keycloak-api-rails 1.1.1 → 1.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1f53bfe86f8f72911bac95192b9a21fc0cf1ec01868e00f2cdd8edfcc57811e3
-  data.tar.gz: 2ad644c2561e191e9dd858055a9442df69fff0af02d078360164f1d41283f633
+  metadata.gz: 74dec51fa027308c2cf5b57ca67b7316b21677bf1592022f76988f232bbde911
+  data.tar.gz: 4836a7951bbf1559ff5eec0dfeb004ff8bcd2955cee7e06ee9e8a553743ad99e
 SHA512:
-  metadata.gz: da17e6a76b47460200ea397c58346dbdd43975f7aecec34e973b77ad15ebd12739d2c5d533064af24204d5be7bd4cc0f3c74b3df98e6d2623289a0d66f1398ad
-  data.tar.gz: 1f1f0ed249c2963fec160fdbdb6910a8387024f54d9956c35729fb5438037b541989046aee9dab2936dcc585d8f5e9ca6cd1b3247c20fb4dcea62ff7e2fae253
+  metadata.gz: 48b3307f4dff316dfa063deddf0d106bbcc409856c20f0af5c441bdc3b1163e9cf93f0c3f7e53fd1a90fcb7946744c2b1b8863fd5a61a0c4012fe3d7df6b5aee
+  data.tar.gz: 81aca7224bcae644dd35f6fb715bdb447b0da549bc3da0bdd311a6bea06adfba468936aabcdaeb305a44839c6770a46644abfdf81f2f828246414880e9ab52dd

data/CHANGELOG.md

@@ -5,6 +5,11 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.2] - 2026-08-01
+
+* Gem metadata
+* The published gem no longer ships non-production code
+
 ## [1.1.1] - 2026-07-31
 
 * New test helpers, in `keycloak-api-rails/testing`: `KeycloakApiRails::Testing.stub_public_keys!` validates the tokens forged by `keycloak_token` and `keycloak_auth_headers`, so that controller and request tests can be authenticated without a Keycloak server, and without the boilerplate the README used to describe. This file is not loaded by `keycloak-api-rails` and has to be required explicitly

data/MIT-LICENSE

@@ -1,4 +1,4 @@
-Copyright 2018 
+Copyright (c) 2018 Lorent Lempereur
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/README.md

@@ -18,7 +18,7 @@ the recommended path.
 ## Install
 
 ```ruby
-gem "keycloak-api-rails", "1.1.1"
+gem "keycloak-api-rails", "1.1.2"
 ```
 
 ## Token validation

data/keycloak-api-rails.gemspec

@@ -9,10 +9,21 @@ Gem::Specification.new do |spec|
   spec.email       = ["lorent.lempereur.dev@gmail.com"]
   spec.homepage    = "https://github.com/looorent/keycloak-api-rails"
   spec.summary     = "Rails middleware that validates Authorization token emitted by Keycloak"
-  spec.description = "Rails middleware that validates Authorization token emitted by Keycloak"
+  spec.description = "Rack middleware that validates the Keycloak JWT access token carried by every " \
+                     "request of a Ruby on Rails API. It verifies the token signature against the " \
+                     "realm public keys, exposes the authenticated user, its roles and the custom " \
+                     "attributes of the token to the controllers, and lets some routes opt out of " \
+                     "authentication."
   spec.license     = "MIT"
 
-  spec.files = `git ls-files -z`.split("\x0")
+  spec.metadata = {
+    "source_code_uri"       => spec.homepage,
+    "changelog_uri"         => "#{spec.homepage}/blob/main/CHANGELOG.md",
+    "bug_tracker_uri"       => "#{spec.homepage}/issues",
+    "rubygems_mfa_required" => "true"
+  }
+
+  spec.files = Dir.glob(["lib/**/*.rb", "CHANGELOG.md", "MIT-LICENSE", "README.md", "keycloak-api-rails.gemspec"])
   spec.require_paths = ["lib"]
 
   spec.required_ruby_version = ">= 2.7"

data/lib/keycloak-api-rails/version.rb

@@ -1,3 +1,3 @@
 module KeycloakApiRails
-  VERSION = "1.1.1"
+  VERSION = "1.1.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: keycloak-api-rails
 version: !ruby/object:Gem::Version
-  version: 1.1.1
+  version: 1.1.2
 platform: ruby
 authors:
 - Lorent Lempereur
@@ -93,23 +93,19 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 11.1.3
-description: Rails middleware that validates Authorization token emitted by Keycloak
+description: Rack middleware that validates the Keycloak JWT access token carried
+  by every request of a Ruby on Rails API. It verifies the token signature against
+  the realm public keys, exposes the authenticated user, its roles and the custom
+  attributes of the token to the controllers, and lets some routes opt out of authentication.
 email:
 - lorent.lempereur.dev@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".github/workflows/ci.yml"
-- ".github/workflows/release.yml"
-- ".gitignore"
-- ".rspec"
 - CHANGELOG.md
-- Dockerfile
-- Gemfile
 - MIT-LICENSE
 - README.md
-- Rakefile
 - keycloak-api-rails.gemspec
 - lib/keycloak-api-rails.rb
 - lib/keycloak-api-rails/authentication.rb
@@ -124,22 +120,14 @@ files:
 - lib/keycloak-api-rails/testing.rb
 - lib/keycloak-api-rails/token_error.rb
 - lib/keycloak-api-rails/version.rb
-- spec/keycloak-api-rails/activesupport_free_spec.rb
-- spec/keycloak-api-rails/authentication_spec.rb
-- spec/keycloak-api-rails/configuration_spec.rb
-- spec/keycloak-api-rails/helper_spec.rb
-- spec/keycloak-api-rails/public_key_cached_resolver_spec.rb
-- spec/keycloak-api-rails/service_spec.rb
-- spec/keycloak-api-rails/testing_spec.rb
-- spec/spec_helper.rb
-- spec/support/activesupport_free_probe.rb
-- spec/support/public_key_cached_resolver_stub.rb
-- spec/support/public_key_resolver_stub.rb
-- spec/support/rails_helper.rb
 homepage: https://github.com/looorent/keycloak-api-rails
 licenses:
 - MIT
-metadata: {}
+metadata:
+  source_code_uri: https://github.com/looorent/keycloak-api-rails
+  changelog_uri: https://github.com/looorent/keycloak-api-rails/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/looorent/keycloak-api-rails/issues
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib

data/.github/workflows/ci.yml

@@ -1,35 +0,0 @@
-name: Ruby
-
-on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    name: Ruby ${{ matrix.ruby-version }}
-    # Pinned rather than 'ubuntu-latest': ruby/setup-ruby has no prebuilt Rubies for
-    # ubuntu-26.04 yet, so the oldest versions of the matrix would break once the
-    # 'latest' alias moves on.
-    runs-on: ubuntu-24.04
-
-    strategy:
-      fail-fast: false
-      matrix:
-        # Each version resolves the newest dependencies it supports: Rails 7.1 on Ruby 2.7
-        # and 3.0, Rails 7.2 on Ruby 3.1, Rails 8.1 on Ruby 3.2 and above.
-        ruby-version: ['2.7', '3.0', '3.1', '3.2', '3.3', '3.4', '4.0']
-
-    steps:
-    - uses: actions/checkout@v4
-    - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
-      with:
-        ruby-version: ${{ matrix.ruby-version }}
-        bundler-cache: true # runs 'bundle install' and caches installed gems automatically
-    - name: Run tests
-      run: bundle exec rspec

data/.github/workflows/release.yml

@@ -1,52 +0,0 @@
-name: Release
-
-# Publishing is triggered by pushing a version tag, e.g.:
-#   git tag -a v1.2.0 -m "Version 1.2.0" && git push origin v1.2.0
-#
-# No RubyGems API key is stored in this repository: the gem is pushed through
-# RubyGems' Trusted Publishing, which exchanges a short-lived GitHub OIDC token
-# for a scoped RubyGems credential. This requires a trusted publisher declared on
-# https://rubygems.org/gems/keycloak-api-rails pointing to this repository, this
-# workflow file name and the 'release' environment.
-on:
-  push:
-    tags: [ "v*" ]
-
-permissions:
-  contents: read
-
-jobs:
-  release:
-    name: Push gem to RubyGems.org
-    # Pinned rather than 'ubuntu-latest', for the same reason as in ci.yml.
-    runs-on: ubuntu-24.04
-
-    environment: release
-
-    permissions:
-      contents: write # 'rake release' pushes the version tag when it does not exist yet
-      id-token: write # mandatory to request the OIDC token used by trusted publishing
-
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
-      with:
-        ruby-version: '3.4'
-        bundler-cache: true
-
-    - name: Check that the tag matches KeycloakApiRails::VERSION
-      run: |
-        tag="${GITHUB_REF_NAME#v}"
-        version="$(ruby -Ilib -r keycloak-api-rails/version -e 'print KeycloakApiRails::VERSION')"
-        if [ "$tag" != "$version" ]; then
-          echo "::error::Tag '${GITHUB_REF_NAME}' does not match KeycloakApiRails::VERSION '${version}'"
-          exit 1
-        fi
-
-    - name: Run tests
-      run: bundle exec rspec
-
-    # Builds the gem, pushes it to RubyGems.org and waits for it to be available.
-    - uses: rubygems/release-gem@v1

data/.gitignore

@@ -1,9 +0,0 @@
-.bundle/
-log/*.log
-.byebug_history
-*.gem
-pkg/
-# This gem supports several Ruby versions, each of them resolving a different set of
-# dependencies (Ruby 2.7 caps Rails to 7.1, Ruby 3.1 to 7.2, Ruby 3.2+ resolves Rails 8.1).
-# A single committed lockfile cannot satisfy all of them.
-Gemfile.lock

data/.rspec

@@ -1,2 +0,0 @@
---color
---require spec_helper

data/Dockerfile

@@ -1,13 +0,0 @@
-FROM ruby:3.4.10-slim-bookworm
-
-RUN apt-get update -qq && apt-get install -y build-essential git ruby-dev && apt-get clean && \
-  mkdir -p /usr/src/app/lib/keycloak-api-rails
-
-WORKDIR /usr/src/app
-
-COPY Gemfile /usr/src/app/
-COPY keycloak-api-rails.gemspec /usr/src/app/
-COPY lib/keycloak-api-rails/version.rb /usr/src/app/lib/keycloak-api-rails/
-RUN bundle install
-COPY . /usr/src/app
-RUN bundle install

data/Gemfile

@@ -1,3 +0,0 @@
-source 'https://rubygems.org'
-
-gemspec

data/Rakefile

@@ -1,6 +0,0 @@
-require "bundler/gem_tasks"
-require "rspec/core/rake_task"
-
-RSpec::Core::RakeTask.new(:spec)
-
-task default: :spec

data/spec/keycloak-api-rails/activesupport_free_spec.rb

@@ -1,18 +0,0 @@
-require "rbconfig"
-
-RSpec.describe "The library without ActiveSupport" do
-
-  let(:probe) { File.expand_path("../../support/activesupport_free_probe.rb", __FILE__) }
-
-  # RUBYOPT is cleared so that nothing set up by bundler is preloaded in the probe process.
-  def run_probe
-    output = IO.popen({ "RUBYOPT" => nil }, [RbConfig.ruby, probe], err: [:child, :out], &:read)
-    [$?.exitstatus, output]
-  end
-
-  it "loads and behaves the same way when ActiveSupport is not available" do
-    status, output = run_probe
-
-    expect(status).to eq(0), "The library relies on ActiveSupport:\n#{output}"
-  end
-end

data/spec/keycloak-api-rails/authentication_spec.rb

@@ -1,70 +0,0 @@
-require "spec_helper"
-
-describe KeycloakApiRails::Authentication do
-  class ExampleController < ActionController::Base
-    include KeycloakApiRails::Authentication
-    # Mark protected methods public so they may be called in tests
-    public(*KeycloakApiRails::Authentication.protected_instance_methods)
-  end
-
-  let(:controller) { ExampleController.new }
-  let(:token) { 'keycloak_valid_token'}
-  let(:headers) do
-    {
-      'REQUEST_METHOD' => :get,
-      'REQUEST_URI' => 'http://www.an-url.io',
-      'HTTP_AUTHORIZATION' => "Bearer #{token}"
-    }
-  end
-
-  describe "when included" do
-    it "declares keycloak_authenticate as a helper method when the base class supports helpers" do
-      declared_helper_methods = []
-      base = Class.new do
-        define_singleton_method(:helper_method) { |*names| declared_helper_methods.concat(names) }
-      end
-
-      base.include(KeycloakApiRails::Authentication)
-
-      expect(declared_helper_methods).to eq [:keycloak_authenticate]
-    end
-
-    it "declares the helper method on a real controller" do
-      expect(ExampleController._helper_methods).to include :keycloak_authenticate
-    end
-
-    it "does not fail when the base class does not support helpers" do
-      expect {
-        Class.new.include(KeycloakApiRails::Authentication)
-      }.to_not raise_error
-    end
-
-    it "exposes its methods as protected instance methods" do
-      expect(KeycloakApiRails::Authentication.protected_instance_methods).to match_array %i[
-        keycloak_authenticate
-        authentication_failed
-        authentication_succeeded
-      ]
-    end
-
-    it "does not add any public method to the including class" do
-      base = Class.new.include(KeycloakApiRails::Authentication)
-
-      expect(base.public_instance_methods).to_not include :keycloak_authenticate
-      expect(base.protected_instance_methods).to include :keycloak_authenticate
-    end
-  end
-
-  describe "#keycloak_authenticate" do
-    before do
-      # Mock request object because we aren't using real request spec
-      allow(controller).to receive(:request).and_return(double("request", env: headers ))
-    end
-
-    it "it authenticates with request header" do
-      expect_any_instance_of(KeycloakApiRails::Service).to receive(:decode_and_verify).with(token).and_return("A User")
-      expect(controller).to receive(:authentication_succeeded)
-      controller.keycloak_authenticate
-    end
-  end
-end

data/spec/keycloak-api-rails/configuration_spec.rb

@@ -1,101 +0,0 @@
-RSpec.describe KeycloakApiRails::Configuration do
-
-  # Every attribute that used to be declared through ActiveSupport's `config_accessor`.
-  let(:attribute_names) do
-    %i[
-      server_url
-      realm_id
-      skip_paths
-      opt_in
-      token_expiration_tolerance_in_seconds
-      public_key_cache_ttl
-      custom_attributes
-      logger
-      ca_certificate_file
-    ]
-  end
-
-  describe "attributes" do
-    let(:configuration) { KeycloakApiRails::Configuration.new }
-
-    it "exposes a reader and a writer for each attribute" do
-      attribute_names.each do |name|
-        expect(configuration).to respond_to name
-        expect(configuration).to respond_to "#{name}="
-      end
-    end
-
-    it "returns nil for each attribute that has not been assigned" do
-      attribute_names.each do |name|
-        expect(configuration.public_send(name)).to be_nil
-      end
-    end
-
-    it "returns the value that has been assigned" do
-      attribute_names.each do |name|
-        configuration.public_send("#{name}=", "a value for #{name}")
-        expect(configuration.public_send(name)).to eq "a value for #{name}"
-      end
-    end
-
-    it "does not respond to an unknown attribute" do
-      expect(configuration).to_not respond_to :not_a_configuration_attribute
-      expect {
-        configuration.not_a_configuration_attribute
-      }.to raise_error NoMethodError
-    end
-  end
-
-  describe "#configure" do
-    after(:each) do
-      KeycloakApiRails.load_configuration
-    end
-
-    it "yields the configuration" do
-      expect { |block| KeycloakApiRails.configure(&block) }.to yield_with_args KeycloakApiRails::Configuration
-    end
-
-    it "keeps the values assigned within the block" do
-      KeycloakApiRails.configure do |config|
-        config.server_url          = "http://keycloak:8080"
-        config.realm_id            = "a-realm"
-        config.ca_certificate_file = "/etc/ssl/a-certificate.pem"
-      end
-
-      expect(KeycloakApiRails.config.server_url).to eq "http://keycloak:8080"
-      expect(KeycloakApiRails.config.realm_id).to eq "a-realm"
-      expect(KeycloakApiRails.config.ca_certificate_file).to eq "/etc/ssl/a-certificate.pem"
-    end
-
-    it "always returns the same configuration instance" do
-      expect(KeycloakApiRails.config).to be KeycloakApiRails.config
-    end
-  end
-
-  describe "#load_configuration" do
-    before(:each) do
-      KeycloakApiRails.load_configuration
-    end
-
-    after(:each) do
-      KeycloakApiRails.load_configuration
-    end
-
-    it "applies the documented default values" do
-      config = KeycloakApiRails.config
-
-      expect(config.server_url).to be_nil
-      expect(config.realm_id).to be_nil
-      expect(config.logger).to be_a ::Logger
-      expect(config.skip_paths).to eq({})
-      expect(config.opt_in).to be false
-      expect(config.token_expiration_tolerance_in_seconds).to eq 10
-      expect(config.public_key_cache_ttl).to eq 86400
-      expect(config.custom_attributes).to eq []
-    end
-
-    it "exposes the logger through KeycloakApiRails.logger" do
-      expect(KeycloakApiRails.logger).to be KeycloakApiRails.config.logger
-    end
-  end
-end

data/spec/keycloak-api-rails/helper_spec.rb

@@ -1,94 +0,0 @@
-RSpec.describe KeycloakApiRails::Helper do
-  describe "#read_token_from_query_string" do
-
-    subject { KeycloakApiRails::Helper.read_token_from_query_string(uri) }
-
-    context "when the uri is nil" do
-      let(:uri) { nil }
-      it "returns an empty token" do
-        expect(subject).to eq ""
-      end
-    end
-
-    context "when the uri is empty" do
-      let(:uri) { "" }
-      it "returns an empty token" do
-        expect(subject).to eq ""
-      end
-    end
-
-    context "when the uri only contains whitespaces" do
-      let(:uri) { "   " }
-      it "returns an empty token" do
-        expect(subject).to eq ""
-      end
-    end
-
-    context "when the uri has no query string" do
-      let(:uri) { "http://www.an-url.io/health" }
-      it "returns no token" do
-        expect(subject).to be_nil
-      end
-    end
-
-    context "when the uri has a query string but no token" do
-      let(:uri) { "http://www.an-url.io/health?firstName=ouioui" }
-      it "returns no token" do
-        expect(subject).to be_nil
-      end
-    end
-
-    context "when the uri has a token in the query string" do
-      let(:uri) { "http://www.an-url.io/health?authorizationToken=aToken" }
-      it "returns the token" do
-        expect(subject).to eq "aToken"
-      end
-    end
-
-    context "when the uri has a token among other query string parameters" do
-      let(:uri) { "http://www.an-url.io/health?firstName=ouioui&authorizationToken=aToken&lastName=nonnon" }
-      it "returns the token" do
-        expect(subject).to eq "aToken"
-      end
-    end
-
-    context "when the uri has an empty token in the query string" do
-      let(:uri) { "http://www.an-url.io/health?authorizationToken=" }
-      it "returns an empty token" do
-        expect(subject).to eq ""
-      end
-    end
-  end
-
-  describe "#create_url_with_token" do
-
-    let(:uri)   { "http://www.an-url.io" }
-    let(:token) { "aToken" }
-
-    before(:each) do
-      @url_with_token = KeycloakApiRails::Helper.create_url_with_token(uri, token)
-    end
-
-    context "when the uri has no query string yet" do
-      it "returns an url with the provided token" do
-        expect(@url_with_token).to eq "#{uri}?authorizationToken=#{token}"
-      end
-    end
-
-    context "when the uri already has no query strings" do
-      context "but no token yet" do
-        let(:uri)   { "http://www.an-url.io?firstName=ouioui&lastName=nonnon" }
-        it "returns an url with all the query string and the token" do
-          expect(@url_with_token).to eq "#{uri}&authorizationToken=#{token}"
-        end
-      end
-
-      context "including a token" do
-        let(:uri)   { "http://www.an-url.io?authorizationToken=ouioui&lastName=nonnon" }
-        it "returns an url with all the query string and the new token" do
-          expect(@url_with_token).to eq "http://www.an-url.io?lastName=nonnon&authorizationToken=#{token}"
-        end
-      end
-    end
-  end
-end

data/spec/keycloak-api-rails/public_key_cached_resolver_spec.rb

@@ -1,80 +0,0 @@
-RSpec.describe KeycloakApiRails::Service do
-
-  let(:public_key_cache_ttl)  { 86400 }
-  let(:server_url)            { "whatever:8080" }
-  let(:realm_id)              { "pouet" }
-  let!(:resolver)             { KeycloakApiRails::PublicKeyCachedResolver.new(server_url, realm_id, public_key_cache_ttl) }
-
-  before(:each) do
-    resolver.instance_variable_set(:@resolver, KeycloakApiRails::PublicKeyResolverStub.new)
-    now = Time.local(2018, 1, 9, 12, 0, 0)
-    Timecop.freeze(now)
-  end
-
-  after(:each) do
-    Timecop.return
-  end
-
-  describe "#find_public_key" do
-    context "when there is no public key in cache yet" do
-      before(:each) do
-        @public_key = resolver.find_public_keys
-      end
-
-      it "returns a valid public key" do
-        expect(@public_key).to_not be_nil
-      end
-
-      it "sets the current time to the resolver" do
-        expect(resolver.cached_public_key_retrieved_at).to eq Time.now
-      end
-    end
-
-    context "when there is already a public key in cache" do
-      before(:each) do
-        @first_public_key                     = resolver.find_public_keys
-        @first_cached_public_key_retrieved_at = resolver.cached_public_key_retrieved_at
-      end
-
-      context "and no need to refresh it" do
-        before(:each) do
-          Timecop.freeze(Time.now + public_key_cache_ttl.seconds - 10.seconds)
-          @second_public_key                     = resolver.find_public_keys
-          @second_cached_public_key_retrieved_at = resolver.cached_public_key_retrieved_at
-        end
-
-        it "returns a valid public key" do
-          expect(@second_public_key).to_not be_nil
-        end
-
-        it "does not refresh the public key" do
-          expect(@second_public_key).to eq @first_public_key
-        end
-
-        it "does not refresh the public key retrieval time" do
-          expect(@first_cached_public_key_retrieved_at).to eq @second_cached_public_key_retrieved_at
-        end
-      end
-
-      context "and its TTL has expired" do
-        before(:each) do
-          Timecop.freeze(Time.now + public_key_cache_ttl.seconds + 10.seconds)
-          @second_public_key                     = resolver.find_public_keys
-          @second_cached_public_key_retrieved_at = resolver.cached_public_key_retrieved_at
-        end
-
-        it "returns a valid public key" do
-          expect(@second_public_key).to_not be_nil
-        end
-
-        it "refreshes the public key" do
-          expect(@second_public_key).to_not eq @first_public_key
-        end
-
-        it "refreshes the public key retrieval time" do
-          expect(@first_cached_public_key_retrieved_at).to_not eq @second_cached_public_key_retrieved_at
-        end
-      end
-    end
-  end
-end

data/spec/keycloak-api-rails/service_spec.rb

@@ -1,281 +0,0 @@
-RSpec.describe KeycloakApiRails::Service do
-
-  let!(:private_key)  { OpenSSL::PKey::RSA.generate(2048) }
-  let!(:public_key)   { private_key.public_key }
-  let!(:key_resolver)  { KeycloakApiRails::PublicKeyCachedResolverStub.new(public_key) }
-  let!(:service)       { KeycloakApiRails::Service.new(key_resolver) }
-  
-  before(:each) do
-    now = Time.local(2018, 1, 9, 12, 0, 0)
-    Timecop.freeze(now)
-  end
-
-  after(:each) do
-    Timecop.return
-  end
-
-  describe "#decode_and_verify" do
-    def create_token(private_key, expiration_date, algorithm)
-      claim = {
-        iss: "KeycloakApiRails",
-        exp: expiration_date,
-        nbf: Time.local(2018, 1, 1, 0, 0, 0)
-      }
-      jws = JSON::JWT.new(claim).sign(private_key, algorithm)
-      jws.to_s
-    end
-
-    context "when token is nil" do
-      let(:token) { nil }
-      it "should raise an error :no_token" do
-        expect {
-          service.decode_and_verify(token)
-        }.to raise_error(TokenError, "No JWT token provided")
-      end
-    end
-
-    context "when token is an empty string" do
-      let(:token) { "" }
-      it "should raise an error :no_token" do
-        expect {
-          service.decode_and_verify(token)
-        }.to raise_error(TokenError, "No JWT token provided")
-      end
-    end
-
-    context "when token is in an invalid format" do
-      let(:token) { "coucou" }
-      it "should raise an error :invalid_format" do
-        expect {
-          service.decode_and_verify(token)
-        }.to raise_error(TokenError, "Wrong JWT Format")
-      end
-    end
-
-    context "when token is in a valid format" do
-      let(:algorithm)       { :RS256 }
-      let(:expiration_date) { 1.week.from_now }
-
-      context "and token is generated by another private key" do
-        let(:another_private_key)  { OpenSSL::PKey::RSA.generate(1024) }
-        let(:token)                { create_token(another_private_key, expiration_date, algorithm) }
-        
-        it "should raise an error :verification_failed" do
-          expect {
-            service.decode_and_verify(token)
-          }.to raise_error(TokenError, "Failed to verify JWT token")
-        end
-      end
-
-      context "and token is generated by the right private key" do
-        let(:token) { create_token(private_key, expiration_date, algorithm) }
-        
-        context "and token is expired" do
-          let(:expiration_date) { Time.now - 2.days }
-          
-          it "should raise an error :expiration_date" do
-            expect {
-              service.decode_and_verify(token)
-            }.to raise_error(TokenError, "JWT token is expired")
-          end
-        end
-
-        # The service reads `token_expiration_tolerance_in_seconds` when it is instantiated:
-        # a token expiring within that tolerance is already considered as expired.
-        context "and token expires within the expiration tolerance" do
-          let(:expiration_date) { Time.now + 5 }
-
-          it "should raise an error :expiration_date" do
-            expect(KeycloakApiRails.config.token_expiration_tolerance_in_seconds).to eq 10
-            expect {
-              service.decode_and_verify(token)
-            }.to raise_error(TokenError, "JWT token is expired")
-          end
-        end
-
-        context "and token expires just after the expiration tolerance" do
-          let(:expiration_date) { Time.now + 30 }
-
-          it "should return a not-nil decoded token" do
-            expect(KeycloakApiRails.config.token_expiration_tolerance_in_seconds).to eq 10
-            expect(service.decode_and_verify(token)).to_not be_nil
-          end
-        end
-
-        context "and token is not expired" do
-          let(:expiration_date) { Time.now + 2.days }
-
-          context "and token is encrypted using RS256" do
-            let(:algorithm) { :RS256 }
-            
-            it "should return a not-nil decoded token" do
-              expect(service.decode_and_verify(token)).to_not be_nil
-            end
-          end
-
-          context "and token is encrypted using RS512" do
-            let(:algorithm) { :RS512 }
-            
-            it "should return a not-nil decoded token" do
-              expect(service.decode_and_verify(token)).to_not be_nil
-            end
-          end
-        end
-      end
-    end
-  end
-
-  describe "#need_middleware_authentication?" do
-
-    let(:method)  { nil }
-    let(:path)    { nil }
-    let(:headers) { {} }
-
-
-    before(:each) do
-      KeycloakApiRails.config.skip_paths = {
-        post:   [/^\/skip/],
-        get:    [/^\/skip/]
-      }
-      @result = service.need_middleware_authentication?(method, path, headers)
-    end
-
-    context "when method is nil" do
-      let(:method) { nil }
-      let(:path)   { "/do-not-skip" }
-      it "should return true" do
-        expect(@result).to be true
-      end
-    end
-
-    context "when path is nil" do
-      let(:method) { :get }
-      let(:path)   { nil }
-      it "should return true" do
-        expect(@result).to be true
-      end
-    end
-
-    context "when method does not match the configuration" do
-      let(:method) { :put }
-      let(:path)   { "/skip" }
-      it "should return true" do
-        expect(@result).to be true
-      end
-    end
-
-    context "when path does not match the configuration" do
-      let(:method) { :get }
-      let(:path)   { "/do-not-skip" }
-      it "should return true" do
-        expect(@result).to be true
-      end
-    end
-
-    context "when method [get] and path do match the configuration" do
-      let(:method) { :get }
-      let(:path)   { "/skip" }
-      it "should return false" do
-        expect(@result).to be false
-      end
-    end
-
-
-    context "when method [post] and path do match the configuration" do
-      let(:method) { :get }
-      let(:path)   { "/skip" }
-      it "should return false" do
-        expect(@result).to be false
-      end
-    end
-
-    context "when the request is preflight" do
-      let(:method)  { :options }
-      let(:headers) { { "HTTP_ACCESS_CONTROL_REQUEST_METHOD" => ["Authorization"] } }
-      let(:path)    { "/do-not-skip" }
-      it "should return false" do
-        expect(@result).to be false
-      end
-    end
-
-    context "when configured as opt_in" do
-      before do
-        KeycloakApiRails.config.opt_in = true
-        service2 = KeycloakApiRails::Service.new(key_resolver)
-        @result = service2.need_middleware_authentication?(method, path, headers)
-      end
-
-      # The configuration is global: leaving 'opt_in' enabled would disable the authentication
-      # of every example running afterwards.
-      after do
-        KeycloakApiRails.config.opt_in = false
-      end
-
-      it "should return false" do
-        expect(@result).to be false
-      end
-    end
-  end
-
-  describe "#read_token" do
-    let(:query_string)       { "" }
-    let(:url)                { "http://api.service.com/api/health?aParameter=true#{query_string}" }
-    let(:headers)            { {} }
-    let(:header_token)       { "header_token" }
-    let(:query_string_token) { "query_string_token" }
-
-    before(:each) do
-      @token = service.read_token(url, headers)
-    end
-
-    context "when the token is provided in the Authorization headers" do
-      let(:headers) do
-        {
-          "HTTP_AUTHORIZATION" => "Bearer #{header_token}"
-        }
-      end
-      context "and not in the query string" do
-        let(:query_string) { "" }
-        it "returns the header token" do
-          expect(@token).to eq header_token
-        end
-      end
-
-      context "and also in the query string" do
-        let(:query_string) { "&authorizationToken=#{query_string_token}" }
-        it "returns the query string token" do
-          expect(@token).to eq query_string_token
-        end
-      end
-    end
-
-    context "when the token is not provided in the Authorization headers" do
-      let(:headers) do
-        {
-          "ANOTHER_HEADER" => header_token
-        }
-      end
-
-      context "and not in the query string" do
-        let(:query_string) { "" }
-        it "returns an empty token" do
-          expect(@token).to eq ""
-        end
-      end
-
-      context "and query string is nil" do
-        let(:query_string) { nil }
-        it "returns an empty token" do
-          expect(@token).to eq ""
-        end
-      end
-
-      context "but in the query string" do
-        let(:query_string) { "&authorizationToken=#{query_string_token}" }
-        it "returns the query string token" do
-          expect(@token).to eq query_string_token
-        end
-      end
-    end
-  end
-end

data/spec/keycloak-api-rails/testing_spec.rb

@@ -1,102 +0,0 @@
-require_relative "../../lib/keycloak-api-rails/testing"
-
-RSpec.describe KeycloakApiRails::Testing do
-  include KeycloakApiRails::Testing::Helpers
-
-  # The tokens are validated by the real middleware and the real service, so that these examples
-  # fail if what this module forges stops being what the library expects.
-  let(:authenticated_env) { {} }
-  let(:app) do
-    downstream = lambda do |env|
-      authenticated_env.replace(env)
-      [200, {}, ["OK"]]
-    end
-    KeycloakApiRails::Middleware.new(downstream)
-  end
-
-  def get(headers)
-    app.call({
-      "REQUEST_METHOD"    => "GET",
-      "PATH_INFO"         => "/me",
-      "REQUEST_URI"       => "http://example.org/me",
-      "HTTP_AUTHORIZATION" => headers["Authorization"]
-    })
-  end
-
-  before(:each) do
-    # The middleware only authenticates a request when the configuration tells it to, and the
-    # configuration is global: these examples cannot rely on what the other ones leave behind.
-    KeycloakApiRails.config.opt_in    = false
-    KeycloakApiRails.config.skip_paths = {}
-    KeycloakApiRails::Testing.stub_public_keys!
-  end
-
-  after(:each) do
-    KeycloakApiRails.public_key_resolver = nil
-  end
-
-  describe ".stub_public_keys!" do
-    it "should validate the tokens forged by this module" do
-      status, _headers, _body = get(keycloak_auth_headers)
-
-      expect(status).to eq(200)
-    end
-
-    it "should not require a Keycloak server to be configured" do
-      expect(KeycloakApiRails.config.server_url).to be_nil
-      expect(KeycloakApiRails.config.realm_id).to be_nil
-
-      status, _headers, _body = get(keycloak_auth_headers)
-
-      expect(status).to eq(200)
-    end
-  end
-
-  describe ".token_for" do
-    it "should authenticate the given user" do
-      get(keycloak_auth_headers(sub: "a-keycloak-id"))
-
-      expect(KeycloakApiRails::Helper.current_user_id(authenticated_env)).to eq("a-keycloak-id")
-    end
-
-    it "should generate a different user for each token" do
-      first_token  = JSON::JWT.decode(keycloak_token, KeycloakApiRails::Testing.public_keys)
-      second_token = JSON::JWT.decode(keycloak_token, KeycloakApiRails::Testing.public_keys)
-
-      expect(first_token["sub"]).not_to eq(second_token["sub"])
-    end
-
-    it "should expose every claim read by the library" do
-      get(keycloak_auth_headers(sub:              "a-keycloak-id",
-                                email:            "an-email@keycloak.io",
-                                locale:           "fr",
-                                authorized_party: "a-client",
-                                roles:            ["admin", "user"],
-                                resource_roles:   { "a-client" => ["reader"] }))
-
-      expect(KeycloakApiRails::Helper.current_user_id(authenticated_env)).to eq("a-keycloak-id")
-      expect(KeycloakApiRails::Helper.current_user_email(authenticated_env)).to eq("an-email@keycloak.io")
-      expect(KeycloakApiRails::Helper.current_user_locale(authenticated_env)).to eq("fr")
-      expect(KeycloakApiRails::Helper.current_authorized_party(authenticated_env)).to eq("a-client")
-      expect(KeycloakApiRails::Helper.current_user_roles(authenticated_env)).to eq(["admin", "user"])
-      expect(KeycloakApiRails::Helper.current_resource_roles(authenticated_env)).to eq({ "a-client" => ["reader"] })
-    end
-
-    it "should expose the claims declared as custom attributes" do
-      KeycloakApiRails.config.custom_attributes = ["tenant_id"]
-
-      get(keycloak_auth_headers(claims: { "tenant_id" => "a-tenant" }))
-
-      expect(KeycloakApiRails::Helper.current_user_custom_attributes(authenticated_env)).to eq({ "tenant_id" => "a-tenant" })
-    ensure
-      KeycloakApiRails.config.custom_attributes = []
-    end
-
-    it "should forge a token that is expired when 'expires_at' is in the past" do
-      status, _headers, body = get(keycloak_auth_headers(issued_at: Time.now - 7200, expires_at: Time.now - 3600))
-
-      expect(status).to eq(401)
-      expect(body.first).to include("JWT token is expired")
-    end
-  end
-end

data/spec/spec_helper.rb

@@ -1,14 +0,0 @@
-require_relative "../lib/keycloak-api-rails"
-require_relative "support/rails_helper"
-require_relative "support/public_key_cached_resolver_stub"
-require_relative "support/public_key_resolver_stub"
-require "timecop"
-require "byebug"
-
-RSpec.configure do |config|
-  config.include RailsHelper
-  
-  config.expect_with :rspec do |expectations|
-    expectations.include_chain_clauses_in_custom_matcher_descriptions = true
-  end
-end

data/spec/support/activesupport_free_probe.rb

@@ -1,131 +0,0 @@
-# Loads the library and exercises every code path that used to rely on ActiveSupport,
-# in a process where ActiveSupport is *not* loaded.
-#
-# The regular test suite loads `rails/all`, which makes ActiveSupport available everywhere and
-# therefore cannot detect that the library depends on it again. This probe is executed in a
-# separate process by spec/keycloak-api-rails/activesupport_free_spec.rb.
-#
-# The library files are required one by one on purpose: `lib/keycloak-api-rails.rb` pulls in
-# `json/jwt`, which depends on ActiveSupport. The point of this probe is that *our* code does not
-# use ActiveSupport, not that it never gets loaded by a third party.
-
-require "uri"
-require "date"
-require "logger"
-
-LIB = File.expand_path("../../../lib/keycloak-api-rails", __FILE__)
-
-# Minimal stand-in for the parts of lib/keycloak-api-rails.rb the required files call at runtime.
-module KeycloakApiRails
-  class << self
-    attr_accessor :config
-  end
-end
-
-require "#{LIB}/configuration"
-require "#{LIB}/helper"
-require "#{LIB}/authentication"
-require "#{LIB}/public_key_resolver"
-require "#{LIB}/public_key_cached_resolver"
-require "#{LIB}/service"
-
-$failures = []
-
-def assert(description)
-  $failures << description unless yield
-rescue => e
-  $failures << "#{description} (raised #{e.class}: #{e.message})"
-end
-
-assert("ActiveSupport is not loaded by the library") { !defined?(ActiveSupport) }
-
-### Configuration -- used to be ActiveSupport::Configurable
-configuration = KeycloakApiRails::Configuration.new
-KeycloakApiRails.config = configuration
-
-%i[
-  server_url realm_id skip_paths opt_in token_expiration_tolerance_in_seconds
-  public_key_cache_ttl custom_attributes logger ca_certificate_file
-].each do |name|
-  assert("Configuration##{name} is nil until it is assigned") { configuration.public_send(name).nil? }
-  configuration.public_send("#{name}=", "a value for #{name}")
-  assert("Configuration##{name} returns what was assigned") { configuration.public_send(name) == "a value for #{name}" }
-end
-
-### Authentication -- used to be ActiveSupport::Concern
-declared_helper_methods = []
-controller_with_helpers = Class.new do
-  define_singleton_method(:helper_method) { |*names| declared_helper_methods.concat(names) }
-end
-controller_with_helpers.include(KeycloakApiRails::Authentication)
-assert("Authentication declares keycloak_authenticate as a helper method") do
-  declared_helper_methods == [:keycloak_authenticate]
-end
-assert("Authentication can be included in a class without helper_method") do
-  Class.new.include(KeycloakApiRails::Authentication)
-  true
-end
-assert("Authentication keeps its methods protected") do
-  KeycloakApiRails::Authentication.protected_instance_methods.sort ==
-    %i[authentication_failed authentication_succeeded keycloak_authenticate]
-end
-
-### Helper#read_token_from_query_string -- used to be `present?` and `second`
-{
-  nil                                                             => "",
-  ""                                                              => "",
-  "   "                                                           => "",
-  "http://www.an-url.io/health"                                   => nil,
-  "http://www.an-url.io/health?firstName=ouioui"                  => nil,
-  "http://www.an-url.io/health?authorizationToken=aToken"         => "aToken",
-  "http://www.an-url.io/health?a=1&authorizationToken=aToken&b=2" => "aToken",
-}.each do |uri, expected|
-  assert("Helper.read_token_from_query_string(#{uri.inspect}) returns #{expected.inspect}") do
-    KeycloakApiRails::Helper.read_token_from_query_string(uri) == expected
-  end
-end
-
-### Service#expired? -- used to be `to_datetime` and `seconds`
-configuration.token_expiration_tolerance_in_seconds = 10
-configuration.skip_paths = {}
-configuration.opt_in     = false
-configuration.logger     = ::Logger.new(File::NULL)
-service = KeycloakApiRails::Service.new(nil)
-now = Time.now
-
-{
-  "expiring in one hour"                         => [(now + 3600).to_i, false],
-  "expired two days ago"                         => [(now - 172800).to_i, true],
-  "expiring within the tolerance (5s < 10s)"     => [(now + 5).to_i, true],
-  "expiring after the tolerance (30s > 10s)"     => [(now + 30).to_i, false],
-}.each do |description, (exp, expected)|
-  assert("Service#expired? returns #{expected} for a token #{description}") do
-    service.send(:expired?, { "exp" => exp }) == expected
-  end
-end
-
-### PublicKeyCachedResolver -- used to be `seconds`
-ttl = 86400
-resolver = KeycloakApiRails::PublicKeyCachedResolver.new(nil, "a-realm", ttl)
-assert("PublicKeyCachedResolver considers an empty cache as outdated") do
-  resolver.send(:public_keys_are_outdated?) == true
-end
-resolver.instance_variable_set(:@cached_public_keys, "a-public-key")
-resolver.instance_variable_set(:@cached_public_key_retrieved_at, Time.now - (ttl - 10))
-assert("PublicKeyCachedResolver keeps a cache that is within its TTL") do
-  resolver.send(:public_keys_are_outdated?) == false
-end
-resolver.instance_variable_set(:@cached_public_key_retrieved_at, Time.now - (ttl + 10))
-assert("PublicKeyCachedResolver invalidates a cache that outlived its TTL") do
-  resolver.send(:public_keys_are_outdated?) == true
-end
-
-assert("ActiveSupport has not been loaded while exercising the library") { !defined?(ActiveSupport) }
-
-if $failures.empty?
-  puts "The library behaves correctly without ActiveSupport"
-  exit 0
-else
-  $failures.each { |failure| puts "FAILED: #{failure}" }
-  exit 1
-end

data/spec/support/public_key_cached_resolver_stub.rb

@@ -1,11 +0,0 @@
-module KeycloakApiRails
-  class PublicKeyCachedResolverStub
-    def initialize(public_key)
-      @public_key = public_key
-    end
-
-    def find_public_keys
-      @public_key
-    end
-  end
-end

data/spec/support/public_key_resolver_stub.rb

@@ -1,7 +0,0 @@
-module KeycloakApiRails
-  class PublicKeyResolverStub
-    def find_public_keys
-      OpenSSL::PKey::RSA.generate(1024).public_key
-    end
-  end
-end

data/spec/support/rails_helper.rb

@@ -1,4 +0,0 @@
-require "rails/all"
-
-module RailsHelper
-end