kinde_sdk 1.4.0 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4393bedaa94f9f37bcdf785519f34d2a563a812953e9a79172b386dc70b1bdf1
-  data.tar.gz: c6ed0c2101f8bdde09679b1354f92106180ac9842c79899ff4991af80e207006
+  metadata.gz: a9750676886f9fbf88e29b5efd42b0e04982bafa5f2575005211b81ab5c35dcd
+  data.tar.gz: 06e41ce5145e22c146a1c3c77eb2da4fc9759c416c7d3bf0806a5132d0412a83
 SHA512:
-  metadata.gz: 3a66add0908092ef798854740ebabaa033e21565386dd6724915c2a494bc393c2ad8f52b04e29d26c92df93ffb2fbc133d5749f3e514e98e3e015a2246bc4f22
-  data.tar.gz: 70a0439d8b50580546a9e2d4cad90a32eda4bbe276425653be46fd38975918a8aaaab9842261e690dfb7df8962995cb23a064c8629f540e28acd6c334799c348
+  metadata.gz: 85f536327bc49538a3645452b6c7570b6489ce3cc4d169c080d63455bbb320d779738f7ea8798e10829425485b62f94da9c88f0b25b64d382c4866deda8454c6
+  data.tar.gz: a699df4b5e9051fa43fa44ba85f97804966d4544a551add332237fb5b27734a6aa0584f9d0148d0ecc70351d4dee585ef7d017dbe5023059143e067563f161e7

data/lib/kinde_sdk/configuration.rb

@@ -10,6 +10,11 @@ module KindeSdk
     attr_accessor :authorize_url
     attr_accessor :token_url
 
+    attr_accessor :jwks_url
+    attr_accessor :jwks
+    attr_accessor :expected_issuer
+    attr_accessor :expected_audience
+
     attr_accessor :logger
     attr_accessor :debugging
     attr_accessor :oauth_client
@@ -19,6 +24,9 @@ module KindeSdk
     def initialize
       @authorize_url = '/oauth2/auth'
       @token_url = '/oauth2/token'
+      @jwks_url = '/.well-known/jwks.json'
+      @expected_audience = nil
+      @expected_issuer = nil
       @debugging = false
       @logger = defined?(Rails) ? Rails.logger : Logger.new(STDOUT)
       @scope = 'openid offline email profile'

data/lib/kinde_sdk/controllers/auth_controller.rb

@@ -24,7 +24,7 @@ module KindeSdk
         requested_at: Time.current.to_i,
         redirect_url: auth_data[:url]
       }
-  
+      
       redirect_to auth_data[:url], allow_other_host: true
     end
   
@@ -90,7 +90,7 @@ module KindeSdk
     def validate_state
       # Check if nonce and state exist in session
       unless session[:auth_nonce] && session[:auth_state]
-        Rails.logger.warn("Missing session state or nonce")
+        Rails.logger.warn("Missing session state or nonce [#{session[:auth_nonce]}] [#{session[:auth_state]}]")
         redirect_to "/", alert: "Invalid authentication state"
         return
       end

data/lib/kinde_sdk/version.rb

@@ -1,3 +1,3 @@
 module KindeSdk
-  VERSION = "1.4.0"
+  VERSION = "1.5.0"
 end

data/lib/kinde_sdk.rb

@@ -10,6 +10,10 @@ require 'oauth2'
 require 'pkce_challenge'
 require 'faraday/follow_redirects'
 require 'uri'
+require 'httparty'
+require 'jwt'
+require 'openssl'
+require 'base64'
 
 module KindeSdk
   class << self
@@ -102,6 +106,8 @@ module KindeSdk
     #
     # @return [KindeSdk::Client]
     def client(tokens_hash)
+      validate_jwt_token(tokens_hash)
+      
       sdk_api_client = api_client(tokens_hash[:access_token] || tokens_hash["access_token"])
       KindeSdk::Client.new(sdk_api_client, tokens_hash, @config.auto_refresh_tokens)
     end
@@ -135,6 +141,8 @@ module KindeSdk
       audience: "#{@config.domain}/api",
       domain: @config.domain
     )
+      validate_jwt_token(hash)
+      
       OAuth2::AccessToken.from_hash(@config.oauth_client(
         client_id: client_id, 
         client_secret: client_secret,
@@ -150,6 +158,8 @@ module KindeSdk
       audience: "#{@config.domain}/api",
       domain: @config.domain
     )
+      validate_jwt_token(hash)
+      
       OAuth2::AccessToken.from_hash(@config.oauth_client(
         client_id: client_id, 
         client_secret: client_secret,
@@ -182,5 +192,62 @@ module KindeSdk
     rescue URI::InvalidURIError
       default_scheme
     end
+
+
+    def validate_jwt_token(token_hash)
+      token_hash.each do |key, token|
+        next unless %w[access_token id_token].include?(key.to_s.downcase)
+        begin
+          jwt_validation(token, "#{@config.domain}#{@config.jwks_url}", @config.expected_issuer, @config.expected_audience)
+        rescue JWT::DecodeError
+          Rails.logger.error("Invalid JWT token: #{key}")
+          raise JWT::DecodeError, "Invalid #{key.to_s.capitalize.gsub('_', ' ')}"
+        end
+      end
+    end
+
+
+    # Method to validate a JWT token with caching for JWKS
+    def jwt_validation(jwt_token, jwks_url, expected_issuer, expected_audience)
+      @cached_jwks ||= fetch_jwks(jwks_url)
+
+      begin
+        validate_token(jwt_token, @cached_jwks, expected_issuer, expected_audience)
+      rescue JWT::DecodeError, StandardError
+        # If validation fails, fetch JWKS again and retry validation
+        @cached_jwks = fetch_jwks(jwks_url)
+        validate_token(jwt_token, @cached_jwks, expected_issuer, expected_audience)
+      end
+    end
+
+    private
+
+    # Fetch JWKS from the URL
+    def fetch_jwks(jwks_url)
+      jwks_response = HTTParty.get(jwks_url)
+      JSON.parse(jwks_response.body)
+    end
+
+    # Validate the JWT token using the provided JWKS
+    def validate_token(jwt_token, jwks_hash, expected_issuer, expected_audience)
+      # Decode token header to get 'kid'
+      decoded_token = JWT.decode(jwt_token, nil, false) # [payload, header]
+      header = decoded_token[1]
+      kid = header['kid']
+
+      # Find the matching JWK
+      jwks = JWT::JWK::Set.new(jwks_hash)
+      jwks.filter! {|key| key[:use] == 'sig' }
+      algorithms = jwks.map { |key| key[:alg] }.compact.uniq
+      payload, _header = JWT.decode(jwt_token, nil, true, algorithms: algorithms, jwks: jwks)
+      { valid: true, payload: payload }
+    rescue JWT::DecodeError => e
+      Rails.logger.error("Token validation failed: #{e.message}")
+      raise JWT::DecodeError, "Token validation failed: #{e.message}"
+    rescue StandardError => e
+      Rails.logger.error("Unexpected error: #{e.message}")
+      raise StandardError, "Unexpected error: #{e.message}"
+    end
+
   end
 end

data/spec/kinde_sdk_spec.rb

@@ -1,4 +1,8 @@
 require 'spec_helper'
+require 'jwt'
+require 'openssl'
+require 'webmock/rspec'
+
 
 describe KindeSdk do
   let(:domain) { "http://example.com" }
@@ -8,6 +12,13 @@ describe KindeSdk do
   let(:logout_url) { "http://localhost/logout-callback" }
   let(:auto_refresh_tokens) { true }
 
+  let(:optional_parameters) { { kid: 'my-kid', use: 'sig', alg: 'RS512' } }
+  let(:rsa_key) { OpenSSL::PKey::RSA.new(2048) }
+  let(:jwk) { JWT::JWK.new(rsa_key, optional_parameters) }
+  let(:payload) { { data: 'data' } }
+  let(:token) { JWT.encode(payload, jwk.signing_key, jwk[:alg], kid: jwk[:kid]) }
+  let(:jwks_hash) { JWT::JWK::Set.new(jwk).export }
+
   before do
     KindeSdk.configure do |c|
       c.domain = domain
@@ -74,7 +85,19 @@ describe KindeSdk do
         )
         .to_return(
           status: 200,
-          body: { "access_token": "eyJ", "id_token": "test", "refresh_token": "test","expires_in": 86399, "scope": "", "token_type": "bearer" }.to_json,
+          body: { "access_token" => "eyJ", "id_token" => "test", "refresh_token" => "test", "expires_in" => 86399, "scope" => "", "token_type" => "bearer" }.to_json,
+          headers: { "content-type" => "application/json;charset=UTF-8" }
+        )
+      stub_request(:get, "#{domain}/.well-known/jwks.json")
+        .with(
+          headers: {
+       	  'Accept'=>'*/*',
+       	  'Accept-Encoding'=>'gzip;q=1.0,deflate;q=0.6,identity;q=0.3',
+       	  'User-Agent'=>'Ruby'
+           })
+        .to_return(
+          status: 200,
+          body: jwks_hash.to_json,
           headers: { "content-type" => "application/json;charset=UTF-8" }
         )
     end
@@ -123,13 +146,13 @@ describe KindeSdk do
     let(:hash_to_encode) do
       { "aud" => [],
         "azp" => "19ebb687cd2f405c9f2daf645a8db895",
-        "exp" => 1679600554,
         "feature_flags" => {
           "asd" => { "t" => "b", "v" => true },
           "eeeeee" => { "t" => "i", "v" => 111 },
           "qqq" => { "t" => "s", "v" => "aa" }
         },
-        "iat" => 1679514154,
+        "iat": Time.now.to_i,           # Issued at: current time
+        "exp": Time.now.to_i + 3600,  # Expiration time: 1 hour from now
         "iss" => "https://example.kinde.com",
         "jti" => "22c48b2c-da46-4661-a7ff-425c23eceab5",
         "org_code" => "org_cb4544175bc",
@@ -137,9 +160,23 @@ describe KindeSdk do
         "scp" => ["openid", "offline"],
         "sub" => "kp:b17adf719f7d4b87b611d1a88a09fd15" }
     end
-    let(:token) { JWT.encode(hash_to_encode, nil, "none") }
+    before do
+      stub_request(:get, "#{domain}/.well-known/jwks.json")
+        .with(
+          headers: {
+       	  'Accept'=>'*/*',
+       	  'Accept-Encoding'=>'gzip;q=1.0,deflate;q=0.6,identity;q=0.3',
+       	  'User-Agent'=>'Ruby'
+           })
+        .to_return(
+          status: 200,
+          body: jwks_hash.to_json,
+          headers: { "content-type" => "application/json;charset=UTF-8" }
+        )
+    end
+    let(:token) { JWT.encode(hash_to_encode, jwk.signing_key, jwk[:alg], kid: jwk[:kid]) }
     let(:expires_at) { Time.now.to_i + 10000000 }
-    let(:client) { described_class.client({ "access_token": token, "expires_at": expires_at }) }
+    let(:client) { described_class.client({ access_token: token, expires_at: expires_at }) }
 
     context "with feature flags" do
       it "returns existing flags", :aggregate_failures do
@@ -229,3 +266,5 @@ describe KindeSdk do
     end
   end
 end
+
+

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kinde_sdk
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.5.0
 platform: ruby
 authors:
 - Kinde Australia Pty Ltd
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-03-20 00:00:00.000000000 Z
+date: 2025-03-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: typhoeus
@@ -44,6 +44,34 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: httparty
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.19.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.19.0
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
 - !ruby/object:Gem::Dependency
   name: pkce_challenge
   requirement: !ruby/object:Gem::Requirement