omniauth_openid_federation 1.3.2 → 2.0.0

data/lib/omniauth_openid_federation/access_token.rb

@@ -1,150 +1,110 @@
-require "jwt"
-require "jwe"
 require "json"
-require "uri"
 require_relative "string_helpers"
 require_relative "logger"
 require_relative "validators"
 require_relative "utils"
-require_relative "key_extractor"
+require_relative "http_errors"
+require_relative "jwt_response_decoder"
 
-# AccessToken extension for OpenID Federation ID token decryption and signed JWKS support
-# @see https://openid.net/specs/openid-federation-1_0.html OpenID Federation 1.0 Specification
-# @see https://openid.net/specs/openid-connect-core-1_0.html OpenID Connect Core 1.0
-#
-# Extends OpenIDConnect::AccessToken to support:
-# - ID Token decryption (RSA-OAEP + A128CBC-HS256) - Required for token security
-# - Signed JWKS validation - Required for key rotation compliance
-# - Entity statement key loading for signed JWKS validation
-#
-# This extension is automatically loaded when the omniauth_openid_federation library is required.
-module OpenIDConnect
+module OmniauthOpenidFederation
   class AccessToken
-    def resource_request
-      res = yield
-      status_code = if res.status.is_a?(Integer)
-        res.status
-      else
-        (res.status.respond_to?(:code) ? res.status.code : res.status)
+    attr_reader :access_token, :refresh_token, :expires_in, :id_token, :client
+
+    def initialize(access_token:, client:, refresh_token: nil, expires_in: nil, id_token: nil,
+      strategy_options: nil, oauth_token: nil)
+      @access_token = access_token
+      @refresh_token = refresh_token
+      @expires_in = expires_in
+      @id_token = id_token
+      @client = client
+      @strategy_options = strategy_options
+      @oauth_token = oauth_token
+    end
+
+    def self.from_oauth2_token(oauth_token, strategy_options: nil)
+      token_params = oauth_token.params || {}
+      id_token_value = token_params["id_token"] || token_params[:id_token]
+
+      new(
+        access_token: oauth_token.token,
+        refresh_token: oauth_token.refresh_token,
+        expires_in: oauth_token.expires_in,
+        id_token: id_token_value,
+        client: oauth_token.client,
+        strategy_options: strategy_options,
+        oauth_token: oauth_token
+      )
+    end
+
+    def userinfo!(params = {}, http_method: :get, headers: {})
+      unless [:get, :post].include?(http_method)
+        raise ArgumentError, "http_method must be :get or :post"
       end
-      case status_code
-      when 200
-        # Simple check if the response looks like a JWT string (could be ID token or encrypted userinfo)
-        if /\A[\w\-.]+\z/.match?(res.body)
-          # Check if it's encrypted (JWE format has 5 parts separated by dots)
-          is_encrypted = res.body.split(".").length == 5
 
-          if is_encrypted
-            # Decrypt if encrypted (ID token or userinfo encryption)
-            # Use encryption key from JWKS if available, fallback to private_key
-            encryption_key = extract_encryption_key_for_decryption
-            # Decrypt using JWE gem
-            plain_text = JWE.decrypt(res.body, encryption_key)
+      endpoint = client.userinfo_endpoint
+      unless OmniauthOpenidFederation::StringHelpers.present?(endpoint)
+        raise ConfigurationError, "Userinfo endpoint not configured"
+      end
 
-            # Check if plain_text is a JWT (3 parts) or JSON payload
-            # For nested JWTs: encrypted JWT contains signed JWT as plaintext
-            # For direct encryption: encrypted JWT may contain JWT representation of payload
-            if plain_text.split(".").length == 3
-              # It's a JWT (signed or unsigned) - decode it
-              signed_jwt = plain_text
-            else
-              # Try to parse as JSON, if that fails, it might be a malformed JWT
-              begin
-                return JSON.parse(plain_text).with_indifferent_access
-              rescue JSON::ParserError
-                # If parsing fails, treat as JWT and try to decode
-                signed_jwt = plain_text
-              end
-            end
-          else
-            # Not encrypted, use body directly (signed JWT)
-            signed_jwt = res.body
-          end
+      unless @oauth_token
+        raise ConfigurationError, "OAuth token reference not available for userinfo request"
+      end
 
-          # Try to get options from strategy configuration
-          strategy_options = get_strategy_options
+      response = case http_method
+      when :get
+        @oauth_token.get(endpoint.to_s, params: params, headers: headers)
+      when :post
+        @oauth_token.post(
+          endpoint.to_s,
+          body: params,
+          headers: headers.merge("Content-Type" => "application/x-www-form-urlencoded")
+        )
+      end
 
-          # Access client_options from the options hash and normalize keys
-          raw_client_options = strategy_options[:client_options] || strategy_options["client_options"] || {}
-          client_options = OmniauthOpenidFederation::Validators.normalize_hash(raw_client_options)
+      claims = parse_userinfo_response(response)
+      OmniauthOpenidFederation::UserInfo.new(claims)
+    end
 
-          # Get jwks_uri from client_options or fallback to client
-          jwks_uri_value = client_options[:jwks_uri] || ((respond_to?(:client) && client&.respond_to?(:jwks_uri)) ? client.jwks_uri : nil)
+    def decode_response_body(body)
+      JwtResponseDecoder.new(strategy_options: get_strategy_options, client: client).decode(body)
+    end
 
-          jwks_uri =
-            if jwks_uri_value && %r{https?://.+}.match?(jwks_uri_value.to_s)
-              URI.parse(jwks_uri_value.to_s)
-            elsif jwks_uri_value
-              URI::HTTPS.build(
-                host: client_options[:host] || ((respond_to?(:client) && client&.respond_to?(:host)) ? client.host : nil),
-                path: jwks_uri_value.to_s
-              )
-            else
-              # If we can't determine jwks_uri, we'll need to handle this in the JWT decode
-              nil
-            end
+    private
 
-          # Always use federation features (signed JWKS preferred, fallback to standard JWKS)
-          normalized_strategy_options = OmniauthOpenidFederation::Validators.normalize_hash(strategy_options)
+    def parse_userinfo_response(response)
+      body = response.respond_to?(:parsed) ? response.parsed : nil
+      if body.is_a?(Hash)
+        return body
+      end
 
-          # Check if JWT is signed or unsigned
-          # Decode header to check algorithm
-          begin
-            header_part = signed_jwt.split(".").first
-            header = JSON.parse(Base64.urlsafe_decode64(header_part))
-            algorithm = header["alg"] || header[:alg]
+      body_text =
+        if body.is_a?(String) && OmniauthOpenidFederation::StringHelpers.present?(body)
+          body
+        elsif response.respond_to?(:body)
+          response.body.to_s
+        else
+          ""
+        end
 
-            if algorithm == "none" || algorithm.nil?
-              # Unsigned JWT - decode without verification
-              jwt = ::JWT.decode(signed_jwt, nil, false)
-            else
-              # Signed JWT - decode with verification
-              signed_jwks = fetch_signed_jwks(normalized_strategy_options)
-              if signed_jwks
-                # Decode using signed JWKS
-                jwt = ::JWT.decode(
-                  signed_jwt,
-                  nil,
-                  true,
-                  {algorithms: [algorithm], jwks: signed_jwks}
-                )
-              else
-                # Fallback to standard JWKS
-                # Try to resolve JWKS URI from entity statement if not in client_options
-                unless jwks_uri
-                  OmniauthOpenidFederation::Logger.debug("[AccessToken] JWKS URI not in client_options, trying to resolve from entity statement")
-                  jwks_uri = resolve_jwks_uri_from_entity_statement(normalized_strategy_options)
-                  if jwks_uri
-                    OmniauthOpenidFederation::Logger.debug("[AccessToken] Successfully resolved JWKS URI from entity statement")
-                    # Convert to URI object if it's a string
-                    jwks_uri = URI.parse(jwks_uri) if jwks_uri.is_a?(String) && !jwks_uri.is_a?(URI)
-                  end
-                end
+      return {} if OmniauthOpenidFederation::StringHelpers.blank?(body_text)
 
-                unless jwks_uri
-                  error_msg = "JWKS URI not available. Cannot verify JWT signature. Provide jwks_uri in client_options or entity statement."
-                  OmniauthOpenidFederation::Logger.error("[AccessToken] #{error_msg}")
-                  raise OmniauthOpenidFederation::ConfigurationError, error_msg
-                end
+      decode_response_body(body_text)
+    rescue JSON::ParserError => error
+      raise ValidationError, "Failed to parse userinfo response: #{error.message}", error.backtrace
+    end
 
-                entity_statement_keys = load_entity_statement_keys_for_jwks_validation(normalized_strategy_options)
-                jwt = OmniauthOpenidFederation::Jwks::Decode.jwt(
-                  signed_jwt,
-                  jwks_uri.to_s,
-                  entity_statement_keys: entity_statement_keys
-                )
-              end
-            end
-          rescue => e
-            # If header parsing fails, try to decode as unsigned
-            OmniauthOpenidFederation::Logger.warn("[AccessToken] Failed to parse JWT header, trying unsigned decode: #{e.message}")
-            jwt = ::JWT.decode(signed_jwt, nil, false)
-          end
+    public
 
-          jwt.first.with_indifferent_access
-        else
-          JSON.parse(res.body).with_indifferent_access
-        end
+    def resource_request
+      res = yield
+      status_code = if res.status.is_a?(Integer)
+        res.status
+      else
+        (res.status.respond_to?(:code) ? res.status.code : res.status)
+      end
+      case status_code
+      when 200
+        decode_response_body(res.body)
       when 400
         raise BadRequest.new("API Access Faild", res)
       when 401
@@ -158,20 +118,17 @@ module OpenIDConnect
 
     private
 
-    # Get strategy options from client (stored by strategy when client was created)
-    # Falls back to extracting from client attributes if strategy options not available
-    #
-    # @return [Hash] Strategy options hash
     def get_strategy_options
-      # Try to get strategy options stored on client by the strategy
+      if @strategy_options.is_a?(Hash)
+        return @strategy_options
+      end
+
       if respond_to?(:client) && client
         strategy_options = client.instance_variable_get(:@strategy_options)
         return strategy_options if strategy_options&.is_a?(Hash)
       end
 
-      # Fallback: try to extract from client attributes if available
       if respond_to?(:client) && client
-        # Build minimal options from client
         client_options = {}
         client_options[:jwks_uri] = client.jwks_uri.to_s if client.respond_to?(:jwks_uri) && client.jwks_uri
         client_options[:private_key] = client.private_key if client.respond_to?(:private_key) && client.private_key
@@ -181,324 +138,8 @@ module OpenIDConnect
         }
       end
 
-      # Last resort: return empty hash (will cause errors later, but at least won't crash immediately)
       OmniauthOpenidFederation::Logger.warn("[AccessToken] Could not determine strategy options from client. Some features may not work correctly.")
       {}
     end
-
-    # Extract encryption key for decrypting ID tokens or userinfo responses
-    # Uses KeyExtractor to support separate signing/encryption keys per OpenID Federation spec
-    #
-    # @return [OpenSSL::PKey::RSA] Encryption key
-    def extract_encryption_key_for_decryption
-      # Try to get strategy options
-      strategy_options = get_strategy_options
-      raw_client_options = strategy_options[:client_options] || strategy_options["client_options"]
-      client_options = OmniauthOpenidFederation::Validators.normalize_hash(raw_client_options)
-
-      private_key = client_options[:private_key] || ((respond_to?(:client) && client&.respond_to?(:private_key)) ? client.private_key : nil)
-      jwks = client_options[:jwks] || client_options["jwks"]
-
-      # Try to load metadata for key extraction
-      metadata = nil
-      entity_statement_path = strategy_options[:entity_statement_path]
-      if OmniauthOpenidFederation::StringHelpers.present?(entity_statement_path)
-        begin
-          validated_path = OmniauthOpenidFederation::Utils.validate_file_path!(
-            entity_statement_path,
-            allowed_dirs: defined?(Rails) ? [Rails.root.join("config").to_s] : nil
-          )
-          if File.exist?(validated_path)
-            metadata = JSON.parse(File.read(validated_path))
-          end
-        rescue => e
-          OmniauthOpenidFederation::Logger.debug("[AccessToken] Could not load metadata for key extraction: #{e.message}")
-        end
-      end
-
-      # Extract encryption key from JWKS or use provided private_key (backward compatibility)
-      encryption_key = OmniauthOpenidFederation::KeyExtractor.extract_encryption_key(
-        jwks: jwks,
-        metadata: metadata,
-        private_key: private_key
-      ) || private_key
-
-      OmniauthOpenidFederation::Validators.validate_private_key!(encryption_key)
-      encryption_key
-    end
-
-    def fetch_signed_jwks(strategy_options)
-      # Support entity_statement_path, entity_statement_url, or issuer (like strategy does)
-      entity_statement_path = strategy_options[:entity_statement_path] || strategy_options["entity_statement_path"]
-      entity_statement_url = strategy_options[:entity_statement_url] || strategy_options["entity_statement_url"]
-      issuer = strategy_options[:issuer] || strategy_options["issuer"]
-      entity_statement_fingerprint = strategy_options[:entity_statement_fingerprint] || strategy_options["entity_statement_fingerprint"]
-
-      # Load entity statement from path, URL, or issuer
-      entity_statement_content = nil
-
-      # Priority 1: File path (if provided)
-      if OmniauthOpenidFederation::StringHelpers.present?(entity_statement_path)
-        begin
-          validated_path = OmniauthOpenidFederation::Utils.validate_file_path!(
-            entity_statement_path,
-            allowed_dirs: defined?(Rails) ? [Rails.root.join("config").to_s] : nil
-          )
-          if File.exist?(validated_path)
-            entity_statement_content = File.read(validated_path)
-          else
-            OmniauthOpenidFederation::Logger.debug("[AccessToken] Entity statement file not found: #{OmniauthOpenidFederation::Utils.sanitize_path(validated_path)}")
-          end
-        rescue SecurityError => e
-          OmniauthOpenidFederation::Logger.error("[AccessToken] #{e.message}")
-        end
-      end
-
-      # Priority 2: Fetch from URL (if provided)
-      if entity_statement_content.nil? && OmniauthOpenidFederation::StringHelpers.present?(entity_statement_url)
-        begin
-          OmniauthOpenidFederation::Logger.debug("[AccessToken] Fetching entity statement from URL for signed JWKS")
-          entity_statement_instance = OmniauthOpenidFederation::Federation::EntityStatement.fetch!(
-            entity_statement_url,
-            fingerprint: entity_statement_fingerprint
-          )
-          # fetch! returns EntityStatement instance, extract JWT string from it
-          entity_statement_content = entity_statement_instance.entity_statement
-        rescue => e
-          OmniauthOpenidFederation::Logger.warn("[AccessToken] Failed to fetch entity statement from URL: #{e.message}")
-        end
-      end
-
-      # Priority 3: Fetch from issuer (if provided)
-      if entity_statement_content.nil? && OmniauthOpenidFederation::StringHelpers.present?(issuer)
-        begin
-          OmniauthOpenidFederation::Logger.debug("[AccessToken] Fetching entity statement from issuer for signed JWKS")
-          entity_statement_instance = OmniauthOpenidFederation::Federation::EntityStatement.fetch_from_issuer!(
-            issuer,
-            fingerprint: entity_statement_fingerprint
-          )
-          # fetch_from_issuer! returns EntityStatement instance, extract JWT string from it
-          entity_statement_content = entity_statement_instance.entity_statement
-        rescue => e
-          OmniauthOpenidFederation::Logger.warn("[AccessToken] Failed to fetch entity statement from issuer: #{e.message}")
-        end
-      end
-
-      if OmniauthOpenidFederation::StringHelpers.blank?(entity_statement_content)
-        OmniauthOpenidFederation::Logger.debug("[AccessToken] Entity statement not available (path, URL, or issuer not configured), skipping signed JWKS")
-        return nil
-      end
-
-      begin
-        parsed = OmniauthOpenidFederation::Federation::EntityStatementHelper.parse_for_signed_jwks_from_content(
-          entity_statement_content
-        )
-        if parsed.nil?
-          return nil
-        end
-
-        signed_jwks_uri = parsed[:signed_jwks_uri]
-        if OmniauthOpenidFederation::StringHelpers.blank?(signed_jwks_uri)
-          OmniauthOpenidFederation::Logger.warn("[AccessToken] signed_jwks_uri not found in entity statement metadata")
-          return nil
-        end
-
-        # Get entity JWKS for validation
-        entity_jwks = parsed[:entity_jwks]
-
-        # Fetch and validate signed JWKS
-        sanitized_uri = OmniauthOpenidFederation::Utils.sanitize_uri(signed_jwks_uri)
-        OmniauthOpenidFederation::Logger.debug("[AccessToken] Fetching signed JWKS from #{sanitized_uri}")
-        signed_jwks = OmniauthOpenidFederation::Federation::SignedJWKS.fetch!(signed_jwks_uri, entity_jwks)
-        OmniauthOpenidFederation::Logger.debug("[AccessToken] Successfully fetched and validated signed JWKS")
-        signed_jwks
-      rescue SecurityError => e
-        # Security errors should not be silently ignored
-        OmniauthOpenidFederation::Logger.error("[AccessToken] Security error: #{e.message}")
-        nil
-      rescue
-        OmniauthOpenidFederation::Logger.warn("[AccessToken] Failed to fetch signed JWKS, falling back to standard JWKS")
-        # Return nil to allow fallback to standard JWKS, but log the error
-        nil
-      end
-    end
-
-    def load_entity_statement_keys_for_jwks_validation(strategy_options)
-      # Support entity_statement_path, entity_statement_url, or issuer (like strategy does)
-      entity_statement_path = strategy_options[:entity_statement_path] || strategy_options["entity_statement_path"]
-      entity_statement_url = strategy_options[:entity_statement_url] || strategy_options["entity_statement_url"]
-      issuer = strategy_options[:issuer] || strategy_options["issuer"]
-      entity_statement_fingerprint = strategy_options[:entity_statement_fingerprint] || strategy_options["entity_statement_fingerprint"]
-
-      # Load entity statement from path, URL, or issuer
-      entity_statement_content = nil
-
-      # Priority 1: File path (if provided)
-      if OmniauthOpenidFederation::StringHelpers.present?(entity_statement_path)
-        begin
-          validated_path = OmniauthOpenidFederation::Utils.validate_file_path!(
-            entity_statement_path,
-            allowed_dirs: defined?(Rails) ? [Rails.root.join("config").to_s] : nil
-          )
-          if File.exist?(validated_path)
-            entity_statement_content = File.read(validated_path)
-          end
-        rescue SecurityError => e
-          OmniauthOpenidFederation::Logger.error("[AccessToken] #{e.message}")
-        end
-      end
-
-      # Priority 2: Fetch from URL (if provided)
-      if entity_statement_content.nil? && OmniauthOpenidFederation::StringHelpers.present?(entity_statement_url)
-        begin
-          entity_statement_instance = OmniauthOpenidFederation::Federation::EntityStatement.fetch!(
-            entity_statement_url,
-            fingerprint: entity_statement_fingerprint
-          )
-          # fetch! returns EntityStatement instance, extract JWT string from it
-          entity_statement_content = entity_statement_instance.entity_statement
-        rescue => e
-          OmniauthOpenidFederation::Logger.warn("[AccessToken] Failed to fetch entity statement from URL: #{e.message}")
-        end
-      end
-
-      # Priority 3: Fetch from issuer (if provided)
-      if entity_statement_content.nil? && OmniauthOpenidFederation::StringHelpers.present?(issuer)
-        begin
-          entity_statement_instance = OmniauthOpenidFederation::Federation::EntityStatement.fetch_from_issuer!(
-            issuer,
-            fingerprint: entity_statement_fingerprint
-          )
-          # fetch_from_issuer! returns EntityStatement instance, extract JWT string from it
-          entity_statement_content = entity_statement_instance.entity_statement
-        rescue => e
-          OmniauthOpenidFederation::Logger.warn("[AccessToken] Failed to fetch entity statement from issuer: #{e.message}")
-        end
-      end
-
-      if OmniauthOpenidFederation::StringHelpers.blank?(entity_statement_content)
-        OmniauthOpenidFederation::Logger.warn("[AccessToken] Entity statement not available for federation")
-        return nil
-      end
-
-      begin
-        # Parse entity statement to extract keys
-        # entity_statement_content is now always a string (JWT)
-        entity_statement = OmniauthOpenidFederation::Federation::EntityStatement.new(entity_statement_content)
-        parsed = entity_statement.parse
-        entity_jwks = parsed[:jwks] if parsed
-
-        # Extract keys from entity JWKS
-        keys = if entity_jwks.is_a?(Hash) && entity_jwks.key?("keys")
-          entity_jwks["keys"]
-        elsif entity_jwks.is_a?(Hash) && entity_jwks.key?(:keys)
-          entity_jwks[:keys]
-        elsif entity_jwks.is_a?(Array)
-          entity_jwks
-        else
-          []
-        end
-        if keys.empty?
-          OmniauthOpenidFederation::Logger.warn("[AccessToken] No keys found in entity statement")
-          return nil
-        end
-
-        # Convert to format expected by JWT gem (HashWithIndifferentAccess with keys array)
-        jwks_hash = {
-          keys: keys.map { |jwk| jwk.is_a?(Hash) ? jwk : JSON.parse(jwk.to_json) }
-        }
-        OmniauthOpenidFederation::Utils.to_indifferent_hash(jwks_hash)
-      rescue => e
-        error_msg = "Failed to load entity statement keys for JWKS validation: #{e.class} - #{e.message}"
-        OmniauthOpenidFederation::Logger.error("[AccessToken] #{error_msg}")
-        # Return nil to allow fallback, but log the error
-        nil
-      end
-    end
-
-    # Resolve JWKS URI from entity statement if not in client_options
-    #
-    # @param strategy_options [Hash] Strategy options hash
-    # @return [String, nil] JWKS URI or nil if not available
-    def resolve_jwks_uri_from_entity_statement(strategy_options)
-      # Try both symbol and string keys (OmniAuth options can be either)
-      entity_statement_path = strategy_options[:entity_statement_path] || strategy_options["entity_statement_path"]
-      entity_statement_url = strategy_options[:entity_statement_url] || strategy_options["entity_statement_url"]
-      issuer = strategy_options[:issuer] || strategy_options["issuer"]
-      entity_statement_fingerprint = strategy_options[:entity_statement_fingerprint] || strategy_options["entity_statement_fingerprint"]
-
-      # Debug logging to help diagnose issues
-      if OmniauthOpenidFederation::StringHelpers.blank?(entity_statement_path) &&
-          OmniauthOpenidFederation::StringHelpers.blank?(entity_statement_url) &&
-          OmniauthOpenidFederation::StringHelpers.blank?(issuer)
-        OmniauthOpenidFederation::Logger.debug("[AccessToken] No entity statement source configured (path, URL, or issuer) in strategy options. Available keys: #{strategy_options.keys.join(", ")}")
-      end
-
-      # Load entity statement from path, URL, or issuer
-      entity_statement_content = nil
-
-      # Priority 1: File path (if provided)
-      if OmniauthOpenidFederation::StringHelpers.present?(entity_statement_path)
-        begin
-          validated_path = OmniauthOpenidFederation::Utils.validate_file_path!(
-            entity_statement_path,
-            allowed_dirs: defined?(Rails) ? [Rails.root.join("config").to_s] : nil
-          )
-          if File.exist?(validated_path)
-            entity_statement_content = File.read(validated_path)
-          end
-        rescue SecurityError => e
-          OmniauthOpenidFederation::Logger.debug("[AccessToken] Could not load entity statement from path: #{e.message}")
-        end
-      end
-
-      # Priority 2: Fetch from URL (if provided)
-      if entity_statement_content.nil? && OmniauthOpenidFederation::StringHelpers.present?(entity_statement_url)
-        begin
-          entity_statement_instance = OmniauthOpenidFederation::Federation::EntityStatement.fetch!(
-            entity_statement_url,
-            fingerprint: entity_statement_fingerprint
-          )
-          # fetch! returns EntityStatement instance, extract JWT string from it
-          entity_statement_content = entity_statement_instance.entity_statement
-        rescue => e
-          OmniauthOpenidFederation::Logger.debug("[AccessToken] Could not fetch entity statement from URL: #{e.message}")
-        end
-      end
-
-      # Priority 3: Fetch from issuer (if provided)
-      if entity_statement_content.nil? && OmniauthOpenidFederation::StringHelpers.present?(issuer)
-        begin
-          entity_statement_instance = OmniauthOpenidFederation::Federation::EntityStatement.fetch_from_issuer!(
-            issuer,
-            fingerprint: entity_statement_fingerprint
-          )
-          # fetch_from_issuer! returns EntityStatement instance, extract JWT string from it
-          entity_statement_content = entity_statement_instance.entity_statement
-        rescue => e
-          OmniauthOpenidFederation::Logger.debug("[AccessToken] Could not fetch entity statement from issuer: #{e.message}")
-        end
-      end
-
-      return nil if OmniauthOpenidFederation::StringHelpers.blank?(entity_statement_content)
-
-      begin
-        # Parse entity statement to extract JWKS URI
-        # entity_statement_content is now always a string (JWT)
-        entity_statement = OmniauthOpenidFederation::Federation::EntityStatement.new(entity_statement_content)
-        parsed = entity_statement.parse
-        return nil unless parsed
-
-        # Extract JWKS URI from provider metadata
-        jwks_uri = parsed.dig(:metadata, :openid_provider, :jwks_uri) ||
-          parsed.dig("metadata", "openid_provider", "jwks_uri")
-
-        return jwks_uri if OmniauthOpenidFederation::StringHelpers.present?(jwks_uri)
-      rescue => e
-        OmniauthOpenidFederation::Logger.debug("[AccessToken] Could not extract JWKS URI from entity statement: #{e.message}")
-      end
-
-      nil
-    end
   end
 end

data/lib/omniauth_openid_federation/cache.rb

@@ -20,6 +20,22 @@ module OmniauthOpenidFederation
       "omniauth_openid_federation:signed_jwks:#{Digest::SHA256.hexdigest(signed_jwks_uri)}"
     end
 
+    # Generate cache key for locally served JWKS (federation endpoint)
+    #
+    # @param issuer [String] Federation endpoint issuer entity identifier
+    # @return [String] Cache key
+    def self.key_for_served_jwks(issuer)
+      "federation:jwks:#{Digest::SHA256.hexdigest(issuer)}"
+    end
+
+    # Generate cache key for locally served signed JWKS (federation endpoint)
+    #
+    # @param issuer [String] Federation endpoint issuer entity identifier
+    # @return [String] Cache key
+    def self.key_for_served_signed_jwks(issuer)
+      "federation:signed_jwks:#{Digest::SHA256.hexdigest(issuer)}"
+    end
+
     # Delete JWKS cache
     #
     # @param jwks_uri [String] The JWKS URI

data/lib/omniauth_openid_federation/cache_adapter.rb

@@ -116,9 +116,12 @@ module OmniauthOpenidFederation
           return config.cache_adapter
         end
 
-        # Try Rails cache
-        if defined?(Rails) && Rails.respond_to?(:cache) && Rails.cache
-          return RailsCacheAdapter.new(Rails.cache)
+        # Try Rails cache when a booted app exposes a real store
+        if defined?(Rails) && Rails.respond_to?(:cache)
+          cache = Rails.cache
+          if cache && cache.respond_to?(:read)
+            return RailsCacheAdapter.new(cache)
+          end
         end
 
         # Try ActiveSupport::Cache if available (without Rails)

data/lib/omniauth_openid_federation/constants.rb

@@ -14,5 +14,8 @@ module OmniauthOpenidFederation
     # Prevents DoS attacks while allowing legitimate use cases (e.g., encrypted JWT authorization codes)
     # Use Configuration.config.max_string_length for runtime configuration instead of patching this constant
     MAX_STRING_LENGTH = 8192
+
+    # Minimum RSA modulus size for OIDC signing and encryption keys (FTN and common federation profiles)
+    MIN_RSA_KEY_BITS = 2048
   end
 end

data/lib/omniauth_openid_federation/federation/entity_statement.rb

@@ -1,4 +1,3 @@
-require "net/http"
 require "digest"
 require "jwt"
 require "base64"
@@ -94,9 +93,6 @@ module OmniauthOpenidFederation
       # @raise [FetchError] If fetching fails
       # @raise [ValidationError] If validation fails
       def self.fetch!(url, fingerprint: nil, previous_statement: nil, timeout: 10)
-        # Use HttpClient for retry logic and configurable SSL verification
-        # Note: HttpClient uses HTTP gem, but entity statements might need Net::HTTP
-        # For now, we'll use a simple HTTP.get approach with HttpClient's retry logic
         begin
           # Convert URL to URI for HttpClient
           response = HttpClient.get(url, timeout: timeout)

data/lib/omniauth_openid_federation/federation/entity_statement_validator.rb

@@ -319,10 +319,8 @@ module OmniauthOpenidFederation
         unknown_claims = crit - standard_claims
 
         if unknown_claims.any?
-          # For now, we'll log a warning but not reject
-          # In a strict implementation, we should reject if we don't understand the claims
-          # Future enhancement: Add strict_mode option to reject unknown crit claims
-          OmniauthOpenidFederation::Logger.warn("[EntityStatementValidator] Entity statement contains crit claim with unknown claims: #{unknown_claims.join(", ")}. These claims MUST be understood and processed.")
+          raise ValidationError,
+            "Entity statement crit claim contains unknown claims that MUST be understood: #{unknown_claims.join(", ")}"
         end
       end
 

data/lib/omniauth_openid_federation/federation/signed_jwks.rb

@@ -1,4 +1,3 @@
-require "http"
 require "jwt"
 require "base64"
 require "openssl"