Class: Keycardai::OAuth::AccessToken

Inherits:
Data
  • Object
show all
Defined in:
lib/keycardai/oauth/token_verifier.rb

Overview

A verified bearer token: the raw compact JWT plus its verified claims, with convenience accessors for the RFC 9068 profile.

Four accessors answer distinct questions about the caller, and picking the wrong one is a real bug rather than a style choice:

  • #client_id is the OAuth client that authenticated, so it names the credential. It rotates, so it does not stably identify an application.
  • #keycard_app_id is the stable Keycard application identifier. Key on this to answer "which application is calling", whatever the grant type or credential. For user agents it equals #client_id.
  • #subject is the user identifier on a user-present token and the application identifier on an application token.
  • #subject_profile distinguishes those two cases directly, rather than leaving a consumer to infer it from #subject against #client_id.

#subject and #client_id are RFC 9068. The other two are Keycard claims and are absent from a non-Keycard token, so they return nil there.

Instance Attribute Summary collapse

Instance Method Summary collapse

Instance Attribute Details

#claims ⇒ Object (readonly)

Returns the value of attribute claims

Returns:

  • (Object) —

    the current value of claims



23
24
25
 
# File 'lib/keycardai/oauth/token_verifier.rb', line 23

def claims
  @claims
end

#token ⇒ Object (readonly)

Returns the value of attribute token

Returns:

  • (Object) —

    the current value of token



23
24
25
 
# File 'lib/keycardai/oauth/token_verifier.rb', line 23

def token
  @token
end

Instance Method Details

#audiences ⇒ Array<String>

Returns audiences the token was minted for.

Returns:

  • (Array<String>) —

    audiences the token was minted for



58
59
60
 
# File 'lib/keycardai/oauth/token_verifier.rb', line 58

def audiences
  Array(claims["aud"])
end

#client_id ⇒ String

Returns the OAuth client that authenticated, meaning the credential rather than the application.

Returns:

  • (String) —

    the OAuth client that authenticated, meaning the credential rather than the application



48
49
50
 
# File 'lib/keycardai/oauth/token_verifier.rb', line 48

def client_id
  claims["client_id"]
end

#expires_at ⇒ Time

Returns:

  • (Time) 


68
69
70
 
# File 'lib/keycardai/oauth/token_verifier.rb', line 68

def expires_at
  Time.at(claims["exp"])
end

#issuer ⇒ String

Returns the issuer that minted the token.

Returns:

  • (String) —

    the issuer that minted the token



53
54
55
 
# File 'lib/keycardai/oauth/token_verifier.rb', line 53

def issuer
  claims["iss"]
end

#keycard_app_id ⇒ String?

The stable Keycard application identifier, which is the claim to key on when identifying the calling application.

Returns:

  • (String, nil) —

    nil on a non-Keycard token



42
43
44
 
# File 'lib/keycardai/oauth/token_verifier.rb', line 42

def keycard_app_id
  claims["keycard_app_id"]
end

#scopes ⇒ Array<String>

Returns scopes granted to the token.

Returns:

  • (Array<String>) —

    scopes granted to the token



63
64
65
 
# File 'lib/keycardai/oauth/token_verifier.rb', line 63

def scopes
  claims["scope"].to_s.split
end

#subject ⇒ String

Returns the token's subject: the user for a user-present token, the application for an application token.

Returns:

  • (String) —

    the token's subject: the user for a user-present token, the application for an application token



26
27
28
 
# File 'lib/keycardai/oauth/token_verifier.rb', line 26

def subject
  claims["sub"]
end

#subject_profile ⇒ "user", ...

Whether a user authorized this access or an application is acting on its own behalf. Reads the Keycard sub_profile claim.

Returns:

  • ("user", "app", nil) —

    nil on a non-Keycard token



34
35
36
 
# File 'lib/keycardai/oauth/token_verifier.rb', line 34

def subject_profile
  claims["sub_profile"]
end