shakha 0.2.0 → 0.8.0

data/lib/generators/shakha/install/install_generator.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+require "rails/generators/active_record"
+
+module Shakha
+  module Generators
+    class InstallGenerator < Rails::Generators::Base
+      include ActiveRecord::Generators::Migration
+      source_root File.expand_path("templates", __dir__)
+
+      desc "Installs Shakha — headless OAuth broker for Rails"
+
+      def copy_migration
+        migration_template "create_shakha_tables.rb.erb", "db/migrate/create_shakha_tables.rb"
+      end
+
+      def copy_initializer
+        template "shakha.rb.erb", "config/initializers/shakha.rb"
+      end
+
+      def inject_application_controller
+        path = "app/controllers/application_controller.rb"
+        full_path = File.join(destination_root, path)
+        return unless File.exist?(full_path)
+        return if File.read(full_path).include?("Shakha::ControllerHelpers")
+
+        inject_into_class path, "ApplicationController", "  include Shakha::ControllerHelpers\n"
+        say_status :insert, "ApplicationController -> include Shakha::ControllerHelpers", :green
+      end
+
+      def enable_cookies_for_api_mode
+        return unless api_only_app?
+
+        application "config.middleware.use ActionDispatch::Cookies"
+        say_status :insert, "config/application.rb -> ActionDispatch::Cookies (API mode)", :green
+      end
+
+      def print_post_install
+        origin = Shakha.config.app_origin || "http://localhost:3000"
+
+        say ""
+        say "  Shakha installed!", :green
+        say "  #{'─' * 50}", :green
+        say ""
+        say "  1. Set environment variables:", :yellow
+        say "     GOOGLE_CLIENT_ID", :cyan
+        say "     GOOGLE_CLIENT_SECRET", :cyan
+        say ""
+        say "  2. (Optional) GitHub:", :yellow
+        say "     GITHUB_CLIENT_ID / GITHUB_CLIENT_SECRET", :cyan
+        say ""
+        say "  3. For SPA: set ALLOWED_REDIRECT_ORIGINS", :yellow
+        say ""
+        say "  4. Run migrations:", :yellow
+        say "     bin/rails db:migrate", :cyan
+        say ""
+        say "  5. Google Cloud Console redirect URI:", :yellow
+        say "     #{origin}/auth/shakha/google/callback", :cyan
+        say ""
+        say "  6. GitHub OAuth App callback URL:", :yellow
+        say "     #{origin}/auth/shakha/github/callback", :cyan
+        say "  #{'─' * 50}", :green
+        say ""
+        say "  Tell your frontend dev:", :cyan
+        say "    Sign in:  #{origin}/auth/shakha/google"
+        say "    Session:  GET #{origin}/auth/shakha/session"
+        say "    Auth:     Authorization: Bearer <token>"
+        say "    Sign out: DELETE #{origin}/auth/shakha/sign_out"
+        say ""
+      end
+
+      private
+
+      def migration_version
+        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
+      end
+
+      def api_only_app?
+        path = File.join(destination_root, "config/application.rb")
+        File.exist?(path) && File.read(path).include?("config.api_only = true")
+      end
+    end
+  end
+end

data/lib/generators/shakha/install/templates/create_shakha_tables.rb.erb

@@ -0,0 +1,27 @@
+class CreateShakhaTables < ActiveRecord::Migration<%= migration_version %>
+  def change
+    create_table :shakha_users do |t|
+      t.string :provider, null: false
+      t.string :uid, null: false
+      t.string :email
+      t.string :name
+      t.string :picture
+      t.timestamps
+      t.index [:provider, :uid], unique: true
+      t.index :email
+    end
+
+    create_table :shakha_sessions do |t|
+      t.references :user, foreign_key: { to_table: :shakha_users }
+      t.string :token, null: false
+      t.string :exchange_code
+      t.datetime :exchange_code_expires_at
+      t.string :ip_address
+      t.string :user_agent
+      t.timestamps
+      t.index :token, unique: true
+      t.index :exchange_code, unique: true
+      t.index :created_at
+    end
+  end
+end

data/lib/generators/shakha/install/templates/shakha.rb.erb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+Shakha.setup do |config|
+  # Your Rails app's origin
+  config.app_origin = ENV.fetch("APP_ORIGIN", "http://localhost:3000")
+
+  # Name shown on the built-in sign-in page (Rails monolith flow)
+  # config.app_name = "My App"
+
+  # Allowed frontend origins for the SPA redirect
+  config.allowed_redirect_origins = ENV.fetch("ALLOWED_REDIRECT_ORIGINS", "").split(",")
+
+  # How the session token reaches the frontend after OAuth (default:
+  # :exchange_code). With :exchange_code the callback redirects with a
+  # one-time ?code=..., which the frontend swaps for the token:
+  #   POST /auth/shakha/session/exchange  { "code": "..." }
+  #     -> { "token": "...", "expires_at": "..." }
+  # Set :token to put the token directly in the redirect URL instead
+  # (simpler, but the token is exposed in history/logs/Referer).
+  # config.redirect_token_delivery = :token
+
+  # Google OAuth (required)
+  config.google_client_id     = ENV["GOOGLE_CLIENT_ID"]
+  config.google_client_secret = ENV["GOOGLE_CLIENT_SECRET"]
+
+  # GitHub OAuth (optional — remove from providers if unused)
+  config.github_client_id     = ENV["GITHUB_CLIENT_ID"]
+  config.github_client_secret = ENV["GITHUB_CLIENT_SECRET"]
+
+  # Enabled providers
+  # config.providers = [:google]                # Google only
+  config.providers = [:google, :github]          # Both
+
+  # Session lifetime (default: 30 days)
+  # config.session_lifetime = 30.days
+
+  # Rate limiting (default: false)
+  # config.rate_limiting_enabled = true
+end

data/lib/shakha/config.rb

@@ -3,43 +3,23 @@
 module Shakha
   class Config
     attr_accessor :app_origin,
-                  :service_url,
-                  :service_secret,
+                  :app_name,
                   :google_client_id,
                   :google_client_secret,
-                  :issuer,
+                  :github_client_id,
+                  :github_client_secret,
+                  :providers,
                   :session_lifetime,
-                  :signing_key,
-                  :verification_key,
-                  :key_id,
                   :rate_limiting_enabled,
-                  :allowed_redirect_origins
+                  :allowed_redirect_origins,
+                  :redirect_token_delivery
 
     def initialize
+      @app_name = "Shakha"
       @session_lifetime = 30.days
-      @issuer = "https://shakha.dev"
       @rate_limiting_enabled = false
-    end
-
-    def embedded?
-      service_url.blank?
-    end
-
-    def service_base_url
-      return app_origin if embedded?
-
-      service_url.chomp("/")
-    end
-
-    def client_id
-      return @client_id if defined?(@client_id)
-
-      origin = URI.parse(app_origin).origin
-      @client_id = "origin:#{origin}"
-    end
-
-    def audience
-      client_id
+      @providers = [ :google ]
+      @redirect_token_delivery = :exchange_code
     end
   end
-end
+end

data/lib/shakha/config_validator.rb

@@ -5,10 +5,9 @@ module Shakha
     class << self
       def validate!(config)
         missing = []
-        missing << "SHAKHA_APP_ORIGIN" unless config.app_origin.present?
+        missing << "APP_ORIGIN" unless config.app_origin.present?
         missing << "GOOGLE_CLIENT_ID" unless config.google_client_id.present?
         missing << "GOOGLE_CLIENT_SECRET" unless config.google_client_secret.present?
-        missing << "SHAKHA_SERVICE_SECRET" unless config.service_secret.present?
 
         unless missing.empty?
           message = "Shakha: missing required configuration: #{missing.join(', ')}"

data/lib/shakha/controller_helpers.rb

@@ -7,15 +7,14 @@ module Shakha
     extend ActiveSupport::Concern
 
     included do
-      helper_method :current_session, :current_user, :signed_in?
+      helper_method :current_session, :current_user, :signed_in? if respond_to?(:helper_method)
     end
 
     private
 
     def current_session
       return @current_session if defined?(@current_session)
-
-      @current_session = find_session || authenticate_from_bearer || authenticate_from_cookie
+      @current_session = find_session_from_cookie || find_session_from_bearer
     end
 
     def current_user
@@ -29,42 +28,26 @@ module Shakha
     def authenticate!
       return if signed_in?
 
-      redirect_to shakha.new_auth_path(return_to: request.fullpath)
-    end
-
-    def authenticate_from_bearer
-      return unless (token = bearer_token)
-
-      payload = Shakha.verify_token(token)
-      find_session_by_jti(payload["jti"])
+      if request.format.json?
+        render json: { error: "Authentication required" }, status: :unauthorized
+      else
+        redirect_to "/auth/shakha?return_to=#{CGI.escape(request.fullpath)}"
+      end
     end
 
-    def authenticate_from_cookie
-      find_session_by_token(session_token)
+    def find_session_from_cookie
+      return unless respond_to?(:cookies)
+      token = cookies.encrypted[:shakha_session_token]
+      return unless token
+      Shakha::Session.active.find_by(token: token)
     end
 
-    def bearer_token
-      pattern = /^Bearer /
+    def find_session_from_bearer
       header = request.headers["Authorization"]
-      return unless header&.match?(pattern)
-
-      header.gsub(pattern, "")
-    end
-
-    def session_token
-      request.cookie_jar.encrypted[:shakha_session_token]
-    end
-
-    def find_session
-      return unless (token = session_token)
+      return unless header&.start_with?("Bearer ")
 
+      token = header.delete_prefix("Bearer ")
       Shakha::Session.active.find_by(token: token)
     end
-
-    def find_session_by_jti(jti)
-      return unless jti
-
-      Shakha::Session.active.find_by(jti: jti)
-    end
   end
-end
+end

data/lib/shakha/engine.rb

@@ -4,30 +4,23 @@ module Shakha
   class Engine < ::Rails::Engine
     isolate_namespace Shakha
 
-    config.app_middleware.use Shakha::Middleware
-
     config.after_initialize do
       Shakha::ConfigValidator.validate!(Shakha.config)
     end
 
-    # Engine routes - these should be relative paths
     routes do
       root to: "auth#new"
 
-      get "authorize" => "auth#authorize"
-      get "callback" => "auth#callback"
-      post "token" => "auth#token"
-      get "error" => "auth#error"
-
-      get "session" => "session#show"
-      get "sessions" => "session#index"
-      get "sessions/view" => "session#list"
-      post "session/check" => "session#check"
-      delete "session" => "session#destroy"
-      delete "sessions/:id" => "session#revoke"
+      # Static routes MUST come before dynamic :provider routes
+      get  "session"          => "session#show"
+      get  "session/check"    => "session#check"
+      post "session/exchange" => "session#exchange"
+      delete "sign_out"       => "auth#destroy"
+      get "error"             => "auth#error"
 
-      get ".well-known/jwks.json" => "jwks#show"
-      get ".well-known/openid-configuration" => "openid#configuration"
+      # Dynamic provider routes
+      get ":provider"          => "auth#authorize", as: :authorize
+      get ":provider/callback" => "auth#callback",  as: :callback
     end
   end
-end
+end

data/lib/shakha/error_handler.rb

@@ -8,9 +8,9 @@ module Shakha
 
     included do
       rescue_from ActiveRecord::RecordNotFound, with: :not_found
-      rescue_from Shakha::JWTError, with: :unauthorized
+      rescue_from Shakha::ProviderNotFound, with: :provider_not_found
       rescue_from Shakha::PKCEError, with: :bad_request
-      rescue_from Shakha::GoogleOAuthError, with: :bad_gateway
+      rescue_from Shakha::OAuthError, with: :bad_gateway
     end
 
     private
@@ -19,6 +19,10 @@ module Shakha
       render json: { error: exception.message }, status: :not_found
     end
 
+    def provider_not_found(_exception)
+      render json: { error: "Unknown provider" }, status: :not_found
+    end
+
     def unauthorized(exception)
       render json: { error: "Unauthorized" }, status: :unauthorized
     end
@@ -28,8 +32,8 @@ module Shakha
     end
 
     def bad_gateway(exception)
-      Rails.logger.error("[Shakha] Google OAuth error: #{exception.message}")
+      Rails.logger.error("[Shakha] OAuth error: #{exception.message}")
       render json: { error: "Authentication service unavailable" }, status: :bad_gateway
     end
   end
-end
+end

data/lib/shakha/pkce.rb

@@ -14,7 +14,7 @@ module Shakha
 
     class << self
       def generate_code_verifier
-        SecureRandom.urlsafe_base64(CODE_VERIFIER_LENGTH, padding: false)
+        SecureRandom.urlsafe_base64(CODE_VERIFIER_LENGTH, false)
       end
 
       def generate_code_challenge(verifier)
@@ -32,7 +32,9 @@ module Shakha
       challenge = PKCEMixin.generate_code_challenge(verifier)
       state = SecureRandom.urlsafe_base64(32)
       nonce = SecureRandom.urlsafe_base64(32)
-      return_to = params[:return_to] || "/"
+      # sanitize_return_to is provided by the including controller (AuthController);
+      # validating here means the stored return_to is always safe to redirect to.
+      return_to = sanitize_return_to(params[:return_to])
 
       pkce_record = {
         verifier: verifier,
@@ -81,5 +83,4 @@ module Shakha
   end
 
   class PKCEError < StandardError; end
-  class GoogleOAuthError < StandardError; end
-end
+end

data/lib/shakha/providers/base.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Shakha
+  module Providers
+    class Base
+      def authorize_url(state:, code_challenge:, redirect_uri:, nonce: nil)
+        raise NotImplementedError
+      end
+
+      def exchange_code(code:, code_verifier:, redirect_uri:)
+        raise NotImplementedError
+      end
+
+      def identity_from_response(token_response, expected_nonce: nil)
+        raise NotImplementedError
+      end
+
+      def provider_name
+        raise NotImplementedError
+      end
+
+      def scopes
+        []
+      end
+    end
+  end
+end

data/lib/shakha/providers/github.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "uri"
+
+module Shakha
+  module Providers
+    class GitHub < Base
+      AUTHORIZE_URL = "https://github.com/login/oauth/authorize"
+      TOKEN_URL = "https://github.com/login/oauth/access_token"
+      USER_API_URL = "https://api.github.com/user"
+
+      def provider_name
+        :github
+      end
+
+      # GitHub OAuth has no nonce concept; the keyword is accepted for a
+      # uniform provider interface and ignored.
+      def authorize_url(state:, code_challenge:, redirect_uri:, nonce: nil)
+        params = {
+          client_id: Shakha.config.github_client_id,
+          redirect_uri: redirect_uri,
+          scope: scopes.join(" "),
+          state: state
+        }
+
+        "#{AUTHORIZE_URL}?#{URI.encode_www_form(params)}"
+      end
+
+      def exchange_code(code:, code_verifier:, redirect_uri:)
+        response = http_post(TOKEN_URL, {
+          code: code,
+          client_id: Shakha.config.github_client_id,
+          client_secret: Shakha.config.github_client_secret,
+          redirect_uri: redirect_uri
+        }, accept: :json)
+
+        JSON.parse(response.body)
+      end
+
+      def identity_from_response(token_response, expected_nonce: nil)
+        access_token = token_response["access_token"]
+        raise OAuthError, "No access_token received" unless access_token
+
+        user_data = fetch_user(access_token)
+
+        {
+          provider: :github,
+          uid: user_data["id"].to_s,
+          email: user_data["email"],
+          name: user_data["name"] || user_data["login"],
+          picture: user_data["avatar_url"]
+        }
+      end
+
+      def scopes
+        %w[user:email]
+      end
+
+      private
+
+      def fetch_user(access_token)
+        uri = URI.parse(USER_API_URL)
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = true
+        http.open_timeout = 5
+        http.read_timeout = 10
+
+        request = Net::HTTP::Get.new(uri.request_uri)
+        request["Authorization"] = "Bearer #{access_token}"
+        request["Accept"] = "application/json"
+
+        response = http.request(request)
+        JSON.parse(response.body)
+      end
+
+      def http_post(url, body, accept: :json)
+        uri = URI.parse(url)
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = true
+        http.open_timeout = 5
+        http.read_timeout = 10
+
+        request = Net::HTTP::Post.new(uri.request_uri)
+        request["Accept"] = "application/json" if accept == :json
+        request["Content-Type"] = "application/x-www-form-urlencoded"
+        request.body = URI.encode_www_form(body)
+
+        response = http.request(request)
+
+        unless response.is_a?(Net::HTTPSuccess)
+          raise OAuthError, "GitHub returned HTTP #{response.code}"
+        end
+
+        response
+      rescue Net::OpenTimeout, Net::ReadTimeout, Errno::ECONNREFUSED, SocketError => e
+        raise OAuthError, "Unable to reach GitHub: #{e.message}"
+      end
+    end
+  end
+end

data/lib/shakha/providers/google.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "uri"
+
+module Shakha
+  module Providers
+    class Google < Base
+      AUTHORIZE_URL = "https://accounts.google.com/o/oauth2/v2/auth"
+      TOKEN_URL = "https://oauth2.googleapis.com/token"
+
+      def provider_name
+        :google
+      end
+
+      def authorize_url(state:, code_challenge:, redirect_uri:, nonce: nil)
+        params = {
+          client_id: Shakha.config.google_client_id,
+          redirect_uri: redirect_uri,
+          response_type: "code",
+          scope: scopes.join(" "),
+          code_challenge: code_challenge,
+          code_challenge_method: "S256",
+          state: state,
+          access_type: "offline",
+          prompt: "consent",
+          nonce: nonce
+        }
+
+        "#{AUTHORIZE_URL}?#{URI.encode_www_form(params)}"
+      end
+
+      def exchange_code(code:, code_verifier:, redirect_uri:)
+        response = http_post(TOKEN_URL, {
+          code: code,
+          client_id: Shakha.config.google_client_id,
+          client_secret: Shakha.config.google_client_secret,
+          redirect_uri: redirect_uri,
+          grant_type: "authorization_code",
+          code_verifier: code_verifier
+        })
+
+        JSON.parse(response.body)
+      end
+
+      def identity_from_response(token_response, expected_nonce: nil)
+        id_token = token_response["id_token"]
+        raise OAuthError, "No id_token received" unless id_token
+
+        # Signature is not re-verified: the token comes directly from Google's
+        # token endpoint over a TLS connection we initiated, so its provenance
+        # is the transport. The claims below still need checking.
+        payload = JWT.decode(id_token, nil, false)[0]
+        verify_claims!(payload, expected_nonce)
+
+        {
+          provider: :google,
+          uid: payload["sub"],
+          email: payload["email"],
+          name: payload["name"],
+          picture: payload["picture"]
+        }
+      end
+
+      def scopes
+        %w[openid email profile]
+      end
+
+      private
+
+      VALID_ISSUERS = [ "https://accounts.google.com", "accounts.google.com" ].freeze
+
+      def verify_claims!(payload, expected_nonce)
+        unless VALID_ISSUERS.include?(payload["iss"])
+          raise OAuthError, "ID token issuer mismatch"
+        end
+
+        unless payload["aud"] == Shakha.config.google_client_id
+          raise OAuthError, "ID token audience mismatch"
+        end
+
+        raise OAuthError, "ID token expired" if payload["exp"].to_i <= Time.now.to_i
+
+        if expected_nonce.present? &&
+           !ActiveSupport::SecurityUtils.secure_compare(payload["nonce"].to_s, expected_nonce)
+          raise OAuthError, "ID token nonce mismatch"
+        end
+      end
+
+      def http_post(url, body)
+        uri = URI.parse(url)
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = true
+        http.open_timeout = 5
+        http.read_timeout = 10
+
+        request = Net::HTTP::Post.new(uri.request_uri)
+        request["Content-Type"] = "application/x-www-form-urlencoded"
+        request.body = URI.encode_www_form(body)
+
+        response = http.request(request)
+
+        unless response.is_a?(Net::HTTPSuccess)
+          raise OAuthError, "Google returned HTTP #{response.code}"
+        end
+
+        response
+      rescue Net::OpenTimeout, Net::ReadTimeout, Errno::ECONNREFUSED, SocketError => e
+        raise OAuthError, "Unable to reach Google: #{e.message}"
+      end
+    end
+  end
+end

data/lib/shakha/providers.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require "shakha/providers/base"
+require "shakha/providers/google"
+require "shakha/providers/github"
+
+module Shakha
+  module Providers
+    PROVIDER_MAP = {
+      google: "Shakha::Providers::Google",
+      github: "Shakha::Providers::GitHub"
+    }.freeze
+
+    def self.resolve(name)
+      class_name = PROVIDER_MAP[name.to_sym] || raise(ConfigurationError, "Unknown provider: #{name}")
+      class_name.constantize.new
+    end
+  end
+end