new dev credentials, support for RS256

getguesstimate · Mar 6, 2023 · 8a1882b · 8a1882b
1 parent 4c66b21
commit 8a1882b
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 4 deletions.
diff --git a/config/initializers/knock.rb b/config/initializers/knock.rb
@@ -49,7 +49,6 @@
   ##
   ## Default:
   # config.token_public_key = nil
-  config.token_audience = -> { Rails.application.secrets.auth0_client_id }
 
   ## Exception Class
   ## ---------------
@@ -58,5 +57,16 @@
   ##
   ## Default:
   # config.not_found_exception_class_name = 'ActiveRecord::RecordNotFound'
-   config.token_secret_signature_key = -> { JWT.base64url_decode Rails.application.secrets.auth0_client_secret }
+
+  if Rails.application.secrets.auth0_rsa_domain
+    config.token_signature_algorithm = 'RS256'
+    jwks_raw = Net::HTTP.get URI(Rails.application.secrets.auth0_rsa_domain)
+    jwks_keys = Array(JSON.parse(jwks_raw)['keys'])
+    config.token_public_key = OpenSSL::X509::Certificate.new(Base64.decode64(jwks_keys[0]['x5c'].first)).public_key
+  else
+    config.token_signature_algorithm = 'HS256'
+    config.token_secret_signature_key = -> { JWT.base64url_decode Rails.application.secrets.auth0_client_secret }
+  end
+
+  config.token_audience = -> { Rails.application.secrets.auth0_client_id }
 end
diff --git a/config/secrets.yml b/config/secrets.yml
@@ -13,9 +13,9 @@
 #I use a development account on auth0.
 development:
   secret_key_base: 18451581609752ad653f43e9214e87978cf06fdc04daebad9faa2daf9023f4a892efe61a1448b559c55ae343841b5aa873c36478e325c44d9ef0a2c61682e50d
-  auth0_client_id: X0m2PZEyAOqhtLY1Qz9mdetHzQcDsG8U
-  auth0_client_secret: B9cx35Lqlejy2ORT2wR-qKVcXCaJEv41enflXTMxUUl383WpEFbwT18IdguGIuw7
+  auth0_client_id: hNPSROXtn9Ohg4Pa9ijLxAbvbIEJjFJN
   auth0_api_token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJUWnBQRXp5eWpQbTN2VmdSdU9yQjJTakRTVnhFdnJiSCIsInNjb3BlcyI6eyJ1c2VycyI6eyJhY3Rpb25zIjpbImNyZWF0ZSIsInJlYWQiXX0sInVzZXJfdGlja2V0cyI6eyJhY3Rpb25zIjpbImNyZWF0ZSJdfX0sImlhdCI6MTQ2NDMxNTQ1OSwianRpIjoiODlkZjExNzE5ODc2Zjk0MjI0NzkyMzBmYjcwMzJhMTMifQ.lXofGmhVsIbjuhp0cst_DO6JhUWhJJWfj9FiP4uip1c
+  auth0_rsa_domain: https://guesstimate-development.auth0.com/.well-known/jwks.json
   auth0_api_domain: guesstimate-development.auth0.com
   auth0_connection: Username-Password-Authentication
   algolia_application_id: M629R9UGSG