Class: Himari::JwtToken

Inherits:
Object
  • Object
show all
Defined in:
lib/himari/jwt_token.rb

Overview

Shared minting process for the JWTs Himari signs for relying parties: the OIDC ID Token and the RFC 9068 access token. Holds the common claim derivation (registered claims merged over the IdP claims) and the signing step (kid, optional JOSE header fields, signature). Subclasses add their token-specific claims/header by overriding #final_claims / #jwt_header.

Direct Known Subclasses

AccessTokenJwt, IdToken

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(claims:, client_id:, signing_key:, issuer:, time: Time.now, lifetime: 3600) ⇒ JwtToken

Returns a new instance of JwtToken.



11
12
13
14
15
16
17
18
 
# File 'lib/himari/jwt_token.rb', line 11

def initialize(claims:, client_id:, signing_key:, issuer:, time: Time.now, lifetime: 3600)
  @claims = claims
  @client_id = client_id
  @signing_key = signing_key
  @issuer = issuer
  @time = time
  @lifetime = lifetime
end

Instance Attribute Details

#claims ⇒ Object (readonly)

Returns the value of attribute claims.



20
21
22
 
# File 'lib/himari/jwt_token.rb', line 20

def claims
  @claims
end

#client_id ⇒ Object (readonly)

Returns the value of attribute client_id.



20
21
22
 
# File 'lib/himari/jwt_token.rb', line 20

def client_id
  @client_id
end

#issuer ⇒ Object (readonly)

Returns the value of attribute issuer.



20
21
22
 
# File 'lib/himari/jwt_token.rb', line 20

def issuer
  @issuer
end

#signing_key ⇒ Object (readonly)

Returns the value of attribute signing_key.



20
21
22
 
# File 'lib/himari/jwt_token.rb', line 20

def signing_key
  @signing_key
end

Instance Method Details

#final_claims ⇒ Object 



34
35
36
 
# File 'lib/himari/jwt_token.rb', line 34

def final_claims
  standard_claims
end

#jwt_header ⇒ Object

JOSE header fields beyond kid; subclasses override (e.g. typ=at+jwt for RFC 9068).



39
40
41
 
# File 'lib/himari/jwt_token.rb', line 39

def jwt_header
  {}
end

#standard_claims ⇒ Object

Registered claims common to every Himari-minted JWT. The IdP claims (sub and the rest) are carried verbatim so the access token exposes the same claim set as the ID Token.



24
25
26
27
28
29
30
31
32
 
# File 'lib/himari/jwt_token.rb', line 24

def standard_claims
  claims.merge(
    iss: @issuer,
    aud: @client_id,
    iat: @time.to_i,
    nbf: @time.to_i,
    exp: (@time + @lifetime).to_i,
  )
end

#to_jwt ⇒ Object 



43
44
45
46
47
48
 
# File 'lib/himari/jwt_token.rb', line 43

def to_jwt
  jwt = JSON::JWT.new(final_claims)
  jwt.kid = @signing_key.id
  jwt_header.each { |k, v| jwt.header[k] = v }
  jwt.sign(@signing_key.pkey, @signing_key.alg.to_sym).to_s
end