Class: OmniauthOpenidFederation::Jwks::Selector

Inherits:
Object
  • Object
show all
Defined in:
lib/omniauth_openid_federation/jwks/selector.rb,
sig/jwks.rbs

Class Method Summary collapse

Class Method Details

.all_keys(jwks) ⇒ Hash

Get all keys from JWKS (including previous keys from rotation)

Parameters:

  • jwks (Hash, Array) —

    JWKS hash with "keys" array or array of keys

Returns:

  • (Hash) —

    JWKS hash with all keys



45
46
47
48
 
# File 'lib/omniauth_openid_federation/jwks/selector.rb', line 45

def self.all_keys(jwks)
  keys = extract_keys_array(jwks)
  {"keys" => keys}
end

.current_keys(jwks) ⇒ Hash

Get current keys from JWKS (first signing and encryption keys) This is useful for operations that only need the current keys, not all keys including previous keys from rotation.

Parameters:

  • jwks (Hash, Array) —

    JWKS hash with "keys" array or array of keys

Returns:

  • (Hash) —

    JWKS hash with only current keys (one signing, one encryption)



20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
 
# File 'lib/omniauth_openid_federation/jwks/selector.rb', line 20

def self.current_keys(jwks)
  keys = extract_keys_array(jwks)
  return {"keys" => []} if keys.empty?

  taken_uses = []
  current_keys = keys.select do |key|
    use = key[:use] || key["use"]
    if use == "sig" && !taken_uses.include?("sig")
      taken_uses << "sig"
      true
    elsif use == "enc" && !taken_uses.include?("enc")
      taken_uses << "enc"
      true
    else
      false
    end
  end

  {"keys" => current_keys}
end

.encryption_keys(jwks) ⇒ Array<Hash>

Get encryption keys only

Parameters:

  • jwks (Hash, Array) —

    JWKS hash with "keys" array or array of keys

Returns:

  • (Array<Hash>) —

    Array of encryption keys



63
64
65
66
 
# File 'lib/omniauth_openid_federation/jwks/selector.rb', line 63

def self.encryption_keys(jwks)
  keys = extract_keys_array(jwks)
  keys.select { |key| (key[:use] || key["use"]) == "enc" }
end

.key_by_kid(jwks, kid) ⇒ Hash?

Get key by kid (key ID)

Parameters:

  • jwks (Hash, Array) —

    JWKS hash with "keys" array or array of keys

  • kid (String) —

    The key ID to find

Returns:

  • (Hash, nil) —

    The key with matching kid, or nil if not found



73
74
75
76
 
# File 'lib/omniauth_openid_federation/jwks/selector.rb', line 73

def self.key_by_kid(jwks, kid)
  keys = extract_keys_array(jwks)
  keys.find { |key| (key[:kid] || key["kid"]) == kid }
end

.signing_keys(jwks) ⇒ Array<Hash>

Get signing keys only

Parameters:

  • jwks (Hash, Array) —

    JWKS hash with "keys" array or array of keys

Returns:

  • (Array<Hash>) —

    Array of signing keys



54
55
56
57
 
# File 'lib/omniauth_openid_federation/jwks/selector.rb', line 54

def self.signing_keys(jwks)
  keys = extract_keys_array(jwks)
  keys.select { |key| (key[:use] || key["use"]) == "sig" }
end