minty 1.0.0

data/lib/minty/mixins/httpproxy.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+
+require 'addressable/uri'
+require 'retryable'
+require_relative '../exception'
+
+module Minty
+  module Mixins
+    module HTTPProxy
+      attr_accessor :headers, :base_uri, :timeout, :retry_count
+
+      DEFAULT_RETRIES = 3
+      MAX_ALLOWED_RETRIES = 10
+      MAX_REQUEST_RETRY_JITTER = 250
+      MAX_REQUEST_RETRY_DELAY = 1000
+      MIN_REQUEST_RETRY_DELAY = 250
+      BASE_DELAY = 100
+
+      %i[get post post_file put patch delete delete_with_body].each do |method|
+        define_method(method) do |uri, body = {}, extra_headers = {}|
+          body = body.delete_if { |_, v| v.nil? }
+          token = get_token
+          authorization_header(token) unless token.nil?
+          request_with_retry(method, uri, body, extra_headers)
+        end
+      end
+
+      def retry_options
+        sleep_timer = lambda do |attempt|
+          wait = BASE_DELAY * (2**attempt - 1)
+          wait += rand(wait + 1..wait + MAX_REQUEST_RETRY_JITTER)
+          wait = [MAX_REQUEST_RETRY_DELAY, wait].min
+          wait = [MIN_REQUEST_RETRY_DELAY, wait].max
+          wait / 1000.to_f.round(2)
+        end
+
+        tries = 1 + [Integer(retry_count || DEFAULT_RETRIES), MAX_ALLOWED_RETRIES].min
+
+        {
+          tries: tries,
+          sleep: sleep_timer,
+          on: Minty::RateLimitEncountered
+        }
+      end
+
+      def encode_uri(uri)
+        path = base_uri ? Addressable::URI.new(path: uri).normalized_path : Addressable::URI.escape(uri)
+        url(path)
+      end
+
+      def url(path)
+        "#{base_uri}#{path}"
+      end
+
+      def add_headers(h = {})
+        raise ArgumentError, 'Headers must be an object which responds to #to_hash' unless h.respond_to?(:to_hash)
+
+        @headers ||= {}
+        @headers.merge!(h.to_hash)
+      end
+
+      def safe_parse_json(body)
+        JSON.parse(body.to_s)
+      rescue JSON::ParserError
+        body
+      end
+
+      def request_with_retry(method, uri, body = {}, extra_headers = {})
+        Retryable.retryable(retry_options) do
+          request(method, uri, body, extra_headers)
+        end
+      end
+
+      def request(method, uri, body = {}, extra_headers = {})
+        result = case method
+                 when :get
+                   @headers ||= {}
+                   get_headers = @headers.merge({ params: body }).merge(extra_headers)
+                   call(:get, encode_uri(uri), timeout, get_headers)
+                 when :delete
+                   @headers ||= {}
+                   delete_headers = @headers.merge({ params: body })
+                   call(:delete, encode_uri(uri), timeout, delete_headers)
+                 when :delete_with_body
+                   call(:delete, encode_uri(uri), timeout, headers, body.to_json)
+                 when :post_file
+                   body.merge!(multipart: true)
+                   post_file_headers = headers.slice(*headers.keys - ['Content-Type'])
+                   call(:post, encode_uri(uri), timeout, post_file_headers, body)
+                 else
+                   call(method, encode_uri(uri), timeout, headers, body.to_json)
+                 end
+
+        case result.code
+        when 200...226 then safe_parse_json(result.body)
+        when 400       then raise Minty::BadRequest.new(result.body, code: result.code, headers: result.headers)
+        when 401       then raise Minty::Unauthorized.new(result.body, code: result.code, headers: result.headers)
+        when 403       then raise Minty::AccessDenied.new(result.body, code: result.code, headers: result.headers)
+        when 404       then raise Minty::NotFound.new(result.body, code: result.code, headers: result.headers)
+        when 429       then raise Minty::RateLimitEncountered.new(result.body, code: result.code,
+                                                                               headers: result.headers)
+        when 500       then raise Minty::ServerError.new(result.body, code: result.code, headers: result.headers)
+        else           raise Minty::Unsupported.new(result.body, code: result.code, headers: result.headers)
+        end
+      end
+
+      def call(method, url, timeout, headers, body = nil)
+        RestClient::Request.execute(
+          method: method,
+          url: url,
+          timeout: timeout,
+          headers: headers,
+          payload: body
+        )
+      rescue RestClient::Exception => e
+        case e
+        when RestClient::RequestTimeout
+          raise Minty::RequestTimeout, e.message
+        else
+          e.response
+        end
+      end
+    end
+  end
+end

data/lib/minty/mixins/initializer.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require 'json'
+
+module Minty
+  module Mixins
+    module Initializer
+      def initialize(config)
+        options = Hash[config.map { |(k, v)| [k.to_sym, v] }]
+
+        @base_uri = base_url(options)
+        @timeout = options[:timeout] || 10
+        @retry_count = options[:retry_count]
+
+        extend Minty::Api::AuthenticationEndpoints
+
+        @client_id = options[:client_id]
+        @client_secret = options[:client_secret]
+        @application_id = options[:application_id]
+        @organization = options[:organization]
+        @headers = client_headers(@client_id, @client_secret, @application_id)
+      end
+
+      def self.included(klass)
+        klass.send :prepend, Initializer
+      end
+
+      private
+
+      def base_url(options)
+        @domain = options[:domain] || options[:namespace]
+        raise InvalidApiNamespace, 'API namespace must supply an API domain' if @domain.to_s.empty?
+
+        "https://#{@domain}"
+      end
+    end
+  end
+end

data/lib/minty/mixins/validation.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require 'zache'
+
+class Zache
+  def last(key)
+    @hash[key][:value] if @hash.key?(key)
+  end
+end
+
+module Minty
+  module Mixins
+    module Validation
+      class JWTAlgorithm
+        private_class_method :new
+
+        def name
+          raise 'Must be overriden by the subclasses'
+        end
+      end
+
+      module Algorithm
+        class HS256 < JWTAlgorithm
+          class << self
+            private :new
+
+            def secret(secret)
+              new secret
+            end
+          end
+
+          attr_accessor :secret
+
+          def initialize(secret)
+            raise Minty::InvalidParameter, 'Must supply a valid secret' if secret.to_s.empty?
+
+            @secret = secret
+          end
+
+          def name
+            'HS256'
+          end
+        end
+
+        class RS256 < JWTAlgorithm
+          include Minty::Mixins::HTTPProxy
+
+          @@cache = Zache.new.freeze
+
+          class << self
+            private :new
+
+            def jwks_url(url, lifetime: 10 * 60)
+              new url, lifetime
+            end
+
+            def remove_jwks
+              @@cache.remove_by { true }
+            end
+          end
+
+          def initialize(jwks_url, lifetime)
+            raise Minty::InvalidParameter, 'Must supply a valid jwks_url' if jwks_url.to_s.empty?
+
+            unless lifetime.is_a?(Integer) && lifetime >= 0
+              raise Minty::InvalidParameter,
+                    'Must supply a valid lifetime'
+            end
+
+            @lifetime = lifetime
+            @jwks_url = jwks_url
+            @did_fetch_jwks = false
+          end
+
+          def name
+            'RS256'
+          end
+
+          def jwks(force: false)
+            result = fetch_jwks if force
+
+            if result
+              @@cache.put(@jwks_url, result, lifetime: @lifetime)
+              return result
+            end
+
+            previous_value = @@cache.last(@jwks_url)
+
+            @@cache.get(@jwks_url, lifetime: @lifetime, dirty: true) do
+              new_value = fetch_jwks
+
+              raise Minty::InvalidIdToken, 'Could not fetch the JWK set' unless new_value || previous_value
+
+              new_value || previous_value
+            end
+          end
+
+          def fetched_jwks?
+            @did_fetch_jwks
+          end
+
+          private
+
+          def fetch_jwks
+            result = request_with_retry(:get, @jwks_url, {}, {})
+            @did_fetch_jwks = result.is_a?(Hash) && result.key?('keys')
+            result if @did_fetch_jwks
+          end
+        end
+      end
+    end
+  end
+end

data/lib/minty/mixins.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require 'base64'
+require 'rest-client'
+require 'uri'
+
+require 'minty/mixins/api_token_struct'
+require 'minty/mixins/headers'
+require 'minty/mixins/httpproxy'
+require 'minty/mixins/initializer'
+require 'minty/mixins/validation'
+
+require 'minty/api/authentication_endpoints'
+require 'minty/api/v2'
+
+module Minty
+  # Collecting dependencies here
+  module Mixins
+    include Minty::Mixins::Headers
+    include Minty::Mixins::HTTPProxy
+    include Minty::Mixins::Initializer
+  end
+end

data/lib/minty/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Minty
+  VERSION = '1.0.0'
+end

data/lib/minty.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require 'minty/version'
+require 'minty/mixins'
+require 'minty/exception'
+require 'minty/algorithm'
+require 'minty/client'
+require 'minty_client'
+
+module Minty
+end

data/lib/minty_client.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+class MintyClient < Minty::Client
+end

data/minty.gemspec

@@ -0,0 +1,39 @@
+# -*- encoding: utf-8 -*-
+$LOAD_PATH.push File.expand_path('../lib', __FILE__)
+require 'minty/version'
+
+Gem::Specification.new do |s|
+  s.name        = 'minty'
+  s.version     = Minty::VERSION
+  s.authors     = ['Minty']
+  s.email       = ['support@minty.page']
+  s.homepage    = 'https://github.com/mintypage/ruby'
+  s.summary     = 'Minty API Client'
+  s.description = 'Ruby toolkit for Minty API https://minty.page'
+
+  s.files         = `git ls-files`.split("\n")
+  s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
+  s.executables   = `git ls-files -- bin/*`.split("\n").map { |f| File.basename(f) }
+  s.require_paths = ['lib']
+
+  s.add_runtime_dependency 'rest-client', '~> 2.1'
+  s.add_runtime_dependency 'jwt', '~> 2.5'
+  s.add_runtime_dependency 'zache', '~> 0.12'
+  s.add_runtime_dependency 'addressable', '~> 2.8'
+  s.add_runtime_dependency 'retryable', '~> 3.0'
+
+  s.add_development_dependency 'bundler'
+  s.add_development_dependency 'rake', '~> 13.0'
+  s.add_development_dependency 'fuubar', '~> 2.0'
+  s.add_development_dependency 'guard-rspec', '~> 4.5' unless ENV['CIRCLECI']
+  s.add_development_dependency 'dotenv-rails', '~> 2.0'
+  s.add_development_dependency 'pry', '~> 0.10'
+  s.add_development_dependency 'pry-nav', '~> 0.2'
+  s.add_development_dependency 'rspec', '~> 3.11'
+  s.add_development_dependency 'rack-test', '~> 0.6'
+  s.add_development_dependency 'rack', '~> 2.1'
+  s.add_development_dependency 'simplecov', '~> 0.9'
+  s.add_development_dependency 'faker', '~> 2.0'
+  s.add_development_dependency 'gem-release', '~> 0.7'
+  s.license = 'MIT'
+end

data/publish_rubygem.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+
+# Create directory for rubygems credentials
+mkdir /root/.gem
+# Get API key from rubygems.org
+curl -u "$RUBYGEMS_EMAIL":"$RUBYGEMS_PASSWORD" https://rubygems.org/api/v1/api_key.yaml > ~/.gem/credentials; chmod 0600 ~/.gem/credentials
+# Build Gem
+gem build minty.gemspec
+# Publish Gem
+gem push minty-*.gem

data/spec/integration/lib/minty/api/api_authentication_spec.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+describe Minty::Api::AuthenticationEndpoints do
+  attr_reader :client, :test_user_email, :test_user_pwd, :test_user
+
+  before(:all) do
+    @client = MintyClient.new(v2_creds)
+
+    @test_user_email = "#{entity_suffix}-username-1@minty.page"
+    @test_user_pwd = '23kejn2jk3en2jke2jk3be2jk3ber'
+
+    VCR.use_cassette('Minty_Api_AuthenticationEndpoints/create_test_user') do
+      @test_user ||= @client.signup(
+        test_user_email,
+        test_user_pwd
+      )
+    end
+  end
+
+  after(:all) do
+    VCR.use_cassette('Minty_Api_AuthenticationEndpoints/delete_test_user') do
+      @client.delete_user("minty|#{test_user['_id']}")
+    end
+  end
+
+  describe '.signup', vcr: true do
+    it 'should signup a new user' do
+      expect(test_user).to(include('_id', 'email'))
+    end
+
+    it 'should return the correct email address' do
+      expect(test_user['email']).to eq test_user_email
+    end
+  end
+
+  describe '.change_password', vcr: true do
+    it 'should trigger a password reset' do
+      expect(
+        @client.change_password(test_user_email, '')
+      ).to(include("We've just sent you an email to reset your password."))
+    end
+  end
+
+  describe '.saml_metadata', vcr: true do
+    it 'should retrieve SAML metadata' do
+      expect(@client.saml_metadata).to(include('<EntityDescriptor'))
+    end
+  end
+
+  describe '.wsfed_metadata', vcr: true do
+    it 'should retrieve WSFED metadata' do
+      expect(@client.wsfed_metadata).to(include('<EntityDescriptor'))
+    end
+  end
+
+  describe '.userinfo', vcr: true do
+    it 'should fail as not authorized' do
+      expect do
+        @client.userinfo('invalid_token')
+      end.to raise_error Minty::Unauthorized
+    end
+
+    it 'should return the userinfo' do
+      tokens = @client.login_with_resource_owner(test_user_email, test_user_pwd)
+      expect(@client.userinfo(tokens['access_token'])).to(
+        include('email' => test_user_email)
+      )
+    end
+  end
+
+  describe '.login_with_resource_owner', vcr: true do
+    it 'should fail with an incorrect email' do
+      expect do
+        @client.login_with_resource_owner(
+          "#{test_user['email']}_invalid",
+          test_user_pwd
+        )
+      end.to raise_error Minty::AccessDenied
+    end
+
+    it 'should fail with an incorrect password' do
+      expect do
+        @client.login_with_resource_owner(
+          test_user['email'],
+          "#{test_user_pwd}_invalid"
+        )
+      end.to raise_error Minty::AccessDenied
+    end
+
+    it 'should login successfully with a default scope' do
+      expect(
+        @client.login_with_resource_owner(
+          test_user['email'],
+          test_user_pwd
+        ).token
+      ).to_not be_empty
+    end
+
+    it 'should fail with an invalid audience' do
+      expect do
+        @client.login_with_resource_owner(
+          test_user['email'],
+          test_user_pwd,
+          scope: 'test:scope',
+          audience: 'https://brucke.club/invalid/api/v1/'
+        )
+      end.to raise_error Minty::BadRequest
+    end
+
+    it 'should login successfully with a custom audience' do
+      expect(
+        @client.login_with_resource_owner(
+          test_user['email'],
+          test_user_pwd,
+          scope: 'test:scope',
+          audience: 'https://brucke.club/custom/api/v1/'
+        ).token
+      ).to_not be_empty
+    end
+  end
+end

data/spec/integration/lib/minty/minty_client_spec.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+describe Minty::Client do
+  shared_examples 'invalid credentials' do |credentials, error|
+    it "raise an error with credentials #{credentials}" do
+      if error.nil?
+        expect { MintyClient.new(credentials) }.to raise_error
+      else
+        expect { MintyClient.new(credentials) }.to raise_error(error)
+      end
+    end
+  end
+
+  it_should_behave_like 'invalid credentials', {
+    namespace: 'samples.minty.page'
+  }, Minty::InvalidCredentials
+
+  it_should_behave_like 'invalid credentials', {
+    namespace: 'samples.minty.page', client_id: 'client_id'
+  }, Minty::InvalidCredentials
+
+  it_should_behave_like 'invalid credentials', {
+    namespace: 'samples.minty.page', client_secret: 'secret'
+  }, Minty::InvalidCredentials
+
+  it_should_behave_like 'invalid credentials', {
+    namespace: 'samples.minty.page', api_version: 2
+  }, Minty::InvalidCredentials
+
+  it_should_behave_like 'invalid credentials', {}, Minty::InvalidApiNamespace
+
+  it_should_behave_like 'invalid credentials', {
+    api_version: 2
+  }, Minty::InvalidApiNamespace
+
+  it_should_behave_like 'invalid credentials', {
+    api_version: 1
+  }, Minty::InvalidApiNamespace
+
+  it_should_behave_like 'invalid credentials', {
+    client_id: 'client_id', client_secret: 'secret'
+  }, Minty::InvalidApiNamespace
+
+  it_should_behave_like 'invalid credentials', {
+    api_version: 2, token: 'token'
+  }, Minty::InvalidApiNamespace
+
+  let(:v2_credentials) { { domain: 'test.minty.page' } }
+
+  shared_examples 'valid credentials' do
+    it { expect { MintyClient.new(credentials) }.to_not raise_error }
+  end
+
+  it_should_behave_like 'valid credentials' do
+    let(:credentials) { v2_credentials.merge(token: 'TEST_API_TOKEN') }
+  end
+
+  it_should_behave_like 'valid credentials' do
+    let(:credentials) { v2_credentials.merge(access_token: 'TEST_API_TOKEN') }
+  end
+
+  context 'client headers' do
+    let(:client) { Minty::Client.new(v2_credentials.merge(access_token: 'abc123', domain: 'myhost.minty.page')) }
+    let(:headers) { client.headers }
+    let(:telemetry) { JSON.parse(Base64.urlsafe_decode64(headers['Minty-Client'])) }
+
+    it 'has the correct headers present' do
+      expect(headers.keys.sort).to eql(%w[Minty-Client Authorization Content-Type])
+    end
+
+    it 'uses the correct access token' do
+      expect(headers['Authorization']).to eql 'Bearer abc123'
+    end
+
+    it 'is always json' do
+      expect(headers['Content-Type']).to eql 'application/json'
+    end
+
+    it 'should include the correct name in telemetry data' do
+      expect(telemetry['name']).to eq('ruby')
+    end
+
+    it 'should include the correct version in telemetry data' do
+      expect(telemetry['version']).to eq(Minty::VERSION)
+    end
+
+    it 'should include the correct env in telemetry data' do
+      expect(telemetry['env']['ruby']).to eq(RUBY_VERSION)
+    end
+  end
+end