himari 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d532b382f36d5465772fc09e18feebf0a29db47365e2f5fbd3e83cec7eaa6c4b
-  data.tar.gz: cf9632d941835355bea9cde2435ad6e9993cb278d306e8d5888fc804053cce32
+  metadata.gz: 5b8557a7f7d75db91d61c20e931bfa9d05d832541b4fb9fdc05055491568e4ec
+  data.tar.gz: c50b5396fa19b2c03b2b4115d495f3f96a688016a4c8d3fb9b1833ef10de13b7
 SHA512:
-  metadata.gz: bb564663bea0c6c39cc0a81d4db848f1e7142b9e2d89ddc34d4b2550d99c44dfc6340dddc239d701ac53d53f762519388095a7806b68d29b675215785cbaf90a
-  data.tar.gz: db75ed71b1daef3ae8d3ebbcdf85518c27b9be0fea0a3cc18ca7906271253ac16abc6635c44c5f1b03d3e2a6c3354d02611133e6d71ac4a3e5d6019f756bce47
+  metadata.gz: eac9157e67de6f6c2538b36f7d6a55e62f1d3a7e3837e72a23d0b6d407a40a2004f7a7fee8c71b036c709daf6be970a75ae45118c116bbd4ab1a085eb23af137
+  data.tar.gz: b40f7ed7a033f312871a191398ba1d74f376c89d634666b4b076a05666a66309d8886d0bd3d441144d1fea781847e6f020fa9ec39a079ac1ef3f48f9f332efba

data/lib/himari/access_token.rb

@@ -44,6 +44,11 @@ module Himari
 
     attr_reader :handle, :client_id, :claims, :expiry
 
+    def userinfo
+      claims.merge(
+        aud: client_id,
+      )
+    end
 
     def to_bearer
       Bearer.new(

data/lib/himari/client_registration.rb

@@ -2,19 +2,20 @@ require 'digest/sha2'
 
 module Himari
   class ClientRegistration
-    def initialize(name:, id:, secret: nil, secret_hash: nil, redirect_uris:, preferred_key_group: nil)
+    def initialize(name:, id:, secret: nil, secret_hash: nil, redirect_uris:, preferred_key_group: nil, require_pkce: false)
       @name = name
       @id = id
       @secret = secret
       @secret_hash = secret_hash
       @redirect_uris = redirect_uris
       @preferred_key_group = preferred_key_group
+      @require_pkce = require_pkce
 
       raise ArgumentError, "name starts with '_' is reserved" if @name&.start_with?('_')
       raise ArgumentError, "either secret or secret_hash must be present" if !@secret && !@secret_hash
     end
 
-    attr_reader :name, :id, :redirect_uris, :preferred_key_group
+    attr_reader :name, :id, :redirect_uris, :preferred_key_group, :require_pkce
 
     def secret_hash
       @secret_hash ||= Digest::SHA384.hexdigest(secret)

data/lib/himari/services/oidc_authorization_endpoint.rb

@@ -58,6 +58,8 @@ module Himari
               @authz.code_challenge = req.code_challenge
               @authz.code_challenge_method = req.code_challenge_method || 'plain'
               next req.bad_request!(:invalid_request, 'Invalid PKCE parameters') unless @authz.pkce_valid_request?
+            elsif @client.require_pkce
+              next req.bad_request!(:invalid_request, 'PKCE is mandatory')
             end
 
             @storage.put_authorization(@authz)

data/lib/himari/services/oidc_token_endpoint.rb

@@ -57,11 +57,19 @@ module Himari
               @logger&.warn(Himari::LogLine.new('OidcTokenEndpoint: invalid_grant, expired grant', req: env['himari.request_as_log'], client: client.as_log, grant: authz.as_log))
               next req.invalid_grant! 
             end
-            if authz.pkce? && !req.verify_code_verifier!(authz.code_challenge, authz.code_challenge_method)
-              # :nocov:
-              @logger&.warn(Himari::LogLine.new('OidcTokenEndpoint: invalid_grant, invalid pkce', req: env['himari.request_as_log'], client: client.as_log, grant: authz.as_log))
+
+            if authz.pkce?
+              if req.verify_code_verifier!(authz.code_challenge, authz.code_challenge_method)
+                # do nothing
+              else
+                # :nocov:
+                @logger&.warn(Himari::LogLine.new('OidcTokenEndpoint: invalid_grant, invalid pkce', req: env['himari.request_as_log'], client: client.as_log, grant: authz.as_log))
+                next req.invalid_grant!
+                # :nocov:
+              end
+            elsif client.require_pkce
+              @logger&.warn(Himari::LogLine.new('OidcTokenEndpoint: invalid_grant, pkce is mandatory', req: env['himari.request_as_log'], client: client.as_log, grant: authz.as_log))
               next req.invalid_grant!
-              # :nocov:
             end
 
             token = AccessToken.from_authz(authz)

data/lib/himari/services/oidc_userinfo_endpoint.rb

@@ -45,7 +45,7 @@ module Himari
           [
             200,
             {'Content-Type' => 'application/json; charset=utf-8'},
-            [JSON.pretty_generate(token.claims), "\n"],
+            [JSON.pretty_generate(token.userinfo), "\n"],
           ]
         rescue InvalidToken, Himari::TokenString::SecretIncorrect, Himari::TokenString::InvalidFormat, Himari::TokenString::TokenExpired => e
           @logger&.warn(Himari::LogLine.new('OidcUserinfoEndpoint: invalid_token', req: @env['himari.request_as_log'], err: e.class.inspect, token: token&.as_log))

data/lib/himari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Himari
-  VERSION = "0.4.0"
+  VERSION = "0.5.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: himari
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Sorah Fukumori
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-03-26 00:00:00.000000000 Z
+date: 2024-05-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sinatra
@@ -166,7 +166,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
+rubygems_version: 3.4.6
 signing_key:
 specification_version: 4
 summary: Small OIDC IdP for small teams - Omniauth to OIDC