Class: BlueFactory::UserInfo

Inherits:
Object
  • Object
show all
Defined in:
lib/blue_factory/user_info.rb

Overview

An object which provides info about the user making the request, based on the included authorization header (if any). Accessed through RequestContext#user.

Instance Method Summary collapse

Constructor Details

#initialize(auth_header) ⇒ UserInfo

Returns a new instance of UserInfo.

Parameters:

  • auth_header (String, nil) —

    value of the "Authorization" HTTP header



18
19
20
 
# File 'lib/blue_factory/user_info.rb', line 18

def initialize(auth_header)
  @auth = auth_header
end

Instance Method Details

#raw_did ⇒ String?

Returns the user's (unverified) DID decoded from the JWT payload of the bearer token.

Important: this method does not verify the signature of the token, which means the token can be fairly easily forged to impersonate another user, and this method would not detect that. Do not rely on it for use cases where it's important to be certain of the requesting user's identity.

Returns:

  • (String, nil) —

    user DID decoded from the token

Raises:



51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
 
# File 'lib/blue_factory/user_info.rb', line 51

def raw_did
  return nil if token.nil?

  parts = token.split('.')
  raise AuthorizationError.new("Invalid JWT format", "BadJwt") unless parts.length == 3

  begin
    payload = JSON.parse(Base64.decode64(parts[1]))
  rescue StandardError => e
    raise AuthorizationError.new("Invalid JWT format", "BadJwt")
  end

  if did = payload['iss']
    did
  else
    raise AuthorizationError.new("Invalid JWT format", "BadJwt")
  end
end

#token ⇒ String?

The bearer token extracted from the authorization header.

Returns:

  • (String, nil)

Raises:



28
29
30
31
32
33
34
35
36
37
38
 
# File 'lib/blue_factory/user_info.rb', line 28

def token
  @token ||= begin
    if @auth.nil? || @auth.strip.empty?
      nil
    elsif !@auth.start_with?('Bearer ')
      raise AuthorizationError, "Unsupported authorization method"
    else
      @auth.gsub(/^Bearer /, '')
    end
  end
end