Class: SpreeCmCommissioner::Telegram::VerifyOauthIdToken

Inherits:
Object
  • Object
show all
Includes:
Spree::ServiceModule::Base
Defined in:
app/services/spree_cm_commissioner/telegram/verify_oauth_id_token.rb

Overview

Verifies a Telegram "Login Library / OpenID Connect" id_token and extracts the user claims. The mobile app obtains the id_token directly from Telegram using PKCE (no client secret), so here we only need to validate the JWT signature against Telegram's public JWKS and check iss/aud/exp.

Docs: https://core.telegram.org/bots/telegram-login

Constant Summary collapse

ISSUER = 
'https://oauth.telegram.org'.freeze
JWKS_URL = 
'https://oauth.telegram.org/.well-known/jwks.json'.freeze
JWKS_CACHE_KEY = 
'telegram-oauth-jwks'.freeze
SUPPORTED_ALGORITHMS =

ruby-jwt ships native support for RS256 and ES256. Telegram's JWKS also advertises EdDSA/ES256K keys, but id_tokens are signed with RS256 (kid "oidc-1") by default.

%w[RS256 ES256].freeze
VerificationError = 
Class.new(StandardError)

Instance Method Summary collapse

Instance Method Details

#call(id_token:, client_id:) ⇒ Object 



23
24
25
26
27
28
29
30
31
 
# File 'app/services/spree_cm_commissioner/telegram/verify_oauth_id_token.rb', line 23

def call(id_token:, client_id:)
  return failure(nil, 'telegram_id_token_missing') if id_token.blank?
  return failure(nil, 'telegram_oauth_client_id_not_configured') if client_id.blank?

  claim = decode_id_token(id_token, client_id)
  success(claim: claim, provider: extract_provider_params(claim))
rescue VerificationError => e
  failure(nil, e.message)
end