zaikio-jwt_auth 0.2.4 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 16afec7be22352a9cc13e7bc0e65edfcbd1aef93073e3cb4f8f3059eda576859
-  data.tar.gz: f1608ab958c199ff881416298bc17ffd02c3aea3f41315789009af817542f7c3
+  metadata.gz: fd2758c610957007baf7499e46f22d286a5c61dceb5895270080f20af8e5a57d
+  data.tar.gz: 5c945887dca4cd07ebfc836a5cbadb81667a56dbed0c6f67152dba297d4399fd
 SHA512:
-  metadata.gz: 52e9deeaed67d548070b6e28317e000232831896dcef98dabd1e333f2e05e4a6166618ff7cf176e88ff0a6cdb148d2291604366f3f7155149a904a821128bfe1
-  data.tar.gz: 570301e458fbba82a6ace338dcbc4be1f481d2e20d53a0d28b40f096bf56baf154408ce7ae4cb5b18d691f071580de64b012d3daabf5a81f4b8a87db95186039
+  metadata.gz: 73a3192d97b3f20caab44a96306258cd7b1b0240fb9e912726e3dfd536ef46183e0590a9cb513ed4be6afb66f4ee3c0a415153c4a7e7259a7bd569374e30eab4
+  data.tar.gz: bb9db302ba5caafeae825b25c244a91d213c1026d879c62ca2da230db6f29ade726121fcd0c0727c1e5625a84e2ed2cfb282a25ecaa827562efe6e6a9cb1a58f

data/README.md

@@ -49,7 +49,7 @@ end
 
 ### 4. Update Revoked Access Tokens by Webhook
 
-This gem automatically registers a webhook, if you have properly setup [Zaikio::Webhooks](https://github.com/crispymtn/zaikio-webhooks).
+This gem automatically registers a webhook, if you have properly setup [Zaikio::Webhooks](https://github.com/zaikio/zaikio-webhooks).
 
 
 ### 5. Add more restrictions to your resources:
@@ -118,3 +118,32 @@ class API::ResourcesController < API::ApplicationController
   authorize_by_jwt_scopes 'resources', unless: -> { params[:skip] == '1' }
 end
 ```
+
+### Usage outside a Rails controller
+
+If you need to access a JWT outside the normal Rails controllers (e.g. in a Rack
+middleware), there's a static helper method `.extract` which you can use:
+
+```ruby
+class MyRackMiddleware < Rack::Middleware
+  def call(env)
+    token = Zaikio::JWTAuth.extract(env["HTTP_AUTHORIZATION"])
+    puts token.subject_type #=> "Organization"
+    ...
+```
+
+This function expects to receive the string in the format `"Bearer $token"`.
+
+## Contributing
+
+**Make sure you have the dummy app running locally to validate your changes.**
+
+- Make your changes and submit a pull request for them
+- Make sure to update `CHANGELOG.md`
+
+To release a new version of the gem:
+- Update the version in `lib/zaikio/jwt_auth/version.rb`
+- Update `CHANGELOG.md` to include the new version and its release date
+- Commit and push your changes
+- Create a [new release on GitHub](https://github.com/zaikio/zaikio-jwt_auth/releases/new)
+- CircleCI will build the Gem package and push it Rubygems for you

data/app/jobs/zaikio/jwt_auth/revoke_access_token_job.rb

@@ -2,8 +2,8 @@ module Zaikio
   module JWTAuth
     class RevokeAccessTokenJob < ApplicationJob
       def perform(event)
-        DirectoryCache.update("api/v1/blacklisted_access_tokens.json", expires_after: 60.minutes) do |data|
-          data["blacklisted_token_ids"] << event.payload["access_token_id"]
+        DirectoryCache.update("api/v1/revoked_access_tokens.json", expires_after: 60.minutes) do |data|
+          data["revoked_token_ids"] << event.payload["access_token_id"]
           data
         end
       end

data/lib/zaikio/jwt_auth.rb

@@ -1,5 +1,6 @@
 require "jwt"
 require "oj"
+require "active_support/core_ext/integer/time"
 require "zaikio/jwt_auth/railtie"
 require "zaikio/jwt_auth/configuration"
 require "zaikio/jwt_auth/directory_cache"
@@ -26,15 +27,16 @@ module Zaikio
     end
 
     def self.revoked_jwt?(jti)
-      blacklisted_token_ids.include?(jti)
+      revoked_token_ids.include?(jti)
     end
 
-    def self.blacklisted_token_ids
+    def self.revoked_token_ids
       return [] if mocked_jwt_payload
 
-      return configuration.blacklisted_token_ids if configuration.blacklisted_token_ids
-
-      DirectoryCache.fetch("api/v1/blacklisted_access_tokens.json", expires_after: 60.minutes)["blacklisted_token_ids"]
+      configuration.revoked_token_ids || DirectoryCache.fetch(
+        "api/v1/revoked_access_tokens.json",
+        expires_after: 60.minutes
+      )["revoked_token_ids"]
     end
 
     def self.included(base)
@@ -50,6 +52,20 @@ module Zaikio
       @mocked_jwt_payload = payload
     end
 
+    HEADER_FORMAT = /\ABearer (.+)\z/.freeze
+
+    def self.extract(authorization_header_string)
+      return TokenData.new(Zaikio::JWTAuth.mocked_jwt_payload) if Zaikio::JWTAuth.mocked_jwt_payload
+
+      return if authorization_header_string.blank?
+
+      return unless (token = authorization_header_string[HEADER_FORMAT, 1])
+
+      payload, = JWT.decode(token, nil, true, algorithms: ["RS256"], jwks: JWK.loader)
+
+      TokenData.new(payload)
+    end
+
     module ClassMethods
       def authorize_by_jwt_subject_type(type = nil)
         @authorize_by_jwt_subject_type ||= type
@@ -66,11 +82,10 @@ module Zaikio
 
     module InstanceMethods
       def authenticate_by_jwt
-        render_error("no_jwt_passed", status: :unauthorized) && return unless jwt_from_auth_header
+        token_data = Zaikio::JWTAuth.extract(request.headers["Authorization"])
+        return render_error("no_jwt_passed", status: :unauthorized) unless token_data
 
-        token_data = TokenData.new(jwt_payload)
-
-        return if show_error_if_token_is_blacklisted(token_data)
+        return if show_error_if_token_is_revoked(token_data)
 
         return if show_error_if_authorize_by_jwt_subject_type_fails(token_data)
 
@@ -83,11 +98,11 @@ module Zaikio
         render_error("invalid_jwt") && (return)
       end
 
-      def update_blacklisted_access_tokens_by_webhook
+      def update_revoked_access_tokens_by_webhook
         return unless params[:name] == "directory.revoked_access_token"
 
-        DirectoryCache.update("api/v1/blacklisted_access_tokens.json", expires_after: 60.minutes) do |data|
-          data["blacklisted_token_ids"] << params[:payload][:access_token_id]
+        DirectoryCache.update("api/v1/revoked_access_tokens.json", expires_after: 60.minutes) do |data|
+          data["revoked_token_ids"] << params[:payload][:access_token_id]
           data
         end
 
@@ -96,21 +111,6 @@ module Zaikio
 
       private
 
-      def jwt_from_auth_header
-        return true if Zaikio::JWTAuth.mocked_jwt_payload
-
-        auth_header = request.headers["Authorization"]
-        auth_header.split("Bearer ").last if /Bearer/.match?(auth_header)
-      end
-
-      def jwt_payload
-        return Zaikio::JWTAuth.mocked_jwt_payload if Zaikio::JWTAuth.mocked_jwt_payload
-
-        payload, = JWT.decode(jwt_from_auth_header, nil, true, algorithms: ["RS256"], jwks: JWK.loader)
-
-        payload
-      end
-
       def show_error_if_authorize_by_jwt_scopes_fails(token_data)
         return if token_data.scope_by_configurations?(
           self.class.authorize_by_jwt_scopes,
@@ -130,7 +130,7 @@ module Zaikio
         render_error("unpermitted_subject")
       end
 
-      def show_error_if_token_is_blacklisted(token_data)
+      def show_error_if_token_is_revoked(token_data)
         return unless Zaikio::JWTAuth.revoked_jwt?(token_data.jti)
 
         render_error("invalid_jwt")

data/lib/zaikio/jwt_auth/configuration.rb

@@ -4,25 +4,25 @@ module Zaikio
   module JWTAuth
     class Configuration
       HOSTS = {
-        development: "http://directory.zaikio.test",
-        test: "http://directory.zaikio.test",
-        staging: "https://directory.staging.zaikio.com",
-        sandbox: "https://directory.sandbox.zaikio.com",
-        production: "https://directory.zaikio.com"
+        development: "http://hub.zaikio.test",
+        test: "http://hub.zaikio.test",
+        staging: "https://hub.staging.zaikio.com",
+        sandbox: "https://hub.sandbox.zaikio.com",
+        production: "https://hub.zaikio.com"
       }.freeze
 
-      attr_accessor :app_name
-      attr_accessor :redis, :host
+      attr_accessor :app_name, :redis, :host
       attr_reader :environment
-      attr_writer :logger, :blacklisted_token_ids, :keys
+      attr_writer :logger, :revoked_token_ids, :keys
 
       def initialize
         @environment = :sandbox
-        @blacklisted_token_ids = nil
+        @revoked_token_ids = nil
+        @keys = nil
       end
 
       def logger
-        @logger ||= Logger.new(STDOUT)
+        @logger ||= Logger.new($stdout)
       end
 
       def environment=(env)
@@ -31,11 +31,11 @@ module Zaikio
       end
 
       def keys
-        defined?(@keys) && @keys.is_a?(Proc) ? @keys.call : @keys
+        @keys.is_a?(Proc) ? @keys.call : @keys
       end
 
-      def blacklisted_token_ids
-        @blacklisted_token_ids.is_a?(Proc) ? @blacklisted_token_ids.call : @blacklisted_token_ids
+      def revoked_token_ids
+        @revoked_token_ids.is_a?(Proc) ? @revoked_token_ids.call : @revoked_token_ids
       end
 
       private

data/lib/zaikio/jwt_auth/test_helper.rb

@@ -14,7 +14,7 @@ module Zaikio
           jti: "unique-access-token-id",
           nbf: Time.now.to_i,
           exp: 1.hour.from_now.to_i,
-          jku: "http://directory.zaikio.test/api/v1/jwt_public_keys.json",
+          jku: "http://hub.zaikio.test/api/v1/jwt_public_keys.json",
           scope: []
         }.merge(extra_payload).stringify_keys
       end

data/lib/zaikio/jwt_auth/token_data.rb

@@ -2,7 +2,7 @@ module Zaikio
   module JWTAuth
     class TokenData
       def self.subject_format
-        %r{^((\w+)/((\w|-)+)\>)?(\w+)/((\w|-)+)$}
+        %r{^((\w+)/((\w|-)+)>)?(\w+)/((\w|-)+)$}
       end
 
       def self.actions_by_permission
@@ -33,6 +33,10 @@ module Zaikio
         @payload["jti"]
       end
 
+      def expires_at
+        Time.zone.at(@payload["exp"]).to_datetime
+      end
+
       # scope_options is an array of objects with:
       # scope, app_name (optional), except/only (array, optional)
       def scope_by_configurations?(scope_configurations, action_name, context)

data/lib/zaikio/jwt_auth/version.rb

@@ -1,5 +1,5 @@
 module Zaikio
   module JWTAuth
-    VERSION = "0.2.4".freeze
+    VERSION = "0.4.1".freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: zaikio-jwt_auth
 version: !ruby/object:Gem::Version
-  version: 0.2.4
+  version: 0.4.1
 platform: ruby
 authors:
 - crispymtn
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-05-04 00:00:00.000000000 Z
+date: 2021-02-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: oj
@@ -78,10 +78,12 @@ files:
 - lib/zaikio/jwt_auth/test_helper.rb
 - lib/zaikio/jwt_auth/token_data.rb
 - lib/zaikio/jwt_auth/version.rb
-homepage: https://www.zaikio.com/
+homepage: https://github.com/zaikio/zaikio-jwt_auth
 licenses:
 - MIT
-metadata: {}
+metadata:
+  changelog_uri: https://github.com/zaikio/zaikio-jwt_auth/blob/main/CHANGELOG.md
+  source_code_uri: https://github.com/zaikio/zaikio-jwt_auth
 post_install_message: 
 rdoc_options: []
 require_paths:
@@ -90,14 +92,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 2.6.5
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.1.4
 signing_key: 
 specification_version: 4
 summary: JWT-Based authentication and authorization with zaikio