shakha 0.3.0 → 0.9.0

data/lib/shakha/providers/base.rb

@@ -3,7 +3,7 @@
 module Shakha
   module Providers
     class Base
-      def authorize_url(state:, code_challenge:, redirect_uri:)
+      def authorize_url(state:, code_challenge:, redirect_uri:, nonce: nil)
         raise NotImplementedError
       end
 
@@ -11,7 +11,7 @@ module Shakha
         raise NotImplementedError
       end
 
-      def identity_from_response(token_response)
+      def identity_from_response(token_response, expected_nonce: nil)
         raise NotImplementedError
       end
 

data/lib/shakha/providers/github.rb

@@ -14,7 +14,9 @@ module Shakha
         :github
       end
 
-      def authorize_url(state:, code_challenge:, redirect_uri:)
+      # GitHub OAuth has no nonce concept; the keyword is accepted for a
+      # uniform provider interface and ignored.
+      def authorize_url(state:, code_challenge:, redirect_uri:, nonce: nil)
         params = {
           client_id: Shakha.config.github_client_id,
           redirect_uri: redirect_uri,
@@ -36,7 +38,7 @@ module Shakha
         JSON.parse(response.body)
       end
 
-      def identity_from_response(token_response)
+      def identity_from_response(token_response, expected_nonce: nil)
         access_token = token_response["access_token"]
         raise OAuthError, "No access_token received" unless access_token
 

data/lib/shakha/providers/google.rb

@@ -13,7 +13,7 @@ module Shakha
         :google
       end
 
-      def authorize_url(state:, code_challenge:, redirect_uri:)
+      def authorize_url(state:, code_challenge:, redirect_uri:, nonce: nil)
         params = {
           client_id: Shakha.config.google_client_id,
           redirect_uri: redirect_uri,
@@ -24,7 +24,7 @@ module Shakha
           state: state,
           access_type: "offline",
           prompt: "consent",
-          nonce: SecureRandom.urlsafe_base64(32)
+          nonce: nonce
         }
 
         "#{AUTHORIZE_URL}?#{URI.encode_www_form(params)}"
@@ -43,11 +43,15 @@ module Shakha
         JSON.parse(response.body)
       end
 
-      def identity_from_response(token_response)
+      def identity_from_response(token_response, expected_nonce: nil)
         id_token = token_response["id_token"]
         raise OAuthError, "No id_token received" unless id_token
 
+        # Signature is not re-verified: the token comes directly from Google's
+        # token endpoint over a TLS connection we initiated, so its provenance
+        # is the transport. The claims below still need checking.
         payload = JWT.decode(id_token, nil, false)[0]
+        verify_claims!(payload, expected_nonce)
 
         {
           provider: :google,
@@ -64,6 +68,25 @@ module Shakha
 
       private
 
+      VALID_ISSUERS = [ "https://accounts.google.com", "accounts.google.com" ].freeze
+
+      def verify_claims!(payload, expected_nonce)
+        unless VALID_ISSUERS.include?(payload["iss"])
+          raise OAuthError, "ID token issuer mismatch"
+        end
+
+        unless payload["aud"] == Shakha.config.google_client_id
+          raise OAuthError, "ID token audience mismatch"
+        end
+
+        raise OAuthError, "ID token expired" if payload["exp"].to_i <= Time.now.to_i
+
+        if expected_nonce.present? &&
+           !ActiveSupport::SecurityUtils.secure_compare(payload["nonce"].to_s, expected_nonce)
+          raise OAuthError, "ID token nonce mismatch"
+        end
+      end
+
       def http_post(url, body)
         uri = URI.parse(url)
         http = Net::HTTP.new(uri.host, uri.port)

data/lib/shakha/providers.rb

@@ -11,9 +11,29 @@ module Shakha
       github: "Shakha::Providers::GitHub"
     }.freeze
 
-    def self.resolve(name)
-      class_name = PROVIDER_MAP[name.to_sym] || raise(ConfigurationError, "Unknown provider: #{name}")
-      class_name.constantize.new
+    @registry = PROVIDER_MAP.dup
+
+    class << self
+      # Registers a provider under +name+. +klass+ is a Providers::Base
+      # subclass or its name as a String (a String survives code reloading in
+      # development). Registering an existing name replaces it.
+      def register(name, klass)
+        @registry[name.to_sym] = klass
+      end
+
+      def registered
+        @registry.keys
+      end
+
+      def resolve(name)
+        klass = @registry[name.to_sym] || raise(ConfigurationError, "Unknown provider: #{name}")
+        klass = klass.constantize if klass.is_a?(String)
+        klass.new
+      end
+
+      def reset!
+        @registry = PROVIDER_MAP.dup
+      end
     end
   end
 end

data/lib/shakha/rate_limiter.rb

@@ -5,8 +5,8 @@ module Shakha
     extend ActiveSupport::Concern
 
     included do
-      before_action :check_rate_limit_authorize, only: [:authorize]
-      before_action :check_rate_limit_token, only: [:token]
+      before_action :check_rate_limit_authorize, only: [ :authorize ]
+      before_action :check_rate_limit_callback, only: [ :callback ]
     end
 
     private
@@ -15,15 +15,15 @@ module Shakha
       check_rate_limit("authorize", max: 20, period: 1.minute)
     end
 
-    def check_rate_limit_token
-      check_rate_limit("token", max: 10, period: 1.minute)
+    def check_rate_limit_callback
+      check_rate_limit("callback", max: 10, period: 1.minute)
     end
 
     def check_rate_limit(key, max:, period:)
       return unless Shakha.config.rate_limiting_enabled
 
       cache_key = "shakha-rate:#{key}:#{request.remote_ip}"
-      count = Rails.cache.increment(cache_key, 1, expires_in: period.seconds)
+      count = Rails.cache.increment(cache_key, 1, expires_in: period.seconds) || 1
 
       if count > max
         render json: { error: "Too many requests. Try again later." }, status: :too_many_requests

data/lib/shakha/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Shakha
-  VERSION = "0.3.0"
-end
+  VERSION = "0.9.0"
+end

data/lib/shakha.rb

@@ -24,4 +24,5 @@ module Shakha
   class ConfigurationError < StandardError; end
   class PKCEError < StandardError; end
   class OAuthError < StandardError; end
-end
+  class ProviderNotFound < StandardError; end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: shakha
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.9.0
 platform: ruby
 authors:
 - Asrat
@@ -13,16 +13,22 @@ dependencies:
   name: jwt
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.10.3
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '2.7'
+        version: '3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.10.3
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '2.7'
+        version: '3'
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement
@@ -64,25 +70,27 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '10'
 description: |
-  Shakha is a headless authentication broker gem for Rails that handles Google OAuth 2.0
-  with PKCE security. It provides domain-scoped user identifiers via pairwise subjects,
-  ensuring the same Google account gets different IDs across different applications.
-
-  Built DHH-style: database sessions (no Redis), Turbo native (zero JS), and a single
-  "Continue with Google" button. Works as an embedded Rails engine or standalone service.
+  Shakha is a headless OAuth broker engine for Rails APIs and monoliths.
+  Your frontend does a single redirect; Shakha runs the OAuth dance
+  (PKCE, state) against Google or GitHub, stores a revocable
+  database-backed session, and redirects back with a session token usable
+  via encrypted cookie or Authorization: Bearer. No JWTs issued, no Redis,
+  no frontend SDK. Pre-1.0: APIs and security posture still evolving.
 email:
-- asrat@example.com
+- asratextras77@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - LICENSE.txt
 - README.md
+- SECURITY.md
 - app/assets/stylesheets/shakha.css
 - app/controllers/shakha/application_controller.rb
 - app/controllers/shakha/auth_controller.rb
 - app/controllers/shakha/session_controller.rb
-- app/models/shakha/client.rb
+- app/controllers/shakha/sessions_controller.rb
 - app/models/shakha/session.rb
 - app/models/shakha/user.rb
 - app/views/shakha/auth/callback.html.erb
@@ -90,9 +98,9 @@ files:
 - app/views/shakha/auth/new.html.erb
 - app/views/shakha/errors/show.html.erb
 - app/views/shakha/layouts/shakha.html.erb
-- lib/generators/shakha/install_generator.rb
-- lib/generators/shakha/templates/initializer.rb.erb
-- lib/generators/shakha/templates/migration.rb.erb
+- lib/generators/shakha/install/install_generator.rb
+- lib/generators/shakha/install/templates/create_shakha_tables.rb.erb
+- lib/generators/shakha/install/templates/shakha.rb.erb
 - lib/shakha.rb
 - lib/shakha/config.rb
 - lib/shakha/config_validator.rb
@@ -106,11 +114,15 @@ files:
 - lib/shakha/providers/google.rb
 - lib/shakha/rate_limiter.rb
 - lib/shakha/version.rb
-homepage: https://shakha.dev
+homepage: https://github.com/Asrat77/shakha
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://shakha.dev
+  homepage_uri: https://github.com/Asrat77/shakha
+  source_code_uri: https://github.com/Asrat77/shakha
+  changelog_uri: https://github.com/Asrat77/shakha/blob/master/CHANGELOG.md
+  bug_tracker_uri: https://github.com/Asrat77/shakha/issues
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -127,5 +139,5 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 3.6.9
 specification_version: 4
-summary: Headless Google OAuth broker with PKCE, pairwise subjects, and zero JavaScript
+summary: SPA-first OAuth session broker for Rails — one redirect, one token, done
 test_files: []

data/app/models/shakha/client.rb

@@ -1,16 +0,0 @@
-# frozen_string_literal: true
-
-module Shakha
-  class Client < ::ApplicationRecord
-    self.table_name = "shakha_clients"
-
-    has_many :sessions, class_name: "Shakha::Session", dependent: :restrict_with_error
-    has_many :users, class_name: "Shakha::User", dependent: :nullify
-
-    validates :origin, presence: true, uniqueness: true
-
-    def self.find_by_origin!(origin)
-      find_by!(origin: URI.parse(origin).origin)
-    end
-  end
-end

data/lib/generators/shakha/install_generator.rb

@@ -1,25 +0,0 @@
-# frozen_string_literal: true
-
-module Shakha
-  class InstallGenerator < Rails::Generators::Base
-    source_root File.expand_path("templates", __dir__)
-
-    class_option :skip_migration, type: :boolean, default: false, desc: "Skip migration generation"
-
-    def copy_initializer
-      template "initializer.rb.erb", "config/initializers/shakha.rb"
-    end
-
-    def create_migration
-      return if options[:skip_migration]
-
-      sleep 1
-      migration_number = Time.now.strftime("%Y%m%d%H%M%S")
-      template "migration.rb.erb", "db/migrate/#{migration_number}_create_shakha_tables.rb"
-    end
-
-    def add_routes
-      route 'mount Shakha::Engine => "/auth/shakha", as: :shakha'
-    end
-  end
-end

data/lib/generators/shakha/templates/initializer.rb.erb

@@ -1,29 +0,0 @@
-# frozen_string_literal: true
-
-# Shakha Auth Configuration
-#
-# Set these environment variables:
-#   SHAKHA_SERVICE_SECRET - Secret key for pairwise subject derivation (HMAC-SHA256)
-#   GOOGLE_CLIENT_ID      - Google OAuth client ID
-#   GOOGLE_CLIENT_SECRET  - Google OAuth client secret
-#   SHAKHA_APP_ORIGIN     - Your application's origin (e.g., http://localhost:3000)
-#   SHAKHA_SERVICE_URL    - Optional: URL of standalone Shakha service (omit for embedded mode)
-#
-# For ES256 JWT signing, set either:
-#   SHAKHA_SIGNING_KEY     - EC P-256 private key in PEM or base64 format
-#   SHAKHA_KEY_ID         - Key ID for JWKS (optional, defaults to "default")
-
-Shakha.setup do |config|
-  config.app_origin = ENV.fetch("SHAKHA_APP_ORIGIN", "http://localhost:3000")
-  config.service_url = ENV["SHAKHA_SERVICE_URL"]
-  config.service_secret = ENV["SHAKHA_SERVICE_SECRET"]
-  config.google_client_id = ENV["GOOGLE_CLIENT_ID"]
-  config.google_client_secret = ENV["GOOGLE_CLIENT_SECRET"]
-  config.issuer = ENV.fetch("SHAKHA_ISSUER", "https://shakha.dev")
-  config.session_lifetime = 30.days
-
-  # JWT signing keys (required for service mode)
-  config.signing_key = ENV["SHAKHA_SIGNING_KEY"]
-  config.verification_key = ENV["SHAKHA_VERIFICATION_KEY"]
-  config.key_id = ENV["SHAKHA_KEY_ID"] || "default"
-end

data/lib/generators/shakha/templates/migration.rb.erb

@@ -1,45 +0,0 @@
-# frozen_string_literal: true
-
-class CreateShakhaTables < ActiveRecord::Migration[7.1]
-  def change
-    create_table :shakha_clients do |t|
-      t.string :name, null: false
-      t.string :origin, null: false
-      t.string :client_id
-      t.json :metadata, default: {}
-
-      t.timestamps
-    end
-
-    add_index :shakha_clients, :origin, unique: true
-    add_index :shakha_clients, :client_id, unique: true
-
-    create_table :shakha_users do |t|
-      t.string :pairwise_sub, null: false
-      t.string :email
-      t.string :name
-      t.string :picture
-      t.references :client, null: false
-
-      t.timestamps
-    end
-
-    add_index :shakha_users, :pairwise_sub, unique: true
-    add_index :shakha_users, :email
-
-    create_table :shakha_sessions do |t|
-      t.string :token, null: false
-      t.string :jti, null: false
-      t.references :user, null: false
-      t.references :client, null: false
-      t.string :ip_address
-      t.string :user_agent
-
-      t.timestamps
-    end
-
-    add_index :shakha_sessions, :token, unique: true
-    add_index :shakha_sessions, :jti, unique: true
-    add_index :shakha_sessions, :created_at
-  end
-end