kinde_sdk 1.2.3 → 1.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1553814bbc9fcac3dc85f89b46680f81626d6a86771f900fae97fabe5bfb12e6
-  data.tar.gz: a6e89557f44e9483cc9d96e6ec97bcdf402d4995df2e0653ddb11be054913542
+  metadata.gz: 535ff46d086ced73b9c96057f1cdf7bd582cede497aa3d299ff6cef98d7d3259
+  data.tar.gz: 8ae57192d2f173ef0a84902832aadb63a7b81ff8a4a4603da7061b30c4f58bde
 SHA512:
-  metadata.gz: e1110fef072979b2a720c84a468943bccef437dd477d39764b9fae8a85f78680365b40f640535bcdb37aee19652de5761dfc8a5093d6df425130754344809649
-  data.tar.gz: 3d36f72b26a3616967b19c31ac36ed465ae7bc515ef88207bf472ac621704b572de6200ebc0230580a7668b7eca9cf2923b35ef146f69843ea57f44ca6b55832
+  metadata.gz: 7abe77f02ae645e9841037d3c8fdc7a7edc28e3f7d9a1e625d7c687f751b4e16ea86a0af7e96629e7043542ce92434de4eb9868eeba4c4ca51743d0568f3ab39
+  data.tar.gz: f98f1dd0411cd3cff285e1c7a1475a749f6d5ba1c9aa75077c6e25ba0a171e173a2308792d5ceafd7b330cb7aee904957f2a4dbbdbbca178fe76a65b77aa4a7b

data/app/assets/stylesheets/kinde/ruby/sdk/application.css

@@ -0,0 +1,15 @@
+/*
+ * This is a manifest file that'll be compiled into application.css, which will include all the files
+ * listed below.
+ *
+ * Any CSS and SCSS file within this directory, lib/assets/stylesheets, vendor/assets/stylesheets,
+ * or any plugin's vendor/assets/stylesheets directory can be referenced here using a relative path.
+ *
+ * You're free to add application-wide styles to this file and they'll appear at the bottom of the
+ * compiled file so the styles you add here take precedence over styles defined in any other CSS/SCSS
+ * files in this directory. Styles in this file should be added after the last require_* statement.
+ * It is generally better to create a new file per style scope.
+ *
+ *= require_tree .
+ *= require_self
+ */

data/app/controllers/kinde_sdk/auth_controller.rb

@@ -0,0 +1,301 @@
+require 'action_controller'
+require 'uri'
+require 'cgi'
+require 'net/http'
+require 'json'
+require 'jwt'
+
+module KindeSdk
+  # AuthController handles all authentication-related actions for the Kinde SDK
+  # including OAuth2 flows, token management, and session handling
+  class AuthController < ActionController::Base
+    include AuthHelper
+    
+    before_action :validate_state, only: :callback
+    before_action :clear_auth_session, only: [:logout_callback, :logout]
+  
+    # Initiates the OAuth2 authorization flow
+    # Generates a secure nonce and redirects to Kinde's authorization endpoint
+    # @return [void] Redirects to Kinde's authorization URL
+    def auth
+      # Generate a secure random nonce for CSRF protection
+      nonce = SecureRandom.urlsafe_base64(16)
+      
+      # Get authorization URL and PKCE code verifier from SDK
+      auth_data = KindeSdk.auth_url(nonce: nonce)
+      
+      # Store PKCE code verifier and nonce in session for validation
+      session[:code_verifier] = auth_data[:code_verifier] if auth_data[:code_verifier].present?
+      session[:auth_nonce] = nonce
+      session[:auth_state] = {
+        requested_at: Time.current.to_i,
+        redirect_url: auth_data[:url],
+        # Only allow reauth-leniency when reauth_state was provided
+        supports_reauth: params[:reauth_state].present?
+      }
+      
+      redirect_to auth_data[:url], allow_other_host: true
+    rescue StandardError => e
+      handle_error("Auth initialization failed", e)
+    end
+  
+    # Handles the OAuth2 callback from Kinde
+    # Validates the response, exchanges code for tokens, and sets up the session
+    # @return [void] Redirects to root path on success
+    def callback
+      # Handle reauth errors first
+      if handle_reauth_error
+        return
+      end
+
+      tokens = fetch_and_validate_tokens
+      return if performed?
+
+      # Store tokens and user information in session
+      set_session_tokens(tokens)
+      
+      # Clean up temporary auth session data
+      clear_auth_session
+      
+      redirect_to "/"
+    rescue StandardError => e
+      handle_error("Authentication callback failed", e)
+    end
+  
+    # Handles machine-to-machine (M2M) authentication using client credentials
+    # Stores the access token in Redis for subsequent API calls
+    # @return [void] Redirects to management path on success
+    def client_credentials_auth
+      result = KindeSdk.client_credentials_access(
+        client_id: ENV["KINDE_MANAGEMENT_CLIENT_ID"],
+        client_secret: ENV["KINDE_MANAGEMENT_CLIENT_SECRET"]
+      )
+  
+      if result["error"].present?
+        raise result["error"]
+      end
+  
+      # Store M2M token in Redis with expiration
+      $redis.set("kinde_m2m_token", result["access_token"], ex: result["expires_in"].to_i)
+      redirect_to mgmt_path
+    rescue StandardError => e
+      handle_error("Client credentials authentication failed", e)
+    end
+
+    # Refreshes the access token using the refresh token
+    # @return [void] Redirects to root path on success
+    def refresh_token
+      return redirect_with_error("No valid session found") unless session[:kinde_token_store].present?
+
+      if refresh_session_tokens
+        redirect_to "/"
+      else
+        redirect_with_error("Failed to refresh token")
+      end
+    rescue StandardError => e
+      handle_error("Token refresh failed", e)
+    end
+  
+    # Initiates the logout process by redirecting to Kinde's logout endpoint
+    # @return [void] Redirects to Kinde's logout URL
+    def logout
+      # Ensure we have a valid logout URL configured
+      unless KindeSdk.config.logout_url.present?
+        redirect_with_error("Logout URL not configured")
+        return
+      end
+
+      # Get the logout URL with our callback URL
+      logout_url = KindeSdk.logout_url(
+        logout_url: KindeSdk.config.logout_url,
+        domain: KindeSdk.config.domain
+      )
+
+      # Clear local session before redirecting to Kinde
+      session.delete(:kinde_token_store)
+      session.delete(:kinde_user)
+      clear_auth_session
+
+      # Redirect to Kinde's logout endpoint
+      redirect_to logout_url, allow_other_host: true
+    rescue StandardError => e
+      handle_error("Logout initialization failed", e)
+    end
+  
+    # Handles the callback after successful logout
+    # @return [void] Redirects to root path
+    def logout_callback
+      # Session is already cleared in logout method
+      # Just redirect to home page
+      redirect_to "/"
+    end
+  
+    private
+
+    def handle_reauth_error
+      error_param = params[:error]
+      return false unless error_param.present?
+      
+      if error_param.downcase == "login_link_expired"
+        handle_expired_login_link
+      else
+        Rails.logger.warn("OAuth error received: #{error_param}")
+      end
+      
+      true
+    end
+
+    def handle_expired_login_link
+      reauth_state = params[:reauth_state]
+      return unless reauth_state.present?
+      
+      begin
+        decoded_auth_state = Base64.decode64(reauth_state)
+        reauth_data = JSON.parse(decoded_auth_state)
+        
+        if reauth_data.present?
+          redirect_to build_reauth_url(reauth_data), allow_other_host: true
+        end
+      rescue ArgumentError => e
+        handle_error("Invalid reauth state encoding", e)
+      rescue JSON::ParserError => e
+        handle_error("Invalid reauth state format", e)
+      end
+    end
+
+    def build_reauth_url(reauth_data)
+      auth_url = "#{request.base_url}#{KindeSdk::Engine.routes.url_helpers.auth_path}"
+      query_string = URI.encode_www_form(reauth_data)
+      "#{auth_url}?#{query_string}"
+    end
+
+    # Fetches and validates tokens from the authorization code
+    # @return [Hash] The validated tokens or nil if validation fails
+    def fetch_and_validate_tokens
+      begin
+        tokens = KindeSdk.fetch_tokens(
+          params[:code],
+          code_verifier: KindeSdk.config.pkce_enabled ? session[:code_verifier] : nil,
+          redirect_uri: KindeSdk.config.callback_url
+        )
+      rescue StandardError => e
+        # Handle PKCE-related errors that might occur during token fetch
+        if e.message.include?("PKCE code verifier") || e.message.include?("invalid_grant")
+          # This could be a reauth scenario where session data was lost
+          # Redirect back to auth to start fresh
+          Rails.logger.warn("PKCE/token issue detected (#{e.message}), redirecting to re-authenticate")
+          redirect_to "#{request.base_url}#{KindeSdk::Engine.routes.url_helpers.auth_path}"
+          return nil
+        end
+        
+        # Re-raise other errors
+        raise e
+      end
+
+      if tokens[:error].present?
+        redirect_with_error("Token exchange failed: #{tokens[:error]}")
+        return nil
+      end
+
+      # Validate tokens using SDK's built-in validation
+      begin
+        KindeSdk.validate_jwt_token(tokens)
+        
+        # Validate nonce in ID token to prevent replay attacks
+        # Skip nonce validation if no session nonce (could be reauth scenario)
+        if session[:auth_nonce].present?
+          decoded_token = JWT.decode(tokens[:id_token], nil, false)[0]
+          unless decoded_token['nonce'] == session[:auth_nonce]
+            redirect_with_error("Invalid authentication nonce")
+            return nil
+          end
+        else
+          Rails.logger.warn("Skipping nonce validation - no session nonce found (possible reauth scenario)")
+        end
+
+        tokens
+      rescue JWT::DecodeError => e
+        redirect_with_error("Token validation failed: #{e.message}")
+        nil
+      end
+    end
+
+    # Clears temporary authentication data from the session
+    # @return [void]
+    def clear_auth_session
+      session.delete(:auth_nonce)
+      session.delete(:auth_state)
+      session.delete(:code_verifier)
+    end
+  
+    # Validates the state parameter to prevent CSRF attacks
+    # Checks state existence, matches returned state with stored state, and validates expiration
+    # @return [void]
+    def validate_state
+      
+      error_param = params[:error]
+      if error_param.present?
+        if error_param.downcase == "login_link_expired"
+          return
+        end
+      end
+      # Check if nonce and state exist in session
+      unless session[:auth_state]
+        # If no session state but we have a code, check if this could be a reauth scenario
+        # In reauth scenarios, the session might be lost but we still have a valid OAuth code
+        if params[:code].present?
+          # Skip validation for potential reauth scenarios where session state is lost
+          return
+        end
+        
+        redirect_with_error("Invalid authentication state")
+        return
+      end
+
+      # If this auth flow supports reauth, be more lenient with validation
+      if session[:auth_state]["supports_reauth"]
+        # Only skip when both code _and_ state are supplied
+        return if params[:code].present? && params[:state].present?
+      end
+
+      # Normal state validation for non-reauth flows
+      returned_state = params[:state]
+      stored_state = session[:auth_state]
+      stored_url = stored_state["redirect_url"]
+
+      # Extract the state from the stored redirect_url
+      parsed_url = URI.parse(stored_url)
+      query_params = CGI.parse(parsed_url.query || "")
+      stored_state_from_url = query_params["state"]&.first
+
+      # Verify returned state matches the state extracted from the redirect_url
+      unless returned_state.present? && returned_state == stored_state_from_url
+        redirect_with_error("Invalid authentication state")
+        return
+      end
+
+      # Check state age (expires after 15 minutes)
+      if Time.current.to_i - stored_state["requested_at"] > 900
+        redirect_with_error("Authentication session expired")
+        return
+      end
+    end
+
+    # Handles errors during authentication
+    # @param message [String] The error message
+    # @param error [Exception] The exception that occurred
+    # @return [void]
+    def handle_error(message, error)
+      Rails.logger.error("Error: #{error.message}")
+      redirect_with_error(message)
+    end
+
+    # Redirects to root path with an error message
+    # @param message [String] The error message
+    # @return [void]
+    def redirect_with_error(message)
+      Rails.logger.error("Redirecting with error: #{message}")
+      redirect_to "/", alert: message
+    end
+  end
+end

data/app/helpers/auth_helper.rb

@@ -0,0 +1,88 @@
+module AuthHelper
+  # Sets up session tokens and user information after successful authentication
+  # @param tokens [Hash] The authentication tokens received from Kinde
+  # @return [void]
+  def set_session_tokens(tokens)
+    # Create token store from tokens
+    token_store = KindeSdk::TokenManager.create_store(tokens)
+    
+    # Store minimal token data in session
+    session[:kinde_token_store] = {
+      access_token: token_store.bearer_token,
+      refresh_token: token_store.tokens[:refresh_token],
+      expires_at: token_store.expires_at
+    }
+    
+    # Get and store minimal user info
+    client = KindeSdk.client(tokens)
+    user_info = client.oauth.get_user_profile_v2.to_hash
+    
+    # Validate user info before storing
+    raise ArgumentError, "Invalid user info received" unless user_info[:id].present?
+    
+    session[:kinde_user] = {
+      id: user_info[:id],
+      email: user_info[:email],
+      first_name: user_info[:given_name],
+      last_name: user_info[:family_name]
+    }
+  end
+  
+  # Checks if the user is currently logged in
+  # @return [Boolean] true if the user is logged in and token is valid
+  def logged_in?
+    !token_expired?
+  end
+
+  # Checks if the session contains token data
+  # @return [Boolean] true if session contains token data
+  def session_present_in?
+    session[:kinde_token_store].present?
+  end
+
+  # Checks if the current token has expired
+  # @return [Boolean] true if token is expired or invalid
+  def token_expired?
+    return true unless session[:kinde_token_store].present?
+    
+    client = get_client
+    return true unless client
+    
+    client.token_expired?
+  rescue JWT::DecodeError => e
+    Rails.logger.error("JWT decode error: #{e.message}")
+    true
+  rescue StandardError => e
+    Rails.logger.error("Error checking token expiration: #{e.message}")
+    true
+  end
+
+  # Attempts to refresh the session tokens
+  # @return [Boolean] true if refresh was successful
+  def refresh_session_tokens
+    return false unless session[:kinde_token_store].present?
+    
+    # Create token store from session data
+    token_store = KindeSdk::TokenStore.new(session[:kinde_token_store])
+    
+    # Attempt to refresh tokens
+    new_tokens = KindeSdk::TokenManager.refresh_tokens(token_store, session)
+    if new_tokens
+      set_session_tokens(new_tokens)
+      true
+    else
+      false
+    end
+  rescue StandardError => e
+    Rails.logger.error("Error refreshing tokens: #{e.message}")
+    session.delete(:kinde_token_store)
+    false
+  end
+
+  # Gets a Kinde client instance for the current session
+  # @return [KindeSdk::Client, nil] The client instance or nil if no valid session
+  def get_client
+    return nil unless session[:kinde_token_store].present?
+    KindeSdk.client(session[:kinde_token_store])
+  end
+end

data/config/routes.rb

@@ -0,0 +1,9 @@
+KindeSdk::Engine.routes.draw do
+    # Authentication routes
+    get "auth" => "auth#auth"
+    get "callback" => "auth#callback"
+    get "logout" => "auth#logout"
+    get "logout_callback" => "auth#logout_callback"
+    get "refresh_token" => "auth#refresh_token"
+    get "client_credentials_auth" => "auth#client_credentials_auth"
+end

data/kinde_api/Gemfile

@@ -0,0 +1,9 @@
+source 'https://rubygems.org'
+
+gemspec
+
+group :development, :test do
+  gem 'rake', '~> 13.0.1'
+  gem 'pry-byebug'
+  gem 'rubocop', '~> 0.66.0'
+end