omniauth-authify 0.1.1

data/sig/omniauth/strategies/authify.rbs

@@ -0,0 +1,78 @@
+# Signatures for the Authify OmniAuth strategy
+#
+# The strategy inherits the bulk of its behavior (options machine, request/
+# callback phase plumbing, credentials, token management) from
+# OmniAuth::Strategies::OAuth2, whose definitions live in the
+# omniauth-oauth2 gem's own signatures. Only the public surface added or
+# overridden by this gem is described here.
+
+module OmniAuth
+  module Strategies
+    # OmniAuth strategy for Authify, a self-hosted, multi-tenant identity
+    # provider implementing OpenID Connect on top of OAuth 2.0
+    class Authify < OmniAuth::Strategies::OAuth2
+      # Scopes requested when the user does not configure any
+      DEFAULT_SCOPE: String
+
+      # Returns the strategy name used in URLs (+/auth/authify+).
+      # Actually provided by the +option :name+ mechanism at runtime.
+      #
+      # Builds and memoizes the underlying OAuth2 client, raising
+      # ConfigurationError unless both +:site+ and +:organization+ options
+      # are present.
+      def client: () -> ::OAuth2::Client
+
+      # The +uid+ block is configured at class definition time and reads
+      # +raw_info["sub"]+; not a normal method override.
+
+      # Authorize-phase parameters: OAuth2 defaults plus scope/state handling,
+      # a freshly generated +nonce+, the configured +leeway+, and a
+      # request-provided +prompt+ forwarded to Authify when present.
+      def authorize_params: () -> Hash[Symbol, untyped]
+
+      # Initiates the authorization redirect after validating configuration
+      def request_phase: () -> rack_response
+
+      # Completes the callback: validates the OAuth2 state, exchanges the
+      # code for tokens, and (unless +verify_id_token+ is disabled) verifies
+      # the ID token signature and claims while the auth hash is assembled
+      def callback_phase: () -> rack_response
+
+      private
+
+      # Persists per-login parameters (nonce, leeway, max_age) in the session
+      def store_authorize_params: (Hash[Symbol, untyped] params) -> void
+
+      # Session-stored authorize parameters, symbolized; consumed once
+      def stored_authorize_params: () -> Hash[Symbol, untyped]
+
+      # True when either +:site+ or +:organization+ is blank
+      def missing_configuration?: () -> bool
+
+      # The ID token from the token endpoint response, or nil
+      def id_token: () -> String?
+
+      # A validator bound to this organization's issuer and JWKS
+      def jwt_validator: () -> ::OmniAuth::Authify::JwtValidator
+
+      # +site+ joined with +organization+, trailing slashes normalized
+      def org_base: () -> String
+
+      # Raises ConfigurationError when +missing_configuration?+
+      def validate_configuration!: () -> void
+
+      # +org_base+ (kept as a separate name for overriding in subclasses)
+      def normalized_base: () -> String
+
+      # Normalized (nil when blank) ID token value from the access token
+      def normalized_id_token: () -> String?
+
+      # Verified ID token claims (signature-verified), or the userinfo
+      # response when verification is disabled
+      def raw_info: () -> Hash[String, untyped]
+
+      # Organization-scoped userinfo endpoint URL
+      def userinfo_url: () -> String
+    end
+  end
+end

data/sig/shims.rbs

@@ -0,0 +1,67 @@
+# Shims for types referenced by our signatures but not shipped with RBS
+# definitions by their gems (omniauth / omniauth-oauth2 / oauth2 / jwt).
+#
+# These aren't meant to be complete — they define just enough for the
+# OmniAuth::Authify signatures to validate. If upstream gems publish
+# signatures, these should be dropped in favor of theirs.
+
+module OmniAuth
+  def self.config: () -> untyped
+
+  class Strategy
+    class Options
+      def []: (Symbol | String key) -> untyped
+
+      def []=: (Symbol | String key, untyped value) -> untyped
+
+      def deep_merge!: (Hash[Symbol | String, untyped] other) -> untyped
+    end
+  end
+
+  module Strategies
+    # Stub for OmniAuth::Strategies::OAuth2 from the omniauth-oauth2 gem
+    class OAuth2
+      # Rack response triple: [status, headers, body]
+      def call!: (Hash[String, untyped] env) -> untyped
+
+      def options: () -> OmniAuth::Strategy::Options
+
+      def client: () -> ::OAuth2::Client
+
+      def session: () -> untyped
+
+      def request: () -> untyped
+
+      def fail!: (Symbol message_key, ?untyped exception) -> rack_response
+    end
+  end
+
+  class Config
+  end
+end
+
+module OAuth2
+  class Client
+  end
+
+  class AccessToken
+    def token: () -> String
+
+    def expires?: () -> bool
+
+    def expires_at: () -> Integer
+
+    def refresh_token: () -> String?
+
+    def params: () -> Hash[String, untyped]
+
+    def []: (String | Symbol key) -> untyped
+  end
+end
+
+module JWT
+  VERSION: String
+end
+
+# Rack response triple: [status, headers, body]
+type rack_response = [Integer, Hash[String | Symbol, untyped], untyped]

metadata

@@ -0,0 +1,262 @@
+--- !ruby/object:Gem::Specification
+name: omniauth-authify
+version: !ruby/object:Gem::Version
+  version: 0.1.1
+platform: ruby
+authors:
+- Jonathan Gnagy
+bindir: exe
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.2'
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.8'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.8'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+- !ruby/object:Gem::Dependency
+  name: omniauth
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
+- !ruby/object:Gem::Dependency
+  name: omniauth-oauth2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.8'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.8'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
+- !ruby/object:Gem::Dependency
+  name: rack-test
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.12'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.12'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.75'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.75'
+- !ruby/object:Gem::Dependency
+  name: rubocop-rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.7'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.7'
+- !ruby/object:Gem::Dependency
+  name: rubocop-rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.5'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.5'
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.22'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.22'
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.24'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.24'
+- !ruby/object:Gem::Dependency
+  name: yard
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+description: An OmniAuth strategy that authenticates against Authify, a self-hosted,
+  multi-tenant identity provider, using the OpenID Connect authorization code flow
+  with PKCE, verifying ID tokens against the organization's JWKS.
+email:
+- jonathan.gnagy@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".release-please-manifest.json"
+- ".rspec"
+- ".rubocop.yml"
+- ".ruby-version"
+- ".tool-versions"
+- ".yardopts"
+- AGENTS.md
+- CHANGELOG.md
+- CODE_OF_CONDUCT.md
+- CONTRIBUTING.md
+- LICENSE.txt
+- README.md
+- Rakefile
+- lib/omniauth-authify.rb
+- lib/omniauth/authify.rb
+- lib/omniauth/authify/errors.rb
+- lib/omniauth/authify/jwt_validator.rb
+- lib/omniauth/authify/version.rb
+- lib/omniauth/strategies/authify.rb
+- release-please-config.json
+- sig/omniauth/authify.rbs
+- sig/omniauth/strategies/authify.rbs
+- sig/shims.rbs
+homepage: https://github.com/authify/omniauth-authify
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/authify/omniauth-authify
+  source_code_uri: https://github.com/authify/omniauth-authify
+  changelog_uri: https://github.com/authify/omniauth-authify/blob/main/CHANGELOG.md
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.4'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: OmniAuth strategy for Authify, a self-hosted, multi-tenant identity provider
+test_files: []