class Firebase::Auth::IDTokenKeeper::IDToken

Constants

FIREBASE_ALGORITHM

Attributes

encoded_jwt[RW]

Public Class Methods

new(encoded_jwt) click to toggle source
# File lib/firebase/auth/id_token_keeper/id_token.rb, line 12
def initialize(encoded_jwt)
  self.encoded_jwt = encoded_jwt
end

Public Instance Methods

verified_id_token() click to toggle source
# File lib/firebase/auth/id_token_keeper/id_token.rb, line 16
def verified_id_token
  decoded_jwt if verify!
end

Private Instance Methods

certification() click to toggle source
# File lib/firebase/auth/id_token_keeper/id_token.rb, line 66
def certification
  public_keys_endpoint.find_certificate_by(kid: jwt_header['kid'])
end
decoded_jwt() click to toggle source
# File lib/firebase/auth/id_token_keeper/id_token.rb, line 74
def decoded_jwt
  @decoded_jwt ||= JWT.decode(encoded_jwt, nil, false, { algorithm: FIREBASE_ALGORITHM })
rescue JWT::DecodeError => e
  raise 'Invalid JWT format.'
end
firebase_issuer_uri() click to toggle source
# File lib/firebase/auth/id_token_keeper/id_token.rb, line 90
def firebase_issuer_uri
  "https://securetoken.google.com/#{IDTokenKeeper.config.firebase_project_id}"
end
jwt_header() click to toggle source
# File lib/firebase/auth/id_token_keeper/id_token.rb, line 80
def jwt_header
  decoded_jwt[1]
end
jwt_payload() click to toggle source
# File lib/firebase/auth/id_token_keeper/id_token.rb, line 84
def jwt_payload
  decoded_jwt[0]
end
public_keys_endpoint() click to toggle source
# File lib/firebase/auth/id_token_keeper/id_token.rb, line 70
def public_keys_endpoint
  @public_keys_endpoint ||= PublicKeysEndpoint.new
end
verify!() click to toggle source
# File lib/firebase/auth/id_token_keeper/id_token.rb, line 22
def verify!
  verify_header && verify_payload && verify_signature
end
verify_header() click to toggle source
# File lib/firebase/auth/id_token_keeper/id_token.rb, line 26
def verify_header
  # Algorithm must be match Firebase algorithm.
  raise 'Invalid alg in ID Token header.' if jwt_header['alg'] != FIREBASE_ALGORITHM

  # Key ID must be listed at public keys endpoint.
  raise 'Invalid kid in ID Token header.' unless public_keys_endpoint.exist_public_key_by?(kid: jwt_header['kid'])

  true
end
verify_payload() click to toggle source
# File lib/firebase/auth/id_token_keeper/id_token.rb, line 36
def verify_payload
  # Expiration time must be in the future.
  raise 'Invalid exp in payload.' if jwt_payload['exp'] < Time.now.to_i

  # Issued-at time must be in the past.
  raise 'Invalid iat in payload.' if Time.now.to_i < jwt_payload['iat']

  # Audience must be match Firebase project ID.
  raise 'Invalid aud in payload.' if jwt_payload['aud'] != IDTokenKeeper.config.firebase_project_id

  # Issuer must be match Firebase issuer URI.
  raise 'Invalid iss in payload.' if jwt_payload['iss'] != firebase_issuer_uri

  # Subject must be a non-empty string.
  raise 'Invalid sub in payload.' if jwt_payload['sub'].strip.empty?

  # Authentication time must be in the past.
  raise 'Invalid auth_time in payload.' if Time.now.to_i < jwt_payload['auth_time']

  true
end
verify_signature() click to toggle source
# File lib/firebase/auth/id_token_keeper/id_token.rb, line 58
def verify_signature
  JWT.decode(encoded_jwt, certification.public_key, true, { algorithm: FIREBASE_ALGORITHM, verify_iat: true })

  true
rescue JWT::ExpiredSignature => e
  raise 'Signature has expired.'
end