pkce 0.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 2d2c1097b83e0da1e3fcc5cd869686f286de3db0152d8ebf13e351bc2155e325
+  data.tar.gz: 3583de0e97dc4b2e1f7f836148687402f4807f3801eb61481a9f824e09030b28
+SHA512:
+  metadata.gz: 6ff848d394fad7aa5a1722fb6a5b6537d1b41fcea573e3ab732a061b2664e14396d138b028ab171334afce4c924d5b672cde5f3f9ef52ea325ea958a29f8d592
+  data.tar.gz: 9ecbf31eba82c3592aacb455ad3444b6dadd88b6cebedafa01472c4121622bded4fafc474c51ca2bbd62f50131ccf305c11b9c854ae444c54b756bb5e2ca53eb

checksums.yaml.gz.sig

@@ -0,0 +1,2 @@
+#ϐƕ2E�r�X!gq���<iߜ�~_ga���5��Xy��D�wn�9���fc&��`�MZ~���@�@�m�~A�Y�2,1q�=���I�#,�[�����E�z��0֒��m�4 ���h��$�C:Z��,��嬴m&> �0cݛ����O[��ow��[W�N�
+,j9Ϡ;q��\"����-�>��X��������

data/LICENSE.adoc

@@ -0,0 +1,134 @@
+= Hippocratic License
+
+Version: 2.1.0.
+
+Purpose. The purpose of this License is for the Licensor named above to
+permit the Licensee (as defined below) broad permission, if consistent
+with Human Rights Laws and Human Rights Principles (as each is defined
+below), to use and work with the Software (as defined below) within the
+full scope of Licensor’s copyright and patent rights, if any, in the
+Software, while ensuring attribution and protecting the Licensor from
+liability.
+
+Permission and Conditions. The Licensor grants permission by this
+license ("License"), free of charge, to the extent of Licensor’s
+rights under applicable copyright and patent law, to any person or
+entity (the "Licensee") obtaining a copy of this software and
+associated documentation files (the "Software"), to do everything with
+the Software that would otherwise infringe (i) the Licensor’s copyright
+in the Software or (ii) any patent claims to the Software that the
+Licensor can license or becomes able to license, subject to all of the
+following terms and conditions:
+
+* Acceptance. This License is automatically offered to every person and
+entity subject to its terms and conditions. Licensee accepts this
+License and agrees to its terms and conditions by taking any action with
+the Software that, absent this License, would infringe any intellectual
+property right held by Licensor.
+* Notice. Licensee must ensure that everyone who gets a copy of any part
+of this Software from Licensee, with or without changes, also receives
+the License and the above copyright notice (and if included by the
+Licensor, patent, trademark and attribution notice). Licensee must cause
+any modified versions of the Software to carry prominent notices stating
+that Licensee changed the Software. For clarity, although Licensee is
+free to create modifications of the Software and distribute only the
+modified portion created by Licensee with additional or different terms,
+the portion of the Software not modified must be distributed pursuant to
+this License. If anyone notifies Licensee in writing that Licensee has
+not complied with this Notice section, Licensee can keep this License by
+taking all practical steps to comply within 30 days after the notice. If
+Licensee does not do so, Licensee’s License (and all rights licensed
+hereunder) shall end immediately.
+* Compliance with Human Rights Principles and Human Rights Laws.
+[arabic]
+. Human Rights Principles.
+[loweralpha]
+.. Licensee is advised to consult the articles of the United Nations
+Universal Declaration of Human Rights and the United Nations Global
+Compact that define recognized principles of international human rights
+(the "Human Rights Principles"). Licensee shall use the Software in a
+manner consistent with Human Rights Principles.
+.. Unless the Licensor and Licensee agree otherwise, any dispute,
+controversy, or claim arising out of or relating to (i) Section 1(a)
+regarding Human Rights Principles, including the breach of Section 1(a),
+termination of this License for breach of the Human Rights Principles,
+or invalidity of Section 1(a) or (ii) a determination of whether any Law
+is consistent or in conflict with Human Rights Principles pursuant to
+Section 2, below, shall be settled by arbitration in accordance with the
+Hague Rules on Business and Human Rights Arbitration (the "Rules");
+provided, however, that Licensee may elect not to participate in such
+arbitration, in which event this License (and all rights licensed
+hereunder) shall end immediately. The number of arbitrators shall be one
+unless the Rules require otherwise.
++
+Unless both the Licensor and Licensee agree to the contrary: (1) All
+documents and information concerning the arbitration shall be public and
+may be disclosed by any party; (2) The repository referred to under
+Article 43 of the Rules shall make available to the public in a timely
+manner all documents concerning the arbitration which are communicated
+to it, including all submissions of the parties, all evidence admitted
+into the record of the proceedings, all transcripts or other recordings
+of hearings and all orders, decisions and awards of the arbitral
+tribunal, subject only to the arbitral tribunal’s powers to take such
+measures as may be necessary to safeguard the integrity of the arbitral
+process pursuant to Articles 18, 33, 41 and 42 of the Rules; and (3)
+Article 26(6) of the Rules shall not apply.
+. Human Rights Laws. The Software shall not be used by any person or
+entity for any systems, activities, or other uses that violate any Human
+Rights Laws. "Human Rights Laws" means any applicable laws,
+regulations, or rules (collectively, "Laws") that protect human,
+civil, labor, privacy, political, environmental, security, economic, due
+process, or similar rights; provided, however, that such Laws are
+consistent and not in conflict with Human Rights Principles (a dispute
+over the consistency or a conflict between Laws and Human Rights
+Principles shall be determined by arbitration as stated above). Where
+the Human Rights Laws of more than one jurisdiction are applicable or in
+conflict with respect to the use of the Software, the Human Rights Laws
+that are most protective of the individuals or groups harmed shall
+apply.
+. Indemnity. Licensee shall hold harmless and indemnify Licensor (and
+any other contributor) against all losses, damages, liabilities,
+deficiencies, claims, actions, judgments, settlements, interest, awards,
+penalties, fines, costs, or expenses of whatever kind, including
+Licensor’s reasonable attorneys’ fees, arising out of or relating to
+Licensee’s use of the Software in violation of Human Rights Laws or
+Human Rights Principles.
+* Failure to Comply. Any failure of Licensee to act according to the
+terms and conditions of this License is both a breach of the License and
+an infringement of the intellectual property rights of the Licensor
+(subject to exceptions under Laws, e.g., fair use). In the event of a
+breach or infringement, the terms and conditions of this License may be
+enforced by Licensor under the Laws of any jurisdiction to which
+Licensee is subject. Licensee also agrees that the Licensor may enforce
+the terms and conditions of this License against Licensee through
+specific performance (or similar remedy under Laws) to the extent
+permitted by Laws. For clarity, except in the event of a breach of this
+License, infringement, or as otherwise stated in this License, Licensor
+may not terminate this License with Licensee.
+* Enforceability and Interpretation. If any term or provision of this
+License is determined to be invalid, illegal, or unenforceable by a
+court of competent jurisdiction, then such invalidity, illegality, or
+unenforceability shall not affect any other term or provision of this
+License or invalidate or render unenforceable such term or provision in
+any other jurisdiction; provided, however, subject to a court
+modification pursuant to the immediately following sentence, if any term
+or provision of this License pertaining to Human Rights Laws or Human
+Rights Principles is deemed invalid, illegal, or unenforceable against
+Licensee by a court of competent jurisdiction, all rights in the
+Software granted to Licensee shall be deemed null and void as between
+Licensor and Licensee. Upon a determination that any term or provision
+is invalid, illegal, or unenforceable, to the extent permitted by Laws,
+the court may modify this License to affect the original purpose that
+the Software be used in compliance with Human Rights Principles and
+Human Rights Laws as closely as possible. The language in this License
+shall be interpreted as to its fair meaning and not strictly for or
+against any party.
+* Disclaimer. TO THE FULL EXTENT ALLOWED BY LAW, THIS SOFTWARE COMES
+"AS IS," WITHOUT ANY WARRANTY, EXPRESS OR IMPLIED, AND LICENSOR AND
+ANY OTHER CONTRIBUTOR SHALL NOT BE LIABLE TO ANYONE FOR ANY DAMAGES OR
+OTHER LIABILITY ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE
+OR THIS LICENSE, UNDER ANY KIND OF LEGAL CLAIM.
+
+This Hippocratic License is an link:https://ethicalsource.dev[Ethical Source license] and is offered
+for use by licensors and licensees at their own risk, on an "AS IS" basis, and with no warranties
+express or implied, to the maximum extent permitted by Laws.

data/README.adoc

@@ -0,0 +1,123 @@
+:rfc_link: link:https://datatracker.ietf.org/doc/html/rfc7636[RFC 7636]
+
+:toc: macro
+:toclevels: 5
+:figure-caption!:
+
+= Proof Key for Code Exchange (PKCE)
+
+PKCE ({rfc_link}) is an authorization code flow extension to link:https://oauth.net[OAuth] which is necessary for mobile authentication but works well for web flows because the added security is transparent to the end user. Specifically, PKCE prevents the following types of attacks:
+
+* Authorization code interception
+* Authorization code injection
+
+toc::[]
+
+== Features
+
+- Implements the {rfc_link} specification.
+- Provides a simple object API for obtaining a challenge and verify code.
+- Provides max length security by default.
+- Answers a monad result.
+
+== Requirements
+
+. link:https://www.ruby-lang.org[Ruby].
+. link:https://www.oauth.com[OAuth].
+
+== Setup
+
+To set up the project, run:
+
+[source,bash]
+----
+bin/setup
+----
+
+== Usage
+
+The object API is simple to work with as you only need to interact with the `PKCE` constant. Example:
+
+[source,ruby]
+----
+code = PKCE.call.success
+code.challenge  # e2tGChTfGON-C55i0yu13-urIgDFuMCmo73F7TZmoiw
+code.verify     # hYnx2WTJo7Bgu1-GqPUIYtRkb2W7pRBawkmdDi3omPdramb27Fp4rps_w6ozns-gbVCKFC2-Kno4P_b1H3FuxnlYIOd9Bo5yoTXq_xEHDJaB_fOfn2NaiCtcWQ8Bs91I
+----
+
+You can also pass in a custom length (default is maximum):
+
+[source,ruby]
+----
+code = PKCE.call(length: 35).success
+code.challenge  # R1b1Ka3jmrLKvQ7xW5QmP5MsCSEWtdoA2lo3r-SZDfg
+code.verify     # ucKkqwoMzc9cyPcSGMbuVf3ivr4sep2mq15hGN9sVzl4X7g
+----
+
+In case of a failure, you'll get a proper error message:
+
+[source,ruby]
+----
+PKCE.call(length: 100).failure  # Invalid PKCE verifier length: 100. Must be between 32..96.
+----
+
+Due to the fact that PKCE answers back a link:https://dry-rb.org/gems/dry-monads[monad], you have all of the power of link:https://www.alchemists.io/talks/ruby_pattern_matching[pattern matching] at your fingertips as well:
+
+[source,ruby]
+----
+include Dry::Monads[:result]
+
+case PKCE.call
+  in Success(code) then puts code.inspect
+  in Failure(message) then puts message
+end
+----
+
+Finally, since the code answered back is a link:https://www.alchemists.io/articles/ruby_structs[Struct], you have a value object -- which is frozen -- that you can easily test and interact with:
+
+[source,ruby]
+----
+PKCE.call.success
+# #<struct PKCE::Code challenge="dTiwjdltI-SBR1wHTEWa8zQs2kegLoIxJb2fb8emno0", verify="p4uH9lxdDMLmYLaLtYV0QJMi-o0FTQT29CJWYcdRsK0xJVsaFiQ981W5nSWDsWJgA-LS5hwKHEPcOAmVgOELNpolPhi3tcelBX9Y-z_hHUOq24DAAZOe0DU6VBb6zHCZ">
+----
+
+== Architecture
+
+The following documents the workflow used to process and build authorization codes.
+
+image::https://www.alchemists.io/images/projects/pkce/doc/sequence_diagram.svg[Sequence Diagram]
+
+== Development
+
+You can also use the IRB console for direct access to all objects:
+
+[source,bash]
+----
+bin/console
+----
+
+== Tests
+
+To test, run:
+
+[source,bash]
+----
+bundle exec rake
+----
+
+== link:https://www.alchemists.io/policies/license[License]
+
+== link:https://www.alchemists.io/policies/security[Security]
+
+== link:https://www.alchemists.io/policies/code_of_conduct[Code of Conduct]
+
+== link:https://www.alchemists.io/policies/contributions[Contributions]
+
+== link:https://www.alchemists.io/projects/pkce/versions[Versions]
+
+== link:https://www.alchemists.io/community[Community]
+
+== Credits
+
+* Built with link:https://www.alchemists.io/projects/gemsmith[Gemsmith].
+* Engineered by link:https://www.alchemists.io/team/brooke_kuhlmann[Brooke Kuhlmann].

data/lib/pkce/challenger.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+require "base64"
+require "digest"
+
+module PKCE
+  # Handles Proof Key for Code Exchange (PKCE) challenge.
+  class Challenger
+    def initialize hasher: Digest::SHA256, encoder: Base64
+      @hasher = hasher
+      @encoder = encoder
+    end
+
+    def call(code) = encoder.urlsafe_encode64 hasher.digest(code), padding: false
+
+    private
+
+    attr_reader :hasher, :encoder
+  end
+end

data/lib/pkce/code.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module PKCE
+  # Encapsulates the challenge and verify code.
+  Code = Struct.new :challenge, :verify, keyword_init: true do
+    def initialize *arguments
+      super
+      freeze
+    end
+  end
+end

data/lib/pkce/encoder.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module PKCE
+  # Encodes Proof Key for Code Exchange (PKCE) codes for authorization.
+  class Encoder
+    def initialize code: Code, verifier: Verifier.new, challenger: Challenger.new
+      @code = code
+      @verifier = verifier
+      @challenger = challenger
+    end
+
+    def call length: Verifier::MAX
+      verifier.call(length:).fmap { |value| code[challenge: challenger.call(value), verify: value] }
+    end
+
+    private
+
+    attr_reader :code, :verifier, :challenger, :logger
+  end
+end

data/lib/pkce/verifier.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require "securerandom"
+require "dry/monads"
+
+module PKCE
+  # Handles Proof Key for Code Exchange (PKCE) verification.
+  class Verifier
+    include Dry::Monads[:result]
+
+    RANGE = 32..96
+    MAX = RANGE.max
+
+    def initialize range: RANGE, randomizer: SecureRandom
+      @range = range
+      @randomizer = randomizer
+    end
+
+    def call length: MAX
+      if range.cover? length
+        Success randomizer.urlsafe_base64(length)
+      else
+        Failure "Invalid PKCE verifier length: #{length}. Must be between #{range.inspect}."
+      end
+    end
+
+    private
+
+    attr_reader :range, :randomizer
+  end
+end

data/lib/pkce.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require "pkce/challenger"
+require "pkce/verifier"
+require "pkce/code"
+require "pkce/encoder"
+
+# Main namespace.
+module PKCE
+  def self.call(...) = Encoder.new.call(...)
+end

data/pkce.gemspec

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+Gem::Specification.new do |spec|
+  spec.name = "pkce"
+  spec.version = "0.0.0"
+  spec.authors = ["Brooke Kuhlmann"]
+  spec.email = ["brooke@alchemists.io"]
+  spec.homepage = "https://www.alchemists.io/projects/pkce"
+  spec.summary = "Encodes Proof Key for Code Exchange (PKCE) for OAuth."
+  spec.license = "Hippocratic-2.1"
+
+  spec.metadata = {
+    "bug_tracker_uri" => "https://github.com/bkuhlmann/pkce/issues",
+    "changelog_uri" => "https://www.alchemists.io/projects/pkce/versions",
+    "documentation_uri" => "https://www.alchemists.io/projects/pkce",
+    "funding_uri" => "https://github.com/sponsors/bkuhlmann",
+    "label" => "Pkce",
+    "rubygems_mfa_required" => "true",
+    "source_code_uri" => "https://github.com/bkuhlmann/pkce"
+  }
+
+  spec.signing_key = Gem.default_key_path
+  spec.cert_chain = [Gem.default_cert_path]
+
+  spec.required_ruby_version = "~> 3.1"
+  spec.add_dependency "dry-monads", "~> 1.4"
+
+  spec.extra_rdoc_files = Dir["README*", "LICENSE*"]
+  spec.files = Dir["*.gemspec", "lib/**/*"]
+end

data.tar.gz.sig

@@ -0,0 +1 @@
+�;�5����Sq���Yc��0�ȷ8��\.���"?��,v.E�M��)��¯�$��6�9٦��Ш�� y|��b}�#,���h��`�dø�_�6��P.$��v˧�v?:�|[�;Qԛ~_d˷yu�-������zB.s�S�(��A 1*���گ9��qɒF�t}���$����lϩ&f�v���=P��x�
�NR���4���ߑ�GJj��"���$�P��U���LB��PG�N����_���{~d6

metadata

@@ -0,0 +1,94 @@
+--- !ruby/object:Gem::Specification
+name: pkce
+version: !ruby/object:Gem::Version
+  version: 0.0.0
+platform: ruby
+authors:
+- Brooke Kuhlmann
+autorequire:
+bindir: bin
+cert_chain:
+- |
+  -----BEGIN CERTIFICATE-----
+  MIIC/jCCAeagAwIBAgIBBTANBgkqhkiG9w0BAQsFADAlMSMwIQYDVQQDDBpicm9v
+  a2UvREM9YWxjaGVtaXN0cy9EQz1pbzAeFw0yMjAzMTkxNzI0MzJaFw0yMzAzMTkx
+  NzI0MzJaMCUxIzAhBgNVBAMMGmJyb29rZS9EQz1hbGNoZW1pc3RzL0RDPWlvMIIB
+  IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6l1qpXTiomH1RfMRloyw7MiE
+  xyVx/x8Yc3EupdH7uhNaTXQGyORN6aOY//1QXXMHIZ9tW74nZLhesWMSUMYy0XhB
+  brs+KkurHnc9FnEJAbG7ebGvl/ncqZt72nQvaxpDxvuCBHgJAz+8i5wl6FhLw+oT
+  9z0A8KcGhz67SdcoQiD7qiCjL/2NTeWHOzkpPrdGlt088+VerEEGf5I13QCvaftP
+  D5vkU0YlAm1r98BymuJlcQ1qdkVEI1d48ph4kcS0S0nv1RiuyVb6TCAR3Nu3VaVq
+  3fPzZKJLZBx67UvXdbdicWPiUR75elI4PXpLIic3xytaF52ZJYyKZCNZJhNwfQID
+  AQABozkwNzAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHQ4EFgQU0nzow9vc
+  2CdikiiE3fJhP/gY4ggwDQYJKoZIhvcNAQELBQADggEBAJbbNyWzFjqUNVPPCUCo
+  IMrhDa9xf1xkORXNYYbmXgoxRy/KyNbUr+jgEEoWJAm9GXlcqxxWAUI6pK/i4/Qi
+  X6rPFEFmeObDOHNvuqy8Hd6AYsu+kP94U/KJhe9wnWGMmGoNKJNU3EkW3jM/osSl
+  +JRxiH5t4WtnDiVyoYl5nYC02rYdjJkG6VMxDymXTqn7u6HhYgZkGujq1UPar8x2
+  hNIWJblDKKSu7hA2d6+kUthuYo13o1sg1Da/AEDg0hoZSUvhqDEF5Hy232qb3pDt
+  CxDe2+VuChj4I1nvIHdu+E6XoEVlanUPKmSg6nddhkKn2gC45Kyzh6FZqnzH/CRp
+  RFE=
+  -----END CERTIFICATE-----
+date: 2022-06-25 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: dry-monads
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.4'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.4'
+description:
+email:
+- brooke@alchemists.io
+executables: []
+extensions: []
+extra_rdoc_files:
+- README.adoc
+- LICENSE.adoc
+files:
+- LICENSE.adoc
+- README.adoc
+- lib/pkce.rb
+- lib/pkce/challenger.rb
+- lib/pkce/code.rb
+- lib/pkce/encoder.rb
+- lib/pkce/verifier.rb
+- pkce.gemspec
+homepage: https://www.alchemists.io/projects/pkce
+licenses:
+- Hippocratic-2.1
+metadata:
+  bug_tracker_uri: https://github.com/bkuhlmann/pkce/issues
+  changelog_uri: https://www.alchemists.io/projects/pkce/versions
+  documentation_uri: https://www.alchemists.io/projects/pkce
+  funding_uri: https://github.com/sponsors/bkuhlmann
+  label: Pkce
+  rubygems_mfa_required: 'true'
+  source_code_uri: https://github.com/bkuhlmann/pkce
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - "~>"
+    - !ruby/object:Gem::Version
+      version: '3.1'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.3.16
+signing_key:
+specification_version: 4
+summary: Encodes Proof Key for Code Exchange (PKCE) for OAuth.
+test_files: []

metadata.gz.sig

@@ -0,0 +1 @@
+a�lV�����7N�NH$��,�<j7�Eh��j��,w`q6?��"d��G�D�wV�ȼ���E��r�`���BS�4����+��Ox2�L���K}��L�z�O:1����c8�jx�=}'��f%CN�r��!3i�����a�b�(ƅ�Ȋ����ō�D���S8�H�����
���f��� T����<��l�D���Q#~T\߿Ľ"��H}��Q������"Ls��&ESS~q\��U�ߏ����&���K