model_driven_api 3.12.1 → 3.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d5800c6dfa89319961ee6e9eca0e4ff3b54a574cedaff13d18f4ae945ac5055e
-  data.tar.gz: 98d7d1a5b3e9433e1fb96ccea1c38b0c95ab52c00abb8e61538ab2258ea09f8d
+  metadata.gz: 9fcc02687ce88ff1cc47523ddd04f9d1a7c4918d40c2f2765d59f19a1697c0dd
+  data.tar.gz: 2eb8c0586bbbdaed24d44d5c8de670ff5339df53c7d6609eedcb8559cc49e16a
 SHA512:
-  metadata.gz: 6b5334f7a1bd60a0001a04ab1a527da8f590943f842e1317740290f4bda58e4f5738cc97a0bf5223f54233e4c73d9c64f94b969f037a451699220b0f9bcf89a0
-  data.tar.gz: e39b9f18881d5e3c6c497af9d6e73b508db68f04ea6c0dee1f4afd619b8568b7ea0a20f72bf972b6762b4177ffd19cdd3f2f3ddcd2ba2c13df96aea84d5abcfe
+  metadata.gz: c48fa599733f52da66626b80067df10d3cb223c3f950a3f3e4f62afe104e50f5b93778cf228b95b89268227b811e74e3b10455fd8d8a3cff0f9d8b8d0f1caf5b
+  data.tar.gz: bb50aa93d2b0ce0616e8128b9634b6e38e7fd066bb8fd7a0dba61429000dbf3d125b49930273ebe333126f8ee1104d922cf78eec8f4db6d946cb3f47768d8708

data/app/controllers/api/v2/auth/oauth_controller.rb

@@ -1,7 +1,15 @@
 module Api::V2::Auth
   class OauthController < ActionController::API
+    # L'identità arriva solo da request.env['omniauth.auth'], che il middleware OmniAuth imposta
+    # dopo aver verificato il login col provider; mai dai parametri della richiesta, che chiunque
+    # può inviare (fino alla 3.12.1 bastava una POST con email= per avere il JWT di quell'utente).
     def callback
-      user = ThecoreAuthCommons.check_user params['email'], params['given_name'], params['family_name'], params['provider']
+      auth = request.env['omniauth.auth']
+      info = auth&.info
+      user = info && ThecoreAuthCommons.check_user(info.email,
+                                                   info.first_name.presence || info.name,
+                                                   info.last_name,
+                                                   auth.provider)
 
       unless user
         render json: { error: "User not registered" }, status: :unauthorized

data/config/routes.rb

@@ -3,8 +3,9 @@
 Rails.application.routes.draw do
   scope ENV.fetch("RAILS_RELATIVE_URL_ROOT", "/") do
     if ThecoreAuthCommons.oauth_vars?
-      # OmniAuth callbacks need these top-level paths:
-      match "/auth/:provider/callback", to: redirect("/api/v2/auth/%{provider}/callback"), via: [:get, :post]
+      # OmniAuth callbacks need these top-level paths. The callback goes straight to the controller:
+      # a redirect would drop the verified request.env['omniauth.auth'] the middleware has just set.
+      match "/auth/:provider/callback", to: "api/v2/auth/oauth#callback", via: [:get, :post], defaults: { format: :json }
       match "/auth/failure", to: redirect("/api/v2/auth/failure"), via: [:get, :post]
     end
     namespace :api, constraints: { format: :json } do

data/lib/json_web_token.rb

@@ -1,21 +1,44 @@
 class JsonWebToken
   class << self
     def encode(payload, expiry = ENV.fetch('SESSION_TIMEOUT_IN_MINUTES', 31).to_i.minutes.from_now.to_i)
-      result = ::JWT.encode(payload.merge(exp: expiry), ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])
+      result = ::JWT.encode(payload.merge(exp: expiry), signing_key)
       # Store the created token into the DB for later checks if is invalid
       # In a public environment management, without login, it has no interest, so I don't pollute the DB
       UsedToken.find_or_create_by(token: result, user_id: payload[:user_id]) if ENV["ALLOW_MULTISESSIONS"] == "false"
       result
     end
-    
+
     def decode(token)
-      # Check if the passed token is present and valid into the UsedToken 
+      # Check if the passed token is present and valid into the UsedToken
       raise "Token is invalidated by new login" if !UsedToken.exists?(token: token, is_valid: true) && ENV["ALLOW_MULTISESSIONS"] == "false"
-      body = ::JWT.decode(token, ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])[0]
+      body = verified_payload(token)
       Rails.logger.debug "JsonWebToken: decode -> body -> #{body}"
       ::HashWithIndifferentAccess.new body
     # rescue
     #   nil
     end
+
+    private
+
+    def signing_key
+      ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"]
+    end
+
+    # After a SECRET_KEY_BASE rotation, a token signed with the previous key is still accepted until
+    # SECRET_KEY_BASE_PREVIOUS_EXPIRES_AT (ISO 8601), so app users never log in again: every authenticated
+    # response renews the token with the current key. The previous key may be public, so it is never
+    # trusted without an expiry, and only a bad signature falls back to it (an expired token stays expired).
+    def verified_payload(token)
+      ::JWT.decode(token, signing_key)[0]
+    rescue ::JWT::VerificationError
+      previous = previous_signing_key or raise
+      ::JWT.decode(token, previous)[0]
+    end
+
+    def previous_signing_key
+      key = ENV["SECRET_KEY_BASE_PREVIOUS"].presence or return
+      expires_at = Time.iso8601(ENV["SECRET_KEY_BASE_PREVIOUS_EXPIRES_AT"].to_s) rescue nil
+      key if expires_at && Time.current < expires_at
+    end
   end
-end
+end

data/lib/model_driven_api/version.rb

@@ -1,3 +1,3 @@
 module ModelDrivenApi
-  VERSION = "3.12.1".freeze
+  VERSION = "3.13.0".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 3.12.1
+  version: 3.13.0
 platform: ruby
 authors:
 - Gabriele Tassoni