omniauth-honin 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8ba9cb60419c162b8451a3fcb5b2071ac8d5229638d98422b93dbfa9f02e4666
-  data.tar.gz: 43893c67e00b951e240e352c2d08f287d2dcadcb85820d00301c9e6cb7c0a479
+  metadata.gz: ac29cb208ee56c02f6d29e9364c57e3093a7fdc9b776c42a88a7c5d31a7ab395
+  data.tar.gz: 67fc811523c4ddf6dd690b0019b14ea9333f47c79139f6e0049ff93c0763a77d
 SHA512:
-  metadata.gz: e3aead620f5c9a95604c2714811558d783fadc3940ac29c63f6e8c441c67e414977c7174a9db5686edb9ed7743ee67dc6d5809b4e57874c99bf83d8233ba102a
-  data.tar.gz: 0a5bdaa70720965c09c80ba533ce5ea47fa18d11c55fd9fcc2f4279f59b29c1add213dd19aeaf8404f62fe093d82fbdcf3d1e8d41398b8b824e1659eb842e5fa
+  metadata.gz: 1cdb6461a0e684528666698e1f67a1ef6ef07c02d708fc2f30ad998998dd1620d5505a4148c8e0a6deccd274fb443eb0d08b56fc707774f42d027e850378ad34
+  data.tar.gz: c5562a1b8c375dabf8578407e35d0ab10fb7a4bf4636b488b827be0b7dc1c3163ba7eee7a48a8713cf821d7c7e07f6a65df438539e67cce1e18f333be406f824

data/lib/omniauth/honin/version.rb

@@ -2,6 +2,6 @@
 
 module OmniAuth
   module Honin
-    VERSION = "0.1.0"
+    VERSION = "0.2.0"
   end
 end

data/lib/omniauth/strategies/honin.rb

@@ -2,13 +2,7 @@
 
 require "omniauth"
 require "omniauth-oauth2"
-require "jwt"
-require "securerandom"
-require "base64"
-require "digest"
-require "net/http"
-require "uri"
-require "json"
+require "honin/client"
 
 module OmniAuth
   module Strategies
@@ -20,8 +14,7 @@ module OmniAuth
         authorize_url: "/oauth/authorize",
         token_url: "/oauth/token"
 
-      # Disabled so we own the full PKCE flow; omniauth-oauth2's built-in
-      # implementation would conflict with our session keys and S256 enforcement.
+      # Disabled — we own the full PKCE flow via HoninClient::PKCE.
       option :pkce, false
 
       option :scope, "email profile"
@@ -29,19 +22,22 @@ module OmniAuth
       # Honin only supports client_secret_post, not client_secret_basic.
       option :auth_token_params, {client_secret_param: "client_secret"}
 
-      # Sub-path mount support. Set to the engine's mount path when the Honin
-      # instance is not at the root — e.g. "/auth" for id.acme.co/auth/...
-      # The issuer claim in the JWT is verified against site + base_path.
-      # Leave empty (default) for honin.id and root-mounted instances.
+      # Sub-path mount support. Set when the Honin instance is not at the root
+      # (e.g. "/auth" for id.acme.co/auth/...). The issuer claim in the JWT is
+      # verified against site + base_path. Leave empty for honin.id.
       option :base_path, ""
 
+      # Provide a JWKS URI to enable RS256 JWT verification (recommended).
       option :jwks_uri, nil
-      option :jwks, nil
 
-      PKCE_VERIFIER_LENGTH = 64
+      # Alternatively, supply a pre-loaded JWK set (Hash, Array, or JWT::JWK::Set).
+      # Useful for self-hosted instances with a known public key.
+      option :jwks, nil
 
       def request_phase
-        generate_pkce!
+        pkce = HoninClient::PKCE.new
+        session[:honin_pkce_verifier] = pkce.code_verifier
+        session[:honin_pkce_challenge] = pkce.code_challenge
         super
       end
 
@@ -61,30 +57,31 @@ module OmniAuth
       def callback_phase
         super
       ensure
-        clear_pkce_session!
+        session.delete(:honin_pkce_verifier)
+        session.delete(:honin_pkce_challenge)
       end
 
-      uid { decoded_jwt["sub"] }
+      uid { honin_identity.sub }
 
       info do
-        jwt = decoded_jwt
+        id = honin_identity
         {
-          account_type: jwt["account_type"],
-          name: jwt["display_name"],
-          email: jwt["email"],
-          email_verified: jwt["email_verified"],
-          timezone: jwt["timezone"],
-          locale: jwt["locale"]
+          account_type: id.account_type,
+          name: id.display_name,
+          email: id.email,
+          email_verified: id.email_verified,
+          timezone: id.timezone,
+          locale: id.locale
         }.compact
       end
 
       extra do
-        jwt = decoded_jwt
+        id = honin_identity
         {
-          raw_info: raw_info,
-          granted_scopes: jwt["granted_scopes"],
-          required_scopes: jwt["required_scopes"]
-        }.compact
+          raw_info: id.to_h,
+          granted_scopes: id.granted_scopes,
+          required_scopes: id.required_scopes
+        }
       end
 
       def client
@@ -94,98 +91,34 @@ module OmniAuth
           token_url: "#{options.base_path}/oauth/token")
       end
 
-      def raw_info
-        @raw_info ||= decoded_jwt
-      end
-
-      def decoded_jwt
-        @decoded_jwt ||= begin
-          token = access_token.token
-
-          if jwks_verification_available?
-            decode_verified_jwt(token)
-          else
-            decode_unverified_jwt(token)
-          end
+      def honin_identity
+        @honin_identity ||= if options.jwks_uri && !options.jwks_uri.to_s.empty?
+          build_verifier(self.class.jwks_cache_for(options.jwks_uri)).verify(access_token.token)
+        elsif options.jwks
+          build_verifier(HoninClient::JwksCache::Static.new(options.jwks)).verify(access_token.token)
+        else
+          # No JWKS configured — decode without verification (dev/test only)
+          payload, = JWT.decode(access_token.token, nil, false)
+          HoninClient::Identity.new(payload)
         end
-      end
-
-      private
-
-      def generate_pkce!
-        verifier = SecureRandom.urlsafe_base64(PKCE_VERIFIER_LENGTH)
-        challenge = Base64.urlsafe_encode64(
-          Digest::SHA256.digest(verifier),
-          padding: false
-        )
-
-        session[:honin_pkce_verifier] = verifier
-        session[:honin_pkce_challenge] = challenge
-      end
-
-      def clear_pkce_session!
-        session.delete(:honin_pkce_verifier)
-        session.delete(:honin_pkce_challenge)
-      end
-
-      def jwks_verification_available?
-        (options.jwks_uri && !options.jwks_uri.to_s.empty?) ||
-          (!options.jwks.nil? && options.jwks != false)
-      end
-
-      def decode_verified_jwt(token)
-        decode_opts = {
-          algorithms: ["RS256"],
-          verify_iss: true,
-          iss: "#{options.client_options.site}#{options.base_path}",
-          verify_aud: true,
-          aud: options.client_id
-        }
-
-        payload, = JWT.decode(token, nil, true, decode_opts.merge(jwks: resolve_jwk_set))
-        payload
-      rescue JWT::DecodeError, JWT::VerificationError, JWT::ExpiredSignature,
-        JWT::InvalidIssuerError, JWT::JWKError => e
+      rescue HoninClient::Error => e
         raise OmniAuth::Strategies::OAuth2::CallbackError.new(:jwt_verification_failed, e.message)
       end
 
-      def decode_unverified_jwt(token)
-        payload, = JWT.decode(token, nil, false)
-        payload
-      end
-
-      def resolve_jwk_set
-        if options.jwks_uri && !options.jwks_uri.to_s.empty?
-          fetch_jwks(options.jwks_uri)
-        else
-          coerce_jwks(options.jwks)
-        end
+      # Class-level JWKS cache — persists across requests, keyed by URI.
+      def self.jwks_cache_for(uri)
+        @jwks_caches ||= {}
+        @jwks_caches[uri] ||= HoninClient::JwksCache.new(uri)
       end
 
-      def coerce_jwks(jwks)
-        case jwks
-        when JWT::JWK::Set
-          jwks
-        when Hash
-          JWT::JWK::Set.new(jwks[:keys] || jwks["keys"] || [jwks])
-        when Array
-          JWT::JWK::Set.new(jwks)
-        else
-          raise ArgumentError, "jwks must be a Hash, Array, or JWT::JWK::Set, got #{jwks.class}"
-        end
-      end
+      private
 
-      def fetch_jwks(uri)
-        response = Net::HTTP.get_response(URI.parse(uri))
-        unless response.is_a?(Net::HTTPSuccess)
-          raise OmniAuth::Strategies::OAuth2::CallbackError.new(
-            :jwks_fetch_failed, "HTTP #{response.code}"
-          )
-        end
-        body = JSON.parse(response.body)
-        JWT::JWK::Set.new(body["keys"] || [body])
-      rescue JSON::ParserError, JWT::JWKError => e
-        raise OmniAuth::Strategies::OAuth2::CallbackError.new(:jwks_fetch_failed, e.message)
+      def build_verifier(cache)
+        HoninClient::TokenVerifier.new(
+          jwks_cache: cache,
+          issuer: "#{options.client_options.site}#{options.base_path}",
+          client_id: options.client_id
+        )
       end
     end
   end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-honin
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Axel Gustav
 bindir: exe
 cert_chain: []
-date: 2026-04-21 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth
@@ -38,19 +38,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.8'
 - !ruby/object:Gem::Dependency
-  name: jwt
+  name: honin-client
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.7'
+        version: 0.1.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.7'
+        version: 0.1.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -169,7 +169,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.3
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Honin OAuth2 strategy for OmniAuth
 test_files: []