keycloak-api-rails 0.11.2 → 0.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ff480abdc3a9317e66060416095339c0612ff902fec1200bf1178c7445bfad39
-  data.tar.gz: 29d7cb681cb2b05d801ceac2634b6773278516413112500968cdfe5fe7cae76e
+  metadata.gz: d0e8e7c47df127347543955ffc2ed362dc9c2efb549bc970f0efdd519f8cfb1a
+  data.tar.gz: 5b77f9cf1171a36db3d80c6cd31e0df8f0acb00a58916e9b7a4fdcfdec331ecd
 SHA512:
-  metadata.gz: 3bd3bac623390a4efe1cf24a80106c820e2b66c186350ddab00140ccab44f1a919117afb28a2bdcf02651cc1b780d0e9cfc4e75256d6083339e140bdd44669f6
-  data.tar.gz: fdbc7a9b37f8d5efdf5c11ee9ca01075ccfe9bbfaf7d5babfda1653eef9557a275c34487569d4589c2f5902c8ff13a7877f5e6d55133b0e4a7b9b4bd4fb00a58
+  metadata.gz: 38edbedbe88b629c6c6728eda1b60670cd9dd6b03f6246c4bfd79bcc6fd3832922c504b91c15f4f4c7e86128e4d143800f5562292cf0f38877e73f0f39f4a8ff
+  data.tar.gz: d6e9d6ca5a7d5a531e09e7e2fe63d026bd53f088ceabbb2484e59ab36ac1aee234d949ac30c342f67a2784442dacfb1d502762f35999d977d8175189c19193fa

data/CHANGELOG.md

@@ -5,6 +5,10 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.12.0] - 2023-04-11
+
+* Introduce Opt-in mode as an alternative configuration (thanks to @theSteveMitchell)
+
 ## [0.11.2] - 2022-03-30
 
 * Update `Gemfile.lock` to avoid wrong CVE detections. The version of Rails should always be specified by the parent project. This change has no functional impact.
@@ -16,8 +20,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [0.11.0] - 2019-11-21
 
-* Remove dependency to `rest-client` (thanks to @@loicvigneron)
-* Access Authorization Party from ENV (thanks to @@loicvigneron)
-* New configuration option: `ca_certificate_file` (thanks to @@loicvigneron)
+* Remove dependency to `rest-client` (thanks to @loicvigneron)
+* Access Authorization Party from ENV (thanks to @loicvigneron)
+* New configuration option: `ca_certificate_file` (thanks to @loicvigneron)
 * Access the token from ENV
 * Upgrade `json-jwt` to `1.11.0`

data/Dockerfile

@@ -9,6 +9,6 @@ COPY Gemfile /usr/src/app/
 COPY Gemfile.lock /usr/src/app/
 COPY keycloak-api-rails.gemspec /usr/src/app/
 COPY lib/keycloak-api-rails/version.rb /usr/src/app/lib/keycloak-api-rails/
-# RUN bundle install
+RUN bundle install
 COPY . /usr/src/app
-# RUN bundle install
+RUN bundle install

data/Gemfile.lock

@@ -1,188 +1,192 @@
 PATH
   remote: .
   specs:
-    keycloak-api-rails (0.11.2)
+    keycloak-api-rails (0.12.0)
       json-jwt (>= 1.11.0)
       rails (>= 4.2)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (7.0.2.3)
-      actionpack (= 7.0.2.3)
-      activesupport (= 7.0.2.3)
+    actioncable (7.0.4.3)
+      actionpack (= 7.0.4.3)
+      activesupport (= 7.0.4.3)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailbox (7.0.2.3)
-      actionpack (= 7.0.2.3)
-      activejob (= 7.0.2.3)
-      activerecord (= 7.0.2.3)
-      activestorage (= 7.0.2.3)
-      activesupport (= 7.0.2.3)
+    actionmailbox (7.0.4.3)
+      actionpack (= 7.0.4.3)
+      activejob (= 7.0.4.3)
+      activerecord (= 7.0.4.3)
+      activestorage (= 7.0.4.3)
+      activesupport (= 7.0.4.3)
       mail (>= 2.7.1)
       net-imap
       net-pop
       net-smtp
-    actionmailer (7.0.2.3)
-      actionpack (= 7.0.2.3)
-      actionview (= 7.0.2.3)
-      activejob (= 7.0.2.3)
-      activesupport (= 7.0.2.3)
+    actionmailer (7.0.4.3)
+      actionpack (= 7.0.4.3)
+      actionview (= 7.0.4.3)
+      activejob (= 7.0.4.3)
+      activesupport (= 7.0.4.3)
       mail (~> 2.5, >= 2.5.4)
       net-imap
       net-pop
       net-smtp
       rails-dom-testing (~> 2.0)
-    actionpack (7.0.2.3)
-      actionview (= 7.0.2.3)
-      activesupport (= 7.0.2.3)
+    actionpack (7.0.4.3)
+      actionview (= 7.0.4.3)
+      activesupport (= 7.0.4.3)
       rack (~> 2.0, >= 2.2.0)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (7.0.2.3)
-      actionpack (= 7.0.2.3)
-      activerecord (= 7.0.2.3)
-      activestorage (= 7.0.2.3)
-      activesupport (= 7.0.2.3)
+    actiontext (7.0.4.3)
+      actionpack (= 7.0.4.3)
+      activerecord (= 7.0.4.3)
+      activestorage (= 7.0.4.3)
+      activesupport (= 7.0.4.3)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (7.0.2.3)
-      activesupport (= 7.0.2.3)
+    actionview (7.0.4.3)
+      activesupport (= 7.0.4.3)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (7.0.2.3)
-      activesupport (= 7.0.2.3)
+    activejob (7.0.4.3)
+      activesupport (= 7.0.4.3)
       globalid (>= 0.3.6)
-    activemodel (7.0.2.3)
-      activesupport (= 7.0.2.3)
-    activerecord (7.0.2.3)
-      activemodel (= 7.0.2.3)
-      activesupport (= 7.0.2.3)
-    activestorage (7.0.2.3)
-      actionpack (= 7.0.2.3)
-      activejob (= 7.0.2.3)
-      activerecord (= 7.0.2.3)
-      activesupport (= 7.0.2.3)
+    activemodel (7.0.4.3)
+      activesupport (= 7.0.4.3)
+    activerecord (7.0.4.3)
+      activemodel (= 7.0.4.3)
+      activesupport (= 7.0.4.3)
+    activestorage (7.0.4.3)
+      actionpack (= 7.0.4.3)
+      activejob (= 7.0.4.3)
+      activerecord (= 7.0.4.3)
+      activesupport (= 7.0.4.3)
       marcel (~> 1.0)
       mini_mime (>= 1.1.0)
-    activesupport (7.0.2.3)
+    activesupport (7.0.4.3)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
       tzinfo (~> 2.0)
     aes_key_wrap (1.1.0)
-    bindata (2.4.10)
+    bindata (2.4.15)
     builder (3.2.4)
-    byebug (9.1.0)
-    concurrent-ruby (1.1.10)
+    byebug (11.1.3)
+    concurrent-ruby (1.2.2)
     crass (1.0.6)
+    date (3.3.3)
     diff-lcs (1.5.0)
-    digest (3.1.0)
-    erubi (1.10.0)
-    globalid (1.0.0)
+    erubi (1.12.0)
+    faraday (2.7.4)
+      faraday-net_http (>= 2.0, < 3.1)
+      ruby2_keywords (>= 0.0.4)
+    faraday-follow_redirects (0.3.0)
+      faraday (>= 1, < 3)
+    faraday-net_http (3.0.2)
+    globalid (1.1.0)
       activesupport (>= 5.0)
-    i18n (1.10.0)
+    i18n (1.12.0)
       concurrent-ruby (~> 1.0)
-    io-wait (0.2.1)
-    json-jwt (1.13.0)
+    json-jwt (1.16.3)
       activesupport (>= 4.2)
       aes_key_wrap
       bindata
-    loofah (2.15.0)
+      faraday (~> 2.0)
+      faraday-follow_redirects
+    loofah (2.20.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
-    mail (2.7.1)
+    mail (2.8.1)
       mini_mime (>= 0.1.1)
+      net-imap
+      net-pop
+      net-smtp
     marcel (1.0.2)
     method_source (1.0.0)
     mini_mime (1.1.2)
-    mini_portile2 (2.8.0)
-    minitest (5.15.0)
-    net-imap (0.2.3)
-      digest
+    mini_portile2 (2.8.1)
+    minitest (5.18.0)
+    net-imap (0.3.4)
+      date
       net-protocol
-      strscan
-    net-pop (0.1.1)
-      digest
+    net-pop (0.1.2)
       net-protocol
+    net-protocol (0.2.1)
       timeout
-    net-protocol (0.1.2)
-      io-wait
-      timeout
-    net-smtp (0.3.1)
-      digest
+    net-smtp (0.3.3)
       net-protocol
-      timeout
-    nio4r (2.5.8)
-    nokogiri (1.13.3)
+    nio4r (2.5.9)
+    nokogiri (1.14.3)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
-    racc (1.6.0)
-    rack (2.2.3)
-    rack-test (1.1.0)
-      rack (>= 1.0, < 3)
-    rails (7.0.2.3)
-      actioncable (= 7.0.2.3)
-      actionmailbox (= 7.0.2.3)
-      actionmailer (= 7.0.2.3)
-      actionpack (= 7.0.2.3)
-      actiontext (= 7.0.2.3)
-      actionview (= 7.0.2.3)
-      activejob (= 7.0.2.3)
-      activemodel (= 7.0.2.3)
-      activerecord (= 7.0.2.3)
-      activestorage (= 7.0.2.3)
-      activesupport (= 7.0.2.3)
+    racc (1.6.2)
+    rack (2.2.6.4)
+    rack-test (2.1.0)
+      rack (>= 1.3)
+    rails (7.0.4.3)
+      actioncable (= 7.0.4.3)
+      actionmailbox (= 7.0.4.3)
+      actionmailer (= 7.0.4.3)
+      actionpack (= 7.0.4.3)
+      actiontext (= 7.0.4.3)
+      actionview (= 7.0.4.3)
+      activejob (= 7.0.4.3)
+      activemodel (= 7.0.4.3)
+      activerecord (= 7.0.4.3)
+      activestorage (= 7.0.4.3)
+      activesupport (= 7.0.4.3)
       bundler (>= 1.15.0)
-      railties (= 7.0.2.3)
+      railties (= 7.0.4.3)
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.4.2)
-      loofah (~> 2.3)
-    railties (7.0.2.3)
-      actionpack (= 7.0.2.3)
-      activesupport (= 7.0.2.3)
+    rails-html-sanitizer (1.5.0)
+      loofah (~> 2.19, >= 2.19.1)
+    railties (7.0.4.3)
+      actionpack (= 7.0.4.3)
+      activesupport (= 7.0.4.3)
       method_source
       rake (>= 12.2)
       thor (~> 1.0)
       zeitwerk (~> 2.5)
     rake (13.0.6)
-    rspec (3.7.0)
-      rspec-core (~> 3.7.0)
-      rspec-expectations (~> 3.7.0)
-      rspec-mocks (~> 3.7.0)
-    rspec-core (3.7.1)
-      rspec-support (~> 3.7.0)
-    rspec-expectations (3.7.0)
+    rspec (3.12.0)
+      rspec-core (~> 3.12.0)
+      rspec-expectations (~> 3.12.0)
+      rspec-mocks (~> 3.12.0)
+    rspec-core (3.12.1)
+      rspec-support (~> 3.12.0)
+    rspec-expectations (3.12.2)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.7.0)
-    rspec-mocks (3.7.0)
+      rspec-support (~> 3.12.0)
+    rspec-mocks (3.12.5)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.7.0)
-    rspec-support (3.7.1)
-    strscan (3.0.1)
+      rspec-support (~> 3.12.0)
+    rspec-support (3.12.0)
+    ruby2_keywords (0.0.5)
     thor (1.2.1)
-    timecop (0.9.1)
-    timeout (0.2.0)
-    tzinfo (2.0.4)
+    timecop (0.9.6)
+    timeout (0.3.2)
+    tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     websocket-driver (0.7.5)
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
-    zeitwerk (2.5.4)
+    zeitwerk (2.6.7)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
-  byebug (= 9.1.0)
+  byebug (= 11.1.3)
   keycloak-api-rails!
-  rspec (= 3.7.0)
-  timecop (= 0.9.1)
+  rspec (= 3.12.0)
+  timecop (= 0.9.6)
 
 BUNDLED WITH
    2.1.4

data/README.md

@@ -1,16 +1,16 @@
 # Keycloak-Rails-Api
 
-This gem aims at validates Keycloak JWT token in Ruby On Rails APIs.
+This gem validates Keycloak JWT token for Ruby On Rails APIs.
 
 ## Install
 
 ```ruby
-gem "keycloak-api-rails", "0.11.2"
+gem "keycloak-api-rails", "0.12.0"
 ```
 
 ## Token validation
 
-Tokens send (through query strings or Authorization headers) to this Railtie Middleware are validated against a Keycloak public key. This public key is downloaded every day by default (this interval can be changed through `public_key_cache_ttl`).
+Tokens sent (through query strings or Authorization headers) are validated against a Keycloak public key. This public key is downloaded every day by default (this interval can be changed through `public_key_cache_ttl`).
 
 ## Pass token to the API
 
@@ -21,6 +21,20 @@ Tokens send (through query strings or Authorization headers) to this Railtie Mid
 
 _If both method are used at the same time, The query string as a higher priority when reading given tokens._
 
+## Opt-in vs. Opt-out validation
+
+By default, Keycloak-api-rails installs as a Rack Middleware. It processes all requests before any application logic. URIs/Paths can be excluded (opted-out) from this validation using the 'skip_paths' config option
+
+Alternatively, it can be configured to `opt-in` to validation. In this case, no Rack middleware is used, and controllers can request (opt-in) by including the module `Keycloak::authentication` and calling `keycloak_authenticate`, for example in a `before_action`, like so: 
+
+```ruby
+class MyApiController < ActionController::Base
+  include Keycloak::Authentication
+
+  before_action :keycloak_authenticate
+end
+```
+
 ## When a token is validated
 
 In Rails controller, the request `env` variables has two more properties:
@@ -39,6 +53,7 @@ All options have a default value. However, all of them can be changed in your in
 | `realm_id` | `nil`| String | Required | Realm's name (not id, actually) | `master` |
 | `logger` | `Logger.new(STDOUT)`| Logger | Optional | The logger used by `keycloak-api-rails` | `Rails.logger` | 
 | `skip_paths` | `{}`| Hash of methods and paths regexp | Optional | Paths whose the token must not be validatefd | `{ get: [/^\/health\/.+/] }`| 
+| `opt_in` | `false` | Boolean | Optional | When true, All requests will be validated (excluding requests matching `skip_paths`). When false, validation must be explicitly requested | `true`
 | `token_expiration_tolerance_in_seconds` | `10`| Logger | Optional | Number of seconds a token can expire before being rejected by the API. | `15` | 
 | `public_key_cache_ttl` | `86400`| Integer | Optional | Amount of time, in seconds, specifying maximum interval between two requests to {project_name} to retrieve new public keys. It is 86400 seconds (1 day) by default. At least once per this configured interval (1 day by default) will be new public key always downloaded. | `Rails.logger` | 
 | `custom_attributes` | `[]`| Array Of String | Optional | List of token attributes to read from each token and to add to their http request env | `["originalFirstName", "originalLastName"]` | 
@@ -59,6 +74,19 @@ Keycloak.configure do |config|
 end
 ```
 
+Or using opt-in configuration:
+
+```ruby
+Keycloak.configure do |config|
+  config.server_url = ENV["KEYCLOAK_SERVER_URL"]
+  config.realm_id   = ENV["KEYCLOAK_REALM_ID"]
+  config.logger     = Rails.logger
+  config.opt_in     = true
+end
+```
+
+When using `opt-in` is true, `skip_paths` is not used. 
+
 ## Use cases
 
 Once this gem is configured in your Rails project, you can read, validate and use tokens in your controllers.
@@ -77,6 +105,24 @@ class AuthenticatedController < ApplicationController
 end
 ```
 
+Or if using opt-in mode, the controller can request validation conditionally: 
+```ruby
+class MostlyAuthenticatedController < ApplicationController
+  include Keycloak::Authentication
+
+  before_action :keycloak_authenticate, only: show
+
+  def show
+    keycloak_id = Keycloak::Helper.current_user_id(request.env)
+    User.active.find_by(keycloak_id: keycloak_id)
+  end
+
+  def index 
+    # unauthenticated
+  end
+end
+```
+
 ### Roles
 
 `Keycloak::Helper.current_user_roles` can be use against a Rails request to read user's roles.

data/keycloak-api-rails.gemspec

@@ -18,7 +18,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency "rails",       ">= 4.2"
   spec.add_dependency "json-jwt",    ">= 1.11.0"
 
-  spec.add_development_dependency "rspec",   "3.7.0"
-  spec.add_development_dependency "timecop", "0.9.1"
-  spec.add_development_dependency "byebug", "9.1.0"
+  spec.add_development_dependency "rspec",   "3.12.0"
+  spec.add_development_dependency "timecop", "0.9.6"
+  spec.add_development_dependency "byebug", "11.1.3"
 end

data/lib/keycloak-api-rails/authentication.rb

@@ -0,0 +1,57 @@
+module Keycloak
+  module Authentication
+    extend ActiveSupport::Concern
+
+    included do
+      if respond_to?(:helper_method)
+        helper_method :keycloak_authenticate
+      end
+    end
+
+    protected
+
+    def keycloak_authenticate
+      
+      env = request.env
+      method = env["REQUEST_METHOD"]
+      path   = env["PATH_INFO"]
+      uri    = env["REQUEST_URI"]
+
+      logger.debug("Start authentication for #{method} : #{path}")
+      token         = service.read_token(uri, env)
+      decoded_token = service.decode_and_verify(token)
+      authentication_succeeded(env, decoded_token)
+      
+    rescue TokenError => e
+      authentication_failed(e.message)
+    end
+
+    def authentication_failed(message)
+      logger.info(message)
+      [401, {"Content-Type" => "application/json"}, [ { error: message }.to_json]]
+    end
+
+    def authentication_succeeded(env, decoded_token)
+      Helper.assign_current_user_id(env, decoded_token)
+      Helper.assign_current_authorized_party(env, decoded_token)
+      Helper.assign_current_user_email(env, decoded_token)
+      Helper.assign_current_user_locale(env, decoded_token)
+      Helper.assign_current_user_custom_attributes(env, decoded_token, config.custom_attributes)
+      Helper.assign_realm_roles(env, decoded_token)
+      Helper.assign_resource_roles(env, decoded_token)
+      Helper.assign_keycloak_token(env, decoded_token)
+    end
+
+    def service
+      Keycloak.service
+    end
+
+    def logger
+      Keycloak.logger
+    end
+
+    def config
+      Keycloak.config
+    end
+  end
+end

data/lib/keycloak-api-rails/configuration.rb

@@ -4,6 +4,7 @@ module Keycloak
     config_accessor :server_url
     config_accessor :realm_id
     config_accessor :skip_paths
+    config_accessor :opt_in
     config_accessor :token_expiration_tolerance_in_seconds
     config_accessor :public_key_cache_ttl
     config_accessor :custom_attributes

data/lib/keycloak-api-rails/middleware.rb

@@ -10,7 +10,7 @@ module Keycloak
       path   = env["PATH_INFO"]
       uri    = env["REQUEST_URI"]
 
-      if service.need_authentication?(method, path, env)
+      if service.need_middleware_authentication?(method, path, env)
         logger.debug("Start authentication for #{method} : #{path}")
         token         = service.read_token(uri, env)
         decoded_token = service.decode_and_verify(token)

data/lib/keycloak-api-rails/service.rb

@@ -4,6 +4,7 @@ module Keycloak
     def initialize(key_resolver)
       @key_resolver                          = key_resolver
       @skip_paths                            = Keycloak.config.skip_paths
+      @opt_in                                = Keycloak.config.opt_in
       @logger                                = Keycloak.config.logger
       @token_expiration_tolerance_in_seconds = Keycloak.config.token_expiration_tolerance_in_seconds
     end
@@ -34,8 +35,8 @@ module Keycloak
       Helper.read_token_from_query_string(uri) || Helper.read_token_from_headers(headers)
     end
 
-    def need_authentication?(method, path, headers)
-      !should_skip?(method, path) && !is_preflight?(method, headers)
+    def need_middleware_authentication?(method, path, headers)
+      !is_preflight?(method, headers) && (!@opt_in && !should_skip?(method, path))
     end
 
     private

data/lib/keycloak-api-rails/version.rb

@@ -1,3 +1,3 @@
 module Keycloak
-  VERSION = "0.11.2"
+  VERSION = "0.12.0"
 end

data/lib/keycloak-api-rails.rb

@@ -4,6 +4,7 @@ require "uri"
 require "date"
 require "net/http"
 
+require_relative "keycloak-api-rails/authentication"
 require_relative "keycloak-api-rails/configuration"
 require_relative "keycloak-api-rails/http_client"
 require_relative "keycloak-api-rails/token_error"
@@ -46,6 +47,7 @@ module Keycloak
       config.realm_id                               = nil
       config.logger                                 = ::Logger.new(STDOUT)
       config.skip_paths                             = {}
+      config.opt_in                                 = false
       config.token_expiration_tolerance_in_seconds  = 10
       config.public_key_cache_ttl                   = 86400
       config.custom_attributes                      = []

data/spec/keycloak-api-rails/authentication_spec.rb

@@ -0,0 +1,32 @@
+require "spec_helper"
+
+describe Keycloak::Authentication do
+  class ExampleController < ActionController::Base
+    include Keycloak::Authentication
+    # Mark protected methods public so they may be called in tests
+    public(*Keycloak::Authentication.protected_instance_methods)
+  end
+
+  let(:controller) { ExampleController.new }
+  let(:token) { 'keycloak_valid_token'}
+  let(:headers) do
+    {
+      'REQUEST_METHOD' => :get,
+      'REQUEST_URI' => 'http://www.an-url.io',
+      'HTTP_AUTHORIZATION' => "Bearer #{token}"
+    }
+  end
+
+  describe "#keycloak_authenticate" do
+    before do
+      # Mock request object because we aren't using real request spec
+      allow(controller).to receive(:request).and_return(double("request", env: headers ))
+    end
+
+    it "it authenticates with request header" do
+      expect_any_instance_of(Keycloak::Service).to receive(:decode_and_verify).with(token).and_return("A User")
+      expect(controller).to receive(:authentication_succeeded)
+      controller.keycloak_authenticate
+    end
+  end
+end

data/spec/keycloak-api-rails/service_spec.rb

@@ -103,7 +103,7 @@ RSpec.describe Keycloak::Service do
     end
   end
 
-  describe "#need_authentication?" do
+  describe "#need_middleware_authentication?" do
 
     let(:method)  { nil }
     let(:path)    { nil }
@@ -115,7 +115,7 @@ RSpec.describe Keycloak::Service do
         post:   [/^\/skip/],
         get:    [/^\/skip/]
       }
-      @result = service.need_authentication?(method, path, headers)
+      @result = service.need_middleware_authentication?(method, path, headers)
     end
 
     context "when method is nil" do
@@ -175,6 +175,18 @@ RSpec.describe Keycloak::Service do
         expect(@result).to be false
       end
     end
+
+    context "when configured as opt_in" do
+      before do
+        Keycloak.config.opt_in = true
+        service2 = Keycloak::Service.new(key_resolver)
+        @result = service2.need_middleware_authentication?(method, path, headers)
+      end
+
+      it "should return false" do
+        expect(@result).to be false
+      end
+    end
   end
 
   describe "#read_token" do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: keycloak-api-rails
 version: !ruby/object:Gem::Version
-  version: 0.11.2
+  version: 0.12.0
 platform: ruby
 authors:
 - Lorent Lempereur
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-03-30 00:00:00.000000000 Z
+date: 2023-04-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -44,42 +44,42 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.7.0
+        version: 3.12.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.7.0
+        version: 3.12.0
 - !ruby/object:Gem::Dependency
   name: timecop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.9.1
+        version: 0.9.6
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.9.1
+        version: 0.9.6
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 9.1.0
+        version: 11.1.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 9.1.0
+        version: 11.1.3
 description: Rails middleware that validates Authorization token emitted by Keycloak
 email:
 - lorent.lempereur.dev@gmail.com
@@ -97,6 +97,7 @@ files:
 - README.md
 - keycloak-api-rails.gemspec
 - lib/keycloak-api-rails.rb
+- lib/keycloak-api-rails/authentication.rb
 - lib/keycloak-api-rails/configuration.rb
 - lib/keycloak-api-rails/helper.rb
 - lib/keycloak-api-rails/http_client.rb
@@ -107,6 +108,7 @@ files:
 - lib/keycloak-api-rails/service.rb
 - lib/keycloak-api-rails/token_error.rb
 - lib/keycloak-api-rails/version.rb
+- spec/keycloak-api-rails/authentication_spec.rb
 - spec/keycloak-api-rails/helper_spec.rb
 - spec/keycloak-api-rails/public_key_cached_resolver_spec.rb
 - spec/keycloak-api-rails/service_spec.rb
@@ -118,7 +120,7 @@ homepage: https://github.com/looorent/keycloak-api-rails
 licenses:
 - MIT
 metadata: {}
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -133,8 +135,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.3
-signing_key:
+rubygems_version: 3.0.3.1
+signing_key: 
 specification_version: 4
 summary: Rails middleware that validates Authorization token emitted by Keycloak
 test_files: []