omniauth_oidc 0.2.7 → 1.0.1

data/lib/omniauth/oidc/errors.rb

@@ -3,7 +3,26 @@
 module OmniauthOidc
   class Error < RuntimeError; end
 
+  # Authentication flow errors
   class MissingCodeError < Error; end
-
   class MissingIdTokenError < Error; end
+
+  # Configuration errors
+  class ConfigurationError < Error; end
+  class MissingConfigurationError < ConfigurationError; end
+
+  # Token/JWT errors
+  class TokenError < Error; end
+  class TokenVerificationError < TokenError; end
+  class TokenExpiredError < TokenError; end
+  class InvalidAlgorithmError < TokenError; end
+  class InvalidSignatureError < TokenError; end
+  class InvalidIssuerError < TokenError; end
+  class InvalidAudienceError < TokenError; end
+  class InvalidNonceError < TokenError; end
+
+  # JWKS errors
+  class JwksError < Error; end
+  class JwksFetchError < JwksError; end
+  class KeyNotFoundError < JwksError; end
 end

data/lib/omniauth/oidc/http_client.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "uri"
+require "json"
+
+module OmniauthOidc
+  # Simple HTTP client using Net::HTTP
+  class HttpClient
+    class HttpError < StandardError; end
+
+    MAX_REDIRECTS = 5
+
+    def self.get(url, headers: {})
+      uri = URI.parse(url)
+      request = Net::HTTP::Get.new(uri)
+      headers.each { |key, value| request[key] = value }
+
+      response = execute_request(uri, request)
+      handle_response(response, url, headers: headers, redirects_remaining: MAX_REDIRECTS)
+    end
+
+    def self.post(url, body: nil, headers: {})
+      uri = URI.parse(url)
+      request = Net::HTTP::Post.new(uri)
+      request["Content-Type"] = "application/x-www-form-urlencoded" unless headers["Content-Type"]
+      headers.each { |key, value| request[key] = value }
+      request.body = body if body
+
+      response = execute_request(uri, request)
+      handle_response(response, url)
+    end
+
+    def self.execute_request(uri, request)
+      OmniauthOidc::Logging.instrument("http.request", method: request.method, uri: uri.to_s) do
+        Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
+          http.request(request)
+        end
+      end
+    end
+    private_class_method :execute_request
+
+    def self.handle_response(response, url, headers: {}, redirects_remaining: 0)
+      case response
+      when Net::HTTPSuccess
+        parse_json_response(response.body)
+      when Net::HTTPRedirection
+        raise HttpError, "Too many redirects for #{url}" if redirects_remaining <= 0
+
+        location = response["location"]
+        raise HttpError, "HTTP redirect from #{url} with no location header" unless location
+
+        redirect_uri = URI.parse(location)
+        # Resolve relative redirects
+        redirect_uri = URI.join(url, location) unless redirect_uri.host
+
+        OmniauthOidc::Logging.debug("Following redirect", from: url, to: redirect_uri.to_s)
+        follow_redirect(redirect_uri, headers: headers, redirects_remaining: redirects_remaining - 1)
+      else
+        raise HttpError, "HTTP request failed: #{response.code} #{response.message} for #{url}"
+      end
+    end
+    private_class_method :handle_response
+
+    def self.follow_redirect(uri, headers: {}, redirects_remaining: 0)
+      request = Net::HTTP::Get.new(uri)
+      headers.each { |key, value| request[key] = value }
+
+      response = execute_request(uri, request)
+      handle_response(response, uri.to_s, headers: headers, redirects_remaining: redirects_remaining)
+    end
+    private_class_method :follow_redirect
+
+    def self.parse_json_response(body)
+      JSON.parse(body)
+    rescue JSON::ParserError => e
+      raise HttpError, "Failed to parse JSON response: #{e.message}"
+    end
+    private_class_method :parse_json_response
+  end
+end

data/lib/omniauth/oidc/jwk_handler.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require "jwt"
+require "openssl"
+
+module OmniauthOidc
+  # Handles JWK/JWKS operations for JWT verification
+  class JwkHandler
+    # Parsed key with its kid for matching
+    KeyWithId = Struct.new(:kid, :keypair, keyword_init: true)
+
+    def self.parse_jwks(jwks_data)
+      return nil unless jwks_data
+
+      jwks_data = JSON.parse(jwks_data) if jwks_data.is_a?(String)
+
+      # Handle JWKS (set of keys)
+      if jwks_data["keys"]
+        jwks_data["keys"].filter_map { |key_data| jwk_to_key(key_data) }
+      # Handle single JWK
+      else
+        [jwk_to_key(jwks_data)].compact
+      end
+    end
+
+    def self.jwk_to_key(jwk_data)
+      keypair = JWT::JWK.import(jwk_data).keypair
+      kid = jwk_data["kid"] || jwk_data[:kid]
+      KeyWithId.new(kid: kid, keypair: keypair)
+    rescue StandardError => e
+      OmniauthOidc::Logging.error("Failed to import JWK", error: e.message)
+      nil
+    end
+
+    # Find the right key from JWKS based on kid (key ID)
+    def self.find_key(keys, kid = nil)
+      return keys.first&.keypair if kid.nil? || keys.size <= 1
+
+      matched = keys.find { |k| k.kid == kid }
+      if matched
+        matched.keypair
+      else
+        OmniauthOidc::Logging.warn("No JWK found matching kid '#{kid}', falling back to first key")
+        keys.first&.keypair
+      end
+    end
+  end
+end

data/lib/omniauth/oidc/jwks_cache.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+module OmniauthOidc
+  # Thread-safe JWKS cache with configurable TTL and force refresh capability
+  class JwksCache
+    DEFAULT_TTL = 3600 # 1 hour in seconds
+
+    CacheEntry = Struct.new(:keys, :fetched_at, keyword_init: true)
+
+    class << self
+      def instance
+        @instance ||= new
+      end
+
+      # Clear all cached keys (useful for testing)
+      def clear!
+        instance.clear!
+      end
+
+      # Force refresh a specific JWKS URI on next access
+      def invalidate(jwks_uri)
+        instance.invalidate(jwks_uri)
+      end
+    end
+
+    def initialize(ttl: DEFAULT_TTL)
+      @ttl = ttl
+      @cache = {}
+      @mutex = Mutex.new
+    end
+
+    # Fetch JWKS, using cache if valid
+    def fetch(jwks_uri, force_refresh: false, &block)
+      @mutex.synchronize do
+        entry = @cache[jwks_uri]
+
+        if !force_refresh && entry && !expired?(entry)
+          Logging.debug("JWKS cache hit", jwks_uri: jwks_uri)
+          return entry.keys
+        end
+
+        Logging.info("JWKS cache miss, fetching", jwks_uri: jwks_uri, force_refresh: force_refresh)
+        keys = block.call
+        @cache[jwks_uri] = CacheEntry.new(keys: keys, fetched_at: Time.now)
+        keys
+      end
+    end
+
+    # Check if a specific URI's cache is valid
+    def valid?(jwks_uri)
+      @mutex.synchronize do
+        entry = @cache[jwks_uri]
+        entry && !expired?(entry)
+      end
+    end
+
+    # Invalidate a specific URI's cache
+    def invalidate(jwks_uri)
+      @mutex.synchronize do
+        @cache.delete(jwks_uri)
+        Logging.debug("JWKS cache invalidated", jwks_uri: jwks_uri)
+      end
+    end
+
+    # Clear entire cache
+    def clear!
+      @mutex.synchronize do
+        @cache.clear
+        Logging.debug("JWKS cache cleared")
+      end
+    end
+
+    # Get current TTL
+    attr_reader :ttl
+
+    # Update TTL (affects future expiration checks)
+    def ttl=(value)
+      @mutex.synchronize do
+        @ttl = value
+      end
+    end
+
+    private
+
+    def expired?(entry)
+      Time.now - entry.fetched_at > @ttl
+    end
+  end
+end

data/lib/omniauth/oidc/logging.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require "logger"
+
+module OmniauthOidc
+  # Logging module providing both Ruby Logger and ActiveSupport::Notifications support
+  module Logging
+    class << self
+      attr_writer :logger
+
+      def logger
+        @logger ||= default_logger
+      end
+
+      def log_level=(level)
+        logger.level = level
+      end
+
+      def instrument(event_name, payload = {}, &block)
+        full_event_name = "#{event_name}.omniauth_oidc"
+
+        # Always log the event
+        log_event(event_name, payload)
+
+        # Use ActiveSupport::Notifications if available
+        if defined?(ActiveSupport::Notifications)
+          ActiveSupport::Notifications.instrument(full_event_name, payload, &block)
+        elsif block
+          yield payload
+        end
+      end
+
+      def debug(message, context = {})
+        log(:debug, message, context)
+      end
+
+      def info(message, context = {})
+        log(:info, message, context)
+      end
+
+      def warn(message, context = {})
+        log(:warn, message, context)
+      end
+
+      def error(message, context = {})
+        log(:error, message, context)
+      end
+
+      private
+
+      def default_logger
+        Logger.new($stdout).tap do |log|
+          log.progname = "OmniauthOidc"
+          log.level = Logger::WARN # Default to WARN to avoid noise
+        end
+      end
+
+      def log(level, message, context)
+        formatted_message = context.empty? ? message : "#{message} #{context.inspect}"
+        logger.send(level, formatted_message)
+      end
+
+      def log_event(event_name, payload)
+        # Log at debug level for instrumentation events
+        sanitized_payload = sanitize_payload(payload)
+        debug("Event: #{event_name}", sanitized_payload)
+      end
+
+      def sanitize_payload(payload)
+        # Remove sensitive data from logs
+        sensitive_keys = %i[secret client_secret access_token id_token refresh_token code_verifier]
+        payload.reject { |k, _| sensitive_keys.include?(k.to_sym) }
+      end
+    end
+  end
+end

data/lib/omniauth/oidc/response_objects.rb

@@ -0,0 +1,176 @@
+# frozen_string_literal: true
+
+module OmniauthOidc
+  # Simple response objects to replace OpenIDConnect::ResponseObject classes
+  module ResponseObjects
+    # Represents an OIDC ID Token with claims
+    class IdToken
+      attr_reader :raw_attributes
+
+      def initialize(attributes = {})
+        @raw_attributes = attributes.is_a?(Hash) ? attributes : attributes.to_h
+      end
+
+      def sub
+        raw_attributes["sub"]
+      end
+
+      def iss
+        raw_attributes["iss"]
+      end
+
+      def aud
+        raw_attributes["aud"]
+      end
+
+      def exp
+        raw_attributes["exp"]
+      end
+
+      def iat
+        raw_attributes["iat"]
+      end
+
+      def nonce
+        raw_attributes["nonce"]
+      end
+
+      # Allow method-style access to claims
+      def method_missing(method_name, *args)
+        return raw_attributes[method_name.to_s] if raw_attributes.key?(method_name.to_s)
+
+        super
+      end
+
+      def respond_to_missing?(method_name, include_private = false)
+        raw_attributes.key?(method_name.to_s) || super
+      end
+    end
+
+    # Represents OIDC UserInfo response
+    class UserInfo
+      attr_reader :raw_attributes
+
+      def initialize(attributes = {})
+        @raw_attributes = attributes.is_a?(Hash) ? attributes : attributes.to_h
+      end
+
+      # Standard OIDC claims
+      def sub
+        raw_attributes["sub"]
+      end
+
+      def name
+        raw_attributes["name"]
+      end
+
+      def given_name
+        raw_attributes["given_name"]
+      end
+
+      def family_name
+        raw_attributes["family_name"]
+      end
+
+      def middle_name
+        raw_attributes["middle_name"]
+      end
+
+      def nickname
+        raw_attributes["nickname"]
+      end
+
+      def preferred_username
+        raw_attributes["preferred_username"]
+      end
+
+      def profile
+        raw_attributes["profile"]
+      end
+
+      def picture
+        raw_attributes["picture"]
+      end
+
+      def website
+        raw_attributes["website"]
+      end
+
+      def email
+        raw_attributes["email"]
+      end
+
+      def email_verified
+        raw_attributes["email_verified"]
+      end
+
+      def gender
+        raw_attributes["gender"]
+      end
+
+      def birthdate
+        raw_attributes["birthdate"]
+      end
+
+      def zoneinfo
+        raw_attributes["zoneinfo"]
+      end
+
+      def locale
+        raw_attributes["locale"]
+      end
+
+      def phone_number
+        raw_attributes["phone_number"]
+      end
+
+      def phone_number_verified
+        raw_attributes["phone_number_verified"]
+      end
+
+      def address
+        raw_attributes["address"]
+      end
+
+      def updated_at
+        raw_attributes["updated_at"]
+      end
+
+      # Allow method-style access to custom claims
+      def method_missing(method_name, *args)
+        return raw_attributes[method_name.to_s] if raw_attributes.key?(method_name.to_s)
+
+        super
+      end
+
+      def respond_to_missing?(method_name, include_private = false)
+        raw_attributes.key?(method_name.to_s) || super
+      end
+    end
+
+    # Represents an OAuth2 Access Token
+    class AccessToken
+      attr_reader :access_token, :token_type, :expires_in, :refresh_token, :scope, :id_token
+
+      def initialize(attributes = {})
+        @access_token = attributes["access_token"] || attributes[:access_token]
+        @token_type = attributes["token_type"] || attributes[:token_type]
+        @expires_in = attributes["expires_in"] || attributes[:expires_in]
+        @refresh_token = attributes["refresh_token"] || attributes[:refresh_token]
+        @scope = attributes["scope"] || attributes[:scope]
+        @id_token = attributes["id_token"] || attributes[:id_token]
+      end
+
+      def to_h
+        {
+          "access_token" => access_token,
+          "token_type" => token_type,
+          "expires_in" => expires_in,
+          "refresh_token" => refresh_token,
+          "scope" => scope,
+          "id_token" => id_token
+        }.compact
+      end
+    end
+  end
+end

data/lib/omniauth/oidc/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module OmniauthOidc
-  VERSION = "0.2.7"
+  VERSION = "1.0.1"
 end