zaikio-jwt_auth 0.3.1 → 0.4.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cf4b231af0a8a9fb3d9c48d577c85d12ef02b2605418b22abf21512f1d714433
-  data.tar.gz: 2d106d3d2821edc1d24d96d5e69cda3e3b4e4d04b0f062c26a1d90fd2b223f3f
+  metadata.gz: d7b832b997b8cca7a0fe380edfb7f902f152f317747ea5eb83041dac639d4a31
+  data.tar.gz: d1f9556f70ce6034472a8cf027d4bd09a043be8967615e097b376b8dfcbff2e4
 SHA512:
-  metadata.gz: 325c2144f07a582d0bc3e4f3eeadfd68a1940e5230cefaa3a1b7bd9231b7bb74c86ccc1922f457945e78b05a8286f68b7551851705592e0c3838ebfa06f654a1
-  data.tar.gz: 6fc738d1533e5e06a15ebe476acd0a20b166bd08d5065462fdfe012363ae598d258e324806e0e35651f129b0d5dd5d8974ec92bb49b06e644c9bd2fb5f7a1236
+  metadata.gz: 7cb49d476a40bd91701b53cfc196e8db0b7630217f55bcc86acb0c0a012ed318c3abb62099cb268e00be802551ada7e220bb8036982d9a9dc371fd146a97d089
+  data.tar.gz: affaa752ee97fb676a945dc2a5df3b7b4594289df3900fdc3457ca479096441867e97ba150d88008cb0ee65fc247f055e619b6a37796070c9405a9e85fdcab3f

data/README.md

@@ -49,7 +49,7 @@ end
 
 ### 4. Update Revoked Access Tokens by Webhook
 
-This gem automatically registers a webhook, if you have properly setup [Zaikio::Webhooks](https://github.com/crispymtn/zaikio-webhooks).
+This gem automatically registers a webhook, if you have properly setup [Zaikio::Webhooks](https://github.com/zaikio/zaikio-webhooks).
 
 
 ### 5. Add more restrictions to your resources:
@@ -63,6 +63,26 @@ end
 
 By convention, `authorize_by_jwt_scopes` automatically maps all CRUD actions in a controller. Requests for `show` and `index` with a read or read_write scope are allowed. All other actions like `create`, `update` and `destroy` are accepted if the scope is a write or read_write scope. Therefore it is strongly recommended to always create standard Rails resources. If a custom action is required, you will need to authorize yourself using the `after_jwt_auth`.
 
+#### Modifying required scopes
+If you nonetheless want to change the required scopes for CRUD routes, you can use the `type` option which accepts the following values: `:read`, `:write`, `:read_write`
+
+```rb
+class API::ResourcesController < API::ApplicationController
+  # Require a write or read_write scope on the index route
+  authorize_by_jwt_scopes 'resources', only: :index, type: :write
+end
+```
+
+#### Using custom actions
+You can also specify authorization for custom actions. When doing so the `type` option is required.
+
+```rb
+class API::ResourcesController < API::ApplicationController
+  # Require the index use to have a write or read_write scope
+  authorize_by_jwt_scopes 'resources', only: :my_custom_route, type: :write
+end
+```
+
 ### 6. Optionally, if you are using SSO: Check revoked tokens
 
 Additionally, the API provides a method called `revoked_jwt?` which expects the `jti` of the JWT.
@@ -118,3 +138,43 @@ class API::ResourcesController < API::ApplicationController
   authorize_by_jwt_scopes 'resources', unless: -> { params[:skip] == '1' }
 end
 ```
+
+### Usage outside a Rails controller
+
+If you need to access a JWT outside the normal Rails controllers (e.g. in a Rack
+middleware), there's a static helper method `.extract` which you can use:
+
+```ruby
+class MyRackMiddleware < Rack::Middleware
+  def call(env)
+    token = Zaikio::JWTAuth.extract(env["HTTP_AUTHORIZATION"])
+    puts token.subject_type #=> "Organization"
+    ...
+```
+
+This function expects to receive the string in the format `"Bearer $token"`. If the JWT is
+invalid, expired, or has some other fundamental issues, the JWT library may throw
+[additional errors](https://github.com/jwt/ruby-jwt/blob/v2.2.2/lib/jwt/error.rb), and you
+should be prepared to handle these, for example:
+
+```ruby
+def call(env)
+  token = Zaikio::JWTAuth.extract("definitely.not.jwt")
+rescue JWT::DecodeError, JWT::ExpiredSignature
+  [401, {}, ["Unauthorized"]]
+end
+```
+
+## Contributing
+
+**Make sure you have the dummy app running locally to validate your changes.**
+
+- Make your changes and submit a pull request for them
+- Make sure to update `CHANGELOG.md`
+
+To release a new version of the gem:
+- Update the version in `lib/zaikio/jwt_auth/version.rb`
+- Update `CHANGELOG.md` to include the new version and its release date
+- Commit and push your changes
+- Create a [new release on GitHub](https://github.com/zaikio/zaikio-jwt_auth/releases/new)
+- CircleCI will build the Gem package and push it Rubygems for you

data/lib/zaikio/jwt_auth.rb

@@ -1,5 +1,6 @@
 require "jwt"
 require "oj"
+require "active_support/core_ext/integer/time"
 require "zaikio/jwt_auth/railtie"
 require "zaikio/jwt_auth/configuration"
 require "zaikio/jwt_auth/directory_cache"
@@ -17,7 +18,7 @@ module Zaikio
     def self.configure
       self.configuration ||= Configuration.new
 
-      if Zaikio.const_defined?("Webhooks")
+      if Zaikio.const_defined?("Webhooks", false)
         Zaikio::Webhooks.on "directory.revoked_access_token", Zaikio::JWTAuth::RevokeAccessTokenJob,
                             perform_now: true
       end
@@ -51,6 +52,20 @@ module Zaikio
       @mocked_jwt_payload = payload
     end
 
+    HEADER_FORMAT = /\ABearer (.+)\z/.freeze
+
+    def self.extract(authorization_header_string)
+      return TokenData.new(Zaikio::JWTAuth.mocked_jwt_payload) if Zaikio::JWTAuth.mocked_jwt_payload
+
+      return if authorization_header_string.blank?
+
+      return unless (token = authorization_header_string[HEADER_FORMAT, 1])
+
+      payload, = JWT.decode(token, nil, true, algorithms: ["RS256"], jwks: JWK.loader)
+
+      TokenData.new(payload)
+    end
+
     module ClassMethods
       def authorize_by_jwt_subject_type(type = nil)
         @authorize_by_jwt_subject_type ||= type
@@ -67,9 +82,8 @@ module Zaikio
 
     module InstanceMethods
       def authenticate_by_jwt
-        render_error("no_jwt_passed", status: :unauthorized) && return unless jwt_from_auth_header
-
-        token_data = TokenData.new(jwt_payload)
+        token_data = Zaikio::JWTAuth.extract(request.headers["Authorization"])
+        return render_error("no_jwt_passed", status: :unauthorized) unless token_data
 
         return if show_error_if_token_is_revoked(token_data)
 
@@ -97,21 +111,6 @@ module Zaikio
 
       private
 
-      def jwt_from_auth_header
-        return true if Zaikio::JWTAuth.mocked_jwt_payload
-
-        auth_header = request.headers["Authorization"]
-        auth_header.split("Bearer ").last if /Bearer/.match?(auth_header)
-      end
-
-      def jwt_payload
-        return Zaikio::JWTAuth.mocked_jwt_payload if Zaikio::JWTAuth.mocked_jwt_payload
-
-        payload, = JWT.decode(jwt_from_auth_header, nil, true, algorithms: ["RS256"], jwks: JWK.loader)
-
-        payload
-      end
-
       def show_error_if_authorize_by_jwt_scopes_fails(token_data)
         return if token_data.scope_by_configurations?(
           self.class.authorize_by_jwt_scopes,

data/lib/zaikio/jwt_auth/configuration.rb

@@ -11,18 +11,18 @@ module Zaikio
         production: "https://hub.zaikio.com"
       }.freeze
 
-      attr_accessor :app_name
-      attr_accessor :redis, :host
+      attr_accessor :app_name, :redis, :host
       attr_reader :environment
       attr_writer :logger, :revoked_token_ids, :keys
 
       def initialize
         @environment = :sandbox
         @revoked_token_ids = nil
+        @keys = nil
       end
 
       def logger
-        @logger ||= Logger.new(STDOUT)
+        @logger ||= Logger.new($stdout)
       end
 
       def environment=(env)
@@ -31,7 +31,7 @@ module Zaikio
       end
 
       def keys
-        defined?(@keys) && @keys.is_a?(Proc) ? @keys.call : @keys
+        @keys.is_a?(Proc) ? @keys.call : @keys
       end
 
       def revoked_token_ids

data/lib/zaikio/jwt_auth/token_data.rb

@@ -2,7 +2,7 @@ module Zaikio
   module JWTAuth
     class TokenData
       def self.subject_format
-        %r{^((\w+)/((\w|-)+)\>)?(\w+)/((\w|-)+)$}
+        %r{^((\w+)/((\w|-)+)>)?(\w+)/((\w|-)+)$}
       end
 
       def self.actions_by_permission
@@ -13,6 +13,14 @@ module Zaikio
         }.freeze
       end
 
+      def self.permissions_by_type
+        {
+          read: %w[r rw],
+          write: %w[rw w],
+          read_write: %w[r rw w]
+        }
+      end
+
       def initialize(payload)
         @payload = payload
       end
@@ -34,12 +42,12 @@ module Zaikio
       end
 
       def expires_at
-        Time.at(@payload["exp"]).to_datetime
+        Time.zone.at(@payload["exp"]).to_datetime
       end
 
       # scope_options is an array of objects with:
-      # scope, app_name (optional), except/only (array, optional)
-      def scope_by_configurations?(scope_configurations, action_name, context)
+      # scope, app_name (optional), except/only (array, optional), type (read, write, readwrite)
+      def scope_by_configurations?(scope_configurations, action_name, context) # rubocop:disable Metrics/AbcSize
         configuration = scope_configurations.find do |scope_configuration|
           action_matches = action_matches_config?(scope_configuration, action_name)
 
@@ -54,7 +62,7 @@ module Zaikio
 
         return true unless configuration
 
-        scope?(configuration[:scopes], action_name, configuration[:app_name])
+        scope?(configuration[:scopes], action_name, app_name: configuration[:app_name], type: configuration[:type])
       end
 
       def action_matches_config?(scope_configuration, action_name)
@@ -67,14 +75,14 @@ module Zaikio
         end
       end
 
-      def scope?(allowed_scopes, action_name, app_name = nil)
+      def scope?(allowed_scopes, action_name, app_name: nil, type: nil)
         app_name ||= Zaikio::JWTAuth.configuration.app_name
         Array(allowed_scopes).map(&:to_s).any? do |allowed_scope|
           scope.any? do |s|
             parts = s.split(".")
             parts[0] == app_name &&
               parts[1] == allowed_scope &&
-              action_in_permission?(action_name, parts[2])
+              action_permitted?(action_name, parts[2], type: type)
           end
         end
       end
@@ -101,8 +109,14 @@ module Zaikio
 
       private
 
-      def action_in_permission?(action_name, permission)
-        self.class.actions_by_permission[permission].include?(action_name)
+      def action_permitted?(action_name, permission, type: nil)
+        if type
+          return false unless self.class.permissions_by_type.key?(type)
+
+          self.class.permissions_by_type[type].include?(permission)
+        else
+          self.class.actions_by_permission[permission].include?(action_name)
+        end
       end
     end
   end

data/lib/zaikio/jwt_auth/version.rb

@@ -1,5 +1,5 @@
 module Zaikio
   module JWTAuth
-    VERSION = "0.3.1".freeze
+    VERSION = "0.4.4".freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: zaikio-jwt_auth
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.4.4
 platform: ruby
 authors:
 - crispymtn
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-10-15 00:00:00.000000000 Z
+date: 2021-03-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: oj
@@ -27,7 +27,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 3.0.0
 - !ruby/object:Gem::Dependency
-  name: rails
+  name: railties
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -78,10 +78,12 @@ files:
 - lib/zaikio/jwt_auth/test_helper.rb
 - lib/zaikio/jwt_auth/token_data.rb
 - lib/zaikio/jwt_auth/version.rb
-homepage: https://www.zaikio.com/
+homepage: https://github.com/zaikio/zaikio-jwt_auth
 licenses:
 - MIT
-metadata: {}
+metadata:
+  changelog_uri: https://github.com/zaikio/zaikio-jwt_auth/blob/main/CHANGELOG.md
+  source_code_uri: https://github.com/zaikio/zaikio-jwt_auth
 post_install_message: 
 rdoc_options: []
 require_paths:
@@ -90,14 +92,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 2.6.5
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.1.4
 signing_key: 
 specification_version: 4
 summary: JWT-Based authentication and authorization with zaikio