Class: Zitadel::Client::Auth::OAuthAuthenticator

Inherits:
Authenticator show all
Defined in:
lib/zitadel/client/auth/o_auth_authenticator.rb,
sig/lib.rbs

Overview

Base class for OAuth-based authentication using an OAuth2 client.

Attributes:

open_id: An object providing OAuth endpoint information.
auth_session: An OAuth2Session instance used for fetching tokens.

Instance Attribute Summary

Attributes inherited from Authenticator

#host

Instance Method Summary collapse

Constructor Details

#initialize(open_id, auth_scopes, auth_session, transport_options: nil) ⇒ OAuthAuthenticator

Constructs an OAuthAuthenticator.

Parameters:

  • open_id (OpenId) —

    An object that must implement get_host_endpoint and get_token_endpoint.

  • auth_scopes (Set<String>) —

    The scope(s) for the token request.

  • auth_session (OAuth2::Client) —

    The OAuth2 client instance used for token requests.

  • transport_options (TransportOptions, nil) (defaults to: nil) —

    Optional transport options for TLS, proxy, and headers.

  • (OpenId)
  • (Set[String])
  • (OAuth2::Client)
  • transport_options: (TransportOptions, nil) (defaults to: nil) 


32
33
34
35
36
37
38
39
40
 
# File 'lib/zitadel/client/auth/o_auth_authenticator.rb', line 32

def initialize(open_id, auth_scopes, auth_session, transport_options: nil)
  super(open_id.host_endpoint)
  @open_id = open_id
  @transport_options = transport_options || TransportOptions.defaults
  @token = nil
  @auth_session = auth_session
  @auth_scopes = auth_scopes.to_a.join(' ')
  @mutex = Thread::Mutex.new
end

Instance Method Details

#auth_headers ⇒ Hash{String => String}

Retrieves authentication headers.

Returns:

  • (Hash{String => String}) —

    A hash containing the 'Authorization' header.



62
63
64
 
# File 'lib/zitadel/client/auth/o_auth_authenticator.rb', line 62

def auth_headers
  { 'Authorization' => "Bearer #{auth_token}" }
end

#auth_token ⇒ String

Returns the current access token, refreshing it if necessary.

Returns:

  • (String) —

    The current access token.



47
48
49
50
51
52
53
54
55
 
# File 'lib/zitadel/client/auth/o_auth_authenticator.rb', line 47

def auth_token
  @mutex.synchronize do
    refresh_token if @token.nil? || @token.expired?

    raise 'Token is nil after refresh' if @token.nil?

    return @token.token
  end
end

#get_grant(auth_client, auth_scopes) ⇒ OAuth2::AccessToken

Builds and returns a hash of grant parameters required for the token request.

The base class will invoke this method by passing its OAuth2 client. The subclass implementation should return the result of either:

client.client_credentials.get_token(scope: scopes)

or client.assertion.get_token(claims)

Parameters:

Returns:

Raises:

  • (NotImplementedError) 


79
80
81
82
83
 
# File 'lib/zitadel/client/auth/o_auth_authenticator.rb', line 79

def get_grant(auth_client, auth_scopes)
  # :nocov:
  raise NotImplementedError, "#{self.class}#get_grant must be implemented"
  # :nocov:
end

#refresh_token ⇒ OAuth2::AccessToken

Refreshes the access token using the OAuth flow.

It uses get_grant to obtain all necessary parameters for the token request.

Returns:

Raises:

  • (RuntimeError) —

    if the token refresh fails.



93
94
95
96
97
 
# File 'lib/zitadel/client/auth/o_auth_authenticator.rb', line 93

def refresh_token
  @token = get_grant(@auth_session, @auth_scopes)
rescue StandardError => e
  raise ZitadelError.new("Failed to refresh token: #{e.message}"), cause: e
end