keycloak-api-rails 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c8848fb5696ab7e2962d8491b2df8e17c1bc88a3f08bb4b328b96e872b5858de
-  data.tar.gz: 9b2f8541d0a2e26f59cec67fcd6573e34c898db12a769335faa701a9c15b66be
+  metadata.gz: cb67f66191b532371ed77f5677c4959a3d01cd8d4fa270dd984a119d796077b0
+  data.tar.gz: 64f29e21b50fb2d6f46d2a136c299aa9864c78aea977c9e4f7dc6a4927a28dff
 SHA512:
-  metadata.gz: e7f9ca820ba2eb32fca2bcbf72c9a19e70ed2bc62e95f6f059fcd848f7aafbb40847017a012a93ff7b5f55fe029b4e7cd353f2376eb90c7a5c0b11f4fac4e310
-  data.tar.gz: 57a3a77dec4b4daeb697ee3b3d8f4ed4ad349c2b68e60ca7001e46be2809a358c1e24e6dd1a3e2d31270be9e0e8daaac0176511e7009ce9cca4ea591e8040ba7
+  metadata.gz: 2db5967b4c4b7e678763d015dd05567103cafb42bce12f0018c241df45400f8c4538309a59dd7526994bc14cf587aef3b7c51040d89ca2599c91c409b6acf8a5
+  data.tar.gz: 847fc92280c17a54d7f10976197b4ea0b37fea4217ee7ef9dd6d7089399b261831a07d3d56d07ffce2827aaf86c4332da680b3eaa044a3c35d0cb2347f123043

data/.github/workflows/ci.yml

@@ -11,11 +11,18 @@ permissions:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    name: Ruby ${{ matrix.ruby-version }}
+    # Pinned rather than 'ubuntu-latest': ruby/setup-ruby has no prebuilt Rubies for
+    # ubuntu-26.04 yet, so the oldest versions of the matrix would break once the
+    # 'latest' alias moves on.
+    runs-on: ubuntu-24.04
 
     strategy:
+      fail-fast: false
       matrix:
-        ruby-version: ['3.2']
+        # Each version resolves the newest dependencies it supports: Rails 7.1 on Ruby 2.7
+        # and 3.0, Rails 7.2 on Ruby 3.1, Rails 8.1 on Ruby 3.2 and above.
+        ruby-version: ['2.7', '3.0', '3.1', '3.2', '3.3', '3.4', '4.0']
 
     steps:
     - uses: actions/checkout@v4

data/.gitignore

@@ -1,4 +1,8 @@
 .bundle/
 log/*.log
 .byebug_history
-*.gem
+*.gem
+# This gem supports several Ruby versions, each of them resolving a different set of
+# dependencies (Ruby 2.7 caps Rails to 7.1, Ruby 3.1 to 7.2, Ruby 3.2+ resolves Rails 8.1).
+# A single committed lockfile cannot satisfy all of them.
+Gemfile.lock

data/CHANGELOG.md

@@ -5,7 +5,15 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [1.0.0] - 2025-06-20
+## [1.1.0] - 2026-07-31
+
+* Dependencies: Upgrade test dependency `timecop` to `0.9.11`
+* Upgrade Docker image to Ruby 3.4
+* Remove all usages of `ActiveSupport` from the library, replaced by plain Ruby
+* Support Ruby 2.7 up to 4.0: declare `required_ruby_version >= 2.7` and stop committing `Gemfile.lock`, so that each Ruby version resolves the dependencies it supports (Rails 7.1 on Ruby 2.7 and 3.0, Rails 7.2 on Ruby 3.1, Rails 8.1 on Ruby 3.2 and above)
+* Test dependency `byebug` is no longer pinned to an exact version, since byebug 12 requires Ruby 3.1
+
+## [1.0.0] - 2025-12-10
 
 * *[BREAKING CHANGE!]* Rename top-level module from `Keycloak` to `KeycloakApiRails` to avoid conflicts with other gems. (thanks to @eilers)
   * *Migration: Please do a global find and replace of `Keycloak.` to `KeycloakApiRails.` in your application.*

data/Dockerfile

@@ -1,4 +1,4 @@
-FROM ruby:3.2.2-slim-bullseye
+FROM ruby:3.4.10-slim-bookworm
 
 RUN apt-get update -qq && apt-get install -y build-essential git ruby-dev && apt-get clean && \
   mkdir -p /usr/src/app/lib/keycloak-api-rails
@@ -6,7 +6,6 @@ RUN apt-get update -qq && apt-get install -y build-essential git ruby-dev && apt
 WORKDIR /usr/src/app
 
 COPY Gemfile /usr/src/app/
-COPY Gemfile.lock /usr/src/app/
 COPY keycloak-api-rails.gemspec /usr/src/app/
 COPY lib/keycloak-api-rails/version.rb /usr/src/app/lib/keycloak-api-rails/
 RUN bundle install

data/README.md

@@ -2,10 +2,23 @@
 
 This gem validates Keycloak JWT token for Ruby On Rails APIs.
 
+## Requirements
+
+* Ruby `>= 2.7`
+* Rails `>= 4.2`
+
+Every push is tested against Ruby 2.7, 3.0, 3.1, 3.2, 3.3, 3.4 and 4.0. Each of them installs the
+most recent dependencies it supports, so the test suite runs against Rails 7.1 (Ruby 2.7 and 3.0),
+Rails 7.2 (Ruby 3.1) and Rails 8.1 (Ruby 3.2 and above).
+
+Ruby 2.7 and 3.0 reached their end of life and no longer receive security fixes. They are supported
+here so that applications running on Rails 7.0 and 7.1 can use this gem, but upgrading Ruby remains
+the recommended path.
+
 ## Install
 
 ```ruby
-gem "keycloak-api-rails", "1.0.0"
+gem "keycloak-api-rails", "1.1.0"
 ```
 
 ## Token validation
@@ -63,7 +76,7 @@ All options have a default value. However, all of them can be changed in your in
 Create a `keycloak.rb` file in your Rails `config/initializers` folder. For instance:
 
 ```
-Keycloak.configure do |config|
+KeycloakApiRails.configure do |config|
   config.server_url = ENV["KEYCLOAK_SERVER_URL"]
   config.realm_id   = ENV["KEYCLOAK_REALM_ID"]
   config.logger     = Rails.logger
@@ -77,7 +90,7 @@ end
 Or using opt-in configuration:
 
 ```ruby
-Keycloak.configure do |config|
+KeycloakApiRails.configure do |config|
   config.server_url = ENV["KEYCLOAK_SERVER_URL"]
   config.realm_id   = ENV["KEYCLOAK_REALM_ID"]
   config.logger     = Rails.logger
@@ -163,14 +176,14 @@ This should output `https://api.pouet.io/api/more-pouets?authorizationToken=myTo
 
 ### Accessing Keycloak Service
 
-A lazy-loaded service KeycloakApiRails::Service can be accessed using `Keycloak.service`.
+A lazy-loaded service KeycloakApiRails::Service can be accessed using `KeycloakApiRails.service`.
 For instance, to read a provided token:
 ```ruby
 class RenderTokenController < ApplicationController
   def show
     uri     = request.env["REQUEST_URI"]
     headers = request.env
-    token   = Keycloak.service.read_token(uri, headers)
+    token   = KeycloakApiRails.service.read_token(uri, headers)
     render json: { token: token }, status: :ok
   end
 end
@@ -200,10 +213,10 @@ let(:jwt) do
   token.sign($private_key, :RS256).to_s
 end
 ```
-* Finally, in the same `shared_context`, stub `Keycloak.public_key_resolver` to use a valid public key that is able to validate `jwt`:
+* Finally, in the same `shared_context`, stub `KeycloakApiRails.public_key_resolver` to use a valid public key that is able to validate `jwt`:
 ```ruby
 before(:each) do
-  public_key_resolver = Keycloak.public_key_resolver
+  public_key_resolver = KeycloakApiRails.public_key_resolver
   allow(public_key_resolver).to receive(:find_public_keys) { JSON::JWK::Set.new(JSON::JWK.new($private_key, kid: "default")) }
 end
 ```
@@ -216,7 +229,7 @@ From the `keycloak-rails-api` directory:
   $ docker build . -t keycloak-rails-api:test
   $ docker run -v `pwd`:/usr/src/app/ keycloak-rails-api:test bundle exec rspec spec
 ```
-rspe
+
 ## Next developments
 
 * Manage multiple realms

data/keycloak-api-rails.gemspec

@@ -15,10 +15,14 @@ Gem::Specification.new do |spec|
   spec.files = `git ls-files -z`.split("\x0")
   spec.require_paths = ["lib"]
 
+  spec.required_ruby_version = ">= 2.7"
+
   spec.add_dependency "rails",       ">= 4.2"
   spec.add_dependency "json-jwt",    ">= 1.11.0"
 
   spec.add_development_dependency "rspec",   "3.13.2"
-  spec.add_development_dependency "timecop", "0.9.10"
-  spec.add_development_dependency "byebug", "12.0.0"
+  spec.add_development_dependency "timecop", "0.9.11"
+  # Not pinned to an exact version: byebug 12 requires Ruby >= 3.1, byebug 13 requires Ruby >= 3.2.
+  # Older Rubies resolve to byebug 11.
+  spec.add_development_dependency "byebug", ">= 11.1.3"
 end

data/lib/keycloak-api-rails/authentication.rb

@@ -1,10 +1,8 @@
 module KeycloakApiRails
   module Authentication
-    extend ActiveSupport::Concern
-
-    included do
-      if respond_to?(:helper_method)
-        helper_method :keycloak_authenticate
+    def self.included(base)
+      if base.respond_to?(:helper_method)
+        base.helper_method :keycloak_authenticate
       end
     end
 

data/lib/keycloak-api-rails/configuration.rb

@@ -1,14 +1,13 @@
 module KeycloakApiRails
   class Configuration
-    include ActiveSupport::Configurable
-    config_accessor :server_url
-    config_accessor :realm_id
-    config_accessor :skip_paths
-    config_accessor :opt_in
-    config_accessor :token_expiration_tolerance_in_seconds
-    config_accessor :public_key_cache_ttl
-    config_accessor :custom_attributes
-    config_accessor :logger
-    config_accessor :ca_certificate_file
+    attr_accessor :server_url
+    attr_accessor :realm_id
+    attr_accessor :skip_paths
+    attr_accessor :opt_in
+    attr_accessor :token_expiration_tolerance_in_seconds
+    attr_accessor :public_key_cache_ttl
+    attr_accessor :custom_attributes
+    attr_accessor :logger
+    attr_accessor :ca_certificate_file
   end
 end

data/lib/keycloak-api-rails/helper.rb

@@ -83,11 +83,11 @@ module KeycloakApiRails
     end
 
     def self.read_token_from_query_string(uri)
-      if uri.present?
+      if uri && !uri.strip.empty?
         parsed_uri         = URI.parse(uri)
         query              = URI.decode_www_form(parsed_uri.query || "")
         query_string_token = query.detect { |param| param.first == QUERY_STRING_TOKEN_KEY }
-        query_string_token&.second
+        query_string_token&.at(1)
       else
         ""
       end

data/lib/keycloak-api-rails/public_key_cached_resolver.rb

@@ -24,7 +24,7 @@ module KeycloakApiRails
     private
 
     def public_keys_are_outdated?
-      @cached_public_keys.nil? || @cached_public_key_retrieved_at.nil? || Time.now > (@cached_public_key_retrieved_at + @public_key_cache_ttl.seconds)
+      @cached_public_keys.nil? || @cached_public_key_retrieved_at.nil? || Time.now > (@cached_public_key_retrieved_at + @public_key_cache_ttl)
     end
   end
 end

data/lib/keycloak-api-rails/service.rb

@@ -53,8 +53,8 @@ module KeycloakApiRails
     end
 
     def expired?(token)
-      token_expiration = Time.at(token["exp"]).to_datetime
-      token_expiration < Time.now + @token_expiration_tolerance_in_seconds.seconds
+      token_expiration = Time.at(token["exp"])
+      token_expiration < Time.now + @token_expiration_tolerance_in_seconds
     end
   end
 end

data/lib/keycloak-api-rails/version.rb

@@ -1,3 +1,3 @@
 module KeycloakApiRails
-  VERSION = "1.0.0"
+  VERSION = "1.1.0"
 end

data/spec/keycloak-api-rails/activesupport_free_spec.rb

@@ -0,0 +1,18 @@
+require "rbconfig"
+
+RSpec.describe "The library without ActiveSupport" do
+
+  let(:probe) { File.expand_path("../../support/activesupport_free_probe.rb", __FILE__) }
+
+  # RUBYOPT is cleared so that nothing set up by bundler is preloaded in the probe process.
+  def run_probe
+    output = IO.popen({ "RUBYOPT" => nil }, [RbConfig.ruby, probe], err: [:child, :out], &:read)
+    [$?.exitstatus, output]
+  end
+
+  it "loads and behaves the same way when ActiveSupport is not available" do
+    status, output = run_probe
+
+    expect(status).to eq(0), "The library relies on ActiveSupport:\n#{output}"
+  end
+end

data/spec/keycloak-api-rails/authentication_spec.rb

@@ -17,6 +17,44 @@ describe KeycloakApiRails::Authentication do
     }
   end
 
+  describe "when included" do
+    it "declares keycloak_authenticate as a helper method when the base class supports helpers" do
+      declared_helper_methods = []
+      base = Class.new do
+        define_singleton_method(:helper_method) { |*names| declared_helper_methods.concat(names) }
+      end
+
+      base.include(KeycloakApiRails::Authentication)
+
+      expect(declared_helper_methods).to eq [:keycloak_authenticate]
+    end
+
+    it "declares the helper method on a real controller" do
+      expect(ExampleController._helper_methods).to include :keycloak_authenticate
+    end
+
+    it "does not fail when the base class does not support helpers" do
+      expect {
+        Class.new.include(KeycloakApiRails::Authentication)
+      }.to_not raise_error
+    end
+
+    it "exposes its methods as protected instance methods" do
+      expect(KeycloakApiRails::Authentication.protected_instance_methods).to match_array %i[
+        keycloak_authenticate
+        authentication_failed
+        authentication_succeeded
+      ]
+    end
+
+    it "does not add any public method to the including class" do
+      base = Class.new.include(KeycloakApiRails::Authentication)
+
+      expect(base.public_instance_methods).to_not include :keycloak_authenticate
+      expect(base.protected_instance_methods).to include :keycloak_authenticate
+    end
+  end
+
   describe "#keycloak_authenticate" do
     before do
       # Mock request object because we aren't using real request spec

data/spec/keycloak-api-rails/configuration_spec.rb

@@ -0,0 +1,101 @@
+RSpec.describe KeycloakApiRails::Configuration do
+
+  # Every attribute that used to be declared through ActiveSupport's `config_accessor`.
+  let(:attribute_names) do
+    %i[
+      server_url
+      realm_id
+      skip_paths
+      opt_in
+      token_expiration_tolerance_in_seconds
+      public_key_cache_ttl
+      custom_attributes
+      logger
+      ca_certificate_file
+    ]
+  end
+
+  describe "attributes" do
+    let(:configuration) { KeycloakApiRails::Configuration.new }
+
+    it "exposes a reader and a writer for each attribute" do
+      attribute_names.each do |name|
+        expect(configuration).to respond_to name
+        expect(configuration).to respond_to "#{name}="
+      end
+    end
+
+    it "returns nil for each attribute that has not been assigned" do
+      attribute_names.each do |name|
+        expect(configuration.public_send(name)).to be_nil
+      end
+    end
+
+    it "returns the value that has been assigned" do
+      attribute_names.each do |name|
+        configuration.public_send("#{name}=", "a value for #{name}")
+        expect(configuration.public_send(name)).to eq "a value for #{name}"
+      end
+    end
+
+    it "does not respond to an unknown attribute" do
+      expect(configuration).to_not respond_to :not_a_configuration_attribute
+      expect {
+        configuration.not_a_configuration_attribute
+      }.to raise_error NoMethodError
+    end
+  end
+
+  describe "#configure" do
+    after(:each) do
+      KeycloakApiRails.load_configuration
+    end
+
+    it "yields the configuration" do
+      expect { |block| KeycloakApiRails.configure(&block) }.to yield_with_args KeycloakApiRails::Configuration
+    end
+
+    it "keeps the values assigned within the block" do
+      KeycloakApiRails.configure do |config|
+        config.server_url          = "http://keycloak:8080"
+        config.realm_id            = "a-realm"
+        config.ca_certificate_file = "/etc/ssl/a-certificate.pem"
+      end
+
+      expect(KeycloakApiRails.config.server_url).to eq "http://keycloak:8080"
+      expect(KeycloakApiRails.config.realm_id).to eq "a-realm"
+      expect(KeycloakApiRails.config.ca_certificate_file).to eq "/etc/ssl/a-certificate.pem"
+    end
+
+    it "always returns the same configuration instance" do
+      expect(KeycloakApiRails.config).to be KeycloakApiRails.config
+    end
+  end
+
+  describe "#load_configuration" do
+    before(:each) do
+      KeycloakApiRails.load_configuration
+    end
+
+    after(:each) do
+      KeycloakApiRails.load_configuration
+    end
+
+    it "applies the documented default values" do
+      config = KeycloakApiRails.config
+
+      expect(config.server_url).to be_nil
+      expect(config.realm_id).to be_nil
+      expect(config.logger).to be_a ::Logger
+      expect(config.skip_paths).to eq({})
+      expect(config.opt_in).to be false
+      expect(config.token_expiration_tolerance_in_seconds).to eq 10
+      expect(config.public_key_cache_ttl).to eq 86400
+      expect(config.custom_attributes).to eq []
+    end
+
+    it "exposes the logger through KeycloakApiRails.logger" do
+      expect(KeycloakApiRails.logger).to be KeycloakApiRails.config.logger
+    end
+  end
+end

data/spec/keycloak-api-rails/helper_spec.rb

@@ -1,4 +1,65 @@
 RSpec.describe KeycloakApiRails::Helper do
+  describe "#read_token_from_query_string" do
+
+    subject { KeycloakApiRails::Helper.read_token_from_query_string(uri) }
+
+    context "when the uri is nil" do
+      let(:uri) { nil }
+      it "returns an empty token" do
+        expect(subject).to eq ""
+      end
+    end
+
+    context "when the uri is empty" do
+      let(:uri) { "" }
+      it "returns an empty token" do
+        expect(subject).to eq ""
+      end
+    end
+
+    context "when the uri only contains whitespaces" do
+      let(:uri) { "   " }
+      it "returns an empty token" do
+        expect(subject).to eq ""
+      end
+    end
+
+    context "when the uri has no query string" do
+      let(:uri) { "http://www.an-url.io/health" }
+      it "returns no token" do
+        expect(subject).to be_nil
+      end
+    end
+
+    context "when the uri has a query string but no token" do
+      let(:uri) { "http://www.an-url.io/health?firstName=ouioui" }
+      it "returns no token" do
+        expect(subject).to be_nil
+      end
+    end
+
+    context "when the uri has a token in the query string" do
+      let(:uri) { "http://www.an-url.io/health?authorizationToken=aToken" }
+      it "returns the token" do
+        expect(subject).to eq "aToken"
+      end
+    end
+
+    context "when the uri has a token among other query string parameters" do
+      let(:uri) { "http://www.an-url.io/health?firstName=ouioui&authorizationToken=aToken&lastName=nonnon" }
+      it "returns the token" do
+        expect(subject).to eq "aToken"
+      end
+    end
+
+    context "when the uri has an empty token in the query string" do
+      let(:uri) { "http://www.an-url.io/health?authorizationToken=" }
+      it "returns an empty token" do
+        expect(subject).to eq ""
+      end
+    end
+  end
+
   describe "#create_url_with_token" do
 
     let(:uri)   { "http://www.an-url.io" }

data/spec/keycloak-api-rails/service_spec.rb

@@ -80,9 +80,31 @@ RSpec.describe KeycloakApiRails::Service do
           end
         end
 
+        # The service reads `token_expiration_tolerance_in_seconds` when it is instantiated:
+        # a token expiring within that tolerance is already considered as expired.
+        context "and token expires within the expiration tolerance" do
+          let(:expiration_date) { Time.now + 5 }
+
+          it "should raise an error :expiration_date" do
+            expect(KeycloakApiRails.config.token_expiration_tolerance_in_seconds).to eq 10
+            expect {
+              service.decode_and_verify(token)
+            }.to raise_error(TokenError, "JWT token is expired")
+          end
+        end
+
+        context "and token expires just after the expiration tolerance" do
+          let(:expiration_date) { Time.now + 30 }
+
+          it "should return a not-nil decoded token" do
+            expect(KeycloakApiRails.config.token_expiration_tolerance_in_seconds).to eq 10
+            expect(service.decode_and_verify(token)).to_not be_nil
+          end
+        end
+
         context "and token is not expired" do
           let(:expiration_date) { Time.now + 2.days }
-          
+
           context "and token is encrypted using RS256" do
             let(:algorithm) { :RS256 }
             

data/spec/support/activesupport_free_probe.rb

@@ -0,0 +1,131 @@
+# Loads the library and exercises every code path that used to rely on ActiveSupport,
+# in a process where ActiveSupport is *not* loaded.
+#
+# The regular test suite loads `rails/all`, which makes ActiveSupport available everywhere and
+# therefore cannot detect that the library depends on it again. This probe is executed in a
+# separate process by spec/keycloak-api-rails/activesupport_free_spec.rb.
+#
+# The library files are required one by one on purpose: `lib/keycloak-api-rails.rb` pulls in
+# `json/jwt`, which depends on ActiveSupport. The point of this probe is that *our* code does not
+# use ActiveSupport, not that it never gets loaded by a third party.
+
+require "uri"
+require "date"
+require "logger"
+
+LIB = File.expand_path("../../../lib/keycloak-api-rails", __FILE__)
+
+# Minimal stand-in for the parts of lib/keycloak-api-rails.rb the required files call at runtime.
+module KeycloakApiRails
+  class << self
+    attr_accessor :config
+  end
+end
+
+require "#{LIB}/configuration"
+require "#{LIB}/helper"
+require "#{LIB}/authentication"
+require "#{LIB}/public_key_resolver"
+require "#{LIB}/public_key_cached_resolver"
+require "#{LIB}/service"
+
+$failures = []
+
+def assert(description)
+  $failures << description unless yield
+rescue => e
+  $failures << "#{description} (raised #{e.class}: #{e.message})"
+end
+
+assert("ActiveSupport is not loaded by the library") { !defined?(ActiveSupport) }
+
+### Configuration -- used to be ActiveSupport::Configurable
+configuration = KeycloakApiRails::Configuration.new
+KeycloakApiRails.config = configuration
+
+%i[
+  server_url realm_id skip_paths opt_in token_expiration_tolerance_in_seconds
+  public_key_cache_ttl custom_attributes logger ca_certificate_file
+].each do |name|
+  assert("Configuration##{name} is nil until it is assigned") { configuration.public_send(name).nil? }
+  configuration.public_send("#{name}=", "a value for #{name}")
+  assert("Configuration##{name} returns what was assigned") { configuration.public_send(name) == "a value for #{name}" }
+end
+
+### Authentication -- used to be ActiveSupport::Concern
+declared_helper_methods = []
+controller_with_helpers = Class.new do
+  define_singleton_method(:helper_method) { |*names| declared_helper_methods.concat(names) }
+end
+controller_with_helpers.include(KeycloakApiRails::Authentication)
+assert("Authentication declares keycloak_authenticate as a helper method") do
+  declared_helper_methods == [:keycloak_authenticate]
+end
+assert("Authentication can be included in a class without helper_method") do
+  Class.new.include(KeycloakApiRails::Authentication)
+  true
+end
+assert("Authentication keeps its methods protected") do
+  KeycloakApiRails::Authentication.protected_instance_methods.sort ==
+    %i[authentication_failed authentication_succeeded keycloak_authenticate]
+end
+
+### Helper#read_token_from_query_string -- used to be `present?` and `second`
+{
+  nil                                                             => "",
+  ""                                                              => "",
+  "   "                                                           => "",
+  "http://www.an-url.io/health"                                   => nil,
+  "http://www.an-url.io/health?firstName=ouioui"                  => nil,
+  "http://www.an-url.io/health?authorizationToken=aToken"         => "aToken",
+  "http://www.an-url.io/health?a=1&authorizationToken=aToken&b=2" => "aToken",
+}.each do |uri, expected|
+  assert("Helper.read_token_from_query_string(#{uri.inspect}) returns #{expected.inspect}") do
+    KeycloakApiRails::Helper.read_token_from_query_string(uri) == expected
+  end
+end
+
+### Service#expired? -- used to be `to_datetime` and `seconds`
+configuration.token_expiration_tolerance_in_seconds = 10
+configuration.skip_paths = {}
+configuration.opt_in     = false
+configuration.logger     = ::Logger.new(File::NULL)
+service = KeycloakApiRails::Service.new(nil)
+now = Time.now
+
+{
+  "expiring in one hour"                         => [(now + 3600).to_i, false],
+  "expired two days ago"                         => [(now - 172800).to_i, true],
+  "expiring within the tolerance (5s < 10s)"     => [(now + 5).to_i, true],
+  "expiring after the tolerance (30s > 10s)"     => [(now + 30).to_i, false],
+}.each do |description, (exp, expected)|
+  assert("Service#expired? returns #{expected} for a token #{description}") do
+    service.send(:expired?, { "exp" => exp }) == expected
+  end
+end
+
+### PublicKeyCachedResolver -- used to be `seconds`
+ttl = 86400
+resolver = KeycloakApiRails::PublicKeyCachedResolver.new(nil, "a-realm", ttl)
+assert("PublicKeyCachedResolver considers an empty cache as outdated") do
+  resolver.send(:public_keys_are_outdated?) == true
+end
+resolver.instance_variable_set(:@cached_public_keys, "a-public-key")
+resolver.instance_variable_set(:@cached_public_key_retrieved_at, Time.now - (ttl - 10))
+assert("PublicKeyCachedResolver keeps a cache that is within its TTL") do
+  resolver.send(:public_keys_are_outdated?) == false
+end
+resolver.instance_variable_set(:@cached_public_key_retrieved_at, Time.now - (ttl + 10))
+assert("PublicKeyCachedResolver invalidates a cache that outlived its TTL") do
+  resolver.send(:public_keys_are_outdated?) == true
+end
+
+assert("ActiveSupport has not been loaded while exercising the library") { !defined?(ActiveSupport) }
+
+if $failures.empty?
+  puts "The library behaves correctly without ActiveSupport"
+  exit 0
+else
+  $failures.each { |failure| puts "FAILED: #{failure}" }
+  exit 1
+end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: keycloak-api-rails
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Lorent Lempereur
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2025-12-10 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -58,28 +57,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.9.10
+        version: 0.9.11
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.9.10
+        version: 0.9.11
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 12.0.0
+        version: 11.1.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 12.0.0
+        version: 11.1.3
 description: Rails middleware that validates Authorization token emitted by Keycloak
 email:
 - lorent.lempereur.dev@gmail.com
@@ -93,7 +92,6 @@ files:
 - CHANGELOG.md
 - Dockerfile
 - Gemfile
-- Gemfile.lock
 - MIT-LICENSE
 - README.md
 - keycloak-api-rails.gemspec
@@ -109,11 +107,14 @@ files:
 - lib/keycloak-api-rails/service.rb
 - lib/keycloak-api-rails/token_error.rb
 - lib/keycloak-api-rails/version.rb
+- spec/keycloak-api-rails/activesupport_free_spec.rb
 - spec/keycloak-api-rails/authentication_spec.rb
+- spec/keycloak-api-rails/configuration_spec.rb
 - spec/keycloak-api-rails/helper_spec.rb
 - spec/keycloak-api-rails/public_key_cached_resolver_spec.rb
 - spec/keycloak-api-rails/service_spec.rb
 - spec/spec_helper.rb
+- spec/support/activesupport_free_probe.rb
 - spec/support/public_key_cached_resolver_stub.rb
 - spec/support/public_key_resolver_stub.rb
 - spec/support/rails_helper.rb
@@ -121,7 +122,6 @@ homepage: https://github.com/looorent/keycloak-api-rails
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -129,15 +129,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '2.7'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
-signing_key: 
+rubygems_version: 4.0.17
 specification_version: 4
 summary: Rails middleware that validates Authorization token emitted by Keycloak
 test_files: []

data/Gemfile.lock

@@ -1,244 +0,0 @@
-PATH
-  remote: .
-  specs:
-    keycloak-api-rails (1.0.0)
-      json-jwt (>= 1.11.0)
-      rails (>= 4.2)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    action_text-trix (2.1.15)
-      railties
-    actioncable (8.1.1)
-      actionpack (= 8.1.1)
-      activesupport (= 8.1.1)
-      nio4r (~> 2.0)
-      websocket-driver (>= 0.6.1)
-      zeitwerk (~> 2.6)
-    actionmailbox (8.1.1)
-      actionpack (= 8.1.1)
-      activejob (= 8.1.1)
-      activerecord (= 8.1.1)
-      activestorage (= 8.1.1)
-      activesupport (= 8.1.1)
-      mail (>= 2.8.0)
-    actionmailer (8.1.1)
-      actionpack (= 8.1.1)
-      actionview (= 8.1.1)
-      activejob (= 8.1.1)
-      activesupport (= 8.1.1)
-      mail (>= 2.8.0)
-      rails-dom-testing (~> 2.2)
-    actionpack (8.1.1)
-      actionview (= 8.1.1)
-      activesupport (= 8.1.1)
-      nokogiri (>= 1.8.5)
-      rack (>= 2.2.4)
-      rack-session (>= 1.0.1)
-      rack-test (>= 0.6.3)
-      rails-dom-testing (~> 2.2)
-      rails-html-sanitizer (~> 1.6)
-      useragent (~> 0.16)
-    actiontext (8.1.1)
-      action_text-trix (~> 2.1.15)
-      actionpack (= 8.1.1)
-      activerecord (= 8.1.1)
-      activestorage (= 8.1.1)
-      activesupport (= 8.1.1)
-      globalid (>= 0.6.0)
-      nokogiri (>= 1.8.5)
-    actionview (8.1.1)
-      activesupport (= 8.1.1)
-      builder (~> 3.1)
-      erubi (~> 1.11)
-      rails-dom-testing (~> 2.2)
-      rails-html-sanitizer (~> 1.6)
-    activejob (8.1.1)
-      activesupport (= 8.1.1)
-      globalid (>= 0.3.6)
-    activemodel (8.1.1)
-      activesupport (= 8.1.1)
-    activerecord (8.1.1)
-      activemodel (= 8.1.1)
-      activesupport (= 8.1.1)
-      timeout (>= 0.4.0)
-    activestorage (8.1.1)
-      actionpack (= 8.1.1)
-      activejob (= 8.1.1)
-      activerecord (= 8.1.1)
-      activesupport (= 8.1.1)
-      marcel (~> 1.0)
-    activesupport (8.1.1)
-      base64
-      bigdecimal
-      concurrent-ruby (~> 1.0, >= 1.3.1)
-      connection_pool (>= 2.2.5)
-      drb
-      i18n (>= 1.6, < 2)
-      json
-      logger (>= 1.4.2)
-      minitest (>= 5.1)
-      securerandom (>= 0.3)
-      tzinfo (~> 2.0, >= 2.0.5)
-      uri (>= 0.13.1)
-    aes_key_wrap (1.1.0)
-    base64 (0.3.0)
-    bigdecimal (3.3.1)
-    bindata (2.5.1)
-    builder (3.3.0)
-    byebug (12.0.0)
-    concurrent-ruby (1.3.5)
-    connection_pool (3.0.2)
-    crass (1.0.6)
-    date (3.5.1)
-    diff-lcs (1.6.2)
-    drb (2.2.3)
-    erb (6.0.0)
-    erubi (1.13.1)
-    faraday (2.14.0)
-      faraday-net_http (>= 2.0, < 3.5)
-      json
-      logger
-    faraday-follow_redirects (0.4.0)
-      faraday (>= 1, < 3)
-    faraday-net_http (3.4.2)
-      net-http (~> 0.5)
-    globalid (1.3.0)
-      activesupport (>= 6.1)
-    i18n (1.14.7)
-      concurrent-ruby (~> 1.0)
-    io-console (0.8.1)
-    irb (1.15.3)
-      pp (>= 0.6.0)
-      rdoc (>= 4.0.0)
-      reline (>= 0.4.2)
-    json (2.17.1)
-    json-jwt (1.17.0)
-      activesupport (>= 4.2)
-      aes_key_wrap
-      base64
-      bindata
-      faraday (~> 2.0)
-      faraday-follow_redirects
-    logger (1.7.0)
-    loofah (2.24.1)
-      crass (~> 1.0.2)
-      nokogiri (>= 1.12.0)
-    mail (2.9.0)
-      logger
-      mini_mime (>= 0.1.1)
-      net-imap
-      net-pop
-      net-smtp
-    marcel (1.1.0)
-    mini_mime (1.1.5)
-    mini_portile2 (2.8.9)
-    minitest (5.26.2)
-    net-http (0.8.0)
-      uri (>= 0.11.1)
-    net-imap (0.5.12)
-      date
-      net-protocol
-    net-pop (0.1.2)
-      net-protocol
-    net-protocol (0.2.2)
-      timeout
-    net-smtp (0.5.1)
-      net-protocol
-    nio4r (2.7.5)
-    nokogiri (1.18.10)
-      mini_portile2 (~> 2.8.2)
-      racc (~> 1.4)
-    pp (0.6.3)
-      prettyprint
-    prettyprint (0.2.0)
-    psych (5.3.0)
-      date
-      stringio
-    racc (1.8.1)
-    rack (3.2.4)
-    rack-session (2.1.1)
-      base64 (>= 0.1.0)
-      rack (>= 3.0.0)
-    rack-test (2.2.0)
-      rack (>= 1.3)
-    rackup (2.3.1)
-      rack (>= 3)
-    rails (8.1.1)
-      actioncable (= 8.1.1)
-      actionmailbox (= 8.1.1)
-      actionmailer (= 8.1.1)
-      actionpack (= 8.1.1)
-      actiontext (= 8.1.1)
-      actionview (= 8.1.1)
-      activejob (= 8.1.1)
-      activemodel (= 8.1.1)
-      activerecord (= 8.1.1)
-      activestorage (= 8.1.1)
-      activesupport (= 8.1.1)
-      bundler (>= 1.15.0)
-      railties (= 8.1.1)
-    rails-dom-testing (2.3.0)
-      activesupport (>= 5.0.0)
-      minitest
-      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.6.2)
-      loofah (~> 2.21)
-      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
-    railties (8.1.1)
-      actionpack (= 8.1.1)
-      activesupport (= 8.1.1)
-      irb (~> 1.13)
-      rackup (>= 1.0.0)
-      rake (>= 12.2)
-      thor (~> 1.0, >= 1.2.2)
-      tsort (>= 0.2)
-      zeitwerk (~> 2.6)
-    rake (13.3.1)
-    rdoc (6.17.0)
-      erb
-      psych (>= 4.0.0)
-      tsort
-    reline (0.6.3)
-      io-console (~> 0.5)
-    rspec (3.13.2)
-      rspec-core (~> 3.13.0)
-      rspec-expectations (~> 3.13.0)
-      rspec-mocks (~> 3.13.0)
-    rspec-core (3.13.6)
-      rspec-support (~> 3.13.0)
-    rspec-expectations (3.13.5)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.7)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.13.0)
-    rspec-support (3.13.6)
-    securerandom (0.4.1)
-    stringio (3.1.9)
-    thor (1.4.0)
-    timecop (0.9.10)
-    timeout (0.5.0)
-    tsort (0.2.0)
-    tzinfo (2.0.6)
-      concurrent-ruby (~> 1.0)
-    uri (1.1.1)
-    useragent (0.16.11)
-    websocket-driver (0.8.0)
-      base64
-      websocket-extensions (>= 0.1.0)
-    websocket-extensions (0.1.5)
-    zeitwerk (2.7.3)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  byebug (= 12.0.0)
-  keycloak-api-rails!
-  rspec (= 3.13.2)
-  timecop (= 0.9.10)
-
-BUNDLED WITH
-   2.4.13