hydra-keycloak-client 0.1.13 → 0.1.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6b9fb72f474785e45fca86279c8a7877f73605bf3da22507a801ef7458f107b1
-  data.tar.gz: cc12951887ddd3f14aa662788b36c06d41095934707be9a4fe1ba685b8b1afa1
+  metadata.gz: e44c13e82949716bb5f91393dab600335b8c5d201065edff00b286084f15399d
+  data.tar.gz: 23662cc9f3ffdd48f77c1d05baeff95ea72af6681a5813cd46f22d155c532b1d
 SHA512:
-  metadata.gz: 5b026319391803ea1da1bee4bd47eb019a6c99ca48abd4a330353cdf55285378d1ef7d57f38d42520b59499962bbc393e6d17a1ed4b78e18087dc8e892d69ab5
-  data.tar.gz: 2bf4d76068843e4e82bb65c86653b04ed506d373f14990b77991f8c1064f1e193967c39a265536b364228bf1afa6bd4d2ad77f74201488f0d0d7e124c5c130b0
+  metadata.gz: b9fb3fe92fc2c065ff622a5dcbea04541a94c2f9bb0bac1a3d0b7f34af058f1801869a068d8720937fbd38cb349fc3b4a707a72c7a9a43f0763aa74c3fe5fd33
+  data.tar.gz: 0e5ec4ae6acfd1f9ca880f24741077cff808cd9a3d1ffdb1bc27c6db801f6b3d5c36864729401827d7918d341d5d3033e2ed2fe37e226cdc5f1a6522687aebf5

data/.github/workflows/release.yml

@@ -0,0 +1,26 @@
+name: Create release
+
+on:
+  push:
+    tags:
+      - '*'
+
+jobs:
+  deploy:
+    runs-on: self-hosted
+
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Set env
+        run: echo "RELEASE_VERSION=${{ github.ref_name }}" >> $GITHUB_ENV
+
+      - name: Build releaser image
+        run: docker build -f Dockerfile.release -t hkc:release .
+
+      - name: Release gem
+        run: |
+          docker run --rm --name hkc_release \
+                     -e RUBYGEMS_TOKEN=${{ secrets.RUBYGEMS_TOKEN }} \
+                     -e RELEASE_VERSION=${{ env.RELEASE_VERSION }} \
+                     hkc:release

data/.gitignore

@@ -1 +1,3 @@
 .rspec_status
+coverage
+.bundle

data/Dockerfile.release

@@ -0,0 +1,11 @@
+FROM ruby:2.7.4
+
+COPY . /app
+
+WORKDIR /app
+
+RUN chmod +x ./release.sh
+
+RUN bundle install
+
+ENTRYPOINT ["./release.sh"]

data/Gemfile

@@ -11,5 +11,7 @@ gem 'rubocop', '~> 1.26'
 
 gem 'pry'
 
+gem 'dalli', require: false, group: :test
+gem 'redis', require: false, group: :test
 gem 'simplecov', require: false, group: :test
 gem 'simplecov-cobertura', require: false, group: :test

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    hydra-keycloak-client (0.1.12)
+    hydra-keycloak-client (0.1.15)
       dry-auto_inject
       dry-container
       dry-monads
@@ -15,6 +15,8 @@ GEM
     ast (2.4.2)
     coderay (1.1.3)
     concurrent-ruby (1.1.10)
+    connection_pool (2.3.0)
+    dalli (3.2.3)
     diff-lcs (1.4.4)
     docile (1.4.0)
     dry-auto_inject (0.9.0)
@@ -22,12 +24,11 @@ GEM
     dry-configurable (0.15.0)
       concurrent-ruby (~> 1.0)
       dry-core (~> 0.6)
-    dry-container (0.9.0)
+    dry-container (0.10.1)
       concurrent-ruby (~> 1.0)
-      dry-configurable (~> 0.13, >= 0.13.0)
-    dry-core (0.7.1)
+    dry-core (0.8.1)
       concurrent-ruby (~> 1.0)
-    dry-inflector (0.2.1)
+    dry-inflector (0.3.0)
     dry-initializer (3.1.1)
     dry-logic (1.2.0)
       concurrent-ruby (~> 1.0)
@@ -63,6 +64,10 @@ GEM
       method_source (~> 1.0)
     rainbow (3.1.1)
     rake (12.3.3)
+    redis (5.0.5)
+      redis-client (>= 0.9.0)
+    redis-client (0.11.2)
+      connection_pool
     regexp_parser (2.2.1)
     rexml (3.2.5)
     rspec (3.10.0)
@@ -105,13 +110,15 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
+  dalli
   hydra-keycloak-client!
   pry
   rake (~> 12.0)
+  redis
   rspec (~> 3.0)
   rubocop (~> 1.26)
   simplecov
   simplecov-cobertura
 
 BUNDLED WITH
-   2.2.25
+   2.3.5

data/lib/hydra/keycloak/client.rb

@@ -12,16 +12,39 @@ module Hydra
   module Keycloak
     class ConfigurationError < ::StandardError; end
 
+    MEMCACHED_SCHEMA = Dry::Schema.JSON do
+      required(:memcached_host).filled(:string)
+      required(:memcached_port).filled(:integer)
+      required(:memcached_namespace).filled(:string)
+    end
+
+    REDIS_SCHEMA = Dry::Schema.JSON do
+      required(:redis_host).filled(:string)
+      required(:redis_port).filled(:integer)
+    end
+
+    CONFIG_SCHEMA = Dry::Schema.JSON do
+      required(:auth_server_url).filled(:string)
+      required(:realm).filled(:string)
+      required(:client_id).filled(:string)
+      required(:redirect_uri).filled(:string)
+      required(:secret).filled(:string)
+      required(:logout_redirect).filled(:string)
+      required(:store_client).value(included_in?: %w[redis memcached])
+      required(:store_client_options).hash(MEMCACHED_SCHEMA | REDIS_SCHEMA)
+      optional(:scope).array(:str?)
+    end
+
     class ClientCreator
       extend ::Hydra::Keycloak::Mixin
 
       class << self
         def call(config:)
-          register_containers(validate_config(config))
+          register_containers(validate_config(config).to_h)
         end
 
         def validate_config(config)
-          validated_config = config_schema.call(config)
+          validated_config = CONFIG_SCHEMA.call(config)
 
           if validated_config.failure?
             raise ConfigurationError, "Wrong configuration params: #{validated_config.errors(full: true).to_h}"
@@ -30,40 +53,8 @@ module Hydra
           validated_config
         end
 
-        def config_schema
-          memcached_schema = ::Hydra::Keycloak::ClientCreator.memcached_schema
-          redis_schema     = ::Hydra::Keycloak::ClientCreator.redis_schema
-          Dry::Schema.JSON do
-            required(:auth_server_url).filled(:string)
-            required(:realm).filled(:string)
-            required(:client_id).filled(:string)
-            required(:redirect_uri).filled(:string)
-            required(:secret).filled(:string)
-            required(:logout_redirect).filled(:string)
-            required(:store_client).value(included_in?: %w[redis memcached])
-            required(:store_client_options).hash(memcached_schema | redis_schema)
-            optional(:scope).array(:str?)
-          end
-        end
-
-        def memcached_schema
-          Dry::Schema.JSON do
-            required(:memcached_host).filled(:string)
-            required(:memcached_port).filled(:integer)
-            required(:memcached_namespace).filled(:string)
-          end
-        end
-
-        def redis_schema
-          Dry::Schema.JSON do
-            required(:redis_host).filled(:string)
-            required(:redis_port).filled(:integer)
-          end
-        end
-
         def register_containers(validated_config)
           register_urls(validated_config)
-          register_queries
           register_store_client(validated_config)
           register_store
           register_code_verifier
@@ -79,42 +70,43 @@ module Hydra
           end
         end
 
-        def register_queries
-          container.register :queries do
-            require 'hydra/keycloak/queries/gateway'
+        def register_store_client(config)
+          case config.fetch(:store_client)
+          when 'redis'
+            register_redis_store(config.fetch(:store_client_options))
+          when 'memcached'
+            register_memcached_store(config.fetch(:store_client_options))
+          end
+        end
+
+        def register_redis_store(redis_host:, redis_port:)
+          require 'hydra/keycloak/store/adapters/redis'
 
-            ::Hydra::Keycloak::Queries::Gateway.new
+          container.register :redis do
+            ::Redis.new(host: redis_host, port: redis_port)
+          end
+
+          container.register :store_client do
+            require 'hydra/keycloak/store/redis_client'
+
+            ::Hydra::Keycloak::Store::RedisClient.new
           end
         end
 
-        def register_store_client(config)
-          case config[:store_client]
-          when 'redis'
-            require 'hydra/keycloak/store/adapters/redis'
+        def register_memcached_store(memcached_host:, memcached_port:, memcached_namespace:)
+          require 'hydra/keycloak/store/adapters/memcached'
 
-            container.register :redis do
-              ::Redis.new(host: config[:redis_host], port: config[:redis_port])
-            end
+          container.register :dalli do
+            ::Dalli::Client.new(
+              "#{memcached_host}:#{memcached_port}",
+              namespace: memcached_namespace
+            )
+          end
 
-            container.register :store_client do
-              require 'hydra/keycloak/store/redis_client'
+          container.register :store_client do
+            require 'hydra/keycloak/store/memcached_client'
 
-              ::Hydra::Keycloak::Store::RedisClient.new
-            end
-          when 'memcached'
-            require 'hydra/keycloak/store/adapters/memcached'
-            container.register :dalli do
-              ::Dalli::Client.new(
-                "#{config[:store_client_options][:memcached_host]}:#{config[:store_client_options][:memcached_port]}",
-                namespace: config[:store_client_options][:memcached_namespace]
-              )
-            end
-
-            container.register :store_client do
-              require 'hydra/keycloak/store/memcached_client'
-
-              ::Hydra::Keycloak::Store::MemcachedClient.new
-            end
+            ::Hydra::Keycloak::Store::MemcachedClient.new
           end
         end
 
@@ -135,7 +127,7 @@ module Hydra
     class Client
       extend ::Hydra::Keycloak::Mixin
       include ::Dry::Monads[:result, :do]
-      inject['urls', 'queries', 'store', 'code_verifier']
+      inject['urls', 'tokens_repo', 'store', 'code_verifier']
 
       def auth_url
         code_verifier.generate
@@ -143,9 +135,23 @@ module Hydra
       end
 
       def authenticate!(auth_code)
-        return Failure(status: 400, code: :auth_code_was_not_received) unless auth_code
+        tokens_repo.get_tokens(auth_code, code_verifier.value).fmap do |tokens|
+          access_token  = tokens[:access_token]
+          id_token      = tokens[:id_token]
+          refresh_token = tokens[:refresh_token]
+
+          session_state = access_token.session_state
+
+          save_token(session_state, 'access_token',  access_token)
+          save_token(session_state, 'id_token',      id_token)
+          save_token(session_state, 'refresh_token', refresh_token)
+
+          session_state
+        end
+      end
 
-        queries.get_tokens(auth_code, code_verifier.value).fmap do |tokens|
+      def authenticate_by_password!(username, password)
+        tokens_repo.get_tokens_by_password(username, password).fmap do |tokens|
           access_token  = tokens[:access_token]
           id_token      = tokens[:id_token]
           refresh_token = tokens[:refresh_token]
@@ -180,7 +186,7 @@ module Hydra
           access_token = yield fetch_token(session_state, 'access_token')
         end
 
-        queries.token_introspect(access_token.source)
+        tokens_repo.introspect_token(access_token.source)
       end
 
       def access_token_jti(session_state)
@@ -198,7 +204,7 @@ module Hydra
       end
 
       def introspect_token(token)
-        queries.token_introspect(token)
+        tokens_repo.introspect_token(token)
       end
 
       private
@@ -229,7 +235,7 @@ module Hydra
 
       def refresh_tokens(session_state)
         refresh_token = yield fetch_token(session_state, 'refresh_token')
-        new_tokens = yield queries.refresh_tokens(refresh_token.source)
+        new_tokens = yield tokens_repo.refresh_tokens(refresh_token.source)
 
         yield save_token(session_state, 'access_token',  new_tokens[:access_token])
         yield save_token(session_state, 'id_token',      new_tokens[:id_token])

data/lib/hydra/keycloak/code_verifier.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require 'base64'
 require 'digest'
 require 'securerandom'
 
@@ -26,7 +27,7 @@ module Hydra
 
       def _generate_pkce(code_verifier)
         # https://datatracker.ietf.org/doc/html/rfc7636#section-4.6
-        Digest::SHA256.base64digest(code_verifier).tr('+/', '-_').tr('=', '')
+        Base64.urlsafe_encode64(Digest::SHA256.digest(code_verifier), padding: false)
       end
     end
   end

data/lib/hydra/keycloak/container.rb

@@ -8,10 +8,22 @@ module Hydra
     class Container
       extend Dry::Container::Mixin
 
-      register(:http_client) do
-        require 'hydra/keycloak/queries/http_client'
+      register(:http) do
+        require 'net/http'
 
-        ::Hydra::Keycloak::Queries::HttpClient.new
+        Net::HTTP
+      end
+
+      register(:tokens_gateway) do
+        require 'hydra/keycloak/tokens/gateway'
+
+        ::Hydra::Keycloak::Tokens::Gateway.new
+      end
+
+      register(:tokens_repo) do
+        require 'hydra/keycloak/tokens/repo'
+
+        ::Hydra::Keycloak::Tokens::Repo.new
       end
     end
 

data/lib/hydra/keycloak/token.rb

@@ -5,21 +5,22 @@ require 'jwt'
 module Hydra
   module Keycloak
     class Token
+      REGISTERED_CLAIMS = %i[iss sub aud exp nbf iat jti].freeze
+      PUBLIC_CLAIMS     = %i[auth_time scope].freeze
+      PRIVATE_CLAIMS    = %i[session_state resource_access].freeze
+
       attr_reader :source,
-                  :exp,
-                  :iat,
-                  :auth_time,
-                  :iss,
-                  :session_state,
-                  :scope,
-                  :jti
+                  :data,
+                  *REGISTERED_CLAIMS,
+                  *PUBLIC_CLAIMS,
+                  *PRIVATE_CLAIMS
 
       def initialize(source)
         @source = source
         @data = ::JWT.decode(source, nil, false).first.transform_keys(&:to_sym)
       end
 
-      %i[exp iat auth_time iss session_state scope jti].each do |field|
+      [*REGISTERED_CLAIMS, *PUBLIC_CLAIMS, *PRIVATE_CLAIMS].each do |field|
         define_method(field) do
           @data.fetch(field)
         end

data/lib/hydra/keycloak/{queries/http_client.rb → tokens/gateway.rb}

@@ -3,13 +3,18 @@
 require 'net/http'
 require 'json'
 require 'dry/monads'
+require 'hydra/keycloak/container'
 
 module Hydra
   module Keycloak
-    module Queries
-      class HttpClient
+    module Tokens
+      class Gateway
+        extend ::Hydra::Keycloak::Mixin
+
         include ::Dry::Monads[:result]
 
+        inject['http']
+
         NETWORK_ERRORS = [Timeout::Error,
                           Errno::EINVAL,
                           Errno::ECONNRESET,
@@ -19,8 +24,8 @@ module Hydra
                           Net::HTTPHeaderSyntaxError,
                           Net::ProtocolError].freeze
 
-        def do_post_request(path, body)
-          response = Net::HTTP.post_form(URI(path), **body)
+        def post(path, body)
+          response = http.post_form(URI(path), **body)
 
           if response.code == '200'
             json = JSON.parse(response.body)

data/lib/hydra/keycloak/{queries/gateway.rb → tokens/repo.rb}

@@ -7,15 +7,19 @@ require 'hydra/keycloak/token'
 
 module Hydra
   module Keycloak
-    module Queries
-      class Gateway
+    module Tokens
+      class Repo
         extend ::Hydra::Keycloak::Mixin
         include ::Dry::Monads[:result]
-        inject['http_client', 'urls']
+        inject['tokens_gateway', 'urls']
 
         def get_tokens(auth_code, code_verifier)
-          result = make_request(urls.token_endpoint,
-                                urls.token_request_body(auth_code, code_verifier))
+          return Failure(status: 400, code: :auth_code_was_not_received) unless auth_code
+
+          result = tokens_gateway.post(
+            urls.token_endpoint,
+            urls.auth_code_token_request_body(auth_code, code_verifier)
+          )
 
           result.fmap do |tokens|
             {
@@ -26,9 +30,28 @@ module Hydra
           end
         end
 
-        def token_introspect(token)
-          make_request(urls.introspection_endpoint,
-                       urls.introspection_request_body(token)).bind do |result|
+        def get_tokens_by_password(username, password)
+          return Failure(status: 400, code: :username_or_password_is_empty) if username.nil? || password.nil?
+
+          result = tokens_gateway.post(
+            urls.token_endpoint,
+            urls.password_token_request_body(username, password)
+          )
+
+          result.fmap do |tokens|
+            {
+              access_token: ::Hydra::Keycloak::Token.new(tokens['access_token']),
+              id_token: ::Hydra::Keycloak::Token.new(tokens['id_token']),
+              refresh_token: ::Hydra::Keycloak::Token.new(tokens['refresh_token'])
+            }
+          end
+        end
+
+        def introspect_token(token)
+          tokens_gateway.post(
+            urls.introspection_endpoint,
+            urls.introspection_request_body(token)
+          ).bind do |result|
             if result['active']
               Success(result)
             else
@@ -38,8 +61,10 @@ module Hydra
         end
 
         def refresh_tokens(refresh_token)
-          make_request(urls.token_endpoint,
-                       urls.refresh_request_body(refresh_token)).bind do |result|
+          tokens_gateway.post(
+            urls.token_endpoint,
+            urls.refresh_request_body(refresh_token)
+          ).bind do |result|
             if result['error']
               Failure(status: 400, code: :token_refreshing_error)
             else
@@ -51,12 +76,6 @@ module Hydra
             end
           end
         end
-
-        private
-
-        def make_request(path, body)
-          http_client.do_post_request(path, body)
-        end
       end
     end
   end

data/lib/hydra/keycloak/urls.rb

@@ -10,22 +10,26 @@ module Hydra
       end
 
       def auth_url(code_challenge)
-        "#{@config[:auth_server_url]}" \
-          "realms/#{@config[:realm]}/protocol/openid-connect/auth/?" \
-          'response_type=code&' \
-          "client_id=#{@config[:client_id]}&" \
-          "redirect_uri=#{@config[:redirect_uri]}&" \
-          "nonce=#{@config[:secret]}&" \
-          "scope=#{scope}&" \
-          "code_challenge=#{code_challenge}&" \
-          'code_challenge_method=S256'
+        URI(URI.join(@config[:auth_server_url], "realms/#{@config[:realm]}/protocol/openid-connect/auth")).tap do |uri|
+          uri.query = URI.encode_www_form(
+            {
+              response_type: 'code',
+              client_id: @config[:client_id],
+              redirect_uri: @config[:redirect_uri],
+              nonce: @config[:secret],
+              scope: scope,
+              code_challenge: code_challenge,
+              code_challenge_method: 'S256'
+            }
+          )
+        end.to_s
       end
 
       def token_endpoint
-        "#{@config[:auth_server_url]}realms/#{@config[:realm]}/protocol/openid-connect/token"
+        URI.join(@config[:auth_server_url], "realms/#{@config[:realm]}/protocol/openid-connect/token")
       end
 
-      def token_request_body(auth_code, code_verifier)
+      def auth_code_token_request_body(auth_code, code_verifier)
         {
           grant_type: 'authorization_code',
           code: auth_code,
@@ -36,8 +40,19 @@ module Hydra
         }
       end
 
+      def password_token_request_body(username, password)
+        {
+          grant_type: 'password',
+          username: username,
+          password: password,
+          scope: scope,
+          client_id: @config[:client_id],
+          client_secret: @config[:secret]
+        }
+      end
+
       def introspection_endpoint
-        "#{@config[:auth_server_url]}realms/#{@config[:realm]}/protocol/openid-connect/token/introspect"
+        URI.join(@config[:auth_server_url], "realms/#{@config[:realm]}/protocol/openid-connect/token/introspect")
       end
 
       def introspection_request_body(token)
@@ -50,9 +65,9 @@ module Hydra
       end
 
       def end_session_url(id_token)
-        "#{@config[:auth_server_url]}realms/#{@config[:realm]}/protocol/openid-connect/logout" \
-        "?id_token_hint=#{id_token}" \
-        "&post_logout_redirect_uri=#{@config[:logout_redirect]}"
+        URI.join(@config[:auth_server_url], "realms/#{@config[:realm]}/protocol/openid-connect/logout").tap do |uri|
+          uri.query = URI.encode_www_form(id_token_hint: id_token, post_logout_redirect_uri: @config[:logout_redirect])
+        end.to_s
       end
 
       def refresh_request_body(refresh_token)
@@ -68,7 +83,7 @@ module Hydra
       private
 
       def scope
-        (DEFAULT_SCOPE + @config[:scope]).join('%20')
+        [*DEFAULT_SCOPE, *@config[:scope]].join(' ')
       end
     end
   end

data/lib/hydra/keycloak/version.rb

@@ -2,6 +2,6 @@
 
 module Hydra
   module Keycloak
-    VERSION = '0.1.13'
+    VERSION = '0.1.15'
   end
 end

data/release.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+mkdir -p $HOME/.gem
+touch $HOME/.gem/credentials
+chmod 0600 $HOME/.gem/credentials
+printf -- "---\n:rubygems_api_key: $RUBYGEMS_TOKEN\n" > $HOME/.gem/credentials
+
+gem build hydra-keycloak-client.gemspec
+gem push hydra-keycloak-client-$RELEASE_VERSION.gem

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hydra-keycloak-client
 version: !ruby/object:Gem::Version
-  version: 0.1.13
+  version: 0.1.15
 platform: ruby
 authors:
 - Fedor Kosolapov
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-10-31 00:00:00.000000000 Z
+date: 2022-12-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt
@@ -104,9 +104,11 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".github/workflows/main.yml"
+- ".github/workflows/release.yml"
 - ".gitignore"
 - ".rspec"
 - ".rubocop.yml"
+- Dockerfile.release
 - Dockerfile.test
 - Gemfile
 - Gemfile.lock
@@ -118,16 +120,17 @@ files:
 - lib/hydra/keycloak/client.rb
 - lib/hydra/keycloak/code_verifier.rb
 - lib/hydra/keycloak/container.rb
-- lib/hydra/keycloak/queries/gateway.rb
-- lib/hydra/keycloak/queries/http_client.rb
 - lib/hydra/keycloak/store/adapters/memcached.rb
 - lib/hydra/keycloak/store/adapters/redis.rb
 - lib/hydra/keycloak/store/gateway.rb
 - lib/hydra/keycloak/store/memcached_client.rb
 - lib/hydra/keycloak/store/redis_client.rb
 - lib/hydra/keycloak/token.rb
+- lib/hydra/keycloak/tokens/gateway.rb
+- lib/hydra/keycloak/tokens/repo.rb
 - lib/hydra/keycloak/urls.rb
 - lib/hydra/keycloak/version.rb
+- release.sh
 - run_tests.sh
 homepage: https://github.com/hydra-billing/hydra-keycloak-client
 licenses: []
@@ -136,7 +139,7 @@ metadata:
   homepage_uri: https://github.com/hydra-billing/hydra-keycloak-client
   source_code_uri: https://github.com/hydra-billing/hydra-keycloak-client
   changelog_uri: https://github.com/hydra-billing/hydra-keycloak-client
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -152,7 +155,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.1.6
-signing_key:
+signing_key: 
 specification_version: 4
 summary: Keycloak client for SSO
 test_files: []