jwt_auth_cognito 1.0.0.pre.beta.14 → 1.0.0.pre.beta.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 77eed5e47f35c5f0a7e693bab6c09e70cf2ea950670273d203ff3611d94b8a70
-  data.tar.gz: 21a499f3e1ad917bf9587cd8695e2dc44cceb7fb77f3ada93185ae2ed855c0d7
+  metadata.gz: 5478b2beaffce3e103aa915b73735e2b78ae39d4f802fb663fd0aad79a721207
+  data.tar.gz: 2023c50ebe2234f58243820118edce9e8d413dc348b0798642e4378adc356898
 SHA512:
-  metadata.gz: 2fb3defb3e11e9cc318ac1d387cf58c99fa6b1b3152bc34841db21645fb6a6fa67ab99af956fb4fd539aeaa44132df9994bc55256f9bb4412e30ebd112801c6a
-  data.tar.gz: cba58be12f1fd5dfe1d199a83e27e60fa851bedfd1b39a2d7b8a0f6c2669c99c9f4459fbe6390977aef177c1c797abecd83ffb447e966615d6556ac8192acf3c
+  metadata.gz: e8a0c2b0bb5897f15bc83b065ccfa060f18d509788cd1406325792caa74ac1d23bc9910c4c81d3f1c4923e21efd6aa0e35655bffb8f44dc1f74767a3ed3e51d9
+  data.tar.gz: 5bbb8e162f0150c06730a8c63723e6458b50f32404bc12661622d8b670fa3901f1dac9c93a909d59f77d7f63ff0e1d2b9592c2df69247feb9b9b3aac5786db1b

data/.rubocop.yml

@@ -6,16 +6,12 @@ AllCops:
   SuggestExtensions: false
   TargetRubyVersion: 2.7
 
-# Increase limits for code complexity - legacy codebase
-Metrics/ClassLength:
-  Max: 300
-
+# Limits for code metrics that remain enabled (legacy codebase).
+# NOTE: ClassLength, MethodLength, AbcSize, CyclomaticComplexity and PerceivedComplexity
+# are disabled further below — that block is their single source of truth.
 Metrics/ModuleLength:
   Max: 300
 
-Metrics/MethodLength:
-  Max: 30
-
 Metrics/BlockLength:
   Max: 50
   Exclude:
@@ -23,15 +19,6 @@ Metrics/BlockLength:
     - 'lib/tasks/**/*'
     - 'Rakefile'
 
-Metrics/AbcSize:
-  Max: 30
-
-Metrics/CyclomaticComplexity:
-  Max: 15
-
-Metrics/PerceivedComplexity:
-  Max: 15
-
 Metrics/ParameterLists:
   Max: 8
 

data/CHANGELOG.md

@@ -7,6 +7,36 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.0-beta.16] - 2026-06-25
+
+### Fixed
+
+- **Blacklist key now matches auth-service (revocations were being missed).** The gem
+  looked up revoked tokens under `jwt_blacklist:{jti | sha256(token)[0,16]}`, but
+  auth-service writes them under `revoked:{base64(last 32 chars of token)}` (the same
+  scheme the Node validator reads). The prefix and the id derivation both differed, so
+  a token revoked via `/auth/logout` was **never detected** by Ruby consumers and kept
+  validating until it expired on its own. `BLACKLIST_PREFIX` is now `revoked:` and
+  `#generate_token_id` derives `Base64.strict_encode64(token[-32..])`, matching
+  auth-service and the npm package exactly.
+
+### Changed
+
+- **Thread-safe shared Redis connection pool.** `RedisService` previously held a single,
+  non-thread-safe connection per instance (and the validator builds several instances),
+  which races under Puma/Sidekiq and makes connection count grow with threads/instances.
+  It now uses one process-wide `ConnectionPool` (new `connection_pool` dependency) shared
+  across all instances, sized via `redis_pool_size` (defaults to `RAILS_MAX_THREADS`,
+  env `REDIS_POOL_SIZE`) with `redis_pool_timeout` (env `REDIS_POOL_TIMEOUT`, default 5s).
+  This bounds connections to the pool size per process regardless of how many validators
+  or threads exist. Forking servers should call `JwtAuthCognito::RedisService.reset_pool!`
+  in their `after_fork` hook.
+- **`#is_token_revoked?` fails open on any Redis/pool error.** Previously only
+  `Redis::BaseError` was rescued (a connection failure or pool-exhaustion error would
+  propagate and could block validation). It now rescues `StandardError` and returns
+  `false`, so a saturated or unreachable Redis never locks every user out — matching the
+  Node validator and auth-service's `RedisService.isTokenRevoked`.
+
 ## [1.0.0-beta.14] - 2026-06-18
 
 ### Changed

data/jwt_auth_cognito.gemspec

@@ -44,6 +44,7 @@ Gem::Specification.new do |spec|
   # Dependencies - compatible with llegando-neo (Ruby 2.7.5, Rails 5.2.6)
   spec.add_dependency 'aws-sdk-cognitoidentityprovider', '~> 1.0' # For GetUser identity enrichment
   spec.add_dependency 'aws-sdk-ssm', '~> 1.0' # For AWS Parameter Store support
+  spec.add_dependency 'connection_pool', '~> 2.2' # Shared, thread-safe Redis connection pool
   spec.add_dependency 'json', '~> 2.0'
   spec.add_dependency 'jwt', '~> 2.0'
   spec.add_dependency 'redis', '>= 4.2.5', '< 6.0' # Compatible with llegando-neo redis version

data/lib/jwt_auth_cognito/configuration.rb

@@ -6,6 +6,7 @@ module JwtAuthCognito
                   :redis_host, :redis_port, :redis_password, :redis_db,
                   :redis_ssl, :redis_timeout, :redis_connect_timeout, :redis_read_timeout,
                   :redis_ca_cert_path, :redis_ca_cert_name, :redis_verify_mode,
+                  :redis_pool_size, :redis_pool_timeout,
                   :jwks_cache_ttl, :validation_mode, :environment,
                   :enable_api_key_validation, :enable_user_data_retrieval,
                   :enable_user_identity_enrichment, :identity_cache_timeout, :identity_attributes
@@ -26,6 +27,13 @@ module JwtAuthCognito
       @redis_connect_timeout = (ENV['REDIS_CONNECT_TIMEOUT'] || 10).to_i
       @redis_read_timeout = (ENV['REDIS_READ_TIMEOUT'] || 10).to_i
 
+      # Shared connection pool sizing. Defaults to the web server's thread count
+      # (RAILS_MAX_THREADS) so the pool matches concurrency without over-allocating
+      # connections. redis_pool_timeout is the max seconds to wait for a free
+      # connection before raising ConnectionPool::TimeoutError.
+      @redis_pool_size = (ENV['REDIS_POOL_SIZE'] || ENV['RAILS_MAX_THREADS'] || 5).to_i
+      @redis_pool_timeout = (ENV['REDIS_POOL_TIMEOUT'] || 5).to_i
+
       # TLS specific configuration (compatible with auth-service)
       @redis_ca_cert_path = ENV.fetch('REDIS_CA_CERT_PATH', nil)
       @redis_ca_cert_name = ENV.fetch('REDIS_CA_CERT_NAME', nil)

data/lib/jwt_auth_cognito/jwt_validator.rb

@@ -305,6 +305,15 @@ module JwtAuthCognito
       PermissionChecker.permission_in_list?(permission, result[:permissions])
     end
 
+    # Resolve the user's effective ABAC access scope for (app, org).
+    # Hash keyed by "<resourceType>:<action>" => { 'match' =>, 'include' =>, 'exclude' => }.
+    # The consuming app filters its data with this. Returns {} when there is no scope.
+    def get_access_scope(user_id, app_id, org_id)
+      return {} unless @user_data_service
+
+      @user_data_service.resolve_access_scope(user_id, app_id, org_id)
+    end
+
     def is_token_expired?(token)
       payload = decode_token(token)
       return true if payload.is_a?(Hash) && payload[:error]

data/lib/jwt_auth_cognito/redis_service.rb

@@ -1,27 +1,57 @@
 # frozen_string_literal: true
 
 require 'redis'
+require 'connection_pool'
 require 'digest'
 require 'openssl'
+require 'base64'
 
 module JwtAuthCognito
   class RedisService
-    BLACKLIST_PREFIX = 'jwt_blacklist:'
+    # auth-service revokes tokens under `revoked:{base64(last 32 chars of token)}`
+    # (see tokenBlacklist.ts#getTokenHash). This prefix and the id derivation in
+    # #generate_token_id MUST match it exactly, otherwise revocations performed by
+    # auth-service (/auth/logout) are looked up under a key that never exists and are
+    # silently missed. The Node validator uses this same scheme.
+    BLACKLIST_PREFIX = 'revoked:'
     USER_TOKENS_PREFIX = 'user_tokens:'
 
+    # One shared, thread-safe connection pool per process — independent of how many
+    # RedisService instances exist (the blacklist, user-data and api-key services each
+    # build their own instance, yet they all share this pool). This bounds Redis
+    # connections to `redis_pool_size` per process instead of growing with the number
+    # of instances/threads, and makes the service safe under Puma/Sidekiq.
+    class << self
+      # Builds (once) and returns the shared pool. The factory is a callable that
+      # produces a connected Redis client; it runs lazily as the pool grows.
+      def pool(config, factory)
+        @pool ||= ConnectionPool.new(
+          size: config.redis_pool_size,
+          timeout: config.redis_pool_timeout
+        ) { factory.call }
+      end
+
+      # Drops the shared pool. Call after forking (Puma/Unicorn `after_fork`, Sidekiq)
+      # so each child builds its own connections instead of reusing parent sockets.
+      # Also used to isolate tests.
+      def reset_pool!
+        @pool = nil
+      end
+    end
+
     def initialize(config = JwtAuthCognito.configuration)
       @config = config
-      @redis = nil
     end
 
     def save_revoked_token(token_id, ttl = nil)
-      connect_redis
       key = "#{BLACKLIST_PREFIX}#{token_id}"
 
-      if ttl
-        @redis.setex(key, ttl, 'revoked')
-      else
-        @redis.set(key, 'revoked')
+      with_redis do |redis|
+        if ttl
+          redis.setex(key, ttl, 'revoked')
+        else
+          redis.set(key, 'revoked')
+        end
       end
 
       true
@@ -30,52 +60,53 @@ module JwtAuthCognito
     end
 
     def is_token_revoked?(token_id)
-      connect_redis
       key = "#{BLACKLIST_PREFIX}#{token_id}"
-      result = @redis.exists?(key)
+      result = with_redis { |redis| redis.exists?(key) }
       result.is_a?(Integer) ? result.positive? : result
-    rescue Redis::BaseError
-      # Graceful degradation - if Redis is down, don't block validation
+    rescue StandardError
+      # Fail-open graceful degradation: if Redis is unreachable or the pool is
+      # exhausted, do not block validation. Mirrors the Node validator and
+      # auth-service (RedisService.isTokenRevoked), which also treat errors as
+      # "not revoked" so an infrastructure issue never locks every user out.
       false
     end
 
     def clear_revoked_tokens
-      connect_redis
-      keys = @redis.keys("#{BLACKLIST_PREFIX}*")
-      @redis.del(*keys) if keys.any?
-      keys.length
+      with_redis do |redis|
+        keys = redis.keys("#{BLACKLIST_PREFIX}*")
+        redis.del(*keys) if keys.any?
+        keys.length
+      end
     rescue Redis::BaseError => e
       raise BlacklistError, "Failed to clear revoked tokens: #{e.message}"
     end
 
     def invalidate_user_tokens(user_id)
-      connect_redis
-
-      # Get all tokens for the user
       user_key = "#{USER_TOKENS_PREFIX}#{user_id}"
-      token_ids = @redis.smembers(user_key)
 
-      # Add all tokens to blacklist
-      token_ids.each do |token_id|
-        save_revoked_token(token_id)
-      end
+      with_redis do |redis|
+        token_ids = redis.smembers(user_key)
 
-      # Clear the user's token set
-      @redis.del(user_key)
+        # Persist a revocation marker for each tracked token, then clear the set.
+        # Inlined (instead of calling #save_revoked_token) to reuse this single
+        # pooled connection and avoid a nested pool checkout.
+        token_ids.each { |token_id| redis.set("#{BLACKLIST_PREFIX}#{token_id}", 'revoked') }
+        redis.del(user_key)
 
-      token_ids.length
+        token_ids.length
+      end
     rescue Redis::BaseError => e
       raise BlacklistError, "Failed to invalidate user tokens: #{e.message}"
     end
 
     def track_user_token(user_id, token_id, ttl = nil)
-      connect_redis
-
       user_key = "#{USER_TOKENS_PREFIX}#{user_id}"
-      @redis.sadd(user_key, token_id)
 
-      # Set expiration on the user's token set
-      @redis.expire(user_key, ttl) if ttl
+      with_redis do |redis|
+        redis.sadd(user_key, token_id)
+        # Set expiration on the user's token set
+        redis.expire(user_key, ttl) if ttl
+      end
 
       true
     rescue Redis::BaseError
@@ -84,34 +115,31 @@ module JwtAuthCognito
     end
 
     def generate_token_id(token)
-      # Try to extract jti from token first
-      begin
-        payload = JWT.decode(token, nil, false).first
-        return payload['jti'] if payload['jti']
-      rescue JWT::DecodeError
-        # Fall back to hash if token can't be decoded
-      end
-
-      # Generate hash-based ID
-      Digest::SHA256.hexdigest(token)[0, 16]
+      # Must match auth-service's key derivation (tokenBlacklist.ts#getTokenHash):
+      # base64 of the last 32 characters of the raw token. Using the JTI or a SHA256
+      # here would look up a key auth-service never writes, so revocations would be
+      # missed. The Node validator (token-blacklist-service.ts#getTokenHash) is identical.
+      suffix = token.to_s
+      suffix = suffix[-32..] || suffix
+      Base64.strict_encode64(suffix)
     end
 
     def get(key)
-      connect_redis
-      @redis.get(key)
+      with_redis { |redis| redis.get(key) }
     rescue Redis::BaseError => e
       raise BlacklistError, "Failed to get key '#{key}': #{e.message}"
     end
 
     def set(key, value, ttl = nil)
-      connect_redis
-      # Only attach an expiry for a positive TTL. A nil or non-positive ttl (note:
-      # 0 is truthy in Ruby) means a persistent key — `SETEX key 0` is rejected by
-      # Redis with "ERR invalid expire time", so fall back to a plain SET.
-      if ttl&.positive?
-        @redis.setex(key, ttl, value)
-      else
-        @redis.set(key, value)
+      with_redis do |redis|
+        # Only attach an expiry for a positive TTL. A nil or non-positive ttl (note:
+        # 0 is truthy in Ruby) means a persistent key — `SETEX key 0` is rejected by
+        # Redis with "ERR invalid expire time", so fall back to a plain SET.
+        if ttl&.positive?
+          redis.setex(key, ttl, value)
+        else
+          redis.set(key, value)
+        end
       end
       true
     rescue Redis::BaseError => e
@@ -120,19 +148,24 @@ module JwtAuthCognito
 
     private
 
-    def connect_redis
-      return @redis if @redis
+    # Checks out a connection from the shared pool for the duration of the block.
+    # The pool is built lazily on first use and reused across all instances.
+    def with_redis(&block)
+      self.class.pool(@config, method(:build_connection)).with(&block)
+    end
 
+    # Connection factory used by the pool. Verifies connectivity with PING and retries
+    # with exponential backoff, mirroring the previous single-connection behavior.
+    def build_connection
       redis_options = build_redis_options
 
-      # Retry logic with exponential backoff (similar to Node.js implementation)
       max_retries = 3
       retry_count = 0
 
       begin
-        @redis = Redis.new(redis_options)
-        @redis.ping # Test connection
-        @redis
+        redis = Redis.new(redis_options)
+        redis.ping # Test connection
+        redis
       rescue Redis::BaseError => e
         retry_count += 1
         raise BlacklistError, "Failed to connect to Redis after #{max_retries} retries: #{e.message}" unless retry_count <= max_retries
@@ -142,6 +175,13 @@ module JwtAuthCognito
       end
     end
 
+    # Kept for backward compatibility: the `jwt_auth_cognito:test_redis` rake task
+    # calls this via #send. Validates connectivity by checking out a pooled connection
+    # and issuing a PING.
+    def connect_redis
+      with_redis(&:ping)
+    end
+
     def build_redis_options
       options = {
         host: @config.redis_host,

data/lib/jwt_auth_cognito/user_data_service.rb

@@ -349,32 +349,60 @@ module JwtAuthCognito
       @stats[:connection_status] = 'disconnected'
     end
 
-    private
+    # Resolves the effective ABAC access scope for (user, app, org).
+    #   = union of role default accessScope (R2) + user accessScope (override/extend)
+    #     + legacy resourceRestrictions (= include without match).
+    # Keyed by "<resourceType>:<action>" (R3). Expired roles (roleExpiry) are skipped (R1).
+    # Returns {} when there is no scope (open access to everything).
+    def resolve_access_scope(user_id, app_id, organization_id)
+      raw = @redis_service.get("user:permissions:#{user_id}")
+      return {} unless raw
 
-    def get_from_cache(key)
-      return nil unless @cache.key?(key)
+      data = JSON.parse(raw)
+      org_perms = data.dig('permissions', app_id, organization_id)
+      return {} unless org_perms.is_a?(Hash) && org_perms['status'] == 'active'
+
+      now = (Time.now.to_f * 1000).to_i
+      expiry = org_perms['roleExpiry'].is_a?(Hash) ? org_perms['roleExpiry'] : {}
+      roles = org_perms['roles'].is_a?(Array) ? org_perms['roles'] : []
+      active_roles = roles.reject { |role_id| expiry[role_id] && expiry[role_id] <= now }
+
+      effective = {}
+
+      # 1) Role default scope (R2)
+      unless active_roles.empty?
+        app_roles = get_app_roles(app_id, organization_id)
+        app_roles = {} unless app_roles.is_a?(Hash)
+        active_roles.each do |role_id|
+          role = app_roles[role_id]
+          next unless role.is_a?(Hash)
+          next if role['isActive'] == false
+
+          merge_scope_into(effective, role['accessScope'])
+        end
+      end
 
-      timestamp = @cache_timestamps[key]
-      return nil unless timestamp
+      # 2) User override/extend (R2)
+      merge_scope_into(effective, org_perms['accessScope'])
 
-      # Check if cache entry has expired
-      if Time.now.to_i - timestamp > @config[:cache_timeout]
-        @cache.delete(key)
-        @cache_timestamps.delete(key)
-        return nil
+      # 3) Legacy resourceRestrictions = include (no match)
+      restrictions = org_perms['resourceRestrictions']
+      if restrictions.is_a?(Hash)
+        restrictions.each do |key, ids|
+          merge_scope_into(effective, { key => { 'include' => ids } })
+        end
       end
 
-      @cache[key]
-    end
-
-    def set_in_cache(key, value, _ttl = nil)
-      @cache[key] = value
-      @cache_timestamps[key] = Time.now.to_i
+      effective
+    rescue StandardError => e
+      puts "Error resolving access scope for #{user_id}:#{app_id}:#{organization_id}: #{e.message}"
+      {}
     end
 
     # Resolve permissions the user has over a specific resource instance (ReBAC).
     # Applies resourceRestrictions per-permission: open mode if none configured.
     # Returns nil if the user has no active membership in that org.
+    # NOTE: public because JwtValidator calls it with an explicit receiver.
     def resolve_resource_permissions(user_id, app_id, organization_id, resource_id)
       effective = resolve_effective_permissions(user_id, app_id, organization_id)
       return nil unless effective
@@ -401,6 +429,49 @@ module JwtAuthCognito
       nil
     end
 
+    private
+
+    def get_from_cache(key)
+      return nil unless @cache.key?(key)
+
+      timestamp = @cache_timestamps[key]
+      return nil unless timestamp
+
+      # Check if cache entry has expired
+      if Time.now.to_i - timestamp > @config[:cache_timeout]
+        @cache.delete(key)
+        @cache_timestamps.delete(key)
+        return nil
+      end
+
+      @cache[key]
+    end
+
+    def set_in_cache(key, value, _ttl = nil)
+      @cache[key] = value
+      @cache_timestamps[key] = Time.now.to_i
+    end
+
+    # Additively merge a scope map into another: union match per dimension, and include/exclude.
+    def merge_scope_into(into, from)
+      return unless from.is_a?(Hash)
+
+      from.each do |key, scope|
+        next unless scope.is_a?(Hash)
+
+        target = into[key] || {}
+        if scope['match'].is_a?(Hash)
+          target['match'] ||= {}
+          scope['match'].each do |dim, values|
+            target['match'][dim] = ((target['match'][dim] || []) + Array(values)).uniq
+          end
+        end
+        target['include'] = ((target['include'] || []) + Array(scope['include'])).uniq if scope['include']
+        target['exclude'] = ((target['exclude'] || []) + Array(scope['exclude'])).uniq if scope['exclude']
+        into[key] = target
+      end
+    end
+
     def compute_permissions_from_roles(app_id, organization_id, role_names)
       roles_data = get_app_roles(app_id, organization_id)
       return [] unless roles_data.is_a?(Hash)

data/lib/jwt_auth_cognito/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JwtAuthCognito
-  VERSION = '1.0.0-beta.14'
+  VERSION = '1.0.0-beta.15'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jwt_auth_cognito
 version: !ruby/object:Gem::Version
-  version: 1.0.0.pre.beta.14
+  version: 1.0.0.pre.beta.15
 platform: ruby
 authors:
 - The Optimal
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-06-18 00:00:00.000000000 Z
+date: 2026-06-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-cognitoidentityprovider
@@ -38,6 +38,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: connection_pool
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
 - !ruby/object:Gem::Dependency
   name: json
   requirement: !ruby/object:Gem::Requirement