keycloak-api-rails 1.0.1 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 72a9cf5907ae0256e7acfbf9bd9e453dcbcaeae5fd4c5ce146780e3ef5ec2644
-  data.tar.gz: ac22d1edfbf8d1701ac82a213f3052ca32976dd766841111066600910497d58d
+  metadata.gz: 1f53bfe86f8f72911bac95192b9a21fc0cf1ec01868e00f2cdd8edfcc57811e3
+  data.tar.gz: 2ad644c2561e191e9dd858055a9442df69fff0af02d078360164f1d41283f633
 SHA512:
-  metadata.gz: e73d57fcaf904c534048ff6d6e611913298b173be1e47b01b31c7c6cb351f2e8d74b00a57027ce03063b63391f2200c9c8d866a18a7cb632856acb77bdb5d494
-  data.tar.gz: be4136364d974a0ebcba62a31f526341cdef89f0f87f991dde409cb40a36303f0ae4a781599929caf830cf89a58ce01b20e2c7209ef7613c9e0d465b831bbb17
+  metadata.gz: da17e6a76b47460200ea397c58346dbdd43975f7aecec34e973b77ad15ebd12739d2c5d533064af24204d5be7bd4cc0f3c74b3df98e6d2623289a0d66f1398ad
+  data.tar.gz: 1f1f0ed249c2963fec160fdbdb6910a8387024f54d9956c35729fb5438037b541989046aee9dab2936dcc585d8f5e9ca6cd1b3247c20fb4dcea62ff7e2fae253

data/.github/workflows/ci.yml

@@ -11,11 +11,18 @@ permissions:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    name: Ruby ${{ matrix.ruby-version }}
+    # Pinned rather than 'ubuntu-latest': ruby/setup-ruby has no prebuilt Rubies for
+    # ubuntu-26.04 yet, so the oldest versions of the matrix would break once the
+    # 'latest' alias moves on.
+    runs-on: ubuntu-24.04
 
     strategy:
+      fail-fast: false
       matrix:
-        ruby-version: ['3.2']
+        # Each version resolves the newest dependencies it supports: Rails 7.1 on Ruby 2.7
+        # and 3.0, Rails 7.2 on Ruby 3.1, Rails 8.1 on Ruby 3.2 and above.
+        ruby-version: ['2.7', '3.0', '3.1', '3.2', '3.3', '3.4', '4.0']
 
     steps:
     - uses: actions/checkout@v4

data/.github/workflows/release.yml

@@ -0,0 +1,52 @@
+name: Release
+
+# Publishing is triggered by pushing a version tag, e.g.:
+#   git tag -a v1.2.0 -m "Version 1.2.0" && git push origin v1.2.0
+#
+# No RubyGems API key is stored in this repository: the gem is pushed through
+# RubyGems' Trusted Publishing, which exchanges a short-lived GitHub OIDC token
+# for a scoped RubyGems credential. This requires a trusted publisher declared on
+# https://rubygems.org/gems/keycloak-api-rails pointing to this repository, this
+# workflow file name and the 'release' environment.
+on:
+  push:
+    tags: [ "v*" ]
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    name: Push gem to RubyGems.org
+    # Pinned rather than 'ubuntu-latest', for the same reason as in ci.yml.
+    runs-on: ubuntu-24.04
+
+    environment: release
+
+    permissions:
+      contents: write # 'rake release' pushes the version tag when it does not exist yet
+      id-token: write # mandatory to request the OIDC token used by trusted publishing
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Set up Ruby
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: '3.4'
+        bundler-cache: true
+
+    - name: Check that the tag matches KeycloakApiRails::VERSION
+      run: |
+        tag="${GITHUB_REF_NAME#v}"
+        version="$(ruby -Ilib -r keycloak-api-rails/version -e 'print KeycloakApiRails::VERSION')"
+        if [ "$tag" != "$version" ]; then
+          echo "::error::Tag '${GITHUB_REF_NAME}' does not match KeycloakApiRails::VERSION '${version}'"
+          exit 1
+        fi
+
+    - name: Run tests
+      run: bundle exec rspec
+
+    # Builds the gem, pushes it to RubyGems.org and waits for it to be available.
+    - uses: rubygems/release-gem@v1

data/.gitignore

@@ -1,4 +1,9 @@
 .bundle/
 log/*.log
 .byebug_history
-*.gem
+*.gem
+pkg/
+# This gem supports several Ruby versions, each of them resolving a different set of
+# dependencies (Ruby 2.7 caps Rails to 7.1, Ruby 3.1 to 7.2, Ruby 3.2+ resolves Rails 8.1).
+# A single committed lockfile cannot satisfy all of them.
+Gemfile.lock

data/CHANGELOG.md

@@ -5,11 +5,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [1.0.1] - 2026-07-30
+## [1.1.1] - 2026-07-31
+
+* New test helpers, in `keycloak-api-rails/testing`: `KeycloakApiRails::Testing.stub_public_keys!` validates the tokens forged by `keycloak_token` and `keycloak_auth_headers`, so that controller and request tests can be authenticated without a Keycloak server, and without the boilerplate the README used to describe. This file is not loaded by `keycloak-api-rails` and has to be required explicitly
+* Publish the gem to RubyGems from Github Actions when a `v*` tag is pushed, using RubyGems' Trusted Publishing
+
+## [1.1.0] - 2026-07-31
 
 * Dependencies: Upgrade test dependency `timecop` to `0.9.11`
 * Upgrade Docker image to Ruby 3.4
 * Remove all usages of `ActiveSupport` from the library, replaced by plain Ruby
+* Support Ruby 2.7 up to 4.0: declare `required_ruby_version >= 2.7` and stop committing `Gemfile.lock`, so that each Ruby version resolves the dependencies it supports (Rails 7.1 on Ruby 2.7 and 3.0, Rails 7.2 on Ruby 3.1, Rails 8.1 on Ruby 3.2 and above)
+* Test dependency `byebug` is no longer pinned to an exact version, since byebug 12 requires Ruby 3.1
 
 ## [1.0.0] - 2025-12-10
 

data/Dockerfile

@@ -6,7 +6,6 @@ RUN apt-get update -qq && apt-get install -y build-essential git ruby-dev && apt
 WORKDIR /usr/src/app
 
 COPY Gemfile /usr/src/app/
-COPY Gemfile.lock /usr/src/app/
 COPY keycloak-api-rails.gemspec /usr/src/app/
 COPY lib/keycloak-api-rails/version.rb /usr/src/app/lib/keycloak-api-rails/
 RUN bundle install

data/README.md

@@ -2,10 +2,23 @@
 
 This gem validates Keycloak JWT token for Ruby On Rails APIs.
 
+## Requirements
+
+* Ruby `>= 2.7`
+* Rails `>= 4.2`
+
+Every push is tested against Ruby 2.7, 3.0, 3.1, 3.2, 3.3, 3.4 and 4.0. Each of them installs the
+most recent dependencies it supports, so the test suite runs against Rails 7.1 (Ruby 2.7 and 3.0),
+Rails 7.2 (Ruby 3.1) and Rails 8.1 (Ruby 3.2 and above).
+
+Ruby 2.7 and 3.0 reached their end of life and no longer receive security fixes. They are supported
+here so that applications running on Rails 7.0 and 7.1 can use this gem, but upgrading Ruby remains
+the recommended path.
+
 ## Install
 
 ```ruby
-gem "keycloak-api-rails", "1.0.1"
+gem "keycloak-api-rails", "1.1.1"
 ```
 
 ## Token validation
@@ -178,36 +191,60 @@ end
 
 ## Writing integration tests
 
-If you want to write controller tests in your codebase and that Keycloak is configured for these controllers, here is how to mock it.
+If you want to write controller or request tests in your codebase and that Keycloak is configured for these controllers,
+this gem provides the helpers that forge valid tokens, so that no Keycloak server is required.
+These helpers are not loaded by `keycloak-api-rails`: they have to be required explicitly, so that nothing they define ends up in a production process.
 These lines are based on tests written using `rspec`.
 
-* First, create a private key. This key should be created once per test suite for performance matters.
 ```ruby
-config.before(:suite) do
-  $private_key = OpenSSL::PKey::RSA.generate(1024)
+# spec/rails_helper.rb
+require "keycloak-api-rails/testing"
+
+RSpec.configure do |config|
+  config.include KeycloakApiRails::Testing::Helpers
+  config.before(:suite) { KeycloakApiRails::Testing.stub_public_keys! }
 end
 ```
-* Then, in a `shared_context`, configure a lazy token based on your main user. (here, we assume you have a `user` variable with a `keycloak_id` property)
+
+`stub_public_keys!` makes the library validate the tokens forged by these helpers, instead of fetching public keys from a Keycloak server.
+`server_url` and `realm_id` therefore do not have to be configured in the test environment. Requests can then be authenticated with:
+
 ```ruby
-let(:jwt) do
-  claims = {
-    iat: Time.zone.now.to_i,
-    exp: (Time.zone.now + 1.day).to_i,
-    sub: user.keycloak_id,
-  }
-  token = JSON::JWT.new(claims)
-  token.kid = "default"
-  token.sign($private_key, :RS256).to_s
+it "returns the current user" do
+  get "/me", headers: keycloak_auth_headers(sub: user.keycloak_id)
+
+  expect(response).to have_http_status(:ok)
 end
 ```
-* Finally, in the same `shared_context`, stub `KeycloakApiRails.public_key_resolver` to use a valid public key that is able to validate `jwt`:
+
+`keycloak_auth_headers` returns an `Authorization` header, and `keycloak_token` returns the token alone.
+Both accept the same optional parameters, one for each claim this library reads:
+
+| Parameter | Claim | Default |
+| --- | --- | --- |
+| `sub` | `sub` | a random UUID |
+| `email` | `email` | none |
+| `locale` | `locale` | none |
+| `authorized_party` | `azp` | none |
+| `roles` | `realm_access.roles` | none |
+| `resource_roles` | `resource_access` | none |
+| `issued_at` | `iat` | now |
+| `expires_at` | `exp` | one hour after `issued_at` |
+| `claims` | any other claim | none |
+
+For instance, to authenticate a request as a user having the realm role `admin`, the role `reader` on the client `a-client`,
+and a `tenant_id` attribute declared in `config.custom_attributes`:
+
 ```ruby
-before(:each) do
-  public_key_resolver = KeycloakApiRails.public_key_resolver
-  allow(public_key_resolver).to receive(:find_public_keys) { JSON::JWK::Set.new(JSON::JWK.new($private_key, kid: "default")) }
-end
+headers = keycloak_auth_headers(sub:            user.keycloak_id,
+                                roles:          ["admin"],
+                                resource_roles: { "a-client" => ["reader"] },
+                                claims:         { "tenant_id" => tenant.id })
 ```
 
+An expired token is forged by passing an `expires_at` in the past, which is how a `401` can be tested.
+Assigning `KeycloakApiRails.public_key_resolver = nil` restores the regular resolver.
+
 ## How to execute library tests
 
 From the `keycloak-rails-api` directory:
@@ -217,6 +254,25 @@ From the `keycloak-rails-api` directory:
   $ docker run -v `pwd`:/usr/src/app/ keycloak-rails-api:test bundle exec rspec spec
 ```
 
+## How to release a new version
+
+Releases are published to [RubyGems](https://rubygems.org/gems/keycloak-api-rails) by GitHub Actions
+(`.github/workflows/release.yml`), through [Trusted Publishing](https://guides.rubygems.org/trusted-publishing/):
+no API key is stored in this repository, the workflow exchanges a short-lived GitHub OIDC token for a
+scoped RubyGems credential.
+
+1. Update `KeycloakApiRails::VERSION` in `lib/keycloak-api-rails/version.rb` and the `CHANGELOG.md`
+2. Commit and push these changes to `main`
+3. Tag the commit and push the tag:
+
+```
+  $ git tag -a v1.2.0 -m "Version 1.2.0"
+  $ git push origin v1.2.0
+```
+
+The workflow then checks that the tag matches `KeycloakApiRails::VERSION`, runs the tests, builds the gem
+and pushes it. It only publishes tags starting with `v`.
+
 ## Next developments
 
 * Manage multiple realms

data/Rakefile

@@ -0,0 +1,6 @@
+require "bundler/gem_tasks"
+require "rspec/core/rake_task"
+
+RSpec::Core::RakeTask.new(:spec)
+
+task default: :spec

data/keycloak-api-rails.gemspec

@@ -15,10 +15,16 @@ Gem::Specification.new do |spec|
   spec.files = `git ls-files -z`.split("\x0")
   spec.require_paths = ["lib"]
 
+  spec.required_ruby_version = ">= 2.7"
+
   spec.add_dependency "rails",       ">= 4.2"
   spec.add_dependency "json-jwt",    ">= 1.11.0"
 
   spec.add_development_dependency "rspec",   "3.13.2"
   spec.add_development_dependency "timecop", "0.9.11"
-  spec.add_development_dependency "byebug", "12.0.0"
+  # Required by 'rake release', which builds and publishes the gem from the CI.
+  spec.add_development_dependency "rake",    ">= 13.0"
+  # Not pinned to an exact version: byebug 12 requires Ruby >= 3.1, byebug 13 requires Ruby >= 3.2.
+  # Older Rubies resolve to byebug 11.
+  spec.add_development_dependency "byebug", ">= 11.1.3"
 end

data/lib/keycloak-api-rails/testing.rb

@@ -0,0 +1,118 @@
+# Test helpers for the applications that authenticate their requests with this library.
+#
+# This file is *not* loaded by "keycloak-api-rails": it has to be required explicitly, so that
+# nothing it defines can end up in a production process.
+#
+#   # spec/rails_helper.rb
+#   require "keycloak-api-rails/testing"
+#
+#   RSpec.configure do |config|
+#     config.include KeycloakApiRails::Testing::Helpers
+#     config.before(:suite) { KeycloakApiRails::Testing.stub_public_keys! }
+#   end
+#
+# Requests can then be authenticated without a running Keycloak, and without configuring
+# 'server_url' or 'realm_id':
+#
+#   get "/me", headers: keycloak_auth_headers(sub: user.keycloak_id, roles: ["admin"])
+
+require_relative "../keycloak-api-rails"
+require "securerandom"
+
+module KeycloakApiRails
+  module Testing
+
+    KEY_SIZE                    = 2048
+    KEY_ID                      = "keycloak-api-rails-testing"
+    ALGORITHM                   = :RS256
+    DEFAULT_VALIDITY_IN_SECONDS = 3600
+
+    # Returns the public keys forged by this module, instead of fetching them from a Keycloak server.
+    class PublicKeyResolver
+      def initialize(public_keys)
+        @public_keys = public_keys
+      end
+
+      def find_public_keys
+        @public_keys
+      end
+    end
+
+    class << self
+      # The RSA key pair used to sign the tokens forged by this module. It is generated once per
+      # process: generating a key is by far the slowest operation of a test suite that uses tokens.
+      def private_key
+        @private_key ||= OpenSSL::PKey::RSA.generate(KEY_SIZE)
+      end
+
+      def signing_key
+        @signing_key ||= JSON::JWK.new(private_key, kid: KEY_ID)
+      end
+
+      def public_keys
+        @public_keys ||= JSON::JWK::Set.new(JSON::JWK.new(private_key.public_key, kid: KEY_ID))
+      end
+
+      # Makes the library validate the tokens forged by this module. Assigning
+      # 'KeycloakApiRails.public_key_resolver = nil' restores the regular resolver.
+      def stub_public_keys!
+        KeycloakApiRails.public_key_resolver = PublicKeyResolver.new(public_keys)
+      end
+
+      # Forges a signed token, similar to the ones emitted by Keycloak. Every claim this library
+      # reads has a dedicated parameter; any other claim can be passed through 'claims', which is
+      # also how the attributes declared in 'config.custom_attributes' are set.
+      def token_for(sub: SecureRandom.uuid,
+                    email: nil,
+                    locale: nil,
+                    authorized_party: nil,
+                    roles: [],
+                    resource_roles: {},
+                    issued_at: Time.now,
+                    expires_at: nil,
+                    claims: {})
+        payload = {
+          "sub"    => sub,
+          "email"  => email,
+          "locale" => locale,
+          "azp"    => authorized_party,
+          "iat"    => issued_at.to_i,
+          "exp"    => (expires_at || (issued_at.to_i + DEFAULT_VALIDITY_IN_SECONDS)).to_i
+        }.reject { |_, value| value.nil? }
+
+        payload["realm_access"]    = { "roles" => roles.map(&:to_s) } unless roles.nil? || roles.empty?
+        payload["resource_access"] = build_resource_access(resource_roles) unless resource_roles.nil? || resource_roles.empty?
+
+        claims.each { |name, value| payload[name.to_s] = value }
+
+        JSON::JWT.new(payload).sign(signing_key, ALGORITHM).to_s
+      end
+
+      # The 'Authorization' header a client would send, e.g. { "Authorization" => "Bearer eyJ0..." }.
+      # It accepts the same parameters as '.token_for'.
+      def auth_headers_for(**options)
+        { "Authorization" => "Bearer #{token_for(**options)}" }
+      end
+
+      private
+
+      def build_resource_access(resource_roles)
+        resource_roles.inject({}) do |resource_access, (name, roles)|
+          resource_access[name.to_s] = { "roles" => Array(roles).map(&:to_s) }
+          resource_access
+        end
+      end
+    end
+
+    # Meant to be included in a test suite, e.g. 'config.include KeycloakApiRails::Testing::Helpers'.
+    module Helpers
+      def keycloak_token(**options)
+        KeycloakApiRails::Testing.token_for(**options)
+      end
+
+      def keycloak_auth_headers(**options)
+        KeycloakApiRails::Testing.auth_headers_for(**options)
+      end
+    end
+  end
+end

data/lib/keycloak-api-rails/version.rb

@@ -1,3 +1,3 @@
 module KeycloakApiRails
-  VERSION = "1.0.1"
+  VERSION = "1.1.1"
 end

data/lib/keycloak-api-rails.rb

@@ -33,6 +33,14 @@ module KeycloakApiRails
     @public_key_resolver ||= PublicKeyCachedResolver.from_configuration(http_client, config)
   end
 
+  # Mainly used by "keycloak-api-rails/testing" to validate tokens without a Keycloak server.
+  # Assigning nil restores the regular resolver. The memoized service is discarded, since it holds
+  # a reference to the resolver that is being replaced.
+  def self.public_key_resolver=(resolver)
+    @public_key_resolver = resolver
+    @service             = nil
+  end
+
   def self.service
     @service ||= KeycloakApiRails::Service.new(public_key_resolver)
   end

data/spec/keycloak-api-rails/service_spec.rb

@@ -205,6 +205,12 @@ RSpec.describe KeycloakApiRails::Service do
         @result = service2.need_middleware_authentication?(method, path, headers)
       end
 
+      # The configuration is global: leaving 'opt_in' enabled would disable the authentication
+      # of every example running afterwards.
+      after do
+        KeycloakApiRails.config.opt_in = false
+      end
+
       it "should return false" do
         expect(@result).to be false
       end

data/spec/keycloak-api-rails/testing_spec.rb

@@ -0,0 +1,102 @@
+require_relative "../../lib/keycloak-api-rails/testing"
+
+RSpec.describe KeycloakApiRails::Testing do
+  include KeycloakApiRails::Testing::Helpers
+
+  # The tokens are validated by the real middleware and the real service, so that these examples
+  # fail if what this module forges stops being what the library expects.
+  let(:authenticated_env) { {} }
+  let(:app) do
+    downstream = lambda do |env|
+      authenticated_env.replace(env)
+      [200, {}, ["OK"]]
+    end
+    KeycloakApiRails::Middleware.new(downstream)
+  end
+
+  def get(headers)
+    app.call({
+      "REQUEST_METHOD"    => "GET",
+      "PATH_INFO"         => "/me",
+      "REQUEST_URI"       => "http://example.org/me",
+      "HTTP_AUTHORIZATION" => headers["Authorization"]
+    })
+  end
+
+  before(:each) do
+    # The middleware only authenticates a request when the configuration tells it to, and the
+    # configuration is global: these examples cannot rely on what the other ones leave behind.
+    KeycloakApiRails.config.opt_in    = false
+    KeycloakApiRails.config.skip_paths = {}
+    KeycloakApiRails::Testing.stub_public_keys!
+  end
+
+  after(:each) do
+    KeycloakApiRails.public_key_resolver = nil
+  end
+
+  describe ".stub_public_keys!" do
+    it "should validate the tokens forged by this module" do
+      status, _headers, _body = get(keycloak_auth_headers)
+
+      expect(status).to eq(200)
+    end
+
+    it "should not require a Keycloak server to be configured" do
+      expect(KeycloakApiRails.config.server_url).to be_nil
+      expect(KeycloakApiRails.config.realm_id).to be_nil
+
+      status, _headers, _body = get(keycloak_auth_headers)
+
+      expect(status).to eq(200)
+    end
+  end
+
+  describe ".token_for" do
+    it "should authenticate the given user" do
+      get(keycloak_auth_headers(sub: "a-keycloak-id"))
+
+      expect(KeycloakApiRails::Helper.current_user_id(authenticated_env)).to eq("a-keycloak-id")
+    end
+
+    it "should generate a different user for each token" do
+      first_token  = JSON::JWT.decode(keycloak_token, KeycloakApiRails::Testing.public_keys)
+      second_token = JSON::JWT.decode(keycloak_token, KeycloakApiRails::Testing.public_keys)
+
+      expect(first_token["sub"]).not_to eq(second_token["sub"])
+    end
+
+    it "should expose every claim read by the library" do
+      get(keycloak_auth_headers(sub:              "a-keycloak-id",
+                                email:            "an-email@keycloak.io",
+                                locale:           "fr",
+                                authorized_party: "a-client",
+                                roles:            ["admin", "user"],
+                                resource_roles:   { "a-client" => ["reader"] }))
+
+      expect(KeycloakApiRails::Helper.current_user_id(authenticated_env)).to eq("a-keycloak-id")
+      expect(KeycloakApiRails::Helper.current_user_email(authenticated_env)).to eq("an-email@keycloak.io")
+      expect(KeycloakApiRails::Helper.current_user_locale(authenticated_env)).to eq("fr")
+      expect(KeycloakApiRails::Helper.current_authorized_party(authenticated_env)).to eq("a-client")
+      expect(KeycloakApiRails::Helper.current_user_roles(authenticated_env)).to eq(["admin", "user"])
+      expect(KeycloakApiRails::Helper.current_resource_roles(authenticated_env)).to eq({ "a-client" => ["reader"] })
+    end
+
+    it "should expose the claims declared as custom attributes" do
+      KeycloakApiRails.config.custom_attributes = ["tenant_id"]
+
+      get(keycloak_auth_headers(claims: { "tenant_id" => "a-tenant" }))
+
+      expect(KeycloakApiRails::Helper.current_user_custom_attributes(authenticated_env)).to eq({ "tenant_id" => "a-tenant" })
+    ensure
+      KeycloakApiRails.config.custom_attributes = []
+    end
+
+    it "should forge a token that is expired when 'expires_at' is in the past" do
+      status, _headers, body = get(keycloak_auth_headers(issued_at: Time.now - 7200, expires_at: Time.now - 3600))
+
+      expect(status).to eq(401)
+      expect(body.first).to include("JWT token is expired")
+    end
+  end
+end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: keycloak-api-rails
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.1.1
 platform: ruby
 authors:
 - Lorent Lempereur
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-07-30 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -66,20 +65,34 @@ dependencies:
     - - '='
       - !ruby/object:Gem::Version
         version: 0.9.11
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '13.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '13.0'
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 12.0.0
+        version: 11.1.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 12.0.0
+        version: 11.1.3
 description: Rails middleware that validates Authorization token emitted by Keycloak
 email:
 - lorent.lempereur.dev@gmail.com
@@ -88,14 +101,15 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".github/workflows/ci.yml"
+- ".github/workflows/release.yml"
 - ".gitignore"
 - ".rspec"
 - CHANGELOG.md
 - Dockerfile
 - Gemfile
-- Gemfile.lock
 - MIT-LICENSE
 - README.md
+- Rakefile
 - keycloak-api-rails.gemspec
 - lib/keycloak-api-rails.rb
 - lib/keycloak-api-rails/authentication.rb
@@ -107,6 +121,7 @@ files:
 - lib/keycloak-api-rails/public_key_resolver.rb
 - lib/keycloak-api-rails/railtie.rb
 - lib/keycloak-api-rails/service.rb
+- lib/keycloak-api-rails/testing.rb
 - lib/keycloak-api-rails/token_error.rb
 - lib/keycloak-api-rails/version.rb
 - spec/keycloak-api-rails/activesupport_free_spec.rb
@@ -115,6 +130,7 @@ files:
 - spec/keycloak-api-rails/helper_spec.rb
 - spec/keycloak-api-rails/public_key_cached_resolver_spec.rb
 - spec/keycloak-api-rails/service_spec.rb
+- spec/keycloak-api-rails/testing_spec.rb
 - spec/spec_helper.rb
 - spec/support/activesupport_free_probe.rb
 - spec/support/public_key_cached_resolver_stub.rb
@@ -124,7 +140,6 @@ homepage: https://github.com/looorent/keycloak-api-rails
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -132,15 +147,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '2.7'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
-signing_key: 
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Rails middleware that validates Authorization token emitted by Keycloak
 test_files: []

data/Gemfile.lock

@@ -1,249 +0,0 @@
-PATH
-  remote: .
-  specs:
-    keycloak-api-rails (1.0.0)
-      json-jwt (>= 1.11.0)
-      rails (>= 4.2)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    action_text-trix (2.1.19)
-      railties
-    actioncable (8.1.3.1)
-      actionpack (= 8.1.3.1)
-      activesupport (= 8.1.3.1)
-      nio4r (~> 2.0)
-      websocket-driver (>= 0.6.1)
-      zeitwerk (~> 2.6)
-    actionmailbox (8.1.3.1)
-      actionpack (= 8.1.3.1)
-      activejob (= 8.1.3.1)
-      activerecord (= 8.1.3.1)
-      activestorage (= 8.1.3.1)
-      activesupport (= 8.1.3.1)
-      mail (>= 2.8.0)
-    actionmailer (8.1.3.1)
-      actionpack (= 8.1.3.1)
-      actionview (= 8.1.3.1)
-      activejob (= 8.1.3.1)
-      activesupport (= 8.1.3.1)
-      mail (>= 2.8.0)
-      rails-dom-testing (~> 2.2)
-    actionpack (8.1.3.1)
-      actionview (= 8.1.3.1)
-      activesupport (= 8.1.3.1)
-      nokogiri (>= 1.8.5)
-      rack (>= 2.2.4)
-      rack-session (>= 1.0.1)
-      rack-test (>= 0.6.3)
-      rails-dom-testing (~> 2.2)
-      rails-html-sanitizer (~> 1.6)
-      useragent (~> 0.16)
-    actiontext (8.1.3.1)
-      action_text-trix (~> 2.1.15)
-      actionpack (= 8.1.3.1)
-      activerecord (= 8.1.3.1)
-      activestorage (= 8.1.3.1)
-      activesupport (= 8.1.3.1)
-      globalid (>= 0.6.0)
-      nokogiri (>= 1.8.5)
-    actionview (8.1.3.1)
-      activesupport (= 8.1.3.1)
-      builder (~> 3.1)
-      erubi (~> 1.11)
-      rails-dom-testing (~> 2.2)
-      rails-html-sanitizer (~> 1.6)
-    activejob (8.1.3.1)
-      activesupport (= 8.1.3.1)
-      globalid (>= 0.3.6)
-    activemodel (8.1.3.1)
-      activesupport (= 8.1.3.1)
-    activerecord (8.1.3.1)
-      activemodel (= 8.1.3.1)
-      activesupport (= 8.1.3.1)
-      timeout (>= 0.4.0)
-    activestorage (8.1.3.1)
-      actionpack (= 8.1.3.1)
-      activejob (= 8.1.3.1)
-      activerecord (= 8.1.3.1)
-      activesupport (= 8.1.3.1)
-      marcel (~> 1.0)
-    activesupport (8.1.3.1)
-      base64
-      bigdecimal
-      concurrent-ruby (~> 1.0, >= 1.3.1)
-      connection_pool (>= 2.2.5)
-      drb
-      i18n (>= 1.6, < 2)
-      json
-      logger (>= 1.4.2)
-      minitest (>= 5.1)
-      securerandom (>= 0.3)
-      tzinfo (~> 2.0, >= 2.0.5)
-      uri (>= 0.13.1)
-    aes_key_wrap (1.1.0)
-    base64 (0.3.0)
-    bigdecimal (4.1.2)
-    bindata (3.0.0)
-    builder (3.3.0)
-    byebug (12.0.0)
-    concurrent-ruby (1.3.8)
-    connection_pool (3.0.2)
-    crass (1.0.7)
-    date (3.5.1)
-    diff-lcs (1.6.2)
-    drb (2.2.3)
-    erb (6.0.6)
-    erubi (1.13.1)
-    faraday (2.14.3)
-      faraday-net_http (>= 2.0, < 3.5)
-      json
-      logger
-    faraday-follow_redirects (0.5.0)
-      faraday (>= 1, < 3)
-    faraday-net_http (3.4.4)
-      net-http (~> 0.5)
-    globalid (1.4.0)
-      activesupport (>= 6.1)
-    i18n (1.15.2)
-      concurrent-ruby (~> 1.0)
-    io-console (0.8.2)
-    irb (1.18.0)
-      pp (>= 0.6.0)
-      prism (>= 1.3.0)
-      rdoc (>= 4.0.0)
-      reline (>= 0.4.2)
-    json (2.21.1)
-    json-jwt (1.17.1)
-      activesupport (>= 4.2)
-      aes_key_wrap
-      base64
-      bindata
-      faraday (~> 2.0)
-      faraday-follow_redirects
-    logger (1.7.0)
-    loofah (2.25.2)
-      crass (~> 1.0.2)
-      nokogiri (>= 1.12.0)
-    mail (2.9.1)
-      logger
-      mini_mime (>= 0.1.1)
-      net-imap
-      net-pop
-      net-smtp
-    marcel (1.2.1)
-    mini_mime (1.1.5)
-    mini_portile2 (2.8.9)
-    minitest (6.0.6)
-      drb (~> 2.0)
-      prism (~> 1.5)
-    net-http (0.9.1)
-      uri (>= 0.11.1)
-    net-imap (0.6.6)
-      date
-      net-protocol
-    net-pop (0.1.2)
-      net-protocol
-    net-protocol (0.2.2)
-      timeout
-    net-smtp (0.5.1)
-      net-protocol
-    nio4r (2.7.5)
-    nokogiri (1.19.4)
-      mini_portile2 (~> 2.8.2)
-      racc (~> 1.4)
-    pp (0.6.4)
-      prettyprint
-    prettyprint (0.2.0)
-    prism (1.9.0)
-    racc (1.8.1)
-    rack (3.2.6)
-    rack-session (2.1.2)
-      base64 (>= 0.1.0)
-      rack (>= 3.0.0)
-    rack-test (2.2.0)
-      rack (>= 1.3)
-    rackup (2.3.1)
-      rack (>= 3)
-    rails (8.1.3.1)
-      actioncable (= 8.1.3.1)
-      actionmailbox (= 8.1.3.1)
-      actionmailer (= 8.1.3.1)
-      actionpack (= 8.1.3.1)
-      actiontext (= 8.1.3.1)
-      actionview (= 8.1.3.1)
-      activejob (= 8.1.3.1)
-      activemodel (= 8.1.3.1)
-      activerecord (= 8.1.3.1)
-      activestorage (= 8.1.3.1)
-      activesupport (= 8.1.3.1)
-      bundler (>= 1.15.0)
-      railties (= 8.1.3.1)
-    rails-dom-testing (2.3.0)
-      activesupport (>= 5.0.0)
-      minitest
-      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.7.1)
-      loofah (~> 2.25, >= 2.25.2)
-      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
-    railties (8.1.3.1)
-      actionpack (= 8.1.3.1)
-      activesupport (= 8.1.3.1)
-      irb (~> 1.13)
-      rackup (>= 1.0.0)
-      rake (>= 12.2)
-      thor (~> 1.0, >= 1.2.2)
-      tsort (>= 0.2)
-      zeitwerk (~> 2.6)
-    rake (13.4.2)
-    rbs (4.1.1)
-      logger
-      prism (>= 1.6.0)
-      tsort
-    rdoc (8.0.0)
-      erb
-      prism (>= 1.6.0)
-      rbs (>= 4.0.0)
-      tsort
-    reline (0.6.3)
-      io-console (~> 0.5)
-    rspec (3.13.2)
-      rspec-core (~> 3.13.0)
-      rspec-expectations (~> 3.13.0)
-      rspec-mocks (~> 3.13.0)
-    rspec-core (3.13.6)
-      rspec-support (~> 3.13.0)
-    rspec-expectations (3.13.5)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.8)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.13.0)
-    rspec-support (3.13.7)
-    securerandom (0.4.1)
-    thor (1.5.0)
-    timecop (0.9.11)
-    timeout (0.6.1)
-    tsort (0.2.0)
-    tzinfo (2.0.6)
-      concurrent-ruby (~> 1.0)
-    uri (1.1.1)
-    useragent (0.16.11)
-    websocket-driver (0.8.2)
-      base64
-      websocket-extensions (>= 0.1.0)
-    websocket-extensions (0.1.5)
-    zeitwerk (2.8.2)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  byebug (= 12.0.0)
-  keycloak-api-rails!
-  rspec (= 3.13.2)
-  timecop (= 0.9.11)
-
-BUNDLED WITH
-   2.4.13