omniauth-auth0 3.1.1 → 3.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (35) hide show
  1. checksums.yaml +4 -4
  2. data/.github/CODEOWNERS +1 -1
  3. data/.github/actions/get-prerelease/action.yml +30 -0
  4. data/.github/actions/get-release-notes/action.yml +42 -0
  5. data/.github/actions/get-version/action.yml +21 -0
  6. data/.github/actions/release-create/action.yml +47 -0
  7. data/.github/actions/rl-scanner/action.yml +71 -0
  8. data/.github/actions/rubygems-publish/action.yml +30 -0
  9. data/.github/actions/setup/action.yml +28 -0
  10. data/.github/actions/tag-exists/action.yml +36 -0
  11. data/.github/dependabot.yml +13 -0
  12. data/.github/workflows/codeql.yml +53 -0
  13. data/.github/workflows/matrix.json +7 -0
  14. data/.github/workflows/publish.yml +33 -0
  15. data/.github/workflows/rl-scanner.yml +65 -0
  16. data/.github/workflows/ruby-release.yml +72 -0
  17. data/.github/workflows/snyk.yml +40 -0
  18. data/.github/workflows/test.yml +69 -0
  19. data/.shiprc +2 -1
  20. data/.version +1 -0
  21. data/CHANGELOG.md +10 -5
  22. data/Gemfile +1 -2
  23. data/Gemfile.lock +117 -84
  24. data/README.md +42 -1
  25. data/lib/omniauth/auth0/jwt_token.rb +38 -0
  26. data/lib/omniauth/auth0/jwt_validator.rb +2 -2
  27. data/lib/omniauth/strategies/auth0.rb +48 -14
  28. data/lib/omniauth-auth0/version.rb +1 -1
  29. data/omniauth-auth0.gemspec +1 -0
  30. data/spec/omniauth/auth0/jwt_token_spec.rb +87 -0
  31. data/spec/omniauth/strategies/auth0_spec.rb +478 -230
  32. metadata +39 -9
  33. data/.circleci/config.yml +0 -63
  34. data/.gemrelease +0 -2
  35. data/.github/workflows/semgrep.yml +0 -24
data/spec/omniauth/auth0/jwt_token_spec.rb ADDED
@@ -0,0 +1,87 @@
1
+ # frozen_string_literal: true
2
+
3
+ require 'spec_helper'
4
+ require 'json'
5
+ require 'jwt'
6
+
7
+ describe OmniAuth::Auth0::JWTToken do
8
+ let(:client_id) { 'CLIENT_ID' }
9
+ let(:domain_url) { 'https://samples.auth0.com' }
10
+ let(:client_assertion_signing_key) { OpenSSL::PKey::RSA.generate(2048) }
11
+
12
+ describe '#jwt_token' do
13
+ it 'generates a valid JWT token' do
14
+ uuid = '12345678-1234-5678-1234-567812345678'
15
+ allow(SecureRandom).to receive(:uuid).and_return(uuid)
16
+
17
+ jwt_token = described_class.new(client_id,
18
+ domain_url,
19
+ client_assertion_signing_key,
20
+ 'RS256')
21
+ .jwt_token
22
+ decoded_token = JWT.decode(jwt_token, client_assertion_signing_key, true, { algorithm: 'RS256' })
23
+
24
+ expect(decoded_token[0]['iss']).to eq(client_id)
25
+ expect(decoded_token[0]['sub']).to eq(client_id)
26
+ expect(decoded_token[0]['aud']).to eq("#{domain_url}/oauth/token")
27
+ expect(decoded_token[0]['iat']).to be_within(5).of(Time.now.utc.to_i)
28
+ expect(decoded_token[0]['exp']).to eq(decoded_token[0]['iat'] + 60)
29
+ expect(decoded_token[0]['jti']).to eq(uuid)
30
+ end
31
+
32
+ it 'defaults to RS256 algorithm if not specified' do
33
+ uuid = '12345678-1234-5678-1234-567812345678'
34
+ allow(SecureRandom).to receive(:uuid).and_return(uuid)
35
+
36
+ jwt_token = described_class.new(client_id, domain_url, client_assertion_signing_key).jwt_token
37
+ decoded_token = JWT.decode(jwt_token, client_assertion_signing_key, true, { algorithm: 'RS256' })
38
+
39
+ expect(decoded_token[0]['iss']).to eq(client_id)
40
+ expect(decoded_token[0]['sub']).to eq(client_id)
41
+ expect(decoded_token[0]['aud']).to eq("#{domain_url}/oauth/token")
42
+ expect(decoded_token[0]['iat']).to be_within(5).of(Time.now.utc.to_i)
43
+ expect(decoded_token[0]['exp']).to eq(decoded_token[0]['iat'] + 60)
44
+ expect(decoded_token[0]['jti']).to eq(uuid)
45
+ end
46
+
47
+ context 'when using ES256 algorithm' do
48
+ let(:client_assertion_signing_key) { OpenSSL::PKey::EC.generate('prime256v1') }
49
+
50
+ it 'generates a valid JWT token' do
51
+ uuid = '12345678-1234-5678-1234-567812345678'
52
+ allow(SecureRandom).to receive(:uuid).and_return(uuid)
53
+ jwt_token = described_class.new(client_id,
54
+ domain_url,
55
+ client_assertion_signing_key,
56
+ 'ES256')
57
+ .jwt_token
58
+ decoded_token = JWT.decode(jwt_token, client_assertion_signing_key, true, { algorithm: 'ES256' })
59
+
60
+ expect(decoded_token[0]['iss']).to eq(client_id)
61
+ expect(decoded_token[0]['sub']).to eq(client_id)
62
+ expect(decoded_token[0]['aud']).to eq("#{domain_url}/oauth/token")
63
+ expect(decoded_token[0]['iat']).to be_within(5).of(Time.now.utc.to_i)
64
+ expect(decoded_token[0]['exp']).to eq(decoded_token[0]['iat'] + 60)
65
+ expect(decoded_token[0]['jti']).to eq(uuid)
66
+ end
67
+
68
+ it 'accepts client_assertion_signing_key_token_params as a string' do
69
+ uuid = '12345678-1234-5678-1234-567812345678'
70
+ allow(SecureRandom).to receive(:uuid).and_return(uuid)
71
+ jwt_token = described_class.new(client_id,
72
+ domain_url,
73
+ client_assertion_signing_key,
74
+ 'ES256')
75
+ .jwt_token
76
+ decoded_token = JWT.decode(jwt_token, client_assertion_signing_key, true, { algorithm: 'ES256' })
77
+
78
+ expect(decoded_token[0]['iss']).to eq(client_id)
79
+ expect(decoded_token[0]['sub']).to eq(client_id)
80
+ expect(decoded_token[0]['aud']).to eq("#{domain_url}/oauth/token")
81
+ expect(decoded_token[0]['iat']).to be_within(5).of(Time.now.utc.to_i)
82
+ expect(decoded_token[0]['exp']).to eq(decoded_token[0]['iat'] + 60)
83
+ expect(decoded_token[0]['jti']).to eq(uuid)
84
+ end
85
+ end
86
+ end
87
+ end