Class: Nonnative::PasetoToken

Inherits:
Object
  • Object
show all
Defined in:
lib/nonnative/paseto_token.rb

Overview

Generates Ed25519 PASETO v4.public tokens for authenticating against services under test.

The key id is carried in a JSON footer ({"kid":"..."}), and the claims match the common iss/aud/sub/iat/nbf/exp/jti set expected by verifiers such as go-service. The signing library is required lazily so that requiring nonnative does not depend on rbnacl/libsodium being present.

Examples:

paseto = Nonnative::PasetoToken.new(issuer: 'iss', key: 'key-1', private_key: 'config/ed25519.pem', expiration: 3600)
paseto.generate(aud: 'GET /v1/things', sub: 'user-1')

See Also:

Instance Method Summary collapse

Constructor Details

#initialize(issuer:, key:, private_key:, expiration:) ⇒ PasetoToken

Returns a new instance of PasetoToken.

Parameters:

  • issuer (String) —

    the iss claim

  • key (String) —

    the key id carried in the kid footer

  • private_key (String) —

    path to a PKCS#8 Ed25519 private key PEM file

  • expiration (Integer) —

    token lifetime in seconds (drives exp)



20
21
22
23
24
25
 
# File 'lib/nonnative/paseto_token.rb', line 20

def initialize(issuer:, key:, private_key:, expiration:)
  @issuer = issuer
  @key = key
  @ed25519 = Nonnative::Ed25519Key.new(private_key)
  @expiration = expiration
end

Instance Method Details

#generate(aud:, sub:) ⇒ String

Generates a signed PASETO v4.public token.

Parameters:

  • aud (String) —

    the aud claim (for example "GET /v1/things" or a gRPC full method)

  • sub (String) —

    the sub claim

Returns:

  • (String) —

    the signed PASETO token



32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
 
# File 'lib/nonnative/paseto_token.rb', line 32

def generate(aud:, sub:)
  load_dependencies!

  now = Time.now.utc
  claims = {
    'iss' => @issuer,
    'aud' => aud,
    'sub' => sub,
    'iat' => now.iso8601,
    'nbf' => now.iso8601,
    'exp' => (now + @expiration).iso8601,
    'jti' => SecureRandom.uuid
  }

  Paseto::V4::Public.new(@ed25519.pem).encode!(claims, footer: { 'kid' => @key }.to_json)
end