zaikio-jwt_auth 0.4.1 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fd2758c610957007baf7499e46f22d286a5c61dceb5895270080f20af8e5a57d
-  data.tar.gz: 5c945887dca4cd07ebfc836a5cbadb81667a56dbed0c6f67152dba297d4399fd
+  metadata.gz: cbd7c7fb4d5cb2a3d1001e5a24036beafbf3dcf76200bd052ee4c1d731c39a2d
+  data.tar.gz: 94a597d69c55f1dee78784967f6b6fa33d0b3aee98d55b4001060bc28ad1cf97
 SHA512:
-  metadata.gz: 73a3192d97b3f20caab44a96306258cd7b1b0240fb9e912726e3dfd536ef46183e0590a9cb513ed4be6afb66f4ee3c0a415153c4a7e7259a7bd569374e30eab4
-  data.tar.gz: bb9db302ba5caafeae825b25c244a91d213c1026d879c62ca2da230db6f29ade726121fcd0c0727c1e5625a84e2ed2cfb282a25ecaa827562efe6e6a9cb1a58f
+  metadata.gz: 6be2c8d3b1000c4dcbe09518fc4afb38a6f550fced5dfb82eca44636755adbcc50897c8ed81729346f8ab2b3838b2a033a0c6b33a7cb37d3e2027644e2e2daad
+  data.tar.gz: 370e9de4ce7973de106fb66259d43186876591770f71e819448d386d5c64f17751ebb32573130533777a4477df6cd0b93997e4fb6de5f7418ef4f2c82d22d560

data/README.md

@@ -63,6 +63,26 @@ end
 
 By convention, `authorize_by_jwt_scopes` automatically maps all CRUD actions in a controller. Requests for `show` and `index` with a read or read_write scope are allowed. All other actions like `create`, `update` and `destroy` are accepted if the scope is a write or read_write scope. Therefore it is strongly recommended to always create standard Rails resources. If a custom action is required, you will need to authorize yourself using the `after_jwt_auth`.
 
+#### Modifying required scopes
+If you nonetheless want to change the required scopes for CRUD routes, you can use the `type` option which accepts the following values: `:read`, `:write`, `:read_write`
+
+```rb
+class API::ResourcesController < API::ApplicationController
+  # Require a write or read_write scope on the index route
+  authorize_by_jwt_scopes 'resources', only: :index, type: :write
+end
+```
+
+#### Using custom actions
+You can also specify authorization for custom actions. When doing so the `type` option is required.
+
+```rb
+class API::ResourcesController < API::ApplicationController
+  # Require the index use to have a write or read_write scope
+  authorize_by_jwt_scopes 'resources', only: :my_custom_route, type: :write
+end
+```
+
 ### 6. Optionally, if you are using SSO: Check revoked tokens
 
 Additionally, the API provides a method called `revoked_jwt?` which expects the `jti` of the JWT.
@@ -132,7 +152,18 @@ class MyRackMiddleware < Rack::Middleware
     ...
 ```
 
-This function expects to receive the string in the format `"Bearer $token"`.
+This function expects to receive the string in the format `"Bearer $token"`. If the JWT is
+invalid, expired, or has some other fundamental issues, the JWT library may throw
+[additional errors](https://github.com/jwt/ruby-jwt/blob/v2.2.2/lib/jwt/error.rb), and you
+should be prepared to handle these, for example:
+
+```ruby
+def call(env)
+  token = Zaikio::JWTAuth.extract("definitely.not.jwt")
+rescue JWT::DecodeError, JWT::ExpiredSignature
+  [401, {}, ["Unauthorized"]]
+end
+```
 
 ## Contributing
 

data/lib/zaikio/jwt_auth.rb

@@ -18,7 +18,7 @@ module Zaikio
     def self.configure
       self.configuration ||= Configuration.new
 
-      if Zaikio.const_defined?("Webhooks")
+      if Zaikio.const_defined?("Webhooks", false)
         Zaikio::Webhooks.on "directory.revoked_access_token", Zaikio::JWTAuth::RevokeAccessTokenJob,
                             perform_now: true
       end

data/lib/zaikio/jwt_auth/directory_cache.rb

@@ -5,6 +5,8 @@ require "logger"
 module Zaikio
   module JWTAuth
     class DirectoryCache
+      BadResponseError = Class.new(StandardError)
+
       class << self
         def fetch(directory_path, options = {})
           cache = Zaikio::JWTAuth.configuration.redis.get("zaikio::jwt_auth::#{directory_path}")
@@ -48,10 +50,10 @@ module Zaikio
             }.to_json)
 
             data
-          rescue Errno::ECONNREFUSED, Net::ReadTimeout => e
+          rescue Errno::ECONNREFUSED, Net::ReadTimeout, BadResponseError => e
             raise unless (retries += 1) <= 3
 
-            Zaikio::JWTAuth.configuration.logger.log("Timeout (#{e}), retrying in 1 second...")
+            Zaikio::JWTAuth.configuration.logger.info("Timeout (#{e}), retrying in 1 second...")
             sleep(1)
             retry
           end
@@ -59,7 +61,13 @@ module Zaikio
 
         def fetch_from_directory(directory_path)
           uri = URI("#{Zaikio::JWTAuth.configuration.host}/#{directory_path}")
-          Oj.load(Net::HTTP.get(uri))
+          http = Net::HTTP.new(uri.host, uri.port)
+          http.use_ssl = uri.scheme == "https"
+          response = http.request(Net::HTTP::Get.new(uri.request_uri))
+          raise BadResponseError unless (200..299).cover?(response.code.to_i)
+          raise BadResponseError unless response["content-type"].to_s.include?("application/json")
+
+          Oj.load(response.body)
         end
       end
     end

data/lib/zaikio/jwt_auth/token_data.rb

@@ -13,6 +13,14 @@ module Zaikio
         }.freeze
       end
 
+      def self.permissions_by_type
+        {
+          read: %w[r rw],
+          write: %w[rw w],
+          read_write: %w[r rw w]
+        }
+      end
+
       def initialize(payload)
         @payload = payload
       end
@@ -38,8 +46,8 @@ module Zaikio
       end
 
       # scope_options is an array of objects with:
-      # scope, app_name (optional), except/only (array, optional)
-      def scope_by_configurations?(scope_configurations, action_name, context)
+      # scope, app_name (optional), except/only (array, optional), type (read, write, readwrite)
+      def scope_by_configurations?(scope_configurations, action_name, context) # rubocop:disable Metrics/AbcSize
         configuration = scope_configurations.find do |scope_configuration|
           action_matches = action_matches_config?(scope_configuration, action_name)
 
@@ -54,7 +62,7 @@ module Zaikio
 
         return true unless configuration
 
-        scope?(configuration[:scopes], action_name, configuration[:app_name])
+        scope?(configuration[:scopes], action_name, app_name: configuration[:app_name], type: configuration[:type])
       end
 
       def action_matches_config?(scope_configuration, action_name)
@@ -67,14 +75,14 @@ module Zaikio
         end
       end
 
-      def scope?(allowed_scopes, action_name, app_name = nil)
+      def scope?(allowed_scopes, action_name, app_name: nil, type: nil)
         app_name ||= Zaikio::JWTAuth.configuration.app_name
         Array(allowed_scopes).map(&:to_s).any? do |allowed_scope|
           scope.any? do |s|
             parts = s.split(".")
             parts[0] == app_name &&
               parts[1] == allowed_scope &&
-              action_in_permission?(action_name, parts[2])
+              action_permitted?(action_name, parts[2], type: type)
           end
         end
       end
@@ -101,8 +109,14 @@ module Zaikio
 
       private
 
-      def action_in_permission?(action_name, permission)
-        self.class.actions_by_permission[permission].include?(action_name)
+      def action_permitted?(action_name, permission, type: nil)
+        if type
+          return false unless self.class.permissions_by_type.key?(type)
+
+          self.class.permissions_by_type[type].include?(permission)
+        else
+          self.class.actions_by_permission[permission].include?(action_name)
+        end
       end
     end
   end

data/lib/zaikio/jwt_auth/version.rb

@@ -1,5 +1,5 @@
 module Zaikio
   module JWTAuth
-    VERSION = "0.4.1".freeze
+    VERSION = "0.5.1".freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: zaikio-jwt_auth
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.5.1
 platform: ruby
 authors:
 - crispymtn
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-02-15 00:00:00.000000000 Z
+date: 2021-04-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: oj
@@ -27,7 +27,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 3.0.0
 - !ruby/object:Gem::Dependency
-  name: rails
+  name: railties
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="