prx_auth 1.5.0 → 1.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0ac722c142dfc949c887f3bd913c19e9a743c6dc9503badaa967fc180b200344
-  data.tar.gz: bbac43c4ad1611c136da5a66f544eea639262fa2cb01e6eb1853610ee630b0ca
+  metadata.gz: f7d2d71dd1671a97f1ce4f9181852e8cc7e0a651e91370aca09300c468dfbf86
+  data.tar.gz: f4fcef9ecc2977321ae3ec193a8be62c0735d08f0a564787ff581d3e65bc869a
 SHA512:
-  metadata.gz: 7941fafb990e4d7aa8cb070963aba181b91d3d108fd4a4d6017618b15532d83876db3dc69a3fb962d5193adb61f82cad5874b7b65590880b99a6eb68117e0e6d
-  data.tar.gz: b3d1a127bbe650df453b3158d81df5fd56dfcad9c9862ceaba502ca25dd45ad9c6a6764f65a481cd6a54989aa22b5cf10774a003efc97d949c782cdddc767660
+  metadata.gz: 482f861b69e7e05eb6d9b2308b2c0dfc402ac8a8bd01f200e14e04cafd24897adea376de29a6ad1fb6a52eeb08647303c10c344e097a45c1dea6730ace2a4bdf
+  data.tar.gz: 10ada294eda678f2d70c4780db32f33063a869d3caf25c481949cd5350f326bbeb6c5a60d96fa797ef3d1f2548c552edde731a28fd9667ee20a7d336ad936656

data/lib/prx_auth/version.rb

@@ -1,3 +1,3 @@
 module PrxAuth
-  VERSION = "1.5.0"
+  VERSION = "1.6.0"
 end

data/lib/rack/prx_auth.rb

@@ -1,6 +1,7 @@
 require 'json/jwt'
 require 'rack/prx_auth/certificate'
 require 'rack/prx_auth/token_data'
+require 'rack/prx_auth/auth_validator'
 require 'prx_auth'
 
 module Rack
@@ -20,16 +21,21 @@ module Rack
       @issuer = options[:issuer] || DEFAULT_ISS
     end
 
+    def build_auth_validator(token)
+      AuthValidator.new(token, @certificate, @issuer)
+    end
+
     def call(env)
       return @app.call(env) unless env['HTTP_AUTHORIZATION']
 
       token = env['HTTP_AUTHORIZATION'].split[1]
-      claims = decode_token(token)
 
-      return @app.call(env) unless should_validate_token?(claims)
+      auth_validator = build_auth_validator(token)
 
-      if valid?(claims, token)
-        env['prx.auth'] = TokenData.new(claims)
+      return @app.call(env) unless should_validate_token?(auth_validator)
+
+      if auth_validator.valid?
+        env['prx.auth'] = TokenData.new(auth_validator.claims)
         @app.call(env)
       else
         INVALID_TOKEN
@@ -38,31 +44,8 @@ module Rack
 
     private
 
-    def valid?(claims, token)
-      !expired?(claims) && @certificate.valid?(token)
-    end
-
-    def decode_token(token)
-      return {} if token.nil?
-
-      begin
-        JSON::JWT.decode(token, :skip_verification)
-      rescue JSON::JWT::InvalidFormat
-        {}
-      end
-    end
-
-    def expired?(claims)
-      now = Time.now.to_i - 30 # 30 second clock jitter allowance
-      if claims['iat'] <= claims['exp']
-        now > claims['exp']
-      else
-        now > (claims['iat'] + claims['exp'])
-      end
-    end
-
-    def should_validate_token?(claims)
-      claims['iss'] == @issuer
+    def should_validate_token?(auth_validator)
+      auth_validator.token_issuer_matches?
     end
   end
 end

data/lib/rack/prx_auth/auth_validator.rb

@@ -0,0 +1,51 @@
+require 'json/jwt'
+
+module Rack
+  class PrxAuth
+    class AuthValidator
+
+      attr_reader :issuer, :claims, :token
+
+      def initialize(token, certificate, issuer)
+        @token = token
+        @certificate = certificate
+        @issuer = issuer
+      end
+
+      def valid?
+        valid_token_format? && !expired? && @certificate.valid?(token)
+      end
+
+      def claims
+        @claims ||= decode_token
+      end
+
+      def valid_token_format?
+        decode_token.present?
+      end
+
+      def decode_token
+        return {} if token.nil?
+
+        begin
+          JSON::JWT.decode(token, :skip_verification)
+        rescue JSON::JWT::InvalidFormat
+          {}
+        end
+      end
+
+      def expired?
+        now = Time.now.to_i - 30 # 30 second clock jitter allowance
+        if claims['iat'] <= claims['exp']
+          now > claims['exp']
+        else
+          now > (claims['iat'] + claims['exp'])
+        end
+      end
+
+      def token_issuer_matches?
+        claims['iss'] == @issuer
+      end
+    end
+  end
+end

data/lib/rack/prx_auth/token_data.rb

@@ -32,7 +32,11 @@ module Rack
       def globally_authorized?(namespace, scope=nil)
         authorized?(::PrxAuth::ResourceMap::WILDCARD_KEY, namespace, scope)
       end
-      
+
+      def authorized_account_ids(scope)
+        resources(::PrxAuth::Rails.configuration.namespace, scope).map(&:to_i)
+      end
+
       private
 
       def unpack_aur(aur)

data/prx_auth.gemspec

@@ -28,5 +28,5 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency 'rack', '>= 1.5.2'
   spec.add_dependency 'json', '>= 1.8.1'
-  spec.add_dependency 'json-jwt', '~> 1.11.0'
+  spec.add_dependency 'json-jwt', '~> 1.12.0'
 end

data/test/rack/prx_auth/auth_validator_test.rb

@@ -0,0 +1,111 @@
+require 'test_helper'
+
+describe Rack::PrxAuth::AuthValidator do
+  let(:app) { Proc.new {|env| env } }
+  let(:auth_validator) { Rack::PrxAuth::AuthValidator.new(token, certificate, 'id.local.test') }
+
+  let(:token) { 'some.token.foo' }
+
+  let(:iat) { Time.now.to_i }
+  let(:exp) { 3600 }
+  let(:claims) { {'sub'=>3, 'exp'=>exp, 'iat'=>iat, 'token_type'=>'bearer', 'scope'=>nil, 'iss'=>'id.prx.org'} }
+  let(:certificate) { cert = Rack::PrxAuth::Certificate.new }
+
+  describe '#token_issuer_matches' do
+    it 'false if the token is from another issuer' do
+      auth_validator.stub(:claims, claims) do
+        refute auth_validator.token_issuer_matches?
+      end
+    end
+
+    it 'is false if the issuer in the validator does not match' do
+      auth_validator.stub(:issuer, 'id.foo.com') do
+        refute auth_validator.token_issuer_matches?
+      end
+    end
+  end
+
+  describe '#valid?' do
+    it 'is false if token is invalid' do
+      auth_validator.stub(:claims, claims) do
+        refute auth_validator.valid?
+      end
+    end
+
+    it 'is false if the token is nil' do
+      certificate.stub(:valid?, true) do
+        auth_validator.stub(:token, nil) do
+          refute auth_validator.valid?
+        end
+      end
+    end
+  end
+
+  describe '#expired?' do
+
+    def expired?(claims)
+      auth_validator.stub(:claims, claims) do
+        auth_validator.expired?
+      end
+    end
+
+    describe 'with a malformed exp' do
+      let(:iat) { Time.now.to_i }
+      let(:exp) { 3600 }
+
+      it 'is expired if iat + exp are in the past' do
+        claims['iat'] -= 3631
+
+        assert expired?(claims)
+      end
+
+      it 'is not expired if iat + exp are in the future' do
+        claims['iat'] = Time.now.to_i - 3599
+
+        refute expired?(claims)
+      end
+
+      it 'allows a 30s clock jitter' do
+        claims['iat'] = Time.now.to_i - 3629
+
+        refute expired?(claims)
+      end
+    end
+
+    describe 'with a corrected exp' do
+      let(:iat) { Time.now.to_i - 3600 }
+      let(:exp) { Time.now.to_i + 1 }
+
+      it 'is not expired if exp is in the future' do
+        refute expired?(claims)
+      end
+
+      it 'is expired if exp is in the past (with 30s jitter grace)' do
+        claims['exp'] = Time.now.to_i - 31
+        assert expired?(claims)
+        claims['exp'] = Time.now.to_i - 29
+        refute expired?(claims)
+      end
+    end
+  end
+
+  describe '#decode_token' do
+    it 'should return an empty result for a nil token' do
+        auth_validator.stub(:token, nil) do
+          assert auth_validator.decode_token == {}
+        end
+    end
+
+    it 'should return an empty result for an empty token' do
+        auth_validator.stub(:token, '') do
+          assert auth_validator.decode_token == {}
+        end
+    end
+
+    it 'should return an empty result for a malformed token' do
+        auth_validator.stub(:token, token) do
+          assert auth_validator.decode_token == {}
+        end
+    end
+  end
+end

data/test/rack/prx_auth_test.rb

@@ -34,24 +34,34 @@ describe Rack::PrxAuth do
     end
 
     it 'returns 401 if verification fails' do
+      auth_validator = prxauth.build_auth_validator('sometoken')
+
       JSON::JWT.stub(:decode, claims) do
-        prxauth.stub(:valid?, false) do
-          assert prxauth.call(env) == Rack::PrxAuth::INVALID_TOKEN
+        prxauth.stub(:build_auth_validator, auth_validator) do
+          auth_validator.stub(:valid?, false) do
+            assert prxauth.call(env) == Rack::PrxAuth::INVALID_TOKEN
+          end
         end
       end
     end
 
     it 'returns 401 if access token has expired' do
+      auth_validator = prxauth.build_auth_validator('sometoken')
+
       JSON::JWT.stub(:decode, claims) do
-        prxauth.stub(:expired?, true) do
-          assert prxauth.call(env) == Rack::PrxAuth::INVALID_TOKEN
+        prxauth.stub(:build_auth_validator, auth_validator) do
+          auth_validator.stub(:expired?, true) do
+            assert prxauth.call(env) == Rack::PrxAuth::INVALID_TOKEN
+          end
         end
       end
     end
 
     it 'attaches claims to request params if verification passes' do
-      prxauth.stub(:decode_token, claims) do
-        prxauth.stub(:valid?, true) do
+      auth_validator = prxauth.build_auth_validator('sometoken')
+
+      JSON::JWT.stub(:decode, claims) do
+        prxauth.stub(:build_auth_validator, auth_validator) do
           prxauth.call(env)['prx.auth'].tap do |token|
             assert token.instance_of? Rack::PrxAuth::TokenData
             assert token.user_id == claims['sub']
@@ -61,52 +71,6 @@ describe Rack::PrxAuth do
     end
   end
 
-  describe '#expired?' do
-
-    def expired?(claims)
-      prxauth.send(:expired?, claims)
-    end
-
-    describe 'with a malformed exp' do
-      let(:iat) { Time.now.to_i }
-      let(:exp) { 3600 }
-
-      it 'is expired if iat + exp are in the past' do
-        claims['iat'] -= 3631
-
-        assert expired?(claims)
-      end
-
-      it 'is not expired if iat + exp are in the future' do
-        claims['iat'] = Time.now.to_i - 3599
-
-        refute expired?(claims)
-      end
-
-      it 'allows a 30s clock jitter' do
-        claims['iat'] = Time.now.to_i - 3629
-
-        refute expired?(claims)
-      end
-    end
-
-    describe 'with a corrected exp' do
-      let(:iat) { Time.now.to_i - 3600 }
-      let(:exp) { Time.now.to_i + 1 }
-
-      it 'is not expired if exp is in the future' do
-        refute expired?(claims)
-      end
-
-      it 'is expired if exp is in the past (with 30s jitter grace)' do
-        claims['exp'] = Time.now.to_i - 31
-        assert expired?(claims)
-        claims['exp'] = Time.now.to_i - 29
-        refute expired?(claims)
-      end
-    end
-  end
-
   describe 'initialize' do
     it 'takes a certificate location as an option' do
       loc = nil
@@ -116,18 +80,4 @@ describe Rack::PrxAuth do
       end
     end
   end
-
-  describe '#decode_token' do
-    it 'should return an empty result for a nil token' do
-      assert prxauth.send(:decode_token, nil) == {}
-    end
-
-    it 'should return an empty result for an empty token' do
-      assert prxauth.send(:decode_token, {}) == {}
-    end
-
-    it 'should return an empty result for a malformed token' do
-      assert prxauth.send(:decode_token, 'asdfsadfsad') == {}
-    end
-  end
 end

metadata

@@ -1,15 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: prx_auth
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.6.0
 platform: ruby
 authors:
 - Eve Asher
 - Chris Rhoden
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-10-19 00:00:00.000000000 Z
+date: 2021-01-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -115,14 +115,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.11.0
+        version: 1.12.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.11.0
+        version: 1.12.0
 description: Specific to PRX. Will ignore tokens that were not issued by PRX.
 email:
 - eve@prx.org
@@ -144,11 +144,13 @@ files:
 - lib/prx_auth/scope_list.rb
 - lib/prx_auth/version.rb
 - lib/rack/prx_auth.rb
+- lib/rack/prx_auth/auth_validator.rb
 - lib/rack/prx_auth/certificate.rb
 - lib/rack/prx_auth/token_data.rb
 - prx_auth.gemspec
 - test/prx_auth/resource_map_test.rb
 - test/prx_auth/scope_list_test.rb
+- test/rack/prx_auth/auth_validator_test.rb
 - test/rack/prx_auth/certificate_test.rb
 - test/rack/prx_auth/token_data_test.rb
 - test/rack/prx_auth_test.rb
@@ -157,7 +159,7 @@ homepage: https://github.com/PRX/prx_auth
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -172,14 +174,15 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.1
-signing_key: 
+rubygems_version: 3.0.3
+signing_key:
 specification_version: 4
 summary: Utilites for parsing PRX JWTs and Rack middleware that verifies and attaches
   the token's claims to env.
 test_files:
 - test/prx_auth/resource_map_test.rb
 - test/prx_auth/scope_list_test.rb
+- test/rack/prx_auth/auth_validator_test.rb
 - test/rack/prx_auth/certificate_test.rb
 - test/rack/prx_auth/token_data_test.rb
 - test/rack/prx_auth_test.rb