keycardai-oauth 0.4.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 377cff115fcfdf240200ae12b5d76d9c395e7a88a7e68cada08eb2bbe2dedaa2
-  data.tar.gz: 2d225d8679d1d4a901419aece54de5aceed70ef6998bb6f58966fda86512450d
+  metadata.gz: 40a3e00e3c9bea5de74c7dfec6f5daccb2f90bc7cf778bb792ea737e7e34dead
+  data.tar.gz: 29be50e3ae28e46aeb2c20f2c93680e4aaf9206e4fa39a092360b5239f7ee1af
 SHA512:
-  metadata.gz: cbdc7911049fbf06b769cf708b3be1f53c8a5dcfb6f2db3e9a920ad050b31526b245e0558d3a90d405a612713985c82ea4cd6f51cde7e23e0a64acc2591ed18d
-  data.tar.gz: 84047019c88c419316be53c29b79acee9558cdcf657b1297d2ee840426f5459dbc8759943f9737f8d6f3a86ed08f2be8d349925a99697ab1d9d720477ebc3a5a
+  metadata.gz: 2b7b2d4fedab4c89db633147d98151dcfb36e2bd84da817025c9ae10be11c39291bebae71d7549063c52371738a8c417c1ba87a1622964dabcac03ff4f36e386
+  data.tar.gz: bc08654b809ca7863b9a60de9518b65255d303d115819d85620daca16d5bb5f5a5e2ae3ec35b0b34f1173d526413a10faf1bd5b0681fa9d62395895037b2dc1e

data/CHANGELOG.md

@@ -15,6 +15,33 @@ the loopback flow (RFC 8252), JWT signing and verification with a caching JWKS
 keyring, the three application credentials (ClientSecret with multi-zone,
 WebIdentity, WorkloadIdentity with pluggable token sources), and AccessContext.
 
+## 0.5.1-keycardai-oauth (2026-09-17)
+
+
+- fix(keycardai-oauth): warn once when a TokenVerifier is built without audiences (SDK-4) (#39)
+- * fix(keycardai-oauth): warn once when a TokenVerifier is built without audiences (SDK-4)
+- Co-Authored-By: Larry Osakwe <larry@keycard.ai>
+- * fix(keycardai-oauth): bind the example server's verifier to KEYCARD_RESOURCE_ID
+- The example used KEYCARD_RESOURCE_ID as a display name and built its verifier
+without audiences. It now keeps SERVER_NAME for display, passes the resource
+identifier as audiences, and its selftest mints tokens for that identifier,
+sends the wrong-scope token with the right aud so it reaches the scope check,
+and asserts the proxied authorization_endpoint passes through unmodified
+(the resource= rewrite it still expected was retired in #37).
+- Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
+- ---------
+- Co-authored-by: devin-ai-keycard <devin-ai@keycard.ai>
+Co-authored-by: Larry Osakwe <larry@keycard.ai>
+Co-authored-by: Larry-Osakwe <larryosak@gmail.com>
+Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
+
+## 0.5.0-keycardai-oauth (2026-09-08)
+
+
+- feat(keycardai-oauth): reuse Net::HTTP sessions in the default transport
+- ECO-383. NetHTTPClient#perform built a fresh Net::HTTP per request, so every oauth call (and every verify and token exchange in the mcp gem, whose AuthProvider holds one NetHTTPClient) paid a new TCP and TLS handshake. Sessions are now kept per instance, per thread, per (host, port, scheme): the request path takes no lock, a small mutex guards only the registry of per-thread session maps, and dead threads are swept when the registry is touched. close finishes every session; an unclosed throwaway instance keeps its sessions until garbage collection, the same abandonment doctrine as the Python fix (python-sdk #291). Timeouts are applied per request, restoring Net::HTTP's own defaults when absent. No new dependencies; the gem stays stdlib-only.
+- Behavior change: a keepalive connection the server dropped while idle surfaces as NetworkError on the next request, where a fresh-connection design could not fail that way; the session reconnects on the attempt after. The Ruby retryability classification (ECO-360) is the consumer-side answer when it lands.
+
 ## 0.4.0-keycardai-oauth (2026-09-05)
 
 

data/lib/keycardai/oauth/http.rb

@@ -27,7 +27,41 @@ module Keycardai
       end
 
       # Default transport backed by Net::HTTP. TLS is used for https URLs.
+      #
+      # Sessions are kept open and reused per instance, per thread, per
+      # (host, port, scheme). A thread only ever touches its own sessions, so
+      # the request path takes no lock; a small mutex guards only the registry
+      # of per-thread session maps, and dead threads are swept from it whenever
+      # it is touched. There is no transparent retry: a keepalive connection
+      # the server dropped while idle surfaces as NetworkError on the next
+      # request, the same as any other failure.
+      #
+      # Call {#close} when no requests are in flight to finish every session.
+      # An instance that is never closed, such as the throwaway client built by
+      # module-level function defaults, keeps its sessions until it is garbage
+      # collected, which closes the underlying sockets.
       class NetHTTPClient
+        DEFAULT_OPEN_TIMEOUT = Net::HTTP.new("localhost").open_timeout
+        DEFAULT_READ_TIMEOUT = Net::HTTP.new("localhost").read_timeout
+        private_constant :DEFAULT_OPEN_TIMEOUT, :DEFAULT_READ_TIMEOUT
+
+        def initialize
+          @registry = {}
+          @registry_mutex = Mutex.new
+        end
+
+        # Finish every open session and clear the registry. The client stays
+        # usable; the next request opens fresh sessions. Call only when no
+        # requests are in flight on any thread.
+        #
+        # @return [void]
+        def close
+          maps = @registry_mutex.synchronize do
+            @registry.values.tap { @registry.clear }
+          end
+          maps.each { |sessions| sessions.each_value { |http| finish(http) } }
+        end
+
         # @param url [String]
         # @param headers [Hash{String => String}]
         # @param timeout [Numeric, nil] open/read timeout in seconds
@@ -72,17 +106,53 @@ module Keycardai
         private
 
         def perform(uri, request, timeout)
-          http = Net::HTTP.new(uri.host, uri.port)
-          http.use_ssl = uri.scheme == "https"
-          if timeout
-            http.open_timeout = timeout
-            http.read_timeout = timeout
-          end
+          http = session_for(uri)
+          # Timeouts are per request; a request without one gets Net::HTTP's
+          # defaults back rather than the previous request's values.
+          http.open_timeout = timeout || DEFAULT_OPEN_TIMEOUT
+          http.read_timeout = timeout || DEFAULT_READ_TIMEOUT
+          http.start unless http.started?
           response = http.request(request)
           Response.new(status: response.code.to_i, headers: response.to_hash, body: response.body.to_s)
         rescue SystemCallError, SocketError, Timeout::Error, OpenSSL::SSL::SSLError, EOFError => e
           raise NetworkError, "request to #{uri.host} failed: #{e.class}"
         end
+
+        def session_for(uri)
+          sessions = sessions_for_current_thread
+          key = [uri.host, uri.port, uri.scheme]
+          http = sessions[key]
+          return http if http&.started?
+
+          http = Net::HTTP.new(uri.host, uri.port)
+          http.use_ssl = uri.scheme == "https"
+          sessions[key] = http
+        end
+
+        # A thread's own map is read without the mutex once it exists; the mutex
+        # is taken only to register a new thread or to close.
+        def sessions_for_current_thread
+          @registry[Thread.current] || @registry_mutex.synchronize do
+            sweep_dead_threads
+            @registry[Thread.current] ||= {}
+          end
+        end
+
+        # Caller holds @registry_mutex.
+        def sweep_dead_threads
+          @registry.delete_if do |thread, sessions|
+            next false if thread.alive?
+
+            sessions.each_value { |http| finish(http) }
+            true
+          end
+        end
+
+        def finish(http)
+          http.finish if http.started?
+        rescue IOError
+          nil
+        end
       end
     end
   end

data/lib/keycardai/oauth/token_verifier.rb

@@ -77,7 +77,8 @@ module Keycardai
     class TokenVerifier
       # @param issuers [String, Array<String>] trusted zone issuer URL(s)
       # @param audiences [String, Array<String>, nil] when set, tokens must
-      #   carry an intersecting aud
+      #   carry an intersecting aud; when nil, the verifier accepts a token
+      #   minted for any resource in the zone and warns once at construction
       # @param http_client [#get] pluggable transport
       # @param key_ttl [Numeric] JWKS key cache lifetime in seconds
       # @param discovery_ttl [Numeric] jwks_uri cache lifetime in seconds
@@ -90,6 +91,12 @@ module Keycardai
         @issuers = Array(issuers).reject { |issuer| issuer.nil? || issuer.empty? }
         raise ConfigurationError, "TokenVerifier requires at least one trusted issuer" if @issuers.empty?
 
+        if audiences.nil?
+          warn "Keycardai::OAuth::TokenVerifier has no audiences configured, so it accepts a token minted " \
+               "for any resource in the zone; pass audiences: with this server's registered resource identifier.",
+               uplevel: 1
+        end
+
         @audiences = audiences
         @clock = clock
         @keyring = JWKSKeyring.new(http_client: http_client, key_ttl: key_ttl,

data/lib/keycardai/oauth/version.rb

@@ -2,6 +2,6 @@
 
 module Keycardai
   module OAuth
-    VERSION = "0.4.0"
+    VERSION = "0.5.1"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: keycardai-oauth
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.1
 platform: ruby
 authors:
 - Keycard