strongmind-auth 1.0.17 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 75836642566646ba7a5100a9daedb353288906cf4fbfe229ff73d3217cc12797
-  data.tar.gz: 7907e3c46d657c5776edfd4fd4540b8643309607bee7a5dd616412f72f424e12
+  metadata.gz: 0234d7b4cfe4a3a5d738c6ef9af96622f348ca47b39d9b76ff971b6ebc0bfa8f
+  data.tar.gz: 8ca75096b6b9ed3082f03e4e6a48f9e98f43366fdfc4fdfce72fe3d69c8e0463
 SHA512:
-  metadata.gz: 21b444fbafe788e90b97da758d4bd6f0214764cf3910e1ec5b2765a8ac6a93422a92df009513231b6d1905b52a580b2d528eb47f06026b2b08400b35107bcfb8
-  data.tar.gz: 9fd3e496c494fa37c1a1602b7890c28f744e9510b3e4c74990df8b09a46e90e3cfcf90fa8b807e6e0c3299ba141b682926c10dfc2d58b9fe52469cd777c55583
+  metadata.gz: b8cf1a51d8ebbb13566a382ede82a001284123efc5544d97e71c487efffea08f81bace84f65742eb19f1dbbd7b312187e754dcead6e9e9a5d7f6ee44437285c9
+  data.tar.gz: 619659baf8e51ffd5daafcea330840ce240c0b072856978b491d5f43d2f4f2d0161f9bfdfdf0e9de356ec8383440d1216666acf17e5a4c34c9a804bd29a9b0e7

data/app/controllers/concerns/jwt_utilities.rb

@@ -4,32 +4,14 @@
 module JwtUtilities
   extend ActiveSupport::Concern
 
-  def jwt_valid?(jwt, condition_key = nil, scopes = [])
-    begin
-      payload, _header = JWT.decode(jwt, public_key, true, {
-        verify_iat: true,
-        verify_iss: true,
-        verify_aud: true,
-        verify_sub: true,
-        algorithm: 'RS256',
-        leeway: 60
-      })
-    rescue JWT::DecodeError => e
-      Rails.logger.error e.message
-      return false
-    end
-
-    payload = payload.with_indifferent_access
-
-    unless !scopes.empty? && payload['scope'].present? && payload['scope'].all? { |elem| scopes.include?(elem) }
-      return false
-    end
-
-    return false unless payload['nonce'].nil?
-
-    return false unless condition_key.nil? || payload['events'].key?(condition_key)
-
-    true
+  def jwt_valid?(jwt, condition_key = nil, scopes = [], attributes = [])
+    payload = decode_jwt(jwt)
+    return false unless payload
+
+    scope_valid?(payload,
+                 scopes) && nonce_valid?(payload) && condition_key_valid?(payload,
+                                                                          condition_key) && attributes_valid?(payload,
+                                                                                                              attributes)
   end
 
   def public_key
@@ -42,6 +24,41 @@ module JwtUtilities
 
   private
 
+  def decode_jwt(jwt)
+    payload, _header = JWT.decode(jwt, public_key, true, jwt_decode_options)
+    payload.with_indifferent_access
+  rescue JWT::DecodeError => e
+    Rails.logger.error e.message
+    nil
+  end
+
+  def jwt_decode_options
+    {
+      verify_iat: true,
+      verify_iss: true,
+      verify_aud: true,
+      verify_sub: true,
+      algorithm: 'RS256',
+      leeway: 60
+    }
+  end
+
+  def scope_valid?(payload, scopes)
+    scopes.empty? || (payload['scope'].present? && scopes.all? { |scope| payload['scope'].include?(scope) })
+  end
+
+  def nonce_valid?(payload)
+    payload['nonce'].nil?
+  end
+
+  def condition_key_valid?(payload, condition_key)
+    condition_key.nil? || payload['events'].to_h.key?(condition_key)
+  end
+
+  def attributes_valid?(payload, attributes)
+    attributes.empty? || attributes.all? { |attribute| payload.include?(attribute) }
+  end
+
   def fetch_user_token_info
     user_jwt(session)
   end
@@ -72,7 +89,7 @@ module JwtUtilities
   def validate_tokens(tokens)
     return unless tokens[:error] == 'invalid_grant' || !tokens[:refresh_token]
 
-    raise Strongmind::Exceptions::RefreshTokenExpired, tokens[:error]
+    raise Strongmind::Exceptions::RefreshTokenExpiredError, tokens[:error]
   end
 
   def generate_tokens(session_data)

data/app/controllers/users/sessions_controller.rb

@@ -18,6 +18,7 @@ module Users
 
     def endsession
       headers = { 'Cache-Control' => 'no-store' }
+      Rails.logger.info("endsession called with params: #{params}")
       if jwt_valid?(params[:logout_token], 'http://schemas.openid.net/event/backchannel-logout')
         payload, _header = JWT.decode(params[:logout_token], nil, false)
         user_identity = payload['sub']

data/config/routes.rb

@@ -9,6 +9,7 @@ Rails.application.routes.draw do
 
   devise_scope :user do
     get 'users/sign_out', to: 'users/sessions#initiate_backchannel_logout'
+    post 'users/endsession', to: 'users/sessions#endsession'
 
     unauthenticated do
       root 'logins#index', as: :unauthenticated_root

data/lib/strongmind/auth/version.rb

@@ -1,5 +1,5 @@
 module Strongmind
   module Auth
-    VERSION = "1.0.17"
+    VERSION = "1.1.1"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: strongmind-auth
 version: !ruby/object:Gem::Version
-  version: 1.0.17
+  version: 1.1.1
 platform: ruby
 authors:
 - Team Belding
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-03-18 00:00:00.000000000 Z
+date: 2024-03-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -94,34 +94,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: rspec-rails
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: factory_bot_rails
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 description: Ruby gem for StrongMind authentication in a strongmind app
 email:
 - teambelding@strongmind.com