zaikio-oauth_client 0.17.1 → 0.18.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 237bdb03b2ab2870ef2c0b9a92c9dac64fb2c67df2bba8e9234831eb14954f42
-  data.tar.gz: ae977109316a023585e008e669958775534eef2ecea309ede9b373d44f368fd4
+  metadata.gz: 25dbc767b924d59fa2706f4d7da22fd940ff80da966856447b8027e1ebca986c
+  data.tar.gz: 0a7dbef1ae4c475583c5958ce4320285ca32532b7f55cc7a2b33386109657e2d
 SHA512:
-  metadata.gz: 44945aba1999049638cca10555d4dc192e191fa1fdf81965fa43fe31d1ab01c5e6054769a94efe0e862feee171a24b6d9a50853395628e497e30fb4629295ddf
-  data.tar.gz: b97fe832a40614ef14da36d12492e368c86460b0dde1867f411d0360d581fb3fe60256b3efea8d1653d744a1598908d9636d1a97c7043a59de56f6b87deb23ee
+  metadata.gz: f7c542585a0f6d9b47736f587f3b4f75b4544c439f23da8013c67d2f5d27d081c649e7c62985d787956bc04363c0d27315a6cdeb6085c8d2d51b30e022f5e55c
+  data.tar.gz: 2f418622e4ff38e2f2e3f0b9550ffc170a0278584cc2261012a2632c5e7d7de6ca472f73e0a2720e11dcc8129663377772e692085ffc28cd13cac0573e3f9d4b

data/README.md

@@ -14,7 +14,17 @@ Then run `bundle install`.
 
 ## Setup & Configuration
 
-### 1. Copy & run Migrations
+### 1. Setup Active Record encryption
+
+Setup [Active Record Encryption](https://guides.rubyonrails.org/active_record_encryption.html#setup) by running:
+
+```
+rails db:encryption:init
+```
+
+(Continue generating the credentials each for different environments)
+
+### 2. Copy & run Migrations
 
 ```bash
 rails zaikio_oauth_client:install:migrations
@@ -24,7 +34,7 @@ rails db:migrate
 This will create the tables:
 + `zaikio_access_tokens`
 
-### 2. Mount routes
+### 3. Mount routes
 
 Add this to `config/routes.rb`:
 
@@ -32,7 +42,7 @@ Add this to `config/routes.rb`:
 mount Zaikio::OAuthClient::Engine => "/zaikio"
 ```
 
-### 3. Configure Gem
+### 4. Configure Gem
 
 ```rb
 # config/initializers/zaikio_oauth_client.rb
@@ -70,7 +80,7 @@ end
 ```
 
 
-### 4. Clean up outdated access tokens (recommended)
+### 5. Clean up outdated access tokens (recommended)
 
 To avoid keeping all expired oath and refresh tokens in your database, we recommend to implement their scheduled deletion. We recommend therefore to use a schedule gems such as [sidekiq](https://github.com/mperham/sidekiq) and [sidekiq-scheduler](https://github.com/moove-it/sidekiq-scheduler).
 

data/app/models/zaikio/access_token.rb

@@ -5,6 +5,10 @@ module Zaikio
   class AccessToken < ApplicationRecord
     self.table_name = "zaikio_access_tokens"
 
+    # Encryption
+    encrypts :token
+    encrypts :refresh_token
+
     def self.build_from_access_token(access_token, requested_scopes: nil)
       payload = JWT.decode(access_token.token, nil, false).first rescue {} # rubocop:disable Style/RescueModifier
       scopes = access_token.params["scope"].split(",")
@@ -63,7 +67,7 @@ module Zaikio
     end
 
     def bearer_klass
-      return unless Zaikio.const_defined?(:"Hub::Models", false)
+      return unless Zaikio.const_defined?("Hub::Models", false) # rubocop:disable Performance/StringIdentifierArgument
 
       if Zaikio::Hub::Models.configuration.respond_to?(:"#{bearer_type.underscore}_class_name")
         Zaikio::Hub::Models.configuration.public_send(:"#{bearer_type.underscore}_class_name").constantize

data/db/migrate/20220425130923_encrypt_tokens.rb

@@ -0,0 +1,45 @@
+class EncryptTokens < ActiveRecord::Migration[7.0]
+  def change
+    reversible do |dir|
+      dir.up do
+        rename_column :zaikio_access_tokens, :token, :unencrypted_token
+        rename_column :zaikio_access_tokens, :refresh_token, :unencrypted_refresh_token
+
+        add_column :zaikio_access_tokens, :token, :string
+        add_column :zaikio_access_tokens, :refresh_token, :string
+
+        Zaikio::AccessToken.find_each do |access_token|
+          access_token.update(
+            token: access_token.unencrypted_token,
+            refresh_token: access_token.unencrypted_refresh_token
+          )
+        end
+
+        change_column_null :zaikio_access_tokens, :token, false
+
+        remove_column :zaikio_access_tokens, :unencrypted_token, :string
+        remove_column :zaikio_access_tokens, :unencrypted_refresh_token, :string
+      end
+
+      dir.down do
+        add_column :zaikio_access_tokens, :unencrypted_token, :string
+        add_column :zaikio_access_tokens, :unencrypted_refresh_token, :string
+
+        Zaikio::AccessToken.find_each do |access_token|
+          access_token.update_columns(
+            unencrypted_token: access_token.token,
+            unencrypted_refresh_token: access_token.refresh_token
+          )
+        end
+
+        remove_column :zaikio_access_tokens, :token, :string
+        remove_column :zaikio_access_tokens, :refresh_token, :string
+
+        rename_column :zaikio_access_tokens, :unencrypted_token, :token
+        rename_column :zaikio_access_tokens, :unencrypted_refresh_token, :refresh_token
+
+        change_column_null :zaikio_access_tokens, :token, false
+      end
+    end
+  end
+end

data/lib/zaikio/oauth_client/version.rb

@@ -1,5 +1,5 @@
 module Zaikio
   module OAuthClient
-    VERSION = "0.17.1".freeze
+    VERSION = "0.18.1".freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: zaikio-oauth_client
 version: !ruby/object:Gem::Version
-  version: 0.17.1
+  version: 0.18.1
 platform: ruby
 authors:
 - Zaikio GmbH
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-01-07 00:00:00.000000000 Z
+date: 2022-04-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionpack
@@ -89,7 +89,7 @@ dependencies:
         version: '0.5'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -99,7 +99,7 @@ dependencies:
         version: '0.5'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: pg
   requirement: !ruby/object:Gem::Requirement
@@ -157,6 +157,7 @@ files:
 - db/migrate/20191017132048_create_zaikio_access_tokens.rb
 - db/migrate/20210222135920_enhance_access_token_index.rb
 - db/migrate/20210224154303_add_requested_scopes_to_zaikio_access_tokens.rb
+- db/migrate/20220425130923_encrypt_tokens.rb
 - lib/tasks/zaikio_tasks.rake
 - lib/zaikio/oauth_client.rb
 - lib/zaikio/oauth_client/authenticatable.rb