Module: BetterAuth::Crypto::JWE

Defined in:
lib/better_auth/crypto/jwe.rb

Constant Summary collapse

ALG = 
"dir"
ENC = 
"A256CBC-HS512"
INFO = 
"BetterAuth.js Generated Encryption Key"
CLOCK_TOLERANCE = 
15

Class Method Summary collapse

Class Method Details

.all_secrets(secret) ⇒ Object 



69
70
71
72
73
 
# File 'lib/better_auth/crypto/jwe.rb', line 69

def all_secrets(secret)
  return [[0, secret]] unless secret.is_a?(SecretConfig)

  secret.all_secrets
end

.current_secret(secret) ⇒ Object 



65
66
67
 
# File 'lib/better_auth/crypto/jwe.rb', line 65

def current_secret(secret)
  secret.is_a?(SecretConfig) ? secret.current_secret : secret
end

.decode(token, secret, salt) ⇒ Object 



33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
 
# File 'lib/better_auth/crypto/jwe.rb', line 33

def decode(token, secret, salt)
  return nil if token.to_s.empty?

  header = protected_header(token)
  return nil unless valid_header?(header)

  decryption_keys(secret, salt, header["kid"]).each do |key|
    payload = JSON.parse(::JWE.decrypt(token.to_s, key))
    return nil if expired?(payload)

    return payload
  rescue JSON::ParserError, ::JWE::DecodeError, ::JWE::InvalidData, ::JWE::BadCEK
    next
  end

  nil
rescue JSON::ParserError, ArgumentError, ::JWE::DecodeError, ::JWE::InvalidData, ::JWE::BadCEK
  nil
end

.decryption_keys(secret, salt, kid) ⇒ Object 



75
76
77
78
79
80
 
# File 'lib/better_auth/crypto/jwe.rb', line 75

def decryption_keys(secret, salt, kid)
  keys = all_secrets(secret).map { |_version, value| encryption_key(value, salt) }
  return keys if kid.nil?

  keys.select { |key| thumbprint(key) == kid }
end

.encode(payload, secret, salt, expires_in: 3600) ⇒ Object 



23
24
25
26
27
28
29
30
31
 
# File 'lib/better_auth/crypto/jwe.rb', line 23

def encode(payload, secret, salt, expires_in: 3600)
  claims = Crypto.stringify_keys(payload).merge(
    "iat" => Time.now.to_i,
    "exp" => Time.now.to_i + expires_in.to_i,
    "jti" => SecureRandom.uuid
  )
  key = encryption_key(current_secret(secret), salt)
  ::JWE.encrypt(JSON.generate(claims), key, alg: ALG, enc: ENC, kid: thumbprint(key))
end

.encryption_key(secret, salt) ⇒ Object 



53
54
55
 
# File 'lib/better_auth/crypto/jwe.rb', line 53

def encryption_key(secret, salt)
  OpenSSL::KDF.hkdf(secret.to_s, salt: salt.to_s, info: INFO, length: 64, hash: "SHA256")
end

.expired?(payload) ⇒ Boolean

Returns:

  • (Boolean) 


93
94
95
 
# File 'lib/better_auth/crypto/jwe.rb', line 93

def expired?(payload)
  payload["exp"] && payload["exp"].to_i < Time.now.to_i - CLOCK_TOLERANCE
end

.protected_header(token) ⇒ Object 



82
83
84
85
86
87
 
# File 'lib/better_auth/crypto/jwe.rb', line 82

def protected_header(token)
  first_segment = token.to_s.split(".", 2).first
  JSON.parse(Crypto.base64url_decode(first_segment))
rescue JSON::ParserError, ArgumentError
  {}
end

.thumbprint(key) ⇒ Object 



57
58
59
60
61
62
63
 
# File 'lib/better_auth/crypto/jwe.rb', line 57

def thumbprint(key)
  jwk = {
    "k" => Base64.urlsafe_encode64(key, padding: false),
    "kty" => "oct"
  }
  Crypto.base64url_encode(OpenSSL::Digest.digest("SHA256", JSON.generate(jwk)))
end

.valid_header?(header) ⇒ Boolean

Returns:

  • (Boolean) 


89
90
91
 
# File 'lib/better_auth/crypto/jwe.rb', line 89

def valid_header?(header)
  header["alg"] == ALG && header["enc"] == ENC
end