~ren/magentasso-rb

ref: b4173bb058ac827bf15f2d71206b1d366c07b6e4 magentasso-rb/lib/magentasso.rb -rw-r--r-- 3.8 KiB
b4173bb0 — Lauren Jenkinson Add "json" as an explicit dependency 1 year, 5 months ago
                                                                                
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
# frozen_string_literal: true

require "json"
require "base32"
require "base64"
require "openssl"
require "securerandom"

# A library to implement a MagentaSSO provider or client.
module MagentaSSO
  # The base MagentaSSO error.
  class MagentaError < StandardError; end

  # Raised by verification methods when a signature is incorrect.
  class SignatureError < MagentaError; end

  class << self
    # Encode the +payload+ and generate a signature with the +secret+.
    def encode_and_sign(payload, secret)
      secret = Base32.decode(secret)

      payload = JSON.generate(payload)
      payload = Base64.urlsafe_encode64(payload, padding: false)
      signature = OpenSSL::HMAC.digest("SHA256", secret, payload)
      signature = Base64.urlsafe_encode64(signature, padding: false)

      [payload, signature]
    end

    # Verify the +signature+ using the +secret+, and return the decoded +payload+.
    def verify_and_decode(payload, signature, secret)
      secret = Base32.decode(secret)

      signature = Base64.urlsafe_decode64(signature)
      our_signature = OpenSSL::HMAC.digest("SHA256", secret, payload)
      raise MagentaSSO::SignatureError unless signature == our_signature

      payload = Base64.urlsafe_decode64(payload)
      JSON.parse(payload)
    end
  end

  # A Magenta authentication request.
  class Request
    attr_accessor :client_id, :client_secret, :nonce, :scopes, :callback_url

    def initialize(client_id, client_secret, nonce, scopes, callback_url)
      @client_id = client_id
      @client_secret = client_secret
      @nonce = nonce || SecureRandom.random_number(9_999_999)
      @scopes = [scopes].flatten
      @callback_url = callback_url
    end

    def self.verify(payload, signature, client_secret)
      payload = ::MagentaSSO.verify_and_decode(payload, signature, client_secret)

      new(
        payload["client_id"],
        client_secret,
        payload["nonce"],
        payload["scopes"],
        payload["callback_url"]
      )
    end

    def sign
      payload = {
        client_id: @client_id,
        nonce: @nonce,
        scopes: @scopes,
        callback_url: @callback_url
      }

      ::MagentaSSO.encode_and_sign(payload, @client_secret)
    end

    def query_params
      payload, signature = sign

      {
        client: @client_id,
        payload: payload,
        signature: signature
      }
    end
  end

  # A Magenta authentication response
  class Response
    attr_accessor :client_id, :client_secret, :nonce, :user_data, :scope_data

    def initialize(client_id, client_secret, nonce, user_data, scope_data)
      @client_id = client_id
      @client_secret = client_secret
      @nonce = nonce
      @user_data = user_data
      @scope_data = scope_data
    end

    def self.verify(payload, signature, client_secret)
      payload = ::MagentaSSO.verify_and_decode(payload, signature, client_secret)

      new(
        payload["client_id"],
        client_secret,
        payload["nonce"],
        payload["user_data"],
        payload["scope_data"]
      )
    end

    def sign
      payload = {
        client_id: @client_id,
        nonce: @nonce,
        user_data: @user_data,
        scope_data: @scope_data
      }

      ::MagentaSSO.encode_and_sign(payload, @client_secret)
    end

    def query_params
      payload, signature = sign

      {
        payload: payload,
        signature: signature
      }
    end

    def external_id
      @user_data&.[]("external_id")
    end

    def email_address
      @user_data&.[]("email")
    end

    def profile_name
      return nil unless @scope_data.key?("profile")

      return [@scope_data["profile"]["name_combined"], nil] if @scope_data["profile"].key?("name_combined")

      [
        @scope_data["profile"]["name_first"],
        @scope_data["profile"]["name_last"]
      ]
    end
  end
end

require "magentasso/version"