ruby_jwk 0.1.0 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 23921b96849d38f01a575f59134abbe026c6848c1cbc4c460c27d92bcf77a809
-  data.tar.gz: b787be04a11e0ffbf0fe9f3c1418747589f60563a7067e8910a741b6b56a6335
+  metadata.gz: acbc90c2694f4c2e36ad46ef10bad76f202bcbcaf2475ffc6a8abfdc54ea79ff
+  data.tar.gz: 5418fc821dee941ba7dfda69871e068a42303a35b43ab710cf8166d50037a619
 SHA512:
-  metadata.gz: 1dab2c10dcb374bd786b21e244105bd1ef391416838f5736d6fc168a8dcf57a5ac19e3aaabeb37968f230a6bf8fd26b6e49cbb0e9027b79342443bdeaa06d400
-  data.tar.gz: d06b10422d2f8b94def06b55fe6653c818535bed789c83f5cafaf06ed74ca3807bded3fa14d2161f4294aea985cde3c653abb856e9764a3e40dfb18a0fc955b2
+  metadata.gz: 1c772e723e5d79550bf4e373a5f7fe319ae22223c53968d303f8936f7eb1fe47f08b78964b69fee2915421a330fea872af0b6e02753b0a0b06b72e5525e54320
+  data.tar.gz: 546ddbdddde062611a4644644052fb97690433bfc22c6b5afebfe8b5167885202eec2a01d958e79517e9ec8d5e5582940024916e3862ecd996fce45a23676162

data/README.md

@@ -1,5 +1,5 @@
 # RubyJwk
-Authenticate JWKs via public JWT enspoint
+Authenticate JWT with JWKs. 
 
 ## Usage
 How to use my plugin.
@@ -20,6 +20,47 @@ Or install it yourself as:
 ```bash
 $ gem install ruby_jwk
 ```
+## Getting started
+
+Authentication system exposes a JWKS endpoint for each tenant, which looks like `https://YOUR_DOMAIN/.well-known/jwks.json`. This endpoint will contain the JWK used to verify all Authentication JWTs for this tenant. This endpoint has to be configured like below in initializer file. 
+
+```ruby
+RubyJwk.jwk_url = 'https://YOUR_DOMAIN/.well-known/jwks.json'
+RubyJwk.skip_issuers = [] # to skip authentication for certain issuers
+```
+
+Suppose each tenant has different endpoint then configure it as below. Here `:tenant_name` gets replaced by `tenant` attribute in JWT payload. 
+
+```ruby
+RubyJwk.jwk_url = 'https://:tenant_name/.well-known/jwks.json'
+```
+
+To set up a controller with tenant authentication, just add this before_action
+
+```ruby
+ class ApplicationController < ActionController::API
+   include RubyJwk::Authenticate
+   before_action :authenticate_tenant!
+end
+```
+To get the JWT payload, use the following helper:
+```ruby
+jwt_payload
+```
+
+To get tenant name from JWT, use the following helper:
+```ruby
+jwt_tenant_name
+```
+
+### Token verification 
+Currently, we support below verifications
+* Signature
+* Token expiry
+* nbf
+
+## Reference
+https://blog.unathichonco.com/verifying-jwts-with-jwks-in-ruby
 
 ## Contributing
 Contribution directions go here.

data/app/controllers/concerns/ruby_jwk/authenticate.rb

@@ -1,19 +1,29 @@
 module RubyJwk
   module Authenticate
     def authenticate_tenant!
-      return if RubyJwk.skip_issuers.to_a.include?(payload[:iss])
+      return if RubyJwk.skip_issuers.to_a.include?(jwt_payload['iss'])
 
-      JWT.decode(token, nil, true, { algorithm: 'RS256', jwks: jwk_loader})
+      JWT.decode(jwt_token, nil, true, { algorithm: 'RS256', jwks: jwk_loader})
     rescue JWT::DecodeError => e
       render status: 401, json: error_response_template("Authentication failed! - #{e.message}")
     end
 
     def jwt_payload
-      @jwt_payload ||= JWT.decode(token, nil, false).first
+      @jwt_payload ||= JWT.decode(jwt_token, nil, false).first
     rescue JWT::DecodeError => e
       render status: 401, json: error_response_template("Authentication failed! - #{e.message}")
     end
 
+    def jwt_tenant_name
+      @jwt_payload.dig('tenant')
+    end
+
+    def jwt_token
+      return unless auth_header.starts_with?('Bearer ')
+
+      auth_header.to_s.gsub('Bearer ', '')
+    end
+
     private
 
     # invalidate becomes true when kid not found
@@ -30,10 +40,6 @@ module RubyJwk
       end
     end
 
-    def tenant_name
-      @payload.fetch('tenant')
-    end
-
     def error_response_template(msg)
       {
         error: {
@@ -48,11 +54,5 @@ module RubyJwk
     def auth_header
       request.headers['Authorization'].to_s
     end
-
-    def token
-      return unless auth_header.starts_with?('Bearer ')
-
-      auth_header.to_s.gsub('Bearer ', '')
-    end
   end
 end

data/app/controllers/ruby_jwk/application_controller.rb

@@ -1,7 +1,4 @@
 module RubyJwk
   class ApplicationController < ::ApplicationController
-    def authenticate_tenant!
-      byebug
-    end
   end
 end

data/lib/ruby_jwk/version.rb

@@ -1,3 +1,3 @@
 module RubyJwk
-  VERSION = '0.1.0'
+  VERSION = '0.1.3'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ruby_jwk
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.3
 platform: ruby
 authors:
 - santhanakarthikeyan
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-02-24 00:00:00.000000000 Z
+date: 2022-02-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails