shakha 0.2.0 → 0.8.0

data/app/controllers/shakha/auth_controller.rb

@@ -6,199 +6,102 @@ require "uri"
 module Shakha
   class AuthController < ApplicationController
     include PKCEMixin
-    include Auditable
+    include RateLimiter
 
-    skip_before_action :verify_authenticity_token, only: [:callback, :token]
+    skip_before_action :verify_authenticity_token, only: [ :callback ]
 
     def new
-      @client = find_or_create_client
       @return_to = sanitize_return_to(params[:return_to])
+      @providers = Shakha.config.providers
     end
 
     def authorize
-      params[:return_to] = sanitize_return_to(params[:return_to])
+      provider = resolve_provider
       pkce = create_pkce_bundle
-      @client = find_or_create_client
 
-      google_auth_url = build_google_auth_url(pkce)
+      auth_url = provider.authorize_url(
+        state: pkce[:state],
+        code_challenge: pkce[:challenge],
+        redirect_uri: callback_redirect_uri(provider),
+        nonce: pkce[:nonce]
+      )
 
-      redirect_to google_auth_url, allow_other_host: true
+      redirect_to auth_url, allow_other_host: true
     end
 
     def callback
+      provider = resolve_provider
       pkce_result = verify_pkce!(params[:state])
-      exchange_code_for_tokens(params[:code], pkce_result[:verifier], pkce_result[:return_to], pkce_result[:nonce])
-    rescue PKCEError, GoogleOAuthError => e
-      ActiveSupport::Notifications.instrument("shakha.sign_in_failed", {
-        reason: e.class.name,
-        ip: request.remote_ip
-      })
-      Rails.logger.warn("[Shakha] Auth error: #{e.class}: #{e.message}")
-      redirect_to "/auth/shakha/error?message=#{URI.encode_www_form_component(user_facing_error(e))}"
-    end
-
-    def token
-      code = params[:code]
-      verifier = params[:code_verifier]
-
-      raise PKCEError, "Missing code" unless code
-      raise PKCEError, "Missing code_verifier" unless verifier
-
-      id_token = exchange_code_for_id_token(code, verifier)
-
-      render json: {
-        id_token: id_token,
-        pairwise_sub: id_token_payload(id_token)[:sub],
-        expires_in: 24.hours.to_i
-      }
-    rescue PKCEError, JWTError, GoogleOAuthError => e
-      render json: { error: e.message }, status: :unauthorized
-    end
-
-    def error
-      @message = params[:message] || "Authentication failed"
-    end
-
-    private
-
-    def sanitize_return_to(raw)
-      return "/" if raw.blank?
-
-      uri = URI.parse(raw)
-      app_host = URI.parse(Shakha.config.app_origin).host
 
-      # Must have a path
-      return "/" unless uri.path.present? && uri.path.start_with?("/")
-
-      # If external host, must be in allowed origins
-      if uri.host.present? && uri.host != app_host && !allowed_origin?(uri.origin)
-        return "/"
-      end
-
-      raw
-    rescue URI::InvalidURIError
-      "/"
-    end
+      token_response = provider.exchange_code(
+        code: params[:code],
+        code_verifier: pkce_result[:verifier],
+        redirect_uri: callback_redirect_uri(provider)
+      )
 
-    def allowed_origin?(origin)
-      Shakha.config.allowed_redirect_origins&.include?(origin) || false
-    end
+      identity = provider.identity_from_response(token_response, expected_nonce: pkce_result[:nonce])
+      user = find_or_create_user(provider.provider_name, identity)
+      session_record = create_session(user)
+      set_session_cookie(session_record)
+      redirect_to build_return_url(pkce_result[:return_to], session_record), allow_other_host: true
 
-    def app_origin_host
-      URI.parse(Shakha.config.app_origin).host
+    rescue PKCEError, OAuthError => e
+      handle_auth_failure(e, pkce_result)
     end
 
-    def client_origin_host
-      URI.parse(Shakha.config.service_base_url).host
-    rescue URI::InvalidURIError
-      nil
-    end
+    def destroy
+      current_session&.destroy
+      cookies.delete(:shakha_session_token)
 
-    def user_facing_error(exception)
-      case exception
-      when PKCEError
-        "Authentication failed. Please try again."
-      when GoogleOAuthError
-        "Unable to sign in with Google. Please try again later."
+      if request.format.json?
+        render json: { status: "signed_out" }
       else
-        "An unexpected error occurred. Please try again."
+        redirect_to params[:return_to].presence || "/"
       end
     end
 
-    def find_or_create_client
-      origin = request.origin || Shakha.config.app_origin
-      origin_uri = URI.parse(origin).origin
-
-      if Shakha.config.embedded?
-        Shakha::Client.find_or_create_by!(origin: origin_uri) do |client|
-          client.name = URI.parse(origin).host
-        end
-      else
-        Shakha::Client.find_by!(origin: origin_uri)
-      end
-    rescue ActiveRecord::RecordNotFound
-      raise ConfigurationError, "Unknown client origin: #{origin_uri}. Register this origin in shakha_clients first."
+    def error
+      @message = params[:message] || "Authentication failed"
     end
 
-    def build_google_auth_url(pkce)
-      client_id = Shakha.config.google_client_id || ENV["GOOGLE_CLIENT_ID"]
-      base_url = Shakha.config.service_base_url || "http://localhost:3000"
-      redirect_uri = "#{base_url}/auth/shakha/callback"
+    private
 
-      scopes = ["openid", "email", "profile"].join(" ")
-      scopes += " https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile" if params[:request_pii]
+    def resolve_provider
+      name = (params[:provider] || :google).to_sym
+      raise ProviderNotFound, name.to_s unless Shakha.config.providers.include?(name)
 
-      params = {
-        client_id: client_id,
-        redirect_uri: redirect_uri,
-        response_type: "code",
-        scope: scopes,
-        code_challenge: pkce[:challenge],
-        code_challenge_method: "S256",
-        state: pkce[:state],
-        nonce: pkce[:nonce],
-        access_type: "offline",
-        prompt: "consent"
-      }
+      Shakha::Providers.resolve(name)
+    end
 
-      URI.parse("https://accounts.google.com/o/oauth2/v2/auth").tap do |uri|
-        uri.query = URI.encode_www_form(params)
-      end.to_s
+    # Built from the engine's actual mount point, so Shakha works no matter
+    # where the host app mounts it.
+    def callback_redirect_uri(provider)
+      origin = URI.parse(Shakha.config.app_origin)
+      callback_url(provider: provider.provider_name,
+                   host: origin.host, port: origin.port, protocol: origin.scheme)
     end
 
-    def exchange_code_for_tokens(code, verifier, return_to = "/", expected_nonce = nil)
-      client_id = Shakha.config.google_client_id || ENV["GOOGLE_CLIENT_ID"]
-      client_secret = Shakha.config.google_client_secret || ENV["GOOGLE_CLIENT_SECRET"]
-      base_url = Shakha.config.service_base_url || "http://localhost:3000"
-      redirect_uri = "#{base_url}/auth/shakha/callback"
-
-      response = http_post(
-        "https://oauth2.googleapis.com/token",
-        {
-          code: code,
-          client_id: client_id,
-          client_secret: client_secret,
-          redirect_uri: redirect_uri,
-          grant_type: "authorization_code",
-          code_verifier: verifier
-        }
+    def find_or_create_user(provider_name, identity)
+      user = Shakha::User.find_or_initialize_by(
+        provider: provider_name.to_s,
+        uid: identity[:uid]
       )
-
-      tokens = JSON.parse(response.body)
-      id_token = tokens["id_token"]
-      access_token = tokens["access_token"]
-
-      raise GoogleOAuthError, "No id_token received" unless id_token
-
-      payload = decode_id_token(id_token)
-      google_sub = payload["sub"]
-
-      # Verify nonce (OIDC replay protection)
-      if expected_nonce && payload["nonce"] != expected_nonce
-        raise GoogleOAuthError, "Nonce mismatch"
-      end
-
-      client = find_or_create_client
-      pairwise_sub = Shakha.derive_pairwise_sub(google_sub, client.client_id)
-
-      user = Shakha::User.find_or_initialize_by(pairwise_sub: pairwise_sub, client: client)
-
-      if payload["email"]
-        user.assign_attributes(
-          email: payload["email"],
-          name: payload["name"],
-          picture: payload["picture"]
-        )
-      end
+      user.email = identity[:email]
+      user.name = identity[:name]
+      user.picture = identity[:picture]
       user.save!
+      user
+    end
 
-      session_record = Shakha::Session.create!(
+    def create_session(user)
+      Shakha::Session.create!(
         user: user,
-        client: client,
         ip_address: request.remote_ip,
         user_agent: request.user_agent
       )
+    end
 
+    def set_session_cookie(session_record)
       cookies.encrypted[:shakha_session_token] = {
         value: session_record.token,
         httponly: true,
@@ -206,61 +109,65 @@ module Shakha
         same_site: :lax,
         expires: Shakha.config.session_lifetime.from_now
       }
-
-      redirect_to sanitize_return_to(return_to)
     end
 
-    def exchange_code_for_id_token(code, verifier)
-      client_id = Shakha.config.google_client_id || ENV["GOOGLE_CLIENT_ID"]
-      client_secret = Shakha.config.google_client_secret || ENV["GOOGLE_CLIENT_SECRET"]
-      redirect_uri = "#{Shakha.config.service_base_url}/auth/shakha/callback"
-
-      response = http_post(
-        "https://oauth2.googleapis.com/token",
-        {
-          code: code,
-          client_id: client_id,
-          client_secret: client_secret,
-          redirect_uri: redirect_uri,
-          grant_type: "authorization_code",
-          code_verifier: verifier
-        }
-      )
+    def build_return_url(return_to, session_record)
+      uri = URI.parse(return_to || "/")
+      existing = URI.decode_www_form(uri.query || "").to_h
+
+      if Shakha.config.redirect_token_delivery == :token
+        existing["token"] = session_record.token
+        existing["expires_at"] = session_record.expires_at.iso8601
+      else
+        existing["code"] = session_record.generate_exchange_code!
+      end
 
-      tokens = JSON.parse(response.body)
-      tokens["id_token"] || raise(GoogleOAuthError, "No id_token in response")
+      uri.query = URI.encode_www_form(existing)
+      uri.to_s
     end
 
-    def id_token_payload(id_token)
-      JWT.decode(id_token, nil, false)[0]
+    def handle_auth_failure(exception, pkce_result)
+      return_to = pkce_result&.dig(:return_to) || "/"
+
+      if request.format.json? || api_request?
+        render json: { error: user_facing_error(exception) }, status: :unauthorized
+      else
+        redirect_to "#{return_to}?error=#{URI.encode_www_form_component(user_facing_error(exception))}",
+                    allow_other_host: true
+      end
     end
 
-    def decode_id_token(id_token)
-      JWT.decode(id_token, nil, false)[0]
+    def api_request?
+      request.headers["Accept"]&.include?("application/json")
     end
 
-    def http_post(url, body)
-      uri = URI.parse(url)
-      http = Net::HTTP.new(uri.host, uri.port)
-      http.use_ssl = uri.scheme == "https"
-      http.open_timeout = 5
-      http.read_timeout = 10
+    def sanitize_return_to(raw)
+      return "/" if raw.blank?
 
-      request = Net::HTTP::Post.new(uri.request_uri)
-      request["Content-Type"] = "application/x-www-form-urlencoded"
-      request.body = URI.encode_www_form(body)
+      uri = URI.parse(raw)
+      app_host = URI.parse(Shakha.config.app_origin).host
 
-      response = http.request(request)
+      return "/" unless uri.path.present? && uri.path.start_with?("/")
 
-      unless response.is_a?(Net::HTTPSuccess)
-        Rails.logger.error("[Shakha] Google API error: HTTP #{response.code} — #{response.body.truncate(500)}")
-        raise GoogleOAuthError, "Google returned HTTP #{response.code}"
+      if uri.host.present? && uri.host != app_host && !allowed_origin?(uri.origin)
+        return "/"
       end
 
-      response
-    rescue Net::OpenTimeout, Net::ReadTimeout, Errno::ECONNREFUSED, SocketError => e
-      Rails.logger.error("[Shakha] Network error contacting Google: #{e.message}")
-      raise GoogleOAuthError, "Unable to reach Google authentication service"
+      raw
+    rescue URI::InvalidURIError
+      "/"
+    end
+
+    def allowed_origin?(origin)
+      Shakha.config.allowed_redirect_origins&.include?(origin) || false
+    end
+
+    def user_facing_error(exception)
+      case exception
+      when PKCEError then "Authentication failed. Please try again."
+      when OAuthError then "Unable to sign in. Please try again later."
+      else "An unexpected error occurred. Please try again."
+      end
     end
   end
-end
+end

data/app/controllers/shakha/session_controller.rb

@@ -2,34 +2,35 @@
 
 module Shakha
   class SessionController < ApplicationController
-    include Auditable
-    skip_before_action :verify_authenticity_token, only: [:check]
-
-    def index
-      return render json: { error: "Authentication required" }, status: :unauthorized unless signed_in?
-
-      sessions = current_user.sessions.active.order(created_at: :desc)
-
-      render json: {
-        current_token: current_session.token,
-        sessions: sessions.map { |s|
-          {
-            id: s.id,
-            token: s.token,
-            created_at: s.created_at.iso8601,
-            expires_at: s.expires_at.iso8601,
-            current: s.token == current_session.token
-          }
-        }
-      }
+    skip_before_action :verify_authenticity_token, only: :exchange
+
+    # POST /session/exchange — swap a one-time code for the session token.
+    def exchange
+      session_record = Shakha::Session.exchange(params[:code])
+      if session_record
+        render json: { token: session_record.token,
+                       expires_at: session_record.expires_at.iso8601 }
+      else
+        render json: { error: "Invalid or expired code" }, status: :unauthorized
+      end
     end
 
     def show
+      unless signed_in?
+        return render json: { error: "Authentication required" }, status: :unauthorized
+      end
+
       render json: {
-        user_id: current_user&.pairwise_sub,
-        email: current_user&.email,
-        name: current_user&.name,
-        expires_at: current_session&.expires_at&.iso8601
+        user: {
+          id: current_user.id,
+          email: current_user.email,
+          name: current_user.name,
+          picture: current_user.picture,
+          provider: current_user.provider
+        },
+        session: {
+          expires_at: current_session.expires_at.iso8601
+        }
       }
     end
 
@@ -37,41 +38,8 @@ module Shakha
       if signed_in?
         render json: { status: "active" }
       else
-        render json: {
-          status: "login_required",
-          reason: "no_session"
-        }, status: :unauthorized
-      end
-    end
-
-    def destroy
-      current_session&.destroy
-      cookies.delete(:shakha_session_token)
-
-      respond_to do |format|
-        format.html { redirect_to params[:return_to].presence || "/" }
-        format.json { render json: { status: "signed_out" } }
+        render json: { status: "expired" }, status: :unauthorized
       end
     end
-
-    def list
-      return redirect_to "/auth/shakha" unless signed_in?
-
-      @sessions = current_user.sessions.active.order(created_at: :desc)
-      @current_token = current_session&.token
-    end
-
-    def revoke
-      return render json: { error: "Authentication required" }, status: :unauthorized unless signed_in?
-
-      session = current_user.sessions.find(params[:id])
-      session.destroy
-
-      cookies.delete(:shakha_session_token) if session.token == current_session&.token
-
-      log_session_revoked(session)
-
-      render json: { status: "revoked" }
-    end
   end
-end
+end

data/app/models/shakha/session.rb

@@ -5,13 +5,13 @@ module Shakha
     self.table_name = "shakha_sessions"
 
     belongs_to :user, class_name: "Shakha::User", optional: true
-    belongs_to :client, class_name: "Shakha::Client"
 
     before_create :generate_token
-    before_create :generate_jti
 
     scope :active, -> { where("created_at > ?", Shakha.config.session_lifetime.ago) }
 
+    EXCHANGE_CODE_TTL = 60.seconds
+
     def expired?
       created_at < Shakha.config.session_lifetime.ago
     end
@@ -20,14 +20,34 @@ module Shakha
       created_at + Shakha.config.session_lifetime
     end
 
+    # Issues a short-lived, single-use code the frontend swaps for the session
+    # token, so the token itself never travels in a redirect URL.
+    def generate_exchange_code!
+      update_columns(
+        exchange_code: SecureRandom.urlsafe_base64(32),
+        exchange_code_expires_at: EXCHANGE_CODE_TTL.from_now
+      )
+      exchange_code
+    end
+
+    # Redeems a code for its session, atomically clearing it so a code can be
+    # used at most once even under concurrent requests.
+    def self.exchange(code)
+      return nil if code.blank?
+
+      session = active.where(exchange_code: code)
+                      .where("exchange_code_expires_at > ?", Time.current).first
+      return nil unless session
+
+      claimed = where(id: session.id).where.not(exchange_code: nil)
+                .update_all(exchange_code: nil, exchange_code_expires_at: nil)
+      claimed == 1 ? session : nil
+    end
+
     private
 
     def generate_token
       self.token ||= SecureRandom.urlsafe_base64(32)
     end
-
-    def generate_jti
-      self.jti ||= SecureRandom.uuid
-    end
   end
-end
+end

data/app/models/shakha/user.rb

@@ -4,14 +4,10 @@ module Shakha
   class User < ::ApplicationRecord
     self.table_name = "shakha_users"
 
-    belongs_to :client, class_name: "Shakha::Client"
     has_many :sessions, class_name: "Shakha::Session", dependent: :destroy
 
-    validates :pairwise_sub, presence: true
-    validates :email, uniqueness: { scope: :client_id }, allow_blank: true
-
-    def can_access?(resource)
-      true
-    end
+    validates :provider, presence: true
+    validates :uid, presence: true
+    validates :uid, uniqueness: { scope: :provider }
   end
-end
+end

data/app/views/shakha/auth/new.html.erb

@@ -1,4 +1,4 @@
-<% content_for :title, "Sign in — #{@client&.name || 'Shakha'}" %>
+<% content_for :title, "Sign in — #{Shakha.config.app_name}" %>
 
 <div class="sh-layout sh-animate-fade">
   <div class="sh-card sh-animate-slide">
@@ -6,35 +6,23 @@
       <div class="sh-brand">
         <div class="sh-brand__icon">S</div>
         <div>
-          <div class="sh-brand__name"><%= @client&.name || "Shakha" %></div>
+          <div class="sh-brand__name"><%= Shakha.config.app_name %></div>
           <div class="sh-brand__subtitle">Secure authentication</div>
         </div>
       </div>
 
       <h1 class="sh-heading sh-heading--center">Welcome back</h1>
-      <p class="sh-subheading">Sign in to continue to <%= @client&.name || "your app" %></p>
+      <p class="sh-subheading">Sign in to continue to <%= Shakha.config.app_name %></p>
     </div>
 
     <div class="sh-card__body">
-      <%= link_to shakha.authorize_path(request_pii: 1),
-                  class: "sh-btn sh-btn--google",
-                  data: { turbo: false } do %>
-        <svg class="sh-btn__icon" viewBox="0 0 18 18" aria-hidden="true">
-          <path fill="#4285F4" d="M17.64 9.2c0-.637-.057-1.251-.164-1.84H9v3.481h4.844c-.209 1.125-.843 2.078-1.796 2.717v2.258h2.908c1.702-1.567 2.684-3.875 2.684-6.615z"/>
-          <path fill="#34A853" d="M9 18c2.43 0 4.467-.806 5.956-2.184l-2.908-2.258c-.806.54-1.837.86-3.048.86-2.344 0-4.328-1.584-5.036-3.711H.957v2.332A8.997 8.997 0 0 0 9 18z"/>
-          <path fill="#FBBC05" d="M3.964 10.71A5.41 5.41 0 0 1 3.682 9c0-.593.102-1.17.282-1.71V4.958H.957A8.996 8.996 0 0 0 0 9c0 1.452.348 2.827.957 4.042l3.007-2.332z"/>
-          <path fill="#EA4335" d="M9 3.58c1.321 0 2.508.454 3.44 1.345l2.582-2.58C13.463.891 11.426 0 9 0A8.997 8.997 0 0 0 .957 4.958L3.964 7.29C4.672 5.163 6.656 3.58 9 3.58z"/>
-        </svg>
-        Continue with Google
+      <% @providers.each do |provider| %>
+        <%= link_to "/auth/shakha/#{provider}",
+                    class: "sh-btn sh-btn--#{provider}",
+                    data: { turbo: false } do %>
+          Continue with <%= provider.to_s.titleize %>
+        <% end %>
       <% end %>
-
-      <div class="sh-divider">or</div>
-
-      <p class="sh-text-center" style="color: var(--sh-text-tertiary); font-size: var(--sh-text-sm);">
-        By signing in, you agree to our
-        <a href="#">Terms</a> and
-        <a href="#">Privacy Policy</a>.
-      </p>
     </div>
 
     <div class="sh-card__footer">

data/app/views/shakha/layouts/shakha.html.erb

@@ -4,7 +4,7 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title><%= yield(:title).presence || "Shakha" %></title>
-  <%= stylesheet_link_tag "shakha", "data-turbo-track": "reload" %>
+  <style><%= Shakha::Engine.root.join("app/assets/stylesheets/shakha.css").read.html_safe %></style>
   <%= csrf_meta_tags %>
   <meta name="theme-color" content="#0f0f23" media="(prefers-color-scheme: dark)">
   <meta name="theme-color" content="#ffffff" media="(prefers-color-scheme: light)">