jwt_authorize 0.2.5

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 66496a68b009b540f997f4ea96f0bdcc15c8182b2bae9c78b77f42a1f9c74f4b
+  data.tar.gz: d729629a346b4806cd4f88cc6d42a1744edf90627a408c61d3e08c3fbff236c7
+SHA512:
+  metadata.gz: 7eb7e532be4ae3e215ee07792abdcf96f1d7b69e7dff03b7f926ece9802d9ac731111982d20e16857266093a6a6af36834f195d7a39d653e4485ef20e4139fed
+  data.tar.gz: 997b0802d7af46b8aa07440e4071ea62b8603fe624e24374bccd2dfae0995567a4a6fb7eeb37aa5d3e6b63bb73081e67f864370a21ae644528eec79b6848a184

data/lib/jwt_authorize.rb

@@ -0,0 +1,64 @@
+#  Copyright 2016 Adobe Systems Incorporated. All rights reserved.
+#  This file is licensed to you under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License. You may obtain a copy
+#  of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software distributed under
+#  the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+#  OF ANY KIND, either express or implied. See the License for the specific language
+#  governing permissions and limitations under the License.
+
+require "jwt_authorize/version"
+require "jwt_authorize/jwt_decoder"
+require "jwt_authorize/jwt_payload_authorizer"
+require "logger"
+
+module JwtAuthorize
+  class << self
+    attr_writer :logger
+
+    def get_certificate_thumbprint(auth_token)
+      headers = get_jwt_headers(auth_token)
+
+      headers[CERTIFICATE_THUMBPRINT]
+    end
+
+    def get_certificate_path(auth_token)
+      headers = get_jwt_headers(auth_token)
+
+      headers[CERTIFICATE_PATH]
+    end
+
+    def get_jwt_headers(auth_token)
+      JwtAuthorize::JwtDecoder.new.get_headers_from_jwt(auth_token)
+    end
+
+    def decode(auth_token, certificate, options = {})
+      fail "No public key" if certificate.nil?
+
+      JwtAuthorize::JwtDecoder.new(logger, options).get_payload_from_jwt(auth_token, certificate)
+    rescue => err
+      logger.error("Error decoding JWT token: #{err}")
+      nil
+    end
+
+    def authorized_request?(payload, permissions, base_repo)
+      JwtAuthorize::JwtPayloadAuthorizer.new(permissions, logger).authorized?(payload, base_repo)
+    rescue => err
+      logger.error("Error processing JWT token: #{err}")
+      false
+    end
+
+    def authorized?(certificate, auth_token, permissions, base_repo, options = {})
+      decoded = decode(auth_token, certificate, options)
+
+      decoded.nil? ? false : authorized_request?(decoded.first, permissions, base_repo)
+    end
+
+    def logger
+      @logger ||= Logger.new($stdout).tap do |log|
+        log.progname = name
+      end
+    end
+  end
+end

data/lib/jwt_authorize/jwt_consts.rb

@@ -0,0 +1,4 @@
+module JwtAuthorize
+  CERTIFICATE_THUMBPRINT = "x5t".freeze
+  CERTIFICATE_PATH = "x5u".freeze
+end

data/lib/jwt_authorize/jwt_decoder.rb

@@ -0,0 +1,75 @@
+#  Copyright 2016 Adobe Systems Incorporated. All rights reserved.
+#  This file is licensed to you under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License. You may obtain a copy
+#  of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software distributed under
+#  the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+#  OF ANY KIND, either express or implied. See the License for the specific language
+#  governing permissions and limitations under the License.
+
+require "jwt"
+require "jwt_authorize/jwt_consts"
+
+module JwtAuthorize
+  class JwtDecoder
+    def initialize(logger = nil, options = {})
+      @logger = logger
+      @options = options
+    end
+
+    def get_payload_from_jwt(header, certificate)
+      fail "No certificate specified" unless certificate
+
+      validate_header(header)
+
+      token = token_from_header(header)
+
+      decoded = decode_token(token, certificate)
+
+      options = decoded.last
+      validate_thumbprint(options[CERTIFICATE_THUMBPRINT], certificate)
+
+      decoded
+    end
+
+    def get_headers_from_jwt(token)
+      fail "token is nil" if token.nil?
+
+      headers = token_from_header(token).split(".").first
+
+      JSON.parse(Base64.decode64(headers))
+    end
+
+    private
+
+    def validate_header(header)
+      fail "Header is nil!" if header.nil?
+      fail "Incorrectly formatted token" unless header.start_with?("bearer")
+    end
+
+    def token_from_header(header)
+      _type, token = header.split(" ", 2)
+      fail "#{header} is invalid token!" unless token
+
+      token
+    end
+
+    def validate_thumbprint(head_thumb, certificate)
+      cert_thumb = calculate_thumbprint(certificate)
+      fail "Cert SHA1 mismatch. head: #{head_thumb}, cert: #{cert_thumb}" unless head_thumb.casecmp(cert_thumb)
+    end
+
+    def decode_token(token, certificate)
+      @options[:algorithm] = "RS256"
+      JWT.decode(token, certificate.public_key, true, @options)
+    rescue JWT::ExpiredSignature, JWT::VerificationError => err
+      @logger.error("Payload could not be decoded: #{err}") unless @logger.nil?
+      raise "Payload could not be decoded from token."
+    end
+
+    def calculate_thumbprint(certificate)
+      OpenSSL::Digest::SHA1.hexdigest(certificate.to_der).scan(/../).join(":")
+    end
+  end
+end

data/lib/jwt_authorize/jwt_payload_authorizer.rb

@@ -0,0 +1,55 @@
+#  Copyright 2016 Adobe Systems Incorporated. All rights reserved.
+#  This file is licensed to you under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License. You may obtain a copy
+#  of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software distributed under
+#  the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+#  OF ANY KIND, either express or implied. See the License for the specific language
+#  governing permissions and limitations under the License.
+
+module JwtAuthorize
+  class JwtPayloadAuthorizer
+    def initialize(permissions, logger = nil)
+      fail "Permissions are empty!" unless permissions
+
+      @perms = permissions.split(",")
+      @logger = logger
+    end
+
+    def authorized?(payload, base_repo)
+      repos = payload["repositories"]
+
+      same_repositories?(repos, base_repo) && permissions_valid?(repos)
+    end
+
+    private
+
+    def same_repositories?(payload_repos, base_repo)
+      test_repos = payload_repos.map { |repo| repo["name"].downcase }
+      fail "No payload repositories." if test_repos.size == 0
+
+      same = test_repos.include?(base_repo.downcase)
+      fail "Repositories do not match." unless same
+
+      same
+    end
+
+    def permissions_valid?(payload_repos)
+      repo_perms = payload_repos.map { |repo| repo["permissions"] }.flatten
+
+      valid = (permissions & repo_perms).size > 0
+
+      unless valid
+        @logger.error("Invalid perms. Jwt: #{permissions.inspect}, repo: #{repo_perms.inspect}") unless @logger.nil?
+        fail "Invalid permissions."
+      end
+
+      valid
+    end
+
+    def permissions
+      @perms
+    end
+  end
+end

data/lib/jwt_authorize/version.rb

@@ -0,0 +1,3 @@
+module JwtAuthorize
+  VERSION = "0.2.5".freeze
+end

metadata

@@ -0,0 +1,118 @@
+--- !ruby/object:Gem::Specification
+name: jwt_authorize
+version: !ruby/object:Gem::Version
+  version: 0.2.5
+platform: ruby
+authors:
+- Dave Persing
+autorequire: 
+bindir: exe
+cert_chain: []
+date: 2018-12-13 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.12'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.12'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.36'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.36'
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.5'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.5'
+description: 
+email:
+- persing@adobe.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/jwt_authorize.rb
+- lib/jwt_authorize/jwt_consts.rb
+- lib/jwt_authorize/jwt_decoder.rb
+- lib/jwt_authorize/jwt_payload_authorizer.rb
+- lib/jwt_authorize/version.rb
+homepage: https://github.com/adobe-platform/jwt-authorize-gem
+licenses: []
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.7.6
+signing_key: 
+specification_version: 4
+summary: Authorizing requests containing an Authorization header against custom permissions
+test_files: []