kinde_sdk 1.6.3 → 1.6.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 968c1259cbb736de98492390e22ff1ee9d696d377f53bee26c51638ef559dc4b
-  data.tar.gz: 1bfe473e41c17233663f3b56ac7dc7f7cc6e0206ba5ef4f789c168364dfc927b
+  metadata.gz: e09a644031cc5915d99166b84fc7d9cd59657fbe2991faa4a93697c51f39978a
+  data.tar.gz: 30a74f7a9cc11d9c7eebf827eb4db4db9c904ce47ca3d5db6cefaecd6d438d3d
 SHA512:
-  metadata.gz: d0eb3ff3c628a848ef41b41e921a686a7cf86033e040c4468b6923b5f0b92490990fd93166064bf1109fcae36a1d13259f97c12e194ebe55059c981fdc648e52
-  data.tar.gz: 6958f1bce9b3b68c9d4d7d8fa166bc0f1bda5e9fce4d49a49f73da9f4369ecf1b59bc3539374bc8bbda21e55f62a08b647886b5ca951541e4ac98b56a72ca8f3
+  metadata.gz: caa067305857d9904758f66c5cb522b9e4f104258686431fe846f968623c93eb6dda2c1c2fd8ccb0281d052e7e528d6f48d64aa5ea4fadb11c26b6abbb1c259a
+  data.tar.gz: 7f459347afb2493a4a722f8a6d249906d95994008d9f89e6475e6a673929f09cf15414c4fb41644d478898f1ca6aef408805741921aa9ae4dc298c20f45f45e8

data/app/controllers/kinde_sdk/auth_controller.rb

@@ -6,18 +6,25 @@ require 'json'
 require 'jwt'
 
 module KindeSdk
+  # AuthController handles all authentication-related actions for the Kinde SDK
+  # including OAuth2 flows, token management, and session handling
   class AuthController < ActionController::Base
-    # Add before_action to validate nonce in callback
+    include AuthHelper
+    
     before_action :validate_state, only: :callback
+    before_action :clear_auth_session, only: [:logout_callback, :logout]
   
+    # Initiates the OAuth2 authorization flow
+    # Generates a secure nonce and redirects to Kinde's authorization endpoint
+    # @return [void] Redirects to Kinde's authorization URL
     def auth
-      # Generate a secure random nonce
+      # Generate a secure random nonce for CSRF protection
       nonce = SecureRandom.urlsafe_base64(16)
       
-      # Call KindeSdk.auth_url with nonce
+      # Get authorization URL and PKCE code verifier from SDK
       auth_data = KindeSdk.auth_url(nonce: nonce)
       
-      # Store in session
+      # Store PKCE code verifier and nonce in session for validation
       session[:code_verifier] = auth_data[:code_verifier] if auth_data[:code_verifier].present?
       session[:auth_nonce] = nonce
       session[:auth_state] = {
@@ -26,41 +33,31 @@ module KindeSdk
       }
       
       redirect_to auth_data[:url], allow_other_host: true
+    rescue StandardError => e
+      handle_error("Auth initialization failed", e)
     end
   
+    # Handles the OAuth2 callback from Kinde
+    # Validates the response, exchanges code for tokens, and sets up the session
+    # @return [void] Redirects to root path on success
     def callback
-      tokens = KindeSdk.fetch_tokens(
-        params[:code],
-        code_verifier: KindeSdk.config.pkce_enabled ? session[:code_verifier] : nil
-      ).slice(:access_token, :id_token, :refresh_token, :expires_at)
-  
-
-      # Validate nonce in ID token
-      id_token = tokens[:id_token]
-      issuer = KindeSdk.config.domain
-      client_id = KindeSdk.config.client_id
-      original_nonce = session[:auth_nonce]
-      unless validate_nonce(id_token, original_nonce, issuer, client_id)
-        Rails.logger.warn("Nonce validation failed")
-        redirect_to "/", alert: "Invalid authentication nonce"
-        return
-      end
+      tokens = fetch_and_validate_tokens
+      return if performed?
 
-      # Store tokens and user in session
-      session[:kinde_auth] = OAuth2::AccessToken.from_hash(KindeSdk.config.oauth_client, tokens).to_hash
-        .slice(:access_token, :refresh_token, :expires_at)
-      session[:kinde_user] = KindeSdk.client(tokens).oauth.get_user.to_hash
+      # Store tokens and user information in session
+      set_session_tokens(tokens)
+      
+      # Clean up temporary auth session data
+      clear_auth_session
       
-      # Clear nonce and state after successful authentication
-      session.delete(:auth_nonce)
-      session.delete(:auth_state)
-      session.delete(:code_verifier)
       redirect_to "/"
     rescue StandardError => e
-      Rails.logger.error("Authentication callback failed: #{e.message}")
-      redirect_to "/", alert: "Authentication failed"
+      handle_error("Authentication callback failed", e)
     end
   
+    # Handles machine-to-machine (M2M) authentication using client credentials
+    # Stores the access token in Redis for subsequent API calls
+    # @return [void] Redirects to management path on success
     def client_credentials_auth
       result = KindeSdk.client_credentials_access(
         client_id: ENV["KINDE_MANAGEMENT_CLIENT_ID"],
@@ -68,30 +65,113 @@ module KindeSdk
       )
   
       if result["error"].present?
-        Rails.logger.error("Client credentials auth failed: #{result['error']}")
         raise result["error"]
       end
   
+      # Store M2M token in Redis with expiration
       $redis.set("kinde_m2m_token", result["access_token"], ex: result["expires_in"].to_i)
       redirect_to mgmt_path
+    rescue StandardError => e
+      handle_error("Client credentials authentication failed", e)
+    end
+
+    # Refreshes the access token using the refresh token
+    # @return [void] Redirects to root path on success
+    def refresh_token
+      return redirect_with_error("No valid session found") unless session[:kinde_token_store].present?
+
+      if refresh_session_tokens
+        redirect_to "/"
+      else
+        redirect_with_error("Failed to refresh token")
+      end
+    rescue StandardError => e
+      handle_error("Token refresh failed", e)
     end
   
+    # Initiates the logout process by redirecting to Kinde's logout endpoint
+    # @return [void] Redirects to Kinde's logout URL
     def logout
-      redirect_to KindeSdk.logout_url, allow_other_host: true
+      # Ensure we have a valid logout URL configured
+      unless KindeSdk.config.logout_url.present?
+        redirect_with_error("Logout URL not configured")
+        return
+      end
+
+      # Get the logout URL with our callback URL
+      logout_url = KindeSdk.logout_url(
+        logout_url: KindeSdk.config.logout_url,
+        domain: KindeSdk.config.domain
+      )
+
+      # Clear local session before redirecting to Kinde
+      session.delete(:kinde_token_store)
+      session.delete(:kinde_user)
+      clear_auth_session
+
+      # Redirect to Kinde's logout endpoint
+      redirect_to logout_url, allow_other_host: true
+    rescue StandardError => e
+      handle_error("Logout initialization failed", e)
     end
   
+    # Handles the callback after successful logout
+    # @return [void] Redirects to root path
     def logout_callback
-      reset_session
+      # Session is already cleared in logout method
+      # Just redirect to home page
       redirect_to "/"
     end
   
     private
+
+    # Fetches and validates tokens from the authorization code
+    # @return [Hash] The validated tokens or nil if validation fails
+    def fetch_and_validate_tokens
+      tokens = KindeSdk.fetch_tokens(
+        params[:code],
+        code_verifier: KindeSdk.config.pkce_enabled ? session[:code_verifier] : nil,
+        redirect_uri: KindeSdk.config.callback_url
+      )
+
+      if tokens[:error].present?
+        redirect_with_error("Token exchange failed: #{tokens[:error]}")
+        return nil
+      end
+
+      # Validate tokens using SDK's built-in validation
+      begin
+        KindeSdk.validate_jwt_token(tokens)
+        
+        # Validate nonce in ID token to prevent replay attacks
+        decoded_token = JWT.decode(tokens[:id_token], nil, false)[0]
+        unless decoded_token['nonce'] == session[:auth_nonce]
+          redirect_with_error("Invalid authentication nonce")
+          return nil
+        end
+
+        tokens
+      rescue JWT::DecodeError => e
+        redirect_with_error("Token validation failed: #{e.message}")
+        nil
+      end
+    end
+
+    # Clears temporary authentication data from the session
+    # @return [void]
+    def clear_auth_session
+      session.delete(:auth_nonce)
+      session.delete(:auth_state)
+      session.delete(:code_verifier)
+    end
   
+    # Validates the state parameter to prevent CSRF attacks
+    # Checks state existence, matches returned state with stored state, and validates expiration
+    # @return [void]
     def validate_state
       # Check if nonce and state exist in session
-      unless session[:auth_nonce] && session[:auth_state]
-        Rails.logger.warn("Missing session state or nonce [#{session[:auth_nonce]}] [#{session[:auth_state]}]")
-        redirect_to "/", alert: "Invalid authentication state"
+      unless session[:auth_state]
+        redirect_with_error("Invalid authentication state")
         return
       end
   
@@ -107,46 +187,32 @@ module KindeSdk
 
       # Verify returned state matches the state extracted from the redirect_url
       unless returned_state.present? && returned_state == stored_state_from_url
-        Rails.logger.warn("State validation failed: returned=#{returned_state}, expected=#{stored_state_from_url}")
-        redirect_to "/", alert: "Invalid authentication state"
+        redirect_with_error("Invalid authentication state")
         return
       end
 
-      # Optional: Check state age (e.g., expires after 15 minutes)
+      # Check state age (expires after 15 minutes)
       if Time.current.to_i - stored_state["requested_at"] > 900
-        Rails.logger.warn("Authentication state expired")
-        redirect_to "/", alert: "Authentication session expired"
+        redirect_with_error("Authentication session expired")
         return
       end
     end
 
+    # Handles errors during authentication
+    # @param message [String] The error message
+    # @param error [Exception] The exception that occurred
+    # @return [void]
+    def handle_error(message, error)
+      Rails.logger.error("Error: #{error.message}")
+      redirect_with_error(message)
+    end
 
-    def validate_nonce(id_token, original_nonce, issuer, client_id)
-      jwks_uri = URI.parse("#{issuer}/.well-known/jwks.json")
-      jwks_response = Net::HTTP.get(jwks_uri)
-      jwks = JSON.parse(jwks_response)
-    
-      decoded_token = JWT.decode(
-        id_token,
-        nil,
-        true,
-        algorithm: 'RS256',
-        iss: issuer,
-        aud: client_id,
-        verify_iss: true,
-        verify_aud: true,
-        jwks: { keys: jwks['keys'] }
-      )
-    
-      payload = decoded_token[0]
-      nonce_from_token = payload['nonce']
-      
-      nonce_from_token == original_nonce
-    rescue StandardError => e
-      Rails.logger.error("Nonce validation error: #{e.message}")
-      false
+    # Redirects to root path with an error message
+    # @param message [String] The error message
+    # @return [void]
+    def redirect_with_error(message)
+      Rails.logger.error("Redirecting with error: #{message}")
+      redirect_to "/", alert: message
     end
-    
-    
   end
 end

data/app/helpers/auth_helper.rb

@@ -0,0 +1,88 @@
+module AuthHelper
+  # Sets up session tokens and user information after successful authentication
+  # @param tokens [Hash] The authentication tokens received from Kinde
+  # @return [void]
+  def set_session_tokens(tokens)
+    # Create token store from tokens
+    token_store = KindeSdk::TokenManager.create_store(tokens)
+    
+    # Store minimal token data in session
+    session[:kinde_token_store] = {
+      access_token: token_store.bearer_token,
+      refresh_token: token_store.tokens[:refresh_token],
+      expires_at: token_store.expires_at
+    }
+    
+    # Get and store minimal user info
+    client = KindeSdk.client(tokens)
+    user_info = client.oauth.get_user_profile_v2.to_hash
+    
+    # Validate user info before storing
+    raise ArgumentError, "Invalid user info received" unless user_info[:id].present?
+    
+    session[:kinde_user] = {
+      id: user_info[:id],
+      email: user_info[:email],
+      first_name: user_info[:given_name],
+      last_name: user_info[:family_name]
+    }
+  end
+  
+  # Checks if the user is currently logged in
+  # @return [Boolean] true if the user is logged in and token is valid
+  def logged_in?
+    !token_expired?
+  end
+
+  # Checks if the session contains token data
+  # @return [Boolean] true if session contains token data
+  def session_present_in?
+    session[:kinde_token_store].present?
+  end
+
+  # Checks if the current token has expired
+  # @return [Boolean] true if token is expired or invalid
+  def token_expired?
+    return true unless session[:kinde_token_store].present?
+    
+    client = get_client
+    return true unless client
+    
+    client.token_expired?
+  rescue JWT::DecodeError => e
+    Rails.logger.error("JWT decode error: #{e.message}")
+    true
+  rescue StandardError => e
+    Rails.logger.error("Error checking token expiration: #{e.message}")
+    true
+  end
+
+  # Attempts to refresh the session tokens
+  # @return [Boolean] true if refresh was successful
+  def refresh_session_tokens
+    return false unless session[:kinde_token_store].present?
+    
+    # Create token store from session data
+    token_store = KindeSdk::TokenStore.new(session[:kinde_token_store])
+    
+    # Attempt to refresh tokens
+    new_tokens = KindeSdk::TokenManager.refresh_tokens(token_store, session)
+    if new_tokens
+      set_session_tokens(new_tokens)
+      true
+    else
+      false
+    end
+  rescue StandardError => e
+    Rails.logger.error("Error refreshing tokens: #{e.message}")
+    session.delete(:kinde_token_store)
+    false
+  end
+
+  # Gets a Kinde client instance for the current session
+  # @return [KindeSdk::Client, nil] The client instance or nil if no valid session
+  def get_client
+    return nil unless session[:kinde_token_store].present?
+    KindeSdk.client(session[:kinde_token_store])
+  end
+end

data/config/routes.rb

@@ -1,7 +1,9 @@
 KindeSdk::Engine.routes.draw do
-    get "callback" => "auth#callback"
+    # Authentication routes
     get "auth" => "auth#auth"
+    get "callback" => "auth#callback"
     get "logout" => "auth#logout"
     get "logout_callback" => "auth#logout_callback"
+    get "refresh_token" => "auth#refresh_token"
     get "client_credentials_auth" => "auth#client_credentials_auth"
 end

data/kinde_api/Gemfile

@@ -0,0 +1,9 @@
+source 'https://rubygems.org'
+
+gemspec
+
+group :development, :test do
+  gem 'rake', '~> 13.0.1'
+  gem 'pry-byebug'
+  gem 'rubocop', '~> 0.66.0'
+end