nonnative 3.46.0 → 3.47.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b2d99335be2a92924498425cc447af35544eece2ba160547ef0ac240184cc0e2
-  data.tar.gz: 533de1c117bcb0f67cbcb5254afd291c35672d50dd6f6516a73d7fcd4195d431
+  metadata.gz: bc2bdb41b9c6411e257b89cb9a510170cde28cc454bac1680e1f0bfea546294c
+  data.tar.gz: f93f740ba3d1f67c299a392d2db7c31874c85331e935f0974f15e4e2094a85ef
 SHA512:
-  metadata.gz: 6e0a0b556b0ca9386c4d91117cb349ce0e4ea412fc5a578227ae6c43571ff23d62b0cedd11ac616b81d1ee7a5ccb895f285629eff30bf715460fdc42c27f2f50
-  data.tar.gz: 6382a115cf2b69785fba973c4c82e158cb583912480545ae6bce8a6746e767267350ca73348a96913e64dfb4229445361b3021fe297f601470c9152bee289c4b
+  metadata.gz: 50fd2d856178eaf96676746008cc4aa6477d3aee908a58c61375dc94e74675d3627c5020fd8125f1ba1ed15568d6dede9c1ae41efa2c5b0ac9e071e9f869d914
+  data.tar.gz: 40a613ee1b7553cecb51ef59d3834a14bfa15ba9659c8cdc41170f930be8d019a9c2147a40b01df83cbf35619ede80771cfb7266315d681477a2d580c9a22ea1

data/README.md

@@ -221,10 +221,9 @@ headers = Nonnative::Header.auth_bearer(
 )
 ```
 
-Supported `kind` values (all Ed25519, generation only):
+The supported `kind` is Ed25519 JWT generation only:
 
 - `jwt`: EdDSA JWT with the key id in the `kid` header. `private_key` is a PKCS#8 PEM file.
-- `paseto`: PASETO v4.public with the key id in a `{"kid":"..."}` footer. `private_key` is a PKCS#8 PEM file. Requires system **libsodium** (via `rbnacl`); it loads lazily, so `require 'nonnative'` works without libsodium until you generate a PASETO token.
 
 The audience is endpoint-scoped; build it with the helpers:
 

data/lib/nonnative/ed25519_key.rb

@@ -4,8 +4,7 @@ module Nonnative
   # Loads an Ed25519 private key from a PEM file for signing tokens.
   #
   # Verifiers such as go-service use Ed25519 keys encoded as PKCS#8 PEM. This reads the PEM once and
-  # exposes it in the shapes the token backends need: the raw PEM for {Nonnative::PasetoToken} and the
-  # 32-byte seed for {Nonnative::JwtToken}.
+  # exposes the 32-byte seed required by {Nonnative::JwtToken}.
   #
   # @example
   #   key = Nonnative::Ed25519Key.new('config/ed25519.pem')

data/lib/nonnative/token.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Nonnative
-  # Builds signed JWT or PASETO tokens for authenticating against services under test.
+  # Builds signed JWT tokens for authenticating against services under test.
   #
   # The consumer passes in the signing parameters they parsed from their own configuration; this class
   # is not coupled to any particular service's configuration format. The generated token string is
@@ -12,16 +12,8 @@ module Nonnative
   #                                private_key: 'config/ed25519.pem', expiration: 3600)
   #   header = Nonnative::Header.auth_bearer(token.generate(aud: 'GET /v1/things', sub: 'user-1'))
   #
-  # @example PASETO
-  #   token = Nonnative::Token.new(kind: 'paseto', issuer: 'iss', key: 'key-1',
-  #                                private_key: 'config/ed25519.pem', expiration: 3600)
-  #   token.generate(aud: Nonnative::Token.grpc_audience('/health.v1.Health/Check'), sub: 'user-1')
-  #
   # @see Nonnative::Header.auth_bearer
   class Token
-    # Supported token kinds mapped to their implementation.
-    KINDS = { 'jwt' => Nonnative::JwtToken, 'paseto' => Nonnative::PasetoToken }.freeze
-
     class << self
       # Builds the audience string for an HTTP endpoint.
       #
@@ -41,15 +33,16 @@ module Nonnative
       end
     end
 
-    # @param kind [String] token kind, one of `"jwt"` or `"paseto"`
+    # @param kind [String] token kind, `"jwt"`
     # @param issuer [String] the `iss` claim
-    # @param key [String] the key id (JWT `kid` header or PASETO `kid` footer)
+    # @param key [String] the key id (JWT `kid` header)
     # @param private_key [String] path to a PKCS#8 Ed25519 private key PEM file
     # @param expiration [Integer] token lifetime in seconds (drives `exp`)
     # @raise [ArgumentError] if the kind is not supported
     def initialize(kind:, issuer:, key:, private_key:, expiration:)
-      klass = KINDS.fetch(kind) { raise ArgumentError, "Unsupported token kind '#{kind}'" }
-      @token = klass.new(issuer: issuer, key: key, private_key: private_key, expiration: expiration)
+      raise ArgumentError, "Unsupported token kind '#{kind}'" unless kind == 'jwt'
+
+      @token = Nonnative::JwtToken.new(issuer: issuer, key: key, private_key: private_key, expiration: expiration)
     end
 
     # Generates a signed token.

data/lib/nonnative/version.rb

@@ -4,5 +4,5 @@ module Nonnative
   # The current gem version.
   #
   # @return [String]
-  VERSION = '3.46.0'
+  VERSION = '3.47.0'
 end

data/lib/nonnative.rb

@@ -52,7 +52,6 @@ require 'uri'
 require 'openssl'
 require 'json'
 require 'time'
-require 'singleton' # ruby-paseto depends on this stdlib, which Ruby no longer auto-loads
 
 require 'grpc'
 require 'grpc/health/v1/health_services_pb'
@@ -68,8 +67,6 @@ require 'rspec/wait'
 require 'puma'
 require 'puma/server'
 
-# jwt-eddsa (with the ed25519 gem) is pure Ruby and needs no system library, so it loads here.
-# PASETO's rbnacl needs system libsodium, so Nonnative::PasetoToken requires it lazily instead.
 require 'jwt/eddsa'
 
 require 'nonnative/version'
@@ -124,7 +121,6 @@ require 'nonnative/cucumber'
 require 'nonnative/header'
 require 'nonnative/ed25519_key'
 require 'nonnative/jwt_token'
-require 'nonnative/paseto_token'
 require 'nonnative/token'
 
 # The main namespace for the gem.
@@ -216,9 +212,9 @@ module Nonnative
     # The signing parameters are passed in directly; this is not coupled to any service's
     # configuration format. The generated token string is ready for {Nonnative::Header.auth_bearer}.
     #
-    # @param kind [String] token kind, one of `"jwt"` or `"paseto"`
+    # @param kind [String] token kind, `"jwt"`
     # @param issuer [String] the `iss` claim
-    # @param key [String] the key id (JWT `kid` header or PASETO `kid` footer)
+    # @param key [String] the key id (JWT `kid` header)
     # @param private_key [String] path to a PKCS#8 Ed25519 private key PEM file
     # @param expiration [Integer] token lifetime in seconds (drives `exp`)
     # @return [Nonnative::Token]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nonnative
 version: !ruby/object:Gem::Version
-  version: 3.46.0
+  version: 3.47.0
 platform: ruby
 authors:
 - Alejandro Falkowski
@@ -223,26 +223,6 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '9'
-- !ruby/object:Gem::Dependency
-  name: rbnacl
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '7'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '8'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '7'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '8'
 - !ruby/object:Gem::Dependency
   name: rest-client
   requirement: !ruby/object:Gem::Requirement
@@ -343,26 +323,6 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '2'
-- !ruby/object:Gem::Dependency
-  name: ruby-paseto
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '1'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '1'
 - !ruby/object:Gem::Dependency
   name: sinatra
   requirement: !ruby/object:Gem::Requirement
@@ -427,7 +387,6 @@ files:
 - lib/nonnative/no_proxy.rb
 - lib/nonnative/not_found_error.rb
 - lib/nonnative/observability.rb
-- lib/nonnative/paseto_token.rb
 - lib/nonnative/pool.rb
 - lib/nonnative/port.rb
 - lib/nonnative/ports.rb

data/lib/nonnative/paseto_token.rb

@@ -1,64 +0,0 @@
-# frozen_string_literal: true
-
-module Nonnative
-  # Generates Ed25519 PASETO v4.public tokens for authenticating against services under test.
-  #
-  # The key id is carried in a JSON footer (`{"kid":"..."}`), and the claims match the common
-  # iss/aud/sub/iat/nbf/exp/jti set expected by verifiers such as go-service. The signing library is
-  # required lazily so that requiring `nonnative` does not depend on `rbnacl`/libsodium being present.
-  #
-  # @example
-  #   paseto = Nonnative::PasetoToken.new(issuer: 'iss', key: 'key-1', private_key: 'config/ed25519.pem', expiration: 3600)
-  #   paseto.generate(aud: 'GET /v1/things', sub: 'user-1')
-  #
-  # @see https://github.com/bannable/paseto ruby-paseto
-  class PasetoToken
-    # @param issuer [String] the `iss` claim
-    # @param key [String] the key id carried in the `kid` footer
-    # @param private_key [String] path to a PKCS#8 Ed25519 private key PEM file
-    # @param expiration [Integer] token lifetime in seconds (drives `exp`)
-    def initialize(issuer:, key:, private_key:, expiration:)
-      @issuer = issuer
-      @key = key
-      @ed25519 = Nonnative::Ed25519Key.new(private_key)
-      @expiration = expiration
-    end
-
-    # Generates a signed PASETO v4.public token.
-    #
-    # @param aud [String] the `aud` claim (for example `"GET /v1/things"` or a gRPC full method)
-    # @param sub [String] the `sub` claim
-    # @param issued_at [Time, nil] overrides the `iat` claim (default: now)
-    # @param not_before [Time, nil] overrides the `nbf` claim (default: `issued_at`)
-    # @param expires_at [Time, nil] overrides the `exp` claim (default: `issued_at` plus `expiration`)
-    # @return [String] the signed PASETO token
-    def generate(aud:, sub:, issued_at: nil, not_before: nil, expires_at: nil)
-      load_dependencies!
-
-      now = (issued_at || Time.now).utc
-      claims = {
-        'iss' => @issuer,
-        'aud' => aud,
-        'sub' => sub,
-        'iat' => now.iso8601,
-        'nbf' => (not_before || now).utc.iso8601,
-        'exp' => (expires_at || (now + @expiration)).utc.iso8601,
-        'jti' => SecureRandom.uuid
-      }
-
-      Paseto::V4::Public.new(@ed25519.pem).encode!(claims, footer: { 'kid' => @key }.to_json)
-    end
-
-    private
-
-    # Loads the PASETO signing libraries lazily and raises a clear error if they are unavailable.
-    # rbnacl loads system libsodium at runtime, which the gemspec cannot guarantee, so requiring it
-    # here keeps `require 'nonnative'` working without libsodium for consumers that do not use PASETO.
-    def load_dependencies!
-      require 'rbnacl'
-      require 'paseto'
-    rescue LoadError => e
-      raise Nonnative::Error, "PASETO token generation requires libsodium and the rbnacl and ruby-paseto gems (#{e.message})"
-    end
-  end
-end