strongmind-auth 1.1.142 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 285c55e9de3ac83079fe636603534b725591b48ee91dd73fd3ddf456040ed2f0
-  data.tar.gz: 6f36438062533f4b83062a04fcdb976a1ac51227018dafdd8bb831729b88f095
+  metadata.gz: b1c87c87745c0a96b93591482bfb073b7aee75ad305af4acc7d32632e52f2e51
+  data.tar.gz: 5f199cf554635e03c7949ab35ae0e8740ccfef983c1d92fe5d1c72b839367d50
 SHA512:
-  metadata.gz: 0b049b9ced1a5e3898e22f512b73456e9ca9dfc562420b8d3a27de1ba58d0b20403a037bf16c9b8d26aae6974434cda1a440c121e3a557e579822c58cb218ecd
-  data.tar.gz: b973f2023815ddd688c345da9a7db8385c337e3d736bb8a80eefd7638efbdd1d7780217fac292b3c8c337cfa0b4c941f8df0b25f6e68eb7e1481991fcd5aae86
+  metadata.gz: c71f32bab0c99a7c87d0b62121d26f61ad8c67841ad67ac80968d2db28cbf1c14e089ea2afc147aaad36a8e2c6040d40fa206db831e9f8f453468d58374a3ef1
+  data.tar.gz: 9aeae95af157a89828bd820983c86b4452b6ad0b48f4096836d69d24d41a533d943a7f74d3eeceec4c209a1155539d9cff0579e18c892feccd59c0d377381a9f

data/app/controllers/concerns/jwt_utilities.rb

@@ -4,6 +4,10 @@
 module JwtUtilities
   extend ActiveSupport::Concern
 
+  # Matches Zitadel's role-grant claim, e.g. "urn:zitadel:iam:org:project:123:roles"
+  # or the project-agnostic "urn:zitadel:iam:org:project:roles".
+  ZITADEL_ROLES_CLAIM_PATTERN = /\Aurn:zitadel:iam:org:project:(?:[^:]+:)?roles\z/.freeze
+
   def jwt_valid?(jwt, condition_key = nil, scopes = [], attributes = [])
     payload = decode_jwt(jwt)
     return false unless payload
@@ -41,6 +45,10 @@ module JwtUtilities
       verify_iat: true,
       verify_iss: true,
       verify_sub: true,
+      # RS256 matches Zitadel's current default signing algorithm.
+      # While Zitadel supports EdDSA (Ed25519), the platform is not currently
+      # configured to use it. When/if that changes, migrate this to EdDSA for
+      # post-quantum resistance. See also: go/auth/middleware.go (strongmind-platform).
       algorithm: 'RS256',
       iss: ENV['IDENTITY_BASE_URL'],
       leeway: 60
@@ -48,7 +56,70 @@ module JwtUtilities
   end
 
   def scope_valid?(payload, scopes)
-    scopes.empty? || (payload['scope'].present? && scopes.all? { |scope| payload['scope'].include?(scope) })
+    return true if scopes.empty?
+
+    legacy_scope_valid?(payload, scopes) || roles_valid?(payload, scopes)
+  end
+
+  def legacy_scope_valid?(payload, scopes)
+    payload['scope'].present? && scopes.all? { |scope| payload['scope'].include?(scope) }
+  end
+
+  # Zitadel roles are provisioned 1-to-1 with the legacy scope strings, so a
+  # required scope is satisfied by a same-named grant in the roles claim.
+  # Comparison is case-insensitive to handle different casing conventions.
+  def roles_valid?(payload, scopes)
+    project_id = ENV['IDENTITY_PROJECT_ID']
+    return false if project_id.blank?
+    return false unless audience_valid?(payload)
+    return false unless project_id_valid?(payload)
+
+    roles = zitadel_roles(payload, project_id)
+    return false unless roles.present?
+
+    normalized_roles = roles.keys.map(&:downcase).to_set
+    scopes.all? { |scope| normalized_roles.include?(scope.downcase) }
+  end
+
+  def zitadel_roles(payload, project_id = nil)
+    payload.keys
+           .select { |key| key.to_s.match?(ZITADEL_ROLES_CLAIM_PATTERN) }
+           .select do |key|
+             claim_project_id = extract_project_id(key)
+             project_id.blank? || claim_project_id.nil? || claim_project_id == project_id
+           end
+           .each_with_object({}) do |key, acc|
+             value = payload[key]
+             acc.merge!(value) if value.is_a?(Hash)
+           end
+           .presence
+  end
+
+  def audience_valid?(payload)
+    aud_list = Array(payload['aud'])
+
+    if ENV['IDENTITY_PROJECT_ID'].present?
+      aud_list.include?(ENV['IDENTITY_PROJECT_ID'])
+    elsif ENV['IDENTITY_CLIENT_ID'].present?
+      aud_list.include?(ENV['IDENTITY_CLIENT_ID'])
+    else
+      true
+    end
+  end
+
+  def project_id_valid?(payload)
+    roles_claims = payload.keys.select { |key| key.to_s.match?(ZITADEL_ROLES_CLAIM_PATTERN) }
+    return true if roles_claims.empty?
+    return true if ENV['IDENTITY_PROJECT_ID'].blank?
+
+    roles_claims.any? do |claim_key|
+      project_id = extract_project_id(claim_key)
+      project_id.nil? || project_id == ENV['IDENTITY_PROJECT_ID']
+    end
+  end
+
+  def extract_project_id(claim_key)
+    claim_key.to_s[/project:([^:]+):/, 1]
   end
 
   def nonce_valid?(payload)

data/lib/strongmind/auth/version.rb

@@ -1,5 +1,5 @@
 module Strongmind
   module Auth
-    VERSION = "1.1.142"
+    VERSION = "1.2.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: strongmind-auth
 version: !ruby/object:Gem::Version
-  version: 1.1.142
+  version: 1.2.0
 platform: ruby
 authors:
 - Team Belding
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-04-01 00:00:00.000000000 Z
+date: 2026-07-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails