kinde_sdk 1.5.0 → 1.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a9750676886f9fbf88e29b5efd42b0e04982bafa5f2575005211b81ab5c35dcd
-  data.tar.gz: 06e41ce5145e22c146a1c3c77eb2da4fc9759c416c7d3bf0806a5132d0412a83
+  metadata.gz: 83f3ec0e5e4b6f61d409b0a6c6314459917c94fa6109440fda5634e7d2e747f6
+  data.tar.gz: 35dd34872266b28076bf0a9a89f5bb624d6a314d4067fc359a49f901403ef7a2
 SHA512:
-  metadata.gz: 85f536327bc49538a3645452b6c7570b6489ce3cc4d169c080d63455bbb320d779738f7ea8798e10829425485b62f94da9c88f0b25b64d382c4866deda8454c6
-  data.tar.gz: a699df4b5e9051fa43fa44ba85f97804966d4544a551add332237fb5b27734a6aa0584f9d0148d0ecc70351d4dee585ef7d017dbe5023059143e067563f161e7
+  metadata.gz: 58130b81b2d67b3c2ef8c4f34b6d87157016270b08af9d19d77bb67cfae9b27b32937bbd8b90891f0590b9ad7a7d4cdb0443cf4a2281983567c1960415f60bb8
+  data.tar.gz: fa2f18f0219dbe76661f9a6809deeb0a1e5fcfde13ea300533d3be8c342c97902143392e1c9991e3b94ad5bfda319eefb042f21de27405e091d7b6fbb2d34c75

data/kinde_api/spec/spec_helper.rb

@@ -9,6 +9,7 @@
 # Generated by: https://openapi-generator.tech
 # OpenAPI Generator version: 7.0.0-SNAPSHOT
 #
+$LOAD_PATH.unshift File.expand_path('../lib', __dir__)
 
 # load the gem
 require 'kinde_api'

data/lib/kinde_sdk/client.rb

@@ -1,4 +1,4 @@
-require "kinde_api"
+require_relative '../../kinde_api/lib/kinde_api'
 
 module KindeSdk
   class Client

data/lib/kinde_sdk/engine.rb

@@ -0,0 +1,5 @@
+module KindeSdk
+  class Engine < ::Rails::Engine
+    isolate_namespace KindeSdk # Optional, for mountable engines
+  end
+end

data/lib/kinde_sdk/version.rb

@@ -1,3 +1,3 @@
 module KindeSdk
-  VERSION = "1.5.0"
+  VERSION = "1.6.0"
 end

data/lib/kinde_sdk.rb

@@ -1,9 +1,9 @@
 require "logger"
+require "rails"
 require "kinde_sdk/version"
 require "kinde_sdk/configuration"
 require "kinde_sdk/client/feature_flags"
 require "kinde_sdk/client/permissions"
-require "kinde_sdk/controllers/auth_controller"
 require "kinde_sdk/client"
 require 'securerandom'
 require 'oauth2'
@@ -19,6 +19,10 @@ module KindeSdk
   class << self
     attr_accessor :config
 
+    if defined?(Rails)
+      require "kinde_sdk/engine"
+    end
+
     def configure
       if block_given?
         yield(Configuration.default)

data/spec/spec_helper.rb

@@ -1,3 +1,6 @@
+$LOAD_PATH.unshift File.expand_path('../lib', __dir__)              # For kinde_sdk
+$LOAD_PATH.unshift File.expand_path('../kinde_api/lib', __dir__)    # For kinde_api
+
 require "kinde_sdk"
 require "webmock/rspec"
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kinde_sdk
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.6.0
 platform: ruby
 authors:
 - Kinde Australia Pty Ltd
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-03-25 00:00:00.000000000 Z
+date: 2025-03-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: typhoeus
@@ -45,61 +45,75 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '2.0'
 - !ruby/object:Gem::Dependency
-  name: httparty
+  name: pkce_challenge
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.19.0
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.19.0
+        version: '0'
 - !ruby/object:Gem::Dependency
-  name: jwt
+  name: faraday-follow_redirects
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.2'
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.2'
+        version: '0'
 - !ruby/object:Gem::Dependency
-  name: pkce_challenge
+  name: rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 7.0.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 7.0.4
 - !ruby/object:Gem::Dependency
-  name: faraday-follow_redirects
+  name: httparty
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.19.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.19.0
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -450,7 +464,7 @@ files:
 - lib/kinde_sdk/client/feature_flags.rb
 - lib/kinde_sdk/client/permissions.rb
 - lib/kinde_sdk/configuration.rb
-- lib/kinde_sdk/controllers/auth_controller.rb
+- lib/kinde_sdk/engine.rb
 - lib/kinde_sdk/version.rb
 - spec/kinde_sdk_spec.rb
 - spec/spec_helper.rb

data/lib/kinde_sdk/controllers/auth_controller.rb

@@ -1,152 +0,0 @@
-require 'action_controller'
-require 'uri'
-require 'cgi'
-require 'net/http'
-require 'json'
-require 'jwt'
-
-module KindeSdk
-  class AuthController < ActionController::Base
-    # Add before_action to validate nonce in callback
-    before_action :validate_state, only: :callback
-  
-    def auth
-      # Generate a secure random nonce
-      nonce = SecureRandom.urlsafe_base64(16)
-      
-      # Call KindeSdk.auth_url with nonce
-      auth_data = KindeSdk.auth_url(nonce: nonce)
-      
-      # Store in session
-      session[:code_verifier] = auth_data[:code_verifier] if auth_data[:code_verifier].present?
-      session[:auth_nonce] = nonce
-      session[:auth_state] = {
-        requested_at: Time.current.to_i,
-        redirect_url: auth_data[:url]
-      }
-      
-      redirect_to auth_data[:url], allow_other_host: true
-    end
-  
-    def callback
-      tokens = KindeSdk.fetch_tokens(
-        params[:code],
-        code_verifier: KindeSdk.config.pkce_enabled ? session[:code_verifier] : nil
-      ).slice(:access_token, :id_token, :refresh_token, :expires_at)
-  
-
-      # Validate nonce in ID token
-      id_token = tokens[:id_token]
-      issuer = KindeSdk.config.domain
-      client_id = KindeSdk.config.client_id
-      original_nonce = session[:auth_nonce]
-      unless validate_nonce(id_token, original_nonce, issuer, client_id)
-        Rails.logger.warn("Nonce validation failed")
-        redirect_to "/", alert: "Invalid authentication nonce"
-        return
-      end
-
-      # Store tokens and user in session
-      session[:kinde_auth] = OAuth2::AccessToken.from_hash(KindeSdk.config.oauth_client, tokens).to_hash
-        .slice(:access_token, :refresh_token, :expires_at)
-      session[:kinde_user] = KindeSdk.client(tokens).oauth.get_user.to_hash
-      
-      # Clear nonce and state after successful authentication
-      session.delete(:auth_nonce)
-      session.delete(:auth_state)
-      session.delete(:code_verifier)
-      redirect_to "/"
-    rescue StandardError => e
-      Rails.logger.error("Authentication callback failed: #{e.message}")
-      redirect_to "/", alert: "Authentication failed"
-    end
-  
-    def client_credentials_auth
-      result = KindeSdk.client_credentials_access(
-        client_id: ENV["KINDE_MANAGEMENT_CLIENT_ID"],
-        client_secret: ENV["KINDE_MANAGEMENT_CLIENT_SECRET"]
-      )
-  
-      if result["error"].present?
-        Rails.logger.error("Client credentials auth failed: #{result['error']}")
-        raise result["error"]
-      end
-  
-      $redis.set("kinde_m2m_token", result["access_token"], ex: result["expires_in"].to_i)
-      redirect_to mgmt_path
-    end
-  
-    def logout
-      redirect_to KindeSdk.logout_url, allow_other_host: true
-    end
-  
-    def logout_callback
-      reset_session
-      redirect_to "/"
-    end
-  
-    private
-  
-    def validate_state
-      # Check if nonce and state exist in session
-      unless session[:auth_nonce] && session[:auth_state]
-        Rails.logger.warn("Missing session state or nonce [#{session[:auth_nonce]}] [#{session[:auth_state]}]")
-        redirect_to "/", alert: "Invalid authentication state"
-        return
-      end
-  
-      # Verify nonce returned matches stored nonce
-      returned_state = params[:state]
-      stored_state = session[:auth_state]
-      stored_url = stored_state["redirect_url"]
-  
-      # Extract the state from the stored redirect_url
-      parsed_url = URI.parse(stored_url)
-      query_params = CGI.parse(parsed_url.query || "")
-      stored_state_from_url = query_params["state"]&.first
-
-      # Verify returned state matches the state extracted from the redirect_url
-      unless returned_state.present? && returned_state == stored_state_from_url
-        Rails.logger.warn("State validation failed: returned=#{returned_state}, expected=#{stored_state_from_url}")
-        redirect_to "/", alert: "Invalid authentication state"
-        return
-      end
-
-      # Optional: Check state age (e.g., expires after 15 minutes)
-      if Time.current.to_i - stored_state["requested_at"] > 900
-        Rails.logger.warn("Authentication state expired")
-        redirect_to "/", alert: "Authentication session expired"
-        return
-      end
-    end
-
-
-    def validate_nonce(id_token, original_nonce, issuer, client_id)
-      jwks_uri = URI.parse("#{issuer}/.well-known/jwks.json")
-      jwks_response = Net::HTTP.get(jwks_uri)
-      jwks = JSON.parse(jwks_response)
-    
-      decoded_token = JWT.decode(
-        id_token,
-        nil,
-        true,
-        algorithm: 'RS256',
-        iss: issuer,
-        aud: client_id,
-        verify_iss: true,
-        verify_aud: true,
-        jwks: { keys: jwks['keys'] }
-      )
-    
-      payload = decoded_token[0]
-      nonce_from_token = payload['nonce']
-      
-      nonce_from_token == original_nonce
-    rescue StandardError => e
-      Rails.logger.error("Nonce validation error: #{e.message}")
-      false
-    end
-    
-    
-  end
-end