quantumdmn-sdk 1.0.0

data/vendor/bundle/ruby/4.0.0/gems/jwt-2.10.2/lib/jwt/configuration/decode_configuration.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+module JWT
+  module Configuration
+    # The DecodeConfiguration class holds the configuration settings for decoding JWT tokens.
+    class DecodeConfiguration
+      # @!attribute [rw] verify_expiration
+      #   @return [Boolean] whether to verify the expiration claim.
+      # @!attribute [rw] verify_not_before
+      #   @return [Boolean] whether to verify the not before claim.
+      # @!attribute [rw] verify_iss
+      #   @return [Boolean] whether to verify the issuer claim.
+      # @!attribute [rw] verify_iat
+      #   @return [Boolean] whether to verify the issued at claim.
+      # @!attribute [rw] verify_jti
+      #   @return [Boolean] whether to verify the JWT ID claim.
+      # @!attribute [rw] verify_aud
+      #   @return [Boolean] whether to verify the audience claim.
+      # @!attribute [rw] verify_sub
+      #   @return [Boolean] whether to verify the subject claim.
+      # @!attribute [rw] leeway
+      #   @return [Integer] the leeway in seconds for time-based claims.
+      # @!attribute [rw] algorithms
+      #   @return [Array<String>] the list of acceptable algorithms.
+      # @!attribute [rw] required_claims
+      #   @return [Array<String>] the list of required claims.
+
+      attr_accessor :verify_expiration,
+                    :verify_not_before,
+                    :verify_iss,
+                    :verify_iat,
+                    :verify_jti,
+                    :verify_aud,
+                    :verify_sub,
+                    :leeway,
+                    :algorithms,
+                    :required_claims
+
+      # Initializes a new DecodeConfiguration instance with default settings.
+      def initialize
+        @verify_expiration = true
+        @verify_not_before = true
+        @verify_iss = false
+        @verify_iat = false
+        @verify_jti = false
+        @verify_aud = false
+        @verify_sub = false
+        @leeway = 0
+        @algorithms = ['HS256']
+        @required_claims = []
+      end
+
+      # @api private
+      def to_h
+        {
+          verify_expiration: verify_expiration,
+          verify_not_before: verify_not_before,
+          verify_iss: verify_iss,
+          verify_iat: verify_iat,
+          verify_jti: verify_jti,
+          verify_aud: verify_aud,
+          verify_sub: verify_sub,
+          leeway: leeway,
+          algorithms: algorithms,
+          required_claims: required_claims
+        }
+      end
+    end
+  end
+end

data/vendor/bundle/ruby/4.0.0/gems/jwt-2.10.2/lib/jwt/configuration/jwk_configuration.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require_relative '../jwk/kid_as_key_digest'
+require_relative '../jwk/thumbprint'
+
+module JWT
+  module Configuration
+    # @api private
+    class JwkConfiguration
+      def initialize
+        self.kid_generator_type = :key_digest
+      end
+
+      def kid_generator_type=(value)
+        self.kid_generator = case value
+                             when :key_digest
+                               JWT::JWK::KidAsKeyDigest
+                             when :rfc7638_thumbprint
+                               JWT::JWK::Thumbprint
+                             else
+                               raise ArgumentError, "#{value} is not a valid kid generator type."
+                             end
+      end
+
+      attr_accessor :kid_generator
+    end
+  end
+end

data/vendor/bundle/ruby/4.0.0/gems/jwt-2.10.2/lib/jwt/configuration.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require_relative 'configuration/container'
+
+module JWT
+  # The Configuration module provides methods to configure JWT settings.
+  module Configuration
+    # Configures the JWT settings.
+    #
+    # @yield [config] Gives the current configuration to the block.
+    # @yieldparam config [JWT::Configuration::Container] the configuration container.
+    def configure
+      yield(configuration)
+    end
+
+    # Returns the JWT configuration container.
+    #
+    # @return [JWT::Configuration::Container] the configuration container.
+    def configuration
+      @configuration ||= ::JWT::Configuration::Container.new
+    end
+  end
+end

data/vendor/bundle/ruby/4.0.0/gems/jwt-2.10.2/lib/jwt/decode.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'jwt/x5c_key_finder'
+
+module JWT
+  # The Decode class is responsible for decoding and verifying JWT tokens.
+  class Decode
+    # Initializes a new Decode instance.
+    #
+    # @param jwt [String] the JWT to decode.
+    # @param key [String, Array<String>] the key(s) to use for verification.
+    # @param verify [Boolean] whether to verify the token's signature.
+    # @param options [Hash] additional options for decoding and verification.
+    # @param keyfinder [Proc] an optional key finder block to dynamically find the key for verification.
+    # @raise [JWT::DecodeError] if decoding or verification fails.
+    def initialize(jwt, key, verify, options, &keyfinder)
+      raise JWT::DecodeError, 'Nil JSON web token' unless jwt
+
+      @token = EncodedToken.new(jwt)
+      @key = key
+      @options = options
+      @verify = verify
+      @keyfinder = keyfinder
+    end
+
+    # Decodes the JWT token and verifies its segments if verification is enabled.
+    #
+    # @return [Array<Hash>] an array containing the decoded payload and header.
+    def decode_segments
+      validate_segment_count!
+      if @verify
+        verify_algo
+        set_key
+        verify_signature
+        Claims::DecodeVerifier.verify!(token.payload, @options)
+      end
+
+      [token.payload, token.header]
+    end
+
+    private
+
+    attr_reader :token
+
+    def verify_signature
+      return if none_algorithm?
+
+      raise JWT::DecodeError, 'No verification key available' unless @key
+
+      token.verify_signature!(algorithm: allowed_and_valid_algorithms, key: @key)
+    end
+
+    def verify_algo
+      raise JWT::IncorrectAlgorithm, 'An algorithm must be specified' if allowed_algorithms.empty?
+      raise JWT::DecodeError, 'Token header not a JSON object' unless token.header.is_a?(Hash)
+      raise JWT::IncorrectAlgorithm, 'Token is missing alg header' unless alg_in_header
+      raise JWT::IncorrectAlgorithm, 'Expected a different algorithm' if allowed_and_valid_algorithms.empty?
+    end
+
+    def set_key
+      @key = find_key(&@keyfinder) if @keyfinder
+      @key = ::JWT::JWK::KeyFinder.new(jwks: @options[:jwks], allow_nil_kid: @options[:allow_nil_kid]).key_for(token.header['kid']) if @options[:jwks]
+      return unless (x5c_options = @options[:x5c])
+
+      @key = X5cKeyFinder.new(x5c_options[:root_certificates], x5c_options[:crls]).from(token.header['x5c'])
+    end
+
+    def allowed_and_valid_algorithms
+      @allowed_and_valid_algorithms ||= allowed_algorithms.select { |alg| alg.valid_alg?(alg_in_header) }
+    end
+
+    # Order is very important - first check for string keys, next for symbols
+    ALGORITHM_KEYS = ['algorithm',
+                      :algorithm,
+                      'algorithms',
+                      :algorithms].freeze
+
+    def given_algorithms
+      ALGORITHM_KEYS.each do |alg_key|
+        alg = @options[alg_key]
+        return Array(alg) if alg
+      end
+      []
+    end
+
+    def allowed_algorithms
+      @allowed_algorithms ||= resolve_allowed_algorithms
+    end
+
+    def resolve_allowed_algorithms
+      given_algorithms.map { |alg| JWA.resolve(alg) }
+    end
+
+    def find_key(&keyfinder)
+      key = (keyfinder.arity == 2 ? yield(token.header, token.payload) : yield(token.header))
+      # key can be of type [string, nil, OpenSSL::PKey, Array]
+      return key if key && !Array(key).empty?
+
+      raise JWT::DecodeError, 'No verification key available'
+    end
+
+    def validate_segment_count!
+      segment_count = token.jwt.count('.') + 1
+      return if segment_count == 3
+      return if !@verify && segment_count == 2 # If no verifying required, the signature is not needed
+      return if segment_count == 2 && none_algorithm?
+
+      raise JWT::DecodeError, 'Not enough or too many segments'
+    end
+
+    def none_algorithm?
+      alg_in_header == 'none'
+    end
+
+    def alg_in_header
+      token.header['alg']
+    end
+  end
+end

data/vendor/bundle/ruby/4.0.0/gems/jwt-2.10.2/lib/jwt/deprecations.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module JWT
+  # Deprecations module to handle deprecation warnings in the gem
+  # @api private
+  module Deprecations
+    class << self
+      def context
+        yield.tap { emit_warnings }
+      ensure
+        Thread.current[:jwt_warning_store] = nil
+      end
+
+      def warning(message, only_if_valid: false)
+        method_name = only_if_valid ? :store : :warn
+        case JWT.configuration.deprecation_warnings
+        when :once
+          return if record_warned(message)
+        when :warn
+          # noop
+        else
+          return
+        end
+
+        send(method_name, "[DEPRECATION WARNING] #{message}")
+      end
+
+      def store(message)
+        (Thread.current[:jwt_warning_store] ||= []) << message
+      end
+
+      def emit_warnings
+        return if Thread.current[:jwt_warning_store].nil?
+
+        Thread.current[:jwt_warning_store].each { |warning| warn(warning) }
+      end
+
+      private
+
+      def record_warned(message)
+        @warned ||= []
+        return true if @warned.include?(message)
+
+        @warned << message
+        false
+      end
+    end
+  end
+end

data/vendor/bundle/ruby/4.0.0/gems/jwt-2.10.2/lib/jwt/encode.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require_relative 'jwa'
+
+module JWT
+  # The Encode class is responsible for encoding JWT tokens.
+  class Encode
+    # Initializes a new Encode instance.
+    #
+    # @param options [Hash] the options for encoding the JWT token.
+    # @option options [Hash] :payload the payload of the JWT token.
+    # @option options [Hash] :headers the headers of the JWT token.
+    # @option options [String] :key the key used to sign the JWT token.
+    # @option options [String] :algorithm the algorithm used to sign the JWT token.
+    def initialize(options)
+      @token     = Token.new(payload: options[:payload], header: options[:headers])
+      @key       = options[:key]
+      @algorithm = options[:algorithm]
+    end
+
+    # Encodes the JWT token and returns its segments.
+    #
+    # @return [String] the encoded JWT token.
+    def segments
+      @token.verify_claims!(:numeric)
+      @token.sign!(algorithm: @algorithm, key: @key)
+      @token.jwt
+    end
+  end
+end

data/vendor/bundle/ruby/4.0.0/gems/jwt-2.10.2/lib/jwt/encoded_token.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+
+module JWT
+  # Represents an encoded JWT token
+  #
+  # Processing an encoded and signed token:
+  #
+  #   token = JWT::Token.new(payload: {pay: 'load'})
+  #   token.sign!(algorithm: 'HS256', key: 'secret')
+  #
+  #   encoded_token = JWT::EncodedToken.new(token.jwt)
+  #   encoded_token.verify_signature!(algorithm: 'HS256', key: 'secret')
+  #   encoded_token.payload # => {'pay' => 'load'}
+  class EncodedToken
+    include Claims::VerificationMethods
+
+    # Returns the original token provided to the class.
+    # @return [String] The JWT token.
+    attr_reader :jwt
+
+    # Initializes a new EncodedToken instance.
+    #
+    # @param jwt [String] the encoded JWT token.
+    # @raise [ArgumentError] if the provided JWT is not a String.
+    def initialize(jwt)
+      raise ArgumentError, 'Provided JWT must be a String' unless jwt.is_a?(String)
+
+      @jwt = jwt
+      @encoded_header, @encoded_payload, @encoded_signature = jwt.split('.')
+    end
+
+    # Returns the decoded signature of the JWT token.
+    #
+    # @return [String] the decoded signature.
+    def signature
+      @signature ||= ::JWT::Base64.url_decode(encoded_signature || '')
+    end
+
+    # Returns the encoded signature of the JWT token.
+    #
+    # @return [String] the encoded signature.
+    attr_reader :encoded_signature
+
+    # Returns the decoded header of the JWT token.
+    #
+    # @return [Hash] the header.
+    def header
+      @header ||= parse_and_decode(@encoded_header)
+    end
+
+    # Returns the encoded header of the JWT token.
+    #
+    # @return [String] the encoded header.
+    attr_reader :encoded_header
+
+    # Returns the payload of the JWT token.
+    #
+    # @return [Hash] the payload.
+    def payload
+      @payload ||= decode_payload
+    end
+
+    # Sets or returns the encoded payload of the JWT token.
+    #
+    # @return [String] the encoded payload.
+    attr_accessor :encoded_payload
+
+    # Returns the signing input of the JWT token.
+    #
+    # @return [String] the signing input.
+    def signing_input
+      [encoded_header, encoded_payload].join('.')
+    end
+
+    # Verifies the signature of the JWT token.
+    #
+    # @param algorithm [String, Array<String>, Object, Array<Object>] the algorithm(s) to use for verification.
+    # @param key [String, Array<String>] the key(s) to use for verification.
+    # @param key_finder [#call] an object responding to `call` to find the key for verification.
+    # @return [nil]
+    # @raise [JWT::VerificationError] if the signature verification fails.
+    # @raise [ArgumentError] if neither key nor key_finder is provided, or if both are provided.
+    def verify_signature!(algorithm:, key: nil, key_finder: nil)
+      raise ArgumentError, 'Provide either key or key_finder, not both or neither' if key.nil? == key_finder.nil?
+
+      key ||= key_finder.call(self)
+
+      return if valid_signature?(algorithm: algorithm, key: key)
+
+      raise JWT::VerificationError, 'Signature verification failed'
+    end
+
+    # Checks if the signature of the JWT token is valid.
+    #
+    # @param algorithm [String, Array<String>, Object, Array<Object>] the algorithm(s) to use for verification.
+    # @param key [String, Array<String>] the key(s) to use for verification.
+    # @return [Boolean] true if the signature is valid, false otherwise.
+    def valid_signature?(algorithm:, key:)
+      Array(JWA.resolve_and_sort(algorithms: algorithm, preferred_algorithm: header['alg'])).any? do |algo|
+        Array(key).any? do |one_key|
+          algo.verify(data: signing_input, signature: signature, verification_key: one_key)
+        end
+      end
+    end
+
+    alias to_s jwt
+
+    private
+
+    def decode_payload
+      raise JWT::DecodeError, 'Encoded payload is empty' if encoded_payload == ''
+
+      if unencoded_payload?
+        verify_claims!(crit: ['b64'])
+        return parse_unencoded(encoded_payload)
+      end
+
+      parse_and_decode(encoded_payload)
+    end
+
+    def unencoded_payload?
+      header['b64'] == false
+    end
+
+    def parse_and_decode(segment)
+      parse(::JWT::Base64.url_decode(segment || ''))
+    end
+
+    def parse_unencoded(segment)
+      parse(segment)
+    end
+
+    def parse(segment)
+      JWT::JSON.parse(segment)
+    rescue ::JSON::ParserError
+      raise JWT::DecodeError, 'Invalid segment encoding'
+    end
+  end
+end

data/vendor/bundle/ruby/4.0.0/gems/jwt-2.10.2/lib/jwt/error.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module JWT
+  # The EncodeError class is raised when there is an error encoding a JWT.
+  class EncodeError < StandardError; end
+
+  # The DecodeError class is raised when there is an error decoding a JWT.
+  class DecodeError < StandardError; end
+
+  # The RequiredDependencyError class is raised when a required dependency is missing.
+  class RequiredDependencyError < StandardError; end
+
+  # The VerificationError class is raised when there is an error verifying a JWT.
+  class VerificationError < DecodeError; end
+
+  # The ExpiredSignature class is raised when the JWT signature has expired.
+  class ExpiredSignature < DecodeError; end
+
+  # The IncorrectAlgorithm class is raised when the JWT algorithm is incorrect.
+  class IncorrectAlgorithm < DecodeError; end
+
+  # The ImmatureSignature class is raised when the JWT signature is immature.
+  class ImmatureSignature < DecodeError; end
+
+  # The InvalidIssuerError class is raised when the JWT issuer is invalid.
+  class InvalidIssuerError < DecodeError; end
+
+  # The UnsupportedEcdsaCurve class is raised when the ECDSA curve is unsupported.
+  class UnsupportedEcdsaCurve < IncorrectAlgorithm; end
+
+  # The InvalidIatError class is raised when the JWT issued at (iat) claim is invalid.
+  class InvalidIatError < DecodeError; end
+
+  # The InvalidAudError class is raised when the JWT audience (aud) claim is invalid.
+  class InvalidAudError < DecodeError; end
+
+  # The InvalidSubError class is raised when the JWT subject (sub) claim is invalid.
+  class InvalidSubError < DecodeError; end
+
+  # The InvalidCritError class is raised when the JWT crit header is invalid.
+  class InvalidCritError < DecodeError; end
+
+  # The InvalidJtiError class is raised when the JWT ID (jti) claim is invalid.
+  class InvalidJtiError < DecodeError; end
+
+  # The InvalidPayload class is raised when the JWT payload is invalid.
+  class InvalidPayload < DecodeError; end
+
+  # The MissingRequiredClaim class is raised when a required claim is missing from the JWT.
+  class MissingRequiredClaim < DecodeError; end
+
+  # The Base64DecodeError class is raised when there is an error decoding a Base64-encoded string.
+  class Base64DecodeError < DecodeError; end
+
+  # The JWKError class is raised when there is an error with the JSON Web Key (JWK).
+  class JWKError < DecodeError; end
+end

data/vendor/bundle/ruby/4.0.0/gems/jwt-2.10.2/lib/jwt/json.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require 'json'
+
+module JWT
+  # @api private
+  class JSON
+    class << self
+      def generate(data)
+        ::JSON.generate(data)
+      end
+
+      def parse(data)
+        ::JSON.parse(data)
+      end
+    end
+  end
+end

data/vendor/bundle/ruby/4.0.0/gems/jwt-2.10.2/lib/jwt/jwa/compat.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module JWT
+  module JWA
+    # Provides backwards compatibility for algorithms
+    # @api private
+    module Compat
+      # @api private
+      module ClassMethods
+        def from_algorithm(algorithm)
+          new(algorithm)
+        end
+
+        def sign(algorithm, msg, key)
+          Deprecations.warning('Support for calling sign with positional arguments will be removed in future ruby-jwt versions')
+
+          from_algorithm(algorithm).sign(data: msg, signing_key: key)
+        end
+
+        def verify(algorithm, key, signing_input, signature)
+          Deprecations.warning('Support for calling verify with positional arguments will be removed in future ruby-jwt versions')
+
+          from_algorithm(algorithm).verify(data: signing_input, signature: signature, verification_key: key)
+        end
+      end
+
+      def self.included(klass)
+        klass.extend(ClassMethods)
+      end
+    end
+  end
+end

data/vendor/bundle/ruby/4.0.0/gems/jwt-2.10.2/lib/jwt/jwa/ecdsa.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+module JWT
+  module JWA
+    # ECDSA signing algorithm
+    class Ecdsa
+      include JWT::JWA::SigningAlgorithm
+
+      def initialize(alg, digest)
+        @alg = alg
+        @digest = digest
+      end
+
+      def sign(data:, signing_key:)
+        curve_definition = curve_by_name(signing_key.group.curve_name)
+        key_algorithm = curve_definition[:algorithm]
+        raise IncorrectAlgorithm, "payload algorithm is #{alg} but #{key_algorithm} signing key was provided" if alg != key_algorithm
+
+        asn1_to_raw(signing_key.dsa_sign_asn1(OpenSSL::Digest.new(digest).digest(data)), signing_key)
+      end
+
+      def verify(data:, signature:, verification_key:)
+        curve_definition = curve_by_name(verification_key.group.curve_name)
+        key_algorithm = curve_definition[:algorithm]
+        raise IncorrectAlgorithm, "payload algorithm is #{alg} but #{key_algorithm} verification key was provided" if alg != key_algorithm
+
+        verification_key.dsa_verify_asn1(OpenSSL::Digest.new(digest).digest(data), raw_to_asn1(signature, verification_key))
+      rescue OpenSSL::PKey::PKeyError
+        raise JWT::VerificationError, 'Signature verification raised'
+      end
+
+      NAMED_CURVES = {
+        'prime256v1' => {
+          algorithm: 'ES256',
+          digest: 'sha256'
+        },
+        'secp256r1' => { # alias for prime256v1
+          algorithm: 'ES256',
+          digest: 'sha256'
+        },
+        'secp384r1' => {
+          algorithm: 'ES384',
+          digest: 'sha384'
+        },
+        'secp521r1' => {
+          algorithm: 'ES512',
+          digest: 'sha512'
+        },
+        'secp256k1' => {
+          algorithm: 'ES256K',
+          digest: 'sha256'
+        }
+      }.freeze
+
+      NAMED_CURVES.each_value do |v|
+        register_algorithm(new(v[:algorithm], v[:digest]))
+      end
+
+      def self.from_algorithm(algorithm)
+        new(algorithm, algorithm.downcase.gsub('es', 'sha'))
+      end
+
+      def self.curve_by_name(name)
+        NAMED_CURVES.fetch(name) do
+          raise UnsupportedEcdsaCurve, "The ECDSA curve '#{name}' is not supported"
+        end
+      end
+
+      private
+
+      attr_reader :digest
+
+      def curve_by_name(name)
+        self.class.curve_by_name(name)
+      end
+
+      def raw_to_asn1(signature, private_key)
+        byte_size = (private_key.group.degree + 7) / 8
+        sig_bytes = signature[0..(byte_size - 1)]
+        sig_char = signature[byte_size..-1] || ''
+        OpenSSL::ASN1::Sequence.new([sig_bytes, sig_char].map { |int| OpenSSL::ASN1::Integer.new(OpenSSL::BN.new(int, 2)) }).to_der
+      end
+
+      def asn1_to_raw(signature, public_key)
+        byte_size = (public_key.group.degree + 7) / 8
+        OpenSSL::ASN1.decode(signature).value.map { |value| value.value.to_s(2).rjust(byte_size, "\x00") }.join
+      end
+    end
+  end
+end