kinde_sdk 1.2.3 → 1.7.0

data/lib/kinde_sdk/token_manager.rb

@@ -0,0 +1,85 @@
+module KindeSdk
+  class TokenManager
+    attr_reader :tokens, :bearer_token, :expires_at
+
+    def initialize(tokens = nil)
+      set_tokens(tokens) if tokens
+    end
+
+    def set_tokens(tokens)
+      @tokens = tokens.transform_keys(&:to_sym).freeze
+      @bearer_token = @tokens[:access_token]
+      @expires_at = @tokens[:expires_at]
+      @tokens
+    end
+
+    def token_expired?
+      return true unless @tokens.present?
+      begin
+        KindeSdk.validate_jwt_token(@tokens)
+        @expires_at.to_i > 0 && (@expires_at <= Time.now.to_i)
+      rescue Exception => e
+        Rails.logger.error("Error checking token expiration: #{e.message}")
+        true
+      end
+    end
+
+    def clear_tokens
+      @tokens = nil
+      @bearer_token = nil
+      @expires_at = nil
+    end
+
+    class << self
+      def create_store(tokens = nil)
+        TokenStore.new(tokens)
+      end
+
+      def refresh_tokens(store, session = nil)
+        return nil unless store&.tokens
+        new_tokens = safe_refresh(store.tokens)
+        return nil unless new_tokens
+        store.set_tokens(new_tokens)
+        sync_session(store, session)
+        new_tokens
+      end
+
+      def validate_tokens(store)
+        return false unless store&.tokens
+        begin
+          KindeSdk.validate_jwt_token(store.tokens)
+          true
+        rescue JWT::DecodeError, StandardError
+          false
+        end
+      end
+
+      def token_expired?(store)
+        return true unless store&.tokens
+        return true unless validate_tokens(store)
+        store.expires_at.to_i > 0 && (store.expires_at <= Time.now.to_i)
+      end
+
+      def clear_tokens(store, session = nil)
+        store.set_tokens(nil)
+        target_session = session || Current.session
+        target_session&.delete(:kinde_token_store)
+      end
+
+      private
+
+      def safe_refresh(tokens)
+        KindeSdk.refresh_token(tokens)
+      rescue StandardError => e
+        Rails.logger.error("Token refresh failed: #{e.message}")
+        nil
+      end
+
+      def sync_session(store, session)
+        return unless (session || Current.session) && store.tokens
+        target_session = session || Current.session
+        target_session[:kinde_token_store] = store.to_session
+      end
+    end
+  end
+end 

data/lib/kinde_sdk/token_store.rb

@@ -0,0 +1,29 @@
+module KindeSdk
+  class TokenStore
+    attr_reader :tokens, :bearer_token, :expires_at
+
+    def initialize(tokens = nil)
+      set_tokens(tokens) if tokens
+    end
+
+    def set_tokens(tokens)
+      @tokens = (tokens || {}).transform_keys(&:to_sym)
+      @bearer_token = @tokens[:access_token]
+      @expires_at = @tokens[:expires_at]
+      @tokens
+    end
+
+    def to_session
+      {
+        access_token: @bearer_token,
+        refresh_token: @tokens[:refresh_token],
+        expires_at: @expires_at
+      }
+    end
+
+    def self.from_session(session_data)
+      return nil unless session_data
+      new(session_data)
+    end
+  end
+end 

data/lib/kinde_sdk/version.rb

@@ -1,3 +1,3 @@
 module KindeSdk
-  VERSION = "1.2.3"
+  VERSION = "1.7.0"
 end

data/lib/kinde_sdk.rb

@@ -1,19 +1,35 @@
+require "logger"
+require "rails"
 require "kinde_sdk/version"
 require "kinde_sdk/configuration"
 require "kinde_sdk/client/feature_flags"
 require "kinde_sdk/client/permissions"
 require "kinde_sdk/client"
-
+require "kinde_sdk/current"
+require "kinde_sdk/errors"
 require 'securerandom'
 require 'oauth2'
 require 'pkce_challenge'
 require 'faraday/follow_redirects'
 require 'uri'
+require 'httparty'
+require 'jwt'
+require 'openssl'
+require 'base64'
+
+
 
 module KindeSdk
+
+
+  
   class << self
     attr_accessor :config
 
+    if defined?(Rails)
+      require "kinde_sdk/engine"
+    end
+
     def configure
       if block_given?
         yield(Configuration.default)
@@ -27,18 +43,34 @@ module KindeSdk
     # receive url for authorization in Kinde itself
     #
     # @return [Hash]
-    def auth_url(redirect_uri: @config.callback_url, **kwargs)
+    def auth_url(
+      client_id: @config.client_id,
+      client_secret: @config.client_secret,
+      domain: @config.domain,
+      redirect_uri: @config.callback_url,
+       **kwargs)
       params = {
         redirect_uri: redirect_uri,
         state: SecureRandom.hex,
-        scope: @config.scope
+        scope: @config.scope,
+        supports_reauth: "true"
       }.merge(**kwargs)
-      return { url: @config.oauth_client.auth_code.authorize_url(params) } unless @config.pkce_enabled
+      return { url: @config.oauth_client(
+        client_id: client_id,
+        client_secret: client_secret,
+        domain: domain,
+        authorize_url: "#{domain}/oauth2/auth",
+        token_url: "#{domain}/oauth2/token").auth_code.authorize_url(params) } unless @config.pkce_enabled
 
       pkce_challenge = PkceChallenge.challenge(char_length: 128)
       params.merge!(code_challenge_method: 'S256', code_challenge: pkce_challenge.code_challenge)
       {
-        url: @config.oauth_client.auth_code.authorize_url(params),
+        url: @config.oauth_client(
+          client_id: client_id,
+          client_secret: client_secret,
+          domain: domain,
+          authorize_url: "#{domain}/oauth2/auth",
+          token_url: "#{domain}/oauth2/token").auth_code.authorize_url(params),
         code_verifier: pkce_challenge.code_verifier
       }
     end
@@ -46,14 +78,34 @@ module KindeSdk
     # when callback processor receives code, it needs to be used for fetching bearer token
     #
     # @return [Hash]
-    def fetch_tokens(params_or_code, code_verifier: nil, redirect_uri: @config.callback_url)
-      code = params_or_code.kind_of?(Hash) ? params.fetch("code") : params_or_code
+    def fetch_tokens(
+      params_or_code, 
+      client_id: @config.client_id,
+      client_secret: @config.client_secret,
+      domain: @config.domain,
+      code_verifier: nil,
+      redirect_uri: @config.callback_url)
+      code = params_or_code.kind_of?(Hash) ? params_or_code.fetch("code") : params_or_code
       params = {
         redirect_uri: redirect_uri,
         headers: { 'User-Agent' => "Kinde-SDK: Ruby/#{KindeSdk::VERSION}" }
       }
       params[:code_verifier] = code_verifier if code_verifier
-      @config.oauth_client.auth_code.get_token(code.to_s, params).to_hash
+      token = @config.oauth_client(
+        client_id: client_id,
+        client_secret: client_secret,
+        domain: domain,
+        authorize_url: "#{domain}/oauth2/auth",
+        token_url: "#{domain}/oauth2/token").auth_code.get_token(code.to_s, params)
+
+      {
+        access_token: token.token,           # The access token
+        id_token: token.params['id_token'],  # The ID token from params
+        expires_at: token.expires_at,        # Optional: expiration time
+        refresh_token: token.refresh_token,   # Optional: if present
+        scope: token.params['scope'],        # The scopes requested
+        token_type: token.params['token_type'] # The token type
+      }.compact
     end
 
     # tokens_hash #=>
@@ -65,58 +117,100 @@ module KindeSdk
     #  "token_type"=>"bearer"}
     #
     # @return [KindeSdk::Client]
-    def client(tokens_hash)
-      sdk_api_client = api_client(tokens_hash["access_token"])
-      KindeSdk::Client.new(sdk_api_client, tokens_hash, @config.auto_refresh_tokens)
+    def client(tokens_hash, auto_refresh_tokens = @config.auto_refresh_tokens, force_api = @config.force_api)
+      sdk_api_client = api_client(tokens_hash[:access_token] || tokens_hash["access_token"])
+      KindeSdk::Client.new(sdk_api_client, tokens_hash, auto_refresh_tokens, force_api)
     end
 
-    def logout_url
-      query = @config.logout_url ? URI.encode_www_form(redirect: @config.logout_url) : nil
-      host = URI::parse(@config.domain).host
+    def logout_url(logout_url: @config.logout_url, domain: @config.domain)
+      query = logout_url ? URI.encode_www_form(redirect: logout_url) : nil
+      host = URI::parse(domain).host
       URI::HTTP.build(host: host, path: '/logout', query: query).to_s
     end
 
     def client_credentials_access(
       client_id: @config.client_id,
       client_secret: @config.client_secret,
-      audience: "#{@config.domain}/api"
+      audience: "#{@config.domain}/api",
+      domain: @config.domain
     )
-      Faraday.new(url: @config.domain) do |faraday|
+      Faraday.new(url: domain) do |faraday|
         faraday.response :json
         faraday.use Faraday::FollowRedirects::Middleware
       end
-        .post(@config.token_url) do |req|
+        .post("#{domain}/oauth2/token") do |req|
         req.headers[:content_type] = 'application/x-www-form-urlencoded'
         req.body =
           "grant_type=client_credentials&client_id=#{client_id}&client_secret=#{client_secret}&audience=#{audience}"
       end.body
     end
 
-    def token_expired?(hash)
-      OAuth2::AccessToken.from_hash(@config.oauth_client, hash).expired?
+    def token_expired?(hash,
+      client_id: @config.client_id,
+      client_secret: @config.client_secret,
+      audience: "#{@config.domain}/api",
+      domain: @config.domain
+    )
+      begin
+        validate_jwt_token(hash)
+        OAuth2::AccessToken.from_hash(@config.oauth_client(
+          client_id: client_id, 
+          client_secret: client_secret,
+          domain: domain,
+          authorize_url: "#{domain}/oauth2/auth",
+          token_url: "#{domain}/oauth2/token"), hash).expired?
+      rescue JWT::DecodeError, OAuth2::Error => e
+        Rails.logger.error("Error checking token expiration: #{e.message}")
+        true
+      end
     end
 
     # @return [Hash]
-    def refresh_token(hash)
-      OAuth2::AccessToken.from_hash(@config.oauth_client, hash).refresh.to_hash
+    def refresh_token(hash,
+      client_id: @config.client_id,
+      client_secret: @config.client_secret,
+      audience: "#{@config.domain}/api",
+      domain: @config.domain
+    )
+      OAuth2::AccessToken.from_hash(@config.oauth_client(
+        client_id: client_id, 
+        client_secret: client_secret,
+        domain: domain,
+        authorize_url: "#{domain}/oauth2/auth",
+        token_url: "#{domain}/oauth2/token"), hash).refresh.to_hash
     end
 
     # init sdk api client by bearer token
     #
     # @return [KindeApi::ApiClient]
     def api_client(bearer_token)
-      config = KindeApi::Configuration.default
+      config = KindeApi::Configuration.new  # Create a new instance instead of using default
       config.configure do |c|
         c.access_token = bearer_token
-        c.host = @config.domain
+        c.host = URI.parse(@config.domain).host
+        c.scheme = url_scheme(c.scheme)
+        c.base_path = ''  # Set empty base path since we're using the root
         c.debugging = @config.debugging
         c.logger = @config.logger
-        c.scheme = url_scheme(c.scheme)
+        # Set server configuration
+        c.server_index = nil  # Force direct URL construction
+        c.server_variables = { 'subdomain' => URI.parse(@config.domain).host.split('.').first }
       end
-
       KindeApi::ApiClient.new(config)
     end
 
+    def validate_jwt_token(token_hash)
+      token_hash.each do |key, token|
+        next unless %w[access_token id_token].include?(key.to_s.downcase)
+        begin
+          jwt_validation(token, "#{@config.domain}#{@config.jwks_url}", @config.expected_issuer, @config.expected_audience)
+        rescue JWT::DecodeError
+          Rails.logger.error("Invalid JWT token: #{key}")
+          raise JWT::DecodeError, "Invalid #{key.to_s.capitalize.gsub('_', ' ')}"
+        end
+      end
+    end
+
     private
 
     def url_scheme(default_scheme)
@@ -125,5 +219,46 @@ module KindeSdk
     rescue URI::InvalidURIError
       default_scheme
     end
+
+    # Method to validate a JWT token with caching for JWKS
+    def jwt_validation(jwt_token, jwks_url, expected_issuer, expected_audience)
+      @cached_jwks ||= fetch_jwks(jwks_url)
+
+      begin
+        validate_token(jwt_token, @cached_jwks, expected_issuer, expected_audience)
+      rescue JWT::DecodeError, StandardError
+        # If validation fails, fetch JWKS again and retry validation
+        @cached_jwks = fetch_jwks(jwks_url)
+        validate_token(jwt_token, @cached_jwks, expected_issuer, expected_audience)
+      end
+    end
+
+    # Fetch JWKS from the URL
+    def fetch_jwks(jwks_url)
+      jwks_response = HTTParty.get(jwks_url)
+      JSON.parse(jwks_response.body)
+    end
+
+    # Validate the JWT token using the provided JWKS
+    def validate_token(jwt_token, jwks_hash, expected_issuer, expected_audience)
+      # Decode token header to get 'kid'
+      decoded_token = JWT.decode(jwt_token, nil, false) # [payload, header]
+      header = decoded_token[1]
+      kid = header['kid']
+
+      # Find the matching JWK
+      jwks = JWT::JWK::Set.new(jwks_hash)
+      jwks.filter! {|key| key[:use] == 'sig' }
+      algorithms = jwks.map { |key| key[:alg] }.compact.uniq
+      payload, _header = JWT.decode(jwt_token, nil, true, algorithms: algorithms, jwks: jwks)
+      { valid: true, payload: payload }
+    rescue JWT::DecodeError => e
+      Rails.logger.error("Token validation failed: #{e.message}")
+      raise JWT::DecodeError, "Token validation failed: #{e.message}"
+    rescue StandardError => e
+      Rails.logger.error("Unexpected error: #{e.message}")
+      raise StandardError, "Unexpected error: #{e.message}"
+    end
+
   end
 end

data/spec/examples.txt

@@ -0,0 +1,29 @@
+example_id                            | status | run_time        |
+------------------------------------- | ------ | --------------- |
+./spec/kinde_sdk_spec.rb[1:1:1]       | passed | 0.04758 seconds |
+./spec/kinde_sdk_spec.rb[1:1:2]       | passed | 0.03488 seconds |
+./spec/kinde_sdk_spec.rb[1:2:1]       | passed | 0.0979 seconds  |
+./spec/kinde_sdk_spec.rb[1:2:2:1]     | passed | 0.08776 seconds |
+./spec/kinde_sdk_spec.rb[1:3:1]       | passed | 0.05409 seconds |
+./spec/kinde_sdk_spec.rb[1:4:1]       | passed | 0.05912 seconds |
+./spec/kinde_sdk_spec.rb[1:4:2:1]     | passed | 0.07198 seconds |
+./spec/kinde_sdk_spec.rb[1:5:1]       | passed | 0.05599 seconds |
+./spec/kinde_sdk_spec.rb[1:5:2:1]     | passed | 0.04142 seconds |
+./spec/kinde_sdk_spec.rb[1:6:1:1]     | passed | 0.03109 seconds |
+./spec/kinde_sdk_spec.rb[1:6:1:2]     | passed | 0.04813 seconds |
+./spec/kinde_sdk_spec.rb[1:6:1:3]     | passed | 0.05677 seconds |
+./spec/kinde_sdk_spec.rb[1:6:2:1]     | passed | 0.15193 seconds |
+./spec/kinde_sdk_spec.rb[1:6:2:2:1:1] | passed | 0.01475 seconds |
+./spec/kinde_sdk_spec.rb[1:6:2:2:2:1] | passed | 0.04081 seconds |
+./spec/kinde_sdk_spec.rb[1:6:3:1]     | passed | 0.03504 seconds |
+./spec/kinde_sdk_spec.rb[1:6:3:2]     | passed | 0.02938 seconds |
+./spec/kinde_sdk_spec.rb[1:6:3:3]     | passed | 0.09472 seconds |
+./spec/kinde_sdk_spec.rb[1:6:3:4]     | passed | 0.09361 seconds |
+./spec/kinde_sdk_spec.rb[1:6:3:5]     | passed | 0.11623 seconds |
+./spec/kinde_sdk_spec.rb[1:6:3:6]     | passed | 0.04303 seconds |
+./spec/kinde_sdk_spec.rb[1:6:4:1:1]   | passed | 0.09948 seconds |
+./spec/kinde_sdk_spec.rb[1:7]         | passed | 0.05798 seconds |
+./spec/kinde_sdk_spec.rb[1:8:1]       | passed | 0.11195 seconds |
+./spec/kinde_sdk_spec.rb[1:8:2]       | passed | 0.05606 seconds |
+./spec/kinde_sdk_spec.rb[1:8:3]       | passed | 0.0705 seconds  |
+./spec/kinde_sdk_spec.rb[1:8:4]       | passed | 0.08605 seconds |