keypairs 0.1.0 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1d5f2f484253f46b38eb0c4ee8a71e77bec208ac0aeca8a5909f20389b8de9a9
-  data.tar.gz: bb148cb660872ca14d8ba9c3416fccff38efeac97619f581b5019f2f76b83157
+  metadata.gz: b147b6ede46b3ddb570fcf22a695d6cf4cb1b9d1ccba3f5b7f8afdd9419e0747
+  data.tar.gz: ebe56e66f398850c478b73ec5ee7cab7ff37ed660df886b5e01d43f2f154bf4e
 SHA512:
-  metadata.gz: 6b0baa0b7ad99ed238cbd7021f81fe53a40abfc720e0a1b95bc8c83f23680b15aac0c19f551f3f4c19821423a29dc2a2e48c41e68a0af3da9e9442c094784920
-  data.tar.gz: 53160f8c12ff02c7b3143f771b7890a50e4ad1014f6c1b1c5ec6b3d97486477b831fefa5a3b3654daeb0617ae09dcdb5494cba0465850823023abe68de8a133b
+  metadata.gz: 7a8c50b775aeb0786f43489f1ddc9fc9196071ce7f87d36fff7db7bc9eba63b08ea3b5c1ef97798904b3205bc3e7f9b511fed322e84227a98a5712cd863be797
+  data.tar.gz: b0b30cc23347d5a4c0d0add46ac6944cb1881a75aebd2577db470742e81b72613b6808bd63d36385897e4a304c328adbafe7ef196cb495fdab919defc1626410

data/db/migrate/20201116144600_add_validity_to_keypairs.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+class AddValidityToKeypairs < ActiveRecord::Migration[6.0]
+  class Keypair < ActiveRecord::Base; end
+
+  def change # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+    change_table :keypairs, bulk: true do |t|
+      t.datetime :not_before, precision: 6
+      t.datetime :not_after, precision: 6
+      t.datetime :expires_at, precision: 6
+    end
+
+    reversible do |dir|
+      dir.up do
+        Keypair.find_each do |keypair|
+          keypair.update!(
+            not_before: keypair.created_at,
+            not_after: keypair.created_at + 1.month,
+            expires_at: keypair.created_at + 2.months
+          )
+        end
+      end
+    end
+
+    change_column_null :keypairs, :not_before, false
+    change_column_null :keypairs, :not_after, false
+    change_column_null :keypairs, :expires_at, false
+  end
+end

data/lib/keypair.rb

@@ -6,8 +6,18 @@ require 'jwt'
 # This class contains functionality needed for signing messages
 # and publishing JWK[s].
 #
-# The last three created keypairs are considered valid, so creating a new Keypair
-# will invalidate the second to last created Keypair.
+# Keypairs are considered valid based on their {#not_before}, {#not_after} and {#expires_at} attributes.
+#
+# A keypair can be used for signing if:
+# - The current time is greater than or equal to {#not_before}
+# - The current time is less than or equal to {#not_after}
+#
+# A keypair can be used for validation if:
+# - The current time is less than {#expires_at}.
+#
+# By default, this means that when a key is created, it can be used for signing for 1 month and can still be used
+# for signature validation 1 month after it is not used for signing (i.e. for 2 months since it started being used
+# for signing).
 #
 # If you need to sign messages, use the {Keypair.current} keypair for this. This method
 # performs the rotation of the keypairs if required.
@@ -21,6 +31,9 @@ require 'jwt'
 #   decoded = Keypair.jwt_decode(id_token)
 #
 # @attr [String] jwk_kid The public external id of the key used to find the associated key on decoding.
+# @attr [Time] not_before The time before which no payloads may be signed using the keypair.
+# @attr [Time] not_after The time after which no payloads may be signed using the keypair.
+# @attr [Time] expires_at The time after which the keypair may not be used for signature validation.
 class Keypair < ActiveRecord::Base
   ALGORITHM = 'RS256'
   ROTATION_INTERVAL = 1.month
@@ -29,18 +42,22 @@ class Keypair < ActiveRecord::Base
 
   validates :_keypair, presence: true
   validates :jwk_kid, presence: true
+  validates :not_before, :expires_at, presence: true
+
+  validate :not_after_after_not_before
+  validate :expires_at_after_not_after
 
   after_initialize :set_keypair
+  after_initialize :set_validity
 
   # @!method valid
   #   @!scope class
-  #   The last 3 keypairs are considered valid and can be used to validate signatures and export public jwks.
-  #   It uses a subquery to make sure a +find_by+ actually searches only the valid 3 ones.
-  scope :valid, -> { where(id: unscoped.order(created_at: :desc).limit(3)) }
+  #   Non-expired keypairs are considered valid and can be used to validate signatures and export public jwks.
+  scope :valid, -> { where(arel_table[:expires_at].gt(Time.zone.now)) }
 
-  # @return [Keypair] the keypair used to sign messages and autorotates if it is older than 1 month.
+  # @return [Keypair] the keypair used to sign messages and autorotates if it has expired.
   def self.current
-    order(:created_at).where(arel_table[:created_at].gt(1.month.ago)).last || create!
+    order(not_before: :asc).where(arel_table[:not_before].lteq(Time.zone.now)).where(arel_table[:not_after].gteq(Time.zone.now)).last || create!
   end
 
   # The JWK Set of our valid keypairs.
@@ -66,11 +83,26 @@ class Keypair < ActiveRecord::Base
   #
   # @see https://www.imsglobal.org/spec/security/v1p0/#h_key-set-url
   def self.keyset
+    valid_keys = valid.order(expires_at: :asc).to_a
+    # If we don't have any keys or if we don't have a future key (i.e. the last key is the current key)
+    if valid_keys.last.nil? || valid_keys.last.not_before <= Time.zone.now
+      # There is an automatic fallback to Time.zone.now if not_before is not set
+      valid_keys << create!(not_before: valid_keys.last&.not_after)
+    end
+
     {
-      keys: valid.order(created_at: :desc).map(&:public_jwk_export)
+      keys: valid_keys.map(&:public_jwk_export)
     }
   end
 
+  # @return [Hash] a cached version of the keyset
+  # @see #keyset
+  def self.cached_keyset
+    Rails.cache.fetch('keypairs/Keypair/keyset', expires_in: 12.hours) do
+      keyset
+    end
+  end
+
   # Encodes the payload with the current keypair.
   # It forewards the call to the instance method {Keypair#jwt_encode}.
   # @return [String] Encoded JWT token with security credentials.
@@ -173,4 +205,25 @@ class Keypair < ActiveRecord::Base
     self._keypair ||= OpenSSL::PKey::RSA.new(2048).to_pem
     self.jwk_kid = public_jwk.kid
   end
+
+  # Set the validity timestamps based on the rotation interval.
+  def set_validity
+    self.not_before ||= created_at || Time.zone.now
+    self.not_after ||= not_before + ROTATION_INTERVAL
+    self.expires_at ||= not_after + ROTATION_INTERVAL
+  end
+
+  def not_after_after_not_before
+    return if not_before.nil? || not_after.nil?
+    return if not_after > not_before
+
+    errors.add(:not_after, 'must be after not before')
+  end
+
+  def expires_at_after_not_after
+    return if not_after.nil? || expires_at.nil?
+    return if expires_at > not_after
+
+    errors.add(:expires_at, 'must be after not after')
+  end
 end

data/lib/keypairs.rb

@@ -4,6 +4,7 @@ require 'lockbox'
 
 autoload :Keypair, 'keypair.rb'
 
+# The Keypairs module contains common functionality in support of the {Keypair} model.
 module Keypairs
   autoload :PublicKeysController, 'keypairs/public_keys_controller'
 end

data/lib/keypairs/public_keys_controller.rb

@@ -18,7 +18,9 @@ module Keypairs
   #  }
   class PublicKeysController < ActionController::API
     def index
-      render json: Keypair.keyset
+      # Always cache for 1 week, our rotation interval is much more than a week
+      expires_in 1.week, public: true
+      render json: Keypair.cached_keyset
     end
   end
 end

data/lib/keypairs/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Keypairs
-  VERSION = '0.1.0'
+  VERSION = '1.0.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: keypairs
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 1.0.0
 platform: ruby
 authors:
 - Stef Schenkelaars
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-10-28 00:00:00.000000000 Z
+date: 2020-11-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionpack
@@ -206,6 +206,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: timecop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Manage application level keypairs with automatic rotation and JWT support
 email:
 - stef.schenkelaars@gmail.com
@@ -216,6 +230,7 @@ files:
 - LICENSE
 - README.md
 - db/migrate/20201024100500_create_keypairs.rb
+- db/migrate/20201116144600_add_validity_to_keypairs.rb
 - lib/keypair.rb
 - lib/keypairs.rb
 - lib/keypairs/engine.rb