keycloak-sdk 0.1.0.rc1

data/lib/keycloak_sdk/auth_client.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+require "rack/oauth2"
+require "securerandom"
+require "digest"
+require "base64"
+
+module KeycloakSdk
+  # 인증 파사드. rack-oauth2를 래핑(그랜트·PKCE)하고 introspection(RFC7662)·logout은 Faraday로 손수 수행한다.
+  # TokenProvider를 구현하지만(직접 사용용), admin은 캐싱 ClientCredentialsTokenProvider를 별도로 쓴다(§4).
+  class AuthClient
+    include TokenProvider
+
+    def initialize(config:, http:, jwt_validator:)
+      @config = config
+      @http = http
+      @jwt_validator = jwt_validator
+      @endpoints = OidcEndpoints.from_config(config)
+      configure_rack_oauth2_timeouts(config)
+    end
+
+    def create_authorization_request(redirect_uri:, scopes: nil, state: SecureRandom.urlsafe_base64(24), nonce: nil)
+      verifier = SecureRandom.urlsafe_base64(64)
+      challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(verifier), padding: false)
+      params = {
+        scope: (scopes || @config.scopes).join(" "),
+        state: state,
+        code_challenge: challenge,
+        code_challenge_method: :S256
+      }
+      params[:nonce] = nonce if nonce
+      url = oauth_client(redirect_uri: redirect_uri).authorization_uri(params)
+      AuthorizationRequest.new(url: url.to_s, state: state, code_verifier: verifier)
+    end
+
+    # `expected_nonce`가 주어지면(create_authorization_request가 돌려준 nonce) 응답 id_token을
+    # realm JWKS로 서명·iss·aud·exp까지 강화 검증한 뒤 nonce 클레임을 대조한다 — OIDC nonce 재생
+    # 방지. 불일치·부재·검증실패는 모두 거부(fail-closed). 생략 시 id_token 검증을 건너뛴다(무-nonce 흐름).
+    def exchange_code(code:, code_verifier:, redirect_uri:, expected_nonce: nil)
+      client = oauth_client(redirect_uri: redirect_uri)
+      client.authorization_code = code
+      token_set = to_token_set(client.access_token!(code_verifier: code_verifier))
+      verify_nonce!(token_set.id_token, expected_nonce) unless expected_nonce.nil?
+      token_set
+    rescue Rack::OAuth2::Client::Error => e
+      raise AuthError.new("authorization_code exchange failed: #{e.message}", oauth_error: e.response[:error].to_s)
+    rescue Faraday::Error => e
+      raise TransportError, "token endpoint transport error: #{e.message}"
+    end
+
+    def refresh(refresh_token:)
+      client = oauth_client
+      client.refresh_token = refresh_token
+      to_token_set(client.access_token!)
+    rescue Rack::OAuth2::Client::Error => e
+      raise AuthError.new("refresh failed: #{e.message}", oauth_error: e.response[:error].to_s)
+    rescue Faraday::Error => e
+      raise TransportError, "token endpoint transport error: #{e.message}"
+    end
+
+    def client_credentials_token
+      to_token_set(oauth_client.access_token!(scope: @config.scopes.join(" ")))
+    rescue Rack::OAuth2::Client::Error => e
+      raise AuthError.new("client-credentials failed: #{e.message}", oauth_error: e.response[:error].to_s)
+    rescue Faraday::Error => e
+      raise TransportError, "token endpoint transport error: #{e.message}"
+    end
+
+    # TokenProvider 계약(직접 사용용). admin은 캐싱 provider를 별도로 쓴다.
+    def access_token
+      client_credentials_token.access_token
+    end
+
+    def introspect(token)
+      resp = @http.post(@endpoints.introspection, {
+                          token: token, client_id: @config.client_id, client_secret: @config.client_secret
+                        })
+      raise AuthError, "introspection failed: HTTP #{resp.status}" unless resp.success?
+
+      IntrospectionResult.from_response(resp.body)
+    rescue Faraday::Error => e
+      raise TransportError, "introspection transport error: #{e.message}"
+    end
+
+    def logout(refresh_token:)
+      resp = @http.post(@endpoints.end_session, {
+                          client_id: @config.client_id, client_secret: @config.client_secret,
+                          refresh_token: refresh_token
+                        })
+      raise AuthError, "logout failed: HTTP #{resp.status}" unless resp.success?
+
+      nil
+    rescue Faraday::Error => e
+      raise TransportError, "logout transport error: #{e.message}"
+    end
+
+    def validate(token)
+      @jwt_validator.validate(token)
+    end
+
+    private
+
+    # rack-oauth2의 프로세스 전역 HTTP 타임아웃을 Config로 설정한다(require 시점 하드코딩 대신).
+    # 타임아웃은 Faraday::Connection이 아니라 그 #options(Faraday::RequestOptions)에 있다
+    # (Connection에 open_timeout=/timeout= 세터가 없어 NoMethodError — 게차 참조).
+    def configure_rack_oauth2_timeouts(config)
+      Rack::OAuth2.http_config do |conn|
+        conn.options.open_timeout = config.connect_timeout
+        conn.options.timeout = config.read_timeout
+      end
+    end
+
+    # id_token의 nonce 클레임을 대조하기 전에 강화 JwtValidator로 서명·iss·aud·exp까지 검증한다
+    # (액세스 토큰과 id_token 모두 aud=client_id이므로 검증기를 공유해도 안전 — Kotlin/.NET 동형).
+    # ⚠️ `config.expected_audience`를 설정하면 이 공유 검증기가 id_token에도 그 값을 요구한다 —
+    # 이 흐름을 쓴다면 해당 오디언스를 id_token에도 매핑해야 한다(audience 매퍼의 "Add to ID token").
+    def verify_nonce!(id_token, expected_nonce)
+      raise AuthError, "authorization_code exchange failed: missing id_token for nonce validation" if id_token.nil?
+
+      validated = @jwt_validator.validate(id_token)
+      return if validated.claims["nonce"] == expected_nonce
+
+      raise AuthError, "authorization_code exchange failed: unexpected nonce"
+    rescue TokenValidationError => e
+      raise AuthError, "authorization_code exchange failed: invalid id_token: #{e.message}"
+    end
+
+    def oauth_client(redirect_uri: nil)
+      Rack::OAuth2::Client.new(
+        identifier: @config.client_id,
+        secret: @config.client_secret,
+        authorization_endpoint: @endpoints.authorization,
+        token_endpoint: @endpoints.token,
+        redirect_uri: redirect_uri
+      )
+    end
+
+    def to_token_set(token)
+      raw = token.raw_attributes || {}
+      scope = raw[:scope] || raw["scope"]
+      TokenSet.new(
+        access_token: token.access_token,
+        token_type: "Bearer",
+        expires_in: token.expires_in,
+        refresh_token: token.refresh_token,
+        id_token: raw[:id_token] || raw["id_token"],
+        scope: scope,
+        expires_at: token.expires_in ? Time.now.to_f + token.expires_in : nil
+      )
+    end
+  end
+end

data/lib/keycloak_sdk/client.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module KeycloakSdk
+  # 통합 진입점. auth는 즉시 조립, admin은 지연 조립(전용 캐싱 TokenProvider 주입 — §4).
+  class KeycloakClient
+    attr_reader :auth
+
+    def initialize(config)
+      @config = config
+      endpoints = OidcEndpoints.from_config(config)
+      @form_http = Http.build(config) do |f|
+        f.request :url_encoded
+        f.response :json, content_type: /\bjson$/
+      end
+      @jwks_http = Http.build(config) { |f| f.response :json, content_type: /\bjson$/ }
+      jwks_store = JwksStore.new(jwks_url: endpoints.jwks, http: @jwks_http, min_refetch: config.jwks_min_refetch)
+      jwt_validator = JwtValidator.from_config(config: config, jwks_store: jwks_store)
+      @auth = AuthClient.new(config: config, http: @form_http, jwt_validator: jwt_validator)
+      @admin = nil
+      @admin_mutex = Mutex.new
+    end
+
+    def admin
+      @admin_mutex.synchronize do
+        @admin ||= Admin::AdminClient.new(
+          config: @config,
+          token_provider: ClientCredentialsTokenProvider.new(config: @config, http: @form_http)
+        )
+      end
+    end
+
+    def close
+      @admin&.close # 지연 생성된 admin의 Faraday 커넥션도 정리(§4 close 계약 — 이전엔 누락)
+      [@form_http, @jwks_http].each { |h| h.close if h.respond_to?(:close) }
+      nil
+    end
+  end
+end

data/lib/keycloak_sdk/config.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+module KeycloakSdk
+  # 불변 설정. 생성 시 검증하고 freeze한다. client_secret은 inspect에서 마스킹.
+  class Config
+    attr_reader :server_url, :realm, :client_id, :client_secret,
+                :scopes, :signature_algorithms, :connect_timeout, :read_timeout, :clock_skew,
+                :jwks_min_refetch, :expected_audience
+
+    def initialize(server_url:, realm:, client_id:, client_secret: nil,
+                   scopes: ["openid"], signature_algorithms: ["RS256"],
+                   connect_timeout: 10, read_timeout: 10, clock_skew: 30,
+                   jwks_min_refetch: 30.0, expected_audience: nil)
+      @server_url = normalize_required("server_url", server_url).sub(%r{/+\z}, "")
+      @realm = normalize_required("realm", realm)
+      @client_id = normalize_required("client_id", client_id)
+      @client_secret = client_secret
+      @scopes = Array(scopes).freeze
+      # JWT 서명 검증 허용 알고리즘 핀(기본 RS256). ES256/PS256 realm을 위해 설정 가능하되
+      # 빈 집합은 alg 핀을 무력화하므로 거부한다.
+      @signature_algorithms = non_empty_array("signature_algorithms", signature_algorithms).freeze
+      @connect_timeout = positive("connect_timeout", connect_timeout)
+      @read_timeout = positive("read_timeout", read_timeout)
+      @clock_skew = non_negative("clock_skew", clock_skew)
+      # 미해결 kid로 인한 JWKS 재조회의 최소 간격(초, 기본 10.0) — DoS 증폭 상한.
+      @jwks_min_refetch = non_negative("jwks_min_refetch", jwks_min_refetch)
+      # 토큰 aud에 들어있어야 할 값(기본 nil = client_id). 기본 realm은 client-credentials 토큰의
+      # aud에 client_id를 넣지 않으므로, realm이 실제로 발급하는 리소스/오디언스를 지정한다.
+      @expected_audience = expected_audience
+      freeze
+    end
+
+    def inspect
+      "#<KeycloakSdk::Config server_url=#{@server_url.inspect} realm=#{@realm.inspect} " \
+        "client_id=#{@client_id.inspect} client_secret=#{Masking.mask(@client_secret).inspect} " \
+        "scopes=#{@scopes.inspect}>"
+    end
+    alias to_s inspect
+
+    private
+
+    def normalize_required(name, value)
+      raise ConfigError, "#{name} is required" if value.nil?
+
+      str = value.to_s
+      raise ConfigError, "#{name} must not be blank" if str.strip.empty?
+
+      str
+    end
+
+    def positive(name, value)
+      raise ConfigError, "#{name} must be > 0" unless value.is_a?(Numeric) && value.positive?
+
+      value
+    end
+
+    def non_negative(name, value)
+      raise ConfigError, "#{name} must be >= 0" unless value.is_a?(Numeric) && value >= 0
+
+      value
+    end
+
+    def non_empty_array(name, value)
+      arr = Array(value)
+      raise ConfigError, "#{name} must be non-empty" if arr.empty?
+
+      arr
+    end
+  end
+end

data/lib/keycloak_sdk/errors.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module KeycloakSdk
+  # 모든 SDK 오류의 루트.
+  class Error < StandardError; end
+
+  # 설정 검증 실패.
+  class ConfigError < Error; end
+
+  # 인증/토큰 발급 실패(OAuth 오류 코드 보존).
+  class AuthError < Error
+    attr_reader :oauth_error
+
+    def initialize(message = nil, oauth_error: nil)
+      super(message)
+      @oauth_error = oauth_error
+    end
+  end
+
+  # 네트워크 전송 실패(타임아웃/연결거부/DNS).
+  class TransportError < Error; end
+
+  # JWT 검증 실패.
+  class TokenValidationError < Error; end
+
+  # Admin REST 오류(HTTP status 보존).
+  class AdminError < Error
+    attr_reader :status
+
+    def initialize(message = nil, status: nil)
+      super(message)
+      @status = status
+    end
+
+    # status → 적절한 하위 예외 인스턴스.
+    def self.from_status(status, message)
+      case status
+      when 404 then NotFoundError.new(message, status: status)
+      when 409 then ConflictError.new(message, status: status)
+      when 403 then ForbiddenError.new(message, status: status)
+      else AdminError.new(message, status: status)
+      end
+    end
+  end
+
+  class NotFoundError < AdminError; end
+  class ConflictError < AdminError; end
+  class ForbiddenError < AdminError; end
+end

data/lib/keycloak_sdk/http.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require "faraday"
+
+module KeycloakSdk
+  # 공유 Faraday 커넥션 팩토리. 타임아웃을 config에서 주입하고,
+  # follow_redirects 미들웨어를 절대 장착하지 않는다(SSRF 하드닝 — Faraday는 기본 미추종).
+  module Http
+    module_function
+
+    def build(config, base_url: nil)
+      Faraday.new(
+        url: base_url,
+        request: { timeout: config.read_timeout, open_timeout: config.connect_timeout }
+      ) do |f|
+        yield f if block_given?
+        f.adapter :net_http
+      end
+    end
+  end
+end

data/lib/keycloak_sdk/jwks_store.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require "faraday"
+
+module KeycloakSdk
+  # DoS-safe JWKS 스토어. Mutex 캐시 + rate-limit + single-flight.
+  # 위조 서명(알려진 kid)은 캐시 반환만 하고 재조회를 유발하지 않는다.
+  # 미해결 kid(force:true)만 재조회하며, rate-limit gate는 재조회 결정 시점에 stamp한다
+  # (성공 아님 — IdP 장애창에서 위조 kid 폭주에도 재조회를 상한한다). Go/Rust/Python 동형.
+  class JwksStore
+    def initialize(jwks_url:, http:, min_refetch: 10.0)
+      @jwks_url = jwks_url
+      @http = http
+      @min_refetch = min_refetch
+      @mutex = Mutex.new
+      @cache = nil        # {"keys" => [...]}
+      @last_refetch = nil # monotonic seconds
+    end
+
+    # ruby-jwt jwks: 로더가 호출. force=true는 미해결 kid 재조회 요청.
+    def key_set(force: false)
+      @mutex.synchronize do
+        return @cache if @cache && !force
+        return @cache if force && !refetch_allowed?
+
+        @last_refetch = monotonic if force # 결정 시점 stamp(cold load는 예산 미소모)
+        @cache = fetch
+      end
+    end
+
+    private
+
+    def refetch_allowed?
+      @last_refetch.nil? || (monotonic - @last_refetch) >= @min_refetch
+    end
+
+    def fetch
+      resp = @http.get(@jwks_url)
+      raise TransportError, "JWKS fetch failed: HTTP #{resp.status}" unless resp.success?
+
+      body = resp.body
+      raise TransportError, "JWKS response malformed" unless body.is_a?(Hash) && body["keys"].is_a?(Array)
+
+      body
+    rescue Faraday::Error => e
+      raise TransportError, "JWKS transport error: #{e.message}"
+    end
+
+    def monotonic
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+  end
+end

data/lib/keycloak_sdk/jwt_validator.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require "jwt"
+
+module KeycloakSdk
+  # 자체강화 JWT 검증기. ruby-jwt의 안전하지 않은 기본값을 전부 오버라이드한다:
+  # RS256 핀(none/confusion 구조적 거부)·iss 정확·aud 포함·exp 필수·nbf·클록스큐.
+  # 키는 DoS-safe JwksStore로 조회한다(위조 서명은 재조회 미유발). 헤더 alg는 검증 알고리즘 선택에 미사용.
+  class JwtValidator
+    def initialize(issuer:, audience:, jwks_store:, algorithms: ["RS256"], clock_skew: 30)
+      # ruby-jwt의 verify_iss/verify_aud 빌더는 값이 nil이면 조용히 no-op이 되어
+      # verify_iss:true/verify_aud:true를 켜도 검사를 건너뛴다 — fail-closed로 방어.
+      raise ConfigError, "issuer is required" if issuer.nil? || issuer.to_s.strip.empty?
+      raise ConfigError, "audience is required" if audience.nil? || audience.to_s.strip.empty?
+
+      @issuer = issuer
+      @audience = audience
+      @jwks_store = jwks_store
+      @algorithms = algorithms
+      @clock_skew = clock_skew
+    end
+
+    # 기대 aud는 config.expected_audience(설정 시) — 미설정이면 종전대로 client_id.
+    def self.from_config(config:, jwks_store:)
+      new(issuer: OidcEndpoints.from_config(config).issuer,
+          audience: config.expected_audience || config.client_id, jwks_store: jwks_store,
+          algorithms: config.signature_algorithms, clock_skew: config.clock_skew)
+    end
+
+    def validate(token)
+      payload, = JWT.decode(token, nil, true, decode_options)
+      to_validated(payload)
+    rescue JWT::DecodeError => e
+      raise TokenValidationError, "JWT validation failed: #{e.message}"
+    end
+
+    private
+
+    def decode_options
+      {
+        algorithms: @algorithms,
+        jwks: jwks_loader,
+        verify_iss: true, iss: @issuer,
+        verify_aud: true, aud: @audience,
+        verify_expiration: true,
+        verify_not_before: true,
+        required_claims: %w[exp iss aud],
+        leeway: @clock_skew
+      }
+    end
+
+    # 초기 호출 {kid:}=캐시, 미해결 시 {kid_not_found:true, invalidate:true, kid:}=재조회.
+    # JwksStore#key_set(force:)는 cold-cache 재조회가 rate-limit되면 nil을 반환할 수 있으므로
+    # 빈 key set으로 폴백한다 — ruby-jwt에 nil을 넘기면 raw NoMethodError가 나므로 반드시 가드한다.
+    def jwks_loader
+      lambda do |opts|
+        force = opts[:kid_not_found] || opts[:invalidate] || false
+        @jwks_store.key_set(force: force) || { "keys" => [] }
+      end
+    end
+
+    def to_validated(payload)
+      ValidatedToken.new(
+        subject: payload["sub"],
+        audience: Array(payload["aud"]),
+        issuer: payload["iss"],
+        expires_at: payload["exp"],
+        issued_at: payload["iat"],
+        claims: payload
+      )
+    end
+  end
+end

data/lib/keycloak_sdk/masking.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module KeycloakSdk
+  # 완전 불투명 마스킹(접두 노출 없음).
+  module Masking
+    module_function
+
+    def mask(secret)
+      secret.nil? ? nil : "***"
+    end
+  end
+end

data/lib/keycloak_sdk/oidc_endpoints.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module KeycloakSdk
+  # Keycloak realm의 OIDC 엔드포인트를 규약대로 조립한다(네트워크 없음).
+  class OidcEndpoints
+    attr_reader :issuer, :authorization, :token, :introspection, :end_session, :jwks
+
+    def initialize(server_url, realm)
+      base = "#{server_url}/realms/#{realm}"
+      oidc = "#{base}/protocol/openid-connect"
+      @issuer = base
+      @authorization = "#{oidc}/auth"
+      @token = "#{oidc}/token"
+      @introspection = "#{oidc}/token/introspect"
+      @end_session = "#{oidc}/logout"
+      @jwks = "#{oidc}/certs"
+      freeze
+    end
+
+    def self.from_config(config)
+      new(config.server_url, config.realm)
+    end
+  end
+end

data/lib/keycloak_sdk/token_provider.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+module KeycloakSdk
+  # 덕 인터페이스: 구현체는 #access_token → String 을 응답한다.
+  # admin은 이 인터페이스로만 토큰을 받는다(auth 비의존, §4 결합 규칙).
+  module TokenProvider
+  end
+
+  # client-credentials 그랜트로 토큰을 발급하고 만료 전까지 캐시한다(Mutex single-flight).
+  # admin 파사드가 소비하는 캐싱 provider(무캐시 AuthClient 직접 주입 금지 — §4 캐시 불변식).
+  class ClientCredentialsTokenProvider
+    include TokenProvider
+
+    def initialize(config:, http:)
+      @config = config
+      @http = http
+      @token_url = OidcEndpoints.from_config(config).token
+      @mutex = Mutex.new
+      @cached = nil
+      @expires_at = 0.0
+    end
+
+    def access_token
+      @mutex.synchronize do
+        now = Time.now.to_f
+        return @cached if @cached && now < @expires_at
+
+        ts = request_token
+        @cached = ts.access_token
+        @expires_at = ts.expires_at ? (ts.expires_at - @config.clock_skew) : (now + 60)
+        @cached
+      end
+    end
+
+    private
+
+    def request_token
+      resp = @http.post(@token_url, {
+                          grant_type: "client_credentials",
+                          client_id: @config.client_id,
+                          client_secret: @config.client_secret,
+                          scope: @config.scopes.join(" ")
+                        })
+      unless resp.success?
+        oauth = resp.body.is_a?(Hash) ? resp.body["error"] : nil
+        raise AuthError.new("client-credentials token request failed: HTTP #{resp.status}", oauth_error: oauth)
+      end
+
+      TokenSet.from_response(resp.body, received_at: Time.now.to_f)
+    rescue Faraday::Error => e
+      raise TransportError, "token endpoint transport error: #{e.message}"
+    end
+  end
+end

data/lib/keycloak_sdk/tokens.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module KeycloakSdk
+  # OAuth 토큰 응답의 불변 값타입. access/refresh/id 토큰은 inspect에서 마스킹.
+  TokenSet = Data.define(:access_token, :token_type, :expires_in, :refresh_token,
+                         :id_token, :scope, :expires_at) do
+    def self.from_response(body, received_at: Time.now.to_f)
+      expires_in = body["expires_in"] && Integer(body["expires_in"])
+      new(
+        access_token: body["access_token"],
+        token_type: body["token_type"],
+        expires_in: expires_in,
+        refresh_token: body["refresh_token"],
+        id_token: body["id_token"],
+        scope: body["scope"],
+        expires_at: expires_in ? received_at + expires_in : nil
+      )
+    end
+
+    def expired?(skew: 0, now: Time.now.to_f)
+      return false if expires_at.nil?
+
+      now >= (expires_at - skew)
+    end
+
+    def inspect
+      "#<KeycloakSdk::TokenSet access_token=\"***\" token_type=#{token_type.inspect} " \
+        "expires_in=#{expires_in.inspect} refresh_token=#{refresh_token ? '"***"' : 'nil'} " \
+        "id_token=#{id_token ? '"***"' : 'nil'} scope=#{scope.inspect} expires_at=#{expires_at.inspect}>"
+    end
+    alias_method :to_s, :inspect
+  end
+
+  # 검증된 access token의 관심 클레임.
+  ValidatedToken = Data.define(:subject, :audience, :issuer, :expires_at, :issued_at, :claims)
+
+  # RFC 7662 introspection 결과.
+  IntrospectionResult = Data.define(:active, :username, :client_id, :claims) do
+    def self.from_response(body)
+      new(active: body["active"] == true, username: body["username"],
+          client_id: body["client_id"], claims: body)
+    end
+
+    def active?
+      active == true
+    end
+  end
+
+  # authorization-code 흐름 시작 값(PKCE code_verifier 포함·inspect 마스킹).
+  AuthorizationRequest = Data.define(:url, :state, :code_verifier) do
+    def inspect
+      "#<KeycloakSdk::AuthorizationRequest url=#{url.inspect} state=#{state.inspect} code_verifier=\"***\">"
+    end
+    alias_method :to_s, :inspect
+  end
+end

data/lib/keycloak_sdk/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module KeycloakSdk
+  VERSION = "0.1.0.rc1"
+end

data/lib/keycloak_sdk.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require_relative "keycloak_sdk/version"
+require_relative "keycloak_sdk/masking"
+require_relative "keycloak_sdk/errors"
+require_relative "keycloak_sdk/config"
+require_relative "keycloak_sdk/tokens"
+require_relative "keycloak_sdk/oidc_endpoints"
+require_relative "keycloak_sdk/http"
+require_relative "keycloak_sdk/token_provider"
+require_relative "keycloak_sdk/jwks_store"
+require_relative "keycloak_sdk/jwt_validator"
+require_relative "keycloak_sdk/auth_client"
+require_relative "keycloak_sdk/admin/call"
+require_relative "keycloak_sdk/admin/bearer_auth"
+require_relative "keycloak_sdk/admin/users"
+require_relative "keycloak_sdk/admin/clients"
+require_relative "keycloak_sdk/admin/realms"
+require_relative "keycloak_sdk/admin/roles"
+require_relative "keycloak_sdk/admin/groups"
+require_relative "keycloak_sdk/admin/admin_client"
+require_relative "keycloak_sdk/client"
+
+# Polyglot Keycloak SDK for Ruby.
+module KeycloakSdk
+end
+
+# ⚠️ rack-oauth2 HTTP 타임아웃은 프로세스 전역(Rack::OAuth2.http_config)이라 per-client 미세제어가
+# 불가하다. 과거엔 require 시점에 하드코딩 10초로 박아 (a) 단순 require만으로 전역 상태를 변조하고
+# (b) Config 타임아웃을 무시했다. 이제는 AuthClient#initialize에서 Config의 connect/read 타임아웃으로
+# 설정한다(auth_client.rb) — require 부작용 제거 + config 반영. 전역이라는 근본 한계는 남지만
+# "SDK auth를 실제로 쓸 때"로 스코프가 좁혀진다(require 시점 아님).
+require "rack/oauth2"