moj-simple-jwt-auth 0.0.1 → 0.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '069216a49c032609b1b2d4bb2b9fa9841efb7ff086d6eabec5f5f3394be7c6f7'
-  data.tar.gz: 6d6571c76a08ca15844b6e3251f900f53fcdcf981b90f3a5509835b80acf4306
+  metadata.gz: bf8744635db729d18bf593eba9663a9ac97aec840d32979b5479c648cedadae3
+  data.tar.gz: 30179bd0b458b5d6d7fe549cae2011a411dfbe7817a8eca3f0ec75af4a65a39a
 SHA512:
-  metadata.gz: 1dfe076548da296f2233ae2b1103c01e5dad5940cbd6a2133b35258f41a24b36fe785681f940d191c57f3a1d92de96dbd968746a986f3e2a958e8150552644da
-  data.tar.gz: ff1c2a743a8f8d03c2a3f9d61cf8ba423e38fbd3b07847a85c7e78d5cd04c81c74615ee39baab1a3af233c87c87fb0651a9e95c873feb1336bbf4731d0aeb76e
+  metadata.gz: 815cdff869c192660599ca3df0e96fb2703ce5e2d23acf8d7ea3c36e1dd912383a1222da1e7bb7c782861f0bea71e7c4da8fdf5197b0ef9ecba60016633f1f3f
+  data.tar.gz: df82ee40efefc2d8a50aff0b632bc9330f8c2f6d6f3d353a4bdee7826beca8c7caaec96b1b24930b70b1eb32986fd661b6306b26d666aceb8be543594b52c6ff

data/README.md

@@ -36,6 +36,37 @@ For the **producer** side (the API service for instance) you will need to config
 
 There are several options you can configure, like expiration, leeway, logging, and more. Please refer to the [Configuration class](lib/simple_jwt_auth/configuration.rb) for more details.
 
+### Example of token
+
+This is a valid format token (might become invalid due to expiration at some point):
+
+`eyJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE2ODI1OTMwMzAsImV4cCI6MTY5ODQwNDU1NSwiaXNzIjoiY3JpbWUtYXBwbHkifQ.x2UE5VnwN5mf8elByPBnjiNChvsySqDjiLht6eN3ZPY`
+
+It has 3 parts, separated by dots, base64-encoded:
+
+1. Header (`eyJhbGciOiJIUzI1NiJ9`), containing the algorithm used. No other details are needed.
+    ```json
+    {
+      "alg": "HS256"
+    }
+    ```
+
+2. Payload (`eyJpYXQiOjE2ODI1OTMwMzAsImV4cCI6MTY5ODQwNDU1NSwiaXNzIjoiY3JpbWUtYXBwbHkifQ`), with some mandatory details.
+    ```json
+    {
+      "iat": 1682593030,
+      "exp": 1698404555,
+      "iss": "crime-apply"
+    }
+    ```
+   *iat* is the issued at seconds since epoch, *exp* is the expire at seconds since epoch, and finally *iss* is the issuer identifier or the name of the consumer to whom this token belongs.
+
+3. Signature (`x2UE5VnwN5mf8elByPBnjiNChvsySqDjiLht6eN3ZPY`)
+
+   To create the signature part you have to take the encoded header, the encoded payload, a secret, the algorithm specified in the header, and sign that.
+
+The token must be included in each request, in an Authorization header (bearer).
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `bundle exec rake` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.

data/lib/simple_jwt_auth/errors.rb

@@ -2,7 +2,10 @@
 
 module SimpleJwtAuth
   module Errors
-    class UndefinedIssuer < StandardError; end
-    class UnknownIssuer < StandardError; end
+    class Forbidden < StandardError; end
+    class IssuerError < StandardError; end
+
+    class UndefinedIssuer < IssuerError; end
+    class UnknownIssuer < IssuerError; end
   end
 end

data/lib/simple_jwt_auth/middleware/grape/authorisation.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module SimpleJwtAuth
+  module Middleware
+    module Grape
+      class Authorisation < ::Grape::Middleware::Base
+        def before
+          return if test_env? || consumer_authorised?
+
+          raise SimpleJwtAuth::Errors::Forbidden,
+                "access to endpoint forbidden for issuer `#{current_issuer}`"
+        end
+
+        private
+
+        def test_env?
+          env['rack.test'] == true
+        end
+
+        def consumer_authorised?
+          route_authorised_consumers.include?(current_issuer) ||
+            route_authorised_consumers.include?('*')
+        end
+
+        def route_authorised_consumers
+          context.route.settings.fetch(:authorised_consumers, [])
+        end
+
+        def current_issuer
+          env.fetch(Jwt::ENV_PAYLOAD_KEY, {})['iss']
+        end
+      end
+    end
+  end
+end

data/lib/simple_jwt_auth/middleware/grape/jwt.rb

@@ -7,6 +7,7 @@ module SimpleJwtAuth
         ENV_AUTH_KEY = 'HTTP_AUTHORIZATION'
         ENV_PAYLOAD_KEY = 'grape_jwt.payload'
 
+        # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
         def call(env)
           return app.call(env) if test_env?(env)
 
@@ -19,12 +20,18 @@ module SimpleJwtAuth
             logger.debug "Authorized request, JWT payload: #{payload}"
 
             app.call(env)
+          rescue SimpleJwtAuth::Errors::Forbidden => e
+            logger.warn "JWT issuer forbidden: #{e.message}"
+            rack_response(403, e.message)
+          rescue SimpleJwtAuth::Errors::IssuerError => e
+            logger.warn "JWT issuer error: #{e.message}"
+            rack_response(400, e.message)
           rescue JWT::DecodeError => e
             logger.warn "Unauthorized request, JWT error: #{e.message}"
-
-            [401, { 'Content-Type' => 'application/json' }, [{ status: 401, error: e.message }.to_json]]
+            rack_response(401, e.message)
           end
         end
+        # rubocop:enable Metrics/AbcSize, Metrics/MethodLength
 
         private
 
@@ -32,6 +39,10 @@ module SimpleJwtAuth
           env['rack.test'] == true
         end
 
+        def rack_response(http_code, error_msg)
+          [http_code, { 'Content-Type' => 'application/json' }, [{ error: error_msg }.to_json]]
+        end
+
         def logger
           SimpleJwtAuth.configuration.logger
         end

data/lib/simple_jwt_auth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SimpleJwtAuth
-  VERSION = '0.0.1'
+  VERSION = '0.1.0'
 end

data/lib/simple_jwt_auth.rb

@@ -17,6 +17,7 @@ require_relative 'simple_jwt_auth/decode'
 # Middleware helpers
 require_relative 'simple_jwt_auth/middleware/faraday/jwt' if defined?(Faraday)
 require_relative 'simple_jwt_auth/middleware/grape/jwt' if defined?(Grape)
+require_relative 'simple_jwt_auth/middleware/grape/authorisation' if defined?(Grape)
 
 module SimpleJwtAuth
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: moj-simple-jwt-auth
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.1.0
 platform: ruby
 authors:
 - Jesus Laiz
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-02-14 00:00:00.000000000 Z
+date: 2023-04-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json
@@ -62,6 +62,7 @@ files:
 - lib/simple_jwt_auth/encode.rb
 - lib/simple_jwt_auth/errors.rb
 - lib/simple_jwt_auth/middleware/faraday/jwt.rb
+- lib/simple_jwt_auth/middleware/grape/authorisation.rb
 - lib/simple_jwt_auth/middleware/grape/jwt.rb
 - lib/simple_jwt_auth/secrets.rb
 - lib/simple_jwt_auth/traits/configurable.rb