omniauth-authify 0.1.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: b98af8a5b5ebd4d40b6c6ee05742ae7716a32180b9b562911f1b33ab89415aa1
+  data.tar.gz: 9951fafe6fcfa93723ef89916dc608f21a2fba12350b2a33ed28d820b0052e63
+SHA512:
+  metadata.gz: 110354e211dca1c4123f483b067a23d5b93b62f2fabb2d645db988f6023d1c894778aaff46e66696219d06a1be886c4c1b395645e7dc389847d33035d8167b9a
+  data.tar.gz: a6684f67a7eb0e1bd55f8fbb4f416f9ee4ae483ce82998c84e1eae958f10c514e1273c20b980c834eff9a14f0fc2961273a9b740a0beb20ef1e0679042d4030f

data/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.1.1"
+}

data/.rspec

@@ -0,0 +1,3 @@
+--format documentation
+--color
+--require spec_helper

data/.rubocop.yml

@@ -0,0 +1,94 @@
+plugins:
+- rubocop-rake
+- rubocop-rspec
+
+Layout/LineLength:
+  Max: 100
+
+AllCops:
+  TargetRubyVersion: 3.4
+  Exclude:
+  - 'vendor/**/*'
+  NewCops: enable
+
+Metrics/AbcSize:
+  Max: 21
+  Exclude:
+  - 'spec/support/*'
+
+Metrics/BlockLength:
+  Max: 35
+  Exclude:
+  - 'spec/**/*_spec.rb'
+  - 'spec/support/*.rb'
+  - 'Rakefile'
+  - '*.gemspec'
+
+Metrics/CyclomaticComplexity:
+  Max: 12
+
+Metrics/MethodLength:
+  Max: 25
+
+Metrics/ModuleLength:
+  Max: 160
+  Exclude:
+  - 'spec/**/*_spec.rb'
+
+Metrics/ClassLength:
+  Max: 300
+  Exclude:
+  - 'spec/**/*_spec.rb'
+
+Metrics/ParameterLists:
+  Max: 6
+  Exclude:
+  - 'spec/support/*'
+
+Gemspec/RequireMFA:
+  Enabled: false
+
+Gemspec/DevelopmentDependencies:
+  Enabled: false
+
+Style/MixinUsage:
+  Exclude:
+  - "bin/console"
+
+Style/StringLiterals:
+  Enabled: true
+  EnforcedStyle: double_quotes
+
+Style/StringLiteralsInInterpolation:
+  Enabled: true
+  EnforcedStyle: double_quotes
+
+Style/StringConcatenation:
+  Exclude:
+  - 'Rakefile'
+
+Naming/FileName:
+  Exclude:
+  - 'lib/omniauth-authify.rb'
+
+RSpec/SpecFilePathFormat:
+  CustomTransform:
+    OmniAuth: omni_auth
+
+# The smoke harness (spec/smoke) is standalone tooling driven by bash and
+# ruby-one-offs, not an RSpec suite; treat it as regular Ruby.
+RSpec:
+  Exclude:
+  - 'spec/smoke/**/*'
+
+RSpec/NamedSubject:
+  Enabled: false
+
+RSpec/MultipleMemoizedHelpers:
+  Max: 12
+
+RSpec/MultipleExpectations:
+  Max: 13
+
+RSpec/ExampleLength:
+  Max: 40

data/.ruby-version

@@ -0,0 +1 @@
+3.4.10

data/.tool-versions

@@ -0,0 +1 @@
+ruby 3.4.10

data/.yardopts

@@ -0,0 +1,5 @@
+--no-private
+--exclude sig
+-
+CHANGELOG.md
+LICENSE.txt

data/AGENTS.md

@@ -0,0 +1,51 @@
+# AGENTS.md
+
+Guidelines for AI agents and automated tools working in this repository.
+
+## Project Overview
+
+omniauth-authify is an [OmniAuth](https://github.com/omniauth/omniauth) strategy for
+[Authify](https://github.com/authify/authify), a self-hosted, multi-tenant identity provider.
+It implements the OpenID Connect authorization code flow with PKCE and verifies ID tokens
+against the organization's JWKS.
+
+- **Language**: Ruby 3.4+ (via asdf, see `.tool-versions` / `.ruby-version`)
+- **Framework**: OmniAuth 2.x strategy built on omniauth-oauth2 / oauth2
+- **Testing**: RSpec with WebMock
+- **Docs**: YARD
+- **Linting**: RuboCop (rubocop-rake, rubocop-rspec)
+- **Releases**: Automated via release-please on push to `main`
+
+## Quality Gates
+
+All four must pass before opening a PR. These run in CI (`.github/workflows/ci.yml`):
+
+```bash
+bundle exec rubocop          # Style/lint
+bundle exec rake spec        # Unit tests
+bundle exec rake rbs         # Signature validation (sig/**/*.rbs)
+bundle exec rake yard        # YARD documentation generation
+```
+
+## Constraints
+
+- **Do not edit** `lib/omniauth/authify/version.rb` or `CHANGELOG.md`. These are managed by release-please.
+- **Do not add runtime dependencies** without explicit justification. The gemspec is deliberately curated.
+- **Do not suppress RuboCop cops inline** without a stated reason. Fix the code or adjust `.rubocop.yml` if a project-wide change is warranted.
+- **Security-critical areas** — Changes to `lib/omniauth/authify/jwt_validator.rb`, nonce/PKCE handling, or any signature/claim verification logic must include test coverage for both success and failure paths.
+- **Respect existing structure** — The strategy lives in `lib/omniauth/strategies/authify.rb`; supporting classes live under `lib/omniauth/authify/`.
+
+## Conventions
+
+- **Conventional Commits** — `feat:`, `fix:`, `docs:`, `refactor:`, `test:`, `chore:`. Release-please generates changelogs from commit messages, so this is functional, not cosmetic.
+- **Double-quoted strings** — Enforced by `.rubocop.yml` (`Style/StringLiterals`).
+- **100-character line length** — Enforced by RuboCop (`Layout/LineLength`).
+- **Ruby 3.4 target** — Use modern Ruby syntax; don't add compatibility shims for older versions.
+
+## Workflow
+
+1. **Plan before code.** Produce a design or plan before writing implementation code.
+2. **Tests first.** Write or update tests before or alongside implementation.
+3. **Minimal viable output.** Produce focused artifacts with clear structure. Don't over-engineer or add scope beyond the task.
+4. **Run all quality gates** before declaring work complete.
+5. **Respect project boundaries** defined in this file and in `CONTRIBUTING.md`.

data/CHANGELOG.md

@@ -0,0 +1,17 @@
+## [Unreleased]
+
+## [0.1.1](https://github.com/authify/omniauth-authify/compare/omniauth-authify-v0.1.0...omniauth-authify/v0.1.1) (2026-08-30)
+
+
+### Features
+
+* initial release of the omniauth-authify strategy ([73b3aaa](https://github.com/authify/omniauth-authify/commit/73b3aaa199d826365f304da5f84aeea2710b5966))
+
+
+### Bug Fixes
+
+* **ci:** correct dead failure-path assertion and rate-limit flakiness ([a0ac070](https://github.com/authify/omniauth-authify/commit/a0ac07098bde3b5b489801bf8e2c5323db7583ae))
+
+## [0.1.0] - 2026-08-29
+
+- Initial release

data/CODE_OF_CONDUCT.md

@@ -0,0 +1,74 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, gender identity and expression, level of experience,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at [http://contributor-covenant.org/version/1/4][version]
+
+[homepage]: http://contributor-covenant.org
+[version]: http://contributor-covenant.org/version/1/4/

data/CONTRIBUTING.md

@@ -0,0 +1,45 @@
+# Contributing
+
+## How to Contribute Code
+
+I'm so glad you're reading this, because we need volunteer developers to help this project grow and thrive!
+
+Before you begin, ensure that your contribution is associated with a [GitHub issue](https://github.com/authify/omniauth-authify/issues). If there isn't an existing issue, please create one.
+
+1. Fork the repository
+2. Create a new branch (`git checkout -b feature-branch`)
+3. Commit your changes (`git commit -am 'Add some feature'`)
+4. Push to the branch (`git push origin feature-branch`)
+5. Create a new [Pull Request](http://help.github.com/pull-requests/)
+
+## Testing
+
+Please make sure that your code passes the existing tests and add tests for any new functionality. Please write [RSpec](https://rspec.info/) examples for new features you add or modify.
+
+To execute the tests, run `bundle exec rake spec`.
+
+## Coding Style
+
+This project uses [Rubocop](https://rubocop.org/) to enforce a consistent coding style. Please make sure that your code passes the Rubocop checks.
+
+To execute Rubocop, run `bundle exec rake rubocop`.
+
+## Documentation
+
+Please make sure that your code is well documented. If you add new features, please add documentation for them. This project uses [YARD](https://yardoc.org/) for documentation, so please add YARD tags to your code when appropriate.
+
+To generate the documentation locally, run `bundle exec rake yard`.
+
+## Security
+
+Since this gem sits in an authentication path, treat security issues with care: signature verification, claim validation, nonce handling, and PKCE logic changes should always include test coverage for both the success and failure paths.
+
+Please report security vulnerabilities privately to the maintainers rather than opening a public issue.
+
+## License
+
+By contributing your code, you agree to license your contribution under the terms of the [MIT License](LICENSE.txt).
+
+## Code of Conduct
+
+By participating in this project, you agree to abide by our [Code of Conduct](CODE_OF_CONDUCT.md).

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 Jonathan Gnagy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,123 @@
+# OmniAuth::Authify
+
+An [OmniAuth](https://github.com/omniauth/omniauth) strategy for
+[Authify](https://github.com/authify/authify), a self-hosted, open-source,
+multi-tenant identity provider implementing OpenID Connect on top of
+OAuth 2.0.
+
+The strategy implements the OpenID Connect authorization code flow with
+PKCE (S256), verifies the returned ID token's signature against the
+organization's published JWKS, and validates the standard ID token claims
+including the per-login nonce.
+
+## Installation
+
+```bash
+gem install omniauth-authify
+```
+
+or in your `Gemfile`:
+
+```ruby
+gem "omniauth-authify"
+```
+
+## Usage
+
+Because Authify is multi-tenant, both the server base URL (`:site`) and the
+`:organization` slug are required. Register an OAuth2 application for your
+client in the Authify dashboard (or via the Management API), then configure
+the provider with its `client_id` and `client_secret`.
+
+### Rails (Devise or plain OmniAuth)
+
+```ruby
+# config/initializers/omniauth.rb
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider :authify,
+           ENV["AUTHIFY_CLIENT_ID"],
+           ENV["AUTHIFY_CLIENT_SECRET"],
+           site: "https://authify.example.com",
+           organization: "my-org"
+end
+```
+
+### Sinatra
+
+```ruby
+require "omniauth-authify"
+
+use OmniAuth::Builder do
+  provider :authify, ENV["AUTHIFY_CLIENT_ID"], ENV["AUTHIFY_CLIENT_SECRET"],
+           site: "https://authify.example.com", organization: "my-org"
+end
+```
+
+Note that OmniAuth 2.x only accepts POST requests to `/auth/:provider` by
+default; use something like `omniauth-rails_csrf_protection` in Rails apps.
+
+## Options
+
+| Option | Default | Description |
+| --- | --- | --- |
+| `site` | — | **Required.** Base URL of the Authify server |
+| `organization` | — | **Required.** Organization slug within Authify |
+| `scope` | `openid profile email` | Requested scopes. `openid` is required for ID token issuance |
+| `pkce` | `true` | Use the authorization code flow with PKCE (S256) |
+| `verify_id_token` | `true` | Verify the ID token signature (via the org JWKS) and claims |
+| `leeway` | `60` | Clock skew allowance (seconds) when validating time claims |
+| `client_options` | `{}` | Passed through to the underlying `OAuth2::Client` |
+
+## Auth Hash
+
+The strategy exposes the standard OmniAuth auth hash:
+
+```ruby
+{
+  provider: "authify",
+  uid: "12345678",            # the user's immutable `sub` claim
+  info: {
+    name: "Jane User",
+    email: "jane@example.com",
+    image: "https://…/avatar.png",
+    nickname: "jane@example.com",
+    first_name: "Jane",
+    last_name: "User",
+    location: "America/Chicago",
+    phone: "+15551234567",
+    urls: { website: "https://example.com/jane" }
+  },
+  credentials: {
+    token: "ACCESS_TOKEN",
+    refresh_token: "REFRESH_TOKEN",
+    expires_at: 1700000000,
+    expires: true,
+    id_token: "eyJhbGciOiJSUzI1NiIs…"
+  },
+  extra: {
+    raw_info: { … },   # verified ID token claims (or userinfo response)
+    id_info: { … }     # verified ID token claims, when verification is enabled
+  }
+}
+```
+
+## Authify application setup
+
+1. Sign in to your Authify organization and create an OAuth2 application.
+2. Register your client's callback URL (e.g.
+   `https://your.app/auth/authify/callback`) as an allowed redirect URI.
+3. Grant the application at least the `openid` scope (plus `profile`,
+   `email`, `groups`, or `phone` as needed).
+
+Contributing
+------------
+
+If you're interested in contributing, please see the
+[Contributing Guide](CONTRIBUTING.md) in the repository! Be sure to check out
+the [Code of Conduct](CODE_OF_CONDUCT.md) as well!
+
+License
+-------
+
+The gem is available as open source under the terms of the
+[MIT License](https://opensource.org/licenses/MIT).

data/Rakefile

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+ENV["RACK_ENV"] ||= "test"
+
+require "bundler/gem_tasks"
+require "rspec/core/rake_task"
+require "rubocop/rake_task"
+require "yard"
+
+RSpec::Core::RakeTask.new(:spec)
+RuboCop::RakeTask.new
+YARD::Rake::YardocTask.new
+
+desc "Validate the RBS signatures in sig/"
+task :rbs do
+  sh "bundle exec rbs -r net-http -I sig validate"
+end
+
+desc "Run a walkthrough console with the strategy loaded"
+task :console do
+  exec "bundle exec irb -I lib -r omniauth-authify"
+end
+
+task default: %i[spec rubocop rbs yard]

data/lib/omniauth/authify/errors.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module OmniAuth
+  module Authify
+    # Raised for configuration errors within the strategy itself
+    class ConfigurationError < StandardError; end
+
+    # Raised when an Authify-issued ID token (or the signing keys used to
+    # verify it) cannot be validated.
+    class TokenValidationError < StandardError; end
+  end
+end