keycloak-api-rails 1.1.0 → 1.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb67f66191b532371ed77f5677c4959a3d01cd8d4fa270dd984a119d796077b0
-  data.tar.gz: 64f29e21b50fb2d6f46d2a136c299aa9864c78aea977c9e4f7dc6a4927a28dff
+  metadata.gz: 74dec51fa027308c2cf5b57ca67b7316b21677bf1592022f76988f232bbde911
+  data.tar.gz: 4836a7951bbf1559ff5eec0dfeb004ff8bcd2955cee7e06ee9e8a553743ad99e
 SHA512:
-  metadata.gz: 2db5967b4c4b7e678763d015dd05567103cafb42bce12f0018c241df45400f8c4538309a59dd7526994bc14cf587aef3b7c51040d89ca2599c91c409b6acf8a5
-  data.tar.gz: 847fc92280c17a54d7f10976197b4ea0b37fea4217ee7ef9dd6d7089399b261831a07d3d56d07ffce2827aaf86c4332da680b3eaa044a3c35d0cb2347f123043
+  metadata.gz: 48b3307f4dff316dfa063deddf0d106bbcc409856c20f0af5c441bdc3b1163e9cf93f0c3f7e53fd1a90fcb7946744c2b1b8863fd5a61a0c4012fe3d7df6b5aee
+  data.tar.gz: 81aca7224bcae644dd35f6fb715bdb447b0da549bc3da0bdd311a6bea06adfba468936aabcdaeb305a44839c6770a46644abfdf81f2f828246414880e9ab52dd

data/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.2] - 2026-08-01
+
+* Gem metadata
+* The published gem no longer ships non-production code
+
+## [1.1.1] - 2026-07-31
+
+* New test helpers, in `keycloak-api-rails/testing`: `KeycloakApiRails::Testing.stub_public_keys!` validates the tokens forged by `keycloak_token` and `keycloak_auth_headers`, so that controller and request tests can be authenticated without a Keycloak server, and without the boilerplate the README used to describe. This file is not loaded by `keycloak-api-rails` and has to be required explicitly
+* Publish the gem to RubyGems from Github Actions when a `v*` tag is pushed, using RubyGems' Trusted Publishing
+
 ## [1.1.0] - 2026-07-31
 
 * Dependencies: Upgrade test dependency `timecop` to `0.9.11`

data/MIT-LICENSE

@@ -1,4 +1,4 @@
-Copyright 2018 
+Copyright (c) 2018 Lorent Lempereur
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/README.md

@@ -18,7 +18,7 @@ the recommended path.
 ## Install
 
 ```ruby
-gem "keycloak-api-rails", "1.1.0"
+gem "keycloak-api-rails", "1.1.2"
 ```
 
 ## Token validation
@@ -191,36 +191,60 @@ end
 
 ## Writing integration tests
 
-If you want to write controller tests in your codebase and that Keycloak is configured for these controllers, here is how to mock it.
+If you want to write controller or request tests in your codebase and that Keycloak is configured for these controllers,
+this gem provides the helpers that forge valid tokens, so that no Keycloak server is required.
+These helpers are not loaded by `keycloak-api-rails`: they have to be required explicitly, so that nothing they define ends up in a production process.
 These lines are based on tests written using `rspec`.
 
-* First, create a private key. This key should be created once per test suite for performance matters.
 ```ruby
-config.before(:suite) do
-  $private_key = OpenSSL::PKey::RSA.generate(1024)
+# spec/rails_helper.rb
+require "keycloak-api-rails/testing"
+
+RSpec.configure do |config|
+  config.include KeycloakApiRails::Testing::Helpers
+  config.before(:suite) { KeycloakApiRails::Testing.stub_public_keys! }
 end
 ```
-* Then, in a `shared_context`, configure a lazy token based on your main user. (here, we assume you have a `user` variable with a `keycloak_id` property)
+
+`stub_public_keys!` makes the library validate the tokens forged by these helpers, instead of fetching public keys from a Keycloak server.
+`server_url` and `realm_id` therefore do not have to be configured in the test environment. Requests can then be authenticated with:
+
 ```ruby
-let(:jwt) do
-  claims = {
-    iat: Time.zone.now.to_i,
-    exp: (Time.zone.now + 1.day).to_i,
-    sub: user.keycloak_id,
-  }
-  token = JSON::JWT.new(claims)
-  token.kid = "default"
-  token.sign($private_key, :RS256).to_s
+it "returns the current user" do
+  get "/me", headers: keycloak_auth_headers(sub: user.keycloak_id)
+
+  expect(response).to have_http_status(:ok)
 end
 ```
-* Finally, in the same `shared_context`, stub `KeycloakApiRails.public_key_resolver` to use a valid public key that is able to validate `jwt`:
+
+`keycloak_auth_headers` returns an `Authorization` header, and `keycloak_token` returns the token alone.
+Both accept the same optional parameters, one for each claim this library reads:
+
+| Parameter | Claim | Default |
+| --- | --- | --- |
+| `sub` | `sub` | a random UUID |
+| `email` | `email` | none |
+| `locale` | `locale` | none |
+| `authorized_party` | `azp` | none |
+| `roles` | `realm_access.roles` | none |
+| `resource_roles` | `resource_access` | none |
+| `issued_at` | `iat` | now |
+| `expires_at` | `exp` | one hour after `issued_at` |
+| `claims` | any other claim | none |
+
+For instance, to authenticate a request as a user having the realm role `admin`, the role `reader` on the client `a-client`,
+and a `tenant_id` attribute declared in `config.custom_attributes`:
+
 ```ruby
-before(:each) do
-  public_key_resolver = KeycloakApiRails.public_key_resolver
-  allow(public_key_resolver).to receive(:find_public_keys) { JSON::JWK::Set.new(JSON::JWK.new($private_key, kid: "default")) }
-end
+headers = keycloak_auth_headers(sub:            user.keycloak_id,
+                                roles:          ["admin"],
+                                resource_roles: { "a-client" => ["reader"] },
+                                claims:         { "tenant_id" => tenant.id })
 ```
 
+An expired token is forged by passing an `expires_at` in the past, which is how a `401` can be tested.
+Assigning `KeycloakApiRails.public_key_resolver = nil` restores the regular resolver.
+
 ## How to execute library tests
 
 From the `keycloak-rails-api` directory:
@@ -230,6 +254,25 @@ From the `keycloak-rails-api` directory:
   $ docker run -v `pwd`:/usr/src/app/ keycloak-rails-api:test bundle exec rspec spec
 ```
 
+## How to release a new version
+
+Releases are published to [RubyGems](https://rubygems.org/gems/keycloak-api-rails) by GitHub Actions
+(`.github/workflows/release.yml`), through [Trusted Publishing](https://guides.rubygems.org/trusted-publishing/):
+no API key is stored in this repository, the workflow exchanges a short-lived GitHub OIDC token for a
+scoped RubyGems credential.
+
+1. Update `KeycloakApiRails::VERSION` in `lib/keycloak-api-rails/version.rb` and the `CHANGELOG.md`
+2. Commit and push these changes to `main`
+3. Tag the commit and push the tag:
+
+```
+  $ git tag -a v1.2.0 -m "Version 1.2.0"
+  $ git push origin v1.2.0
+```
+
+The workflow then checks that the tag matches `KeycloakApiRails::VERSION`, runs the tests, builds the gem
+and pushes it. It only publishes tags starting with `v`.
+
 ## Next developments
 
 * Manage multiple realms

data/keycloak-api-rails.gemspec

@@ -9,10 +9,21 @@ Gem::Specification.new do |spec|
   spec.email       = ["lorent.lempereur.dev@gmail.com"]
   spec.homepage    = "https://github.com/looorent/keycloak-api-rails"
   spec.summary     = "Rails middleware that validates Authorization token emitted by Keycloak"
-  spec.description = "Rails middleware that validates Authorization token emitted by Keycloak"
+  spec.description = "Rack middleware that validates the Keycloak JWT access token carried by every " \
+                     "request of a Ruby on Rails API. It verifies the token signature against the " \
+                     "realm public keys, exposes the authenticated user, its roles and the custom " \
+                     "attributes of the token to the controllers, and lets some routes opt out of " \
+                     "authentication."
   spec.license     = "MIT"
 
-  spec.files = `git ls-files -z`.split("\x0")
+  spec.metadata = {
+    "source_code_uri"       => spec.homepage,
+    "changelog_uri"         => "#{spec.homepage}/blob/main/CHANGELOG.md",
+    "bug_tracker_uri"       => "#{spec.homepage}/issues",
+    "rubygems_mfa_required" => "true"
+  }
+
+  spec.files = Dir.glob(["lib/**/*.rb", "CHANGELOG.md", "MIT-LICENSE", "README.md", "keycloak-api-rails.gemspec"])
   spec.require_paths = ["lib"]
 
   spec.required_ruby_version = ">= 2.7"
@@ -22,6 +33,8 @@ Gem::Specification.new do |spec|
 
   spec.add_development_dependency "rspec",   "3.13.2"
   spec.add_development_dependency "timecop", "0.9.11"
+  # Required by 'rake release', which builds and publishes the gem from the CI.
+  spec.add_development_dependency "rake",    ">= 13.0"
   # Not pinned to an exact version: byebug 12 requires Ruby >= 3.1, byebug 13 requires Ruby >= 3.2.
   # Older Rubies resolve to byebug 11.
   spec.add_development_dependency "byebug", ">= 11.1.3"

data/lib/keycloak-api-rails/testing.rb

@@ -0,0 +1,118 @@
+# Test helpers for the applications that authenticate their requests with this library.
+#
+# This file is *not* loaded by "keycloak-api-rails": it has to be required explicitly, so that
+# nothing it defines can end up in a production process.
+#
+#   # spec/rails_helper.rb
+#   require "keycloak-api-rails/testing"
+#
+#   RSpec.configure do |config|
+#     config.include KeycloakApiRails::Testing::Helpers
+#     config.before(:suite) { KeycloakApiRails::Testing.stub_public_keys! }
+#   end
+#
+# Requests can then be authenticated without a running Keycloak, and without configuring
+# 'server_url' or 'realm_id':
+#
+#   get "/me", headers: keycloak_auth_headers(sub: user.keycloak_id, roles: ["admin"])
+
+require_relative "../keycloak-api-rails"
+require "securerandom"
+
+module KeycloakApiRails
+  module Testing
+
+    KEY_SIZE                    = 2048
+    KEY_ID                      = "keycloak-api-rails-testing"
+    ALGORITHM                   = :RS256
+    DEFAULT_VALIDITY_IN_SECONDS = 3600
+
+    # Returns the public keys forged by this module, instead of fetching them from a Keycloak server.
+    class PublicKeyResolver
+      def initialize(public_keys)
+        @public_keys = public_keys
+      end
+
+      def find_public_keys
+        @public_keys
+      end
+    end
+
+    class << self
+      # The RSA key pair used to sign the tokens forged by this module. It is generated once per
+      # process: generating a key is by far the slowest operation of a test suite that uses tokens.
+      def private_key
+        @private_key ||= OpenSSL::PKey::RSA.generate(KEY_SIZE)
+      end
+
+      def signing_key
+        @signing_key ||= JSON::JWK.new(private_key, kid: KEY_ID)
+      end
+
+      def public_keys
+        @public_keys ||= JSON::JWK::Set.new(JSON::JWK.new(private_key.public_key, kid: KEY_ID))
+      end
+
+      # Makes the library validate the tokens forged by this module. Assigning
+      # 'KeycloakApiRails.public_key_resolver = nil' restores the regular resolver.
+      def stub_public_keys!
+        KeycloakApiRails.public_key_resolver = PublicKeyResolver.new(public_keys)
+      end
+
+      # Forges a signed token, similar to the ones emitted by Keycloak. Every claim this library
+      # reads has a dedicated parameter; any other claim can be passed through 'claims', which is
+      # also how the attributes declared in 'config.custom_attributes' are set.
+      def token_for(sub: SecureRandom.uuid,
+                    email: nil,
+                    locale: nil,
+                    authorized_party: nil,
+                    roles: [],
+                    resource_roles: {},
+                    issued_at: Time.now,
+                    expires_at: nil,
+                    claims: {})
+        payload = {
+          "sub"    => sub,
+          "email"  => email,
+          "locale" => locale,
+          "azp"    => authorized_party,
+          "iat"    => issued_at.to_i,
+          "exp"    => (expires_at || (issued_at.to_i + DEFAULT_VALIDITY_IN_SECONDS)).to_i
+        }.reject { |_, value| value.nil? }
+
+        payload["realm_access"]    = { "roles" => roles.map(&:to_s) } unless roles.nil? || roles.empty?
+        payload["resource_access"] = build_resource_access(resource_roles) unless resource_roles.nil? || resource_roles.empty?
+
+        claims.each { |name, value| payload[name.to_s] = value }
+
+        JSON::JWT.new(payload).sign(signing_key, ALGORITHM).to_s
+      end
+
+      # The 'Authorization' header a client would send, e.g. { "Authorization" => "Bearer eyJ0..." }.
+      # It accepts the same parameters as '.token_for'.
+      def auth_headers_for(**options)
+        { "Authorization" => "Bearer #{token_for(**options)}" }
+      end
+
+      private
+
+      def build_resource_access(resource_roles)
+        resource_roles.inject({}) do |resource_access, (name, roles)|
+          resource_access[name.to_s] = { "roles" => Array(roles).map(&:to_s) }
+          resource_access
+        end
+      end
+    end
+
+    # Meant to be included in a test suite, e.g. 'config.include KeycloakApiRails::Testing::Helpers'.
+    module Helpers
+      def keycloak_token(**options)
+        KeycloakApiRails::Testing.token_for(**options)
+      end
+
+      def keycloak_auth_headers(**options)
+        KeycloakApiRails::Testing.auth_headers_for(**options)
+      end
+    end
+  end
+end

data/lib/keycloak-api-rails/version.rb

@@ -1,3 +1,3 @@
 module KeycloakApiRails
-  VERSION = "1.1.0"
+  VERSION = "1.1.2"
 end

data/lib/keycloak-api-rails.rb

@@ -33,6 +33,14 @@ module KeycloakApiRails
     @public_key_resolver ||= PublicKeyCachedResolver.from_configuration(http_client, config)
   end
 
+  # Mainly used by "keycloak-api-rails/testing" to validate tokens without a Keycloak server.
+  # Assigning nil restores the regular resolver. The memoized service is discarded, since it holds
+  # a reference to the resolver that is being replaced.
+  def self.public_key_resolver=(resolver)
+    @public_key_resolver = resolver
+    @service             = nil
+  end
+
   def self.service
     @service ||= KeycloakApiRails::Service.new(public_key_resolver)
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: keycloak-api-rails
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.1.2
 platform: ruby
 authors:
 - Lorent Lempereur
@@ -65,6 +65,20 @@ dependencies:
     - - '='
       - !ruby/object:Gem::Version
         version: 0.9.11
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '13.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '13.0'
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -79,19 +93,17 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 11.1.3
-description: Rails middleware that validates Authorization token emitted by Keycloak
+description: Rack middleware that validates the Keycloak JWT access token carried
+  by every request of a Ruby on Rails API. It verifies the token signature against
+  the realm public keys, exposes the authenticated user, its roles and the custom
+  attributes of the token to the controllers, and lets some routes opt out of authentication.
 email:
 - lorent.lempereur.dev@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".github/workflows/ci.yml"
-- ".gitignore"
-- ".rspec"
 - CHANGELOG.md
-- Dockerfile
-- Gemfile
 - MIT-LICENSE
 - README.md
 - keycloak-api-rails.gemspec
@@ -105,23 +117,17 @@ files:
 - lib/keycloak-api-rails/public_key_resolver.rb
 - lib/keycloak-api-rails/railtie.rb
 - lib/keycloak-api-rails/service.rb
+- lib/keycloak-api-rails/testing.rb
 - lib/keycloak-api-rails/token_error.rb
 - lib/keycloak-api-rails/version.rb
-- spec/keycloak-api-rails/activesupport_free_spec.rb
-- spec/keycloak-api-rails/authentication_spec.rb
-- spec/keycloak-api-rails/configuration_spec.rb
-- spec/keycloak-api-rails/helper_spec.rb
-- spec/keycloak-api-rails/public_key_cached_resolver_spec.rb
-- spec/keycloak-api-rails/service_spec.rb
-- spec/spec_helper.rb
-- spec/support/activesupport_free_probe.rb
-- spec/support/public_key_cached_resolver_stub.rb
-- spec/support/public_key_resolver_stub.rb
-- spec/support/rails_helper.rb
 homepage: https://github.com/looorent/keycloak-api-rails
 licenses:
 - MIT
-metadata: {}
+metadata:
+  source_code_uri: https://github.com/looorent/keycloak-api-rails
+  changelog_uri: https://github.com/looorent/keycloak-api-rails/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/looorent/keycloak-api-rails/issues
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -136,7 +142,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.17
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Rails middleware that validates Authorization token emitted by Keycloak
 test_files: []

data/.github/workflows/ci.yml

@@ -1,35 +0,0 @@
-name: Ruby
-
-on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    name: Ruby ${{ matrix.ruby-version }}
-    # Pinned rather than 'ubuntu-latest': ruby/setup-ruby has no prebuilt Rubies for
-    # ubuntu-26.04 yet, so the oldest versions of the matrix would break once the
-    # 'latest' alias moves on.
-    runs-on: ubuntu-24.04
-
-    strategy:
-      fail-fast: false
-      matrix:
-        # Each version resolves the newest dependencies it supports: Rails 7.1 on Ruby 2.7
-        # and 3.0, Rails 7.2 on Ruby 3.1, Rails 8.1 on Ruby 3.2 and above.
-        ruby-version: ['2.7', '3.0', '3.1', '3.2', '3.3', '3.4', '4.0']
-
-    steps:
-    - uses: actions/checkout@v4
-    - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
-      with:
-        ruby-version: ${{ matrix.ruby-version }}
-        bundler-cache: true # runs 'bundle install' and caches installed gems automatically
-    - name: Run tests
-      run: bundle exec rspec

data/.gitignore

@@ -1,8 +0,0 @@
-.bundle/
-log/*.log
-.byebug_history
-*.gem
-# This gem supports several Ruby versions, each of them resolving a different set of
-# dependencies (Ruby 2.7 caps Rails to 7.1, Ruby 3.1 to 7.2, Ruby 3.2+ resolves Rails 8.1).
-# A single committed lockfile cannot satisfy all of them.
-Gemfile.lock

data/.rspec

@@ -1,2 +0,0 @@
---color
---require spec_helper

data/Dockerfile

@@ -1,13 +0,0 @@
-FROM ruby:3.4.10-slim-bookworm
-
-RUN apt-get update -qq && apt-get install -y build-essential git ruby-dev && apt-get clean && \
-  mkdir -p /usr/src/app/lib/keycloak-api-rails
-
-WORKDIR /usr/src/app
-
-COPY Gemfile /usr/src/app/
-COPY keycloak-api-rails.gemspec /usr/src/app/
-COPY lib/keycloak-api-rails/version.rb /usr/src/app/lib/keycloak-api-rails/
-RUN bundle install
-COPY . /usr/src/app
-RUN bundle install

data/Gemfile

@@ -1,3 +0,0 @@
-source 'https://rubygems.org'
-
-gemspec

data/spec/keycloak-api-rails/activesupport_free_spec.rb

@@ -1,18 +0,0 @@
-require "rbconfig"
-
-RSpec.describe "The library without ActiveSupport" do
-
-  let(:probe) { File.expand_path("../../support/activesupport_free_probe.rb", __FILE__) }
-
-  # RUBYOPT is cleared so that nothing set up by bundler is preloaded in the probe process.
-  def run_probe
-    output = IO.popen({ "RUBYOPT" => nil }, [RbConfig.ruby, probe], err: [:child, :out], &:read)
-    [$?.exitstatus, output]
-  end
-
-  it "loads and behaves the same way when ActiveSupport is not available" do
-    status, output = run_probe
-
-    expect(status).to eq(0), "The library relies on ActiveSupport:\n#{output}"
-  end
-end

data/spec/keycloak-api-rails/authentication_spec.rb

@@ -1,70 +0,0 @@
-require "spec_helper"
-
-describe KeycloakApiRails::Authentication do
-  class ExampleController < ActionController::Base
-    include KeycloakApiRails::Authentication
-    # Mark protected methods public so they may be called in tests
-    public(*KeycloakApiRails::Authentication.protected_instance_methods)
-  end
-
-  let(:controller) { ExampleController.new }
-  let(:token) { 'keycloak_valid_token'}
-  let(:headers) do
-    {
-      'REQUEST_METHOD' => :get,
-      'REQUEST_URI' => 'http://www.an-url.io',
-      'HTTP_AUTHORIZATION' => "Bearer #{token}"
-    }
-  end
-
-  describe "when included" do
-    it "declares keycloak_authenticate as a helper method when the base class supports helpers" do
-      declared_helper_methods = []
-      base = Class.new do
-        define_singleton_method(:helper_method) { |*names| declared_helper_methods.concat(names) }
-      end
-
-      base.include(KeycloakApiRails::Authentication)
-
-      expect(declared_helper_methods).to eq [:keycloak_authenticate]
-    end
-
-    it "declares the helper method on a real controller" do
-      expect(ExampleController._helper_methods).to include :keycloak_authenticate
-    end
-
-    it "does not fail when the base class does not support helpers" do
-      expect {
-        Class.new.include(KeycloakApiRails::Authentication)
-      }.to_not raise_error
-    end
-
-    it "exposes its methods as protected instance methods" do
-      expect(KeycloakApiRails::Authentication.protected_instance_methods).to match_array %i[
-        keycloak_authenticate
-        authentication_failed
-        authentication_succeeded
-      ]
-    end
-
-    it "does not add any public method to the including class" do
-      base = Class.new.include(KeycloakApiRails::Authentication)
-
-      expect(base.public_instance_methods).to_not include :keycloak_authenticate
-      expect(base.protected_instance_methods).to include :keycloak_authenticate
-    end
-  end
-
-  describe "#keycloak_authenticate" do
-    before do
-      # Mock request object because we aren't using real request spec
-      allow(controller).to receive(:request).and_return(double("request", env: headers ))
-    end
-
-    it "it authenticates with request header" do
-      expect_any_instance_of(KeycloakApiRails::Service).to receive(:decode_and_verify).with(token).and_return("A User")
-      expect(controller).to receive(:authentication_succeeded)
-      controller.keycloak_authenticate
-    end
-  end
-end

data/spec/keycloak-api-rails/configuration_spec.rb

@@ -1,101 +0,0 @@
-RSpec.describe KeycloakApiRails::Configuration do
-
-  # Every attribute that used to be declared through ActiveSupport's `config_accessor`.
-  let(:attribute_names) do
-    %i[
-      server_url
-      realm_id
-      skip_paths
-      opt_in
-      token_expiration_tolerance_in_seconds
-      public_key_cache_ttl
-      custom_attributes
-      logger
-      ca_certificate_file
-    ]
-  end
-
-  describe "attributes" do
-    let(:configuration) { KeycloakApiRails::Configuration.new }
-
-    it "exposes a reader and a writer for each attribute" do
-      attribute_names.each do |name|
-        expect(configuration).to respond_to name
-        expect(configuration).to respond_to "#{name}="
-      end
-    end
-
-    it "returns nil for each attribute that has not been assigned" do
-      attribute_names.each do |name|
-        expect(configuration.public_send(name)).to be_nil
-      end
-    end
-
-    it "returns the value that has been assigned" do
-      attribute_names.each do |name|
-        configuration.public_send("#{name}=", "a value for #{name}")
-        expect(configuration.public_send(name)).to eq "a value for #{name}"
-      end
-    end
-
-    it "does not respond to an unknown attribute" do
-      expect(configuration).to_not respond_to :not_a_configuration_attribute
-      expect {
-        configuration.not_a_configuration_attribute
-      }.to raise_error NoMethodError
-    end
-  end
-
-  describe "#configure" do
-    after(:each) do
-      KeycloakApiRails.load_configuration
-    end
-
-    it "yields the configuration" do
-      expect { |block| KeycloakApiRails.configure(&block) }.to yield_with_args KeycloakApiRails::Configuration
-    end
-
-    it "keeps the values assigned within the block" do
-      KeycloakApiRails.configure do |config|
-        config.server_url          = "http://keycloak:8080"
-        config.realm_id            = "a-realm"
-        config.ca_certificate_file = "/etc/ssl/a-certificate.pem"
-      end
-
-      expect(KeycloakApiRails.config.server_url).to eq "http://keycloak:8080"
-      expect(KeycloakApiRails.config.realm_id).to eq "a-realm"
-      expect(KeycloakApiRails.config.ca_certificate_file).to eq "/etc/ssl/a-certificate.pem"
-    end
-
-    it "always returns the same configuration instance" do
-      expect(KeycloakApiRails.config).to be KeycloakApiRails.config
-    end
-  end
-
-  describe "#load_configuration" do
-    before(:each) do
-      KeycloakApiRails.load_configuration
-    end
-
-    after(:each) do
-      KeycloakApiRails.load_configuration
-    end
-
-    it "applies the documented default values" do
-      config = KeycloakApiRails.config
-
-      expect(config.server_url).to be_nil
-      expect(config.realm_id).to be_nil
-      expect(config.logger).to be_a ::Logger
-      expect(config.skip_paths).to eq({})
-      expect(config.opt_in).to be false
-      expect(config.token_expiration_tolerance_in_seconds).to eq 10
-      expect(config.public_key_cache_ttl).to eq 86400
-      expect(config.custom_attributes).to eq []
-    end
-
-    it "exposes the logger through KeycloakApiRails.logger" do
-      expect(KeycloakApiRails.logger).to be KeycloakApiRails.config.logger
-    end
-  end
-end

data/spec/keycloak-api-rails/helper_spec.rb

@@ -1,94 +0,0 @@
-RSpec.describe KeycloakApiRails::Helper do
-  describe "#read_token_from_query_string" do
-
-    subject { KeycloakApiRails::Helper.read_token_from_query_string(uri) }
-
-    context "when the uri is nil" do
-      let(:uri) { nil }
-      it "returns an empty token" do
-        expect(subject).to eq ""
-      end
-    end
-
-    context "when the uri is empty" do
-      let(:uri) { "" }
-      it "returns an empty token" do
-        expect(subject).to eq ""
-      end
-    end
-
-    context "when the uri only contains whitespaces" do
-      let(:uri) { "   " }
-      it "returns an empty token" do
-        expect(subject).to eq ""
-      end
-    end
-
-    context "when the uri has no query string" do
-      let(:uri) { "http://www.an-url.io/health" }
-      it "returns no token" do
-        expect(subject).to be_nil
-      end
-    end
-
-    context "when the uri has a query string but no token" do
-      let(:uri) { "http://www.an-url.io/health?firstName=ouioui" }
-      it "returns no token" do
-        expect(subject).to be_nil
-      end
-    end
-
-    context "when the uri has a token in the query string" do
-      let(:uri) { "http://www.an-url.io/health?authorizationToken=aToken" }
-      it "returns the token" do
-        expect(subject).to eq "aToken"
-      end
-    end
-
-    context "when the uri has a token among other query string parameters" do
-      let(:uri) { "http://www.an-url.io/health?firstName=ouioui&authorizationToken=aToken&lastName=nonnon" }
-      it "returns the token" do
-        expect(subject).to eq "aToken"
-      end
-    end
-
-    context "when the uri has an empty token in the query string" do
-      let(:uri) { "http://www.an-url.io/health?authorizationToken=" }
-      it "returns an empty token" do
-        expect(subject).to eq ""
-      end
-    end
-  end
-
-  describe "#create_url_with_token" do
-
-    let(:uri)   { "http://www.an-url.io" }
-    let(:token) { "aToken" }
-
-    before(:each) do
-      @url_with_token = KeycloakApiRails::Helper.create_url_with_token(uri, token)
-    end
-
-    context "when the uri has no query string yet" do
-      it "returns an url with the provided token" do
-        expect(@url_with_token).to eq "#{uri}?authorizationToken=#{token}"
-      end
-    end
-
-    context "when the uri already has no query strings" do
-      context "but no token yet" do
-        let(:uri)   { "http://www.an-url.io?firstName=ouioui&lastName=nonnon" }
-        it "returns an url with all the query string and the token" do
-          expect(@url_with_token).to eq "#{uri}&authorizationToken=#{token}"
-        end
-      end
-
-      context "including a token" do
-        let(:uri)   { "http://www.an-url.io?authorizationToken=ouioui&lastName=nonnon" }
-        it "returns an url with all the query string and the new token" do
-          expect(@url_with_token).to eq "http://www.an-url.io?lastName=nonnon&authorizationToken=#{token}"
-        end
-      end
-    end
-  end
-end

data/spec/keycloak-api-rails/public_key_cached_resolver_spec.rb

@@ -1,80 +0,0 @@
-RSpec.describe KeycloakApiRails::Service do
-
-  let(:public_key_cache_ttl)  { 86400 }
-  let(:server_url)            { "whatever:8080" }
-  let(:realm_id)              { "pouet" }
-  let!(:resolver)             { KeycloakApiRails::PublicKeyCachedResolver.new(server_url, realm_id, public_key_cache_ttl) }
-
-  before(:each) do
-    resolver.instance_variable_set(:@resolver, KeycloakApiRails::PublicKeyResolverStub.new)
-    now = Time.local(2018, 1, 9, 12, 0, 0)
-    Timecop.freeze(now)
-  end
-
-  after(:each) do
-    Timecop.return
-  end
-
-  describe "#find_public_key" do
-    context "when there is no public key in cache yet" do
-      before(:each) do
-        @public_key = resolver.find_public_keys
-      end
-
-      it "returns a valid public key" do
-        expect(@public_key).to_not be_nil
-      end
-
-      it "sets the current time to the resolver" do
-        expect(resolver.cached_public_key_retrieved_at).to eq Time.now
-      end
-    end
-
-    context "when there is already a public key in cache" do
-      before(:each) do
-        @first_public_key                     = resolver.find_public_keys
-        @first_cached_public_key_retrieved_at = resolver.cached_public_key_retrieved_at
-      end
-
-      context "and no need to refresh it" do
-        before(:each) do
-          Timecop.freeze(Time.now + public_key_cache_ttl.seconds - 10.seconds)
-          @second_public_key                     = resolver.find_public_keys
-          @second_cached_public_key_retrieved_at = resolver.cached_public_key_retrieved_at
-        end
-
-        it "returns a valid public key" do
-          expect(@second_public_key).to_not be_nil
-        end
-
-        it "does not refresh the public key" do
-          expect(@second_public_key).to eq @first_public_key
-        end
-
-        it "does not refresh the public key retrieval time" do
-          expect(@first_cached_public_key_retrieved_at).to eq @second_cached_public_key_retrieved_at
-        end
-      end
-
-      context "and its TTL has expired" do
-        before(:each) do
-          Timecop.freeze(Time.now + public_key_cache_ttl.seconds + 10.seconds)
-          @second_public_key                     = resolver.find_public_keys
-          @second_cached_public_key_retrieved_at = resolver.cached_public_key_retrieved_at
-        end
-
-        it "returns a valid public key" do
-          expect(@second_public_key).to_not be_nil
-        end
-
-        it "refreshes the public key" do
-          expect(@second_public_key).to_not eq @first_public_key
-        end
-
-        it "refreshes the public key retrieval time" do
-          expect(@first_cached_public_key_retrieved_at).to_not eq @second_cached_public_key_retrieved_at
-        end
-      end
-    end
-  end
-end

data/spec/keycloak-api-rails/service_spec.rb

@@ -1,275 +0,0 @@
-RSpec.describe KeycloakApiRails::Service do
-
-  let!(:private_key)  { OpenSSL::PKey::RSA.generate(2048) }
-  let!(:public_key)   { private_key.public_key }
-  let!(:key_resolver)  { KeycloakApiRails::PublicKeyCachedResolverStub.new(public_key) }
-  let!(:service)       { KeycloakApiRails::Service.new(key_resolver) }
-  
-  before(:each) do
-    now = Time.local(2018, 1, 9, 12, 0, 0)
-    Timecop.freeze(now)
-  end
-
-  after(:each) do
-    Timecop.return
-  end
-
-  describe "#decode_and_verify" do
-    def create_token(private_key, expiration_date, algorithm)
-      claim = {
-        iss: "KeycloakApiRails",
-        exp: expiration_date,
-        nbf: Time.local(2018, 1, 1, 0, 0, 0)
-      }
-      jws = JSON::JWT.new(claim).sign(private_key, algorithm)
-      jws.to_s
-    end
-
-    context "when token is nil" do
-      let(:token) { nil }
-      it "should raise an error :no_token" do
-        expect {
-          service.decode_and_verify(token)
-        }.to raise_error(TokenError, "No JWT token provided")
-      end
-    end
-
-    context "when token is an empty string" do
-      let(:token) { "" }
-      it "should raise an error :no_token" do
-        expect {
-          service.decode_and_verify(token)
-        }.to raise_error(TokenError, "No JWT token provided")
-      end
-    end
-
-    context "when token is in an invalid format" do
-      let(:token) { "coucou" }
-      it "should raise an error :invalid_format" do
-        expect {
-          service.decode_and_verify(token)
-        }.to raise_error(TokenError, "Wrong JWT Format")
-      end
-    end
-
-    context "when token is in a valid format" do
-      let(:algorithm)       { :RS256 }
-      let(:expiration_date) { 1.week.from_now }
-
-      context "and token is generated by another private key" do
-        let(:another_private_key)  { OpenSSL::PKey::RSA.generate(1024) }
-        let(:token)                { create_token(another_private_key, expiration_date, algorithm) }
-        
-        it "should raise an error :verification_failed" do
-          expect {
-            service.decode_and_verify(token)
-          }.to raise_error(TokenError, "Failed to verify JWT token")
-        end
-      end
-
-      context "and token is generated by the right private key" do
-        let(:token) { create_token(private_key, expiration_date, algorithm) }
-        
-        context "and token is expired" do
-          let(:expiration_date) { Time.now - 2.days }
-          
-          it "should raise an error :expiration_date" do
-            expect {
-              service.decode_and_verify(token)
-            }.to raise_error(TokenError, "JWT token is expired")
-          end
-        end
-
-        # The service reads `token_expiration_tolerance_in_seconds` when it is instantiated:
-        # a token expiring within that tolerance is already considered as expired.
-        context "and token expires within the expiration tolerance" do
-          let(:expiration_date) { Time.now + 5 }
-
-          it "should raise an error :expiration_date" do
-            expect(KeycloakApiRails.config.token_expiration_tolerance_in_seconds).to eq 10
-            expect {
-              service.decode_and_verify(token)
-            }.to raise_error(TokenError, "JWT token is expired")
-          end
-        end
-
-        context "and token expires just after the expiration tolerance" do
-          let(:expiration_date) { Time.now + 30 }
-
-          it "should return a not-nil decoded token" do
-            expect(KeycloakApiRails.config.token_expiration_tolerance_in_seconds).to eq 10
-            expect(service.decode_and_verify(token)).to_not be_nil
-          end
-        end
-
-        context "and token is not expired" do
-          let(:expiration_date) { Time.now + 2.days }
-
-          context "and token is encrypted using RS256" do
-            let(:algorithm) { :RS256 }
-            
-            it "should return a not-nil decoded token" do
-              expect(service.decode_and_verify(token)).to_not be_nil
-            end
-          end
-
-          context "and token is encrypted using RS512" do
-            let(:algorithm) { :RS512 }
-            
-            it "should return a not-nil decoded token" do
-              expect(service.decode_and_verify(token)).to_not be_nil
-            end
-          end
-        end
-      end
-    end
-  end
-
-  describe "#need_middleware_authentication?" do
-
-    let(:method)  { nil }
-    let(:path)    { nil }
-    let(:headers) { {} }
-
-
-    before(:each) do
-      KeycloakApiRails.config.skip_paths = {
-        post:   [/^\/skip/],
-        get:    [/^\/skip/]
-      }
-      @result = service.need_middleware_authentication?(method, path, headers)
-    end
-
-    context "when method is nil" do
-      let(:method) { nil }
-      let(:path)   { "/do-not-skip" }
-      it "should return true" do
-        expect(@result).to be true
-      end
-    end
-
-    context "when path is nil" do
-      let(:method) { :get }
-      let(:path)   { nil }
-      it "should return true" do
-        expect(@result).to be true
-      end
-    end
-
-    context "when method does not match the configuration" do
-      let(:method) { :put }
-      let(:path)   { "/skip" }
-      it "should return true" do
-        expect(@result).to be true
-      end
-    end
-
-    context "when path does not match the configuration" do
-      let(:method) { :get }
-      let(:path)   { "/do-not-skip" }
-      it "should return true" do
-        expect(@result).to be true
-      end
-    end
-
-    context "when method [get] and path do match the configuration" do
-      let(:method) { :get }
-      let(:path)   { "/skip" }
-      it "should return false" do
-        expect(@result).to be false
-      end
-    end
-
-
-    context "when method [post] and path do match the configuration" do
-      let(:method) { :get }
-      let(:path)   { "/skip" }
-      it "should return false" do
-        expect(@result).to be false
-      end
-    end
-
-    context "when the request is preflight" do
-      let(:method)  { :options }
-      let(:headers) { { "HTTP_ACCESS_CONTROL_REQUEST_METHOD" => ["Authorization"] } }
-      let(:path)    { "/do-not-skip" }
-      it "should return false" do
-        expect(@result).to be false
-      end
-    end
-
-    context "when configured as opt_in" do
-      before do
-        KeycloakApiRails.config.opt_in = true
-        service2 = KeycloakApiRails::Service.new(key_resolver)
-        @result = service2.need_middleware_authentication?(method, path, headers)
-      end
-
-      it "should return false" do
-        expect(@result).to be false
-      end
-    end
-  end
-
-  describe "#read_token" do
-    let(:query_string)       { "" }
-    let(:url)                { "http://api.service.com/api/health?aParameter=true#{query_string}" }
-    let(:headers)            { {} }
-    let(:header_token)       { "header_token" }
-    let(:query_string_token) { "query_string_token" }
-
-    before(:each) do
-      @token = service.read_token(url, headers)
-    end
-
-    context "when the token is provided in the Authorization headers" do
-      let(:headers) do
-        {
-          "HTTP_AUTHORIZATION" => "Bearer #{header_token}"
-        }
-      end
-      context "and not in the query string" do
-        let(:query_string) { "" }
-        it "returns the header token" do
-          expect(@token).to eq header_token
-        end
-      end
-
-      context "and also in the query string" do
-        let(:query_string) { "&authorizationToken=#{query_string_token}" }
-        it "returns the query string token" do
-          expect(@token).to eq query_string_token
-        end
-      end
-    end
-
-    context "when the token is not provided in the Authorization headers" do
-      let(:headers) do
-        {
-          "ANOTHER_HEADER" => header_token
-        }
-      end
-
-      context "and not in the query string" do
-        let(:query_string) { "" }
-        it "returns an empty token" do
-          expect(@token).to eq ""
-        end
-      end
-
-      context "and query string is nil" do
-        let(:query_string) { nil }
-        it "returns an empty token" do
-          expect(@token).to eq ""
-        end
-      end
-
-      context "but in the query string" do
-        let(:query_string) { "&authorizationToken=#{query_string_token}" }
-        it "returns the query string token" do
-          expect(@token).to eq query_string_token
-        end
-      end
-    end
-  end
-end

data/spec/spec_helper.rb

@@ -1,14 +0,0 @@
-require_relative "../lib/keycloak-api-rails"
-require_relative "support/rails_helper"
-require_relative "support/public_key_cached_resolver_stub"
-require_relative "support/public_key_resolver_stub"
-require "timecop"
-require "byebug"
-
-RSpec.configure do |config|
-  config.include RailsHelper
-  
-  config.expect_with :rspec do |expectations|
-    expectations.include_chain_clauses_in_custom_matcher_descriptions = true
-  end
-end

data/spec/support/activesupport_free_probe.rb

@@ -1,131 +0,0 @@
-# Loads the library and exercises every code path that used to rely on ActiveSupport,
-# in a process where ActiveSupport is *not* loaded.
-#
-# The regular test suite loads `rails/all`, which makes ActiveSupport available everywhere and
-# therefore cannot detect that the library depends on it again. This probe is executed in a
-# separate process by spec/keycloak-api-rails/activesupport_free_spec.rb.
-#
-# The library files are required one by one on purpose: `lib/keycloak-api-rails.rb` pulls in
-# `json/jwt`, which depends on ActiveSupport. The point of this probe is that *our* code does not
-# use ActiveSupport, not that it never gets loaded by a third party.
-
-require "uri"
-require "date"
-require "logger"
-
-LIB = File.expand_path("../../../lib/keycloak-api-rails", __FILE__)
-
-# Minimal stand-in for the parts of lib/keycloak-api-rails.rb the required files call at runtime.
-module KeycloakApiRails
-  class << self
-    attr_accessor :config
-  end
-end
-
-require "#{LIB}/configuration"
-require "#{LIB}/helper"
-require "#{LIB}/authentication"
-require "#{LIB}/public_key_resolver"
-require "#{LIB}/public_key_cached_resolver"
-require "#{LIB}/service"
-
-$failures = []
-
-def assert(description)
-  $failures << description unless yield
-rescue => e
-  $failures << "#{description} (raised #{e.class}: #{e.message})"
-end
-
-assert("ActiveSupport is not loaded by the library") { !defined?(ActiveSupport) }
-
-### Configuration -- used to be ActiveSupport::Configurable
-configuration = KeycloakApiRails::Configuration.new
-KeycloakApiRails.config = configuration
-
-%i[
-  server_url realm_id skip_paths opt_in token_expiration_tolerance_in_seconds
-  public_key_cache_ttl custom_attributes logger ca_certificate_file
-].each do |name|
-  assert("Configuration##{name} is nil until it is assigned") { configuration.public_send(name).nil? }
-  configuration.public_send("#{name}=", "a value for #{name}")
-  assert("Configuration##{name} returns what was assigned") { configuration.public_send(name) == "a value for #{name}" }
-end
-
-### Authentication -- used to be ActiveSupport::Concern
-declared_helper_methods = []
-controller_with_helpers = Class.new do
-  define_singleton_method(:helper_method) { |*names| declared_helper_methods.concat(names) }
-end
-controller_with_helpers.include(KeycloakApiRails::Authentication)
-assert("Authentication declares keycloak_authenticate as a helper method") do
-  declared_helper_methods == [:keycloak_authenticate]
-end
-assert("Authentication can be included in a class without helper_method") do
-  Class.new.include(KeycloakApiRails::Authentication)
-  true
-end
-assert("Authentication keeps its methods protected") do
-  KeycloakApiRails::Authentication.protected_instance_methods.sort ==
-    %i[authentication_failed authentication_succeeded keycloak_authenticate]
-end
-
-### Helper#read_token_from_query_string -- used to be `present?` and `second`
-{
-  nil                                                             => "",
-  ""                                                              => "",
-  "   "                                                           => "",
-  "http://www.an-url.io/health"                                   => nil,
-  "http://www.an-url.io/health?firstName=ouioui"                  => nil,
-  "http://www.an-url.io/health?authorizationToken=aToken"         => "aToken",
-  "http://www.an-url.io/health?a=1&authorizationToken=aToken&b=2" => "aToken",
-}.each do |uri, expected|
-  assert("Helper.read_token_from_query_string(#{uri.inspect}) returns #{expected.inspect}") do
-    KeycloakApiRails::Helper.read_token_from_query_string(uri) == expected
-  end
-end
-
-### Service#expired? -- used to be `to_datetime` and `seconds`
-configuration.token_expiration_tolerance_in_seconds = 10
-configuration.skip_paths = {}
-configuration.opt_in     = false
-configuration.logger     = ::Logger.new(File::NULL)
-service = KeycloakApiRails::Service.new(nil)
-now = Time.now
-
-{
-  "expiring in one hour"                         => [(now + 3600).to_i, false],
-  "expired two days ago"                         => [(now - 172800).to_i, true],
-  "expiring within the tolerance (5s < 10s)"     => [(now + 5).to_i, true],
-  "expiring after the tolerance (30s > 10s)"     => [(now + 30).to_i, false],
-}.each do |description, (exp, expected)|
-  assert("Service#expired? returns #{expected} for a token #{description}") do
-    service.send(:expired?, { "exp" => exp }) == expected
-  end
-end
-
-### PublicKeyCachedResolver -- used to be `seconds`
-ttl = 86400
-resolver = KeycloakApiRails::PublicKeyCachedResolver.new(nil, "a-realm", ttl)
-assert("PublicKeyCachedResolver considers an empty cache as outdated") do
-  resolver.send(:public_keys_are_outdated?) == true
-end
-resolver.instance_variable_set(:@cached_public_keys, "a-public-key")
-resolver.instance_variable_set(:@cached_public_key_retrieved_at, Time.now - (ttl - 10))
-assert("PublicKeyCachedResolver keeps a cache that is within its TTL") do
-  resolver.send(:public_keys_are_outdated?) == false
-end
-resolver.instance_variable_set(:@cached_public_key_retrieved_at, Time.now - (ttl + 10))
-assert("PublicKeyCachedResolver invalidates a cache that outlived its TTL") do
-  resolver.send(:public_keys_are_outdated?) == true
-end
-
-assert("ActiveSupport has not been loaded while exercising the library") { !defined?(ActiveSupport) }
-
-if $failures.empty?
-  puts "The library behaves correctly without ActiveSupport"
-  exit 0
-else
-  $failures.each { |failure| puts "FAILED: #{failure}" }
-  exit 1
-end

data/spec/support/public_key_cached_resolver_stub.rb

@@ -1,11 +0,0 @@
-module KeycloakApiRails
-  class PublicKeyCachedResolverStub
-    def initialize(public_key)
-      @public_key = public_key
-    end
-
-    def find_public_keys
-      @public_key
-    end
-  end
-end

data/spec/support/public_key_resolver_stub.rb

@@ -1,7 +0,0 @@
-module KeycloakApiRails
-  class PublicKeyResolverStub
-    def find_public_keys
-      OpenSSL::PKey::RSA.generate(1024).public_key
-    end
-  end
-end

data/spec/support/rails_helper.rb

@@ -1,4 +0,0 @@
-require "rails/all"
-
-module RailsHelper
-end