shakha 0.2.0 → 0.8.0

data/lib/shakha/rate_limiter.rb

@@ -5,8 +5,8 @@ module Shakha
     extend ActiveSupport::Concern
 
     included do
-      before_action :check_rate_limit_authorize, only: [:authorize]
-      before_action :check_rate_limit_token, only: [:token]
+      before_action :check_rate_limit_authorize, only: [ :authorize ]
+      before_action :check_rate_limit_callback, only: [ :callback ]
     end
 
     private
@@ -15,15 +15,15 @@ module Shakha
       check_rate_limit("authorize", max: 20, period: 1.minute)
     end
 
-    def check_rate_limit_token
-      check_rate_limit("token", max: 10, period: 1.minute)
+    def check_rate_limit_callback
+      check_rate_limit("callback", max: 10, period: 1.minute)
     end
 
     def check_rate_limit(key, max:, period:)
       return unless Shakha.config.rate_limiting_enabled
 
       cache_key = "shakha-rate:#{key}:#{request.remote_ip}"
-      count = Rails.cache.increment(cache_key, 1, expires_in: period.seconds)
+      count = Rails.cache.increment(cache_key, 1, expires_in: period.seconds) || 1
 
       if count > max
         render json: { error: "Too many requests. Try again later." }, status: :too_many_requests

data/lib/shakha/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Shakha
-  VERSION = "0.2.0"
-end
+  VERSION = "0.8.0"
+end

data/lib/shakha.rb

@@ -3,14 +3,11 @@
 require "shakha/version"
 require "shakha/config"
 require "shakha/config_validator"
-require "shakha/pairwise"
-require "shakha/jwt_handler"
 require "shakha/pkce"
 require "shakha/rate_limiter"
-require "shakha/auditable"
 require "shakha/error_handler"
 require "shakha/controller_helpers"
-require "shakha/middleware"
+require "shakha/providers"
 require "shakha/engine"
 
 module Shakha
@@ -22,32 +19,10 @@ module Shakha
     def config
       @config ||= Config.new
     end
-
-    def verify_token(id_token, audience: nil)
-      JwtHandler.verify(id_token, audience: audience || default_audience)
-    end
-
-    def sign_token(payload, exp: 24.hours.from_now)
-      JwtHandler.encode(payload, exp: exp)
-    end
-
-    def derive_pairwise_sub(google_sub, client_id = nil)
-      Pairwise.derive(google_sub, client_id || default_client_id)
-    end
-
-    private
-
-    def default_audience
-      "origin:#{config.app_origin&.then { |url| URI.parse(url).origin }}"
-    end
-
-    def default_client_id
-      "origin:#{URI.parse(config.app_origin).origin}"
-    end
   end
 
   class ConfigurationError < StandardError; end
-  class JWTError < StandardError; end
   class PKCEError < StandardError; end
-  class GoogleOAuthError < StandardError; end
-end
+  class OAuthError < StandardError; end
+  class ProviderNotFound < StandardError; end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: shakha
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.8.0
 platform: ruby
 authors:
 - Asrat
@@ -13,16 +13,22 @@ dependencies:
   name: jwt
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.10.3
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '2.7'
+        version: '3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.10.3
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '2.7'
+        version: '3'
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement
@@ -64,56 +70,58 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '10'
 description: |
-  Shakha is a headless authentication broker gem for Rails that handles Google OAuth 2.0
-  with PKCE security. It provides domain-scoped user identifiers via pairwise subjects,
-  ensuring the same Google account gets different IDs across different applications.
-
-  Built DHH-style: database sessions (no Redis), Turbo native (zero JS), and a single
-  "Continue with Google" button. Works as an embedded Rails engine or standalone service.
+  Shakha is a headless OAuth broker engine for Rails APIs and monoliths.
+  Your frontend does a single redirect; Shakha runs the OAuth dance
+  (PKCE, state) against Google or GitHub, stores a revocable
+  database-backed session, and redirects back with a session token usable
+  via encrypted cookie or Authorization: Bearer. No JWTs issued, no Redis,
+  no frontend SDK. Pre-1.0: APIs and security posture still evolving.
 email:
-- asrat@example.com
+- asratextras77@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - LICENSE.txt
 - README.md
+- SECURITY.md
 - app/assets/stylesheets/shakha.css
 - app/controllers/shakha/application_controller.rb
 - app/controllers/shakha/auth_controller.rb
-- app/controllers/shakha/jwks_controller.rb
-- app/controllers/shakha/openid_controller.rb
 - app/controllers/shakha/session_controller.rb
-- app/models/shakha/client.rb
 - app/models/shakha/session.rb
 - app/models/shakha/user.rb
 - app/views/shakha/auth/callback.html.erb
 - app/views/shakha/auth/error.html.erb
 - app/views/shakha/auth/new.html.erb
-- app/views/shakha/auth/sessions.html.erb
 - app/views/shakha/errors/show.html.erb
 - app/views/shakha/layouts/shakha.html.erb
-- lib/generators/shakha/install_generator.rb
-- lib/generators/shakha/templates/initializer.rb.erb
-- lib/generators/shakha/templates/migration.rb.erb
+- lib/generators/shakha/install/install_generator.rb
+- lib/generators/shakha/install/templates/create_shakha_tables.rb.erb
+- lib/generators/shakha/install/templates/shakha.rb.erb
 - lib/shakha.rb
-- lib/shakha/auditable.rb
 - lib/shakha/config.rb
 - lib/shakha/config_validator.rb
 - lib/shakha/controller_helpers.rb
 - lib/shakha/engine.rb
 - lib/shakha/error_handler.rb
-- lib/shakha/jwt_handler.rb
-- lib/shakha/middleware.rb
-- lib/shakha/pairwise.rb
 - lib/shakha/pkce.rb
+- lib/shakha/providers.rb
+- lib/shakha/providers/base.rb
+- lib/shakha/providers/github.rb
+- lib/shakha/providers/google.rb
 - lib/shakha/rate_limiter.rb
 - lib/shakha/version.rb
-homepage: https://shakha.dev
+homepage: https://github.com/Asrat77/shakha
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://shakha.dev
+  homepage_uri: https://github.com/Asrat77/shakha
+  source_code_uri: https://github.com/Asrat77/shakha
+  changelog_uri: https://github.com/Asrat77/shakha/blob/master/CHANGELOG.md
+  bug_tracker_uri: https://github.com/Asrat77/shakha/issues
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -130,5 +138,5 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 3.6.9
 specification_version: 4
-summary: Headless Google OAuth broker with PKCE, pairwise subjects, and zero JavaScript
+summary: SPA-first OAuth session broker for Rails — one redirect, one token, done
 test_files: []

data/app/controllers/shakha/jwks_controller.rb

@@ -1,10 +0,0 @@
-# frozen_string_literal: true
-
-module Shakha
-  class JwksController < ApplicationController
-    def show
-      render json: Shakha::JwtHandler.jwks,
-             content_type: "application/json"
-    end
-  end
-end

data/app/controllers/shakha/openid_controller.rb

@@ -1,21 +0,0 @@
-# frozen_string_literal: true
-
-module Shakha
-  class OpenidController < ApplicationController
-    def configuration
-      render json: {
-        issuer: Shakha.config.issuer,
-        authorization_endpoint: "#{Shakha.config.service_base_url}/auth/shakha/authorize",
-        token_endpoint: "#{Shakha.config.service_base_url}/auth/shakha/token",
-        userinfo_endpoint: "#{Shakha.config.service_base_url}/auth/shakha/session",
-        jwks_uri: "#{Shakha.config.service_base_url}/.well-known/jwks.json",
-        response_types_supported: ["code"],
-        grant_types_supported: ["authorization_code"],
-        code_challenge_methods_supported: ["S256"],
-        subject_types_supported: ["pairwise"],
-        id_token_signing_alg_values_supported: ["ES256"],
-        scopes_supported: ["openid", "email", "profile"]
-      }, content_type: "application/json"
-    end
-  end
-end

data/app/models/shakha/client.rb

@@ -1,20 +0,0 @@
-# frozen_string_literal: true
-
-module Shakha
-  class Client < ::ApplicationRecord
-    self.table_name = "shakha_clients"
-
-    has_many :sessions, class_name: "Shakha::Session", dependent: :restrict_with_error
-    has_many :users, class_name: "Shakha::User", dependent: :nullify
-
-    validates :origin, presence: true, uniqueness: true
-
-    def client_id
-      "origin:#{origin}"
-    end
-
-    def self.find_by_origin!(origin)
-      find_by!(origin: URI.parse(origin).origin)
-    end
-  end
-end

data/app/views/shakha/auth/sessions.html.erb

@@ -1,66 +0,0 @@
-<% content_for :title, "Active Sessions" %>
-
-<div class="sh-layout sh-animate-fade">
-  <div class="sh-card sh-animate-slide" style="max-width: 560px;">
-    <div class="sh-card__header">
-      <div class="sh-brand">
-        <div class="sh-brand__icon">S</div>
-        <div>
-          <div class="sh-brand__name">Active Sessions</div>
-          <div class="sh-brand__subtitle">Manage your signed-in devices</div>
-        </div>
-      </div>
-    </div>
-
-    <div class="sh-sessions">
-      <div class="sh-sessions__header">
-        <span class="sh-sessions__title">Devices</span>
-        <span class="sh-sessions__count"><%= @sessions&.size || 0 %> active</span>
-      </div>
-
-      <% if @sessions&.any? %>
-        <% @sessions.each do |session| %>
-          <div class="sh-session <%= 'sh-session--current' if session.token == @current_token %>">
-            <div class="sh-session__info">
-              <div style="display: flex; align-items: center; gap: var(--sh-space-2);">
-                <% if session.token == @current_token %>
-                  <span class="sh-session__badge">Current</span>
-                <% end %>
-                <span class="sh-session__device">Web Browser</span>
-              </div>
-              <div class="sh-session__meta">
-                <%= session.ip_address || "Unknown IP" %> ·
-                <%= session.created_at.strftime("%b %d, %Y at %I:%M %p") %>
-              </div>
-            </div>
-
-            <% if session.token != @current_token %>
-              <%= button_to revoke_session_path(session.id),
-                  method: :delete,
-                  class: "sh-session__btn",
-                  data: { turbo: false, confirm: "Revoke this session?" } do %>
-                Revoke
-              <% end %>
-            <% end %>
-          </div>
-        <% end %>
-      <% else %>
-        <div class="sh-empty">
-          <div class="sh-empty__icon">
-            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5">
-              <rect x="3" y="11" width="18" height="11" rx="2" ry="2"/>
-              <path d="M7 11V7a5 5 0 0 1 10 0v4"/>
-            </svg>
-          </div>
-          <p>No active sessions found.</p>
-        </div>
-      <% end %>
-    </div>
-
-    <div class="sh-card__footer">
-      <%= link_to "/", class: "sh-link" do %>
-        ← Back to app
-      <% end %>
-    </div>
-  </div>
-</div>

data/lib/generators/shakha/install_generator.rb

@@ -1,25 +0,0 @@
-# frozen_string_literal: true
-
-module Shakha
-  class InstallGenerator < Rails::Generators::Base
-    source_root File.expand_path("templates", __dir__)
-
-    class_option :skip_migration, type: :boolean, default: false, desc: "Skip migration generation"
-
-    def copy_initializer
-      template "initializer.rb.erb", "config/initializers/shakha.rb"
-    end
-
-    def create_migration
-      return if options[:skip_migration]
-
-      sleep 1
-      migration_number = Time.now.strftime("%Y%m%d%H%M%S")
-      template "migration.rb.erb", "db/migrate/#{migration_number}_create_shakha_tables.rb"
-    end
-
-    def add_routes
-      route 'mount Shakha::Engine => "/auth/shakha", as: :shakha'
-    end
-  end
-end

data/lib/generators/shakha/templates/initializer.rb.erb

@@ -1,29 +0,0 @@
-# frozen_string_literal: true
-
-# Shakha Auth Configuration
-#
-# Set these environment variables:
-#   SHAKHA_SERVICE_SECRET - Secret key for pairwise subject derivation (HMAC-SHA256)
-#   GOOGLE_CLIENT_ID      - Google OAuth client ID
-#   GOOGLE_CLIENT_SECRET  - Google OAuth client secret
-#   SHAKHA_APP_ORIGIN     - Your application's origin (e.g., http://localhost:3000)
-#   SHAKHA_SERVICE_URL    - Optional: URL of standalone Shakha service (omit for embedded mode)
-#
-# For ES256 JWT signing, set either:
-#   SHAKHA_SIGNING_KEY     - EC P-256 private key in PEM or base64 format
-#   SHAKHA_KEY_ID         - Key ID for JWKS (optional, defaults to "default")
-
-Shakha.setup do |config|
-  config.app_origin = ENV.fetch("SHAKHA_APP_ORIGIN", "http://localhost:3000")
-  config.service_url = ENV["SHAKHA_SERVICE_URL"]
-  config.service_secret = ENV["SHAKHA_SERVICE_SECRET"]
-  config.google_client_id = ENV["GOOGLE_CLIENT_ID"]
-  config.google_client_secret = ENV["GOOGLE_CLIENT_SECRET"]
-  config.issuer = ENV.fetch("SHAKHA_ISSUER", "https://shakha.dev")
-  config.session_lifetime = 30.days
-
-  # JWT signing keys (required for service mode)
-  config.signing_key = ENV["SHAKHA_SIGNING_KEY"]
-  config.verification_key = ENV["SHAKHA_VERIFICATION_KEY"]
-  config.key_id = ENV["SHAKHA_KEY_ID"] || "default"
-end

data/lib/generators/shakha/templates/migration.rb.erb

@@ -1,45 +0,0 @@
-# frozen_string_literal: true
-
-class CreateShakhaTables < ActiveRecord::Migration[7.1]
-  def change
-    create_table :shakha_clients do |t|
-      t.string :name, null: false
-      t.string :origin, null: false
-      t.string :client_id
-      t.json :metadata, default: {}
-
-      t.timestamps
-    end
-
-    add_index :shakha_clients, :origin, unique: true
-    add_index :shakha_clients, :client_id, unique: true
-
-    create_table :shakha_users do |t|
-      t.string :pairwise_sub, null: false
-      t.string :email
-      t.string :name
-      t.string :picture
-      t.references :client, null: false
-
-      t.timestamps
-    end
-
-    add_index :shakha_users, :pairwise_sub, unique: true
-    add_index :shakha_users, :email
-
-    create_table :shakha_sessions do |t|
-      t.string :token, null: false
-      t.string :jti, null: false
-      t.references :user, null: false
-      t.references :client, null: false
-      t.string :ip_address
-      t.string :user_agent
-
-      t.timestamps
-    end
-
-    add_index :shakha_sessions, :token, unique: true
-    add_index :shakha_sessions, :jti, unique: true
-    add_index :shakha_sessions, :created_at
-  end
-end

data/lib/shakha/auditable.rb

@@ -1,47 +0,0 @@
-# frozen_string_literal: true
-
-module Shakha
-  module Auditable
-    extend ActiveSupport::Concern
-
-    included do
-      after_action :log_sign_in
-      after_action :log_sign_out
-      after_action :log_token_exchange
-    end
-
-    private
-
-    def log_sign_in
-      return unless action_name == "callback" && response.successful? && @current_user
-
-      ActiveSupport::Notifications.instrument("shakha.sign_in", {
-        user_id: @current_user&.id,
-        pairwise_sub: @current_user&.pairwise_sub,
-        client_id: @current_client&.id,
-        ip: request.remote_ip,
-        user_agent: request.user_agent
-      })
-    end
-
-    def log_sign_out
-      return unless action_name == "destroy"
-
-      ActiveSupport::Notifications.instrument("shakha.sign_out", {
-        session_id: @current_session&.id,
-        user_id: @current_session&.user_id,
-        ip: request.remote_ip
-      })
-    end
-
-    def log_token_exchange
-      return unless action_name == "token"
-
-      ActiveSupport::Notifications.instrument("shakha.token_exchange", {
-        ip: request.remote_ip,
-        user_agent: request.user_agent,
-        success: response.successful?
-      })
-    end
-  end
-end

data/lib/shakha/jwt_handler.rb

@@ -1,127 +0,0 @@
-# frozen_string_literal: true
-
-require "jwt"
-
-module Shakha
-  class ConfigurationError < StandardError; end
-  class JWTError < StandardError; end
-
-  class JwtHandler
-    ALGORITHM = "ES256"
-
-    class << self
-      def encode(payload, exp: 24.hours.from_now)
-        secret = signing_key || raise(ConfigurationError, "RSA/EC private key required for signing")
-
-        header = {
-          alg: ALGORITHM,
-          typ: "JWT",
-          kid: key_id
-        }
-
-        payload = payload.with_indifferent_access.merge(
-          iss: Shakha.config.issuer,
-          aud: Shakha.config.audience,
-          iat: Time.current.to_i,
-          exp: exp.to_i,
-          jti: SecureRandom.uuid
-        )
-
-        JWT.encode(payload, secret, ALGORITHM, header)
-      end
-
-      def verify(token, audience: nil)
-        public_key = verification_key || raise(ConfigurationError, "RSA/EC public key required for verification")
-
-        decoded = JWT.decode(
-          token,
-          public_key,
-          true,
-          {
-            algorithm: ALGORITHM,
-            iss: Shakha.config.issuer,
-            aud: audience || Shakha.config.audience,
-            verify_iss: true,
-            verify_aud: true,
-            verify_expiration: true
-          }
-        )
-
-        decoded[0].with_indifferent_access
-      rescue JWT::DecodeError => e
-        raise JWTError, e.message
-      end
-
-      def jwks
-        {
-          keys: [
-            {
-              kty: "EC",
-              crv: "P-256",
-              x: Base64.urlsafe_encode64(public_key_point&.x || public_key_raw_point[0..31], padding: false),
-              y: Base64.urlsafe_encode64(public_key_point&.y || public_key_raw_point[32..63], padding: false),
-              use: "sig",
-              alg: ALGORITHM,
-              kid: key_id
-            }
-          ]
-        }.to_json
-      end
-
-      private
-
-      def signing_key
-        return @signing_key if defined?(@signing_key)
-
-        key_material = Shakha.config.signing_key
-        return @signing_key = nil unless key_material
-
-        if key_material.is_a?(OpenSSL::PKey::EC)
-          @signing_key = key_material
-        elsif key_material.start_with?("-----BEGIN")
-          @signing_key = OpenSSL::PKey::EC.new(key_material)
-        else
-          @signing_key = OpenSSL::PKey::EC.new(Base64.decode64(key_material))
-        end
-      end
-
-      def verification_key
-        return signing_key&.public_key if signing_key
-
-        public_material = Shakha.config.verification_key
-        return nil unless public_materiall
-
-        if public_material.start_with?("-----BEGIN")
-          OpenSSL::PKey::EC.new(public_material)
-        else
-          OpenSSL::PKey::EC.new(Base64.decode64(public_material))
-        end
-      end
-
-      def public_key_point
-        @public_key_point ||= begin
-          key = verification_key || signing_key&.public_key
-          return nil unless key
-
-          group = key.group
-          point = key.public_key
-          { x: point.x, y: point.y }
-        end
-      end
-
-      def public_key_raw_point
-        @public_key_raw_point ||= begin
-          key = verification_key || signing_key&.public_key
-          return nil unless key
-
-          point = key.public_key
-          [point.x, point.y].map { |n| n.to_s(16).rjust(64, "0") }.join.scan(/../).map { |b| b.to_i(16).chr }.join
-        end
-      end
-
-      def key_id
-        Shakha.config.key_id || "default"
-      end
-    end
-  end
-end

data/lib/shakha/middleware.rb

@@ -1,49 +0,0 @@
-# frozen_string_literal: true
-
-module Shakha
-  class Middleware
-    def initialize(app)
-      @app = app
-    end
-
-    def call(env)
-      @env = env
-      @request = ActionDispatch::Request.new(env)
-
-      if verify_token_request?
-        verify_token!
-      else
-        @app.call(env)
-      end
-    end
-
-    private
-
-    attr_reader :request
-
-    def verify_token_request?
-      request.path == "/auth/shakha/token" && request.post?
-    end
-
-    def verify_token!
-      token = extract_token || raise(JWTError, "Missing token")
-      payload = Shakha.verify_token(token)
-
-      @env["shakha.user_id"] = payload[:pairwise_sub]
-      @env["shakha.email"] = payload[:email]
-      @env["shakha.name"] = payload[:name]
-
-      @app.call(@env)
-    rescue JWTError => e
-      [401, { "Content-Type" => "application/json" }, [{ error: e.message }.to_json]]
-    end
-
-    def extract_token
-      if request.content_type == "application/json"
-        JSON.parse(request.body.read)["id_token"]
-      elsif request.params["id_token"].present?
-        request.params["id_token"]
-      end
-    end
-  end
-end