omniauth-atproto 0.1.1 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e79046605d1235915ec27cb5f200e0744f1a645c630efcf5792b7ee3563d86f8
-  data.tar.gz: b36566fae3041251882c97e10c9d110fc5893edcf2da9e1f779d1c9aee525d42
+  metadata.gz: bc86c1376053df62fcdc24db7d18eb370727215726af22bb2780a6c36f4f85f3
+  data.tar.gz: 28c3f9a7e1240b04121e859e913f9feb21fe69394d3e745d6fe4960e71d3ed88
 SHA512:
-  metadata.gz: a2bffaa5781a042deb22166582c8d3d0301abee04eccd1c01ccfee320a5cd3af590a0e1a41e97e94a4e1e70b16bb3421ec5b7102334caf83f9421df76111a1e0
-  data.tar.gz: babee933a42f7d584dd7899aab66434d9b5c4438dc524ded0f4030b401bc1205a00d01547000787ede9835410fdaa52118b10ff6379f396e644080dd371da1e1
+  metadata.gz: 4941f9b4bf7355f2881a779210d65070311d920fa708e9afbb1201510c114d13c2c4d41fa9e55f6631795090d73062d446db42be816c6b4d33316057e73ce164
+  data.tar.gz: 60e567ef2f1fba250cf59211f2e9b1f174741103527f74c989dd2807236871ea513633c8d60bb36a793cf9d0e84bc9b4436d8c18ef25797a4eb5b3dd12fbd7f0

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 François Brault
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/lib/omniauth/strategies/atproto.rb

@@ -19,103 +19,54 @@ module OmniAuth
         }
       end
 
-      def request_phase
-        unless has_default_client_options?
-          @handle = request.params['handle']
-
-          unless @handle
-            fail!(:missing_handle,
-                  OmniAuth::Error.new(
-                    'Handle parameter is required if no client options are set'
-                  ))
+      def self.setup
+        lambda do |env|
+          session = env['rack.session']
+
+          if env['rack.request.form_hash'] && handle = env['rack.request.form_hash']['handle']
+            resolver = DIDKit::Resolver.new
+            did = resolver.resolve_handle(handle)
+
+            unless did
+              env['omniauth.strategy'].fail!(:unknown_handle,
+                                             OmniAuth::Error.new(
+                                               'Handle parameter did not resolve to a did'
+                                             ))
+            end
+
+            endpoint = resolver.resolve_did(did).pds_endpoint
+            auth_server = get_authorization_server(endpoint)
+            session['authorization_info'] = authorization_info = get_authorization_data(auth_server)
           end
 
-          set_client_options
+          if authorization_info ||= session.delete('authorization_info')
+            env['omniauth.strategy'].options['client_options']['site'] = authorization_info['issuer']
+            env['omniauth.strategy'].options['client_options']['authorize_url'] =
+              authorization_info['authorization_endpoint']
+            env['omniauth.strategy'].options['client_options']['token_url'] = authorization_info['token_endpoint']
+          end
         end
-        super
-      end
-
-      private
-
-      def has_default_client_options?
-        %i[site authorize_url token_url].all? { |k| options.client_options.key? k }
       end
 
-      def set_client_options
-        options.client_options[:site] = authorization_info['issuer']
-        options.client_options[:authorize_url] = authorization_info['authorization_endpoint']
-        options.client_options[:token_url] = authorization_info['token_endpoint']
-      end
+      option :setup, setup
 
-      def authorization_info
-        session['omniauth.auth_info'] ||= begin
-          resolver = DIDKit::Resolver.new
-          did = resolver.resolve_handle(@handle)
-          endpoint = resolver.resolve_did(did).pds_endpoint
-          auth_server = get_authorization_server(endpoint)
-          auth_info = get_authorization_data(auth_server)
-        end
-      end
+      private
 
       def build_access_token
-        set_client_options unless has_default_client_options?
-
-        new_token_params = token_params.merge(
-          {
-            grant_type: 'authorization_code',
-            redirect_uri: full_host + callback_path,
-            code: request.params['code'],
-            client_id: options.client_id,
-            client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
-            client_assertion: generate_client_assertion
-          }
-        )
-        dpop_handler = AtProto::DpopHandler.new(options.private_key)
-        response = dpop_handler.make_request(
-          client.token_url,
-          :post,
-          headers: { 'Content-Type' => 'application/json', 'Accept' => 'application/json' },
-          body: new_token_params
+        response = AtProto::Client.new(private_key: options.private_key).get_token!(
+          **token_params.merge({
+                                 code: request.params['code'],
+                                 jwk: options.client_jwk,
+                                 client_id: options.client_id,
+                                 redirect_uri: full_host + callback_path,
+                                 site: options.client_options.site,
+                                 endpoint: options.client_options.token_url
+                               }).to_h.symbolize_keys
         )
-
         ::OAuth2::AccessToken.from_hash(client, response)
       end
 
-      def generate_client_assertion
-        # Should return a JWT signed with the private key corresponding to the one in client-metadata.json
-
-        raise 'Client ID is required' unless options.client_id
-        raise 'Client JWK is required' unless options.client_jwk
-
-        private_key = if options.private_key.is_a?(String)
-                        OpenSSL::PKey::EC.new(options.private_key)
-                      elsif options.private_key.is_a?(OpenSSL::PKey::EC)
-                        options.private_key
-                      else
-                        raise 'Invalid private_key format'
-                      end
-        jwt_payload = {
-          iss: options.client_id,
-          sub: options.client_id,
-          aud: options.client_options.site,
-          jti: SecureRandom.uuid,
-          iat: Time.now.to_i,
-          exp: Time.now.to_i + 300
-        }
-
-        JWT.encode(
-          jwt_payload,
-          private_key,
-          'ES256',
-          {
-            typ: 'jwt',
-            alg: 'ES256',
-            kid: options.client_jwk[:kid]
-          }
-        )
-      end
-
-      def get_authorization_server(pds_endpoint)
+      def self.get_authorization_server(pds_endpoint)
         response = Faraday.get("#{pds_endpoint}/.well-known/oauth-protected-resource")
 
         unless response.success?
@@ -135,7 +86,7 @@ module OmniAuth
         auth_server
       end
 
-      def get_authorization_data(issuer)
+      def self.get_authorization_data(issuer)
         response = Faraday.get("#{issuer}/.well-known/oauth-authorization-server")
 
         unless response.success?

data/lib/omniauth-atproto/key_manager.rb

@@ -48,11 +48,11 @@ module OmniAuth
         def rotate_keys
           # Backup current keys if they exist
           if File.exist?(KEY_PATH)
-            # File.write(KEY_PATH, 'config/old_atproto_private_key.pem')
+            File.write(KEY_PATH, 'config/old_atproto_private_key.pem')
             FileUtils.rm(KEY_PATH)
           end
           if File.exist?(JWK_PATH)
-            # File.write(JWK_PATH, 'config/old_atproto_jwk.json')
+            File.write(JWK_PATH, 'config/old_atproto_jwk.json')
             FileUtils.rm(JWK_PATH)
           end
           load_or_generate_keys

data/lib/omniauth-atproto/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module Atproto
-    VERSION = '0.1.1'
+    VERSION = '0.1.3'
   end
 end

metadata

@@ -1,29 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-atproto
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.3
 platform: ruby
 authors:
 - frabr
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-11-29 00:00:00.000000000 Z
+date: 2024-12-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: atproto_client
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.1.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.1.4
 - !ruby/object:Gem::Dependency
   name: didkit
   requirement: !ruby/object:Gem::Requirement
@@ -129,6 +129,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- LICENSE
 - README.md
 - lib/omniauth-atproto.rb
 - lib/omniauth-atproto/key_manager.rb