restforce 4.0.0 → 4.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9e4311062c172c1fd0706872045d29fed90d5b36df5f6c2656d88c37ac680fb2
-  data.tar.gz: f8b6e07bd7533342229f0bb02ef00a731dda64990927bc2c8d822fbfa46f5a29
+  metadata.gz: c4d4058f81fe1d435976494baa2c81caa57515d21f1ffcb0784286d5a608af39
+  data.tar.gz: ddd80cd062c00f2c9d249e63e2cec5103da55a225c42d443e4370c2d234fae36
 SHA512:
-  metadata.gz: 33d02a24a1fc9e7efd40a318f75a48992215b759bcb33c8860a0e4e49fbc5a2eac13cce908dac4605164af58fa6e43473b753668926e0875deeba63eac4cc51c
-  data.tar.gz: 1a6155b0ec55633ebf061e7e709b7e391fe266563f5476b658040139e977ea00baf356602aacf8c5b2aef313c0b48296bfad984d444fe437249424810b567512
+  metadata.gz: 2b37491f67c8f1494aa849b6118c6b5d0bcfae35ebc5f8e313c68d1989fd4fda486ff661a8dfb74181526958b6baa8cff2b477b7297bdeb9bf98a6e44becfb1f
+  data.tar.gz: c046776763a2d2bc13890f6c64241052d25d8e1ded812770ef99aa7df407662065f9bbc349c94d902a66cf71d400770b63dd964a355ea9d2cd57cffe3500156f

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 4.1.0 (Oct 20, 2019)
+
+* Add support for JWT authentication (@nathanKramer, @tagCincy)
+
 ## 4.0.0 (Oct 9, 2019)
 
 * __Deprecate support for Ruby 2.3__, since [Ruby 2.3 reached its end-of-life](https://www.ruby-lang.org/en/news/2019/03/31/support-of-ruby-2-3-has-ended/) in March 2019. (This is the only breaking change included in this version.)

data/Gemfile

@@ -5,6 +5,7 @@ gemspec
 
 gem 'faraday', '~> 0.17.0'
 gem 'jruby-openssl', platforms: :jruby
+gem 'jwt'
 gem 'rake'
 
 group :development do

data/README.md

@@ -25,7 +25,7 @@ Features include:
 
 Add this line to your application's Gemfile:
 
-    gem 'restforce', '~> 4.0.0'
+    gem 'restforce', '~> 4.1.0'
 
 And then execute:
 
@@ -111,6 +111,21 @@ client = Restforce.new(username: 'foo',
                        api_version: '41.0')
 ```
 
+#### JWT Bearer Token
+
+If you prefer to use a [JWT Bearer Token](https://developer.salesforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com#Obtaining_an_Access_Token_using_a_JWT_Bearer_Token) to authenticate:
+
+```ruby
+client = Restforce.new(username: 'foo',
+                       client_id: 'client_id',
+                       instance_url: 'instance_url',
+                       jwt_key: 'certificate_private_key',
+                       api_version: '38.0')
+```
+
+The `jwt_key` option is the private key of the certificate uploaded to your Connected App in Salesforce.
+Choose "use digital signatures" in the Connected App configuration screen to upload your certificate.
+
 You can also set the username, password, security token, client ID, client
 secret and API version in environment variables:
 
@@ -473,11 +488,11 @@ document = client.query('select Id, Name, Body from Document').first
 File.open(document.Name, 'wb') { |f| f.write(document.Body) }
 ```
 
-**Note:** The example above is only applicable if your SOQL query returns a single Document record. If more than one record is returned, 
+**Note:** The example above is only applicable if your SOQL query returns a single Document record. If more than one record is returned,
 the Body field contains an URL to retrieve the BLOB content for the first 2000 records returned. Subsequent records contain the BLOB content
-in the Body field. This is confusing and hard to debug. See notes in [Issue #301](https://github.com/restforce/restforce/issues/301#issuecomment-298972959) explaining this detail. 
-**Executive Summary:** Don't retrieve the Body field in a SOQL query; instead, use the BLOB retrieval URL documented 
-in [SObject BLOB Retrieve](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/resources_sobject_blob_retrieve.htm) 
+in the Body field. This is confusing and hard to debug. See notes in [Issue #301](https://github.com/restforce/restforce/issues/301#issuecomment-298972959) explaining this detail.
+**Executive Summary:** Don't retrieve the Body field in a SOQL query; instead, use the BLOB retrieval URL documented
+in [SObject BLOB Retrieve](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/resources_sobject_blob_retrieve.htm)
 
 * * *
 
@@ -574,14 +589,14 @@ There are two magic values for the replay ID accepted by Salesforce:
 
 **Warning**: Only use a replay ID of a event from the last 24 hours otherwise
 Salesforce will not send anything, including newer events. If in doubt, use one
-of the two magic replay IDs mentioned above. 
+of the two magic replay IDs mentioned above.
 
-You might want to store the replay ID in some sort of datastore so you can 
+You might want to store the replay ID in some sort of datastore so you can
 access it, for example between application restarts. In that case, there is the
 option of passing a custom replay handler which responds to `[]` and `[]=`.
 
 Below is a sample replay handler that stores the replay ID for each channel in
-memory using a Hash, stores a timestamp and has some rudimentary logic that 
+memory using a Hash, stores a timestamp and has some rudimentary logic that
 will use one of the magic IDs depending on the value of the timestamp:
 
 ```ruby
@@ -637,9 +652,9 @@ EM.run {
     puts message.inspect
   end
 }
-``` 
+```
 
-_See also_: 
+_See also_:
 
 * [Force.com Streaming API docs](http://www.salesforce.com/us/developer/docs/api_streaming/index.htm)
 * [Message Durability docs](https://developer.salesforce.com/docs/atlas.en-us.api_streaming.meta/api_streaming/using_streaming_api_durability.htm)

data/lib/restforce.rb

@@ -3,6 +3,7 @@
 require 'faraday'
 require 'faraday_middleware'
 require 'json'
+require 'jwt'
 
 require 'restforce/version'
 require 'restforce/config'

data/lib/restforce/concerns/authentication.rb

@@ -19,6 +19,8 @@ module Restforce
           Restforce::Middleware::Authentication::Password
         elsif oauth_refresh?
           Restforce::Middleware::Authentication::Token
+        elsif jwt?
+          Restforce::Middleware::Authentication::JWTBearer
         end
       end
 
@@ -38,6 +40,14 @@ module Restforce
           options[:client_id] &&
           options[:client_secret]
       end
+
+      # Internal: Returns true if jwt bearer token flow should be used for
+      # authentication.
+      def jwt?
+        options[:jwt_key] &&
+          options[:username] &&
+          options[:client_id]
+      end
     end
   end
 end

data/lib/restforce/concerns/base.rb

@@ -28,6 +28,8 @@ module Restforce
       #                                   password and oauth authentication
       #        :client_secret           - The oauth client secret to use.
       #
+      #        :jwt_key                 - The private key for JWT authentication
+      #
       #        :host                    - The String hostname to use during
       #                                   authentication requests
       #                                   (default: 'login.salesforce.com').

data/lib/restforce/config.rb

@@ -108,6 +108,9 @@ module Restforce
     # The OAuth client secret
     option :client_secret, default: lambda { ENV['SALESFORCE_CLIENT_SECRET'] }
 
+    # The private key for JWT authentication
+    option :jwt_key
+
     # Set this to true if you're authenticating with a Sandbox instance.
     # Defaults to false.
     option :host, default: lambda { ENV['SALESFORCE_HOST'] || 'login.salesforce.com' }

data/lib/restforce/middleware/authentication.rb

@@ -6,8 +6,9 @@ module Restforce
   # will attempt to either reauthenticate (username and password) or refresh
   # the oauth access token (if a refresh token is present).
   class Middleware::Authentication < Restforce::Middleware
-    autoload :Password, 'restforce/middleware/authentication/password'
-    autoload :Token,    'restforce/middleware/authentication/token'
+    autoload :Password,  'restforce/middleware/authentication/password'
+    autoload :Token,     'restforce/middleware/authentication/token'
+    autoload :JWTBearer, 'restforce/middleware/authentication/jwt_bearer'
 
     # Rescue from 401's, authenticate then raise the error again so the client
     # can reissue the request.

data/lib/restforce/middleware/authentication/jwt_bearer.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require 'jwt'
+
+module Restforce
+  class Middleware
+    class Authentication
+      class JWTBearer < Restforce::Middleware::Authentication
+        def params
+          {
+            grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+            assertion: jwt_bearer_token
+          }
+        end
+
+        private
+
+        def jwt_bearer_token
+          JWT.encode claim_set, private_key, 'RS256'
+        end
+
+        def claim_set
+          {
+            iss: @options[:client_id],
+            sub: @options[:username],
+            aud: @options[:host],
+            iat: Time.now.utc.to_i,
+            exp: Time.now.utc.to_i + 180
+          }
+        end
+
+        def private_key
+          OpenSSL::PKey::RSA.new(@options[:jwt_key])
+        end
+      end
+    end
+  end
+end

data/lib/restforce/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Restforce
-  VERSION = '4.0.0'
+  VERSION = '4.1.0'
 end

data/restforce.gemspec

@@ -28,12 +28,13 @@ Gem::Specification.new do |gem|
   gem.add_dependency 'faraday_middleware', ['>= 0.8.8', '<= 1.0']
 
   gem.add_dependency 'json', '>= 1.7.5'
+  gem.add_dependency 'jwt', ['>= 1.5.6']
 
   gem.add_dependency 'hashie', ['>= 1.2.0', '< 4.0']
 
   gem.add_development_dependency 'faye' unless RUBY_PLATFORM == 'java'
   gem.add_development_dependency 'rspec', '~> 2.14.0'
-  gem.add_development_dependency 'rspec_junit_formatter', '~> 0.3.0'
+  gem.add_development_dependency 'rspec_junit_formatter', '~> 0.4.1'
   gem.add_development_dependency 'rubocop', '~> 0.75.0'
   gem.add_development_dependency 'simplecov', '~> 0.17.1'
   gem.add_development_dependency 'webmock', '~> 3.7.6'

data/spec/fixtures/test_private.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAy3KYqxZIgVDgFwdA+OQcKMJQu3iUTlyCSk9b3RLBOudnvk8u
+n0ShtKkOKB4b4RZeedcrlKESoak/6NS+M7CDemRT0EagqUiz/ZsZxB2KUp7au+d8
+0KWX99/loBjDttuon8ITDw2WFC9X0+TZqfsXcQ0iV1/9Sf8WHShd8ZqShjJBlEvf
+7u7VdNW8dXrl+4cvpPzspVxg6jVotEpmp875jmGRvshgx0iz0jtfAyxaaKStITC6
+MxufVNDgIYQDl6queh8b9noDLtt17Eq6YnropYN1hOjaLtoLBP7AN2gsXG7N3vqC
+JG619W9X4zCmKztv4oGjymInrS2msC2J02dNGQIDAQABAoIBAAurTARsJ8Z7DA9m
+FBzygIb59kV6eg8wkSyP9rXscHbfdPzeb88k0Z2aILy+VV0IumyEofRJdNce7RJ+
+uVYfprrrbD9C/c4X5HMEZWrxQtDQWb1zXp5dESVfiz0ujnM7kCVxrUQsxFHuETyP
+IMj2JPcQCMs4L0ACSJNtkE3eTs8xko5kwDHZGiLTi5jD1bLgaHl1A+9CTU8LosTy
+hEIrNSZfNidDPU4QSbwoElYZxpDMSbtyHaIk1WHz7zLzWoogK3x5AIQh64wWAQVd
+zzlp2j2jSM7oQ9j+k1aNiUBdDoRX53jmaIwE/1WDW/LT33qAoqRw+5qHeLRoRcfu
+3uj/WI0CgYEA6wnpIUhqqWT+febhXtCr1mAJlAJpzUUQncN6Zk0Kj/kE1V52OqgL
+gtOactII7J3+0zK7KGptqseTank0ghmGNdRBQ7+1JTQhpjLrCm/huKDhl+sBk95u
+opxw/ZTwMFYPwsmZlFcy4uWRjtI+QzaV+2Xk5JF57H8vUiX/+XqseQcCgYEA3Zdw
+zVHpcVPlyiXCbSvwb9IYXiJaQl/Rg96Klxah3MZNyRRKe5IoKUTJwEDuQ1MAHrve
+cWrNLcXhX6r/PzIXSSLe71wgwpn7UcaqWzZJqqN7OIGEeTzYWbB6tGhse7Dw7tWB
+hRkQSE0LPzZqboHz5msRM02sa61qiI5+ASJvIN8CgYEAvT+IoEzv3R89ruBVPQPm
+KMHBVJSw3iArJex8xJxp0c0fMDJUHhyq0BdTd/pYRzVcNm/VtNAlJ2p07zlSpyKo
+JvWV61gUIjWclnbPO+MkK4YWvzzxUz+5c2NlszjWQQU6wYuUBpZDmeBg2E++5F2y
+W+8KY2QjeOJbltiUCCvXbccCgYEAqARYB5aARumyZqBS16xlVqQazeWGQqWcmzx2
+ITGL8XZ7LGgyQZgE06XQw/F3t5yLjsIsXBr7ECXmST/C4gv9E/tYxm04edV/dfYI
+3bhACx6CI8owxCyabwcdQwWam/8B8FX7KwxiCDBCwt9ju/7VDHVKSXgvsEWBbaF9
+cSbG1EkCgYBZFztTUnD/cLMcvLUegN0K+6Qa3x3nRSrlrJ+v51mU1X8G8qNyFO67
+gUq9h4xbCl4Z5ZTuFKXwPM4XaMzfYdrWNS2zl5IG14FXS077GhDKe062b9mFoxtm
+aViCit4Hm8xpLTS8x9KB7yYAiF9sR/GklW1SUCIqnpL9JShkhzjfZw==
+-----END RSA PRIVATE KEY-----

data/spec/unit/concerns/authentication_spec.rb

@@ -52,6 +52,16 @@ describe Restforce::Concerns::Authentication do
 
       it { should eq Restforce::Middleware::Authentication::Token }
     end
+
+    context 'when jwt option is provided' do
+      before do
+        client.stub username_password?: false
+        client.stub oauth_refresh?: false
+        client.stub jwt?: true
+      end
+
+      it { should eq Restforce::Middleware::Authentication::JWTBearer }
+    end
   end
 
   describe '.username_password?' do
@@ -100,4 +110,29 @@ describe Restforce::Concerns::Authentication do
       it { should_not be_true }
     end
   end
+
+  describe '.jwt?' do
+    subject       { client.jwt? }
+    let(:options) do
+      {}
+    end
+
+    before do
+      client.stub options: options
+    end
+
+    context 'when jwt options are provided' do
+      let(:options) do
+        { jwt_key: 'JWT_PRIVATE_KEY',
+          username: 'foo',
+          client_id: 'client' }
+      end
+
+      it { should be_true }
+    end
+
+    context 'when jwt options are not provided' do
+      it { should_not be_true }
+    end
+  end
 end

data/spec/unit/middleware/authentication/jwt_bearer_spec.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+describe Restforce::Middleware::Authentication::JWTBearer do
+  let(:jwt_key) { File.read('spec/fixtures/test_private.key') }
+
+  let(:options) do
+    { host: 'login.salesforce.com',
+      client_id: 'client_id',
+      username: 'foo',
+      jwt_key: jwt_key,
+      instance_url: 'https://na1.salesforce.com',
+      adapter: :net_http }
+  end
+
+  it_behaves_like 'authentication middleware' do
+    let(:success_request) do
+      stub_login_request(
+        body: "grant_type=grant_type—urn:ietf:params:oauth:grant-type:jwt-bearer&" \
+             "assertion=abc1234567890"
+      ).to_return(status: 200, body: fixture(:auth_success_response))
+    end
+
+    let(:fail_request) do
+      stub_login_request(
+        body: "grant_type=grant_type—urn:ietf:params:oauth:grant-type:jwt-bearer&" \
+             "assertion=abc1234567890"
+      ).to_return(status: 400, body: fixture(:refresh_error_response))
+    end
+  end
+
+  context 'allows jwt_key as string' do
+    let(:jwt_key) do
+      File.read('spec/fixtures/test_private.key')
+    end
+
+    let(:options) do
+      { host: 'login.salesforce.com',
+        client_id: 'client_id',
+        username: 'foo',
+        jwt_key: jwt_key,
+        instance_url: 'https://na1.salesforce.com',
+        adapter: :net_http }
+    end
+
+    it_behaves_like 'authentication middleware' do
+      let(:success_request) do
+        stub_login_request(
+          body: "grant_type=grant_type—urn:ietf:params:oauth:grant-type:jwt-bearer&" \
+            "assertion=abc1234567890"
+        ).to_return(status: 200, body: fixture(:auth_success_response))
+      end
+
+      let(:fail_request) do
+        stub_login_request(
+          body: "grant_type=grant_type—urn:ietf:params:oauth:grant-type:jwt-bearer&" \
+            "assertion=abc1234567890"
+        ).to_return(status: 400, body: fixture(:refresh_error_response))
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: restforce
 version: !ruby/object:Gem::Version
-  version: 4.0.0
+  version: 4.1.0
 platform: ruby
 authors:
 - Eric J. Holmes
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-10-09 00:00:00.000000000 Z
+date: 2019-10-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -65,6 +65,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.7.5
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.5.6
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.5.6
 - !ruby/object:Gem::Dependency
   name: hashie
   requirement: !ruby/object:Gem::Requirement
@@ -119,14 +133,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.3.0
+        version: 0.4.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.3.0
+        version: 0.4.1
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
@@ -210,6 +224,7 @@ files:
 - lib/restforce/mash.rb
 - lib/restforce/middleware.rb
 - lib/restforce/middleware/authentication.rb
+- lib/restforce/middleware/authentication/jwt_bearer.rb
 - lib/restforce/middleware/authentication/password.rb
 - lib/restforce/middleware/authentication/token.rb
 - lib/restforce/middleware/authorization.rb
@@ -266,6 +281,7 @@ files:
 - spec/fixtures/sobject/upsert_multiple_error_response.json
 - spec/fixtures/sobject/upsert_updated_success_response.json
 - spec/fixtures/sobject/write_error_response.json
+- spec/fixtures/test_private.key
 - spec/integration/abstract_client_spec.rb
 - spec/integration/data/client_spec.rb
 - spec/spec_helper.rb
@@ -291,6 +307,7 @@ files:
 - spec/unit/data/client_spec.rb
 - spec/unit/document_spec.rb
 - spec/unit/mash_spec.rb
+- spec/unit/middleware/authentication/jwt_bearer_spec.rb
 - spec/unit/middleware/authentication/password_spec.rb
 - spec/unit/middleware/authentication/token_spec.rb
 - spec/unit/middleware/authentication_spec.rb
@@ -364,6 +381,7 @@ test_files:
 - spec/fixtures/sobject/upsert_multiple_error_response.json
 - spec/fixtures/sobject/upsert_updated_success_response.json
 - spec/fixtures/sobject/write_error_response.json
+- spec/fixtures/test_private.key
 - spec/integration/abstract_client_spec.rb
 - spec/integration/data/client_spec.rb
 - spec/spec_helper.rb
@@ -389,6 +407,7 @@ test_files:
 - spec/unit/data/client_spec.rb
 - spec/unit/document_spec.rb
 - spec/unit/mash_spec.rb
+- spec/unit/middleware/authentication/jwt_bearer_spec.rb
 - spec/unit/middleware/authentication/password_spec.rb
 - spec/unit/middleware/authentication/token_spec.rb
 - spec/unit/middleware/authentication_spec.rb