strongmind-auth 1.1.138 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fce6d989dec60e9621d3ef78bd67e54b317e87ea6cebfd1062daed7a7da009cd
-  data.tar.gz: 020d99b5397adc14b1e3583c75185c354c0c50b8dd30d46f39baf02920c3651e
+  metadata.gz: b1c87c87745c0a96b93591482bfb073b7aee75ad305af4acc7d32632e52f2e51
+  data.tar.gz: 5f199cf554635e03c7949ab35ae0e8740ccfef983c1d92fe5d1c72b839367d50
 SHA512:
-  metadata.gz: 5ba8b3b1b22b901a32b8e5d913d7641aa5558bd8fd07d7af9e043e2e373e783dca127ea8eeb987902240f9da504be1a3fe53ddc1b8990efadbd7d80fa480cd11
-  data.tar.gz: d416b410304413e381bb31ff8a7a216d9dcfd6355c55d6ba9126d46be321bedaa6b20fb8a24c63c9fb6035268696a66fbbc0145ceeb233fc199dda3858335c68
+  metadata.gz: c71f32bab0c99a7c87d0b62121d26f61ad8c67841ad67ac80968d2db28cbf1c14e089ea2afc147aaad36a8e2c6040d40fa206db831e9f8f453468d58374a3ef1
+  data.tar.gz: 9aeae95af157a89828bd820983c86b4452b6ad0b48f4096836d69d24d41a533d943a7f74d3eeceec4c209a1155539d9cff0579e18c892feccd59c0d377381a9f

data/app/controllers/concerns/jwt_utilities.rb

@@ -4,6 +4,10 @@
 module JwtUtilities
   extend ActiveSupport::Concern
 
+  # Matches Zitadel's role-grant claim, e.g. "urn:zitadel:iam:org:project:123:roles"
+  # or the project-agnostic "urn:zitadel:iam:org:project:roles".
+  ZITADEL_ROLES_CLAIM_PATTERN = /\Aurn:zitadel:iam:org:project:(?:[^:]+:)?roles\z/.freeze
+
   def jwt_valid?(jwt, condition_key = nil, scopes = [], attributes = [])
     payload = decode_jwt(jwt)
     return false unless payload
@@ -41,6 +45,10 @@ module JwtUtilities
       verify_iat: true,
       verify_iss: true,
       verify_sub: true,
+      # RS256 matches Zitadel's current default signing algorithm.
+      # While Zitadel supports EdDSA (Ed25519), the platform is not currently
+      # configured to use it. When/if that changes, migrate this to EdDSA for
+      # post-quantum resistance. See also: go/auth/middleware.go (strongmind-platform).
       algorithm: 'RS256',
       iss: ENV['IDENTITY_BASE_URL'],
       leeway: 60
@@ -48,7 +56,70 @@ module JwtUtilities
   end
 
   def scope_valid?(payload, scopes)
-    scopes.empty? || (payload['scope'].present? && scopes.all? { |scope| payload['scope'].include?(scope) })
+    return true if scopes.empty?
+
+    legacy_scope_valid?(payload, scopes) || roles_valid?(payload, scopes)
+  end
+
+  def legacy_scope_valid?(payload, scopes)
+    payload['scope'].present? && scopes.all? { |scope| payload['scope'].include?(scope) }
+  end
+
+  # Zitadel roles are provisioned 1-to-1 with the legacy scope strings, so a
+  # required scope is satisfied by a same-named grant in the roles claim.
+  # Comparison is case-insensitive to handle different casing conventions.
+  def roles_valid?(payload, scopes)
+    project_id = ENV['IDENTITY_PROJECT_ID']
+    return false if project_id.blank?
+    return false unless audience_valid?(payload)
+    return false unless project_id_valid?(payload)
+
+    roles = zitadel_roles(payload, project_id)
+    return false unless roles.present?
+
+    normalized_roles = roles.keys.map(&:downcase).to_set
+    scopes.all? { |scope| normalized_roles.include?(scope.downcase) }
+  end
+
+  def zitadel_roles(payload, project_id = nil)
+    payload.keys
+           .select { |key| key.to_s.match?(ZITADEL_ROLES_CLAIM_PATTERN) }
+           .select do |key|
+             claim_project_id = extract_project_id(key)
+             project_id.blank? || claim_project_id.nil? || claim_project_id == project_id
+           end
+           .each_with_object({}) do |key, acc|
+             value = payload[key]
+             acc.merge!(value) if value.is_a?(Hash)
+           end
+           .presence
+  end
+
+  def audience_valid?(payload)
+    aud_list = Array(payload['aud'])
+
+    if ENV['IDENTITY_PROJECT_ID'].present?
+      aud_list.include?(ENV['IDENTITY_PROJECT_ID'])
+    elsif ENV['IDENTITY_CLIENT_ID'].present?
+      aud_list.include?(ENV['IDENTITY_CLIENT_ID'])
+    else
+      true
+    end
+  end
+
+  def project_id_valid?(payload)
+    roles_claims = payload.keys.select { |key| key.to_s.match?(ZITADEL_ROLES_CLAIM_PATTERN) }
+    return true if roles_claims.empty?
+    return true if ENV['IDENTITY_PROJECT_ID'].blank?
+
+    roles_claims.any? do |claim_key|
+      project_id = extract_project_id(claim_key)
+      project_id.nil? || project_id == ENV['IDENTITY_PROJECT_ID']
+    end
+  end
+
+  def extract_project_id(claim_key)
+    claim_key.to_s[/project:([^:]+):/, 1]
   end
 
   def nonce_valid?(payload)

data/app/controllers/users/sessions_controller.rb

@@ -9,11 +9,11 @@ module Users
     skip_before_action :verify_authenticity_token, only: :endsession
 
     def login
-      redirect_to user_strongmind_omniauth_authorize_url, allow_other_host: true
+      redirect_to unauthenticated_root_path
     end
 
     def new
-      redirect_to user_strongmind_omniauth_authorize_url, allow_other_host: true
+      redirect_to unauthenticated_root_path
     end
 
     def endsession
@@ -38,7 +38,7 @@ module Users
   def initiate_backchannel_logout
     Rails.logger.info "[DEBUG] INITIATE BACKCHANNEL LOGOUT - User: #{current_user&.id}, Session: #{session.id}, Refresh Token: #{session[:refresh_token]}"
     
-    redirect_to user_strongmind_omniauth_authorize_url, allow_other_host: true and return unless current_user
+    redirect_to unauthenticated_root_path and return unless current_user
     
     if session[:refresh_token].blank? && current_user&.auth_token_cache.blank?
       Rails.logger.error "[DEBUG] LOGOUT ISSUE DETECTED - User: #{current_user.id}, Session: #{session.id}, No tokens available"

data/lib/strongmind/auth/version.rb

@@ -1,5 +1,5 @@
 module Strongmind
   module Auth
-    VERSION = "1.1.138"
+    VERSION = "1.2.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: strongmind-auth
 version: !ruby/object:Gem::Version
-  version: 1.1.138
+  version: 1.2.0
 platform: ruby
 authors:
 - Team Belding
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-08-15 00:00:00.000000000 Z
+date: 2026-07-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails