omniauth-aitu-passport 0.1.24 → 0.1.26

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7a58e50932132dada555e296ab35d8164105768c7aed6f411315705cb13a6183
-  data.tar.gz: 63e2743ae7099c59911bd5518e023fabda97982ab8d680285e2395aa2f755b56
+  metadata.gz: ed9f43131e0356fa3011a05bb6c8928943718ffe2716426a04051f9ea2805cd9
+  data.tar.gz: 8dadf7133bc547aa229fe6e736825b79659f16bcbbdb892aa02ffd39b137f3d1
 SHA512:
-  metadata.gz: 1772e65d6e68a2a25c6bbae50491b0a77d5696a04f4895e4ba16a4748b0ec0e1ede16fe14a4169503f054c6b1aeefcfa622b29b8332f1e5fbec7b771c9b2f28a
-  data.tar.gz: 4aba6961aa2168b0d80812b80b8d31b0e9a85923b09c786c904f13668af7dea2f2c358ad0eda013fb86147bf69d94f3f6d1d448f0c127da8fe27012d88eda11e
+  metadata.gz: 483dfd398af835545691c9efe60ffa11f45e6f6040fe047fd774f6a419707aeef7fb2c91a0506a70d837882fefad623e5efa262bf32239e378ab848f78bc4b65
+  data.tar.gz: b62d08dadc3a9537e51310f725b607ddd1fd7b30a80580bed692c90b27aa8b480255f7b1096a53861bf3154785594f05c6b585c681c1a73688dac65c94b27ef8

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+# v 0.1.25
+
+Added: 
+- id_token: support with JWT verification
+
+
 # v 0.1.24
 
 Added:

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    omniauth-aitu-passport (0.1.23)
+    omniauth-aitu-passport (0.1.25)
       oauth2 (~> 1.4.7)
       omniauth (~> 1)
       omniauth-oauth2 (~> 1)

data/lib/omniauth/aitu_passport/version.rb

@@ -2,6 +2,6 @@
 
 module OmniAuth
   module AituPassport
-    VERSION = '0.1.24'
+    VERSION = '0.1.26'
   end
 end

data/lib/omniauth/strategies/aitu_passport.rb

@@ -3,6 +3,7 @@
 require 'omniauth'
 require 'oauth2'
 require 'omniauth-oauth2'
+require 'jwt'
 
 module OmniAuth
   module Strategies
@@ -19,6 +20,7 @@ module OmniAuth
       }
 
       option :pkce, true
+      option :jwt_leeway, 60
 
       AVAILABLE_SCOPE_OPTIONS = %w[
         openid
@@ -46,6 +48,8 @@ module OmniAuth
 
       DEFAULT_SCOPE = 'openid phone'
 
+      ALLOWED_ISS = %w[https://passport.stage.supreme-team.tech https://passport.aitu.io].freeze
+
       uid { raw_info['openid'] }
 
       info do
@@ -59,9 +63,31 @@ module OmniAuth
       end
 
       extra do
-        {
-          'raw_info' => raw_info
-        }
+        hash = {}
+        hash[:id_token] = access_token['id_token']
+        if !options[:skip_jwt] && !access_token['id_token'].nil?
+          decoded = ::JWT.decode(access_token['id_token'], nil, false).first
+
+          # We have to manually verify the claims because the third parameter to
+          # JWT.decode is false since no verification key is provided.
+          ::JWT::Verify.verify_claims(decoded,
+                                      verify_iss: true,
+                                      iss: ALLOWED_ISS,
+                                      verify_aud: true,
+                                      aud: options.client_id,
+                                      verify_sub: false,
+                                      verify_expiration: true,
+                                      verify_not_before: true,
+                                      verify_iat: false,
+                                      verify_jti: false,
+                                      leeway: options[:jwt_leeway])
+
+          hash[:id_info] = decoded
+        end
+        hash[:raw_info] = raw_info unless skip_info?
+
+        # returning resulting hash
+        hash
       end
 
       # Omniauth::Strategy

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-aitu-passport
 version: !ruby/object:Gem::Version
-  version: 0.1.24
+  version: 0.1.26
 platform: ruby
 authors:
 - Yaroslav Shevchenko
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-03-30 00:00:00.000000000 Z
+date: 2022-04-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: oauth2