inst_access 0.4.2 → 0.4.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cbec71c0ed08813dd78884db0a007ea381e8aa6c66eed9f716e2f98979034e2b
-  data.tar.gz: 49f346a1e2caedcd79e0e68e9ab141ce2ec38a6f4f8936181296af43a318d6b9
+  metadata.gz: d5ba1db50c0d9738f9845b2f553e2c3906c9e8bcad0bfb1fbf7d50027b5357f8
+  data.tar.gz: 226f184ea24923d9eb95a836ddb6ee7b03258eed74d070bb2686db85c8075984
 SHA512:
-  metadata.gz: d6884908d27623419e8ac893fd9f101081303c6f0977cb1ef6a7bbdcd38a50f963235620bb59c39b738c67b63d968493b4e555e8d09b9b6e7e7c3e8d151dc6d4
-  data.tar.gz: 6de8f23b7d042a166d4f60b9ff57bfc9d855cc69b2ad9436ec1e278a88908b614f264370f2cde6fc93480e15bdb0bb0a91c5f111c67c680661bf1f077f9a8a7f
+  metadata.gz: 7ab6da2741107934b9d52f168a7d88821b850ee60850d7ab2e190531d08c4e3390822faf25f03a0619e3c311f91215315d51d0eac35e67e7d28562b2f8a690ec
+  data.tar.gz: 0c2058387c8f73dea54577a38691fc5eca384dbaf9cac6d04398fac3ebf49b2d0a239c4dc72b9fa49d5cca6953660102b155bb2e11fb0347cb76e0fb3be08fa2

data/lib/inst_access/config.rb

@@ -22,14 +22,16 @@ require 'openssl'
 
 module InstAccess
   class Config
-    attr_reader :signing_key
+    attr_reader :signing_key, :issuers, :service_jwks
 
-    def initialize(raw_signing_key, raw_encryption_key = nil)
+    def initialize(raw_signing_key, raw_encryption_key = nil, issuers: nil, service_jwks: [])
       @signing_key = OpenSSL::PKey::RSA.new(raw_signing_key)
       if raw_encryption_key
         @encryption_key = OpenSSL::PKey::RSA.new(raw_encryption_key)
         raise ArgumentError, 'the encryption key should be a public RSA key' if @encryption_key.private?
       end
+      @issuers = issuers
+      @service_jwks = service_jwks
     rescue OpenSSL::PKey::RSAError => e
       raise ArgumentError, e
     end

data/lib/inst_access/token.rb

@@ -106,14 +106,15 @@ module InstAccess
         region: nil,
         client_id: nil,
         instructure_service: nil,
-        canvas_shard_id: nil
+        canvas_shard_id: nil,
+        issuer: nil
       )
         raise ArgumentError, 'Must provide user uuid and account uuid' if user_uuid.blank? || account_uuid.blank?
 
         now = Time.now.to_i
 
         payload = {
-          iss: ISSUER,
+          iss: issuer || ISSUER,
           jti: SecureRandom.uuid,
           iat: now,
           exp: now + 1.hour.to_i,
@@ -136,8 +137,17 @@ module InstAccess
 
       # Takes an unencrypted (but signed) token string
       def from_token_string(jws)
+        service_jwks = InstAccess.config.service_jwks
+        jwt = if service_jwks.present?
+          begin
+            JSON::JWT.decode(jws, service_jwks)
+          rescue StandardError
+            nil
+          end
+        end
+
         sig_key = InstAccess.config.signing_key
-        jwt = begin
+        jwt ||= begin
           JSON::JWT.decode(jws, sig_key)
         rescue StandardError => e
           raise InvalidToken, e
@@ -149,7 +159,8 @@ module InstAccess
 
       def token?(string)
         jwt = JSON::JWT.decode(string, :skip_verification)
-        jwt[:iss] == ISSUER
+        InstAccess.configured? && (issuers = InstAccess.config.issuers)
+        issuers&.include?(jwt[:iss]) || jwt[:iss] == ISSUER
       rescue StandardError
         false
       end

data/lib/inst_access/version.rb

@@ -19,5 +19,5 @@
 #
 
 module InstAccess
-  VERSION = '0.4.2'
+  VERSION = '0.4.4'
 end

data/lib/inst_access.rb

@@ -32,15 +32,15 @@ module InstAccess
     # consuming tokens, it can be the RSA public key corresponding to the
     # private key that signed them.
     # encryption_key is only required if you are going to be producing tokens.
-    def configure(signing_key:, encryption_key: nil)
-      @config = Config.new(signing_key, encryption_key)
+    def configure(signing_key:, encryption_key: nil, issuers: nil, service_jwks: nil)
+      @config = Config.new(signing_key, encryption_key, issuers: issuers, service_jwks: service_jwks)
     end
 
     # set a configuration only for the duration of the given block, then revert
     # it.  useful for testing.
-    def with_config(signing_key:, encryption_key: nil)
+    def with_config(signing_key:, encryption_key: nil, issuers: nil, service_jwks: nil)
       old_config = @config
-      configure(signing_key: signing_key, encryption_key: encryption_key)
+      configure(signing_key: signing_key, encryption_key: encryption_key, issuers: issuers, service_jwks: service_jwks)
       yield
     ensure
       @config = old_config
@@ -49,5 +49,9 @@ module InstAccess
     def config
       @config || raise(ConfigError, 'InstAccess is not configured!')
     end
+
+    def configured?
+      @config.present?
+    end
   end
 end

data/spec/inst_access/inst_access_spec.rb

@@ -44,4 +44,16 @@ describe InstAccess do
       end.to raise_error(ArgumentError)
     end
   end
+
+  describe '.configured?' do
+    it 'returns false if not configured' do
+      expect(described_class.configured?).to eq(false)
+    end
+
+    it 'returns true if configured' do
+      InstAccess.with_config(signing_key: signing_priv_key) do
+        expect(described_class.configured?).to eq(true)
+      end
+    end
+  end
 end

data/spec/inst_access/token_spec.rb

@@ -28,10 +28,12 @@ describe InstAccess::Token do
   let(:signing_pub_key) { signing_keypair.public_key.to_s }
   let(:encryption_priv_key) { encryption_keypair.to_s }
   let(:encryption_pub_key) { encryption_keypair.public_key.to_s }
+  let(:issuers) {}
+  let(:issuer) {}
 
-  let(:a_token) { described_class.for_user(user_uuid: 'user-uuid', account_uuid: 'acct-uuid') }
+  let(:a_token) { described_class.for_user(user_uuid: 'user-uuid', account_uuid: 'acct-uuid', issuer: issuer) }
   let(:unencrypted_token) do
-    InstAccess.with_config(signing_key: signing_priv_key) do
+    InstAccess.with_config(signing_key: signing_priv_key, issuers: issuers) do
       a_token.to_unencrypted_token_string
     end
   end
@@ -41,7 +43,7 @@ describe InstAccess::Token do
       expect(described_class.token?('asdf1234stuff')).to eq(false)
     end
 
-    it 'returns false for JWTs from a different issuer' do
+    it 'returns false for JWTs from an issuer not in the list' do
       jwt = JSON::JWT.new(iss: 'bridge').to_s
       expect(described_class.token?(jwt)).to eq(false)
     end
@@ -50,6 +52,31 @@ describe InstAccess::Token do
       expect(described_class.token?(unencrypted_token)).to eq(true)
     end
 
+    context 'with issuers configured' do
+      let(:issuers) { ['token_from_other_service'] }
+      let(:issuer) { 'token_from_other_service' }
+
+      it 'returns true for JWTs from an issuer in the list' do
+        jwt = JSON::JWT.decode(unencrypted_token, :skip_verification)
+        expect(jwt[:iss]).to eq('token_from_other_service')
+        InstAccess.with_config(signing_key: signing_priv_key, issuers: issuers) do
+          expect(described_class.token?(unencrypted_token)).to eq(true)
+        end
+      end
+
+      it 'returns true for JWTs from the default issuer when issuers are configured' do
+        token = described_class.for_user(user_uuid: 'user-uuid', account_uuid: 'acct-uuid')
+        jws = InstAccess.with_config(signing_key: signing_priv_key) do
+          token.to_unencrypted_token_string
+        end
+        jwt = JSON::JWT.decode(jws, :skip_verification)
+        expect(jwt[:iss]).to eq(InstAccess::Token::ISSUER)
+        InstAccess.with_config(signing_key: signing_priv_key, issuers: issuers) do
+          expect(described_class.token?(jws)).to eq(true)
+        end
+      end
+    end
+
     it 'returns true for an expired InstAccess token' do
       token = unencrypted_token # instantiate it to set the expiration
       Timecop.travel(3601) do
@@ -189,6 +216,17 @@ describe InstAccess::Token do
         end.to raise_error(InstAccess::InvalidToken)
       end
     end
+
+    it '.from_token_string decodes a token signed by a key in a configured JSON::JWK::Set' do
+      jwk = JSON::JWK.new(kid: 'token_from_other_service/file_authorization', k: 'hmac_secret', kty: 'oct')
+      payload = { sub: 'user-uuid', account_uuid: 'acct-uuid', issuer: 'other_service', exp: 5.minutes.from_now }
+      jws = JSON::JWT.new(payload).sign(jwk).to_s
+      jwk_set = JSON::JWK::Set.new([jwk])
+      InstAccess.with_config(signing_key: signing_priv_key, issuers: ['other_service'], service_jwks: jwk_set) do
+        token = described_class.from_token_string(jws)
+        expect(token.user_uuid).to eq('user-uuid')
+      end
+    end
   end
 
   context 'when configured for token generation' do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: inst_access
 version: !ruby/object:Gem::Version
-  version: 0.4.2
+  version: 0.4.4
 platform: ruby
 authors:
 - Michael Ziwisky
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-01-09 00:00:00.000000000 Z
+date: 2024-09-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport