rodauth-ciba 0.1.0

data/lib/rodauth/ciba/id_token_encryption.rb

@@ -0,0 +1,175 @@
+# frozen_string_literal: true
+module Rodauth
+  module CibaSupport
+    module IdTokenEncryption
+      SYMMETRIC_ALGORITHMS = %w[dir A128KW A192KW A256KW A128GCMKW A192GCMKW A256GCMKW].freeze
+      ECDH_ALGORITHMS = %w[ECDH-ES ECDH-ES+A128KW ECDH-ES+A192KW ECDH-ES+A256KW].freeze
+      ALGORITHMS = (%w[RSA-OAEP RSA-OAEP-256] + SYMMETRIC_ALGORITHMS + ECDH_ALGORITHMS).freeze
+      METHODS = %w[A128GCM A192GCM A256GCM A128CBC-HS256 A192CBC-HS384 A256CBC-HS512].freeze
+
+      private
+
+      def generate_id_token(grant, include_claims = false)
+        previous = @ciba_symmetric_recipient_client
+        if @ciba_authentication && ciba_id_token_encryption_enabled &&
+            SYMMETRIC_ALGORITHMS.include?(oauth_application[oauth_applications_id_token_encrypted_response_alg_column])
+          @ciba_symmetric_recipient_client = oauth_application[oauth_applications_id_column]
+        end
+        super
+      ensure
+        @ciba_symmetric_recipient_client = previous
+      end
+
+      def oauth_application_jwks(application)
+        # Upstream eagerly resolves recipient keys while generating an ID Token.
+        # Symmetric encryption has no public recipient key. Authentication runs
+        # outside this scope and must still resolve/verify its registered keys.
+        return if @ciba_symmetric_recipient_client &&
+          @ciba_symmetric_recipient_client == application[oauth_applications_id_column]
+        super
+      end
+
+      def ciba_gcm_key_wrap(token, key, algorithm, method)
+        # RFC 7518 §4.7: a fresh 96-bit wrapping IV, empty AAD and a
+        # 128-bit wrapping tag. Content encryption remains in the JWE backend.
+        content = JWE::Enc.for(method)
+        wrapper = OpenSSL::Cipher.new("aes-#{key.bytesize * 8}-gcm")
+        wrapper.encrypt
+        wrapper.key = key
+        iv = SecureRandom.random_bytes(12)
+        wrapper.iv = iv
+        wrapper.auth_data = ""
+        encrypted_key = wrapper.update(content.cek) + wrapper.final
+        header = JSON.generate(alg: algorithm, enc: method, cty: "JWT",
+          iss: oauth_jwt_issuer, aud: oauth_jwt_audience,
+          iv: Base64.urlsafe_encode64(iv, padding: false),
+          tag: Base64.urlsafe_encode64(wrapper.auth_tag(16), padding: false))
+        ciphertext = content.encrypt(token, Base64.urlsafe_encode64(header, padding: false))
+        JWE::Serialization::Compact.encode(header, encrypted_key, content.iv, ciphertext, content.tag)
+      end
+
+      def ciba_ecdh_public_key(jwk)
+        if jwk["kty"] == "EC" && %w[P-256 P-384 P-521].include?(jwk["crv"])
+          key = JWT::JWK.import(jwk.reject { |name, _| name == "d" }).keypair
+          return unless key.is_a?(OpenSSL::PKey::EC) && key.check_key
+          OpenSSL::PKey.read(key.public_to_der)
+        elsif jwk["kty"] == "OKP" && jwk["crv"] == "X25519"
+          encoded = jwk["x"]
+          return unless encoded.is_a?(String) && encoded.match?(/\A[A-Za-z0-9_-]{43}\z/)
+          raw = Base64.urlsafe_decode64(encoded)
+          return unless raw.bytesize == 32 && Base64.urlsafe_encode64(raw, padding: false) == encoded
+          identifier = OpenSSL::ASN1::Sequence.new([OpenSSL::ASN1::ObjectId.new("1.3.101.110")])
+          OpenSSL::PKey.read(OpenSSL::ASN1::Sequence.new([identifier, OpenSSL::ASN1::BitString.new(raw)]).to_der)
+        end
+      rescue JWT::JWKError, OpenSSL::PKey::PKeyError, ArgumentError
+        nil
+      end
+
+      def ciba_ecdh_derived_key(shared, algorithm, method)
+        direct = algorithm == "ECDH-ES"
+        bits = (direct ? (method[/HS(\d+)$/, 1] || method[/^A(\d+)/, 1]) : algorithm[/A(\d+)KW$/, 1]).to_i
+        name = direct ? method : algorithm
+        # RFC 7518 §4.6.2: empty PartyUInfo/PartyVInfo; SHA-256 Concat KDF.
+        info = [name.bytesize].pack("N") + name + [0, 0, bits].pack("N3")
+        (1..((bits + 255) / 256)).map do |counter|
+          OpenSSL::Digest.digest("SHA256", [counter].pack("N") + shared + info)
+        end.join.byteslice(0, bits / 8)
+      end
+
+      def ciba_ecdh_encrypt(token, recipient, algorithm, method, headers)
+        # The reference's public ECDH CryptoKey import accepts no key usages.
+        # Do not silently discard a selected recipient's declared operations.
+        if recipient.key?("key_ops") && recipient["key_ops"] != []
+          raise ConfigurationError, "CIBA ECDH public recipient key_ops must be omitted or empty"
+        end
+        public_key = ciba_ecdh_public_key(recipient)
+        raise ConfigurationError, "Invalid CIBA ECDH recipient key" unless public_key
+        if recipient["crv"] == "X25519"
+          ephemeral = OpenSSL::PKey.generate_key("X25519")
+          raw = OpenSSL::ASN1.decode(ephemeral.public_to_der).value.last.value
+          epk = {kty: "OKP", crv: "X25519", x: Base64.urlsafe_encode64(raw, padding: false)}
+        else
+          ephemeral = OpenSSL::PKey::EC.generate(public_key.group.curve_name)
+          epk = JWT::JWK.new(ephemeral).export.select { |name, _| %i[kty crv x y].include?(name) }
+        end
+        shared = ephemeral.derive(public_key)
+        raise ConfigurationError, "Invalid CIBA ECDH shared secret" if shared.bytes.all?(&:zero?)
+        derived = ciba_ecdh_derived_key(shared, algorithm, method)
+        content = JWE::Enc.for(method)
+        encrypted_key = if algorithm == "ECDH-ES"
+          content.cek = derived
+          ""
+        else
+          JWE::Alg.encrypt_cek(algorithm.split("+").last, derived, content.cek)
+        end
+        header = JSON.generate(headers.merge(alg: algorithm, enc: method, epk: epk))
+        ciphertext = content.encrypt(token, Base64.urlsafe_encode64(header, padding: false))
+        JWE::Serialization::Compact.encode(header, encrypted_key, content.iv, ciphertext, content.tag)
+      rescue OpenSSL::PKey::PKeyError
+        raise ConfigurationError, "Invalid CIBA ECDH recipient key agreement"
+      end
+
+      def ciba_encrypt_id_token(token, options)
+        algorithm = options[:encryption_algorithm]
+        method = options[:encryption_method]
+        unless ALGORITHMS.include?(algorithm) && METHODS.include?(method)
+          raise ConfigurationError, "Unsupported CIBA ID Token encryption"
+        end
+        if SYMMETRIC_ALGORITHMS.include?(algorithm)
+          secret = ciba_id_token_encryption_secret(oauth_application: oauth_application)
+          unless secret.is_a?(String) && secret.valid_encoding? && !secret.empty?
+            raise ConfigurationError, "CIBA symmetric encryption requires the client secret"
+          end
+          bits = if algorithm == "dir"
+            method[/HS(\d+)$/, 1] || method[/^A(\d+)/, 1]
+          else
+            algorithm[/^A(\d+)/, 1]
+          end
+          length = bits.to_i / 8
+          digest = length <= 32 ? "SHA256" : length <= 48 ? "SHA384" : "SHA512"
+          key = OpenSSL::Digest.digest(digest, secret.encode(Encoding::UTF_8))[0, length]
+          require "jwe"
+          return ciba_gcm_key_wrap(token, key, algorithm, method) if algorithm.end_with?("GCMKW")
+          return JWE.encrypt(token, key, alg: algorithm, enc: method,
+            cty: "JWT", iss: oauth_jwt_issuer, aud: oauth_jwt_audience)
+        end
+        jwks = options[:jwks]
+        keys = jwks.is_a?(Hash) ? (jwks[:keys] || jwks["keys"]) : jwks
+        candidates = Array(keys).select do |item|
+          next false unless item.is_a?(Hash)
+          candidate = item.transform_keys(&:to_s)
+          ecdh = ECDH_ALGORITHMS.include?(algorithm)
+          next false unless (ecdh ? %w[EC OKP].include?(candidate["kty"]) : candidate["kty"] == "RSA") &&
+            (!candidate.key?("alg") || candidate["alg"] == algorithm) &&
+            (!candidate.key?("use") || candidate["use"] == "enc") &&
+            (ecdh || !candidate.key?("key_ops") || (candidate["key_ops"].is_a?(Array) &&
+              candidate["key_ops"].include?("encrypt"))) &&
+            (!candidate.key?("kid") || (candidate["kid"].is_a?(String) && !candidate["kid"].empty?))
+          true
+        end
+        raise ProtocolError, "invalid_client_metadata" if candidates.empty?
+        # node-oidc-provider scores explicit matching alg/use above omitted
+        # metadata; equal scores retain registration order.
+        recipient = candidates.each_with_index.min_by do |item, index|
+          candidate = item.transform_keys(&:to_s)
+          score = (candidate["alg"] == algorithm ? 1 : 0) + (candidate["use"] == "enc" ? 1 : 0)
+          [-score, index]
+        end.first
+        recipient = recipient.transform_keys(&:to_s)
+        headers = {cty: "JWT", iss: oauth_jwt_issuer, aud: oauth_jwt_audience}
+        headers[:kid] = recipient["kid"] if recipient["kid"]
+        # Load after Rodauth's feature initialization. The JWE backend is used
+        # only here; upstream algorithm advertisement/authentication is unchanged.
+        require "jwe"
+        return ciba_ecdh_encrypt(token, recipient, algorithm, method, headers) if ECDH_ALGORITHMS.include?(algorithm)
+        if recipient.key?("key_ops") && !recipient["key_ops"].include?("wrapKey")
+          raise ConfigurationError, "CIBA RSA recipient key_ops must include wrapKey"
+        end
+        key = JWT::JWK.import(recipient).keypair
+        raise ConfigurationError, "CIBA RSA recipient key must be at least 2048 bits" if key.n.num_bits < 2048
+        JWE.encrypt(token, key.public_key,
+          alg: algorithm, enc: method, **headers)
+      end
+    end
+  end
+end

data/lib/rodauth/ciba/jwks_cache.rb

@@ -0,0 +1,149 @@
+# frozen_string_literal: true
+require "time"
+require "json"
+
+module Rodauth
+  module CibaSupport
+    # Application-scoped JWKS cache. Ordinary HTTP caching remains delegated.
+    # The separate entries retain explicit stale allowances without depending on
+    # upstream TtlStore internals. Replacing an entry invalidates in-flight snapshots.
+    class JwksCache
+      class StatusError < HTTP::Error
+        attr_reader :status
+        def initialize(status)
+          @status = status
+          super("JWKS retrieval failed")
+        end
+      end
+      LIMIT = 1024
+
+      def initialize(upstream)
+        @upstream, @entries, @mutex = upstream, {}, Mutex.new
+      end
+
+      def [](key)
+        @upstream[key]
+      end
+
+      def set(key, &block)
+        @upstream.set(key, &block)
+      end
+
+      def uncache(key)
+        @mutex.synchronize { @entries.delete(key) }
+        @upstream.uncache(key)
+      end
+
+      def fetch(key)
+        snapshot = @mutex.synchronize do
+          @entries.delete_if { |_uri, entry| entry[:until] && entry[:until] <= now }
+          entry = @entries[key]
+          return entry[:payload] if entry && entry[:fresh] && now < entry[:fresh]
+          unless entry
+            @entries.shift while @entries.size >= LIMIT
+            entry = @entries[key] = {}
+          end
+          entry
+        end
+        started = now
+        response = yield
+        received, wall = now, Time.now.to_f
+        raise StatusError, response.code.to_i unless response.code.to_i == 200
+        payload = JSON.parse(response.body, symbolize_names: true)
+        unless payload.is_a?(Hash) && payload[:keys].is_a?(Array) && payload[:keys].all? { |jwk| jwk.is_a?(Hash) }
+          raise HTTP::Error, "invalid remote JWKS"
+        end
+        lifetime, grace = policy(response, wall, received - started)
+        replacement = {payload: payload, fresh: received + lifetime, until: received + lifetime + grace}
+        @mutex.synchronize do
+          if @entries[key].equal?(snapshot)
+            if replacement[:until] > now
+              @entries[key] = replacement
+            else
+              @entries.delete(key)
+            end
+          else
+            # A newer fetch/eviction wins. Never return the older fetched keys.
+            newer = @entries[key]
+            return newer[:payload] if newer && newer[:fresh] && now < newer[:fresh]
+            raise HTTP::Error, "JWKS changed during retrieval"
+          end
+        end
+        payload
+      rescue StatusError, Timeout::Error => error
+        transient = error.is_a?(Timeout::Error) || [500, 502, 503, 504].include?(error.status)
+        @mutex.synchronize do
+          entry = @entries[key]
+          if transient && entry.equal?(snapshot) && entry[:payload] && now < entry[:until]
+            return entry[:payload]
+          end
+          # A newer successful fetch can satisfy this call, but stale snapshots
+          # cannot survive eviction or a concurrent invalidating response.
+          if transient && entry && !entry.equal?(snapshot) && entry[:fresh] && now < entry[:fresh]
+            return entry[:payload]
+          end
+          @entries.delete(key) if !transient && entry.equal?(snapshot)
+        end
+        raise
+      rescue StandardError
+        @mutex.synchronize { @entries.delete(key) if @entries[key].equal?(snapshot) }
+        raise
+      end
+
+      private
+
+      def now
+        Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      end
+
+      def policy(response, wall, delay)
+        directives = {}
+        # Split outside quoted strings; ambiguous syntax/duplicates disable reuse.
+        parts = response["cache-control"].to_s.split(/,(?=(?:[^\"]*\"[^\"]*\")*[^\"]*$)/)
+        parts.each do |part|
+          match = /\A\s*([!#$%&'*+.^_`|~0-9A-Za-z-]+)(?:\s*=\s*("[^"\\]*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+))?\s*\z/.match(part)
+          return [0, 0] unless match
+          name = match[1].downcase
+          return [0, 0] if directives.key?(name)
+          directives[name] = match[2]&.delete_prefix('"')&.delete_suffix('"')
+        end
+        return [0, 0] if directives.key?("no-store") || directives.key?("no-cache")
+        # Do not cache variant responses without a full Vary-aware cache key.
+        return [0, 0] if response["vary"] && !response["vary"].strip.empty?
+        numeric = lambda do |name|
+          value = directives[name]
+          value && /\A\d+\z/.match?(value) ? value.to_i : nil
+        end
+        date = response["date"] ? Time.httpdate(response["date"]).to_f : wall
+        age = response["age"] || "0"
+        return [0, 0] unless /\A\d+\z/.match?(age)
+        current_age = [[wall - date, 0].max, age.to_i + delay].max
+        lifetime = if directives.key?("max-age")
+          numeric.call("max-age") or return [0, 0]
+        elsif response["expires"]
+          Time.httpdate(response["expires"]).to_f - date
+        else
+          # No heuristic reuse: absent explicit freshness means fetch on demand.
+          return [0, 0]
+        end
+        if directives.key?("s-maxage")
+          shared_lifetime = numeric.call("s-maxage")
+          return [0, 0] unless shared_lifetime
+          lifetime = [lifetime, shared_lifetime].min
+        end
+        grace = if directives.key?("must-revalidate") || directives.key?("proxy-revalidate") || directives.key?("s-maxage")
+          0
+        elsif directives.key?("stale-if-error")
+          allowance = numeric.call("stale-if-error")
+          return [0, 0] unless allowance
+          [allowance, 60].min
+        else
+          0
+        end
+        [lifetime - current_age, grace]
+      rescue ArgumentError
+        [0, 0]
+      end
+    end
+  end
+end

data/lib/rodauth/ciba/mtls.rb

@@ -0,0 +1,174 @@
+# frozen_string_literal: true
+
+module Rodauth
+  module CibaSupport
+    module Mtls
+      private
+
+      def oauth_server_metadata_body(*)
+        super.tap do |metadata|
+          metadata[:tls_client_certificate_bound_access_tokens] = true if features.include?(:oauth_tls_client_auth)
+        end
+      end
+
+      def ciba_mtls_request?
+        features.include?(:oauth_tls_client_auth) && (ciba_protocol_request? || @ciba_mtls_userinfo ||
+          (features.include?(:oauth_token_introspection) && request.path == introspect_path &&
+            ciba_dpop_userinfo_candidate?(param("token"))))
+      end
+
+      def client_certificate
+        return super unless ciba_mtls_request?
+        return if @ciba_mtls_storing
+        return @ciba_tls_certificate if defined?(@ciba_tls_certificate)
+        value = ciba_tls_client_certificate
+        @ciba_tls_certificate = case value
+                                when nil then nil
+                                when OpenSSL::X509::Certificate then value
+                                when String
+                                  authorization_required if value.bytesize > 16_384
+                                  OpenSSL::X509::Certificate.new(value)
+                                else
+                                  authorization_required
+                                end
+      rescue OpenSSL::X509::CertificateError, ArgumentError
+        authorization_required
+      end
+
+      def ciba_certificate_thumbprint(certificate)
+        Base64.urlsafe_encode64(Digest::SHA256.digest(certificate.to_der), padding: false)
+      end
+
+      def require_oauth_application
+        return super unless ciba_mtls_request?
+        client_id = param_or_nil("client_id")
+        application = client_id && db[oauth_applications_table].where(oauth_applications_client_id_column => client_id).first
+        methods = application ? application[oauth_applications_token_endpoint_auth_method_column].to_s.split : []
+        return super if (methods & %w[tls_client_auth self_signed_tls_client_auth]).empty?
+        # Like the reference registration contract, TLS clients select one
+        # authentication method. Never fall back to upstream header trust.
+        authorization_required unless methods.length == 1
+        method = methods.first
+        authorization_required if request.env["HTTP_AUTHORIZATION"] || request.params.key?("client_secret") || request.params.key?("client_assertion")
+        certificate = client_certificate
+        authorization_required unless certificate
+        if method == "tls_client_auth"
+          authorization_required unless ciba_tls_client_certificate_authorized? == true
+          properties = %i[subject_dn san_dns san_uri san_ip san_email].filter_map do |suffix|
+            name = :"tls_client_auth_#{suffix}"
+            value = application[send(:"oauth_applications_#{name}_column")]
+            [name, value] if value
+          end
+          authorization_required unless properties.length == 1 &&
+            ciba_tls_client_certificate_subject_matches?(*properties.first) == true
+        else
+          authorization_required unless ciba_registered_certificate?(application, certificate)
+        end
+        @oauth_application = application
+      end
+
+      def ciba_registered_certificate?(application, certificate)
+        previous = @ciba_tls_key_lookup
+        @ciba_tls_key_lookup = true
+        jwks = oauth_application_jwks(application)
+        keys = jwks.is_a?(Hash) ? (jwks[:keys] || jwks["keys"]) : jwks
+        unless keys.is_a?(Array) && keys.all? { |key| key.is_a?(Hash) }
+          raise ProtocolError, "invalid_client_metadata"
+        end
+        expected = ciba_certificate_thumbprint(certificate)
+        keys.is_a?(Array) && keys.any? do |jwk|
+          next false unless jwk.is_a?(Hash)
+          chain = jwk[:x5c] || jwk["x5c"]
+          next false unless chain.is_a?(Array) && chain.first.is_a?(String) && chain.first.bytesize <= 24_000
+          registered = OpenSSL::X509::Certificate.new(Base64.strict_decode64(chain.first))
+          OpenSSL.fixed_length_secure_compare(ciba_certificate_thumbprint(registered), expected)
+        end
+      rescue CibaSupport::HTTP::Error, JSON::ParserError, IOError, SystemCallError, Timeout::Error,
+             SocketError, OpenSSL::SSL::SSLError, Net::HTTPBadResponse
+        raise ProtocolError, "invalid_client_metadata"
+      rescue OpenSSL::X509::CertificateError, ArgumentError
+        false
+      ensure
+        @ciba_tls_key_lookup = previous
+      end
+
+      def ciba_certificate_binding_required?
+        # Capability is advertised separately. CIBA binding is a client policy;
+        # leave upstream's global policy in effect only for its other grants.
+        oauth_application[oauth_applications_tls_client_certificate_bound_access_tokens_column]
+      end
+
+      def generate_token(grant_params = {}, should_generate_refresh_token = true)
+        if ciba_mtls_request? && grant_params[oauth_grants_type_column] == GRANT_TYPE && ciba_certificate_binding_required?
+          # Validate before upstream's inner uniqueness transaction can convert a
+          # protocol exception into a response and commit the outer consumption.
+          raise ProtocolError, "invalid_grant" unless client_certificate
+          raise ProtocolError, "invalid_request" if @dpop_claims
+        end
+        super
+      end
+
+      def store_token(grant_params, update_params = {})
+        return super unless ciba_mtls_request? && grant_params[oauth_grants_type_column] == GRANT_TYPE
+        if ciba_certificate_binding_required?
+          update_params = update_params.merge(oauth_grants_certificate_thumbprint_column => ciba_certificate_thumbprint(client_certificate))
+        end
+        # Upstream would replace the certificate digest with a public-key JWK
+        # thumbprint. Supply the completed binding and delegate token persistence.
+        @ciba_mtls_storing = true
+        super(grant_params, update_params)
+      ensure
+        @ciba_mtls_storing = false
+      end
+
+      def authorization_token
+        token = super
+        return token unless token && features.include?(:oauth_tls_client_auth) && request.path == userinfo_path && @ciba_userinfo_grant_id
+        thumbprint = db[oauth_grants_table].where(oauth_grants_id_column => @ciba_userinfo_grant_id,
+          oauth_grants_type_column => GRANT_TYPE).get(oauth_grants_certificate_thumbprint_column)
+        return token unless thumbprint
+        @ciba_mtls_userinfo = true
+        certificate = client_certificate
+        unless certificate && thumbprint == ciba_certificate_thumbprint(certificate)
+          response["WWW-Authenticate"] = 'Bearer error="invalid_token"'
+          ciba_error("invalid_token", 401)
+        end
+        token
+      ensure
+        @ciba_mtls_userinfo = false
+      end
+
+      def json_token_introspect_payload(grant)
+        if features.include?(:oauth_tls_client_auth) && grant && grant.key?("urn:rodauth:ciba:token_id")
+          # Introspection receives verified JWT claims, not the persisted grant.
+          # Resolve its live issuance before reporting certificate binding.
+          id = grant["urn:rodauth:ciba:token_id"]
+          return {active: false} unless id.is_a?(Integer) && id.positive?
+          row = db[oauth_grants_table].where(oauth_grants_id_column => id,
+            oauth_grants_type_column => GRANT_TYPE, oauth_grants_revoked_at_column => nil)
+            .where(Sequel.expr(Sequel[oauth_grants_expires_in_column]) >= Sequel::CURRENT_TIMESTAMP).first
+          return {active: false} unless row
+          application = oauth_application_ds(row[oauth_grants_oauth_application_id_column]).first
+          return {active: false} unless application && application[oauth_applications_client_id_column] == grant["client_id"]
+          subject = row[ciba_token_subject_column] || jwt_subject(row[oauth_grants_account_id_column], application)
+          return {active: false} unless subject == grant["sub"]
+          thumbprint = row[oauth_grants_certificate_thumbprint_column]
+          return {active: false} if thumbprint && grant.dig("cnf", "x5t#S256") != thumbprint
+          # The upstream username resolver otherwise treats a pairwise sub as
+          # a local account key. Preserve the public sub and supply its verified
+          # internal identity only for resolving the upstream response fields.
+          return super(grant.merge(oauth_grants_account_id_column => row[oauth_grants_account_id_column])).tap do |payload|
+            (payload[:cnf] ||= {})["x5t#S256"] = thumbprint if payload[:active] && thumbprint
+          end
+        end
+        super.tap do |payload|
+          if features.include?(:oauth_tls_client_auth) && payload[:active] && grant &&
+              grant[oauth_grants_type_column] == GRANT_TYPE &&
+              (thumbprint = grant[oauth_grants_certificate_thumbprint_column])
+            (payload[:cnf] ||= {})["x5t#S256"] = thumbprint
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rodauth/ciba/pairwise.rb

@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+
+module Rodauth
+  module CibaSupport
+    module PairwiseSubjects
+      def jwt_subject(account_id, application = oauth_application)
+        return super unless application &&
+          application[oauth_applications_grant_types_column].to_s.split.include?(GRANT_TYPE) &&
+          (application[oauth_applications_subject_type_column] || oauth_jwt_subject_type) == "pairwise"
+        sector = ciba_pairwise_sector(application)
+        raise ConfigurationError, "invalid CIBA pairwise client" unless ciba_pairwise_enabled && sector
+        subject = ciba_pairwise_identifier(account_id, oauth_application: application, sector_identifier: sector)
+        unless subject.is_a?(String) && subject.ascii_only? && !subject.empty? && subject.bytesize <= 255
+          raise ConfigurationError, "invalid CIBA pairwise identifier"
+        end
+        subject
+      end
+
+      private
+
+      def fill_with_account_claims(claims, account, scopes, locales)
+        result = super
+        if @ciba_userinfo_grant_id && request.path == userinfo_path && oauth_application &&
+            (oauth_application[oauth_applications_subject_type_column] || oauth_jwt_subject_type) == "pairwise"
+          claims["sub"] = jwt_subject(account[account_id_column], oauth_application)
+        end
+        result
+      end
+
+      def ciba_pairwise_sector(application)
+        return unless ciba_pairwise_enabled
+        authentication = application[oauth_applications_token_endpoint_auth_method_column]
+        return unless authentication == "private_key_jwt" ||
+          (authentication == "self_signed_tls_client_auth" && features.include?(:oauth_tls_client_auth))
+        jwks_uri = application[oauth_applications_jwks_uri_column]
+        return unless ciba_pairwise_uri(jwks_uri)
+        return if application[oauth_applications_jwks_column]
+        sector_uri = application[oauth_applications_sector_identifier_uri_column]
+        responses = application[oauth_applications_response_types_column].to_s.split
+        return if !responses.empty? && !sector_uri
+        uri = sector_uri ? ciba_pairwise_uri(sector_uri, https: true) : ciba_pairwise_uri(jwks_uri)
+        return unless uri
+        # WHATWG URL.host includes a nondefault port, unlike Ruby URI#host.
+        authority = uri.host.downcase
+        authority += ":#{uri.port}" unless uri.port == uri.default_port
+        authority
+      end
+
+      def ciba_pairwise_uri(value, https: false)
+        return unless value.is_a?(String) && !value.empty?
+        uri = URI(value)
+        return unless (https ? uri.scheme == "https" : %w[http https].include?(uri.scheme)) &&
+          uri.host && !uri.userinfo && !uri.fragment
+        uri
+      rescue URI::InvalidURIError
+        nil
+      end
+
+      def ciba_pairwise_sector_document_valid?(application, fresh: false)
+        value = application[oauth_applications_sector_identifier_uri_column]
+        return true unless value
+        redirects = application[oauth_applications_redirect_uri_column].to_s.split
+        required = [application[oauth_applications_jwks_uri_column]]
+        required += redirects unless application[oauth_applications_response_types_column].to_s.empty?
+        # Like node's dynamic-client cache, bind validation to complete client
+        # metadata rather than the document URL. Never cache failed validation.
+        mutex, cache = self.class.instance_variable_get(:@ciba_sector_validation_cache)
+        key = Digest::SHA256.hexdigest(JSON.generate(application.sort_by { |column, _| column.to_s }))
+        cached = !fresh && mutex.synchronize { cache[key] = true if cache.delete(key) }
+        return true if cached
+        uri = ciba_pairwise_uri(value, https: true)
+        return false unless uri
+        response = ciba_pairwise_sector_response(uri)
+        body = JSON.parse(response.body) if response.code.to_i == 200
+        valid = body.is_a?(Array) && body.all? { |entry| entry.is_a?(String) } && (required - body).empty?
+        if valid
+          mutex.synchronize do
+            cache.delete(key)
+            cache[key] = true
+            cache.shift while cache.size > 100
+          end
+        end
+        valid
+      rescue HTTP::Error, JSON::ParserError, IOError, SystemCallError, Timeout::Error,
+             SocketError, OpenSSL::SSL::SSLError, Net::HTTPBadResponse
+        false
+      end
+
+      def ciba_pairwise_sector_response(uri)
+        Timeout.timeout(HTTP::TIMEOUT) do
+          21.times do |redirect_count|
+            response = HTTP.request(uri, Net::HTTP::Get.new(uri.request_uri), address_allowed: method(:ciba_http_address_allowed?))
+            return response unless [301, 302, 303, 307, 308].include?(response.code.to_i) && response["location"]
+            raise HTTP::Error, "too many sector redirects" if redirect_count == 20
+            destination = URI.join(uri.to_s, response["location"]).to_s
+            uri = ciba_pairwise_uri(destination)
+            raise HTTP::Error, "invalid sector redirect URI" unless uri
+          end
+        end
+      rescue URI::InvalidURIError
+        raise HTTP::Error, "invalid sector redirect URI"
+      end
+    end
+  end
+end