keycardai-oauth 0.5.0 → 0.5.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +20 -0
- data/lib/keycardai/oauth/token_verifier.rb +8 -1
- data/lib/keycardai/oauth/version.rb +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 40a3e00e3c9bea5de74c7dfec6f5daccb2f90bc7cf778bb792ea737e7e34dead
|
|
4
|
+
data.tar.gz: 29be50e3ae28e46aeb2c20f2c93680e4aaf9206e4fa39a092360b5239f7ee1af
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 2b7b2d4fedab4c89db633147d98151dcfb36e2bd84da817025c9ae10be11c39291bebae71d7549063c52371738a8c417c1ba87a1622964dabcac03ff4f36e386
|
|
7
|
+
data.tar.gz: bc08654b809ca7863b9a60de9518b65255d303d115819d85620daca16d5bb5f5a5e2ae3ec35b0b34f1173d526413a10faf1bd5b0681fa9d62395895037b2dc1e
|
data/CHANGELOG.md
CHANGED
|
@@ -15,6 +15,26 @@ the loopback flow (RFC 8252), JWT signing and verification with a caching JWKS
|
|
|
15
15
|
keyring, the three application credentials (ClientSecret with multi-zone,
|
|
16
16
|
WebIdentity, WorkloadIdentity with pluggable token sources), and AccessContext.
|
|
17
17
|
|
|
18
|
+
## 0.5.1-keycardai-oauth (2026-09-17)
|
|
19
|
+
|
|
20
|
+
|
|
21
|
+
- fix(keycardai-oauth): warn once when a TokenVerifier is built without audiences (SDK-4) (#39)
|
|
22
|
+
- * fix(keycardai-oauth): warn once when a TokenVerifier is built without audiences (SDK-4)
|
|
23
|
+
- Co-Authored-By: Larry Osakwe <larry@keycard.ai>
|
|
24
|
+
- * fix(keycardai-oauth): bind the example server's verifier to KEYCARD_RESOURCE_ID
|
|
25
|
+
- The example used KEYCARD_RESOURCE_ID as a display name and built its verifier
|
|
26
|
+
without audiences. It now keeps SERVER_NAME for display, passes the resource
|
|
27
|
+
identifier as audiences, and its selftest mints tokens for that identifier,
|
|
28
|
+
sends the wrong-scope token with the right aud so it reaches the scope check,
|
|
29
|
+
and asserts the proxied authorization_endpoint passes through unmodified
|
|
30
|
+
(the resource= rewrite it still expected was retired in #37).
|
|
31
|
+
- Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
|
32
|
+
- ---------
|
|
33
|
+
- Co-authored-by: devin-ai-keycard <devin-ai@keycard.ai>
|
|
34
|
+
Co-authored-by: Larry Osakwe <larry@keycard.ai>
|
|
35
|
+
Co-authored-by: Larry-Osakwe <larryosak@gmail.com>
|
|
36
|
+
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
|
|
37
|
+
|
|
18
38
|
## 0.5.0-keycardai-oauth (2026-09-08)
|
|
19
39
|
|
|
20
40
|
|
|
@@ -77,7 +77,8 @@ module Keycardai
|
|
|
77
77
|
class TokenVerifier
|
|
78
78
|
# @param issuers [String, Array<String>] trusted zone issuer URL(s)
|
|
79
79
|
# @param audiences [String, Array<String>, nil] when set, tokens must
|
|
80
|
-
# carry an intersecting aud
|
|
80
|
+
# carry an intersecting aud; when nil, the verifier accepts a token
|
|
81
|
+
# minted for any resource in the zone and warns once at construction
|
|
81
82
|
# @param http_client [#get] pluggable transport
|
|
82
83
|
# @param key_ttl [Numeric] JWKS key cache lifetime in seconds
|
|
83
84
|
# @param discovery_ttl [Numeric] jwks_uri cache lifetime in seconds
|
|
@@ -90,6 +91,12 @@ module Keycardai
|
|
|
90
91
|
@issuers = Array(issuers).reject { |issuer| issuer.nil? || issuer.empty? }
|
|
91
92
|
raise ConfigurationError, "TokenVerifier requires at least one trusted issuer" if @issuers.empty?
|
|
92
93
|
|
|
94
|
+
if audiences.nil?
|
|
95
|
+
warn "Keycardai::OAuth::TokenVerifier has no audiences configured, so it accepts a token minted " \
|
|
96
|
+
"for any resource in the zone; pass audiences: with this server's registered resource identifier.",
|
|
97
|
+
uplevel: 1
|
|
98
|
+
end
|
|
99
|
+
|
|
93
100
|
@audiences = audiences
|
|
94
101
|
@clock = clock
|
|
95
102
|
@keyring = JWKSKeyring.new(http_client: http_client, key_ttl: key_ttl,
|