Class: Nonnative::Token

Inherits:
Object
  • Object
show all
Defined in:
lib/nonnative/token.rb

Overview

Builds signed JWT tokens for authenticating against services under test.

The consumer passes in the signing parameters they parsed from their own configuration; this class is not coupled to any particular service's configuration format. The generated token string is ready to pass to Header.auth_bearer.

Examples:

JWT

token = Nonnative::Token.new(kind: 'jwt', issuer: 'iss', key: 'key-1',
                             private_key: 'config/ed25519.pem', expiration: 3600)
header = Nonnative::Header.auth_bearer(token.generate(aud: 'GET /v1/things', sub: 'user-1'))

See Also:

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(kind:, issuer:, key:, private_key:, expiration:) ⇒ Token

Returns a new instance of Token.

Parameters:

  • kind (String) —

    token kind, "jwt"

  • issuer (String) —

    the iss claim

  • key (String) —

    the key id (JWT kid header)

  • private_key (String) —

    path to a PKCS#8 Ed25519 private key PEM file

  • expiration (Integer) —

    token lifetime in seconds (drives exp)

Raises:

  • (ArgumentError) —

    if the kind is not supported



42
43
44
45
46
 
# File 'lib/nonnative/token.rb', line 42

def initialize(kind:, issuer:, key:, private_key:, expiration:)
  raise ArgumentError, "Unsupported token kind '#{kind}'" unless kind == 'jwt'

  @token = Nonnative::JwtToken.new(issuer: issuer, key: key, private_key: private_key, expiration: expiration)
end

Class Method Details

.grpc_audience(full_method) ⇒ String

Builds the audience string for a gRPC endpoint.

Parameters:

  • full_method (String) —

    the gRPC full method (for example "/health.v1.Health/Check")

Returns:

  • (String) —

    the audience string



31
32
33
 
# File 'lib/nonnative/token.rb', line 31

def grpc_audience(full_method)
  full_method
end

.http_audience(method, path) ⇒ String

Builds the audience string for an HTTP endpoint.

Parameters:

  • method (String) —

    HTTP method (for example "GET")

  • path (String) —

    request path (for example "/v1/things")

Returns:

  • (String) —

    the audience string (for example "GET /v1/things")



23
24
25
 
# File 'lib/nonnative/token.rb', line 23

def http_audience(method, path)
  "#{method} #{path}"
end

Instance Method Details

#generate(aud:, sub:, issued_at: nil, not_before: nil, expires_at: nil) ⇒ String

Generates a signed token.

The optional time claims default to the current time (and the constructor expiration), so omitting them reproduces the token's normal claims. Supply them to mint tokens with specific time claims for negative auth tests, such as a not-yet-valid (future not_before) or clock-skewed token. Times are absolute.

Parameters:

  • aud (String) —

    the aud claim

  • sub (String) —

    the sub claim

  • issued_at (Time, nil) (defaults to: nil) —

    overrides the iat claim (default: now)

  • not_before (Time, nil) (defaults to: nil) —

    overrides the nbf claim (default: issued_at)

  • expires_at (Time, nil) (defaults to: nil) —

    overrides the exp claim (default: issued_at plus expiration)

Returns:

  • (String) —

    the signed token



61
62
63
 
# File 'lib/nonnative/token.rb', line 61

def generate(aud:, sub:, issued_at: nil, not_before: nil, expires_at: nil)
  @token.generate(aud: aud, sub: sub, issued_at: issued_at, not_before: not_before, expires_at: expires_at)
end