fridge 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 14721d992f4d97d606aa10ea94c061553328292f
+  data.tar.gz: 377c3b2543822ebdeea357a4e9ead8bd45ca4938
+SHA512:
+  metadata.gz: 556a8a8805c2402d1accabe75bcc860a23659f528eaca8cf84868c12524ff0893312e6ef3b02e418705c4bdfe7601a3ab75d68ead2df8fa74b00d07624016cd8
+  data.tar.gz: 33936c9085ebf03959a4a7a6d6ad7d8d53377e3899e3008e56191ef401c1cf3da9a0edbe2799cfdd3e417ae30cc64d5b222a03167348c94251004851728ee532

data/.gitignore

@@ -0,0 +1,17 @@
+*.gem
+*.rbc
+.bundle
+.config
+.yardoc
+Gemfile.lock
+InstalledFiles
+_yardoc
+coverage
+doc/
+lib/bundler/man
+pkg
+rdoc
+spec/reports
+test/tmp
+test/version_tmp
+tmp

data/.rspec

@@ -0,0 +1,2 @@
+--color
+--format documentation

data/.travis.yml

@@ -0,0 +1,3 @@
+rvm:
+  - 2.0.0
+  - jruby

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in fridge.gemspec
+gemspec

data/LICENSE.md

@@ -0,0 +1,22 @@
+Copyright (c) 2014 Aptible, Inc.
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,83 @@
+# ![](https://raw.github.com/aptible/straptible/master/lib/straptible/rails/templates/public.api/icon-60px.png) Fridge
+
+[![Gem Version](https://badge.fury.io/rb/fridge.png)](https://rubygems.org/gems/fridge)
+[![Build Status](https://travis-ci.org/aptible/fridge.png?branch=master)](https://travis-ci.org/aptible/fridge)
+[![Dependency Status](https://gemnasium.com/aptible/fridge.png)](https://gemnasium.com/aptible/fridge)
+
+Token validation for distributed resource servers.
+
+## Installation
+
+Add the following line to your application's Gemfile.
+
+    gem 'fridge'
+
+And then run `bundle install`.
+
+## Usage
+
+### Configuration
+
+| Parameter | Description | Possible Values |
+| --------- | ----------- | --------------- |
+| `private_key` | Private token signing key | A PEM-formatted key |
+| `public_key` | Public token verification key (the private key's complement) | A PEM-formatted key |
+| `signing_algorithm` | Algorithm to use for sigining and verification | `RS512`, `RS256` |
+| `validator` | A lambda used to perform custom validation of tokens  | Any `Proc` |
+
+Resource servers must configure a public key corresponding to an authorization server, in order to verify tokens issued by that server. Authorization servers must configure a private key.
+
+By default, public key-verified tokens are considered valid if and only iff they have not expired (i.e., `expires_at > Time.now`). However, some applications may want to perform additional validations. (For example, an authorization server may allow online revocation of tokens before their natural expiration, and need to check the current ). This is possible by configuring a custom validator:
+
+```ruby
+Fridge.configure do |config|
+  config.validator = lambda do |access_token|
+    token = Token.find_by(id: access_token.id)
+    token && !token.revoked?
+  end
+end
+```
+
+The validator will be called with a single argument, the `Fridge::AccessToken` instance.
+
+### Integrating with Fridge from a resource server
+
+From any of your controllers, you may access the following methods:
+
+* `current_token`: The `Fridge::AccessToken` passed via `Authorization` header.
+* `token_subject`: The subject (`:sub`) of the current token.
+* `token_scope`: The scope (`:scope`) of the current token.
+* `session_token`: The `Fridge::AccessToken` stored in the user agent's cookies.
+* `session_subject`: The subject (`:sub`) of the current session token.
+
+
+### Integrating with Fridge from an authorization server
+
+A Fridge access token may be constructed a la the following example:
+
+```ruby
+access_token = Fridge::AccessToken.new(
+  id: '0f1aa5ce-6e93-4812-b3fc-3b7f7b685991',
+  subject: 'https://auth.aptible.com/users/e600a449-b308-4162-ac28-8a2769ad3f05',
+  expires_at: 1.hour.from_now
+)
+```
+
+The only required hash parameters are `:subject` and `:expires_at`. Additionally, you may specify `:id`, `:scope` and `issuer`. To set this token in a cookie that's readable across your entire domain, you may invoke the following command from any Rails controller:
+
+```ruby
+store_session_cookie(access_token)
+```
+
+## Contributing
+
+1. Fork the project.
+1. Commit your changes, with specs.
+1. Ensure that your code passes specs (`rake spec`) and meets Aptible's Ruby style guide (`rake rubocop`).
+1. Create a new pull request on GitHub.
+
+## Copyright and License
+
+MIT License, see [LICENSE](LICENSE.md) for details.
+
+Copyright (c) 2014 [Aptible](https://www.aptible.com), Frank Macreery, and contributors.

data/Rakefile

@@ -0,0 +1,4 @@
+require 'bundler/gem_tasks'
+
+require 'aptible/tasks'
+Aptible::Tasks.load_tasks

data/fridge.gemspec

@@ -0,0 +1,32 @@
+# encoding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+
+require 'English'
+require 'fridge/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = 'fridge'
+  spec.version       = Fridge::VERSION
+  spec.authors       = ['Frank Macreery']
+  spec.email         = ['frank@macreery.com']
+  spec.description   = %q{Token validation for distributed resource servers}
+  spec.summary       = %q{Token validation for distributed resource servers}
+  spec.homepage      = 'https://github.com/aptible/fridge'
+  spec.license       = 'MIT'
+
+  spec.files         = `git ls-files`.split($RS)
+  spec.test_files    = spec.files.grep(/^spec\//)
+  spec.require_paths = ['lib']
+
+  spec.add_dependency 'gem_config'
+  spec.add_dependency 'jwt'
+
+  spec.add_development_dependency 'bundler', '~> 1.5'
+  spec.add_development_dependency 'aptible-tasks'
+  spec.add_development_dependency 'rake'
+  spec.add_development_dependency 'rails'
+  spec.add_development_dependency 'rspec', '~> 2.0'
+  spec.add_development_dependency 'rspec-rails'
+  spec.add_development_dependency 'pry'
+end

data/lib/fridge/access_token.rb

@@ -0,0 +1,102 @@
+require 'jwt'
+
+module Fridge
+  class AccessToken
+    attr_accessor :id, :issuer, :subject, :scope, :expires_at
+
+    def initialize(jwt_or_options = nil)
+      options = case jwt_or_options
+                when String
+                  validate_public_key!
+                  decode_and_verify(jwt_or_options)
+                when Hash then jwt_or_options
+                else {}
+                end
+      options.each do |key, value|
+        instance_variable_set("@#{key}", value)
+      end
+    end
+
+    def serialize
+      validate_parameters!
+      validate_private_key!
+      encode_and_sign
+    end
+
+    def encode_and_sign
+      JWT.encode({
+        id: id,
+        iss: issuer,
+        sub: subject,
+        scope: scope,
+        exp: expires_at.to_i
+      }, private_key, algorithm)
+    rescue
+      raise SerializationError, 'Invalid private key or signing algorithm'
+    end
+
+    def decode_and_verify(jwt)
+      hash = JWT.decode(jwt, public_key)
+      {
+        id: hash['id'],
+        issuer: hash['iss'],
+        subject: hash['sub'],
+        scope: hash['scope'],
+        expires_at: Time.at(hash['exp'])
+      }
+      rescue JWT::DecodeError
+        raise InvalidToken, 'Invalid access token'
+    end
+
+    def valid?
+      !expired?
+    end
+
+    def expired?
+      expires_at.nil? || expires_at < Time.now
+    end
+
+    def private_key
+      return unless config.private_key
+      @private_key ||= OpenSSL::PKey::RSA.new(config.private_key)
+    rescue
+      nil
+    end
+
+    def public_key
+      if config.private_key
+        @public_key ||= OpenSSL::PKey::RSA.new(config.private_key).public_key
+      elsif config.public_key
+        @public_key ||= OpenSSL::PKey::RSA.new(config.public_key)
+      end
+    rescue
+      nil
+    end
+
+    def algorithm
+      config.signing_algorithm
+    end
+
+    def config
+      Fridge.configuration
+    end
+
+    protected
+
+    def validate_parameters!
+      [:subject, :expires_at].each do |attribute|
+        unless send(attribute)
+          fail SerializationError, "Missing attribute: #{attribute}"
+        end
+      end
+    end
+
+    def validate_private_key!
+      fail SerializationError, 'No private key configured' unless private_key
+    end
+
+    def validate_public_key!
+      fail SerializationError, 'No public key configured' unless public_key
+    end
+  end
+end

data/lib/fridge/invalid_token.rb

@@ -0,0 +1,4 @@
+module Fridge
+  class InvalidToken < StandardError
+  end
+end

data/lib/fridge/rails_helpers.rb

@@ -0,0 +1,63 @@
+module Fridge
+  module RailsHelpers
+    def token_scope
+      current_token.scope if current_token
+    end
+
+    def token_subject
+      current_token.subject if current_token
+    end
+
+    def current_token
+      return unless bearer_token
+      @current_token ||= AccessToken.new(bearer_token).tap do |token|
+        validate_token!(token)
+      end
+    end
+
+    def bearer_token
+      header = request.env['HTTP_AUTHORIZATION']
+      header.gsub(/^Bearer /, '') unless header.nil?
+    end
+
+    def session_subject
+      session_token.subject if session_token
+    end
+
+    def session_token
+      return unless cookies[:session_token]
+      @session_token = AccessToken.new(cookies[:session_token]).tap do |token|
+        validate_token!(token)
+      end
+    rescue
+      clear_session_token
+      @session_token = nil
+    end
+
+    def validate_token!(access_token)
+      validator = Fridge.configuration.validator
+      fail InvalidToken unless validator.call(access_token)
+    end
+
+    def store_session_token(access_token)
+      # Ensure that any cookie-persisted tokens are read-only
+      access_token.scope = 'read'
+
+      jwt = access_token.serialize
+      cookies[:session_token] = cookie_options.merge(
+        value: jwt,
+        expires_at: access_token.expires_at
+      )
+    end
+
+    def clear_session_token
+      cookies.delete :session_token, domain: :all
+      nil
+    end
+
+    def cookie_options
+      secure = !Rails.env.development?
+      { domain: :all, secure: secure, httponly: true }
+    end
+  end
+end

data/lib/fridge/railtie.rb

@@ -0,0 +1,9 @@
+require 'fridge/rails_helpers'
+
+module Fridge
+  class Railtie < Rails::Railtie
+    initializer 'fridge.rails_helpers' do
+      ActionController::Base.send :include, RailsHelpers
+    end
+  end
+end

data/lib/fridge/serialization_error.rb

@@ -0,0 +1,4 @@
+module Fridge
+  class SerializationError < StandardError
+  end
+end

data/lib/fridge/version.rb

@@ -0,0 +1,3 @@
+module Fridge
+  VERSION = '0.1.0'
+end

data/lib/fridge.rb

@@ -0,0 +1,24 @@
+require 'gem_config'
+
+require 'fridge/version'
+require 'fridge/access_token'
+require 'fridge/serialization_error'
+require 'fridge/invalid_token'
+
+require 'fridge/railtie' if defined?(Rails)
+
+module Fridge
+  include GemConfig::Base
+
+  with_configuration do
+    has :private_key, classes: [String]
+    has :public_key, classes: [String]
+
+    has :signing_algorithm, values: %w(RS512 RS256), default: 'RS512'
+
+    # A validator must raise an exception or return a false value for an
+    # invalid token
+    has :validator, classes: [Proc],
+                    default: -> (access_token) { access_token.valid? }
+  end
+end

data/spec/fixtures/app.rb

@@ -0,0 +1,24 @@
+require 'active_support/all'
+require 'action_controller'
+require 'action_dispatch'
+
+module Rails
+  class App
+    def env_config
+      {}
+    end
+
+    def routes
+      return @routes if defined?(@routes)
+      @routes = ActionDispatch::Routing::RouteSet.new
+      @routes.draw do
+        resources :posts
+      end
+      @routes
+    end
+  end
+
+  def self.application
+    @app ||= App.new
+  end
+end

data/spec/fixtures/controller.rb

@@ -0,0 +1,5 @@
+require 'fridge/rails_helpers'
+
+class Controller < ActionController::Base
+  include Fridge::RailsHelpers
+end

data/spec/fridge/access_token_spec.rb

@@ -0,0 +1,111 @@
+require 'spec_helper'
+
+describe Fridge::AccessToken do
+  describe '#initialize' do
+    let(:private_key) { OpenSSL::PKey::RSA.new(1024) }
+    let(:public_key) { OpenSSL::PKey::RSA.new(private_key.public_key) }
+
+    before { Fridge.configuration.public_key = public_key.to_s }
+
+    it 'should accept a hash' do
+      access_token = described_class.new(id: 'foobar')
+      expect(access_token.id).to eq 'foobar'
+    end
+
+    it 'should accept a JWT' do
+      jwt = JWT.encode({ id: 'foobar', exp: 0 }, private_key, 'RS512')
+      access_token = described_class.new(jwt)
+      expect(access_token.id).to eq 'foobar'
+    end
+
+    it 'should raise an error on an invalid JWT' do
+      expect { described_class.new('foobar') }.to raise_error
+    end
+
+    it 'should raise an error on an incorrectly signed JWT' do
+      jwt = JWT.encode({ id: 'foobar' }, OpenSSL::PKey::RSA.new(1024), 'RS512')
+      expect { described_class.new(jwt) }.to raise_error Fridge::InvalidToken
+    end
+  end
+
+  describe '#serialize' do
+    let(:options) do
+      {
+        id: SecureRandom.uuid,
+        iss: 'https://auth.aptible.com',
+        subject: "https://auth.aptible.com/users/#{SecureRandom.uuid}",
+        scope: 'read',
+        expires_at: Time.now + 3600
+      }
+    end
+
+    let(:private_key) { OpenSSL::PKey::RSA.new(1024) }
+    let(:public_key) { OpenSSL::PKey::RSA.new(private_key.public_key) }
+
+    before { Fridge.configuration.private_key = private_key.to_s }
+
+    subject { described_class.new(options) }
+
+    it 'should return a JWT comprised of token attributes' do
+      expect(subject.serialize).to eq JWT.encode({
+        id: subject.id,
+        iss: subject.issuer,
+        sub: subject.subject,
+        scope: subject.scope,
+        exp: subject.expires_at.to_i
+      }, private_key, 'RS512')
+    end
+
+    it 'should be verifiable with the application public key' do
+      expect { JWT.decode(subject.serialize, public_key) }.not_to raise_error
+    end
+
+    it 'should be tamper-resistant' do
+      header, _, signature = subject.serialize.split('.')
+      tampered_claim = JWT.base64url_encode({ foo: 'bar' }.to_json)
+      tampered_token = [header, tampered_claim, signature].join('.')
+
+      expect do
+        JWT.decode(tampered_token, public_key)
+      end.to raise_error JWT::DecodeError
+    end
+
+    it 'should represent :exp in seconds since the epoch' do
+      hash = JWT.decode(subject.serialize, public_key)
+      expect(hash['exp']).to be_a Fixnum
+    end
+
+    it 'should be deterministic' do
+      expect(subject.serialize).to eq subject.serialize
+    end
+
+    it 'should complement #initialize' do
+      copy = described_class.new(subject.serialize)
+      expect(copy.subject).to eq subject.subject
+      expect(copy.expires_at.to_i).to eq subject.expires_at.to_i
+      expect(copy.scope).to eq subject.scope
+    end
+
+    it 'should raise an error if required attributes are missing' do
+      subject.subject = nil
+      expect { subject.serialize }.to raise_error Fridge::SerializationError
+    end
+  end
+
+  describe '#expired?' do
+    it 'should return true if the access token has expired' do
+      subject.stub(:expires_at) { Time.now - 3600 }
+      expect(subject).to be_expired
+    end
+
+    it 'should return true if the access token has no expiration set' do
+      subject.stub(:expires_at) { nil }
+      expect(subject).to be_expired
+    end
+
+    it 'should return false otherwise' do
+      subject.stub(:expires_at) { Time.now + 3600 }
+      expect(subject).not_to be_expired
+    end
+  end
+end

data/spec/fridge/rails_helpers_spec.rb

@@ -0,0 +1,126 @@
+require 'spec_helper'
+require 'fixtures/app'
+require 'fixtures/controller'
+require 'rspec/rails'
+
+# http://say26.com/rspec-testing-controllers-outside-of-a-rails-application
+describe Controller, type: :controller do
+  context Fridge::RailsHelpers do
+    let(:private_key) { OpenSSL::PKey::RSA.new(1024) }
+    let(:public_key) { OpenSSL::PKey::RSA.new(private_key.public_key) }
+
+    let(:options) do
+      {
+        subject: "https://auth.aptible.com/users/#{SecureRandom.uuid}",
+        expires_at: Time.now + 3600
+      }
+    end
+    let(:access_token) { Fridge::AccessToken.new(options) }
+
+    let(:cookies) { controller.send(:cookies) }
+
+    before { Fridge.configuration.private_key = private_key.to_s }
+    before { Fridge.configuration.public_key = public_key.to_s }
+
+    describe '#bearer_token' do
+      it 'returns the bearer token from the Authorization: header' do
+        request.env['HTTP_AUTHORIZATION'] = 'Bearer foobar'
+        expect(controller.bearer_token).to eq 'foobar'
+      end
+
+      it 'returns nil in the absence of an Authorization: header' do
+        request.env['HTTP_AUTHORIZATION'] = nil
+        expect(controller.bearer_token).to be_nil
+      end
+    end
+
+    describe '#token_subject' do
+      it 'returns the subject encoded in the token' do
+        controller.stub(:current_token) { access_token }
+        expect(controller.token_subject).to eq access_token.subject
+      end
+
+      it 'returns nil if no token is present' do
+        controller.stub(:current_token) { nil }
+        expect(controller.token_subject).to be_nil
+      end
+    end
+
+    describe '#token_scope' do
+      it 'returns the scope encoded in the token' do
+        controller.stub(:current_token) { access_token }
+        expect(controller.token_scope).to eq access_token.scope
+      end
+
+      it 'returns nil if no token is present' do
+        controller.stub(:current_token) { nil }
+        expect(controller.token_scope).to be_nil
+      end
+    end
+
+    describe '#current_token' do
+      before { controller.stub(:bearer_token) { access_token.serialize } }
+
+      it 'should raise an error if the token is not a valid JWT' do
+        controller.stub(:bearer_token) { 'foobar' }
+        expect { controller.current_token }.to raise_error Fridge::InvalidToken
+      end
+
+      it 'should raise an error if the token has expired' do
+        access_token.expires_at = Time.now - 3600
+        expect { controller.current_token }.to raise_error Fridge::InvalidToken
+      end
+
+      it 'should raise an error if custom validation fails' do
+        Fridge.configuration.validator = -> (token) { false }
+        expect { controller.current_token }.to raise_error Fridge::InvalidToken
+      end
+
+      it 'should not raise an error if a valid token is passed' do
+        expect { controller.current_token }.not_to raise_error
+      end
+
+      it 'should return the token if a valid token is passed' do
+        expect(controller.current_token.id).to eq access_token.id
+      end
+    end
+
+    describe '#session_subject' do
+      it 'returns the subject encoded in the session' do
+        controller.stub(:session_token) { access_token }
+        expect(controller.session_subject).to eq access_token.subject
+      end
+
+      it 'returns nil if no session is present' do
+        controller.stub(:session_token) { nil }
+        expect(controller.session_subject).to be_nil
+      end
+    end
+
+    describe '#session_token' do
+      it 'should delete all cookies on error' do
+        cookies[:session_token] = 'foobar'
+        controller.session_token
+        expect(cookies.deleted?(:session_token, domain: :all)).to be_true
+      end
+
+      it 'should return nil on error' do
+        cookies[:session_token] = 'foobar'
+        expect(controller.session_token).to be_nil
+      end
+
+      it 'should return the token stored in :session_token' do
+        cookies[:session_token] = access_token.serialize
+        expect(controller.session_token.id).to eq access_token.id
+      end
+    end
+
+    describe '#store_session_token' do
+      it 'should set a session cookie' do
+        Rails.stub_chain(:env, :development?) { false }
+        controller.store_session_token(access_token)
+        expect(cookies[:session_token]).to eq access_token.serialize
+      end
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,14 @@
+$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
+$LOAD_PATH.unshift(File.dirname(__FILE__))
+
+# Load shared spec files
+Dir["#{File.dirname(__FILE__)}/shared/**/*.rb"].each do |file|
+  require file
+end
+
+# Require library up front
+require 'fridge'
+
+RSpec.configure do |config|
+  config.before { Fridge.configuration.reset }
+end

metadata

@@ -0,0 +1,195 @@
+--- !ruby/object:Gem::Specification
+name: fridge
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Frank Macreery
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2014-02-08 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: gem_config
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '1.5'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '1.5'
+- !ruby/object:Gem::Dependency
+  name: aptible-tasks
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: rspec-rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: pry
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+description: Token validation for distributed resource servers
+email:
+- frank@macreery.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- .gitignore
+- .rspec
+- .travis.yml
+- Gemfile
+- LICENSE.md
+- README.md
+- Rakefile
+- fridge.gemspec
+- lib/fridge.rb
+- lib/fridge/access_token.rb
+- lib/fridge/invalid_token.rb
+- lib/fridge/rails_helpers.rb
+- lib/fridge/railtie.rb
+- lib/fridge/serialization_error.rb
+- lib/fridge/version.rb
+- spec/fixtures/app.rb
+- spec/fixtures/controller.rb
+- spec/fridge/access_token_spec.rb
+- spec/fridge/rails_helpers_spec.rb
+- spec/spec_helper.rb
+homepage: https://github.com/aptible/fridge
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.2.1
+signing_key: 
+specification_version: 4
+summary: Token validation for distributed resource servers
+test_files:
+- spec/fixtures/app.rb
+- spec/fixtures/controller.rb
+- spec/fridge/access_token_spec.rb
+- spec/fridge/rails_helpers_spec.rb
+- spec/spec_helper.rb