verikloak 0.4.0 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a8fea8bb10499fcd42f05ecc1eadda3008c5215b1907807351c9b4a8a4a420a4
-  data.tar.gz: '05476942149fcdf5f5cbe9605524c8a8ea79359f1b9533b623d08e7b130a0290'
+  metadata.gz: 2acaa72f8a2eee680d3c439b99488a48e7f512de4fb1ab2092ff781f13799c89
+  data.tar.gz: 5918e081c8be11ef410170f38cd4f520c2cfe55a5b34ac9e5363eddedc297a75
 SHA512:
-  metadata.gz: 3133b44cd8ada0217916d82b5b725ed5bd50c445c727969478b6af67cb712de8247d7a124585f5ca2ee763ec69171f3c65b70be60fdb91c16f6d5467b2853b9a
-  data.tar.gz: c790ce4825f32e2d17187b2de7e3564e765274517b4ca59f0fbd8b61a7fbe22edac4e9f72cee91a92ec7e9b2bc6529da74e4d9b3d22abf3d068a3bff2f78a4df
+  metadata.gz: 8ee86f3b6586beac55b0a4e54f9815f58c99edf57bb2661851ae39e4f9f0bab80126643b903802ec90c266ca9fd16bac92550fd18d0c21be52487bfbb80c756e
+  data.tar.gz: 83f47c238874faee6b3391a833e7e3966b04637b3859b64e01943243d5aa1c64bf22986586a00c85ac651928cec476b7a8e05b030fd23172abf5ce60a3ff0e65

data/CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [0.4.1] - 2026-02-15
+
+### Added
+- `Verikloak::SkipPathMatcher` now supports `Regexp` patterns alongside string paths, restoring compatibility with `verikloak-audience` skip_paths Regexp usage
+
+---
+
 ## [0.4.0] - 2026-02-15
 
 ### Security

data/README.md

@@ -238,7 +238,7 @@ For a full list of error cases and detailed explanations, please see the [ERRORS
 | `discovery_url` | Yes   | Full URL to your realm's OIDC discovery doc |
 | `audience`      | Yes   | Your client ID (checked against `aud`). Accepts a String or callable returning a String/Array per request. |
 | `issuer`        | No       | Optional override for the expected `iss` claim; defaults to the discovery `issuer`. |
-| `skip_paths`    | No       | Array of paths or wildcards to skip authentication, e.g. `['/', '/health', '/public/*']`. **Note:** Regex patterns are not supported. |
+| `skip_paths`    | No       | Array of paths, wildcards, or `Regexp` patterns to skip authentication, e.g. `['/', '/health', '/public/*', /\A\/api\/v\d+\/public/]`. |
 | `discovery`     | No       | Inject custom Discovery instance (advanced/testing) |
 | `jwks_cache`    | No       | Inject custom JwksCache instance (advanced/testing) |
 | `leeway`       | No       | Clock skew tolerance (seconds) applied during JWT verification. Defaults to `TokenDecoder::DEFAULT_LEEWAY`. |
@@ -259,17 +259,17 @@ Plain paths are exact-match only, while `/*` at the end enables prefix matching.
 For example:
 
 ```ruby
-skip_paths: ['/', '/health', '/rails/*', '/public/src']
+skip_paths: ['/', '/health', '/rails/*', '/public/src', /\A\/api\/v\d+\/public/]
 ```
 - `'/'` matches only the root path.
 - `'/health'` matches **only** `/health` (for subpaths, use `'/health/*'`).
 - `'/rails/*'` matches `/rails` itself as well as `/rails/foo`, `/rails/foo/bar`, etc.
 - `'/public/src'` matches `/public/src`, but does **not** match `/public`, any subpath like `/public/src/html` or other siblings like `/public/css`.
+- `Regexp` patterns are matched against the normalized path via `Regexp#match?`. For example, `/\A\/api\/v\d+\/public/` matches `/api/v1/public/docs`, `/api/v2/public/info`, etc.
 
 Paths **not matched** by any `skip_paths` entry will require a valid JWT.
 
-**Note:** Regex patterns are not supported. Only literal paths and `*` wildcards are allowed.  
-Internally, `*` expands to match nested paths, so patterns like `/rails/*` are valid. This differs from regex; for example, `'/rails'` alone matches only `/rails`, while `'/rails/*'` covers both `/rails` and deeper subpaths.
+Internally, `*` expands to match nested paths, so patterns like `/rails/*` are valid. `'/rails'` alone matches only `/rails`, while `'/rails/*'` covers both `/rails` and deeper subpaths. For more complex matching needs, use `Regexp` patterns.
 
 #### Option: `audience`
 

data/lib/verikloak/skip_path_matcher.rb

@@ -12,6 +12,7 @@ module Verikloak
   # * `'/'`           — matches only the root path
   # * `'/foo'`        — exact-match only (matches `/foo` but **not** `/foo/...`)
   # * `'/foo/*'`      — prefix match (matches `/foo` and any nested path under it)
+  # * `Regexp`        — matched against the normalized path via `Regexp#match?`
   module SkipPathMatcher
     private
 
@@ -23,8 +24,9 @@ module Verikloak
       np = normalize_path(path)
       return true if @skip_root && np == '/'
       return true if @skip_exacts.include?(np)
+      return true if @skip_prefixes.any? { |prefix| np == prefix || np.start_with?("#{prefix}/") }
 
-      @skip_prefixes.any? { |prefix| np == prefix || np.start_with?("#{prefix}/") }
+      @skip_regexps.any? { |re| re.match?(np) }
     end
 
     # Normalizes paths for stable comparisons:
@@ -46,37 +48,44 @@ module Verikloak
     # * `@skip_root` — whether `'/'` is present
     # * `@skip_exacts` — exact-match set (e.g. `'/health'`)
     # * `@skip_prefixes` — wildcard prefixes for `'/*'` (e.g. `'/public'`)
+    # * `@skip_regexps` — Regexp patterns matched via `Regexp#match?`
     #
-    # @param paths [Array<String>]
+    # @param paths [Array<String, Regexp>]
     # @return [void]
     def compile_skip_paths(paths)
       @skip_root     = false
       @skip_exacts   = Set.new
       @skip_prefixes = []
+      @skip_regexps  = []
 
-      Array(paths).each do |raw|
-        next if raw.nil?
+      Array(paths).each { |raw| classify_skip_entry(raw) }
 
-        s = raw.to_s.strip
-        next if s.empty?
-
-        if s == '/'
-          @skip_root = true
-          next
-        end
+      @skip_prefixes.uniq!
+    end
 
-        if s.end_with?('/*')
-          prefix = normalize_path(s.chomp('/*'))
-          next if prefix == '/' # root is handled by @skip_root
+    # Classify a single skip-path entry into the appropriate bucket.
+    #
+    # @param raw [String, Regexp, nil]
+    # @return [void]
+    def classify_skip_entry(raw)
+      return if raw.nil?
 
-          @skip_prefixes << prefix
-        else
-          exact = normalize_path(s)
-          @skip_exacts << exact
-        end
+      if raw.is_a?(Regexp)
+        @skip_regexps << raw
+        return
       end
 
-      @skip_prefixes.uniq!
+      s = raw.to_s.strip
+      return if s.empty?
+
+      if s == '/'
+        @skip_root = true
+      elsif s.end_with?('/*')
+        prefix = normalize_path(s.chomp('/*'))
+        @skip_prefixes << prefix unless prefix == '/'
+      else
+        @skip_exacts << normalize_path(s)
+      end
     end
   end
 end

data/lib/verikloak/version.rb

@@ -2,5 +2,5 @@
 
 module Verikloak
   # Defines the current version of the Verikloak gem.
-  VERSION = '0.4.0'
+  VERSION = '0.4.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: verikloak
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
 platform: ruby
 authors:
 - taiyaky
@@ -111,7 +111,7 @@ metadata:
   source_code_uri: https://github.com/taiyaky/verikloak
   changelog_uri: https://github.com/taiyaky/verikloak/blob/main/CHANGELOG.md
   bug_tracker_uri: https://github.com/taiyaky/verikloak/issues
-  documentation_uri: https://rubydoc.info/gems/verikloak/0.4.0
+  documentation_uri: https://rubydoc.info/gems/verikloak/0.4.1
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths: