66 lines
2.3 KiB
Ruby
66 lines
2.3 KiB
Ruby
# encoding: UTF-8
|
|
# frozen_string_literal: true
|
|
|
|
Rails.configuration.x.jwt_public_key =
|
|
if ENV['JWT_PUBLIC_KEY'].present?
|
|
key = OpenSSL::PKey.read(Base64.urlsafe_decode64(ENV['JWT_PUBLIC_KEY']))
|
|
raise ArgumentError, 'JWT_PUBLIC_KEY was set to private key, however it should be public.' if key.private?
|
|
|
|
key
|
|
end
|
|
|
|
::Rails.configuration.x.jwt_options = {
|
|
algorithm: ENV.fetch('JWT_ALGORITHM', 'RS256'),
|
|
verify_expiration: true,
|
|
verify_not_before: true,
|
|
iss: ENV['JWT_ISSUER'],
|
|
verify_iss: ENV['JWT_ISSUER'].present?,
|
|
verify_iat: true,
|
|
verify_jti: true,
|
|
aud: ENV['JWT_AUDIENCE'].to_s.split(',').reject(&:blank?),
|
|
verify_aud: ENV['JWT_AUDIENCE'].present?,
|
|
sub: 'session',
|
|
verify_sub: true,
|
|
}.compact.tap do |jwt_options|
|
|
leeway_options = {
|
|
leeway: ENV['JWT_DEFAULT_LEEWAY'],
|
|
iat_leeway: ENV['JWT_ISSUED_AT_LEEWAY'],
|
|
exp_leeway: ENV['JWT_EXPIRATION_LEEWAY'],
|
|
nbf_leeway: ENV['JWT_NOT_BEFORE_LEEWAY'],
|
|
}.compact.transform_values!(&:to_i)
|
|
|
|
jwt_options.merge!(leeway_options)
|
|
|
|
# Set algorithm to 'none' if public key was not provided.
|
|
# Since rack-jwt requires public_key for all algorithms except 'none'
|
|
# Also using empty public key doesn't make sense unless you use 'none' algorithm.
|
|
jwt_options[:algorithm] = 'none' if ::Rails.configuration.x.jwt_public_key.blank?
|
|
end
|
|
|
|
require 'yaml'
|
|
require 'openssl'
|
|
|
|
(YAML.load_file('config/management_api_v1.yml') || {}).deep_symbolize_keys.tap do |x|
|
|
x.fetch(:keychain).each do |id, key|
|
|
key = OpenSSL::PKey.read(Base64.urlsafe_decode64(key.fetch(:value)))
|
|
if key.private?
|
|
raise ArgumentError, 'keychain.' + id.to_s + ' was set to private key, ' \
|
|
'however it should be public (in config/management_api_v1.yml).'
|
|
end
|
|
x[:keychain][id][:value] = key
|
|
end
|
|
|
|
x.fetch(:scopes).values.each do |scope|
|
|
%i[permitted_signers mandatory_signers].each do |list|
|
|
scope[list] = scope.fetch(list, []).map(&:to_sym)
|
|
scope[list] = scope.fetch(list, []).map(&:to_sym)
|
|
if list == :mandatory_signers && scope[list].empty?
|
|
raise ArgumentError, 'scopes.' + scope.to_s + '.' + list.to_s + ' is empty, ' \
|
|
'however it should contain at least one value (in config/management_api_v1.yml).'
|
|
end
|
|
end
|
|
end
|
|
|
|
Rails.configuration.x.security_configuration = x
|
|
end
|