tina4ruby 3.13.90 → 3.13.92

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bcacb51cc9aec287d69bb3d18d0d5736d4e72fd9f25e4b28145af7a8c3e69245
-  data.tar.gz: 5cbe29c5b764594b014c386ab1df06e93d67cc8ad79ee321a2d5c03c5383cc73
+  metadata.gz: '099963e70978ad017383430b404b9cd1a2ff28f0563ca431f1e4adeec9b063fe'
+  data.tar.gz: 190a787d77c3e73a4e48177c865f0e2bdb5c529c4483781ca59e2cdfe4303efa
 SHA512:
-  metadata.gz: b01320730d284fb8f8babdefdcd6c26fc3a4ae29e5ee3a2f700320276a1d211d5d3e88fc0c8de4e1722af814a60333a4056041428fd387ec70446b50f066a208
-  data.tar.gz: 32077d83e0b6c457656915818683193f8a4ef9b3dfd505e3035d97f7b835b979d29a536f6993aa85d987138e9fe1aa229d1d002fec769879fb0c4ca1dbaef2fa
+  metadata.gz: 86ab09867ede9d7587e600d0f98eb333ad767bd392ecd8c5251a5672e5957073d35cace49cee8507a900e568ee6d98bee85b1294d5b5031498e6f41379978481
+  data.tar.gz: 7b42923a37f18d3a96821c0e19144524809d1c631920349ac5bcafcfea49944eea25fce473de20f5b2b19b05c3d1d25291a18b7ee0c7695e4096ab77419043aa

data/lib/tina4/auth.rb

@@ -21,6 +21,23 @@ module Tina4
       "run was NOT detected as dev - typically a container or CI without " \
       "TINA4_DEBUG set, or TINA4_ENV=production."
 
+    # Supported JWT algorithms. HMAC only — the whole family ships in OpenSSL, so
+    # this stays zero-gem. The header's "alg" is now always the one we actually
+    # sign with: the digest is looked up here rather than hardcoded to SHA256.
+    # Mirrors the Python master's _HMAC_ALGORITHMS (a name -> digest map); the
+    # value is the digest CLASS and a fresh instance is made per signature, so
+    # nothing about the digest state is shared between calls or threads.
+    HMAC_ALGORITHMS = {
+      "HS256" => OpenSSL::Digest::SHA256,
+      "HS384" => OpenSSL::Digest::SHA384,
+      "HS512" => OpenSSL::Digest::SHA512
+    }.freeze
+
+    # Seconds of clock skew tolerated on the "nbf" (not-before) claim. Without
+    # this a token minted on one host and validated on another a second behind is
+    # rejected for no real reason; RFC 7519 explicitly allows "a small leeway".
+    JWT_LEEWAY_SECONDS = 60
+
     class << self
       def setup(root_dir = Dir.pwd)
         @keys_dir = File.join(root_dir, KEYS_DIR)
@@ -111,62 +128,120 @@ module Tina4
         Base64.urlsafe_decode64(str)
       end
 
-      # Build a JWT using HS256 with Ruby's OpenSSL::HMAC (no gem needed)
-      def hmac_encode(claims, secret)
-        header = { "alg" => "HS256", "typ" => "JWT" }
+      # Pick the JWT algorithm: explicit argument, else TINA4_JWT_ALGORITHM, else
+      # HS256. A blank value counts as unset (parity with Python, where an empty
+      # env string is falsy and falls through).
+      #
+      # Raises ArgumentError naming the supported set when asked for one we cannot
+      # sign — Ruby's idiomatic equivalent of the master's ValueError. The env var
+      # was registered in the CLI's known_vars and then silently ignored here, so a
+      # user could set HS512 and still get HS256 tokens.
+      def resolve_algorithm(algorithm = nil)
+        candidate = [algorithm, ENV["TINA4_JWT_ALGORITHM"]]
+                    .find { |value| !value.nil? && !value.to_s.strip.empty? }
+        chosen = (candidate || "HS256").to_s.strip
+        unless HMAC_ALGORITHMS.key?(chosen)
+          raise ArgumentError,
+                "Unsupported JWT algorithm #{chosen.inspect}. Tina4 signs with " \
+                "#{HMAC_ALGORITHMS.keys.sort.join(', ')} (HMAC only, zero-dependency). " \
+                "Set TINA4_JWT_ALGORITHM to one of those."
+        end
+        chosen
+      end
+
+      # HMAC the signing input with the digest the algorithm actually names, so the
+      # header's "alg" can never disagree with the bytes we produced.
+      def hmac_signature(algorithm, secret, signing_input)
+        OpenSSL::HMAC.digest(HMAC_ALGORITHMS.fetch(algorithm).new, secret.to_s, signing_input)
+      end
+
+      # Build a JWT with Ruby's OpenSSL::HMAC (no gem needed). The algorithm is the
+      # explicit argument, else TINA4_JWT_ALGORITHM, else HS256 — and the header
+      # advertises exactly the algorithm that signed.
+      def hmac_encode(claims, secret, algorithm: nil)
+        alg = resolve_algorithm(algorithm)
+        header = { "alg" => alg, "typ" => "JWT" }
         segments = [
           base64url_encode(JSON.generate(header)),
           base64url_encode(JSON.generate(claims))
         ]
         signing_input = segments.join(".")
-        signature = OpenSSL::HMAC.digest("SHA256", secret, signing_input)
-        segments << base64url_encode(signature)
+        segments << base64url_encode(hmac_signature(alg, secret, signing_input))
         segments.join(".")
       end
 
-      # Decode and verify a JWT signed with HS256. Returns the payload hash or nil.
-      def hmac_decode(token, secret)
-        parts = token.split(".")
-        return nil unless parts.length == 3
-
-        header_json = base64url_decode(parts[0])
-        header = JSON.parse(header_json)
-        return nil unless header["alg"] == "HS256"
-
-        # Verify signature
-        signing_input = "#{parts[0]}.#{parts[1]}"
-        expected_sig = OpenSSL::HMAC.digest("SHA256", secret, signing_input)
-        actual_sig = base64url_decode(parts[2])
-
-        # Constant-time comparison to prevent timing attacks
-        return nil unless OpenSSL.fixed_length_secure_compare(expected_sig, actual_sig)
-
-        payload = JSON.parse(base64url_decode(parts[1]))
-
-        # Check expiry
-        now = Time.now.to_i
-        return nil if payload["exp"] && now >= payload["exp"]
-        return nil if payload["nbf"] && now < payload["nbf"]
+      # Decode and verify an HMAC-signed JWT. Returns the payload hash or nil.
+      #
+      # The algorithm is PINNED to our configured one rather than trusted from the
+      # token: a header asking to be verified as anything else — "none", a
+      # different HMAC, or an RSA alg we do not implement here — is rejected before
+      # any signature work.
+      def hmac_decode(token, secret, algorithm: nil)
+        # Resolved OUTSIDE the rescue below: an unsupported algorithm is a
+        # configuration error that must surface, not become a nil "invalid token".
+        alg = resolve_algorithm(algorithm)
 
-        payload
-      rescue ArgumentError, JSON::ParserError, OpenSSL::HMACError
-        nil
+        begin
+          parts = token.split(".")
+          return nil unless parts.length == 3
+
+          header_json = base64url_decode(parts[0])
+          header = JSON.parse(header_json)
+          return nil unless header["alg"] == alg
+
+          # Verify signature
+          signing_input = "#{parts[0]}.#{parts[1]}"
+          expected_sig = hmac_signature(alg, secret, signing_input)
+          actual_sig = base64url_decode(parts[2])
+
+          # Constant-time comparison to prevent timing attacks. Lengths must match
+          # first — fixed_length_secure_compare raises on a length mismatch, which
+          # a forged signature of the wrong digest size would trigger.
+          return nil unless expected_sig.bytesize == actual_sig.bytesize
+          return nil unless OpenSSL.fixed_length_secure_compare(expected_sig, actual_sig)
+
+          payload = JSON.parse(base64url_decode(parts[1]))
+
+          # Check expiry
+          now = Time.now.to_i
+          return nil if payload["exp"] && now >= payload["exp"]
+
+          # "nbf" (not-before): a post-dated token is not valid yet. Tolerate
+          # JWT_LEEWAY_SECONDS of clock skew so a token minted on a host a second
+          # ahead is not rejected for nothing.
+          return nil if payload["nbf"] && now + JWT_LEEWAY_SECONDS < payload["nbf"]
+
+          payload
+        rescue ArgumentError, JSON::ParserError, OpenSSL::HMACError
+          nil
+        end
       end
 
       # ── Token API (auto-selects HS256 or RS256) ─────────────────
 
-      def get_token(payload, expires_in: 60, secret: nil)
+      # Mint a signed JWT.
+      #
+      # `algorithm:` selects the HMAC algorithm (else TINA4_JWT_ALGORITHM, else
+      # HS256); an unsupported one raises ArgumentError rather than quietly
+      # downgrading. It applies to the HMAC path only — the legacy RS256 path
+      # (RSA keys present in .keys/) is unaffected.
+      #
+      # BREAKING (deliberate): no "nbf" claim is stamped. It duplicated "iat",
+      # added no security, and created clock-skew rejections; RFC 7519 nbf is for
+      # deliberately post-dated tokens, which stays fully supported when the caller
+      # passes its own "nbf" in the payload. Python/PHP/Node never auto-stamped it,
+      # so Ruby doing so was the parity break.
+      def get_token(payload, expires_in: 60, secret: nil, algorithm: nil)
         now = Time.now.to_i
         claims = payload.merge(
           "iat" => now,
-          "exp" => now + (expires_in * 60).to_i,
-          "nbf" => now
+          "exp" => now + (expires_in * 60).to_i
         )
 
         if secret
-          hmac_encode(claims, secret)
+          hmac_encode(claims, secret, algorithm: algorithm)
         elsif use_hmac?
-          hmac_encode(claims, hmac_secret)
+          hmac_encode(claims, hmac_secret, algorithm: algorithm)
         else
           ensure_keys
           require "jwt"
@@ -247,16 +322,28 @@ module Tina4
         nil
       end
 
+      # Validate and re-issue a token with the same claims.
+      #
+      # Only "iat"/"exp" are dropped (they are re-stamped). A caller-supplied "nbf"
+      # is PRESERVED — matching the Python master, and keeping the promise made
+      # when auto-nbf was removed: a deliberately post-dated claim is the issuer's,
+      # and a refresh must not quietly erase it.
       def refresh_token(token, expires_in: 60)
         return nil unless valid_token(token)
 
         payload = get_payload(token)
         return nil unless payload
-        payload = payload.reject { |k, _| %w[iat exp nbf].include?(k) }
+        payload = payload.reject { |k, _| %w[iat exp].include?(k) }
         get_token(payload, expires_in: expires_in)
       end
 
-      def authenticate_request(headers, secret: nil, algorithm: "HS256")
+      # Extract and validate auth from request headers.
+      #
+      # `secret:` and `algorithm:` are real overrides. `algorithm:` used to be
+      # accepted with a hardcoded "HS256" default and then dropped on the floor, so
+      # an explicit argument silently lost to TINA4_JWT_ALGORITHM — the precedence
+      # is now honoured here too (explicit > env > HS256).
+      def authenticate_request(headers, secret: nil, algorithm: nil)
         auth_header = headers["HTTP_AUTHORIZATION"] || headers["Authorization"] || ""
         return nil unless auth_header =~ /\ABearer\s+(.+)\z/i
 
@@ -271,9 +358,10 @@ module Tina4
           return { "api_key" => true }
         end
 
-        # If a custom secret is provided, validate against it directly
-        if secret
-          payload = hmac_decode(token, secret)
+        # If a custom secret and/or algorithm is provided, validate against those
+        # directly rather than this process's env-resolved defaults.
+        if secret || algorithm
+          payload = hmac_decode(token, secret || hmac_secret, algorithm: algorithm)
           return payload ? payload : nil
         end
 

data/lib/tina4/metrics.rb

@@ -254,7 +254,7 @@ module Tina4
         end
 
         lines = source.lines.map(&:chomp)
-        loc = lines.count { |l| !l.strip.empty? && !l.strip.start_with?('#') }
+        loc = lines.count { |l| _code_line?(l) }
 
         # Extract imports (require/require_relative)
         imports = _extract_imports(lines)
@@ -509,7 +509,7 @@ module Tina4
       end
 
       lines = source.lines.map(&:chomp)
-      loc = lines.count { |l| !l.strip.empty? && !l.strip.start_with?('#') }
+      loc = lines.count { |l| _code_line?(l) }
 
       functions = _extract_functions(source, tokens, lines)
       functions.sort_by! { |f| -f["complexity"] }
@@ -763,6 +763,17 @@ module Tina4
       buffers
     end
 
+    # True for a line that counts toward LOC: not blank, not a comment.
+    #
+    # The single definition of the rule. Method LOC used to ignore it and return a
+    # raw line span while file LOC excluded blanks and comments, so `loc` meant
+    # two different things in one payload - the dashboard sized bubbles in one
+    # unit and printed the method table in the other.
+    def self._code_line?(line)
+      stripped = line.strip
+      !stripped.empty? && !stripped.start_with?("#")
+    end
+
     def self._extract_functions(source, _tokens, _lines)
       functions = []
       # Operate on a neutralised copy: string/regex/comment CONTENT is blanked
@@ -811,7 +822,9 @@ module Tina4
             # Find method end and calculate LOC
             method_start = i
             method_end = _find_method_end(lines, i)
-            method_loc = method_end - method_start + 1
+            # Code lines over the method's span, by the same rule as file LOC.
+            # Floor of 1: a one-line body must never report 0.
+            method_loc = [1, lines[method_start..method_end].count { |l| _code_line?(l) }].max
 
             # Calculate complexity for this method's body
             method_lines = lines[method_start..method_end]
@@ -842,6 +855,51 @@ module Tina4
         i += 1
       end
 
+      _charge_nested_complexity_to_the_nested_function(functions)
+    end
+
+    # Stop a function being charged for the complexity of the functions nested
+    # inside it.
+    #
+    # Each function's raw score is measured over its whole span, so a branch
+    # inside a nested function landed on BOTH that function and every function
+    # enclosing it. The over-count compounded with depth: a wrapper around twenty
+    # inner handlers absorbed the entire file's complexity and topped the
+    # offenders list, hiding the genuine hot spots.
+    #
+    # The correction is exact. A raw score is 1 + every decision in the span, so
+    # (raw - 1) is the total decision count of a function's whole subtree.
+    # Subtracting that for each DIRECT child leaves the function's own branches:
+    #
+    #   own(F) = raw(F) - sum over direct children C of (raw(C) - 1)
+    #
+    # Blocks and lambdas are deliberately unaffected: they are not reported as
+    # functions of their own, so nothing subtracts them and their decisions stay
+    # with the method that contains them - moved, never lost.
+    def self._charge_nested_complexity_to_the_nested_function(functions)
+      return functions if functions.length < 2
+
+      last_line = ->(f) { f["line"] + [1, f["loc"]].max - 1 }
+      contains = ->(outer, inner) do
+        inner["line"] > outer["line"] && last_line.call(inner) <= last_line.call(outer)
+      end
+
+      raw = functions.map { |f| f["complexity"] }
+      functions.each_with_index do |outer, i|
+        subtract = 0
+        functions.each_with_index do |inner, j|
+          next if i == j || !contains.call(outer, inner)
+
+          # Direct child only: skip it if another function sits between the two,
+          # or its complexity would be subtracted twice.
+          nested_deeper = functions.each_with_index.any? do |mid, k|
+            k != i && k != j && contains.call(outer, mid) && contains.call(mid, inner)
+          end
+          subtract += raw[j] - 1 unless nested_deeper
+        end
+        outer["complexity"] = [1, raw[i] - subtract].max
+      end
+
       functions
     end