omniauth_openid_federation 1.3.0 → 2.0.0

data/lib/omniauth_openid_federation/time_helpers.rb

@@ -0,0 +1,67 @@
+# Time helper utilities for compatibility with ActiveSupport
+# Provides time methods that work with or without Time.zone
+module OmniauthOpenidFederation
+  module TimeHelpers
+    # Get current time, using Time.zone if available, otherwise Time
+    #
+    # @return [Time] Current time
+    def self.now
+      if time_zone_available?
+        Time.zone.now
+      else
+        # rubocop:disable Rails/TimeZone
+        Time.now
+        # rubocop:enable Rails/TimeZone
+      end
+    end
+
+    # Convert a timestamp to Time, using Time.zone if available, otherwise Time
+    #
+    # @param timestamp [Integer, Float] Unix timestamp
+    # @return [Time] Time object representing the timestamp
+    def self.at(timestamp)
+      if time_zone_available?
+        Time.zone.at(timestamp)
+      else
+        # rubocop:disable Rails/TimeZone
+        Time.at(timestamp)
+        # rubocop:enable Rails/TimeZone
+      end
+    end
+
+    # Parse a time string, using Time.zone if available, otherwise Time
+    #
+    # @param time_string [String] Time string to parse
+    # @return [Time] Parsed time object
+    def self.parse(time_string)
+      if time_zone_available?
+        Time.zone.parse(time_string)
+      else
+        # rubocop:disable Rails/TimeZone
+        Time.parse(time_string)
+        # rubocop:enable Rails/TimeZone
+      end
+    end
+
+    # Check if Time.zone is available and configured
+    #
+    # @return [Boolean] true if Time.zone is available and not nil
+    def self.time_zone_available?
+      return false unless defined?(ActiveSupport)
+      return false unless Time.respond_to?(:zone)
+
+      begin
+        !Time.zone.nil?
+      rescue
+        false
+      end
+    end
+
+    # Seconds to add to {TimeHelpers.now} for JWT request object expiration.
+    #
+    # @return [Integer]
+    def self.request_object_expiration_offset
+      Constants::REQUEST_OBJECT_EXPIRATION_SECONDS
+    end
+  end
+end

data/lib/omniauth_openid_federation/user_info.rb

@@ -0,0 +1,15 @@
+module OmniauthOpenidFederation
+  class UserInfo
+    attr_reader :raw_attributes
+
+    def initialize(raw_attributes)
+      @raw_attributes = raw_attributes.each_with_object({}) do |(key, value), claims|
+        claims[key.to_sym] = value
+      end
+    end
+
+    def as_json(_options = {})
+      raw_attributes.transform_keys(&:to_s)
+    end
+  end
+end

data/lib/omniauth_openid_federation/utils.rb

@@ -1,15 +1,25 @@
 # Utility functions for omniauth_openid_federation
+require_relative "string_helpers"
+
 module OmniauthOpenidFederation
   module Utils
     # Convert hash to HashWithIndifferentAccess if available
     #
     # @param hash [Hash, Object] The hash to convert
     # @return [Hash, HashWithIndifferentAccess] Converted hash
-    def self.to_indifferent_hash(hash)
+    def self.to_indifferent_hash(value)
+      hash = if value.is_a?(Hash)
+        value
+      elsif value.respond_to?(:to_h)
+        value.to_h
+      else
+        {}
+      end
+
       if defined?(ActiveSupport::HashWithIndifferentAccess)
         ActiveSupport::HashWithIndifferentAccess.new(hash)
       else
-        hash.is_a?(Hash) ? hash : hash.to_h
+        hash
       end
     end
 
@@ -18,7 +28,7 @@ module OmniauthOpenidFederation
     # @param path [String, nil] The file path
     # @return [String] Sanitized path (filename only)
     def self.sanitize_path(path)
-      return "[REDACTED]" if path.nil? || path.empty?
+      return "[REDACTED]" if StringHelpers.blank?(path)
       File.basename(path)
     end
 
@@ -27,7 +37,7 @@ module OmniauthOpenidFederation
     # @param uri [String, nil] The URI
     # @return [String] Sanitized URI
     def self.sanitize_uri(uri)
-      return "[REDACTED]" if uri.nil? || uri.empty?
+      return "[REDACTED]" if StringHelpers.blank?(uri)
       begin
         parsed = URI.parse(uri)
         "#{parsed.scheme}://#{parsed.host}/[REDACTED]"
@@ -70,16 +80,13 @@ module OmniauthOpenidFederation
     def self.validate_file_path!(path, allowed_dirs: nil)
       raise SecurityError, "File path cannot be nil" if path.nil?
 
-      # Convert Pathname to string if needed
       path_str = path.to_s
       raise SecurityError, "File path cannot be empty" if path_str.empty?
 
-      # Check for path traversal attempts
       if path_str.include?("..") || path_str.include?("~")
         raise SecurityError, "Path traversal detected in: #{sanitize_path(path_str)}"
       end
 
-      # Resolve to absolute path
       resolved = File.expand_path(path_str)
 
       # Validate it's within allowed directories if specified
@@ -120,7 +127,6 @@ module OmniauthOpenidFederation
       n = Base64.urlsafe_encode64(key.n.to_s(2), padding: false)
       e = Base64.urlsafe_encode64(key.e.to_s(2), padding: false)
 
-      # Generate kid (key ID) from public key
       public_key_pem = key.public_key.to_pem
       kid = Digest::SHA256.hexdigest(public_key_pem)[0, 16]
 
@@ -131,7 +137,6 @@ module OmniauthOpenidFederation
         e: e
       }
 
-      # Add use field if specified
       jwk[:use] = use if use
 
       jwk

data/lib/omniauth_openid_federation/validators.rb

@@ -1,6 +1,7 @@
 # Input validation utilities for omniauth_openid_federation
 require_relative "constants"
 require_relative "configuration"
+require_relative "string_helpers"
 
 module OmniauthOpenidFederation
   module Validators
@@ -8,20 +9,54 @@ module OmniauthOpenidFederation
     #
     # @param private_key [OpenSSL::PKey::RSA, String, nil] The private key to validate
     # @raise [ConfigurationError] If private key is missing or invalid
-    def self.validate_private_key!(private_key)
+    def self.validate_private_key!(private_key, min_bits: Constants::MIN_RSA_KEY_BITS)
       if private_key.nil?
         raise ConfigurationError, "Private key is required for signed request objects"
       end
 
-      # Try to parse if it's a string
-      if private_key.is_a?(String)
-        begin
-          OpenSSL::PKey::RSA.new(private_key)
-        rescue => e
-          raise ConfigurationError, "Invalid private key format: #{e.message}"
+      normalized_key =
+        if private_key.is_a?(String)
+          begin
+            OpenSSL::PKey::RSA.new(private_key)
+          rescue => error
+            raise ConfigurationError, "Invalid private key format: #{error.message}"
+          end
+        elsif private_key.is_a?(OpenSSL::PKey::RSA)
+          private_key
+        else
+          raise ConfigurationError, "Private key must be an OpenSSL::PKey::RSA instance or PEM string"
         end
-      elsif !private_key.is_a?(OpenSSL::PKey::RSA)
-        raise ConfigurationError, "Private key must be an OpenSSL::PKey::RSA instance or PEM string"
+
+      if min_bits.to_i.positive? && normalized_key.n.num_bits < min_bits.to_i
+        raise ConfigurationError,
+          "RSA private key must be at least #{min_bits} bits (got #{normalized_key.n.num_bits} bits)"
+      end
+
+      true
+    end
+
+    def self.validate_required_request_object_claims!(claims, required_names)
+      required = Array(required_names).map(&:to_s).uniq
+      return true if required.empty?
+
+      normalized_claims = (claims || {}).each_with_object({}) do |(key, value), hash|
+        hash[key.to_s] = value
+      end
+
+      missing = required.reject { |name| StringHelpers.present?(normalized_claims[name]) }
+      return true if missing.empty?
+
+      raise ConfigurationError, "Missing required request object claims: #{missing.join(", ")}"
+    end
+
+    def self.validate_allowed_acr_value!(acr_value, allowed_acr_values)
+      allowed = Array(allowed_acr_values).map(&:to_s).map(&:strip).reject { |value| StringHelpers.blank?(value) }
+      return true if allowed.empty?
+
+      token_acr = acr_value.to_s.strip
+      if StringHelpers.blank?(token_acr) || !allowed.include?(token_acr)
+        raise ValidationError,
+          "ID token acr mismatch: expected one of [#{allowed.join(", ")}], got '#{acr_value}'"
       end
 
       true
@@ -82,10 +117,8 @@ module OmniauthOpenidFederation
     def self.validate_client_options!(client_options)
       client_options ||= {}
 
-      # Normalize hash keys to symbols
       normalized = normalize_hash(client_options)
 
-      # Validate required fields (structure validation, not security)
       if StringHelpers.blank?(normalized[:identifier])
         raise ConfigurationError, "Client identifier is required"
       end
@@ -94,8 +127,6 @@ module OmniauthOpenidFederation
         raise ConfigurationError, "Redirect URI is required"
       end
 
-      # Basic format check for redirect URI (config validation, not security)
-      # Note: Config values are trusted, we only check format to catch config errors
       begin
         parsed = URI.parse(normalized[:redirect_uri].to_s)
         unless parsed.is_a?(URI::HTTP) || parsed.is_a?(URI::HTTPS)
@@ -105,10 +136,8 @@ module OmniauthOpenidFederation
         raise ConfigurationError, "Invalid redirect URI format: #{e.message}"
       end
 
-      # Validate private key (required for security)
       validate_private_key!(normalized[:private_key])
 
-      # Basic format check for endpoints (config validation, not security)
       %i[authorization_endpoint token_endpoint jwks_uri].each do |endpoint|
         if normalized.key?(endpoint) && !StringHelpers.blank?(normalized[endpoint])
           # Endpoints can be paths or full URLs
@@ -145,7 +174,6 @@ module OmniauthOpenidFederation
       str = value.to_s.strip
       return nil if str.length > max_length
 
-      # Only allow printable ASCII (whitelist approach)
       unless allow_control_chars
         str = str.gsub(/[^\x20-\x7E]/, "")
       end
@@ -159,15 +187,16 @@ module OmniauthOpenidFederation
       max_length ||= ::OmniauthOpenidFederation::Configuration.config.max_string_length
       raise SecurityError, "URI cannot be nil" if uri_str.nil?
 
-      str = uri_str.to_s.strip
+      original_str = uri_str.to_s
+      sanitized = original_str.gsub(/[^\x20-\x7E]/, "")
+      raise SecurityError, "URI contains invalid characters (only printable ASCII allowed)" if sanitized != original_str
+
+      str = sanitized.strip
       raise SecurityError, "URI cannot be empty" if str.empty?
       raise SecurityError, "URI exceeds maximum length of #{max_length} characters" if str.length > max_length
 
-      sanitized = str.gsub(/[^\x20-\x7E]/, "")
-      raise SecurityError, "URI contains invalid characters (only printable ASCII allowed)" if sanitized != str
-
       begin
-        parsed = URI.parse(sanitized)
+        parsed = URI.parse(str)
       rescue URI::InvalidURIError => e
         raise SecurityError, "Invalid URI format: #{e.message}"
       end
@@ -180,7 +209,7 @@ module OmniauthOpenidFederation
         raise SecurityError, "URI must be HTTP or HTTPS"
       end
 
-      raise SecurityError, "URI host cannot be empty" if parsed.host.nil? || parsed.host.empty?
+      raise SecurityError, "URI host cannot be empty" if StringHelpers.blank?(parsed.host)
 
       parsed
     end
@@ -199,22 +228,16 @@ module OmniauthOpenidFederation
 
       case acr_values
       when Array
-        # Filter out blanks (arrays may already be sanitized)
         values = acr_values.map(&:to_s).map(&:strip).reject { |v| StringHelpers.blank?(v) }
       when String
-        # Trim and split by whitespace and validate each value using allowed characters
-        # Security: Use simple space split (no regexp to avoid ReDoS)
         trimmed = acr_values.strip
         values = trimmed.split(" ").map(&:strip).reject { |v| StringHelpers.blank?(v) }
       else
-        # Convert to string, trim and split
         str = acr_values.to_s.strip
         return nil if str.length > max_length
-        # Security: Use simple space split (no regexp to avoid ReDoS)
         values = str.split(" ").map(&:strip).reject { |v| StringHelpers.blank?(v) }
       end
 
-      # Sanitize each value unless already sanitized
       unless skip_sanitization
         values = values.map { |v| sanitize_request_param(v) }.compact
       end
@@ -243,9 +266,8 @@ module OmniauthOpenidFederation
         raise ConfigurationError, "client_id cannot be empty after trimming"
       end
 
-      # Sanitize using allowed characters (printable ASCII only)
       sanitized = sanitize_request_param(str)
-      if sanitized.nil? || sanitized.empty?
+      if StringHelpers.blank?(sanitized)
         raise ConfigurationError, "client_id contains invalid characters"
       end
 
@@ -268,7 +290,6 @@ module OmniauthOpenidFederation
         raise ConfigurationError, "redirect_uri cannot be empty after trimming"
       end
 
-      # Validate as URI (includes allowed characters validation)
       validated = validate_uri_safe!(str, allowed_schemes: ["http", "https"])
       validated.to_s
     end
@@ -289,7 +310,6 @@ module OmniauthOpenidFederation
         return nil
       end
 
-      # Normalize to array
       scopes = case scope
       when Array
         scope.map(&:to_s).map(&:strip).reject { |s| StringHelpers.blank?(s) }
@@ -299,14 +319,12 @@ module OmniauthOpenidFederation
         scope.to_s.strip.split(" ").map(&:strip).reject { |s| StringHelpers.blank?(s) }
       end
 
-      # Validate each scope value (allowed: printable ASCII)
       scopes = scopes.map { |s| sanitize_request_param(s) }.compact
 
       if scopes.empty?
         raise ConfigurationError, "scope cannot be empty after validation"
       end
 
-      # Check for "openid" scope if required
       if require_openid && !scopes.include?("openid")
         raise ConfigurationError, "scope MUST include 'openid' per OIDC Core 1.0 spec"
       end
@@ -336,9 +354,8 @@ module OmniauthOpenidFederation
         raise ConfigurationError, "state cannot be empty after trimming"
       end
 
-      # Sanitize using allowed characters (printable ASCII only)
       sanitized = sanitize_request_param(str)
-      if sanitized.nil? || sanitized.empty?
+      if StringHelpers.blank?(sanitized)
         raise ConfigurationError, "state contains invalid characters"
       end
 
@@ -363,10 +380,8 @@ module OmniauthOpenidFederation
         return nil
       end
 
-      # Sanitize using allowed characters (printable ASCII only)
-      # OIDC Core 1.0: nonce value is a case-sensitive string
       sanitized = sanitize_request_param(str)
-      if sanitized.nil? || sanitized.empty?
+      if StringHelpers.blank?(sanitized)
         if required
           raise ConfigurationError, "nonce contains invalid characters"
         end
@@ -392,13 +407,11 @@ module OmniauthOpenidFederation
         raise ConfigurationError, "response_type cannot be empty after trimming"
       end
 
-      # Sanitize using allowed characters (printable ASCII only)
       sanitized = sanitize_request_param(str)
-      if sanitized.nil? || sanitized.empty?
+      if StringHelpers.blank?(sanitized)
         raise ConfigurationError, "response_type contains invalid characters"
       end
 
-      # Validate it's a known response type (space-separated list)
       valid_types = ["code", "id_token", "token", "id_token token", "code id_token", "code token", "code id_token token"]
       types = sanitized.split(" ").map(&:strip)
       unless types.all? { |t| valid_types.include?(t) || t.match?(/^[a-z_]+$/) }
@@ -426,10 +439,8 @@ module OmniauthOpenidFederation
         raise SecurityError, "Entity identifier cannot be empty after trimming"
       end
 
-      # Validate as URI (includes allowed characters and length validation)
       validate_uri_safe!(str, max_length: max_length, allowed_schemes: ["http", "https"])
 
-      # Return trimmed and validated value
       str
     end
   end

data/lib/omniauth_openid_federation/version.rb

@@ -1,3 +1,3 @@
 module OmniauthOpenidFederation
-  VERSION = "1.3.0".freeze
+  VERSION = "2.0.0".freeze
 end

data/lib/omniauth_openid_federation.rb

@@ -1,7 +1,7 @@
 # OmniAuth OpenID Federation
 #
-# Custom OmniAuth strategy for OpenID Federation providers using openid_connect gem
-# supporting signed request objects, ID token encryption, and OpenID Federation.
+# Custom OmniAuth strategy for OpenID Federation providers supporting signed request objects,
+# ID token encryption, and OpenID Federation.
 #
 # @see https://openid.net/specs/openid-federation-1_0.html
 module OmniauthOpenidFederation
@@ -28,6 +28,7 @@ end
 
 require_relative "omniauth_openid_federation/version"
 require_relative "omniauth_openid_federation/string_helpers"
+require_relative "omniauth_openid_federation/time_helpers"
 require_relative "omniauth_openid_federation/logger"
 require_relative "omniauth_openid_federation/configuration"
 require_relative "omniauth_openid_federation/errors"
@@ -38,7 +39,13 @@ require_relative "omniauth_openid_federation/constants"
 require_relative "omniauth_openid_federation/cache"
 require_relative "omniauth_openid_federation/cache_adapter"
 require_relative "omniauth_openid_federation/utils"
+require_relative "omniauth_openid_federation/jwe"
 require_relative "omniauth_openid_federation/jws"
+require_relative "omniauth_openid_federation/http_errors"
+require_relative "omniauth_openid_federation/id_token"
+require_relative "omniauth_openid_federation/user_info"
+require_relative "omniauth_openid_federation/secure_compare"
+require_relative "omniauth_openid_federation/oidc_client"
 require_relative "omniauth_openid_federation/jwks/normalizer"
 require_relative "omniauth_openid_federation/jwks/fetch"
 require_relative "omniauth_openid_federation/jwks/decode"
@@ -55,12 +62,12 @@ require_relative "omniauth_openid_federation/federation/trust_chain_resolver"
 require_relative "omniauth_openid_federation/federation/metadata_policy_merger"
 require_relative "omniauth_openid_federation/federation/signed_jwks"
 require_relative "omniauth_openid_federation/federation_endpoint"
-require_relative "omniauth_openid_federation/rack_endpoint"
 require_relative "omniauth_openid_federation/entity_statement_reader"
 require_relative "omniauth_openid_federation/tasks_helper"
 require_relative "omniauth_openid_federation/endpoint_resolver"
 require_relative "omniauth_openid_federation/strategy"
 require_relative "omniauth_openid_federation/access_token"
+require_relative "omniauth_openid_federation/jwt_response_decoder"
 
 module OmniauthOpenidFederation
   # Rotate JWKS cache for a provider

data/lib/tasks/omniauth_openid_federation.rake

@@ -1,5 +1,6 @@
 # Rake tasks for OmniAuth OpenID Federation
 # Thin wrappers around TasksHelper for CLI interface
+require_relative "../omniauth_openid_federation/time_helpers"
 
 namespace :openid_federation do
   desc "Fetch entity statement from OpenID Federation provider"
@@ -262,8 +263,8 @@ namespace :openid_federation do
       end
       puts "   Issuer: #{metadata[:issuer]}"
       puts "   Subject: #{metadata[:sub]}"
-      puts "   Expires: #{Time.at(metadata[:exp])}" if metadata[:exp]
-      puts "   Issued At: #{Time.at(metadata[:iat])}" if metadata[:iat]
+      puts "   Expires: #{OmniauthOpenidFederation::TimeHelpers.at(metadata[:exp])}" if metadata[:exp]
+      puts "   Issued At: #{OmniauthOpenidFederation::TimeHelpers.at(metadata[:iat])}" if metadata[:iat]
       puts
 
       # Key status information
@@ -456,8 +457,7 @@ namespace :openid_federation do
       begin
         well_known_url = "#{base_url}/.well-known/openid-federation"
         puts "📥 Attempting to fetch entity statement from: #{well_known_url}"
-        require "http"
-        response = HTTP.timeout(connect: 5, read: 5).get(well_known_url)
+        response = OmniauthOpenidFederation::HttpClient.get(well_known_url, timeout: 5, max_retries: 0)
         if response.status.success?
           entity_statement_path = "/tmp/entity_statement_#{Time.now.to_i}.json"
           File.write(entity_statement_path, response.body.to_s)
@@ -594,7 +594,7 @@ namespace :openid_federation do
           if value
             if [:exp, :iat, :auth_time].include?(key)
               time_value = begin
-                Time.at(value)
+                OmniauthOpenidFederation::TimeHelpers.at(value)
               rescue
                 value
               end

data/sig/omniauth_openid_federation.rbs

@@ -71,7 +71,8 @@ module OmniauthOpenidFederation
   end
 
   class HttpClient
-    def self.get: (String uri, ?timeout: Integer, ?max_retries: Integer, ?retry_delay: Integer) -> untyped
+    def self.get: (String uri, ?Hash[Symbol, untyped] options) -> untyped
+    def self.post: (String uri, ?Hash[Symbol, untyped] options) -> untyped
   end
 
   class Logger
@@ -183,6 +184,12 @@ module OmniauthOpenidFederation
     def self.blank?: (untyped value) -> bool
   end
 
+  module TimeHelpers
+    def self.now: () -> Time
+    def self.at: (Integer | Float timestamp) -> Time
+    def self.parse: (String time_string) -> Time
+  end
+
   module Validators
     def self.validate_private_key!: (untyped private_key) -> void
     def self.normalize_hash: (untyped hash) -> Hash[Symbol, untyped]

data/sig/strategy.rbs

@@ -1,8 +1,8 @@
 module OmniAuth
   module Strategies
     class OpenIDFederation < OmniAuth::Strategies::OAuth2
-      def client: () -> untyped
-      def oidc_client: () -> untyped
+      def client: () -> OmniauthOpenidFederation::OidcClient
+      def oidc_client: () -> OmniauthOpenidFederation::OidcClient
       def request_phase: () -> untyped
       def callback_phase: () -> untyped
       def auth_hash: () -> OmniAuth::AuthHash
@@ -10,7 +10,7 @@ module OmniAuth
       def raw_info: () -> Hash[String, untyped]
       def client_jwk_signing_key: () -> untyped
       def options: () -> untyped
-      def exchange_authorization_code: (String authorization_code) -> untyped
+      def exchange_authorization_code: (String authorization_code) -> OmniauthOpenidFederation::AccessToken
       def new_state: () -> String
       def new_nonce: () -> String
       def resolve_endpoints_from_metadata: (Hash[Symbol, untyped] client_options_hash) -> Hash[Symbol, String?]
@@ -21,7 +21,7 @@ module OmniAuth
       def resolve_jwks_uri: (Hash[Symbol, untyped] normalized_options) -> String?
       def build_base_url: (Hash[Symbol, untyped] client_options_hash) -> String
       def build_endpoint: (String base_url, String path) -> String
-      def decode_id_token: (String id_token) -> Hash[String, untyped]
+      def decode_id_token: (String id_token) -> OmniauthOpenidFederation::IdToken
       def encrypted_token?: (String token) -> bool
       def decode_userinfo: (untyped userinfo) -> Hash[String, untyped]
       def load_provider_entity_statement: () -> Hash[Symbol, untyped]?
@@ -45,9 +45,10 @@ module OmniAuth
   end
 end
 
-module OpenIDConnect
+module OmniauthOpenidFederation
   class AccessToken
     def resource_request: () { () -> untyped } -> untyped
+    def userinfo!: () -> untyped
     def get_strategy_options: () -> Hash[Symbol, untyped]
     def extract_encryption_key_for_decryption: () -> untyped
     def fetch_signed_jwks: (Hash[Symbol, untyped] strategy_options) -> Hash[String, untyped]?
@@ -55,4 +56,3 @@ module OpenIDConnect
     def resolve_jwks_uri_from_entity_statement: (Hash[Symbol, untyped] strategy_options) -> String?
   end
 end
-