prx_auth 1.3.0 → 1.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea45502db577f8550ac1aa9d96187123a7a62d67e7d51998eac6d0eded55e587
-  data.tar.gz: 1e0cd0290b00484e5bb3dc6979d79c154287c823bf5f284a2657f35addcb6272
+  metadata.gz: 9e89ea4feff47dadbac479d38e5a35fa04be2e148cb10ebe4b41d800e2df48c3
+  data.tar.gz: b3ae9ed7381ff2765abc01c4126c3b7ede3db2f06a73cbd9da6918c9ac3a41ab
 SHA512:
-  metadata.gz: cf7061a2989e205e67f8c908f971b26ebb6d281f3234dcfaef1d29b50ed33369a9256ad7472415e67f13f25f63d24f87298562435c70eb0dd4c489b6ca83dac9
-  data.tar.gz: ea96bdda24fd8a2a1dba8bea12b9ac793316d021962f0751b3ac3e3496e90b8096db7f38af664fca535e5951a37771761111144154abf4933e10b5f7c538c532
+  metadata.gz: 17ffcb56a69a9c5d674f418967a56405a9f44dac40a0359d9bac42bd93421e7273af08632b311718ca10844ac3a37347d1b8753f1cac7f661b62d75752d25875
+  data.tar.gz: bb3d2a19cabf47a5f6d3d62edebf9bdb0ac368521b6c6128c1dc73edb00f2a2d353c8e0a17a46c52334e651a3c2926cfaf9215053d4f260d258a75793ee13d14

data/lib/prx_auth/scope_list.rb

@@ -126,7 +126,7 @@ module PrxAuth
     def &(other_list)
       return ScopeList.new('') if other_list.nil?
       
-      self - (self - other_list)
+      self - (self - other_list) + (other_list - (other_list - self))
     end
 
     def ==(other)

data/lib/prx_auth/version.rb

@@ -1,3 +1,3 @@
 module PrxAuth
-  VERSION = "1.3.0"
+  VERSION = "1.7.0"
 end

data/lib/rack/prx_auth.rb

@@ -1,6 +1,7 @@
 require 'json/jwt'
 require 'rack/prx_auth/certificate'
 require 'rack/prx_auth/token_data'
+require 'rack/prx_auth/auth_validator'
 require 'prx_auth'
 
 module Rack
@@ -20,16 +21,21 @@ module Rack
       @issuer = options[:issuer] || DEFAULT_ISS
     end
 
+    def build_auth_validator(token)
+      AuthValidator.new(token, @certificate, @issuer)
+    end
+
     def call(env)
       return @app.call(env) unless env['HTTP_AUTHORIZATION']
 
       token = env['HTTP_AUTHORIZATION'].split[1]
-      claims = decode_token(token)
 
-      return @app.call(env) unless should_validate_token?(claims)
+      auth_validator = build_auth_validator(token)
+
+      return @app.call(env) unless should_validate_token?(auth_validator)
 
-      if valid?(claims, token)
-        env['prx.auth'] = TokenData.new(claims)
+      if auth_validator.valid?
+        env['prx.auth'] = TokenData.new(auth_validator.claims)
         @app.call(env)
       else
         INVALID_TOKEN
@@ -38,26 +44,8 @@ module Rack
 
     private
 
-    def valid?(claims, token)
-      !expired?(claims) && @certificate.valid?(token)
-    end
-
-    def decode_token(token)
-      return {} if token.nil?
-
-      begin
-        JSON::JWT.decode(token, :skip_verification)
-      rescue JSON::JWT::InvalidFormat
-        {}
-      end
-    end
-
-    def expired?(claims)
-      Time.now.to_i > (claims['iat'] + claims['exp'])
-    end
-
-    def should_validate_token?(claims)
-      claims['iss'] == @issuer
+    def should_validate_token?(auth_validator)
+      auth_validator.token_issuer_matches?
     end
   end
 end

data/lib/rack/prx_auth/auth_validator.rb

@@ -0,0 +1,58 @@
+require 'json/jwt'
+
+module Rack
+  class PrxAuth
+    class AuthValidator
+
+      attr_reader :issuer, :token
+
+      def initialize(token, certificate = nil, issuer = nil)
+        @token = token
+        @certificate = certificate
+        @issuer = issuer
+      end
+
+      def valid?
+        valid_token_format? && !expired? && @certificate.valid?(token)
+      end
+
+      def claims
+        @claims ||= decode_token
+      end
+
+      def valid_token_format?
+        decode_token.present?
+      end
+
+      def decode_token
+        return {} if token.nil?
+
+        begin
+          JSON::JWT.decode(token, :skip_verification)
+        rescue JSON::JWT::InvalidFormat
+          {}
+        end
+      end
+
+      def expired?
+        (time_to_live + 30) <= 0 # 30 second clock jitter allowance
+      end
+
+      def time_to_live
+        now = Time.now.to_i
+        if claims['exp'].nil?
+          0
+        elsif claims['iat'].nil? || claims['iat'] <= claims['exp']
+          claims['exp'] - now
+        else
+          # malformed - exp is a num-seconds offset from issued-at-time
+          (claims['iat'] + claims['exp']) - now
+        end
+      end
+
+      def token_issuer_matches?
+        claims['iss'] == @issuer
+      end
+    end
+  end
+end

data/lib/rack/prx_auth/certificate.rb

@@ -11,6 +11,7 @@ module Rack
 
       def initialize(cert_uri = nil)
         @cert_location = cert_uri.nil? ? DEFAULT_CERT_LOC : URI(cert_uri)
+        @certificate = nil
       end
 
       def valid?(token)

data/lib/rack/prx_auth/token_data.rb

@@ -32,7 +32,11 @@ module Rack
       def globally_authorized?(namespace, scope=nil)
         authorized?(::PrxAuth::ResourceMap::WILDCARD_KEY, namespace, scope)
       end
-      
+
+      def authorized_account_ids(scope)
+        resources(::PrxAuth::Rails.configuration.namespace, scope).map(&:to_i)
+      end
+
       private
 
       def unpack_aur(aur)

data/prx_auth.gemspec

@@ -21,12 +21,12 @@ Gem::Specification.new do |spec|
   spec.required_ruby_version = '>= 2.3'
 
   spec.add_development_dependency 'bundler', '~> 2.0'
-  spec.add_development_dependency 'rake', '~> 10.0'
+  spec.add_development_dependency 'rake', '~> 12.3.3'
   spec.add_development_dependency 'coveralls', '~> 0'
   spec.add_development_dependency 'guard'
   spec.add_development_dependency 'guard-minitest'
 
   spec.add_dependency 'rack', '>= 1.5.2'
   spec.add_dependency 'json', '>= 1.8.1'
-  spec.add_dependency 'json-jwt', '~> 1.9.4'
+  spec.add_dependency 'json-jwt', '~> 1.12.0'
 end

data/test/prx_auth/scope_list_test.rb

@@ -104,6 +104,16 @@ describe PrxAuth::ScopeList do
       sl = new_list('one') & nil
       assert !sl.contains?(:one)
     end
+
+    it 'works when either side has non-namespaced values correctly' do
+      sl = PrxAuth::ScopeList.new('foo:bar') & PrxAuth::ScopeList.new('bar')
+      assert sl.contains?(:foo, :bar)
+      refute sl.contains?(:bar)
+
+      sl = PrxAuth::ScopeList.new('bar') & PrxAuth::ScopeList.new('foo:bar')
+      assert sl.contains?(:foo, :bar)
+      refute sl.contains?(:bar)
+    end
   end
 
   describe '==' do

data/test/rack/prx_auth/auth_validator_test.rb

@@ -0,0 +1,141 @@
+require 'test_helper'
+
+describe Rack::PrxAuth::AuthValidator do
+  let(:app) { Proc.new {|env| env } }
+  let(:auth_validator) { Rack::PrxAuth::AuthValidator.new(token, certificate, 'id.local.test') }
+
+  let(:token) { 'some.token.foo' }
+
+  let(:iat) { Time.now.to_i }
+  let(:exp) { 3600 }
+  let(:claims) { {'sub'=>3, 'exp'=>exp, 'iat'=>iat, 'token_type'=>'bearer', 'scope'=>nil, 'iss'=>'id.prx.org'} }
+  let(:certificate) { Rack::PrxAuth::Certificate.new }
+
+  describe '#token_issuer_matches' do
+    it 'false if the token is from another issuer' do
+      auth_validator.stub(:claims, claims) do
+        refute auth_validator.token_issuer_matches?
+      end
+    end
+
+    it 'is false if the issuer in the validator does not match' do
+      auth_validator.stub(:issuer, 'id.foo.com') do
+        refute auth_validator.token_issuer_matches?
+      end
+    end
+  end
+
+  describe '#valid?' do
+    it 'is false if token is invalid' do
+      auth_validator.stub(:claims, claims) do
+        refute auth_validator.valid?
+      end
+    end
+
+    it 'is false if the token is nil' do
+      certificate.stub(:valid?, true) do
+        auth_validator.stub(:token, nil) do
+          refute auth_validator.valid?
+        end
+      end
+    end
+  end
+
+  describe '#expired?' do
+
+    def expired?(claims)
+      auth_validator.stub(:claims, claims) do
+        auth_validator.expired?
+      end
+    end
+
+    describe 'with a malformed exp' do
+      let(:iat) { Time.now.to_i }
+      let(:exp) { 3600 }
+
+      it 'is expired if iat + exp are in the past' do
+        claims['iat'] -= 3631
+
+        assert expired?(claims)
+      end
+
+      it 'is not expired if iat + exp are in the future' do
+        claims['iat'] = Time.now.to_i - 3599
+
+        refute expired?(claims)
+      end
+
+      it 'allows a 30s clock jitter' do
+        claims['iat'] = Time.now.to_i - 3629
+
+        refute expired?(claims)
+      end
+    end
+
+    describe 'with a corrected exp' do
+      let(:iat) { Time.now.to_i - 3600 }
+      let(:exp) { Time.now.to_i + 1 }
+
+      it 'is not expired if exp is in the future' do
+        refute expired?(claims)
+      end
+
+      it 'is expired if exp is in the past (with 30s jitter grace)' do
+        claims['exp'] = Time.now.to_i - 31
+        assert expired?(claims)
+        claims['exp'] = Time.now.to_i - 29
+        refute expired?(claims)
+      end
+    end
+  end
+
+  describe '#time_to_live' do
+    def time_to_live(claims)
+      auth_validator.stub(:claims, claims) do
+        auth_validator.time_to_live
+      end
+    end
+
+    it 'returns the ttl without any clock jitter correction' do
+      claims['exp'] = Time.now.to_i + 999
+      assert_equal time_to_live(claims), 999
+    end
+
+    it 'handles missing exp' do
+      claims['exp'] = nil
+      assert_equal time_to_live(claims), 0
+    end
+
+    it 'handles missing iat' do
+      claims['iat'] = nil
+      claims['exp'] = Time.now.to_i + 999
+      assert_equal time_to_live(claims), 999
+    end
+
+    it 'handles malformed exp' do
+      claims['iat'] = Time.now.to_i
+      claims['exp'] = 999
+      assert_equal time_to_live(claims), 999
+    end
+  end
+
+  describe '#decode_token' do
+    it 'should return an empty result for a nil token' do
+        auth_validator.stub(:token, nil) do
+          assert auth_validator.decode_token == {}
+        end
+    end
+
+    it 'should return an empty result for an empty token' do
+        auth_validator.stub(:token, '') do
+          assert auth_validator.decode_token == {}
+        end
+    end
+
+    it 'should return an empty result for a malformed token' do
+        auth_validator.stub(:token, token) do
+          assert auth_validator.decode_token == {}
+        end
+    end
+  end
+end

data/test/rack/prx_auth_test.rb

@@ -5,7 +5,9 @@ describe Rack::PrxAuth do
   let(:prxauth) { Rack::PrxAuth.new(app) }
   let(:fake_token) { 'afawefawefawefawegstgnsrtiohnlijblublwjnvrtoign'}
   let(:env) { {'HTTP_AUTHORIZATION' => 'Bearer ' + fake_token } }
-  let(:claims) { {'sub'=>3, 'exp'=>3600, 'iat'=>Time.now.to_i, 'token_type'=>'bearer', 'scope'=>nil, 'iss'=>'id.prx.org'} }
+  let(:iat) { Time.now.to_i }
+  let(:exp) { 3600 }
+  let(:claims) { {'sub'=>3, 'exp'=>exp, 'iat'=>iat, 'token_type'=>'bearer', 'scope'=>nil, 'iss'=>'id.prx.org'} }
 
   describe '#call' do
     it 'does nothing if there is no authorization header' do
@@ -32,24 +34,34 @@ describe Rack::PrxAuth do
     end
 
     it 'returns 401 if verification fails' do
+      auth_validator = prxauth.build_auth_validator('sometoken')
+
       JSON::JWT.stub(:decode, claims) do
-        prxauth.stub(:valid?, false) do
-          assert prxauth.call(env) == Rack::PrxAuth::INVALID_TOKEN
+        prxauth.stub(:build_auth_validator, auth_validator) do
+          auth_validator.stub(:valid?, false) do
+            assert prxauth.call(env) == Rack::PrxAuth::INVALID_TOKEN
+          end
         end
       end
     end
 
     it 'returns 401 if access token has expired' do
+      auth_validator = prxauth.build_auth_validator('sometoken')
+
       JSON::JWT.stub(:decode, claims) do
-        prxauth.stub(:expired?, true) do
-          assert prxauth.call(env) == Rack::PrxAuth::INVALID_TOKEN
+        prxauth.stub(:build_auth_validator, auth_validator) do
+          auth_validator.stub(:expired?, true) do
+            assert prxauth.call(env) == Rack::PrxAuth::INVALID_TOKEN
+          end
         end
       end
     end
 
     it 'attaches claims to request params if verification passes' do
-      prxauth.stub(:decode_token, claims) do
-        prxauth.stub(:valid?, true) do
+      auth_validator = prxauth.build_auth_validator('sometoken')
+
+      JSON::JWT.stub(:decode, claims) do
+        prxauth.stub(:build_auth_validator, auth_validator) do
           prxauth.call(env)['prx.auth'].tap do |token|
             assert token.instance_of? Rack::PrxAuth::TokenData
             assert token.user_id == claims['sub']
@@ -59,18 +71,6 @@ describe Rack::PrxAuth do
     end
   end
 
-  describe '#token_expired?' do
-    it 'returns true if token is expired' do
-      claims['iat'] = Time.now.to_i - 4000
-
-      assert prxauth.send(:expired?, claims) == true
-    end
-
-    it 'returns false if it is valid' do
-      assert prxauth.send(:expired?, claims) == false
-    end
-  end
-
   describe 'initialize' do
     it 'takes a certificate location as an option' do
       loc = nil
@@ -80,18 +80,4 @@ describe Rack::PrxAuth do
       end
     end
   end
-
-  describe '#decode_token' do
-    it 'should return an empty result for a nil token' do
-      assert prxauth.send(:decode_token, nil) == {}
-    end
-
-    it 'should return an empty result for an empty token' do
-      assert prxauth.send(:decode_token, {}) == {}
-    end
-
-    it 'should return an empty result for a malformed token' do
-      assert prxauth.send(:decode_token, 'asdfsadfsad') == {}
-    end
-  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: prx_auth
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.7.0
 platform: ruby
 authors:
 - Eve Asher
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-08-28 00:00:00.000000000 Z
+date: 2021-03-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -31,14 +31,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: 12.3.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: 12.3.3
 - !ruby/object:Gem::Dependency
   name: coveralls
   requirement: !ruby/object:Gem::Requirement
@@ -115,14 +115,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.4
+        version: 1.12.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.4
+        version: 1.12.0
 description: Specific to PRX. Will ignore tokens that were not issued by PRX.
 email:
 - eve@prx.org
@@ -144,11 +144,13 @@ files:
 - lib/prx_auth/scope_list.rb
 - lib/prx_auth/version.rb
 - lib/rack/prx_auth.rb
+- lib/rack/prx_auth/auth_validator.rb
 - lib/rack/prx_auth/certificate.rb
 - lib/rack/prx_auth/token_data.rb
 - prx_auth.gemspec
 - test/prx_auth/resource_map_test.rb
 - test/prx_auth/scope_list_test.rb
+- test/rack/prx_auth/auth_validator_test.rb
 - test/rack/prx_auth/certificate_test.rb
 - test/rack/prx_auth/token_data_test.rb
 - test/rack/prx_auth_test.rb
@@ -172,7 +174,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.1
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Utilites for parsing PRX JWTs and Rack middleware that verifies and attaches
@@ -180,6 +182,7 @@ summary: Utilites for parsing PRX JWTs and Rack middleware that verifies and att
 test_files:
 - test/prx_auth/resource_map_test.rb
 - test/prx_auth/scope_list_test.rb
+- test/rack/prx_auth/auth_validator_test.rb
 - test/rack/prx_auth/certificate_test.rb
 - test/rack/prx_auth/token_data_test.rb
 - test/rack/prx_auth_test.rb