rkerberos 0.2.3 → 0.3.1

data/spec/krb5_spec.rb

@@ -23,7 +23,7 @@ RSpec.describe Kerberos::Krb5 do
   let(:service) { 'kadmin/admin' }
 
   it 'has the correct version constant' do
-    expect(Kerberos::Krb5::VERSION).to eq('0.2.3')
+    expect(Kerberos::Krb5::VERSION).to eq('0.3.1')
   end
 
   it 'accepts a block and yields itself' do
@@ -31,6 +31,31 @@ RSpec.describe Kerberos::Krb5 do
     described_class.new { |k| expect(k).to be_a(described_class) }
   end
 
+  describe 'constructor' do
+    it 'accepts a context keyword argument' do
+      context = Kerberos::Krb5::Context.new
+      k = described_class.new(context: context)
+      expect(k).to be_a(described_class)
+      expect(k.get_default_realm).to eq(@realm)
+      k.close
+    end
+
+    it 'raises TypeError if context is not a Kerberos::Krb5::Context' do
+      expect { described_class.new(context: 'bad') }.to raise_error(TypeError, /context must be/)
+    end
+
+    it 'raises an error if the context is closed' do
+      context = Kerberos::Krb5::Context.new
+      context.close
+      expect { described_class.new(context: context) }.to raise_error(Kerberos::Krb5::Exception, /context is closed/)
+    end
+
+    it 'rejects positional option hashes and unknown keywords' do
+      expect { described_class.new({context: nil}) }.to raise_error(ArgumentError)
+      expect { described_class.new(unknown: true) }.to raise_error(ArgumentError, /unknown keyword/)
+    end
+  end
+
   describe '#get_default_realm' do
     it 'responds to get_default_realm' do
       expect(krb5).to respond_to(:get_default_realm)
@@ -48,6 +73,17 @@ RSpec.describe Kerberos::Krb5 do
     it 'default_realm is an alias for get_default_realm' do
       expect(krb5.method(:default_realm)).to eq(krb5.method(:get_default_realm))
     end
+    it 'raises after the object is closed' do
+      krb5.close
+      expect { krb5.get_default_realm }.to raise_error(Kerberos::Krb5::Exception)
+    end
+  end
+
+  describe '#set_default_realm' do
+    it 'raises after the object is closed' do
+      krb5.close
+      expect { krb5.set_default_realm(@realm) }.to raise_error(Kerberos::Krb5::Exception)
+    end
   end
 
   describe '#verify_init_creds', :kadm5 do
@@ -68,53 +104,108 @@ RSpec.describe Kerberos::Krb5 do
       expect(krb5).to respond_to(:verify_init_creds)
     end
 
+    it 'requires get_init_creds_password arguments as keywords' do
+      expect { krb5.get_init_creds_password(user, 'changeme') }.to raise_error(ArgumentError)
+      expect {
+        krb5.get_init_creds_password(principal: user, password: 'changeme', unknown: true)
+      }.to raise_error(ArgumentError, /unknown keyword/)
+    end
+
     it 'raises when no credentials have been acquired' do
       expect { krb5.verify_init_creds }.to raise_error(Kerberos::Krb5::Exception)
     end
 
     it 'validates argument types' do
-      expect { krb5.verify_init_creds(true) }.to raise_error(TypeError)
-      expect { krb5.verify_init_creds(nil, true) }.to raise_error(TypeError)
-      expect { krb5.verify_init_creds(nil, nil, true) }.to raise_error(TypeError)
+      expect { krb5.verify_init_creds(server: true) }.to raise_error(TypeError)
+      expect { krb5.verify_init_creds(keytab: true) }.to raise_error(TypeError)
+      expect { krb5.verify_init_creds(ccache: true) }.to raise_error(TypeError)
+    end
+
+    it 'accepts only documented keyword arguments' do
+      expect { krb5.verify_init_creds(nil) }.to raise_error(ArgumentError)
+      expect { krb5.verify_init_creds(unknown: true) }.to raise_error(ArgumentError, /unknown keyword/)
     end
 
     it 'verifies credentials obtained via password' do
-      krb5.get_init_creds_password(user, 'changeme')
+      krb5.get_init_creds_password(principal: user, password: 'changeme')
       expect(krb5.verify_init_creds).to be true
     end
 
     it 'accepts a server principal string' do
-      krb5.get_init_creds_password(user, 'changeme')
-      expect(krb5.verify_init_creds("kadmin/admin@#{@realm}")).to be true
+      krb5.get_init_creds_password(principal: user, password: 'changeme')
+      expect(krb5.verify_init_creds(server: "kadmin/admin@#{@realm}")).to be true
     end
 
     it 'accepts a Keytab object' do
-      krb5.get_init_creds_password(user, 'changeme')
+      krb5.get_init_creds_password(principal: user, password: 'changeme')
       kt = Kerberos::Krb5::Keytab.new
-      expect(krb5.verify_init_creds(nil, kt)).to be true
+      expect(krb5.verify_init_creds(keytab: kt)).to be true
+    end
+
+    it 'rejects a closed Keytab object' do
+      krb5.get_init_creds_password(principal: user, password: 'changeme')
+      kt = Kerberos::Krb5::Keytab.new
+      kt.close
+      expect { krb5.verify_init_creds(keytab: kt) }
+        .to raise_error(Kerberos::Krb5::Exception, /keytab is closed/)
     end
 
     it 'stores additional credentials in provided CredentialsCache' do
       ccache = Kerberos::Krb5::CredentialsCache.new
-      krb5.get_init_creds_password(user, 'changeme')
-      expect(krb5.verify_init_creds(nil, nil, ccache)).to be true
+      krb5.get_init_creds_password(principal: user, password: 'changeme')
+      expect(krb5.verify_init_creds(ccache: ccache)).to be true
       expect(ccache.primary_principal).to be_a(String)
       expect(ccache.primary_principal).to include('@')
     end
 
+    it 'rejects a closed CredentialsCache' do
+      krb5.get_init_creds_password(principal: user, password: 'changeme')
+      ccache = Kerberos::Krb5::CredentialsCache.new
+      ccache.close
+      expect { krb5.verify_init_creds(ccache: ccache) }
+        .to raise_error(Kerberos::Krb5::Exception, /credentials cache is closed/)
+    end
+
+    it 'does not acquire credentials into a closed CredentialsCache' do
+      ccache = Kerberos::Krb5::CredentialsCache.new
+      ccache.close
+      expect {
+        krb5.get_init_creds_password(principal: user, password: 'changeme', ccache: ccache)
+      }.to raise_error(Kerberos::Krb5::Exception, /credentials cache is closed/)
+    end
+
     it 'provides authenticate! which acquires and verifies (Zanarotti mitigation)' do
       expect(krb5).to respond_to(:authenticate!)
-      expect(krb5.authenticate!(user, 'changeme')).to be true
+      expect(krb5.authenticate!(principal: user, password: 'changeme')).to be true
       expect(krb5.verify_init_creds).to be true
     end
 
     it 'accepts an optional service argument' do
-      expect { krb5.authenticate!(user, 'changeme', 'kadmin/changepw') }.not_to raise_error
-      expect(krb5.verify_init_creds).to be true
+      expect {
+        krb5.authenticate!(principal: user, password: 'changeme', service: 'verify/rkerberos-test')
+      }.not_to raise_error
+    end
+
+    it 'fails closed when no verification keytab is available' do
+      original_keytab = ENV['KRB5_KTNAME']
+      ENV['KRB5_KTNAME'] = "FILE:/tmp/missing_verify_keytab_#{Process.pid}"
+
+      expect {
+        described_class.new.authenticate!(principal: user, password: 'changeme')
+      }.to raise_error(Kerberos::Krb5::Exception, /krb5_verify_init_creds/)
+    ensure
+      ENV['KRB5_KTNAME'] = original_keytab
     end
 
     it 'validates argument types for authenticate!' do
-      expect { krb5.authenticate!(true, true) }.to raise_error(TypeError)
+      expect { krb5.authenticate!(principal: true, password: true) }.to raise_error(TypeError)
+    end
+
+    it 'requires authenticate! arguments as keywords' do
+      expect { krb5.authenticate!(user, 'changeme') }.to raise_error(ArgumentError)
+      expect {
+        krb5.authenticate!(principal: user, password: 'changeme', unknown: true)
+      }.to raise_error(ArgumentError, /unknown keyword/)
     end
   end
 
@@ -154,16 +245,16 @@ RSpec.describe Kerberos::Krb5 do
     end
 
     it 'changes the password successfully' do
-      krb5.get_init_creds_password(user, 'changeme')
+      krb5.get_init_creds_password(principal: user, password: 'changeme')
       expect(krb5.change_password('changeme', 'Newpass99!')).to be true
       # Verify we can authenticate with the new password
       krb5_check = described_class.new
-      expect(krb5_check.get_init_creds_password(user, 'Newpass99!')).to be true
+      expect(krb5_check.get_init_creds_password(principal: user, password: 'Newpass99!')).to be true
       krb5_check.close
     end
 
     it 'raises with a meaningful message when the old password is wrong' do
-      krb5.get_init_creds_password(user, 'changeme')
+      krb5.get_init_creds_password(principal: user, password: 'changeme')
       expect {
         krb5.change_password('wrongpass', 'Newpass99!')
       }.to raise_error(Kerberos::Krb5::Exception, /krb5_(get_init_creds_password|change_password)/)
@@ -180,7 +271,7 @@ RSpec.describe Kerberos::Krb5 do
       let(:compliant_pw) { 'Changeme1!' }
 
       it 'raises an exception with the KDC rejection reason' do
-        krb5.get_init_creds_password(policy_user, compliant_pw)
+        krb5.get_init_creds_password(principal: policy_user, password: compliant_pw)
         expect {
           krb5.change_password(compliant_pw, 'a')
         }.to raise_error(Kerberos::Krb5::Exception, /krb5_change_password/)
@@ -208,18 +299,92 @@ RSpec.describe Kerberos::Krb5 do
       expect(krb5).to respond_to(:get_init_creds_keytab)
     end
 
+    it 'accepts only documented keyword arguments' do
+      expect { krb5.get_init_creds_keytab(user) }.to raise_error(ArgumentError)
+      expect { krb5.get_init_creds_keytab(unknown: true) }.to raise_error(ArgumentError, /unknown keyword/)
+    end
+
     it 'acquires credentials for a principal from a supplied keytab file' do
       kt_name = "FILE:#{@kt_file}"
-      expect { krb5.get_init_creds_keytab(user, kt_name) }.not_to raise_error
+      expect { krb5.get_init_creds_keytab(principal: user, keytab: kt_name) }.not_to raise_error
       expect(krb5.verify_init_creds).to be true
     end
 
     it 'accepts a CredentialsCache to receive credentials' do
       ccache = Kerberos::Krb5::CredentialsCache.new
       kt_name = "FILE:#{@kt_file}"
-      expect { krb5.get_init_creds_keytab(user, kt_name, nil, ccache) }.not_to raise_error
+      expect { krb5.get_init_creds_keytab(principal: user, keytab: kt_name, ccache: ccache) }.not_to raise_error
       expect(ccache.primary_principal).to be_a(String)
       expect(ccache.primary_principal).to include('@')
     end
+
+    it 'rejects a closed CredentialsCache' do
+      ccache = Kerberos::Krb5::CredentialsCache.new
+      ccache.close
+      kt_name = "FILE:#{@kt_file}"
+      expect {
+        krb5.get_init_creds_keytab(principal: user, keytab: kt_name, ccache: ccache)
+      }.to raise_error(Kerberos::Krb5::Exception, /credentials cache is closed/)
+    end
+  end
+
+  describe '.thread_safe?' do
+    it 'returns a boolean' do
+      result = described_class.thread_safe?
+      expect([true, false]).to include(result)
+    end
+
+    it 'is callable without an instance' do
+      expect(described_class).to respond_to(:thread_safe?)
+    end
+  end
+
+  describe '#get_host_realm' do
+    it 'responds to get_host_realm' do
+      expect(krb5).to respond_to(:get_host_realm)
+    end
+
+    it 'returns an array of realm strings' do
+      result = krb5.get_host_realm('localhost')
+      expect(result).to be_a(Array)
+      result.each { |r| expect(r).to be_a(String) }
+    end
+
+    it 'returns a non-empty array for a known hostname' do
+      result = krb5.get_host_realm('localhost')
+      expect(result).not_to be_empty
+    end
+
+    it 'raises TypeError for non-string argument' do
+      expect { krb5.get_host_realm(123) }.to raise_error(TypeError)
+    end
+
+    it 'raises ArgumentError when called without arguments' do
+      expect { krb5.get_host_realm }.to raise_error(ArgumentError)
+    end
+  end
+
+  describe '#expand_hostname' do
+    it 'responds to expand_hostname' do
+      expect(krb5).to respond_to(:expand_hostname)
+    end
+
+    it 'returns a string' do
+      result = krb5.expand_hostname('localhost')
+      expect(result).to be_a(String)
+    end
+
+    it 'returns a non-empty string' do
+      result = krb5.expand_hostname('localhost')
+      expect(result.size).to be > 0
+    end
+
+    it 'raises TypeError for non-string argument' do
+      expect { krb5.expand_hostname(123) }.to raise_error(TypeError)
+    end
+
+    it 'raises ArgumentError when called without arguments' do
+      expect { krb5.expand_hostname }.to raise_error(ArgumentError)
+    end
   end
 end

data/spec/policy_spec.rb

@@ -21,6 +21,10 @@ RSpec.describe 'Kerberos::Kadm5::Policy', :kadm5 do
     it 'must be present' do
       expect { klass.new(max_life: 10000) }.to raise_error(ArgumentError)
     end
+    it 'rejects positional option hashes and unknown keywords' do
+      expect { klass.new({name: 'test'}) }.to raise_error(ArgumentError)
+      expect { klass.new(name: 'test', unknown: true) }.to raise_error(ArgumentError, /unknown keyword/)
+    end
   end
 
   describe 'min_life' do

data/spec/principal_spec.rb

@@ -5,20 +5,51 @@ require 'rkerberos'
 
 RSpec.describe Kerberos::Krb5::Principal do
   let(:name) { 'Jon' }
-  subject(:princ) { described_class.new(name) }
+  subject(:princ) { described_class.new(name: name) }
 
   describe 'constructor' do
-    it 'requires a string argument' do
-      expect { described_class.new(1) }.to raise_error(TypeError)
-      expect { described_class.new(true) }.to raise_error(TypeError)
+    it 'requires name to be a string' do
+      expect { described_class.new(name: 1) }.to raise_error(TypeError)
+      expect { described_class.new(name: true) }.to raise_error(TypeError)
     end
 
-    it 'accepts an explicit nil argument' do
-      expect{ described_class.new(nil) }.not_to raise_error
+    it 'accepts no arguments' do
+      expect{ described_class.new }.not_to raise_error
     end
 
-    it 'works as expected with a nil argument to the constructor' do
-      expect(described_class.new(nil).principal).to be_nil
+    it 'works as expected with no name argument' do
+      expect(described_class.new.principal).to be_nil
+    end
+
+    it 'rejects positional arguments' do
+      expect { described_class.new('Jon') }.to raise_error(ArgumentError)
+    end
+
+    it 'accepts a context keyword argument' do
+      ctx = Kerberos::Krb5::Context.new
+      expect { described_class.new(name: 'Jon', context: ctx) }.not_to raise_error
+    end
+
+    it 'rejects positional option hashes and unknown keywords' do
+      expect { described_class.new({name: 'Jon'}) }.to raise_error(ArgumentError)
+      expect { described_class.new(unknown: true) }.to raise_error(ArgumentError, /unknown keyword/)
+    end
+
+    it 'uses the same realm when a context is provided' do
+      ctx = Kerberos::Krb5::Context.new
+      p1 = described_class.new(name: 'Jon')
+      p2 = described_class.new(name: 'Jon', context: ctx)
+      expect(p2.realm).to eq(p1.realm)
+    end
+
+    it 'raises TypeError for non-Context context argument' do
+      expect { described_class.new(name: 'Jon', context: "bad") }.to raise_error(TypeError)
+    end
+
+    it 'raises error for a closed context' do
+      ctx = Kerberos::Krb5::Context.new
+      ctx.close
+      expect { described_class.new(name: 'Jon', context: ctx) }.to raise_error(Kerberos::Krb5::Exception)
     end
   end
 
@@ -27,8 +58,34 @@ RSpec.describe Kerberos::Krb5::Principal do
       expect(subject.realm).to eq('EXAMPLE.COM')
     end
 
-    it 'raises an error if the constructor argument was nil' do
-      expect{ described_class.new(nil).realm }.to raise_error(Kerberos::Krb5::Exception, /no principal/)
+    it 'raises an error if no name was provided' do
+      expect{ described_class.new.realm }.to raise_error(Kerberos::Krb5::Exception, /no principal/)
+    end
+  end
+
+  describe '#close' do
+    it 'releases a borrowed context and prevents further native operations' do
+      context = Kerberos::Krb5::Context.new
+      principal = described_class.new(name: name, context: context)
+
+      expect(principal.close).to equal(principal)
+      expect { principal.realm }.to raise_error(Kerberos::Krb5::Exception)
+      expect { context.close }.not_to raise_error
+    end
+
+    it 'can be called multiple times' do
+      expect { 2.times { princ.close } }.not_to raise_error
+    end
+  end
+
+  describe '#==' do
+    it 'returns true for equivalent principals' do
+      expect(princ).to eq(described_class.new(name: name))
+    end
+
+    it 'returns false for objects of another type' do
+      expect(princ == name).to be false
+      expect(princ == nil).to be false
     end
   end
 
@@ -83,4 +140,53 @@ RSpec.describe Kerberos::Krb5::Principal do
       expect { princ.mod_date }.not_to raise_error
     end
   end
+
+  describe '#principal_type' do
+    it 'returns an integer for a named principal' do
+      p = described_class.new(name: 'user@EXAMPLE.COM')
+      expect(p.principal_type).to be_a(Integer)
+    end
+
+    it 'returns KRB5_NT_PRINCIPAL (1) for a simple name' do
+      p = described_class.new(name: 'user@EXAMPLE.COM')
+      expect(p.principal_type).to eq(1)
+    end
+
+    it 'raises an error when no principal has been established' do
+      p = described_class.new
+      expect { p.principal_type }.to raise_error(Kerberos::Krb5::Exception, /no principal/)
+    end
+  end
+
+  describe '#components' do
+    it 'responds to components' do
+      expect(princ).to respond_to(:components)
+    end
+
+    it 'returns an array of strings' do
+      result = princ.components
+      expect(result).to be_a(Array)
+      result.each { |c| expect(c).to be_a(String) }
+    end
+
+    it 'returns one component for a simple principal' do
+      p = described_class.new(name: 'user@EXAMPLE.COM')
+      expect(p.components).to eq(['user'])
+    end
+
+    it 'returns multiple components for a compound principal' do
+      p = described_class.new(name: 'admin/instance@EXAMPLE.COM')
+      expect(p.components).to eq(['admin', 'instance'])
+    end
+
+    it 'returns three components for a three-part principal' do
+      p = described_class.new(name: 'a/b/c@EXAMPLE.COM')
+      expect(p.components).to eq(['a', 'b', 'c'])
+    end
+
+    it 'raises an error when no principal has been established' do
+      p = described_class.new
+      expect { p.components }.to raise_error(Kerberos::Krb5::Exception, /no principal/)
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rkerberos
 version: !ruby/object:Gem::Version
-  version: 0.2.3
+  version: 0.3.1
 platform: ruby
 authors:
 - Daniel Berger
@@ -66,6 +66,7 @@ extensions:
 extra_rdoc_files: []
 files:
 - CHANGES.md
+- EXAMPLES.md
 - Gemfile
 - LICENSE
 - MANIFEST.md
@@ -93,17 +94,17 @@ files:
 - spec/policy_spec.rb
 - spec/principal_spec.rb
 - spec/spec_helper.rb
-homepage: http://github.com/rkerberos/rkerberos
+homepage: https://github.com/rkerberos/rkerberos
 licenses:
 - Artistic-2.0
 metadata:
-  homepage_uri: https://github.com/rkerberos/rkerberos
   bug_tracker_uri: https://github.com/rkerberos/rkerberos/issues
-  changelog_uri: https://github.com/rkerberos/rkerberos/blob/main/CHANGES.md
+  changelog_uri: https://github.com/rkerberos/rkerberos/blob/master/CHANGES.md
   documentation_uri: https://github.com/rkerberos/rkerberos/wiki
+  homepage_uri: https://github.com/rkerberos/rkerberos
   source_code_uri: https://github.com/rkerberos/rkerberos
   wiki_uri: https://github.com/rkerberos/rkerberos/wiki
-  github_repo: https://github.com/djberg96/rkerberos
+  github_repo: https://github.com/rkerberos/rkerberos
   funding_uri: https://github.com/sponsors/rkerberos
   rubygems_mfa_required: 'true'
 rdoc_options: []
@@ -113,16 +114,16 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.18
 specification_version: 4
-summary: A Ruby interface for the the Kerberos library
+summary: A Ruby interface for the Kerberos library
 test_files:
 - spec/config_spec.rb
 - spec/context_spec.rb