himari 0.6.0 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dcb5e4f61b85b69f1ec9b36205664930ab488c46d4bc1f0800a3481926092d2b
-  data.tar.gz: eacc822fbf0ccb630a42dae0e7c130122980da8875480132047d23378e88b83a
+  metadata.gz: f986e727b538f1f6f512f6787e7546e1ebdaa942398053966d52db1383135fc8
+  data.tar.gz: a300ee5b77dc2e1f7c5befbae719876cc60f08a742d97c43f71bdd44fb170adc
 SHA512:
-  metadata.gz: 125693e2f92b453fffd5bf5d1f0b34bce0e5f29e2c86ac8e6b068ce3d223d4ee4abda646c99165653a01bc2304d496ac7a26779553659afca7501acef247fc05
-  data.tar.gz: 1227491aa891bbaa40c3db1c144bf2ceb429941206cf859f799f409623854c4a099613883579739b1c6ff6f7ee1fef47038063b1f8dc3f313e477a10f8a71ba9
+  metadata.gz: 1bf93eaa1f6f98c45ec2649278ccb571f26a530f7b5b4d6c35d0b15e250861f9fc7e6efdb7f3c77de9abd177330b86970d9b1de29df2a0cdb4c4d65f33933fb0
+  data.tar.gz: 033b8dfa409cea02e7ddd73a6369c261e0d79402ab7a82cab49cbffafc654b12bb08dabd42b824382d4143b426d2749117014b94e96bd4d1b67de7e2ca8e37ef

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.7.0] - 2026-06-06
+
+### Enhancements
+
+- Authorization Server Issuer Identification (RFC 9207): the authorization endpoint now returns the `iss` parameter in all authorization responses (success and redirected errors), and discovery metadata advertises `authorization_response_iss_parameter_supported`
+
 ## [0.6.0] - 2026-06-03
 
 ### Enhancements

data/lib/himari/app.rb

@@ -200,6 +200,7 @@ module Himari
           authz: authz,
           client: client,
           storage: config.storage,
+          issuer: config.issuer,
           consent: consent,
           logger: logger,
         ).call(env)

data/lib/himari/rack_oauth2_ext.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require 'rack/oauth2'
+
+module Himari
+  # RFC 9207 Authorization Server Issuer Identification, implemented as extensions to rack-oauth2.
+  #
+  # rack-oauth2 builds the grant redirect from the response object handed to the authorization
+  # endpoint block, but constructs and finishes error redirects internally (Authorize#_call rescues
+  # and calls e.finish), so those error objects are out of reach. Instead we teach rack-oauth2 to
+  # carry an `iss` through both: the issuer is set on the request/response, and the response classes
+  # merge it into their protocol_params (the parameters rack-oauth2 places on the redirect). Errors
+  # copy it from the request the same way they copy state/redirect_uri.
+  module RackOAuth2Ext
+    # Carried by the grant response; always emitted because the grant is always a redirect.
+    # Prepended onto the base response so every response type (Code::Response calls super) gains the
+    # `iss` accessor, including the response objects the loaded extensions hand to the endpoint block.
+    module IssuerParam
+      attr_accessor :iss
+
+      def protocol_params
+        super.merge(iss:)
+      end
+    end
+
+    # Carried by error responses, but only emitted when the error is actually delivered to the
+    # client via redirect. RFC 9207 covers authorization responses, not the JSON error bodies
+    # rack-oauth2 returns directly to the user agent when there is no trusted redirect_uri.
+    module ErrorIssuerParam
+      attr_accessor :iss
+
+      def protocol_params
+        redirect? ? super.merge(iss:) : super
+      end
+    end
+
+    # rack-oauth2 stamps state and redirect_uri from the request onto every error it raises; thread
+    # the issuer along the same path so ErrorIssuerParam has a value to emit.
+    module RequestIssuer
+      attr_accessor :iss
+
+      private def error!(klass, error, description, options)
+        super
+      rescue Rack::OAuth2::Server::Abstract::Error => e
+        e.iss = iss if e.respond_to?(:iss=)
+        raise e
+      end
+    end
+
+    Rack::OAuth2::Server::Authorize::Response.prepend(IssuerParam)
+    Rack::OAuth2::Server::Authorize::Request.prepend(RequestIssuer)
+    [
+      Rack::OAuth2::Server::Authorize::BadRequest,
+      Rack::OAuth2::Server::Authorize::ServerError,
+      Rack::OAuth2::Server::Authorize::TemporarilyUnavailable,
+    ].each { |klass| klass.prepend(ErrorIssuerParam) }
+  end
+end

data/lib/himari/services/oidc_authorization_endpoint.rb

@@ -4,6 +4,8 @@ require 'rack/oauth2'
 require 'digest/sha2'
 require 'openid_connect'
 
+require 'himari/rack_oauth2_ext'
+
 module Himari
   module Services
     class OidcAuthorizationEndpoint
@@ -26,12 +28,14 @@ module Himari
       # @param authz [Himari::AuthorizationCode] pending (unpersisted) authz data
       # @param client [Himari::ClientRegistration]
       # @param storage [Himari::Storages::Base]
+      # @param issuer [String] issuer identifier, returned to the client as the RFC 9207 `iss` parameter
       # @param consent [:approve, :deny, nil] the user's consent decision (nil = not yet asked)
       # @param logger [Logger]
-      def initialize(authz:, client:, storage:, consent: nil, logger: nil)
+      def initialize(authz:, client:, storage:, issuer:, consent: nil, logger: nil)
         @authz = authz
         @client = client
         @storage = storage
+        @issuer = issuer
         @consent = consent
         @logger = logger
       end
@@ -47,6 +51,11 @@ module Himari
 
       def app(env)
         Rack::OAuth2::Server::Authorize.new do |req, res|
+          # RFC 9207: hand the issuer to rack-oauth2 so both the grant response and any error it
+          # redirects back to the client carry the `iss` parameter (see Himari::RackOAuth2Ext).
+          req.iss = @issuer
+          res.iss = @issuer
+
           # sanity check
           unless @client.id == req.client_id
             @logger&.warn(Himari::LogLine.new('OidcAuthorizationEndpoint: @client.id != req.client_id', req: env['himari.request_as_log'], known_client: @client.id, given_client: req.client_id))

data/lib/himari/services/oidc_provider_metadata_endpoint.rb

@@ -60,6 +60,7 @@ module Himari
             subject_types_supported: ['public'],
             id_token_signing_alg_values_supported: signing_keys.map(&:alg).uniq.sort,
             claims_supported: (DEFAULT_CLAIMS_SUPPORTED + @claims_supported).uniq,
+            authorization_response_iss_parameter_supported: true, # RFC 9207
           }.compact
         end
 

data/lib/himari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Himari
-  VERSION = "0.6.0"
+  VERSION = "0.7.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: himari
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.7.0
 platform: ruby
 authors:
 - Sorah Fukumori
@@ -160,6 +160,7 @@ files:
 - lib/himari/middlewares/metadata_clients.rb
 - lib/himari/middlewares/signing_key.rb
 - lib/himari/provider_chain.rb
+- lib/himari/rack_oauth2_ext.rb
 - lib/himari/refresh_token.rb
 - lib/himari/rule.rb
 - lib/himari/rule_processor.rb