rack-firebase 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 3dcb76b9dd459436772a9058c79c1fda81de49e4b1ce0c76e74e6611a96718d3
+  data.tar.gz: 9e15447178511fe28a6e367ae2a1ce97fd7c4664d416cca36a507b90055a3e6c
+SHA512:
+  metadata.gz: 9786153f3cc1e21470bf30df88b1cb06c54dbf4f5f3f1e12d738dee189e373da35b2a98e3f8e03ca558cbd33735a7e828f25cdaf529f87c874991b94d6702d97
+  data.tar.gz: 910c6ab79bf38b4634278f5710ba42de25a9f81bba5bd3a8590bfcd8671a6a3e30b157ea5e9db974245c87119e774799132034a5c4a14c289a7564fafc0e5dff

data/LICENSE

@@ -0,0 +1,7 @@
+Copyright (c) 2022 Laura Mosher
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,81 @@
+# Rack Firebase Middleware
+
+[![Contributor Covenant](https://img.shields.io/badge/Contributor%20Covenant-2.1-4baaaa.svg)](code_of_conduct.md)
+
+
+A rack middleware for verifying ID tokens from Google's Firebase. It provides token decoding and verification using [Firebase's 3rd Party Verification constraints](https://firebase.google.com/docs/auth/admin/verify-id-tokens?hl=en&authuser=3#verify_id_tokens_using_a_third-party_jwt_library).
+
+## Installation
+
+Add the gem to your Gemfile:
+
+```ruby
+gem "rack-firebase"
+```
+
+And execute
+
+    $ bundle
+
+Or, install it yourself:
+
+    $ gem install rack-firebase
+
+## Configuration
+
+Configure your Firebase Project ID(s):
+
+```ruby
+Rack::Firebase.configure do |config|
+  config.project_ids = ["your-project-id"]
+end
+```
+
+Add the middleware to your rack application:
+
+```ruby
+use Rack::Firebase::Middleware
+```
+
+Now, all incoming requests will require a verified Firebase token.
+
+## Usage
+
+While just adding the middleware to your app will *block* requests without a verified token, your app will still need to handle the connection between the token and the subject in your application.
+
+In order to facilitate this, the Subject claim (Device or User UID) is added to the request env before yielding to your app layer.
+
+For example, assuming your User's model has a `uid` attribute for storing Firebase UID's:
+
+```ruby
+def current_user
+  return @current_user if defined? @current_user
+
+  uid = request.env[Rack::Firebase::Middleware::USER_UID]
+  if uid
+    @current_user = User.find_by(uid: uid)
+  end
+end
+
+def user_signed_in?
+  current_user.present?
+end
+
+def authenticate_user!
+  unless user_signed_in?
+    # deny access and abort request from application layer.
+  end
+end
+```
+
+From here, you can invoke `authenticate_user!` to ensure the token subject is actually a user in your application and use `current_user` to scope your requests or handle more granular authorization.
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub.
+
+This project is intended to be a safe, welcoming space for collaboration. All contributors are expected to adhere to the [Contributor Covenant](https://www.contributor-covenant.org) Code of Conduct.
+
+## License
+
+This gem is available as open source under the terms of the [MIT License](LICENSE).

data/lib/rack/firebase/authorization_header.rb

@@ -0,0 +1,15 @@
+module Rack
+  module Firebase
+    class AuthorizationHeader
+      METHOD = "Bearer"
+      AUTH_HEADER_ENV = "HTTP_AUTHORIZATION"
+
+      def self.read_token(env)
+        return unless (auth = env[AUTH_HEADER_ENV])
+
+        method, token = auth.split
+        return token if method == METHOD
+      end
+    end
+  end
+end

data/lib/rack/firebase/configuration.rb

@@ -0,0 +1,15 @@
+module Rack
+  module Firebase
+    class Configuration
+      attr_accessor :project_ids
+
+      def initialize
+        reset!
+      end
+
+      def reset!
+        @project_ids = []
+      end
+    end
+  end
+end

data/lib/rack/firebase/error.rb

@@ -0,0 +1,6 @@
+module Rack
+  module Firebase
+    class InvalidSubError < StandardError; end
+    class InvalidAuthTimeError < StandardError; end
+  end
+end

data/lib/rack/firebase/middleware.rb

@@ -0,0 +1,95 @@
+require "jwt"
+require "net/http"
+
+module Rack
+  module Firebase
+    class Middleware
+      ALG = "RS256".freeze
+      CERTIFICATE_URL = "https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com".freeze
+      USER_UID = "firebase.user.uid"
+
+      def initialize(app)
+        @app = app
+
+        @config = ::Rack::Firebase.configuration
+
+        @jwt_loader = FIREBASE_KEY_LOADER
+        @error_responder = DEFAULT_ERROR_RESPONDER
+      end
+
+      def call(env)
+        token = AuthorizationHeader.read_token(env)
+        decoded_token, _ = JWT.decode(
+          token, nil, true,
+          {
+            jwks: jwt_loader,
+            algorithm: ALG,
+            verify_iat: true,
+            verify_aud: true, aud: config.project_ids,
+            verify_iss: true, iss: firebase_issuers
+          }
+        )
+
+        raise Rack::Firebase::InvalidSubError.new("Invalid subject") if decoded_token["sub"].nil? || decoded_token["sub"] == ""
+        raise Rack::Firebase::InvalidAuthTimeError.new("Invalid auth time") unless decoded_token["auth_time"] <= Time.now.to_i
+
+        env[USER_UID] = decoded_token["sub"]
+        @app.call(env)
+      rescue JWT::JWKError => error # Issues with fetched JWKs
+        error_responder.call(error, "unauthorized")
+      rescue JWT::ExpiredSignature => error # Token has expired
+        error_responder.call(error, "expired")
+      rescue JWT::InvalidIatError => error # invalid issued at claim (iat)
+        error_responder.call(error, "unauthorized")
+      rescue JWT::InvalidIssuerError => error # invalid issuer
+        error_responder.call(error, "unauthorized")
+      rescue JWT::InvalidAudError => error # invalid audience
+        error_responder.call(error, "unauthorized")
+      rescue JWT::DecodeError => error # General JWT error
+        error_responder.call(error, "unauthorized")
+      rescue Rack::Firebase::InvalidSubError => error # subject is empty or missing
+        error_responder.call(error, "unauthorized")
+      rescue Rack::Firebase::InvalidAuthTimeError => error # auth time is in the future
+        error_responder.call(error, "unauthorized")
+      end
+
+      private
+
+      attr_reader :config, :error_responder, :jwt_loader
+
+      DEFAULT_ERROR_RESPONDER = lambda do |error, reason|
+        error_detail = {
+          error: error.message,
+          message: reason
+        }.to_json
+        [401, {"content-type" => "application/json"}, [error_detail]]
+      end
+
+      FIREBASE_KEY_LOADER = lambda do |options|
+        if options[:kid_not_found] || (@refresh_cache_by.to_i < Time.now.to_i + 3600)
+          @cached_keys = nil
+        end
+
+        @cached_keys ||= begin
+          response = ::Net::HTTP.get_response(URI(CERTIFICATE_URL))
+          cache_control = response["Cache-Control"]
+
+          expires_in = cache_control.match(/max-age=([0-9]+)/).captures.first.to_i
+          @refresh_cache_by = Time.now.to_i + expires_in
+
+          json = JSON.parse(response.body)
+          json.map do |kid, cert_string|
+            key = OpenSSL::X509::Certificate.new(cert_string).public_key
+            JWT::JWK::RSA.new(key, kid: kid)
+          end
+        end
+      end
+
+      def firebase_issuers
+        config.project_ids.map { |project_id|
+          "https://securetoken.google.com/#{project_id}"
+        }
+      end
+    end
+  end
+end

data/lib/rack/firebase/version.rb

@@ -0,0 +1,5 @@
+module Rack
+  module Firebase
+    VERSION = "0.1.0"
+  end
+end

data/lib/rack/firebase.rb

@@ -0,0 +1,21 @@
+require "rack/firebase/configuration"
+require "rack/firebase/version"
+
+module Rack
+  module Firebase
+    class << self
+      attr_writer :configuration
+    end
+
+    def self.configuration
+      @configuration ||= Configuration.new
+    end
+
+    def self.configure
+      yield configuration
+    end
+  end
+end
+require "rack/firebase/error"
+require "rack/firebase/authorization_header"
+require "rack/firebase/middleware"

metadata

@@ -0,0 +1,148 @@
+--- !ruby/object:Gem::Specification
+name: rack-firebase
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Laura Mosher
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2022-12-31 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.6'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.6'
+- !ruby/object:Gem::Dependency
+  name: openssl
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.14'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.14'
+- !ruby/object:Gem::Dependency
+  name: rack-test
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.0.2
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.0.2
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.22.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.22.0
+- !ruby/object:Gem::Dependency
+  name: standard
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.9.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.9.0
+description: A simple, lightweight Rack middleware to verify Firebase tokens.
+email: laura@mosher.tech
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- lib/rack/firebase.rb
+- lib/rack/firebase/authorization_header.rb
+- lib/rack/firebase/configuration.rb
+- lib/rack/firebase/error.rb
+- lib/rack/firebase/middleware.rb
+- lib/rack/firebase/version.rb
+homepage: https://github.com/lauramosher/rack-firebase
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.1.2
+signing_key: 
+specification_version: 4
+summary: Verify Firebase ID Tokens in Middleware
+test_files: []