openid_connect 0.0.11 → 0.0.12

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    openid_connect (0.0.10)
+    openid_connect (0.0.11)
       activemodel (>= 3)
       attr_required (>= 0.0.3)
       json (>= 1.4.3)
@@ -62,8 +62,8 @@ GEM
       mail (>= 2.2.5)
     validate_url (0.2.0)
       activemodel (>= 3.0.0)
-    webmock (1.7.2)
-      addressable (> 2.2.5, ~> 2.2)
+    webmock (1.7.4)
+      addressable (~> 2.2, > 2.2.5)
       crack (>= 0.1.7)
 
 PLATFORMS

data/README.rdoc

@@ -8,8 +8,9 @@ OpenID Connect Server & Client Library
 
 == Resources
 
-* View Source on GitHub (http://github.com/nov/openid_connect)
-* Report Issues on GitHub (http://github.com/nov/openid_connect/issues)
+* View Source on GitHub (https://github.com/nov/openid_connect)
+* Report Issues on GitHub (https://github.com/nov/openid_connect/issues)
+* Subscribe Update Info (https://www.facebook.com/pages/OpenID-Connect/134681459957370)
 
 == Examples
 

data/VERSION

@@ -1 +1 @@
-0.0.11
+0.0.12

data/lib/openid_connect/response_object.rb

@@ -9,36 +9,44 @@ module OpenIDConnect
   class ResponseObject
     include ActiveModel::Validations, AttrRequired, AttrOptional
 
+    class ValidationFailed < Exception
+      attr_reader :errors
+
+      def initialize(errors)
+        super errors.full_messages.to_sentence
+        @errors = errors
+      end
+    end
+
     def initialize(attributes = {})
-      all_attriutes.each do |_attr_|
+      all_attributes.each do |_attr_|
         self.send :"#{_attr_}=", attributes[_attr_]
       end
       attr_missing!
     end
 
-    def all_attriutes
+    def all_attributes
       required_attributes + optional_attributes
     end
 
     def require_at_least_one_attributes
-      all_blank = all_attriutes.all? do |key|
+      all_blank = all_attributes.all? do |key|
         self.send(key).blank?
       end
       errors.add :base, 'At least one attribute is required' if all_blank
     end
 
     def as_json(options = {})
-      (all_attriutes - Array(hidden_attributes)).inject({}) do |hash, _attr_|
+      validate!
+      all_attributes.inject({}) do |hash, _attr_|
         hash.merge! _attr_ => self.send(_attr_)
       end.delete_if do |key, value|
         value.nil?
       end
     end
 
-    private
-
-    def hidden_attributes
-      nil
+    def validate!
+      raise ValidationFailed.new(errors) unless valid?
     end
   end
 end

data/lib/openid_connect/response_object/id_token.rb

@@ -6,10 +6,13 @@ module OpenIDConnect
       class InvalidToken < Exception; end
 
       attr_required :iss, :user_id, :aud, :exp
-      attr_optional :iso29115, :nonce, :issued_to, :secret
+      attr_optional :iso29115, :nonce, :issued_to
 
       def initialize(attributes = {})
         super
+        (all_attributes - [:exp]).each do |key|
+          self.send "#{key}=", self.send(key).try(:to_s)
+        end
         @exp = @exp.to_i
       end
 
@@ -18,19 +21,12 @@ module OpenIDConnect
         raise InvalidToken.new('Invalid audience or expired')
       end
 
-      def to_jwt
-        raise Exception.new('Secret Required') unless secret
-        JWT.encode as_json, secret
+      def to_jwt(key, algorithm = 'RS256')
+        JWT.encode as_json, key, algorithm
       end
 
-      def self.from_jwt(jwt, secret)
-        new JWT.decode(jwt, secret).with_indifferent_access.merge(:secret => secret)
-      end
-
-      private
-
-      def hidden_attributes
-        :secret
+      def self.from_jwt(jwt_string, key)
+        new JWT.decode(jwt_string, key).with_indifferent_access
       end
     end
   end

data/lib/openid_connect/response_object/user_info/open_id.rb

@@ -7,9 +7,9 @@ module OpenIDConnect
         attr_optional :phone_number
 
         attr_optional :verified, :gender, :zoneinfo, :locale
-        validates_inclusion_of :verified, :in => [true, false], :allow_nil => true
-        validates_inclusion_of :gender, :in => [:male, :female], :allow_nil => true
-        validates_inclusion_of :zoneinfo, :in => TZInfo::TimezoneProxy.all.collect(&:name), :allow_nil => true
+        validates :verified, :inclusion => {:in => [true, false]},                             :allow_nil => true
+        validates :gender,   :inclusion => {:in => ['male', 'female']},                        :allow_nil => true
+        validates :zoneinfo, :inclusion => {:in => TZInfo::TimezoneProxy.all.collect(&:name)}, :allow_nil => true
         # TODO: validate locale
 
         attr_optional :birthday, :updated_time
@@ -25,6 +25,13 @@ module OpenIDConnect
 
         validate :require_at_least_one_attributes
 
+        def initialize(attributes = {})
+          super
+          (all_attributes - [:verified, :address]).each do |key|
+            self.send "#{key}=", self.send(key).try(:to_s)
+          end
+        end
+
         def validate_address
           errors.add :address, 'cannot be blank' unless address.blank? || address.valid?
         end

data/lib/rack/oauth2/server/id_token_response.rb

@@ -1,11 +1,21 @@
 module Rack::OAuth2::Server
   module IdTokenResponse
     def self.included(klass)
-      klass.send :attr_optional, :id_token
+      klass.send :attr_optional, :id_token, :private_key
       klass.class_eval do
+        def jwt_string
+          case id_token
+          when String
+            id_token
+          when OpenIDConnect::ResponseObject::IdToken
+            raise AttrRequired::AttrMissing.new('private_key is required') unless private_key
+            id_token.to_jwt private_key
+          end
+        end
+
         def protocol_params_with_id_token
           protocol_params_without_id_token.merge(
-            :id_token => id_token.try(:to_jwt)
+            :id_token => jwt_string
           )
         end
         alias_method_chain :protocol_params, :id_token

data/spec/openid_connect/response_object/id_token_spec.rb

@@ -1,10 +1,10 @@
 require 'spec_helper'
 
 describe OpenIDConnect::ResponseObject::IdToken do
-  let(:klass) { OpenIDConnect::ResponseObject::IdToken }
-  let(:id_token) { klass.new attributes }
-  let(:attributes) { required_attributes }
-  let(:ext) { 10.minutes.from_now }
+  let(:klass)       { OpenIDConnect::ResponseObject::IdToken }
+  let(:id_token)    { klass.new attributes }
+  let(:attributes)  { required_attributes }
+  let(:ext)         { 10.minutes.from_now }
   let :required_attributes do
     {
       :iss => 'https://server.example.com',
@@ -17,7 +17,7 @@ describe OpenIDConnect::ResponseObject::IdToken do
   describe 'attributes' do
     subject { klass }
     its(:required_attributes) { should == [:iss, :user_id, :aud, :exp] }
-    its(:optional_attributes) { should == [:iso29115, :nonce, :issued_to, :secret] }
+    its(:optional_attributes) { should == [:iso29115, :nonce, :issued_to] }
   end
 
   describe '#verify!' do
@@ -40,31 +40,21 @@ describe OpenIDConnect::ResponseObject::IdToken do
   end
 
   describe '#to_jwt' do
-    subject { id_token.to_jwt }
-
-    context 'when secret is given' do
-      let(:attributes) { required_attributes.merge(:secret => 'secret') }
-      it { should be_a String }
-    end
-
-    context 'otherwise' do
-      it do
-        expect { id_token.to_jwt }.should raise_error OpenIDConnect::Exception, 'Secret Required'
-      end
-    end
+    subject { id_token.to_jwt private_key }
+    it { should be_a String }
   end
 
   describe '#as_json' do
     subject { id_token.as_json }
-    let(:attributes) { required_attributes.merge(:secret => 'secret') }
+    let(:attributes) { required_attributes }
     it { should_not include :secret }
   end
 
   describe '.from_jwt' do
-    subject { klass.from_jwt id_token.to_jwt, 'secret' }
-    let(:attributes) { required_attributes.merge(:secret => 'secret') }
+    subject { klass.from_jwt id_token.to_jwt(private_key), public_key }
+    let(:attributes) { required_attributes }
     it { should be_a klass }
-    [:iss, :user_id, :aud, :secret].each do |key|
+    [:iss, :user_id, :aud].each do |key|
       its(key) { should == attributes[key] }
     end
     its(:exp) { should == attributes[:exp].to_i }

data/spec/openid_connect/response_object_spec.rb

@@ -4,16 +4,17 @@ describe OpenIDConnect::ResponseObject do
   class OpenIDConnect::ResponseObject::SubClass < OpenIDConnect::ResponseObject
     attr_required :required
     attr_optional :optional
+    validates :required, :inclusion => {:in => ['Required', 'required']}, :length => 1..10
   end
 
-  let(:klass) { OpenIDConnect::ResponseObject::SubClass }
   subject { klass.new attributes }
+  let(:klass) { OpenIDConnect::ResponseObject::SubClass }
+  let :attributes do
+    {:required => 'Required', :optional => 'Optional'}
+  end
 
   context 'when required attributes are given' do
     context 'when optional attributes are given' do
-      let :attributes do
-        {:required => 'Required', :optional => 'Optional'}
-      end
       its(:required) { should == 'Required' }
       its(:optional) { should == 'Optional' }
     end
@@ -45,11 +46,24 @@ describe OpenIDConnect::ResponseObject do
   end
 
   describe '#as_json' do
-    let :attributes do
-      {:required => 'Required', :optional => 'Optional'}
-    end
     its(:as_json) do
       should == {:required => 'Required', :optional => 'Optional'}
     end
   end
+
+  describe '#validate!' do
+    let(:invalid) do
+      instance = klass.new attributes
+      instance.required = 'Out of List and Too Long'
+      instance
+    end
+
+    it 'should raise OpenIDConnect::ResponseObject::ValidationFailed with ActiveModel::Errors' do
+      expect { invalid.validate! }.should raise_error(OpenIDConnect::ResponseObject::ValidationFailed) { |e|
+        e.message.should include 'Required is not included in the list'
+        e.message.should include 'Required is too long (maximum is 10 characters)'
+        e.errors.should be_a ActiveModel::Errors
+      }
+    end
+  end
 end

data/spec/openid_connect/server/id_token_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper.rb'
 
 describe OpenIDConnect::Server::IdToken do
-  let(:request) { Rack::MockRequest.new app }
+  let(:request)     { Rack::MockRequest.new app }
   let :app do
     OpenIDConnect::Server::IdToken.new do |req, res|
       res.id_token = id_token
@@ -14,7 +14,7 @@ describe OpenIDConnect::Server::IdToken do
     )
   end
   let :params do
-    {:id_token => id_token.to_jwt}
+    {:id_token => id_token.to_jwt(private_key) }
   end
   let :id_token do
     OpenIDConnect::ResponseObject::IdToken.new(

data/spec/rack/oauth2/server/authorize/code_and_token_spec.rb

@@ -24,11 +24,32 @@ describe Rack::OAuth2::Server::Authorize::Extension::CodeAndToken do
         response.code = 'code'
         response.access_token = bearer_token
         response.id_token = id_token
+        response.private_key = private_key
         response.approve!
       end
     end
     its(:status)   { should == 302 }
-    its(:location) { should == "#{redirect_uri}?code=code#access_token=access_token&id_token=#{id_token.to_jwt}&token_type=bearer" }
+    its(:location) { should == "#{redirect_uri}?code=code#access_token=access_token&id_token=#{id_token.to_jwt(private_key)}&token_type=bearer" }
+
+    context 'when id_token is String' do
+      let(:id_token) { 'id_token' }
+      its(:location) { should == "#{redirect_uri}?code=code#access_token=access_token&id_token=id_token&token_type=bearer" }
+    end
+
+    context 'when private_key is missing' do
+      let :app do
+        Rack::OAuth2::Server::Authorize.new do |request, response|
+          response.redirect_uri = redirect_uri
+          response.code = 'code'
+          response.access_token = bearer_token
+          response.id_token = id_token
+          response.approve!
+        end
+      end
+      it do
+        expect { response }.should raise_error AttrRequired::AttrMissing, 'private_key is required'
+      end
+    end
   end
 
   context "otherwise" do

data/spec/rack/oauth2/server/authorize/token_spec.rb

@@ -22,11 +22,31 @@ describe Rack::OAuth2::Server::Authorize::Token do
         response.redirect_uri = redirect_uri
         response.access_token = bearer_token
         response.id_token = id_token
+        response.private_key = private_key
         response.approve!
       end
     end
     its(:status)   { should == 302 }
-    its(:location) { should == "#{redirect_uri}#access_token=access_token&id_token=#{id_token.to_jwt}&token_type=bearer" }
+    its(:location) { should == "#{redirect_uri}#access_token=access_token&id_token=#{id_token.to_jwt(private_key)}&token_type=bearer" }
+
+    context 'when id_token is String' do
+      let(:id_token) { 'id_token' }
+      its(:location) { should == "#{redirect_uri}#access_token=access_token&id_token=id_token&token_type=bearer" }
+    end
+
+    context 'when private_key is missing' do
+      let :app do
+        Rack::OAuth2::Server::Authorize.new do |request, response|
+          response.redirect_uri = redirect_uri
+          response.access_token = bearer_token
+          response.id_token = id_token
+          response.approve!
+        end
+      end
+      it do
+        expect { response }.should raise_error AttrRequired::AttrMissing, 'private_key is required'
+      end
+    end
   end
 
   context "otherwise" do

data/spec/rack/oauth2/server/token/authorization_code_spec.rb

@@ -26,10 +26,28 @@ describe Rack::OAuth2::Server::Token::AuthorizationCode do
       Rack::OAuth2::Server::Token.new do |request, response|
         response.access_token = Rack::OAuth2::AccessToken::Bearer.new(:access_token => 'access_token')
         response.id_token = id_token
+        response.private_key = private_key
       end
     end
     its(:status) { should == 200 }
-    its(:body)   { should include "\"id_token\":\"#{id_token.to_jwt}\"" }
+    its(:body)   { should include "\"id_token\":\"#{id_token.to_jwt(private_key)}\"" }
+
+    context 'when id_token is String' do
+      let(:id_token) { 'id_token' }
+      its(:body)   { should include "\"id_token\":\"id_token\"" }
+    end
+
+    context 'when private_key is missing' do
+      let :app do
+        Rack::OAuth2::Server::Token.new do |request, response|
+          response.access_token = Rack::OAuth2::AccessToken::Bearer.new(:access_token => 'access_token')
+          response.id_token = id_token
+        end
+      end
+      it do
+        expect { response }.should raise_error AttrRequired::AttrMissing, 'private_key is required'
+      end
+    end
   end
 
   context "otherwise" do

data/spec/rack/oauth2/server/token/refresh_token_spec.rb

@@ -25,10 +25,28 @@ describe Rack::OAuth2::Server::Token::RefreshToken do
       Rack::OAuth2::Server::Token.new do |request, response|
         response.access_token = Rack::OAuth2::AccessToken::Bearer.new(:access_token => 'access_token')
         response.id_token = id_token
+        response.private_key = private_key
       end
     end
     its(:status) { should == 200 }
-    its(:body)   { should include "\"id_token\":\"#{id_token.to_jwt}\"" }
+    its(:body)   { should include "\"id_token\":\"#{id_token.to_jwt(private_key)}\"" }
+
+    context 'when id_token is String' do
+      let(:id_token) { 'id_token' }
+      its(:body)     { should include "\"id_token\":\"id_token\"" }
+    end
+
+    context 'when private_key is missing' do
+      let :app do
+        Rack::OAuth2::Server::Token.new do |request, response|
+          response.access_token = Rack::OAuth2::AccessToken::Bearer.new(:access_token => 'access_token')
+          response.id_token = id_token
+        end
+      end
+      it do
+        expect { response }.should raise_error AttrRequired::AttrMissing, 'private_key is required'
+      end
+    end
   end
 
   context "otherwise" do

data/spec/spec_helper.rb

@@ -1,4 +1,16 @@
 require 'rspec'
 require 'openid_connect'
 
-require 'helpers/webmock_helper'
+require 'helpers/webmock_helper'
+
+def rsa
+  @rsa ||= OpenSSL::PKey::RSA.generate 2048
+end
+
+def public_key
+  @public_key ||= rsa.public_key
+end
+
+def private_key
+  @private_key ||= OpenSSL::PKey::RSA.new rsa.export(OpenSSL::Cipher::Cipher.new('aes256'), 'pass-phrase'), 'pass-phrase'
+end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: openid_connect
 version: !ruby/object:Gem::Version 
-  hash: 9
+  hash: 7
   prerelease: 
   segments: 
   - 0
   - 0
-  - 11
-  version: 0.0.11
+  - 12
+  version: 0.0.12
 platform: ruby
 authors: 
 - nov matake
@@ -15,7 +15,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-08-17 00:00:00 Z
+date: 2011-08-18 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: activemodel