Initial commit

config/initializers/jwt.rb

@@ -0,0 +1,65 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+Rails.configuration.x.jwt_public_key =
+  if ENV['JWT_PUBLIC_KEY'].present?
+    key = OpenSSL::PKey.read(Base64.urlsafe_decode64(ENV['JWT_PUBLIC_KEY']))
+    raise ArgumentError, 'JWT_PUBLIC_KEY was set to private key, however it should be public.' if key.private?
+
+    key
+  end
+
+::Rails.configuration.x.jwt_options = {
+  algorithm: ENV.fetch('JWT_ALGORITHM', 'RS256'),
+  verify_expiration: true,
+  verify_not_before: true,
+  iss: ENV['JWT_ISSUER'],
+  verify_iss: ENV['JWT_ISSUER'].present?,
+  verify_iat: true,
+  verify_jti: true,
+  aud: ENV['JWT_AUDIENCE'].to_s.split(',').reject(&:blank?),
+  verify_aud: ENV['JWT_AUDIENCE'].present?,
+  sub: 'session',
+  verify_sub: true,
+}.compact.tap do |jwt_options|
+  leeway_options = {
+    leeway: ENV['JWT_DEFAULT_LEEWAY'],
+    iat_leeway: ENV['JWT_ISSUED_AT_LEEWAY'],
+    exp_leeway: ENV['JWT_EXPIRATION_LEEWAY'],
+    nbf_leeway: ENV['JWT_NOT_BEFORE_LEEWAY'],
+  }.compact.transform_values!(&:to_i)
+
+  jwt_options.merge!(leeway_options)
+
+  # Set algorithm to 'none' if public key was not provided.
+  # Since rack-jwt requires public_key for all algorithms except 'none'
+  # Also using empty public key doesn't make sense unless you use 'none' algorithm.
+  jwt_options[:algorithm] = 'none' if ::Rails.configuration.x.jwt_public_key.blank?
+end
+
+require 'yaml'
+require 'openssl'
+
+(YAML.load_file('config/management_api_v1.yml') || {}).deep_symbolize_keys.tap do |x|
+  x.fetch(:keychain).each do |id, key|
+    key = OpenSSL::PKey.read(Base64.urlsafe_decode64(key.fetch(:value)))
+    if key.private?
+      raise ArgumentError, 'keychain.' + id.to_s + ' was set to private key, ' \
+                           'however it should be public (in config/management_api_v1.yml).'
+    end
+    x[:keychain][id][:value] = key
+  end
+
+  x.fetch(:scopes).values.each do |scope|
+    %i[permitted_signers mandatory_signers].each do |list|
+      scope[list] = scope.fetch(list, []).map(&:to_sym)
+      scope[list] = scope.fetch(list, []).map(&:to_sym)
+      if list == :mandatory_signers && scope[list].empty?
+        raise ArgumentError, 'scopes.' + scope.to_s + '.' + list.to_s + ' is empty, ' \
+                             'however it should contain at least one value (in config/management_api_v1.yml).'
+      end
+    end
+  end
+
+  Rails.configuration.x.security_configuration = x
+end