rack-prx_auth 0.2.1 → 0.3.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.gitignore +1 -0
- data/Gemfile +0 -3
- data/lib/rack/prx_auth/token_data.rb +23 -2
- data/lib/rack/prx_auth/version.rb +1 -1
- data/rack-prx_auth.gemspec +2 -0
- data/test/rack/prx_auth/token_data_test.rb +59 -5
- metadata +31 -4
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: b87251008aee29e6d86aae5fbec89cbd77b08479a57bfe69a78b7ca8b765d75b
|
4
|
+
data.tar.gz: fb463afd9ea824de3c6bb7b0cb1115a5783c422d3c3edaf53583bd670ba72f54
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: d2688d966852da50ed3d9045b187790b106ddf7996f4964544c50128baeb1fa407871abcf90d094387c5e08e12fd27215145468462e65d9491e1bfb8c4ceec3b
|
7
|
+
data.tar.gz: b110467850548ec5f5e0b31951f782d0b303b1fa41c10f58b29cc9930894c22bb1aede5e419c7ec1d52fbd8ae022cf5385de8f2e0c454052dabcc7f667c83098
|
data/.gitignore
CHANGED
data/Gemfile
CHANGED
@@ -1,6 +1,8 @@
|
|
1
1
|
module Rack
|
2
2
|
class PrxAuth
|
3
3
|
class TokenData
|
4
|
+
WILDCARD_RESOURCE_NAME = '*'
|
5
|
+
|
4
6
|
attr_reader :attributes, :authorized_resources, :scopes
|
5
7
|
|
6
8
|
def initialize(attrs = {})
|
@@ -22,13 +24,29 @@ module Rack
|
|
22
24
|
end
|
23
25
|
|
24
26
|
def authorized?(resource, scope=nil)
|
25
|
-
if
|
26
|
-
|
27
|
+
if resource == WILDCARD_RESOURCE_NAME
|
28
|
+
globally_authorized?(scope)
|
29
|
+
elsif scope.nil?
|
30
|
+
authorized_for_resource?(resource, scope)
|
31
|
+
else
|
32
|
+
authorized_for_resource?(resource, scope) || globally_authorized?(scope)
|
27
33
|
end
|
28
34
|
end
|
29
35
|
|
36
|
+
def globally_authorized?(scope)
|
37
|
+
raise ArgumentError if scope.nil?
|
38
|
+
|
39
|
+
authorized_for_resource?(WILDCARD_RESOURCE_NAME, scope)
|
40
|
+
end
|
41
|
+
|
30
42
|
private
|
31
43
|
|
44
|
+
def authorized_for_resource?(resource, scope=nil)
|
45
|
+
if auth = authorized_resources[resource.to_s]
|
46
|
+
scope.nil? || (scopes + auth.split(' ')).include?(scope.to_s)
|
47
|
+
end
|
48
|
+
end
|
49
|
+
|
32
50
|
def unpack_aur(aur)
|
33
51
|
aur.clone.tap do |result|
|
34
52
|
unless result['$'].nil?
|
@@ -38,6 +56,9 @@ module Rack
|
|
38
56
|
end
|
39
57
|
end
|
40
58
|
end
|
59
|
+
if result[WILDCARD_RESOURCE_NAME].nil? && result['0']
|
60
|
+
result[WILDCARD_RESOURCE_NAME] = result.delete('0')
|
61
|
+
end
|
41
62
|
end
|
42
63
|
end
|
43
64
|
end
|
data/rack-prx_auth.gemspec
CHANGED
@@ -23,6 +23,8 @@ Gem::Specification.new do |spec|
|
|
23
23
|
spec.add_development_dependency 'bundler', '~> 2.0'
|
24
24
|
spec.add_development_dependency 'rake', '~> 10.0'
|
25
25
|
spec.add_development_dependency 'coveralls', '~> 0'
|
26
|
+
spec.add_development_dependency 'guard'
|
27
|
+
spec.add_development_dependency 'guard-minitest'
|
26
28
|
|
27
29
|
spec.add_dependency 'rack', '>= 1.5.2'
|
28
30
|
spec.add_dependency 'json', '>= 1.8.1'
|
@@ -3,12 +3,12 @@ require 'test_helper'
|
|
3
3
|
describe Rack::PrxAuth::TokenData do
|
4
4
|
it 'pulls user_id from sub' do
|
5
5
|
token = Rack::PrxAuth::TokenData.new('sub' => 123)
|
6
|
-
token.user_id
|
6
|
+
assert token.user_id == 123
|
7
7
|
end
|
8
8
|
|
9
9
|
it 'pulls authorized_resources from aur' do
|
10
10
|
token = Rack::PrxAuth::TokenData.new('aur' => {'123' => 'admin'})
|
11
|
-
token.authorized_resources['123']
|
11
|
+
assert token.authorized_resources['123'] == 'admin'
|
12
12
|
end
|
13
13
|
|
14
14
|
it 'unpacks compressed aur into authorized_resources' do
|
@@ -18,9 +18,9 @@ describe Rack::PrxAuth::TokenData do
|
|
18
18
|
'admin' => [456, 789, 1011]
|
19
19
|
}
|
20
20
|
})
|
21
|
-
token.authorized_resources['$'].
|
22
|
-
token.authorized_resources['789']
|
23
|
-
token.authorized_resources['123']
|
21
|
+
assert token.authorized_resources['$'].nil?
|
22
|
+
assert token.authorized_resources['789'] == 'admin'
|
23
|
+
assert token.authorized_resources['123'] == 'member'
|
24
24
|
end
|
25
25
|
|
26
26
|
describe '#authorized?' do
|
@@ -48,5 +48,59 @@ describe Rack::PrxAuth::TokenData do
|
|
48
48
|
assert !token.authorized?(789)
|
49
49
|
end
|
50
50
|
|
51
|
+
describe 'with wildcard role' do
|
52
|
+
let(:aur) { {'*' => 'peek', '123' => 'admin', '456' => 'member' } }
|
53
|
+
|
54
|
+
it 'applies wildcard tokens to queries with no matching aur' do
|
55
|
+
assert token.authorized?(789, :peek)
|
56
|
+
end
|
57
|
+
|
58
|
+
it 'does not authorize unscoped for wildcard resources' do
|
59
|
+
assert !token.authorized?(789)
|
60
|
+
end
|
61
|
+
|
62
|
+
it 'allows querying by wildcard resource directly' do
|
63
|
+
assert token.authorized?('*', :peek)
|
64
|
+
assert !token.authorized?('*', :admin)
|
65
|
+
end
|
66
|
+
|
67
|
+
it 'has a shorthand `gobally_authorized?` to query wildcard' do
|
68
|
+
assert token.globally_authorized?(:peek)
|
69
|
+
assert !token.globally_authorized?(:admin)
|
70
|
+
end
|
71
|
+
|
72
|
+
it 'treats global authorizations as additive to other explicit ones' do
|
73
|
+
assert token.authorized?(123, :peek)
|
74
|
+
end
|
75
|
+
|
76
|
+
it 'refuses to run `globally_authorized?` with no scope' do
|
77
|
+
assert_raises ArgumentError do
|
78
|
+
token.globally_authorized?
|
79
|
+
end
|
80
|
+
assert_raises ArgumentError do
|
81
|
+
token.authorized?('*')
|
82
|
+
end
|
83
|
+
end
|
84
|
+
end
|
85
|
+
|
86
|
+
describe 'wildcard fallback handling' do
|
87
|
+
|
88
|
+
describe 'with no primary wildcard present' do
|
89
|
+
let(:aur) { {'0' => 'peek', '123' => 'admin', '456' => 'member' } }
|
90
|
+
|
91
|
+
it 'applies fallback as a wildcard' do
|
92
|
+
assert token.authorized?(789, :peek)
|
93
|
+
end
|
94
|
+
end
|
95
|
+
|
96
|
+
describe 'with primary wildcard present' do
|
97
|
+
let(:aur) { {'*' => 'cook', '0' => 'peek', '123' => 'admin', '456' => 'member' } }
|
98
|
+
|
99
|
+
it 'does not apply the fallback as a wildcard' do
|
100
|
+
assert token.authorized?(789, :cook)
|
101
|
+
assert !token.authorized?(789, :peek)
|
102
|
+
end
|
103
|
+
end
|
104
|
+
end
|
51
105
|
end
|
52
106
|
end
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: rack-prx_auth
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.
|
4
|
+
version: 0.3.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Eve Asher
|
@@ -9,7 +9,7 @@ authors:
|
|
9
9
|
autorequire:
|
10
10
|
bindir: bin
|
11
11
|
cert_chain: []
|
12
|
-
date:
|
12
|
+
date: 2020-03-30 00:00:00.000000000 Z
|
13
13
|
dependencies:
|
14
14
|
- !ruby/object:Gem::Dependency
|
15
15
|
name: bundler
|
@@ -53,6 +53,34 @@ dependencies:
|
|
53
53
|
- - "~>"
|
54
54
|
- !ruby/object:Gem::Version
|
55
55
|
version: '0'
|
56
|
+
- !ruby/object:Gem::Dependency
|
57
|
+
name: guard
|
58
|
+
requirement: !ruby/object:Gem::Requirement
|
59
|
+
requirements:
|
60
|
+
- - ">="
|
61
|
+
- !ruby/object:Gem::Version
|
62
|
+
version: '0'
|
63
|
+
type: :development
|
64
|
+
prerelease: false
|
65
|
+
version_requirements: !ruby/object:Gem::Requirement
|
66
|
+
requirements:
|
67
|
+
- - ">="
|
68
|
+
- !ruby/object:Gem::Version
|
69
|
+
version: '0'
|
70
|
+
- !ruby/object:Gem::Dependency
|
71
|
+
name: guard-minitest
|
72
|
+
requirement: !ruby/object:Gem::Requirement
|
73
|
+
requirements:
|
74
|
+
- - ">="
|
75
|
+
- !ruby/object:Gem::Version
|
76
|
+
version: '0'
|
77
|
+
type: :development
|
78
|
+
prerelease: false
|
79
|
+
version_requirements: !ruby/object:Gem::Requirement
|
80
|
+
requirements:
|
81
|
+
- - ">="
|
82
|
+
- !ruby/object:Gem::Version
|
83
|
+
version: '0'
|
56
84
|
- !ruby/object:Gem::Dependency
|
57
85
|
name: rack
|
58
86
|
requirement: !ruby/object:Gem::Requirement
|
@@ -139,8 +167,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
139
167
|
- !ruby/object:Gem::Version
|
140
168
|
version: '0'
|
141
169
|
requirements: []
|
142
|
-
|
143
|
-
rubygems_version: 2.7.6.2
|
170
|
+
rubygems_version: 3.0.1
|
144
171
|
signing_key:
|
145
172
|
specification_version: 4
|
146
173
|
summary: Rack middleware that verifies and decodes a JWT token and attaches the token's
|