SWAMPy

✎ CARVE FLESH

EDITING: asymmetric_client_credentials_provider.rb

# frozen_string_literal: true

#
# Copyright (C) 2018 - present Instructure, Inc.
#
# This file is part of Canvas.
#
# Canvas is free software: you can redistribute it and/or modify it under
# the terms of the GNU Affero General Public License as published by the Free
# Software Foundation, version 3 of the License.
#
# Canvas is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
# details.
#
# You should have received a copy of the GNU Affero General Public License along
# with this program. If not, see <http://www.gnu.org/licenses/>.

module Canvas::OAuth
  class AsymmetricClientCredentialsProvider < ClientCredentialsProvider
    def initialize(jwt, host, scopes = nil, protocol = "http://")
      super(JSON::JWT.decode(jwt, :skip_verification)[:sub], host, scopes, protocol)
      @errors = []
      if key.nil? || (key.public_jwk.nil? && key.public_jwk_url.nil?)
        @invalid_key = true
      else
        decoded_jwt(jwt)
      end
    end

def valid?
      return false if @invalid_key

validator.valid?
    end

def error_message
      return "JWS signature invalid." if @invalid_key
      return "JWK Error: #{errors.first.message}" if errors.present?

validator.error_message
    end

private

attr_accessor :errors

def validator
      @validator ||= Canvas::Security::JwtValidator.new(
        jwt: decoded_jwt,
        expected_aud: @expected_aud,
        full_errors: true,
        require_iss: true,
        skip_jti_check: true
      )
    end

def decoded_jwt(jwt = nil)
      @decoded_jwt ||= if key.public_jwk_url.present?
                         get_jwk_from_url(jwt)
                       else
                         JSON::JWT.decode(jwt, JSON::JWK.new(key.public_jwk), :RS256)
                       end
    rescue JSON::JWS::VerificationFailed, JSON::JWS::UnexpectedAlgorithm
      @invalid_key = true
    end

def get_jwk_from_url(jwt = nil)
      pub_jwk_from_url = HTTParty.get(key.public_jwk_url)
      JSON::JWT.decode(jwt, JSON::JWK::Set.new(pub_jwk_from_url.parsed_response))
    rescue JSON::JWT::Exception => e
      errors << e
      raise JSON::JWS::VerificationFailed
    end
  end
end

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📁 grant_types/	DIR	—	2023-09-24 03:36
📄 asymmetric_client_credentials_provider.rb	RB	2.3 KB	2023-09-24 03:39	EDIT
📄 client_credentials_provider.rb	RB	2.1 KB	2023-09-24 03:36	EDIT
📄 invalid_request_error.rb	RB	933 B	2023-09-24 03:36	EDIT
📄 invalid_scope_error.rb	RB	1.2 KB	2023-09-24 03:36	EDIT
📄 key_storage.rb	RB	805 B	2023-09-24 03:36	EDIT
📄 provider.rb	RB	4.4 KB	2023-09-24 03:36	EDIT
📄 request_error.rb	RB	3.1 KB	2023-09-24 03:36	EDIT
📄 site_admin_client_credentials_provider.rb	RB	1.6 KB	2023-09-24 03:36	EDIT
📄 symmetric_client_credentials_provider.rb	RB	926 B	2023-09-24 03:36	EDIT
📄 token.rb	RB	5.7 KB	2023-09-24 03:36	EDIT