rails-vault-jwt 0.1.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 410f4ef7c6b7f8ce74ffed0d7d99c5ebe753151b9db6b5db1d218b7ecbbd8c18
-  data.tar.gz: cfc364e819fe4af7c31b905c4bb0b69b197ffe623655e4c6bf7778bdc0811cfe
+  metadata.gz: 56e13dd8dfadee363e4789e1bf500b72ed53702b9144c673cd941cd88810e366
+  data.tar.gz: f56952d5e1190fc34554de88b42404ee0f68d67e61490c599f28be6482c92326
 SHA512:
-  metadata.gz: b55438c67edc9375487e8546254ab3b48da37a183d84a1374123976944b21f94a72904032e88957257bd43f8a8b7ef36996d588acc469010719d3caea1b921cc
-  data.tar.gz: 256f556c85fd42c8640d157063d338c25d886b34a61f7c69e4fb365f51ce9b846e78cd68ff117b948e6c3fcc69398614983eb1eb8d0fc87f0f75b747ef266be5
+  metadata.gz: 27a96436485358397827ff3e0930836ed8a036e6566fa41a81636a711fde677a20678cfa1bcdc5b910229e69cbe6229fc137bae80cd2937d48becd68ece66dda
+  data.tar.gz: cb107da1c5ee885cb09ab6d9ee7f25acb02962c6a73fe064df6cc917e28cece33034942581fec5be5c555c662b7b5665009e305302edb23eb81e9ec5128d7ef3

data/CHANGELOG.md

@@ -6,6 +6,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.1] - 2021-02-07
+### Fixed
+- Calls token to get a new token if needed when calling bearer_token
+
+## [0.2.0] - 2021-02-06
+### Added
+- Add #bearer_token method to use token to acquire a JWT
+
+### Changed
+- Prefix env vars with `VAULT_`
+
+## [0.1.3] - 2021-01-18
+### Added
+- Added `valid_issuers` config item to allow restricting key lookups to specific issuers
+
+## [0.1.2] - 2021-01-18
+### Fixed
+- Fixed issuer key url
+
+## [0.1.1] - 2021-01-18
+### Added
+- Very basic logging around some errors
+
 ## [0.1.0] - 2021-01-17
 ### Added
 - Initial commit

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    rails-vault-jwt (0.1.0)
+    rails-vault-jwt (0.2.1)
       activesupport (~> 6.1)
       jwt (~> 2.2)
       vault (~> 0.15)
@@ -9,36 +9,36 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    actionpack (6.1.0)
-      actionview (= 6.1.0)
-      activesupport (= 6.1.0)
+    actionpack (6.1.1)
+      actionview (= 6.1.1)
+      activesupport (= 6.1.1)
       rack (~> 2.0, >= 2.0.9)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actionview (6.1.0)
-      activesupport (= 6.1.0)
+    actionview (6.1.1)
+      activesupport (= 6.1.1)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activesupport (6.1.0)
+    activesupport (6.1.1)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
       tzinfo (~> 2.0)
       zeitwerk (~> 2.3)
-    ast (2.4.1)
+    ast (2.4.2)
     aws-eventstream (1.1.0)
     aws-sigv4 (1.2.2)
       aws-eventstream (~> 1, >= 1.0.2)
     builder (3.2.4)
-    concurrent-ruby (1.1.7)
+    concurrent-ruby (1.1.8)
     crass (1.0.6)
     diff-lcs (1.4.4)
-    docile (1.3.4)
+    docile (1.3.5)
     erubi (1.10.0)
-    i18n (1.8.7)
+    i18n (1.8.8)
       concurrent-ruby (~> 1.0)
     jwt (2.2.2)
     loofah (2.9.0)
@@ -74,28 +74,28 @@ GEM
     rspec-expectations (3.10.1)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.10.0)
-    rspec-mocks (3.10.1)
+    rspec-mocks (3.10.2)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.10.0)
-    rspec-support (3.10.1)
-    rubocop (1.7.0)
+    rspec-support (3.10.2)
+    rubocop (1.9.1)
       parallel (~> 1.10)
-      parser (>= 2.7.1.5)
+      parser (>= 3.0.0.0)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 1.8, < 3.0)
       rexml
       rubocop-ast (>= 1.2.0, < 2.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 1.4.0, < 2.0)
-    rubocop-ast (1.4.0)
+      unicode-display_width (>= 1.4.0, < 3.0)
+    rubocop-ast (1.4.1)
       parser (>= 2.7.1.5)
     rubocop-rake (0.5.1)
       rubocop
-    rubocop-rspec (2.1.0)
+    rubocop-rspec (2.2.0)
       rubocop (~> 1.0)
       rubocop-ast (>= 1.1.0)
     ruby-progressbar (1.11.0)
-    simplecov (0.21.0)
+    simplecov (0.21.2)
       docile (~> 1.1)
       simplecov-html (~> 0.11)
       simplecov_json_formatter (~> 0.1)
@@ -103,7 +103,7 @@ GEM
     simplecov_json_formatter (0.1.2)
     tzinfo (2.0.4)
       concurrent-ruby (~> 1.0)
-    unicode-display_width (1.7.0)
+    unicode-display_width (2.0.0)
     vault (0.15.0)
       aws-sigv4
     zeitwerk (2.4.2)

data/lib/rails/vault/jwt.rb

@@ -13,7 +13,11 @@ module Rails
     module JWT
       class Error < StandardError; end
 
+      class InvalidIssuer < StandardError; end
+
       class << self
+        extend Forwardable
+
         def configure
           @config = Config.new
           yield(@config) if block_given?
@@ -23,6 +27,8 @@ module Rails
         def config
           @config || configure
         end
+
+        def_delegators :config, :token, :bearer_token
       end
     end
   end

data/lib/rails/vault/jwt/concerns/auth_required.rb

@@ -20,7 +20,8 @@ module Rails
               render json: { errors: ['Not Authenticated'] }, status: :unauthorized
               nil
             end
-          rescue ::JWT::VerificationError, ::JWT::DecodeError
+          rescue ::JWT::VerificationError, ::JWT::DecodeError => e
+            JWT.config.logger.debug { "Error while verifying token: #{e}" }
             render json: { errors: ['Not Authenticated'] }, status: :unauthorized
           end
 
@@ -28,10 +29,16 @@ module Rails
 
           def http_token
             @http_token ||= (request.headers['Authorization'].split.last if request.headers['Authorization'].present?)
+            JWT.config.logger.debug { "@http_token => #{@http_token}" }
+
+            @http_token
           end
 
           def auth_token
             @auth_token ||= JWT::Decoder.decode(http_token)
+            JWT.config.logger.debug { "@auth_token => #{@auth_token}" }
+
+            @auth_token
           end
 
           def token_valid?

data/lib/rails/vault/jwt/config.rb

@@ -7,9 +7,14 @@ module Rails
     module JWT
       class Config
         extend Forwardable
-        attr_accessor :cache
+        attr_accessor :cache, :logger, :valid_issuers
         attr_reader :token_provider
 
+        def initialize
+          @logger = defined?(Rails) && defined?(Rails.logger) ? Rails.logger : Logger.new($stdout)
+          @valid_issuers = []
+        end
+
         def token_provider=(value)
           @token_provider = if value.is_a? Class
                               value.new
@@ -18,7 +23,7 @@ module Rails
                             end
         end
 
-        def_delegators :@token_provider, :token
+        def_delegators :@token_provider, :token, :bearer_token
       end
     end
   end

data/lib/rails/vault/jwt/decoder.rb

@@ -19,7 +19,8 @@ module Rails
                 jwks: key_provider.keys(issuer(token))
               }
             )[0])
-          rescue StandardError
+          rescue StandardError => e
+            JWT.config.logger.error "Error while decoding token: #{e}"
             nil
           end
 

data/lib/rails/vault/jwt/key_provider.rb

@@ -12,6 +12,8 @@ module Rails
         end
 
         def keys(issuer)
+          raise InvalidIssuer if JWT.config.valid_issuers.any? && !(JWT.config.valid_issuers.include? issuer)
+
           if @cache.respond_to?(:fetch)
             @cache.fetch("keys/#{issuer}", expires_in: 5.minutes) do
               fetch_keys issuer
@@ -22,7 +24,7 @@ module Rails
         end
 
         def fetch_keys(issuer)
-          raw = Net::HTTP.get URI.parse(issuer)
+          raw = Net::HTTP.get URI.parse("#{issuer}/.well-known/keys")
           JSON.parse raw, symbolize_names: true
         end
       end

data/lib/rails/vault/jwt/token_provider/base_provider.rb

@@ -9,12 +9,18 @@ module Rails
         class BaseProvider
           attr_reader :expire_time
 
-          def initialize(*_args)
+          def initialize(*_args, bearer_role_name: nil, **_kwargs)
             @expire_time = DateTime.now
+            @bearer_role_name = bearer_role_name || ENV.fetch('VAULT_BEARER_ROLE', '')
           end
 
           def auth; end
 
+          def bearer_token
+            token
+            client.logical.read("identity/oidc/token/#{@bearer_role_name}")&.data[:token]
+          end
+
           def token
             unless token_valid?
               auth_data = auth

data/lib/rails/vault/jwt/token_provider/role_id.rb

@@ -8,8 +8,8 @@ module Rails
           def initialize(*args, mount_name: 'approle', role_id: nil, secret_id: nil, token_ttl: '5m')
             super
             @mount_name = mount_name
-            @role_id = role_id || ENV.fetch('ROLE_ID')
-            @secret_id = secret_id || ENV.fetch('SECRET_ID')
+            @role_id = role_id || ENV.fetch('VAULT_ROLE_ID')
+            @secret_id = secret_id || ENV.fetch('VAULT_SECRET_ID')
             @token_ttl = token_ttl
           end
 

data/lib/rails/vault/jwt/version.rb

@@ -3,7 +3,7 @@
 module Rails
   module Vault
     module JWT
-      VERSION = '0.1.0'
+      VERSION = '0.2.1'
     end
   end
 end

data/rails-vault-jwt.gemspec

@@ -22,8 +22,8 @@ Gem::Specification.new do |spec|
     spec.metadata['allowed_push_host'] = 'https://rubygems.org'
 
     spec.metadata['homepage_uri'] = spec.homepage
-    spec.metadata['source_code_uri'] = 'https://github.com/datanuggets/rails-vault-jwt'
-    spec.metadata['changelog_uri'] = 'https://github.com/datanuggets/rails-vault-jwt/blob/main/CHANGELOG.md'
+    spec.metadata['source_code_uri'] = 'https://github.com/twitch-data-nuggets/rails-vault-jwt'
+    spec.metadata['changelog_uri'] = 'https://github.com/twitch-data-nuggets/rails-vault-jwt/blob/main/CHANGELOG.md'
   else
     raise 'RubyGems 2.0 or newer is required to protect against ' \
       'public gem pushes.'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails-vault-jwt
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Nick King
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2021-01-18 00:00:00.000000000 Z
+date: 2021-02-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -148,8 +148,8 @@ licenses:
 metadata:
   allowed_push_host: https://rubygems.org
   homepage_uri: https://github.com/datanuggets/rails-vault-jwt
-  source_code_uri: https://github.com/datanuggets/rails-vault-jwt
-  changelog_uri: https://github.com/datanuggets/rails-vault-jwt/blob/main/CHANGELOG.md
+  source_code_uri: https://github.com/twitch-data-nuggets/rails-vault-jwt
+  changelog_uri: https://github.com/twitch-data-nuggets/rails-vault-jwt/blob/main/CHANGELOG.md
 post_install_message: 
 rdoc_options: []
 require_paths: