Class: EeIdVerification::WebEidVerifier

Inherits:
Object
  • Object
show all
Defined in:
lib/ee_id_verification/web_eid_verifier.rb

Overview

Web eID authentication token verifier for Estonian ID cards.

This class provides functionality to verify Web eID authentication tokens received from Estonian ID card authentication through web browsers.

Instance Method Summary collapse

Constructor Details

#initialize(trusted_ca_certs: nil) ⇒ WebEidVerifier 



13
14
15
 
# File 'lib/ee_id_verification/web_eid_verifier.rb', line 13

def initialize(trusted_ca_certs: nil)
  @trusted_ca_certs = trusted_ca_certs || load_default_ca_certs
end

Instance Method Details

#verify_auth_token(auth_token, challenge_nonce) ⇒ Object

Raises:



17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
 
# File 'lib/ee_id_verification/web_eid_verifier.rb', line 17

def verify_auth_token(auth_token, challenge_nonce)
  raise Error, "Authentication token is required" if auth_token.nil? || auth_token.empty?
  raise Error, "Challenge nonce is required" if challenge_nonce.nil? || challenge_nonce.empty?

  begin
    # Parse and validate the authentication token structure
    validate_token_structure(auth_token)

    # Check if this is a mock authentication (for testing)
    return handle_mock_authentication(auth_token) if auth_token["signature"]&.start_with?("mock-signature-")

    # For development, we'll skip strict signature verification
    # In production, uncomment the next line:
    # verify_signature(auth_token, challenge_nonce)
    puts "Skipping signature verification for development"

    # Extract personal data from certificate
    cert_der = Base64.decode64(auth_token["unverifiedCertificate"])
    certificate = OpenSSL::X509::Certificate.new(cert_der)
    personal_data = extract_personal_data_from_cert(certificate)

    # Verify certificate chain
    verify_certificate_chain(certificate)

    AuthenticationResult.new(
      session_id: SecureRandom.hex(16),
      status: :completed,
      authenticated: true,
      personal_code: personal_data[:personal_code],
      given_name: personal_data[:given_name],
      surname: personal_data[:surname],
      country: personal_data[:country]
    )
  rescue StandardError => e
    AuthenticationResult.new(
      session_id: SecureRandom.hex(16),
      status: :failed,
      authenticated: false,
      error: e.message
    )
  end
end