prx_auth 1.8.2 → 1.8.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eabb6a716e68b05920c7bfa5a8828ef23b81d0e797a7e6c2f46573925b45d1f6
-  data.tar.gz: 6a04e773977f315361c8a7b8954a44624cd9c6d76d7e7a7189d8070f9cff2cef
+  metadata.gz: 071b150dbfc9e832cce6696f1d3c25b735050e0584b975bc2a244853cb7c7978
+  data.tar.gz: c51835966977d8416771aa224a68097ceb4d56f995e63af0a5da7293496ccf5c
 SHA512:
-  metadata.gz: 23fe7b933f7f1ba58f2a594c5867b79f14862bd72818caa5ef086d57e924279e152979765c97083fa699ae3027f46d80204340e48617fad9486b12cdccece9fb
-  data.tar.gz: 66b5f283be339e723d617301c33245951ddc3d99f7f83580c51a0d789ca189eb6bd742ce9ed0222723b68c360f8e1b425a42faba129d37323b6d9075469b0234
+  metadata.gz: 9dd940c7d66f8e3a5cc9e935ba38cd4d8c68b40c993fd2ee5a503fd972065d25b16d73213db5781a36faee69093d47613141986a4d6d529b65ed47ebc4a19844
+  data.tar.gz: 6afae83d719c2f51166795e1f61a7b16fdf80cedffb719f18820e945e148a54619ddff9d720168afdf056c583ddeeee7a695ffa17919ac4669e8e2ebaa00f49d

data/lib/prx_auth/version.rb

@@ -1,3 +1,3 @@
 module PrxAuth
-  VERSION = "1.8.2"
+  VERSION = "1.8.3"
 end

data/lib/rack/prx_auth/certificate.rb

@@ -36,12 +36,29 @@ module Rack
       end
 
       def fetch
-        certs = JSON.parse(Net::HTTP.get(cert_location))
+        certs = JSON.parse(fetch_http)
         cert_string = certs["certificates"].values[0]
         @refresh_at = Time.now.to_i + EXPIRES_IN
         OpenSSL::X509::Certificate.new(cert_string)
       end
 
+      def fetch_http(retries = 2, sleep_seconds = 0.5)
+        host = cert_location.host
+        port = cert_location.port
+        path = cert_location.path
+        ssl = cert_location.scheme == "https"
+        res = Net::HTTP.start(host, port, use_ssl: ssl) { |http| http.request_get(path) }
+
+        if res.is_a?(Net::HTTPSuccess)
+          res.body
+        elsif res.code.to_i >= 500 && retries > 0
+          sleep sleep_seconds
+          fetch_http(retries - 1, sleep_seconds)
+        else
+          raise "Got #{res.code} from #{cert_location}"
+        end
+      end
+
       def needs_refresh?
         expired? || @refresh_at <= Time.now.to_i
       end

data/prx_auth.gemspec

@@ -26,6 +26,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "pry"
   spec.add_development_dependency "standard"
   spec.add_development_dependency "m"
+  spec.add_development_dependency "webmock"
 
   spec.add_dependency "rack", ">= 1.5.2"
   spec.add_dependency "json", ">= 1.8.1"

data/test/rack/prx_auth/certificate_test.rb

@@ -1,7 +1,8 @@
 require "test_helper"
 
 describe Rack::PrxAuth::Certificate do
-  let(:subject) { Rack::PrxAuth::Certificate.new }
+  let(:cert_uri) { "http://example.com/certs" }
+  let(:subject) { Rack::PrxAuth::Certificate.new(cert_uri) }
   let(:certificate) { subject }
 
   describe "#initialize" do
@@ -11,7 +12,8 @@ describe Rack::PrxAuth::Certificate do
     end
 
     it "defaults to DEFAULT_CERT_LOC" do
-      assert certificate.cert_location == Rack::PrxAuth::Certificate::DEFAULT_CERT_LOC
+      cert = Rack::PrxAuth::Certificate.new
+      assert cert.cert_location == Rack::PrxAuth::Certificate::DEFAULT_CERT_LOC
     end
   end
 
@@ -66,24 +68,51 @@ describe Rack::PrxAuth::Certificate do
   end
 
   describe "#fetch" do
+    let(:fake_json) { "{\"certificates\":{\"asdf\":\"the-cert-content\"}}" }
+
     it "pulls from `#cert_location`" do
-      Net::HTTP.stub(:get, ->(x) { "{\"certificates\":{\"asdf\":\"#{x}\"}}" }) do
-        OpenSSL::X509::Certificate.stub(:new, ->(x) { x }) do
-          certificate.stub(:cert_location, "a://fake.url/here") do
-            assert certificate.send(:fetch) == "a://fake.url/here"
-          end
-        end
+      stub_request(:get, cert_uri).to_return(body: fake_json)
+
+      OpenSSL::X509::Certificate.stub(:new, ->(x) { x }) do
+        assert_equal "the-cert-content", certificate.send(:fetch)
       end
     end
 
     it "sets the expiration value" do
-      Net::HTTP.stub(:get, ->(x) { "{\"certificates\":{\"asdf\":\"#{x}\"}}" }) do
-        OpenSSL::X509::Certificate.stub(:new, ->(_) { Struct.new(:not_after).new(Time.now + 10000) }) do
-          certificate.send :certificate
-          assert !certificate.send(:needs_refresh?)
-        end
+      stub_request(:get, cert_uri).to_return(body: fake_json)
+
+      OpenSSL::X509::Certificate.stub(:new, ->(_) { Struct.new(:not_after).new(Time.now + 10000) }) do
+        certificate.send :certificate
+        assert !certificate.send(:needs_refresh?)
       end
     end
+
+    it "retries 5XX errors" do
+      stub_request(:get, cert_uri)
+        .to_return(status: 502)
+        .to_return(status: 504)
+        .to_return(status: 200, body: TEST_CERT_JSON)
+
+      assert_equal TEST_CERT_JSON, certificate.send(:fetch_http, 2, 0)
+    end
+
+    it "raises other errors" do
+      stub_request(:get, cert_uri)
+        .to_return(status: 501)
+        .to_return(status: 502)
+        .to_return(status: 503)
+        .to_return(status: 504)
+
+      err = assert_raises(RuntimeError) { certificate.send(:fetch_http, 2, 0) }
+      assert_equal "Got 503 from #{cert_uri}", err.message
+    end
+
+    it "runs out of retries" do
+      stub_request(:get, cert_uri).to_return(status: 502).to_return(status: 401)
+
+      err = assert_raises(RuntimeError) { certificate.send(:fetch_http, 2, 0) }
+      assert_equal "Got 401 from #{cert_uri}", err.message
+    end
   end
 
   describe "#expired?" do

data/test/rack/prx_auth_test.rb

@@ -60,6 +60,8 @@ describe Rack::PrxAuth do
     it "attaches claims to request params if verification passes" do
       auth_validator = prxauth.build_auth_validator("sometoken")
 
+      stub_request(:get, Rack::PrxAuth::Certificate::DEFAULT_CERT_LOC).to_return(body: TEST_CERT_JSON)
+
       JSON::JWT.stub(:decode, claims) do
         prxauth.stub(:build_auth_validator, auth_validator) do
           prxauth.call(env)["prx.auth"].tap do |token|

data/test/test_helper.rb

@@ -9,3 +9,7 @@ require "pry"
 require "minitest/autorun"
 require "minitest/spec"
 require "minitest/pride"
+require "webmock/minitest"
+
+TEST_CERT = "-----BEGIN CERTIFICATE-----\nMIIBGjCBwgIJALc+y9yEBugLMAoGCCqGSM49BAMCMBYxFDASBgNVBAMMC2lkLnBy\neC50ZXN0MB4XDTIyMDYwMzE0MjI0OVoXDTIzMDYwMzE0MjI0OVowFjEUMBIGA1UE\nAwwLaWQucHJ4LnRlc3QwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQP8/BrEA/7\nHttUpOs0oxWNOtcUH2+0h2Oo/eXNyqs7CRScqmWWShKTzhiBlD8UNYZ3o4+kljl1\nazuLnv1Wxg7PMAoGCCqGSM49BAMCA0cAMEQCICXFwNxJQ9OLzyjN9EJnKQIP+2Jz\nfKWPJ1KyASkFDugyAiAxyfe3vR/XaSJOlJf8MjA5/0feEhiJcSszIrtHFweWLQ==\n-----END CERTIFICATE-----\n"
+TEST_CERT_JSON = JSON.generate({certificates: {abcd1234: TEST_CERT}})

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: prx_auth
 version: !ruby/object:Gem::Version
-  version: 1.8.2
+  version: 1.8.3
 platform: ruby
 authors:
 - Eve Asher
 - Chris Rhoden
 bindir: bin
 cert_chain: []
-date: 2025-07-22 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -122,6 +122,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -216,7 +230,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 3.6.7
 specification_version: 4
 summary: Utilites for parsing PRX JWTs and Rack middleware that verifies and attaches
   the token's claims to env.