omniauth-cloudiap 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4dd63aa4dba59ff3b4251103f4dc8202f9dfbe39753e967f47133a7cd7b4c907
-  data.tar.gz: e8aaf738e50bdb425c8cd6a57ac3bc5a3b9a7945323187e46b1498f2cc89225e
+  metadata.gz: 71d630cae4e35a08c26c0605fb042a9e9f290a2f5598432521581af23555ff04
+  data.tar.gz: 479bc4020c0106fc46361906ff26e83a105a0507453d37f2252e4825f5f71957
 SHA512:
-  metadata.gz: 69b1f7761fd89ff7bcb3974ac08d3b836271020fb50dd324bb1226359a15d71a92c0aeb28d27c1f330eae27f406c8a1868f125666c3d5bf2fb0185a1c1d26b5b
-  data.tar.gz: 2270c3f8e4865b62f81825633b88b2fcdb35beb2fec1cbad77c45937f976e2acb1a6c3926f1adfe4e918d984a364011d7f7d78fcedd742d725d9aaea26cc9160
+  metadata.gz: d79d2795cca365f18c65155776790bd1783c6f0fe55e6f93b50fec117407a6129b6b58223ab7e21dab30caa75cb63ea2777aeac2315a5e05278f0ea6c859e5db
+  data.tar.gz: 6c3275328d58b65a8806add7d93c6f6bceada32c43ac93c457653eec5b462ca420bebee0c8a9cb152d1fd29fbab4454b8a691c8e8dd6ffd5c2e25a3d20b55f1b

data/.rubocop.yml

@@ -0,0 +1,45 @@
+
+AllCops:
+  TargetRubyVersion: 3.0
+  NewCops: enable
+  Exclude:
+    - 'omniauth-cloudiap.gemspec'
+
+Metrics/AbcSize:
+  Max: 28
+
+Metrics/MethodLength:
+  Enabled: false
+
+Style/NumericLiterals:
+  MinDigits: 11
+
+Style/FrozenStringLiteralComment:
+  Enabled: false
+
+Style/StringLiterals:
+  EnforcedStyle: double_quotes
+
+Style/TrailingCommaInHashLiteral:
+  EnforcedStyleForMultiline: consistent_comma
+
+Style/TrailingCommaInArguments:
+  EnforcedStyleForMultiline: consistent_comma
+
+Style/Documentation:
+  Enabled: false
+
+Style/IfUnlessModifier:
+  Enabled: false
+
+Style/GuardClause:
+  Enabled: false
+
+Style/SignalException:
+  EnforcedStyle: semantic
+
+Style/RescueStandardError:
+  EnforcedStyle: implicit
+
+Layout/FirstHashElementIndentation:
+  EnforcedStyle: consistent

data/CHANGELOG.md

@@ -1,8 +1,9 @@
 Changelog
 ===========
 
+## 1.1.0 - 2024-06-04
+- Change validation method to use ruby-jwt to avoid openssl3 error
 
-1.0.0 - 2018-11-21
---------------------
+## 1.0.0 - 2018-11-21
 
 - First release

data/Gemfile

@@ -1,6 +1,6 @@
 source "https://rubygems.org"
 
-git_source(:github) {|repo_name| "https://github.com/#{repo_name}" }
+git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
 
 # Specify your gem's dependencies in omniauth-cloudiap.gemspec
 gemspec

data/Gemfile.lock

@@ -1,40 +1,81 @@
 PATH
   remote: .
   specs:
-    omniauth-cloudiap (0.1.0)
+    omniauth-cloudiap (1.1.0)
       jwt
       omniauth
 
 GEM
   remote: https://rubygems.org/
   specs:
-    hashie (3.5.7)
-    jwt (2.1.0)
-    minitest (5.11.3)
-    minitest-power_assert (0.3.0)
+    ast (2.4.2)
+    base64 (0.2.0)
+    hashie (5.0.0)
+    json (2.7.2)
+    jwt (2.8.1)
+      base64
+    language_server-protocol (3.17.0.3)
+    minitest (5.23.1)
+    minitest-power_assert (0.3.1)
       minitest
       power_assert (>= 1.1)
-    omniauth (1.8.1)
-      hashie (>= 3.4.6, < 3.6.0)
-      rack (>= 1.6.2, < 3)
-    power_assert (1.1.3)
-    rack (2.0.6)
-    rack-test (1.1.0)
-      rack (>= 1.0, < 3)
-    rake (10.5.0)
-    timecop (0.9.1)
+    minitest-stub_any_instance (1.0.3)
+    omniauth (2.1.2)
+      hashie (>= 3.4.6)
+      rack (>= 2.2.3)
+      rack-protection
+    parallel (1.24.0)
+    parser (3.3.2.0)
+      ast (~> 2.4.1)
+      racc
+    power_assert (2.0.3)
+    racc (1.8.0)
+    rack (3.0.11)
+    rack-protection (4.0.0)
+      base64 (>= 0.1.0)
+      rack (>= 3.0.0, < 4)
+    rack-session (2.0.0)
+      rack (>= 3.0.0)
+    rack-test (2.1.0)
+      rack (>= 1.3)
+    rainbow (3.1.1)
+    rake (13.2.1)
+    regexp_parser (2.9.2)
+    rexml (3.2.8)
+      strscan (>= 3.0.9)
+    rubocop (1.64.1)
+      json (~> 2.3)
+      language_server-protocol (>= 3.17.0)
+      parallel (~> 1.10)
+      parser (>= 3.3.0.2)
+      rainbow (>= 2.2.2, < 4.0)
+      regexp_parser (>= 1.8, < 3.0)
+      rexml (>= 3.2.5, < 4.0)
+      rubocop-ast (>= 1.31.1, < 2.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (>= 2.4.0, < 3.0)
+    rubocop-ast (1.31.3)
+      parser (>= 3.3.1.0)
+    ruby-progressbar (1.13.0)
+    strscan (3.1.0)
+    timecop (0.9.9)
+    unicode-display_width (2.5.0)
 
 PLATFORMS
+  arm64-darwin-22
   ruby
 
 DEPENDENCIES
-  bundler (~> 1.17)
-  minitest (~> 5.0)
+  bundler
+  minitest
   minitest-power_assert
+  minitest-stub_any_instance
   omniauth-cloudiap!
+  rack-session
   rack-test
-  rake (~> 10.0)
+  rake
+  rubocop
   timecop
 
 BUNDLED WITH
-   1.17.1
+   2.5.11

data/Rakefile

@@ -7,4 +7,4 @@ Rake::TestTask.new(:test) do |t|
   t.test_files = FileList["test/**/*_test.rb"]
 end
 
-task :default => :test
+task default: :test

data/lib/omniauth/cloudiap/iapjwt.rb

@@ -1,11 +1,10 @@
-require 'jwt'
-require 'open-uri'
-require 'json'
+require "jwt"
+require "open-uri"
+require "json"
 
 module OmniAuth
   module Cloudiap
     class IAPJWT
-
       class InvalidAudError < Error; end
 
       def initialize(aud: nil)
@@ -13,56 +12,51 @@ module OmniAuth
       end
 
       def decode_with_validate(token)
-        payload, header = validate(token)
+        payload, = validate(token)
         { identifier: payload["sub"], email: payload["email"] }
       end
 
       def parse(token)
-        JWT.decode token, nil, false
+        JWT.decode(token, nil, true, algorithms: algorithms, jwks: jwks)
       end
 
       def jwk_keys
-        @jwk_keys ||= begin
-          url = "https://www.gstatic.com/iap/verify/public_key-jwk"
-          open(url) { |f| JSON.parse(f.read) }
-        end
+        url = "https://www.gstatic.com/iap/verify/public_key-jwk"
+        URI.open(url) { |f| JSON.parse(f.read) } # rubocop:disable Security/Open
       end
 
-      def jwk_key(token)
-        _, header = parse(token)
-        jwk = jwk_keys["keys"].find{|k| k["kid"] == header["kid"] }
-        curve_name = \
-          case jwk["crv"]
-          when "P-256"
-            "prime256v1"
-          when "P-384"
-            "secp384r1"
-          when "P-521"
-            "secp521r1"
-          else
-            raise AugumentError, "Unknown crv: #{jwk["crv"]}"
-          end
-        x = Base64.urlsafe_decode64(jwk["x"])
-        y = Base64.urlsafe_decode64(jwk["y"])
-
-        key = OpenSSL::PKey::EC.new(curve_name)
-        group = OpenSSL::PKey::EC::Group.new(curve_name)
-        bn = OpenSSL::BN.new(["04" + x.unpack("H*").first + y.unpack("H*").first].pack("H*"), 2)
-        key.public_key = OpenSSL::PKey::EC::Point.new(group, bn)
-        key
+      def jwks_loader(options)
+        if options[:kid_not_found] && @cache_last_update < Time.now.to_i - 300
+          logger.info("Invalidating JWK cache. #{options[:kid]} not found from previous cache")
+          @cached_keys = nil
+        end
+        @cached_keys ||= begin # rubocop:disable Naming/MemoizedInstanceVariableName
+          @cache_last_update = Time.now.to_i
+          jwks = JWT::JWK::Set.new(jwk_keys)
+          jwks.select! { |key| key[:use] == "sig" } # Signing Keys only
+          jwks
+        end
       end
 
-      def validate(token)
-        iss = "https://cloud.google.com/iap"
-        options = {
-          algorithm: "ES256",
+      def default_jwt_decode_options
+        {
           verify_expiration: true,
           verify_iat: true,
           verify_aud: true,
           verify_iss: true,
-          iss: iss,
         }
-        payload, header = JWT.decode(token, jwk_key(token), true, options)
+      end
+
+      def validate(token)
+        iss = "https://cloud.google.com/iap"
+        options = default_jwt_decode_options.merge(
+          iss: iss,
+          algorithm: "ES256",
+          jwks: method(:jwks_loader),
+        )
+
+        payload, header = JWT.decode(token, nil, true, options)
+
         if @required_aud
           validate_aud(@required_aud, payload["aud"])
         else
@@ -81,7 +75,7 @@ module OmniAuth
 
       def validate_aud_format(aud)
         case aud
-        when %r|/projects/\d+/apps/\d+|, %r|/projects/\d+/global/backendServices/\d+|
+        when %r{/projects/\d+/apps/\d+}, %r{/projects/\d+/global/backendServices/\d+}
           # do nothing
         else
           fail InvalidAudError, aud
@@ -90,4 +84,3 @@ module OmniAuth
     end
   end
 end
-

data/lib/omniauth/cloudiap/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module Cloudiap
-    VERSION = "1.0.0"
+    VERSION = "1.1.0".freeze
   end
 end

data/lib/omniauth/cloudiap.rb

@@ -7,4 +7,3 @@ module OmniAuth
 end
 
 require "omniauth/strategies/cloudiap"
-

data/lib/omniauth/strategies/cloudiap.rb

@@ -51,11 +51,11 @@ module OmniAuth
       end
 
       def userinfo_from_jwt
-        if token = env["HTTP_X_GOOG_IAP_JWT_ASSERTION"]
-          payload, header = ::OmniAuth::Cloudiap::IAPJWT.new(aud: options[:aud]).validate(token)
+        if (token = env["HTTP_X_GOOG_IAP_JWT_ASSERTION"])
+          payload, = ::OmniAuth::Cloudiap::IAPJWT.new(aud: options[:aud]).validate(token)
           uid = payload["sub"].sub(/^accounts.google.com:/, "")
           email = payload["email"]
-          result = {
+          {
             uid: uid,
             email: email,
             name: username_from_email(email),
@@ -70,7 +70,7 @@ module OmniAuth
         uid = env["HTTP_X_GOOG_AUTHENTICATED_USER_ID"].sub(/^accounts.google.com:/, "")
         email = env["HTTP_X_GOOG_AUTHENTICATED_USER_EMAIL"].sub(/^accounts.google.com:/, "")
 
-        result = {
+        {
           uid: uid,
           email: email,
           name: username_from_email(email),
@@ -78,7 +78,7 @@ module OmniAuth
       end
 
       def username_from_email(email)
-        if options[:username_callback] && options[:username_callback].respond_to?(:[])
+        if options[:username_callback].respond_to?(:[])
           options[:username_callback][email]
         else
           email

data/omniauth-cloudiap.gemspec

@@ -35,13 +35,17 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_development_dependency "bundler", "~> 1.17"
-  spec.add_development_dependency "rake", "~> 10.0"
-  spec.add_development_dependency "minitest", "~> 5.0"
+  spec.add_development_dependency "bundler"
+  spec.add_development_dependency "minitest"
   spec.add_development_dependency "minitest-power_assert"
+  spec.add_development_dependency "minitest-stub_any_instance"
+  spec.add_development_dependency "rack-session"
   spec.add_development_dependency "rack-test"
+  spec.add_development_dependency "rake"
+  spec.add_development_dependency "rubocop"
   spec.add_development_dependency "timecop"
 
+
   spec.add_dependency "omniauth"
   spec.add_dependency "jwt"
 end

metadata

@@ -1,59 +1,73 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-cloudiap
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
 platform: ruby
 authors:
 - HORII Keima
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2018-11-21 00:00:00.000000000 Z
+date: 2024-06-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.17'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.17'
+        version: '0'
 - !ruby/object:Gem::Dependency
-  name: rake
+  name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '0'
 - !ruby/object:Gem::Dependency
-  name: minitest
+  name: minitest-power_assert
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '0'
 - !ruby/object:Gem::Dependency
-  name: minitest-power_assert
+  name: minitest-stub_any_instance
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rack-session
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -80,6 +94,34 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: timecop
   requirement: !ruby/object:Gem::Requirement
@@ -130,6 +172,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".gitignore"
+- ".rubocop.yml"
 - CHANGELOG.md
 - Gemfile
 - Gemfile.lock
@@ -150,7 +193,7 @@ metadata:
   allowed_push_host: https://rubygems.org
   homepage_uri: https://github.com/holysugar/omniauth-cloudiap
   source_code_uri: https://github.com/holysugar/omniauth-cloudiap
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -165,9 +208,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6
-signing_key: 
+rubygems_version: 3.5.9
+signing_key:
 specification_version: 4
 summary: omniauth strategy using Google Cloud IAP
 test_files: []