stytch 9.0.0 → 9.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c5075518300c9fb8d82d98b80851825a1bfc72d61b637dbbbc54df07ad4b40f9
-  data.tar.gz: e4abd2aec41c59f9d9605f0c6f43a62d5d4126991cfe89b5e96ad293a33922d5
+  metadata.gz: 833c91cba84e4cbbe5fd094bdf3d7ede5c0b351df7ebfab729fbaacdc181b14a
+  data.tar.gz: eccd3e064c0e2ba7bf0a7cbcc9f60b2aadaf25c0db70bee8c0c13646d30a6842
 SHA512:
-  metadata.gz: 29a88d3485f4cabefe89721a83506e0dcbe64d8864780eec0508da70f5d308a204fa427cd0fb8e0c725c07bb45c20f37d182cb3f75e2694536f562b863a35ce9
-  data.tar.gz: 6eaf332fea8ba9eb38da3af8d6eea7376b947a97e93f6478c0e149cc44d35236d9f148ee42e7179fb83ec6fa743076c806a7fc5b6c9e19e584763a3d2a5a2297
+  metadata.gz: c73c79869bb8e2bd29dac4307aa3dc4ba7b7a1c76eb1d5a780b29e2b62f2abcd2fe64244d654e37c99c160b8b5f1f6f762e02c59ea0510da034ebfb550c8d6ca
+  data.tar.gz: 07e99d0cd758a18aa37a20fe830ce7ba6ecfb19e9d6ec63a85870a12183b2da1ead1ec65315bee283d9f1b034f9f73be8b04aff9e5ff7fcd387867217cc92145

data/.rubocop.yml

@@ -1,5 +1,5 @@
 require:
- - rubocop-rspec
+  - rubocop-rspec
 
 AllCops:
   NewCops: disable

data/lib/stytch/errors.rb

@@ -49,4 +49,11 @@ module Stytch
       super(msg)
     end
   end
+
+  class M2MPermissionError < StandardError
+    def initialize(has_scopes, required_scopes)
+      msg = "Missing at least one required scope from #{required_scopes} for M2M request with scopes #{has_scopes}"
+      super(msg)
+    end
+  end
 end

data/lib/stytch/m2m.rb

@@ -96,6 +96,10 @@ module Stytch
     # max_token_age::
     #   The maximum possible lifetime in seconds for the token to be valid.
     #   The type of this field is nilable +Integer+.
+    # scope_authorization_func::
+    #   A function to check if the token has the required scopes. This defaults to a function that assumes
+    #   scopes are either direct string matches or written in the form "action:resource". See the
+    #   documentation for +perform_authorization_check+ for more information.
     # == Returns:
     # +nil+ if the token could not be validated, or an object with the following fields:
     # scopes::
@@ -107,7 +111,12 @@ module Stytch
     # custom_claims::
     #   A map of custom claims present in the token.
     #   The type of this field is +object+.
-    def authenticate_token(access_token:, required_scopes: nil, max_token_age: nil)
+    def authenticate_token(
+      access_token:,
+      required_scopes: nil,
+      max_token_age: nil,
+      scope_authorization_func: method(:perform_authorization_check)
+    )
       # Intentionally allow this to re-raise if authentication fails
       decoded_jwt = authenticate_token_local(access_token)
 
@@ -119,14 +128,50 @@ module Stytch
       resp = marshal_jwt_into_response(decoded_jwt)
 
       unless required_scopes.nil?
-        for scope in required_scopes
-          raise TokenMissingScopeError, scope unless resp['scopes'].include?(scope)
-        end
+        is_authorized = scope_authorization_func.call(
+          has_scopes: resp['scopes'],
+          required_scopes: required_scopes
+        )
+        raise M2MPermissionError.new(resp['scopes'], required_scopes) unless is_authorized
       end
 
       resp
     end
 
+    # Performs an authorization check against an M2M client and a set of required
+    # scopes. Returns true if the client has all the required scopes, false otherwise.
+    # A scope can match if the client has a wildcard resource or the specific resource.
+    # This function assumes that scopes are of the form "action:resource" or just
+    # "specific_scope". It is _also_ possible to represent scopes as "resource:action",
+    # but it is ultimately up to the developer to ensure consistency in the scopes format.
+    # Note that a scope of "*" will only match another literal "*" because wildcards are
+    # *not* supported in the prefix piece of a scope.
+    def perform_authorization_check(
+      has_scopes:,
+      required_scopes:
+    )
+      client_scopes = Hash.new { |hash, key| hash[key] = Set.new }
+      has_scopes.each do |scope|
+        action = scope
+        resource = '-'
+        action, resource = scope.split(':') if scope.include?(':')
+        client_scopes[action].add(resource)
+      end
+
+      required_scopes.each do |required_scope|
+        required_action = required_scope
+        required_resource = '-'
+        required_action, required_resource = required_scope.split(':') if required_scope.include?(':')
+        return false unless client_scopes.key?(required_action)
+
+        resources = client_scopes[required_action]
+        # The client can either have a wildcard resource or the specific resource
+        return false unless resources.include?('*') || resources.include?(required_resource)
+      end
+
+      true
+    end
+
     # Parse a M2M token and verify the signature locally (without calling /authenticate in the API)
     def authenticate_token_local(jwt)
       issuer = 'stytch.com/' + @project_id

data/lib/stytch/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Stytch
-  VERSION = '9.0.0'
+  VERSION = '9.1.0'
 end

data/stytch.gemspec

@@ -30,6 +30,6 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'jwt', '>= 2.3.0'
 
   spec.add_development_dependency 'rspec', '~> 3.11.0'
-  spec.add_development_dependency 'rubocop', '1.56.3'
+  spec.add_development_dependency 'rubocop', '1.64.1'
   spec.add_development_dependency 'rubocop-rspec', '2.24.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: stytch
 version: !ruby/object:Gem::Version
-  version: 9.0.0
+  version: 9.1.0
 platform: ruby
 authors:
 - stytch
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-06-03 00:00:00.000000000 Z
+date: 2024-06-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -78,14 +78,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.56.3
+        version: 1.64.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.56.3
+        version: 1.64.1
 - !ruby/object:Gem::Dependency
   name: rubocop-rspec
   requirement: !ruby/object:Gem::Requirement