prx_auth 1.2.1 → 1.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1a851973aab51bd36533ff3959ab4d494886d0c6803fa1be1359ee1a5e0a68c0
-  data.tar.gz: 9033b3e43be7f508ec7956df7be578e4b860f3285169ac1de6c5ee80b1e21c89
+  metadata.gz: f7d2d71dd1671a97f1ce4f9181852e8cc7e0a651e91370aca09300c468dfbf86
+  data.tar.gz: f4fcef9ecc2977321ae3ec193a8be62c0735d08f0a564787ff581d3e65bc869a
 SHA512:
-  metadata.gz: 92e74203143a4920470336dd93bedfe07fe03235bbcafc20229f4076bdfabe5240e5908b0765b035c9471c0a8bfbc001435e08e61830dd954f64e65f0d0f2e26
-  data.tar.gz: 139726fa863102b0e179c63e29df3d42f4fa03082e1208668cc6f9d32062bcab1995921677f22138718449a5b6a1cb67694003e141b829f585f0b6cc141e5dc9
+  metadata.gz: 482f861b69e7e05eb6d9b2308b2c0dfc402ac8a8bd01f200e14e04cafd24897adea376de29a6ad1fb6a52eeb08647303c10c344e097a45c1dea6730ace2a4bdf
+  data.tar.gz: 10ada294eda678f2d70c4780db32f33063a869d3caf25c481949cd5350f326bbeb6c5a60d96fa797ef3d1f2548c552edde731a28fd9667ee20a7d336ad936656

data/lib/prx_auth/resource_map.rb

@@ -37,6 +37,14 @@ module PrxAuth
       end
     end
 
+    def [](key)
+      super(key.to_s)
+    end
+
+    def []=(key, value)
+      super(key.to_s, value)
+    end
+
     def condense
       condensed_wildcard = @wildcard.condense
       condensed_map = Hash[map do |resource, list|

data/lib/prx_auth/scope_list.rb

@@ -126,7 +126,11 @@ module PrxAuth
     def &(other_list)
       return ScopeList.new('') if other_list.nil?
       
-      self - (self - other_list)
+      self - (self - other_list) + (other_list - (other_list - self))
+    end
+
+    def ==(other)
+      condense.sort_by(&:to_s) == other.condense.sort_by(&:to_s)
     end
 
     private

data/lib/prx_auth/version.rb

@@ -1,3 +1,3 @@
 module PrxAuth
-  VERSION = "1.2.1"
+  VERSION = "1.6.0"
 end

data/lib/rack/prx_auth.rb

@@ -1,6 +1,7 @@
 require 'json/jwt'
 require 'rack/prx_auth/certificate'
 require 'rack/prx_auth/token_data'
+require 'rack/prx_auth/auth_validator'
 require 'prx_auth'
 
 module Rack
@@ -20,16 +21,21 @@ module Rack
       @issuer = options[:issuer] || DEFAULT_ISS
     end
 
+    def build_auth_validator(token)
+      AuthValidator.new(token, @certificate, @issuer)
+    end
+
     def call(env)
       return @app.call(env) unless env['HTTP_AUTHORIZATION']
 
       token = env['HTTP_AUTHORIZATION'].split[1]
-      claims = decode_token(token)
 
-      return @app.call(env) unless should_validate_token?(claims)
+      auth_validator = build_auth_validator(token)
+
+      return @app.call(env) unless should_validate_token?(auth_validator)
 
-      if valid?(claims, token)
-        env['prx.auth'] = TokenData.new(claims)
+      if auth_validator.valid?
+        env['prx.auth'] = TokenData.new(auth_validator.claims)
         @app.call(env)
       else
         INVALID_TOKEN
@@ -38,26 +44,8 @@ module Rack
 
     private
 
-    def valid?(claims, token)
-      !expired?(claims) && @certificate.valid?(token)
-    end
-
-    def decode_token(token)
-      return {} if token.nil?
-
-      begin
-        JSON::JWT.decode(token, :skip_verification)
-      rescue JSON::JWT::InvalidFormat
-        {}
-      end
-    end
-
-    def expired?(claims)
-      Time.now.to_i > (claims['iat'] + claims['exp'])
-    end
-
-    def should_validate_token?(claims)
-      claims['iss'] == @issuer
+    def should_validate_token?(auth_validator)
+      auth_validator.token_issuer_matches?
     end
   end
 end

data/lib/rack/prx_auth/auth_validator.rb

@@ -0,0 +1,51 @@
+require 'json/jwt'
+
+module Rack
+  class PrxAuth
+    class AuthValidator
+
+      attr_reader :issuer, :claims, :token
+
+      def initialize(token, certificate, issuer)
+        @token = token
+        @certificate = certificate
+        @issuer = issuer
+      end
+
+      def valid?
+        valid_token_format? && !expired? && @certificate.valid?(token)
+      end
+
+      def claims
+        @claims ||= decode_token
+      end
+
+      def valid_token_format?
+        decode_token.present?
+      end
+
+      def decode_token
+        return {} if token.nil?
+
+        begin
+          JSON::JWT.decode(token, :skip_verification)
+        rescue JSON::JWT::InvalidFormat
+          {}
+        end
+      end
+
+      def expired?
+        now = Time.now.to_i - 30 # 30 second clock jitter allowance
+        if claims['iat'] <= claims['exp']
+          now > claims['exp']
+        else
+          now > (claims['iat'] + claims['exp'])
+        end
+      end
+
+      def token_issuer_matches?
+        claims['iss'] == @issuer
+      end
+    end
+  end
+end

data/lib/rack/prx_auth/token_data.rb

@@ -32,7 +32,11 @@ module Rack
       def globally_authorized?(namespace, scope=nil)
         authorized?(::PrxAuth::ResourceMap::WILDCARD_KEY, namespace, scope)
       end
-      
+
+      def authorized_account_ids(scope)
+        resources(::PrxAuth::Rails.configuration.namespace, scope).map(&:to_i)
+      end
+
       private
 
       def unpack_aur(aur)

data/prx_auth.gemspec

@@ -21,12 +21,12 @@ Gem::Specification.new do |spec|
   spec.required_ruby_version = '>= 2.3'
 
   spec.add_development_dependency 'bundler', '~> 2.0'
-  spec.add_development_dependency 'rake', '~> 10.0'
+  spec.add_development_dependency 'rake', '~> 12.3.3'
   spec.add_development_dependency 'coveralls', '~> 0'
   spec.add_development_dependency 'guard'
   spec.add_development_dependency 'guard-minitest'
 
   spec.add_dependency 'rack', '>= 1.5.2'
   spec.add_dependency 'json', '>= 1.8.1'
-  spec.add_dependency 'json-jwt', '~> 1.9.4'
+  spec.add_dependency 'json-jwt', '~> 1.12.0'
 end

data/test/prx_auth/resource_map_test.rb

@@ -169,4 +169,17 @@ describe PrxAuth::ResourceMap do
       assert map.as_json.has_key?('*')
     end
   end
+
+  describe '#[]' do
+    it 'automatically stringifies' do
+      refute_nil map[123]
+    end
+  end
+
+  describe '#[]=' do
+    it 'automatically stringifies' do
+      map[789] = PrxAuth::ScopeList.new("")
+      refute_nil map["789"]
+    end
+  end
 end

data/test/prx_auth/scope_list_test.rb

@@ -104,5 +104,26 @@ describe PrxAuth::ScopeList do
       sl = new_list('one') & nil
       assert !sl.contains?(:one)
     end
+
+    it 'works when either side has non-namespaced values correctly' do
+      sl = PrxAuth::ScopeList.new('foo:bar') & PrxAuth::ScopeList.new('bar')
+      assert sl.contains?(:foo, :bar)
+      refute sl.contains?(:bar)
+
+      sl = PrxAuth::ScopeList.new('bar') & PrxAuth::ScopeList.new('foo:bar')
+      assert sl.contains?(:foo, :bar)
+      refute sl.contains?(:bar)
+    end
+  end
+
+  describe '==' do
+
+    it 'is equal when they are functionally equal' do
+      assert_equal PrxAuth::ScopeList.new("foo ns:foo bar ns2:baz"), PrxAuth::ScopeList.new("ns2:baz bar foo")
+    end
+
+    it 'is not equal when they are not functionally equal' do
+      refute_equal PrxAuth::ScopeList.new("foo bar"), PrxAuth::ScopeList.new("foo:bar bar:foo")
+    end
   end
 end

data/test/rack/prx_auth/auth_validator_test.rb

@@ -0,0 +1,111 @@
+require 'test_helper'
+
+describe Rack::PrxAuth::AuthValidator do
+  let(:app) { Proc.new {|env| env } }
+  let(:auth_validator) { Rack::PrxAuth::AuthValidator.new(token, certificate, 'id.local.test') }
+
+  let(:token) { 'some.token.foo' }
+
+  let(:iat) { Time.now.to_i }
+  let(:exp) { 3600 }
+  let(:claims) { {'sub'=>3, 'exp'=>exp, 'iat'=>iat, 'token_type'=>'bearer', 'scope'=>nil, 'iss'=>'id.prx.org'} }
+  let(:certificate) { cert = Rack::PrxAuth::Certificate.new }
+
+  describe '#token_issuer_matches' do
+    it 'false if the token is from another issuer' do
+      auth_validator.stub(:claims, claims) do
+        refute auth_validator.token_issuer_matches?
+      end
+    end
+
+    it 'is false if the issuer in the validator does not match' do
+      auth_validator.stub(:issuer, 'id.foo.com') do
+        refute auth_validator.token_issuer_matches?
+      end
+    end
+  end
+
+  describe '#valid?' do
+    it 'is false if token is invalid' do
+      auth_validator.stub(:claims, claims) do
+        refute auth_validator.valid?
+      end
+    end
+
+    it 'is false if the token is nil' do
+      certificate.stub(:valid?, true) do
+        auth_validator.stub(:token, nil) do
+          refute auth_validator.valid?
+        end
+      end
+    end
+  end
+
+  describe '#expired?' do
+
+    def expired?(claims)
+      auth_validator.stub(:claims, claims) do
+        auth_validator.expired?
+      end
+    end
+
+    describe 'with a malformed exp' do
+      let(:iat) { Time.now.to_i }
+      let(:exp) { 3600 }
+
+      it 'is expired if iat + exp are in the past' do
+        claims['iat'] -= 3631
+
+        assert expired?(claims)
+      end
+
+      it 'is not expired if iat + exp are in the future' do
+        claims['iat'] = Time.now.to_i - 3599
+
+        refute expired?(claims)
+      end
+
+      it 'allows a 30s clock jitter' do
+        claims['iat'] = Time.now.to_i - 3629
+
+        refute expired?(claims)
+      end
+    end
+
+    describe 'with a corrected exp' do
+      let(:iat) { Time.now.to_i - 3600 }
+      let(:exp) { Time.now.to_i + 1 }
+
+      it 'is not expired if exp is in the future' do
+        refute expired?(claims)
+      end
+
+      it 'is expired if exp is in the past (with 30s jitter grace)' do
+        claims['exp'] = Time.now.to_i - 31
+        assert expired?(claims)
+        claims['exp'] = Time.now.to_i - 29
+        refute expired?(claims)
+      end
+    end
+  end
+
+  describe '#decode_token' do
+    it 'should return an empty result for a nil token' do
+        auth_validator.stub(:token, nil) do
+          assert auth_validator.decode_token == {}
+        end
+    end
+
+    it 'should return an empty result for an empty token' do
+        auth_validator.stub(:token, '') do
+          assert auth_validator.decode_token == {}
+        end
+    end
+
+    it 'should return an empty result for a malformed token' do
+        auth_validator.stub(:token, token) do
+          assert auth_validator.decode_token == {}
+        end
+    end
+  end
+end

data/test/rack/prx_auth_test.rb

@@ -5,7 +5,9 @@ describe Rack::PrxAuth do
   let(:prxauth) { Rack::PrxAuth.new(app) }
   let(:fake_token) { 'afawefawefawefawegstgnsrtiohnlijblublwjnvrtoign'}
   let(:env) { {'HTTP_AUTHORIZATION' => 'Bearer ' + fake_token } }
-  let(:claims) { {'sub'=>3, 'exp'=>3600, 'iat'=>Time.now.to_i, 'token_type'=>'bearer', 'scope'=>nil, 'iss'=>'id.prx.org'} }
+  let(:iat) { Time.now.to_i }
+  let(:exp) { 3600 }
+  let(:claims) { {'sub'=>3, 'exp'=>exp, 'iat'=>iat, 'token_type'=>'bearer', 'scope'=>nil, 'iss'=>'id.prx.org'} }
 
   describe '#call' do
     it 'does nothing if there is no authorization header' do
@@ -32,24 +34,34 @@ describe Rack::PrxAuth do
     end
 
     it 'returns 401 if verification fails' do
+      auth_validator = prxauth.build_auth_validator('sometoken')
+
       JSON::JWT.stub(:decode, claims) do
-        prxauth.stub(:valid?, false) do
-          assert prxauth.call(env) == Rack::PrxAuth::INVALID_TOKEN
+        prxauth.stub(:build_auth_validator, auth_validator) do
+          auth_validator.stub(:valid?, false) do
+            assert prxauth.call(env) == Rack::PrxAuth::INVALID_TOKEN
+          end
         end
       end
     end
 
     it 'returns 401 if access token has expired' do
+      auth_validator = prxauth.build_auth_validator('sometoken')
+
       JSON::JWT.stub(:decode, claims) do
-        prxauth.stub(:expired?, true) do
-          assert prxauth.call(env) == Rack::PrxAuth::INVALID_TOKEN
+        prxauth.stub(:build_auth_validator, auth_validator) do
+          auth_validator.stub(:expired?, true) do
+            assert prxauth.call(env) == Rack::PrxAuth::INVALID_TOKEN
+          end
         end
       end
     end
 
     it 'attaches claims to request params if verification passes' do
-      prxauth.stub(:decode_token, claims) do
-        prxauth.stub(:valid?, true) do
+      auth_validator = prxauth.build_auth_validator('sometoken')
+
+      JSON::JWT.stub(:decode, claims) do
+        prxauth.stub(:build_auth_validator, auth_validator) do
           prxauth.call(env)['prx.auth'].tap do |token|
             assert token.instance_of? Rack::PrxAuth::TokenData
             assert token.user_id == claims['sub']
@@ -59,18 +71,6 @@ describe Rack::PrxAuth do
     end
   end
 
-  describe '#token_expired?' do
-    it 'returns true if token is expired' do
-      claims['iat'] = Time.now.to_i - 4000
-
-      assert prxauth.send(:expired?, claims) == true
-    end
-
-    it 'returns false if it is valid' do
-      assert prxauth.send(:expired?, claims) == false
-    end
-  end
-
   describe 'initialize' do
     it 'takes a certificate location as an option' do
       loc = nil
@@ -80,18 +80,4 @@ describe Rack::PrxAuth do
       end
     end
   end
-
-  describe '#decode_token' do
-    it 'should return an empty result for a nil token' do
-      assert prxauth.send(:decode_token, nil) == {}
-    end
-
-    it 'should return an empty result for an empty token' do
-      assert prxauth.send(:decode_token, {}) == {}
-    end
-
-    it 'should return an empty result for a malformed token' do
-      assert prxauth.send(:decode_token, 'asdfsadfsad') == {}
-    end
-  end
 end

metadata

@@ -1,15 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: prx_auth
 version: !ruby/object:Gem::Version
-  version: 1.2.1
+  version: 1.6.0
 platform: ruby
 authors:
 - Eve Asher
 - Chris Rhoden
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-08-11 00:00:00.000000000 Z
+date: 2021-01-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -31,14 +31,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: 12.3.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: 12.3.3
 - !ruby/object:Gem::Dependency
   name: coveralls
   requirement: !ruby/object:Gem::Requirement
@@ -115,14 +115,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.4
+        version: 1.12.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.4
+        version: 1.12.0
 description: Specific to PRX. Will ignore tokens that were not issued by PRX.
 email:
 - eve@prx.org
@@ -144,11 +144,13 @@ files:
 - lib/prx_auth/scope_list.rb
 - lib/prx_auth/version.rb
 - lib/rack/prx_auth.rb
+- lib/rack/prx_auth/auth_validator.rb
 - lib/rack/prx_auth/certificate.rb
 - lib/rack/prx_auth/token_data.rb
 - prx_auth.gemspec
 - test/prx_auth/resource_map_test.rb
 - test/prx_auth/scope_list_test.rb
+- test/rack/prx_auth/auth_validator_test.rb
 - test/rack/prx_auth/certificate_test.rb
 - test/rack/prx_auth/token_data_test.rb
 - test/rack/prx_auth_test.rb
@@ -157,7 +159,7 @@ homepage: https://github.com/PRX/prx_auth
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -172,14 +174,15 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.1
-signing_key: 
+rubygems_version: 3.0.3
+signing_key:
 specification_version: 4
 summary: Utilites for parsing PRX JWTs and Rack middleware that verifies and attaches
   the token's claims to env.
 test_files:
 - test/prx_auth/resource_map_test.rb
 - test/prx_auth/scope_list_test.rb
+- test/rack/prx_auth/auth_validator_test.rb
 - test/rack/prx_auth/certificate_test.rb
 - test/rack/prx_auth/token_data_test.rb
 - test/rack/prx_auth_test.rb