Class: Keycardai::OAuth::JWTSigner

Inherits:
Object
  • Object
show all
Defined in:
lib/keycardai/oauth/jwt_signer.rb

Overview

Signs compact JWTs (RFC 7519) with RS256, the baseline algorithm the SDK family uses for private_key_jwt client assertions (RFC 7523) and signed access tokens (RFC 9068).

The signer writes the JWT header (kid) from its construction-time key material. Claims are signed verbatim: temporal claims (exp, iat, nbf) come from the caller and the signer does not invent an expiry. When the claims omit iss and the signer carries an issuer, iss is filled in; a caller-supplied iss is preserved.

Constant Summary collapse

ALGORITHM = 
"RS256"

Instance Method Summary collapse

Constructor Details

#initialize(key:, kid:, issuer: nil) ⇒ JWTSigner

Returns a new instance of JWTSigner.

Parameters:

  • key (OpenSSL::PKey::RSA) —

    the RSA private signing key

  • kid (String) —

    key id written to the JWT header

  • issuer (String, nil) (defaults to: nil) —

    default iss, applied only when claims omit it

Raises:



23
24
25
26
27
28
29
30
31
32
 
# File 'lib/keycardai/oauth/jwt_signer.rb', line 23

def initialize(key:, kid:, issuer: nil)
  unless key.is_a?(OpenSSL::PKey::RSA) && key.private?
    raise ConfigurationError, "JWTSigner requires an RSA private key"
  end
  raise ConfigurationError, "JWTSigner requires a kid" if kid.nil? || kid.empty?

  @key = key
  @kid = kid
  @issuer = issuer
end

Instance Method Details

#sign(claims) ⇒ String

Sign a claim set into a compact JWS (header.payload.signature).

Parameters:

  • claims (Hash) —

    payload claims; string or symbol keys

Returns:

  • (String) —

    the signed compact JWT



38
39
40
41
42
 
# File 'lib/keycardai/oauth/jwt_signer.rb', line 38

def sign(claims)
  payload = claims.transform_keys(&:to_s)
  payload["iss"] = @issuer if @issuer && !payload.key?("iss")
  JWT.encode(payload, @key, ALGORITHM, { "kid" => @kid })
end