omniauth-threefold-connect 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: e538dfc9a2f928f9cf65ba4494b88680344f637c5c61d4f3353abb830651b079
+  data.tar.gz: c8a5acfa6214a117c4c59733b0b2f722764f63024a50946dae3126851d9cebbb
+SHA512:
+  metadata.gz: eb68b5a40f20f555b4ba67ea1207c9a4920ed36e4ac8c24086dbd8ee6bc2051067435192ae396509cc066dd994733fe54e73a1f2b379488fec94d941be9ad435
+  data.tar.gz: cd4a6c80c5a002032fdf195fdb5baa7da9f5dd59d345dc87c495bb91f3782cc62837d967a4ec9fe14e9a612da3514f3c7ce16a27bf7b0561bf025996a281b8f1

data/Gemfile

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+source "https://rubygems.org"
+
+# Specify your gem's dependencies in omniauth-threefold-connect.gemspec
+gemspec
+
+gem "rake", "~> 13.0"

data/README.md

@@ -0,0 +1,29 @@
+# Omniauth::Threefold::Connect
+
+Welcome to your new gem! In this directory, you'll find the files you need to be able to package up your Ruby library into a gem. Put your Ruby code in the file `lib/omniauth/threefold/connect`. To experiment with that code, run `bin/console` for an interactive prompt.
+
+TODO: Delete this and the text above, and describe your gem
+
+## Installation
+
+Install the gem and add to the application's Gemfile by executing:
+
+    $ bundle add omniauth-threefold-connect
+
+If bundler is not being used to manage dependencies, install the gem by executing:
+
+    $ gem install omniauth-threefold-connect
+
+## Usage
+
+TODO: Write usage instructions here
+
+## Development
+
+After checking out the repo, run `bin/setup` to install dependencies. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+
+To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and the created tag, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/omniauth-threefold-connect.

data/Rakefile

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+require "bundler/gem_tasks"
+task default: %i[]

data/lib/omniauth/threefold/connect/version.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Omniauth
+  module Threefold
+    module Connect
+      VERSION = "0.1.0"
+    end
+  end
+end

data/lib/omniauth/threefold/connect.rb

@@ -0,0 +1,150 @@
+# frozen_string_literal: true
+
+require_relative "connect/version"
+require "base64"
+
+module OmniAuth
+  module Strategies
+    class Threefold
+      include OmniAuth::Strategy
+
+      args [:key, :scope, :callback_url, :server_url, :kyc_url]
+
+      option :key, nil
+      option :scope, [:user, :email]
+
+      option :callback_url, nil
+      option :server_url, "https://login.threefold.me"
+      option :kyc_url, "https://openkyc.live/verification/verify-sei"
+
+      attr_accessor :data
+
+      def signing_key
+        RbNaCl::SigningKey.new(Base64.decode64(options[:key]))
+      end
+
+      def get_user_public_key(double_name)
+        resp = Net::HTTP.get_response(URI("#{options[:server_url]}/api/users/#{double_name}"))
+        if resp.kind_of?(Net::HTTPOK)
+          return JSON.parse(resp.body)["publicKey"]
+        end
+
+        raise resp.body
+      end
+
+      def verify_email(sei)
+        resp = Net::HTTP.post(URI(options[:kyc_url]), { "signedEmailIdentifier": sei }.to_json, { "Content-Type" => "application/json" })
+        unless resp.kind_of?(Net::HTTPOK)
+          raise "email is not verified"
+        end
+      end
+
+      def validate_fields(data, fields)
+        fields.each do |field|
+          unless data.key?(field)
+            raise "missing '#{field}'"
+          end
+        end
+      end
+
+      # decrypt verified data
+      # @param verify_key [VerifyKey] used to verify this data
+      # @param data [Hash] e.g. {data => {"nonce" => "...", "ciphertext" => "..."}}
+      #
+      # @return [Hash] containing scope fields e.g. email and username
+      def decrypt_verified_data(verify_key, data)
+        nonce = Base64.strict_decode64(data["data"]["nonce"])
+        ciphertext = Base64.strict_decode64(data["data"]["ciphertext"])
+
+        private_key = signing_key.to_curve25519_private_key
+        public_key = verify_key.to_curve25519_public_key
+        box = RbNaCl::Box.new(public_key, private_key)
+        decrypted = box.decrypt(nonce, ciphertext)
+        JSON.parse(decrypted)
+      end
+
+      # verify login attempt
+      # @param attempt [Hash] must containing `doubleName` and `signedAttempt`
+      #
+      # @raise in case verifying the login attempt failed
+      #
+      # @return [Hash] containing user info as `email` and `username`
+      def verify(attempt)
+        validate_fields(attempt, ["signedAttempt", "doubleName"])
+
+        signed_data = Base64.strict_decode64(attempt["signedAttempt"])
+        double_name = attempt["doubleName"]
+        public_key = get_user_public_key(double_name)
+        verify_key = RbNaCl::VerifyKey.new(Base64.strict_decode64(public_key))
+
+        # signed_data have the signature attached, so, split them
+        signature, signed_data = signed_data[0...verify_key.signature_bytes], signed_data[verify_key.signature_bytes..-1]
+        # will raise an error if verification failed
+        verify_key.verify(signature, signed_data)
+        verified_data = JSON.parse(signed_data)
+        validate_fields(verified_data, ["data", "signedState", "doubleName"])
+
+        state = verified_data["signedState"]
+        if state != session[:auth_state]
+          raise "state has been changed"
+        end
+
+        decrypted = decrypt_verified_data(verify_key, verified_data)
+        validate_fields(decrypted, ["email"])
+        verify_email(decrypted["email"]["sei"])
+        { email: decrypted["email"]["email"], user: double_name }
+      end
+
+      def callback_url
+        options[:callback_url] || callback_path
+      end
+
+      def request_phase
+        state = SecureRandom.uuid.gsub("-", "")
+        scope = options[:scope].to_h { |field| [field, true] }
+        params = {
+          :appid => request.host_with_port,
+          :scope => JSON.generate(scope),
+          :publickey => Base64.strict_encode64(signing_key.verify_key.to_curve25519_public_key.to_s),
+          :redirecturl => callback_url,
+          :state => state,
+        }
+
+        session[:auth_state] = params[:state]
+        redirect "#{options[:server_url]}?#{params.to_query}"
+      end
+
+      def callback_phase
+        begin
+          attempt = JSON.parse(request.params["signedAttempt"])
+          @data = verify(attempt)
+        rescue => err
+          fail!(:error, err)
+        end
+
+        super
+      end
+
+      def username
+        data[:user].chomp(".3bot")
+      end
+
+      def email
+        data[:email]
+      end
+
+      uid do
+        username
+      end
+
+      info do
+        {
+          :name => username,
+          :nickname => username,
+          :email => email,
+          :verified => true,
+        }
+      end
+    end
+  end
+end

data/sig/omniauth/threefold/connect.rbs

@@ -0,0 +1,8 @@
+module Omniauth
+  module Threefold
+    module Connect
+      VERSION: String
+      # See the writing guide of rbs: https://github.com/ruby/rbs#guides
+    end
+  end
+end

metadata

@@ -0,0 +1,48 @@
+--- !ruby/object:Gem::Specification
+name: omniauth-threefold-connect
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Omar
+autorequire: 
+bindir: exe
+cert_chain: []
+date: 2022-12-21 00:00:00.000000000 Z
+dependencies: []
+description: Omniauth strategy for ThreeFold connect auth!
+email: omarabdul3ziz@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- Gemfile
+- README.md
+- Rakefile
+- lib/omniauth/threefold/connect.rb
+- lib/omniauth/threefold/connect/version.rb
+- sig/omniauth/threefold/connect.rbs
+homepage: https://github.com/Omarabdul3ziz/omniauth-threefold-connect
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.3.25
+signing_key: 
+specification_version: 4
+summary: Omniauth strategy for ThreeFold connect auth!
+test_files: []