google-auth-token_validator 0.1.0 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 9c85cade77aab2f374eac0dff1223b436a149202
-  data.tar.gz: c7b99dd26296a90cffb992a955a302511ac9427d
+  metadata.gz: cd96722d88bd535c40980ccfe43384424fe2e22e
+  data.tar.gz: 93b4ca75f73ee610991963a859dd16477e7494ce
 SHA512:
-  metadata.gz: 1d8b6992a81e86cb64a17d1bbb037e7199ac4810813ee15f1d53478475c1808c04875d55e7a81144b41e62d47c944acde50430886c8f75497e3275974976dc98
-  data.tar.gz: cc20fbe4694191a04a6d5ad86b9b7ddfe44e02161ecfd96d1dd3b06b025e5fcff147fb69394fd94fe59f8b34750a9d628d3aebe8b9ee50d30438d0f748443588
+  metadata.gz: 896349e1e8045836616665bd4eb91b9b3e2f99367ba882d89459f8e38516d8caefccd2b071a5886efc2476a39673957d9985f81cf59c9c000020ad902f4fb4bb
+  data.tar.gz: b64eca6fef334a4bf27fbf2a270a237ce1e30bfa65b58fbc2d153933885154580d4806fd9cb886a386aa99e8d8f0a0bbba60312efdd6e3295cb47f7517f6f7be

data/.travis.yml

@@ -2,4 +2,5 @@ sudo: false
 language: ruby
 rvm:
   - 2.3.0
-before_install: gem install bundler -v 1.15.1
+before_install: gem install bundler -v 1.16.0.pre.2
+cache: bundler

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+# 0.1.2 - September 17, 2017
+
+- make description more clear
+
+# 0.1.1 - September 17, 2017
+
+- change module nesting syntax (fix)
+
 # 0.1.0 - September 17, 2017
 
 - initial implementation

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    google-auth-token_validator (0.1.0)
+    google-auth-token_validator (0.1.2)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -3,16 +3,16 @@
 [![Build Status](https://travis-ci.org/hamza/google-auth-token-validator-ruby.svg?branch=master)](https://travis-ci.org/hamza/google-auth-token-validator-ruby)
 [![Coverage Status](https://coveralls.io/repos/github/hamza/google-auth-token-validator-ruby/badge.svg?branch=master)](https://coveralls.io/github/hamza/google-auth-token-validator-ruby?branch=master)
 
-The Google Sign-In API gives OAuth2 JSON Web Tokens (JWT) as response data upon user sign-in. A necessary step for a service provider to trust such a token involves validating the token, rather than simply trusting the token, which would allow a malicious client to simply assert itself.
+The Google Sign-In API gives OAuth2 JSON Web Tokens (JWT) as response data upon user sign-in. A necessary step for a service provider to trust such a token is validatation. Accepting the token without validation would allow a malicious client to simply assert itself in your system.
 
-Google provides libraries in several languages (https://goo.gl/jkzS18) to serve this function, as well as an API endpoint that can outsource the task to Google's own servers (thereby introducing an additional network round trip into every authentication step), but a Ruby implementation is missing. This gem fills that gap.
+Google provides [libraries in several languages](https://developers.google.com/identity/sign-in/web/backend-auth) to accomplish this, as well as an API endpoint that can outsource the task to Google's own servers (thereby introducing an additional network round trip into every authentication step), but a Ruby implementation is missing. This gem fills that gap.
 
 ## Installation
 
 Add this line to your application's Gemfile:
 
 ```ruby
-gem 'google-auth-token_validator' # doesn't work yet! stay tuned …
+gem 'google-auth-token_validator'
 ```
 
 And then execute:
@@ -61,7 +61,7 @@ Use the [Google Cloud Console](https://console.cloud.google.com) to set up an OA
 
 ## Contributing
 
-Bug reports and pull requests are welcome on [the repo](https://github.com/hamza/google_signin_token_validator).
+Bug reports and pull requests are welcome on [the repo](https://github.com/hamza/google-auth-token-validator-ruby/issues).
 
 ## License
 

data/google-auth_token_validator.gemspec

@@ -14,11 +14,11 @@ Gem::Specification.new do |spec|
   spec.summary       = "Ruby gem to validate signed JSON Web Tokens from Google's sign-in API"
   spec.description   = <<-DESC
     The Google Sign-In API gives OAuth2 JSON Web Tokens (JWT) as response data upon user sign-in.
-    A necessary step for a service provider to trust such a token involves validating the token,
-    rather than simply trusting the token, which would allow a malicious client to simply assert
-    itself.
+    A necessary step for a service provider to trust such a token is validatation. Accepting the
+    token without validation would allow a malicious client to simply assert itself in your system.
+    \n\n
 
-    Google provides libraries in several languages (https://goo.gl/jkzS18) to serve this function,
+    Google provides libraries in several languages (https://goo.gl/jkzS18) to accomplish this,
     as well as an API endpoint that can outsource the task to Google's own servers (thereby
     introducing an additional network round trip into every authentication step), but a Ruby
     implementation is missing. This gem fills that gap.

data/lib/googleauth/token_validator.rb

@@ -3,85 +3,89 @@ require "json"
 require "base64"
 require "openssl"
 
-class Google::Auth::TokenValidator
-  GOOGLE_SIGNON_CERTS_URL    = "https://www.googleapis.com/oauth2/v1/certs".freeze
-  ISSUERS                    = %w(accounts.google.com https://accounts.google.com).freeze
-  CLOCK_SKEW_SECONDS         = 300 # five minutes
-  MAX_TOKEN_LIFETIME_SECONDS = 86400 # one day
+module Google
+  module Auth
+    class TokenValidator
+      GOOGLE_SIGNON_CERTS_URL    = "https://www.googleapis.com/oauth2/v1/certs".freeze
+      ISSUERS                    = %w(accounts.google.com https://accounts.google.com).freeze
+      CLOCK_SKEW_SECONDS         = 300 # five minutes
+      MAX_TOKEN_LIFETIME_SECONDS = 86400 # one day
 
-  attr_reader :signed, :signature, :envelope, :payload, :client_id
+      attr_reader :signed, :signature, :envelope, :payload, :client_id
 
-  def initialize jwt, client_id
-    segments = jwt.split(".")
+      def initialize jwt, client_id
+        segments = jwt.split(".")
 
-    fail Error, "Wrong number of segments in token: #{jwt}" unless segments.size.eql? 3
+        fail Error, "Wrong number of segments in token: #{jwt}" unless segments.size.eql? 3
 
-    @client_id = client_id
+        @client_id = client_id
 
-    @signed = "#{segments[0]}.#{segments[1]}"
-    @signature = segments[2]
+        @signed = "#{segments[0]}.#{segments[1]}"
+        @signature = segments[2]
 
-    @envelope = JSON.parse Base64.decode64(segments[0])
-    @payload = JSON.parse Base64.decode64(segments[1])
-  end
+        @envelope = JSON.parse Base64.decode64(segments[0])
+        @payload = JSON.parse Base64.decode64(segments[1])
+      end
 
-  def validate max_expiry = MAX_TOKEN_LIFETIME_SECONDS
-    unless [@signed, @signature, @envelope, @payload].all?
-      fail Error, "Validator was not properly initialized"
-    end
+      def validate max_expiry = MAX_TOKEN_LIFETIME_SECONDS
+        unless [@signed, @signature, @envelope, @payload].all?
+          fail Error, "Validator was not properly initialized"
+        end
 
-    unless self.class._certs.keys.include? @envelope["kid"]
-      fail Error, "No matching Google cert found for envelope: #{@envelope}"
-    end
+        unless self.class._certs.keys.include? @envelope["kid"]
+          fail Error, "No matching Google cert found for envelope: #{@envelope}"
+        end
 
-    pem = self.class._certs[envelope["kid"]]
-    cert = OpenSSL::X509::Certificate.new pem
-    digest = OpenSSL::Digest::SHA256.new
+        pem = self.class._certs[envelope["kid"]]
+        cert = OpenSSL::X509::Certificate.new pem
+        digest = OpenSSL::Digest::SHA256.new
 
-    verified = cert.public_key.verify(digest, Base64.urlsafe_decode64(@signature), @signed)
+        verified = cert.public_key.verify(digest, Base64.urlsafe_decode64(@signature), @signed)
 
-    fail Error, "Token signature invalid" unless verified
+        fail Error, "Token signature invalid" unless verified
 
-    fail Error, "No issue time in token" if @payload["iat"].to_s.empty?
-    fail Error, "No expiration time in token" if @payload["exp"].to_s.empty?
+        fail Error, "No issue time in token" if @payload["iat"].to_s.empty?
+        fail Error, "No expiration time in token" if @payload["exp"].to_s.empty?
 
-    now      = Time.now.to_i
-    earliest = @payload["iat"] - CLOCK_SKEW_SECONDS
-    latest   = @payload["exp"] + CLOCK_SKEW_SECONDS
+        now      = Time.now.to_i
+        earliest = @payload["iat"] - CLOCK_SKEW_SECONDS
+        latest   = @payload["exp"] + CLOCK_SKEW_SECONDS
 
-    fail Error, "Expiration time too far in future" if @payload["exp"] >= Time.now.to_i + max_expiry
-    fail Error, "Token used too early" if now < earliest
-    fail Error, "Token used too late" if now > latest
+        fail Error, "Expiration time too far in future" if @payload["exp"] >= Time.now.to_i + max_expiry
+        fail Error, "Token used too early" if now < earliest
+        fail Error, "Token used too late" if now > latest
 
-    unless ISSUERS.include? @payload["iss"]
-      fail Error, "Invalid issuer. Expected one of #{ISSUERS}, but got #{@payload["iss"]}"
-    end
+        unless ISSUERS.include? @payload["iss"]
+          fail Error, "Invalid issuer. Expected one of #{ISSUERS}, but got #{@payload["iss"]}"
+        end
 
-    if @client_id.is_a? Array
-      aud_verified = @client_id.include?(@payload["aud"])
-    elsif @client_id.is_a? String
-      aud_verified = @payload["aud"] == @client_id
-    else
-      fail Error, "Invalid client id(s)"
-    end
+        if @client_id.is_a? Array
+          aud_verified = @client_id.include?(@payload["aud"])
+        elsif @client_id.is_a? String
+          aud_verified = @payload["aud"] == @client_id
+        else
+          fail Error, "Invalid client id(s)"
+        end
 
-    unless aud_verified
-      fail Error, "Wrong recipient - payload audience doesn't match required audience"
-    end
+        unless aud_verified
+          fail Error, "Wrong recipient - payload audience doesn't match required audience"
+        end
 
-    return true
-  end
+        return true
+      end
 
-  class << self
-    attr_accessor :_cached_certs
+      class << self
+        attr_accessor :_cached_certs
 
-    def _certs
-      @_cached_certs ||= begin
-        uri = URI(GOOGLE_SIGNON_CERTS_URL)
-        JSON.parse Net::HTTP.get(uri)
+        def _certs
+          @_cached_certs ||= begin
+            uri = URI(GOOGLE_SIGNON_CERTS_URL)
+            JSON.parse Net::HTTP.get(uri)
+          end
+        end
       end
+
+      class Error < StandardError; end
     end
   end
-
-  class Error < StandardError; end
 end

data/lib/googleauth/token_validator/version.rb

@@ -1,7 +1,7 @@
 module Google
   module Auth
     class TokenValidator
-      VERSION = "0.1.0"
+      VERSION = "0.1.2"
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: google-auth-token_validator
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.2
 platform: ruby
 authors:
 - Hamza Tayeb
@@ -94,16 +94,14 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.2'
-description: |2
-      The Google Sign-In API gives OAuth2 JSON Web Tokens (JWT) as response data upon user sign-in.
-      A necessary step for a service provider to trust such a token involves validating the token,
-      rather than simply trusting the token, which would allow a malicious client to simply assert
-      itself.
-
-      Google provides libraries in several languages (https://goo.gl/jkzS18) to serve this function,
-      as well as an API endpoint that can outsource the task to Google's own servers (thereby
-      introducing an additional network round trip into every authentication step), but a Ruby
-      implementation is missing. This gem fills that gap.
+description: "    The Google Sign-In API gives OAuth2 JSON Web Tokens (JWT) as response
+  data upon user sign-in.\n    A necessary step for a service provider to trust such
+  a token is validatation. Accepting the\n    token without validation would allow
+  a malicious client to simply assert itself in your system.\n    \n\n\n\n    Google
+  provides libraries in several languages (https://goo.gl/jkzS18) to accomplish this,\n
+  \   as well as an API endpoint that can outsource the task to Google's own servers
+  (thereby\n    introducing an additional network round trip into every authentication
+  step), but a Ruby\n    implementation is missing. This gem fills that gap.\n"
 email:
 - hamza.tayeb@gmail.com
 executables: []