zaikio-jwt_auth 0.1.2 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 38efe9a261965fba37dd9bedfb98646dbc50943715ae3be8c643ddb9c067650b
-  data.tar.gz: 46f84150b23a8437ea5d080be5eefea054df8c7fde522593a7e445532b77578a
+  metadata.gz: 3e888abf5976a9f6837a1723da1f586f317add69e45caa8527c68c086e1f4c40
+  data.tar.gz: 3ccd16afb7cdc1e808b01dab786cf24cdab31e2eff44bffaa695a0c8231afad5
 SHA512:
-  metadata.gz: ca226ab262494c8f3619905834dc1309693df9abec13b408999eb6a6f3c9ddc12fda702394fe822b21c7960382628c2f9546db269c663f925d56de8f418badad
-  data.tar.gz: 8c55b455367af7f7e8a25ac9e78357ce208ce345e8f54f8e7f201c0bda68284e7ea04a16eae5aad1798d4b1856bd421d803192efb4c1adf478f7d1789633db72
+  metadata.gz: 36540e2d6588c39f994e4ae5dc62c2bb274d505feb32404f3d0dd7568c57f665024ed164686bc3056c5f236b4471f271917d2f42090d62a3685952010bf27ba9
+  data.tar.gz: 13447cfaf7386af9cbbfe83f54ccb0ffed13e310c9dd7fab94705ee1b321bf3d82daeb40a4ba9bb273dc313e355aaf822b33f702e5386674c5ce223cd629155f

data/README.md

@@ -6,7 +6,7 @@ Gem for JWT-Based authentication and authorization with zaikio.
 
 ## Installation
 
-Add this line to your application's Gemfile:
+1. Add this line to your application's Gemfile:
 
 ```ruby
 gem 'zaikio-jwt_auth'
@@ -22,7 +22,7 @@ Or install it yourself as:
 $ gem install zaikio-jwt_auth
 ```
 
-Configure the gem:
+2. Configure the gem:
 
 ```rb
 # config/initializers/zaikio_jwt_auth.rb
@@ -34,7 +34,7 @@ Zaikio::JWTAuth.configure do |config|
 end
 ```
 
-Extend your API application controller:
+3. Extend your API application controller:
 
 ```rb
 class API::ApplicationController < ActionController::Base
@@ -49,7 +49,40 @@ class API::ApplicationController < ActionController::Base
 end
 ```
 
-Add more restrictions to your resources:
+4. Update Revoked Access Tokens by Webhook
+
+```rb
+# ENV['ZAIKIO_SHARED_SECRET'] needs to be defined first, you can find it on your
+# app details page in zaikio. Fore more help read:
+# https://docs.zaikio.com/guide/loom/receiving-events.html
+class WebhooksController < ActionController::Base
+  include Zaikio::JWTAuth
+
+  before_action :verify_signature
+  before_action :update_blacklisted_access_tokens_by_webhook
+
+  def create
+    case params[:name]
+      # Manage other events
+    end
+  end
+
+  private
+
+  def verify_signature
+    # Read More: https://docs.zaikio.com/guide/loom/receiving-events.html
+    unless ActiveSupport::SecurityUtils.secure_compare(
+      OpenSSL::HMAC.hexdigest("SHA256", "shared-secret", request.body.read),
+      request.headers["X-Loom-Signature"]
+    )
+      render status: :unauthorized, json: { errors: ["invalid_signature"] }
+    end
+  end
+end
+```
+
+
+5. Add more restrictions to your resources:
 
 ```rb
 class API::ResourcesController < API::ApplicationController

data/lib/zaikio/jwt_auth.rb

@@ -27,8 +27,8 @@ module Zaikio
         @authorize_by_jwt_subject_type ||= type
       end
 
-      def authorize_by_jwt_scopes(scopes = nil)
-        @authorize_by_jwt_scopes ||= scopes
+      def authorize_by_jwt_scopes(scopes = nil, options = {})
+        @authorize_by_jwt_scopes ||= options.merge(scopes: scopes)
       end
     end
 
@@ -51,6 +51,17 @@ module Zaikio
         render_error("invalid_jwt") && (return)
       end
 
+      def update_blacklisted_access_tokens_by_webhook
+        return unless params[:name] == "directory.revoked_access_token"
+
+        DirectoryCache.update("api/v1/blacklisted_token_ids.json", expires_after: 60.minutes) do |data|
+          data["blacklisted_token_ids"] << params[:payload][:access_token_id]
+          data
+        end
+
+        render json: { received: true }
+      end
+
       private
 
       def jwt_from_auth_header
@@ -65,9 +76,8 @@ module Zaikio
       end
 
       def show_error_if_authorize_by_jwt_scopes_fails(token_data)
-        if !self.class.authorize_by_jwt_scopes || token_data.scope?(self.class.authorize_by_jwt_scopes, action_name)
-          return
-        end
+        scope_data = self.class.authorize_by_jwt_scopes
+        return if !scope_data[:scopes] || token_data.scope?(scope_data[:scopes], action_name, scope_data[:app_name])
 
         render_error("unpermitted_scope")
       end
@@ -92,7 +102,7 @@ module Zaikio
           return Zaikio::JWTAuth.configuration.blacklisted_token_ids
         end
 
-        DirectoryCache.fetch("api/v1/blacklisted_token_ids.json", expires_after: 5.minutes)["blacklisted_token_ids"]
+        DirectoryCache.fetch("api/v1/blacklisted_token_ids.json", expires_after: 60.minutes)["blacklisted_token_ids"]
       end
 
       def render_error(error, status: :forbidden)

data/lib/zaikio/jwt_auth/directory_cache.rb

@@ -18,6 +18,19 @@ module Zaikio
           json["data"]
         end
 
+        def update(directory_path, options = {})
+          data = fetch(directory_path, options)
+          data = yield(data)
+          Zaikio::JWTAuth.configuration.redis.set("zaikio::jwt_auth::#{directory_path}", {
+            fetched_at: Time.now.to_i,
+            data: data
+          }.to_json)
+        end
+
+        def reset(directory_path)
+          Zaikio::JWTAuth.configuration.redis.del("zaikio::jwt_auth::#{directory_path}")
+        end
+
         private
 
         def cache_expired?(json, expires_after)

data/lib/zaikio/jwt_auth/token_data.rb

@@ -33,11 +33,12 @@ module Zaikio
         @payload["jti"]
       end
 
-      def scope?(allowed_scopes, action_name)
+      def scope?(allowed_scopes, action_name, app_name = nil)
+        app_name ||= Zaikio::JWTAuth.configuration.app_name
         Array(allowed_scopes).map(&:to_s).any? do |allowed_scope|
           scope.any? do |s|
             parts = s.split(".")
-            parts[0] == Zaikio::JWTAuth.configuration.app_name &&
+            parts[0] == app_name &&
               parts[1] == allowed_scope &&
               action_in_permission?(action_name, parts[2])
           end

data/lib/zaikio/jwt_auth/version.rb

@@ -1,5 +1,5 @@
 module Zaikio
   module JWTAuth
-    VERSION = "0.1.2".freeze
+    VERSION = "0.1.3".freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: zaikio-jwt_auth
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
 platform: ruby
 authors:
 - Crispy Mountain GmbH
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-01-28 00:00:00.000000000 Z
+date: 2020-02-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: oj