Class: Verikloak::Audience::Middleware

Inherits:
Object
  • Object
show all
Includes:
SkipPathMatcher
Defined in:
lib/verikloak/audience/middleware.rb

Overview

Rack middleware that validates audience claims according to configured profile.

Place this middleware after the core Middleware so that verified token claims are already available in the Rack env.

Instance Method Summary collapse

Constructor Details

#initialize(app, **opts) ⇒ Middleware

Returns a new instance of Middleware.

Parameters:

  • app (#call) —

    next Rack application

  • opts (Hash) —

    configuration overrides (see Configuration)

Options Hash (**opts):

  • :profile (Symbol) — default: :strict_single, :allow_account, :any_match, :resource_or_aud
  • :required_aud (Array<String>, String, Symbol)
  • :resource_client (String)
  • :env_claims_key (String)
  • :suggest_in_logs (Boolean)
  • :skip_paths (Array<String, Regexp>) 


28
29
30
31
32
33
34
 
# File 'lib/verikloak/audience/middleware.rb', line 28

def initialize(app, **opts)
  @app = app
  @config = Verikloak::Audience.config.dup
  apply_overrides!(opts)
  @config.validate! unless skip_validation?
  compile_skip_paths(@config.skip_paths || [])
end

Instance Method Details

#call(env) ⇒ Array(Integer, Hash, #each)

Evaluate the request against the audience profile.

Parameters:

  • env (Hash) —

    Rack environment

Returns:

  • (Array(Integer, Hash, #each)) —

    Rack response triple



40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
 
# File 'lib/verikloak/audience/middleware.rb', line 40

def call(env)
  # Skip audience validation for configured paths (e.g., health checks)
  path = env['PATH_INFO'] || env['REQUEST_PATH'] || ''
  return @app.call(env) if skip?(path)

  claims = read_claims(env)
  begin
    authorized = Checker.ok?(claims, @config)
  rescue Verikloak::Audience::ConfigurationError => e
    return configuration_error_response(env, e)
  end
  return @app.call(env) if authorized

  log_rejection(env, claims)

  Verikloak::ErrorResponse.build(
    code: 'insufficient_audience',
    message: "Audience not acceptable for profile #{@config.profile}",
    status: 403
  )
end