Class: Safire::Protocols::UdapRegistrationMetadata

Inherits:
Object
  • Object
show all
Includes:
URIValidation
Defined in:
lib/safire/protocols/udap_registration_metadata.rb

Overview

Validates and normalizes caller-controlled UDAP Dynamic Client Registration metadata before a software statement is signed.

The object enforces the registration metadata rules from UDAP Security STU2. It preserves JSON-compatible RFC 7591 extension metadata while preventing callers from overriding JWT claims, request envelope fields, or fixed UDAP values generated by Safire.

Examples:

Build authorization-code registration metadata

metadata = Safire::Protocols::UdapRegistrationMetadata.new(
  {
    client_name: 'Example Health App',
    contacts: ['mailto:security@example.com'],
    grant_types: %w[authorization_code refresh_token],
    scope: 'openid system/Patient.rs',
    redirect_uris: ['https://app.example.com/callback'],
    logo_uri: 'https://app.example.com/logo.png'
  }
)
metadata.to_h

Build cancellation metadata

metadata = Safire::Protocols::UdapRegistrationMetadata.new(
  {
    client_name: 'Example Health App',
    contacts: ['mailto:security@example.com'],
    scope: 'openid system/Patient.rs'
  },
  operation: :cancel
)

See Also:

Instance Method Summary collapse

Constructor Details

#initialize(input, operation: :register, allow_insecure_localhost: false) ⇒ UdapRegistrationMetadata

Returns a new instance of UdapRegistrationMetadata.

Parameters:

  • input (Hash) —

    caller-controlled registration metadata

  • operation (:register, :cancel) (defaults to: :register) —

    metadata operation

  • allow_insecure_localhost (Boolean) (defaults to: false) —

    permit HTTP redirect and logo URIs only on localhost or 127.0.0.1 for local development; this produces non-conformant UDAP registration metadata

Raises:



84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
 
# File 'lib/safire/protocols/udap_registration_metadata.rb', line 84

def initialize(input, operation: :register, allow_insecure_localhost: false)
  @operation = validate_operation(operation)
  @allow_insecure_localhost = validate_localhost_policy(allow_insecure_localhost)
  normalized = normalize_input(input)
  validate_reserved_fields!(normalized)
  prepare_operation!(normalized)
  validate_required_fields!(normalized)
  validate_contacts!(normalized)
  validate_scope!(normalized)
  validate_registration_fields!(normalized) if register?
  validate_authorization_fields!(normalized)
  validate_extensions!(normalized)
  generate_protocol_fields!(normalized)
  @metadata = deep_freeze(normalized)
  warn_if_insecure_localhost_used(@metadata)
  freeze
end

Instance Method Details

#to_h ⇒ Hash<String, Object>

Returns a mutable defensive copy of the normalized metadata.

Returns:

  • (Hash<String, Object>) 


105
106
107
 
# File 'lib/safire/protocols/udap_registration_metadata.rb', line 105

def to_h
  deep_copy(@metadata)
end