lyrebird 1.0.1 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a2c22dc89d09728d25d5563a9db0c136b144865ddea516ea71bd1806a4bf0ce2
-  data.tar.gz: 002da134ef786dd04b2f61a3b2f01a2fe43ec4e772081b9d76dd4b4f5788e839
+  metadata.gz: 763dc798f8c44d5fdf3b9782961fe0ea042ee6a593816a5fb9ac6f6359b284ef
+  data.tar.gz: fc30ca3c936e76b4b29fb55e0dec4528bd17c156c3bf95c6ba76e3b16b3c0b94
 SHA512:
-  metadata.gz: dc069741583e5940e825df140b405fe9c5710632c38927d2fb0baa80c52a4dafcb06170ac72a82259b9708f651e83e2ca11ee1d758d0031c1502f2d068faba57
-  data.tar.gz: 78a80065561c35f30b81a588a9584c173b044064a9b73266385a6708109f0b02952e0acbcbc1d6768d1750ea47ebdcbf346f42dbc7b9e151e0731a43316c995a
+  metadata.gz: 97b8ffd5d37a09be4cea80d33e51de9ac12aee670aa281907740c12d65c91af624649522a8511e4dbb3a15e237f422b0016dc22b00c8435abad460ce17279316
+  data.tar.gz: 44913f9701aaf25446db2ebfd81d2efd7ec887a3be13085bf48444bb7b7eee5724296840e7e3e8e7d67e489b9ef12e6f21882309e5fcd607d0320f3e349ae00c

data/README.md

@@ -7,6 +7,7 @@ A Ruby gem for mimicking SAML Identity Provider (IdP) responses in test
 environments.
 
 ## Installation
+Requires Ruby 3.2 or newer.
 ```ruby
 gem "lyrebird", group: :test
 ```
@@ -15,10 +16,6 @@ gem "lyrebird", group: :test
 ```ruby
 # test/integration/saml_test.rb
 class SAMLTest < ActionDispatch::IntegrationTest
-  setup do
-    @idp_cert = Lyrebird::Certificate.build
-  end
-
   test "consume creates a session" do
     user = users(:alice)
 
@@ -28,7 +25,7 @@ class SAMLTest < ActionDispatch::IntegrationTest
       r.recipient = saml_consume_url
       r.audience = root_url
       r.name_id = user.email
-      r.sign_with = @idp_cert
+      r.sign_with = Lyrebird::Certificate.default
 
       r.attributes do |a|
         a.email = user.email
@@ -93,8 +90,12 @@ end
 ### Getting the encoded response
 ```ruby
 response.mimic    # Base64-encoded SAML response (for POST binding)
-response.document # Nokogiri::XML::Document for inspection
+response.to_xml   # the same response as plain XML (for reading)
+response.document # the response as a Nokogiri document (for searching)
 ```
+Use `response.to_xml`, not `document.to_xml`. Going through `document`
+adds spaces and line breaks, which breaks the signature, and the SP
+rejects the response.
 
 ### Signing
 Sign both the assertion and response with an IdP certificate:
@@ -117,6 +118,35 @@ response = Lyrebird::Response.build do |r|
   r.encrypt_with = sp_cert
 end
 ```
+The assertion is signed first and then encrypted, and the response is
+signed over the ciphertext.
+
+### Testing rejection paths
+Build deliberately invalid responses the SP should reject:
+```ruby
+# Expired (NotOnOrAfter in the past)
+response = Lyrebird::Response.build do |r|
+  r.sign_with = idp_cert
+  r.valid_for = -10
+end
+
+# Not yet valid (NotBefore in the future)
+response = Lyrebird::Response.build do |r|
+  r.sign_with = idp_cert
+  r.not_before = Time.now.utc + 600
+end
+
+# Wrong audience
+response = Lyrebird::Response.build do |r|
+  r.sign_with = idp_cert
+  r.audience = "https://wrong.example.com"
+end
+
+# Untrusted signature (a certificate the SP does not know)
+response = Lyrebird::Response.build do |r|
+  r.sign_with = Lyrebird::Certificate.build
+end
+```
 
 ### NameID Formats
 ```ruby
@@ -139,13 +169,19 @@ Lyrebird.configure do |d|
   d.attributes = { role: "user" }
 end
 ```
-Defaults are frozen after configuration for thread safety.
+Defaults are frozen after configuration for thread safety, so
+`configure` can only be called once.
 
 ## Certificate
 Generates and manages X.509 certificates for signing SAML responses.
 
 ### Building a certificate
+Key generation is slow, so `Lyrebird::Certificate.default` generates one
+certificate and reuses it.
 ```ruby
+# Generated once and reused
+cert = Lyrebird::Certificate.default
+
 # With defaults
 cert = Lyrebird::Certificate.build
 
@@ -169,10 +205,11 @@ cert = Lyrebird::Certificate.load(
 
 ### Using a certificate
 ```ruby
-cert.key          # OpenSSL::PKey::RSA private key
-cert.x509         # OpenSSL::X509::Certificate object
-cert.key_pem      # PEM-encoded private key
-cert.x509_pem     # PEM-encoded certificate
-cert.base64       # Base64-encoded certificate (for SAML metadata)
-cert.fingerprint  # SHA256 fingerprint
+cert.key                 # OpenSSL::PKey::RSA private key
+cert.x509                # OpenSSL::X509::Certificate object
+cert.key_pem             # PEM-encoded private key
+cert.x509_pem            # PEM-encoded certificate
+cert.base64              # Base64-encoded certificate (for SAML metadata)
+cert.fingerprint         # SHA256 fingerprint, colon-separated
+cert.fingerprint(:sha1)  # SHA1 fingerprint
 ```

data/lib/lyrebird/assertion.rb

@@ -20,8 +20,8 @@ module Lyrebird
       @name_id_format = name_id_format
       @recipient = recipient
       @in_response_to = in_response_to
-      @not_before = not_before || @issue_instant
-      @not_on_or_after = @issue_instant + valid_for
+      @not_before = (not_before || @issue_instant).to_time.getutc
+      @not_on_or_after = [@issue_instant, @not_before].max + valid_for
       @audience = audience
       @authn_context = authn_context
       @attributes = attributes
@@ -121,12 +121,14 @@ module Lyrebird
         as.namespace = ns
 
         @attributes.each do |name, values|
+          list = values.is_a?(Enumerable) ? values.to_a : [values].compact
+
           as.add_child(doc.create_element("Attribute")).tap do |a|
             a.namespace = ns
             a["Name"] = name
             a["NameFormat"] = ATTR_NAME_FORMAT
 
-            Array(values).each do |value|
+            list.each do |value|
               a.add_child(doc.create_element("AttributeValue")).tap do |av|
                 av.namespace = ns
                 av.content = value

data/lib/lyrebird/certificate.rb

@@ -2,10 +2,21 @@
 
 module Lyrebird
   class Certificate
+    LOCK = Mutex.new
+
+    EXTENSIONS = {
+      "basicConstraints" => "CA:FALSE",
+      "keyUsage" => "digitalSignature,keyEncipherment"
+    }.freeze
+
     attr_reader :key, :x509
 
+    def self.default
+      LOCK.synchronize { @default ||= build }
+    end
+
     def self.build(**kwargs)
-      config = OpenStruct.new(kwargs)
+      config = Options.new(kwargs)
       yield config if block_given?
       new(**config.to_h)
     end
@@ -18,7 +29,7 @@ module Lyrebird
 
     def initialize(
       bits: 2048,
-      cn: nil,
+      cn: "lyrebird",
       o: nil,
       valid_for: 365,
       valid_until: nil,
@@ -41,12 +52,13 @@ module Lyrebird
       @x509.to_pem
     end
 
-    def fingerprint
-      OpenSSL::Digest::SHA256.hexdigest(@x509.to_der)
+    def fingerprint(algorithm = :sha256)
+      digest = OpenSSL::Digest.new(algorithm.to_s)
+      digest.hexdigest(@x509.to_der).upcase.scan(/../).join(":")
     end
 
     def base64
-      Base64.strict_encode64(@x509.to_der)
+      [@x509.to_der].pack("m0")
     end
 
     private
@@ -62,7 +74,12 @@ module Lyrebird
         c.issuer = c.subject
         c.not_before = now
         c.not_after = @valid_until || now + (@valid_for * 86_400)
-        c.sign(@key, OpenSSL::Digest::SHA256.new)
+
+        EXTENSIONS.each do |oid, value|
+          c.add_extension(OpenSSL::X509::Extension.new(oid, value, true))
+        end
+
+        c.sign(@key, OpenSSL::Digest.new("SHA256"))
       end
     end
 

data/lib/lyrebird/encryption.rb

@@ -49,7 +49,6 @@ module Lyrebird
 
     def build_encrypted_key
       @doc.create_element("EncryptedKey").tap do |ek|
-        ek.add_namespace_definition("xenc", XMLENC_NS)
         ek.namespace = @xenc
 
         ek.add_child(@doc.create_element("EncryptionMethod")).tap do |em|
@@ -71,7 +70,7 @@ module Lyrebird
 
         cd.add_child(@doc.create_element("CipherValue")).tap do |cv|
           cv.namespace = @xenc
-          cv.content = Base64.strict_encode64(encrypted_aes_key)
+          cv.content = [encrypted_aes_key].pack("m0")
         end
       end
     end
@@ -81,14 +80,15 @@ module Lyrebird
       cipher.encrypt
       cipher.key = @aes_key
       iv = cipher.random_iv
-      ciphertext = cipher.update(@element.to_xml) + cipher.final
+      plaintext = @element.to_xml(save_with: 0)
+      ciphertext = cipher.update(plaintext) + cipher.final
 
       @doc.create_element("CipherData").tap do |cd|
         cd.namespace = @xenc
 
         cd.add_child(@doc.create_element("CipherValue")).tap do |cv|
           cv.namespace = @xenc
-          cv.content = Base64.strict_encode64(iv + ciphertext)
+          cv.content = [iv + ciphertext].pack("m0")
         end
       end
     end

data/lib/lyrebird/options.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Lyrebird
+  class Options
+    def initialize(values = {})
+      @values = values.transform_keys(&:to_sym)
+    end
+
+    def to_h
+      @values
+    end
+
+    def [](key)
+      @values[key.to_sym]
+    end
+
+    def []=(key, value)
+      @values[key.to_sym] = value
+    end
+
+    private
+
+    def method_missing(name, *args)
+      key = name.to_s
+
+      if key.end_with?("=")
+        @values[key.chomp("=").to_sym] = args.first
+      elsif @values.key?(name)
+        @values[name]
+      else
+        super
+      end
+    end
+
+    def respond_to_missing?(name, include_private = false)
+      name.to_s.end_with?("=") || @values.key?(name) || super
+    end
+  end
+end

data/lib/lyrebird/response.rb

@@ -2,13 +2,18 @@
 
 module Lyrebird
   class Response
-    def self.build(**kwargs)
-      config = OpenStruct.new(kwargs)
+    class Config < Options
+      def attributes(&block)
+        current = self[:attributes] || {}
+        return current unless block
 
-      config.define_singleton_method(:attributes) do |&block|
-        self.attributes = OpenStruct.new.tap(&block).to_h
+        fresh = Options.new.tap(&block).to_h
+        self[:attributes] = current.transform_keys(&:to_sym).merge(fresh)
       end
+    end
 
+    def self.build(**kwargs)
+      config = Config.new(kwargs)
       yield config if block_given?
       new(**config.to_h)
     end
@@ -35,7 +40,11 @@ module Lyrebird
     end
 
     def mimic
-      Base64.strict_encode64(document.to_xml(save_with: 0))
+      [to_xml].pack("m0")
+    end
+
+    def to_xml
+      document.to_xml(save_with: 0)
     end
 
     def document
@@ -66,13 +75,12 @@ module Lyrebird
         end
 
         r.add_child(build_status(doc))
-        r.add_child(build_assertion_element(doc))
+        r.add_child(build_assertion_element)
       end
     end
 
-    def build_assertion_element(doc)
-      assertion_doc = @assertion.document
-      element = assertion_doc.root
+    def build_assertion_element
+      element = @assertion.document.root
 
       if @encrypt_with
         Signature.new(element, @sign_with).sign! if @sign_with

data/lib/lyrebird/signature.rb

@@ -11,7 +11,9 @@ module Lyrebird
     end
 
     def sign!
-      issuer = @element.at_xpath("saml:Issuer", "saml" => SAML_ASSERTION_NS)
+      ns = { "saml" => SAML_ASSERTION_NS, "ds" => XMLDSIG_NS }
+      @element.at_xpath("ds:Signature", ns)&.remove
+      issuer = @element.at_xpath("saml:Issuer", ns)
       issuer.add_next_sibling(build_signature)
       populate_signature_value
       self
@@ -33,7 +35,6 @@ module Lyrebird
     def build_signed_info
       @doc.create_element("SignedInfo").tap do |si|
         @signed_info = si
-        si.add_namespace_definition("ds", XMLDSIG_NS)
         si.namespace = @ds
 
         si.add_child(@doc.create_element("CanonicalizationMethod")).tap do |cm|
@@ -59,8 +60,8 @@ module Lyrebird
 
     def populate_signature_value
       canonical = @signed_info.canonicalize(C14N_EXCLUSIVE)
-      sig = @certificate.key.sign("SHA256", canonical)
-      @signature_value.content = Base64.strict_encode64(sig)
+      sig = @certificate.key.sign(OpenSSL::Digest.new("SHA256"), canonical)
+      @signature_value.content = [sig].pack("m0")
     end
 
     def build_key_info
@@ -115,8 +116,8 @@ module Lyrebird
 
     def compute_digest
       canonical = @element.canonicalize(C14N_EXCLUSIVE)
-      digest = OpenSSL::Digest::SHA256.digest(canonical)
-      Base64.strict_encode64(digest)
+      digest = OpenSSL::Digest.new("SHA256").digest(canonical)
+      [digest].pack("m0")
     end
   end
 end

data/lib/lyrebird/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Lyrebird
-  VERSION = "1.0.1"
+  VERSION = "2.1.0"
 end

data/lib/lyrebird.rb

@@ -1,9 +1,7 @@
 # frozen_string_literal: true
 
-require "base64"
 require "nokogiri"
 require "openssl"
-require "ostruct"
 require "securerandom"
 require "time"
 
@@ -13,6 +11,7 @@ require_relative "lyrebird/defaults"
 require_relative "lyrebird/encryption"
 require_relative "lyrebird/id"
 require_relative "lyrebird/namespaces"
+require_relative "lyrebird/options"
 require_relative "lyrebird/response"
 require_relative "lyrebird/signature"
 require_relative "lyrebird/version"

metadata

@@ -1,51 +1,37 @@
 --- !ruby/object:Gem::Specification
 name: lyrebird
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 2.1.0
 platform: ruby
 authors:
 - Josh
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-01 00:00:00.000000000 Z
+date: 2026-08-28 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: base64
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.14'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.14'
 - !ruby/object:Gem::Dependency
-  name: ostruct
+  name: base64
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  type: :runtime
+  type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
@@ -114,11 +100,8 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".github/workflows/ci.yml"
-- ".github/workflows/publish.yml"
 - LICENSE.md
 - README.md
-- Rakefile
 - lib/lyrebird.rb
 - lib/lyrebird/assertion.rb
 - lib/lyrebird/certificate.rb
@@ -126,25 +109,17 @@ files:
 - lib/lyrebird/encryption.rb
 - lib/lyrebird/id.rb
 - lib/lyrebird/namespaces.rb
+- lib/lyrebird/options.rb
 - lib/lyrebird/response.rb
 - lib/lyrebird/signature.rb
 - lib/lyrebird/version.rb
-- lyrebird.gemspec
-- sig/lyrebird.rbs
-- test/lyrebird/assertion_test.rb
-- test/lyrebird/certificate_test.rb
-- test/lyrebird/defaults_test.rb
-- test/lyrebird/encryption_test.rb
-- test/lyrebird/id_test.rb
-- test/lyrebird/integration_test.rb
-- test/lyrebird/namespaces_test.rb
-- test/lyrebird/response_test.rb
-- test/lyrebird/signature_test.rb
-- test/test_helper.rb
 homepage: https://github.com/simplesaml/lyrebird
 licenses:
 - MIT
-metadata: {}
+metadata:
+  source_code_uri: https://github.com/simplesaml/lyrebird
+  changelog_uri: https://github.com/simplesaml/lyrebird/releases
+  bug_tracker_uri: https://github.com/simplesaml/lyrebird/issues
 post_install_message:
 rdoc_options: []
 require_paths:

data/.github/workflows/ci.yml

@@ -1,25 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        ruby-version: ["3.2", "3.3", "3.4", "4.0"]
-
-    steps:
-      - uses: actions/checkout@v4
-      - name: Set up Ruby ${{ matrix.ruby-version }}
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: ${{ matrix.ruby-version }}
-          bundler-cache: true
-      - name: Run tests
-        run: bundle exec rake test

data/.github/workflows/publish.yml

@@ -1,20 +0,0 @@
-name: Publish
-
-on:
-  release:
-    types: [published]
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: "3.2"
-      - name: Build gem
-        run: gem build lyrebird.gemspec
-      - name: Publish to RubyGems
-        run: gem push lyrebird-*.gem
-        env:
-          GEM_HOST_API_KEY: ${{ secrets.RUBYGEMS_API_KEY }}

data/Rakefile

@@ -1,11 +0,0 @@
-# frozen_string_literal: true
-
-require "bundler/gem_tasks"
-require "rake/testtask"
-
-Rake::TestTask.new(:test) do |t|
-  t.libs.push("test")
-  t.test_files = FileList["test/**/*_test.rb"]
-end
-
-task default: :test

data/lyrebird.gemspec

@@ -1,33 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "lib/lyrebird/version"
-
-Gem::Specification.new do |spec|
-  spec.name = "lyrebird"
-  spec.version = Lyrebird::VERSION
-  spec.authors = ["Josh"]
-
-  spec.summary = "Mimics SAML Identity Provider (IdP) responses for testing"
-  spec.homepage = "https://github.com/simplesaml/lyrebird"
-  spec.license = "MIT"
-  spec.required_ruby_version = ">= 3.2.0"
-
-  spec.files = `git ls-files -z`.split("\x0")
-  spec.files.delete("Gemfile")
-  spec.files.delete(".gitignore")
-  spec.files.reject! { |f| f.start_with?("bin/") }
-
-  spec.require_paths = ["lib"]
-
-  spec.add_dependency "base64"
-  spec.add_dependency "nokogiri"
-  spec.add_dependency "ostruct"
-
-  # ruby-saml's gemspec has a conditional dependency on logger for Ruby >= 3.4,
-  # but it was evaluated at gem build time (on Ruby < 3.4), so the published gem
-  # doesn't include it.
-  spec.add_development_dependency "logger"
-  spec.add_development_dependency "minitest"
-  spec.add_development_dependency "rake"
-  spec.add_development_dependency "ruby-saml"
-end

data/sig/lyrebird.rbs

@@ -1,4 +0,0 @@
-module Lyrebird
-  VERSION: String
-  # See the writing guide of rbs: https://github.com/ruby/rbs#guides
-end