devise-jwt-cookie2 0.6.0 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b102a530ecfb53046e5a429698e2db4c373e8f3a9569dc51d1153c12bbf10cae
-  data.tar.gz: ac17f1d3252c92b4e087472555017d856c815f8a456808af1dfc7acae77a8099
+  metadata.gz: 580f1a06dbf4da8cca7f50a859e03bbbc7694068fe378ab35a0c7b936d148581
+  data.tar.gz: 50a30ab8297ca621423dc54e0eebb103fc9c4d766f1af7a8c73f9bbbd96d234b
 SHA512:
-  metadata.gz: 8df2266a978c16560d9e307adbc83dc510ca5a1b1751ffb0ecc27d0d4daef394fce4a1d6dfe18a337cb6379ce72657efce51e0008a163e8b90df3e7443b311c4
-  data.tar.gz: 4d91703d5c8b425b52dfe777491135b1ae9633c9251331786345b722516f3c4a15ca349dbc92b43bfaf5761c56bbbb4a41122af405c9ba180c7fbd2348f38996
+  metadata.gz: 3f40e189895d93d6dea89dea6b663a3b488ffa20af27d171cb6e2f83e8fbd3e76e05da844a142a0bf80426078022ae6dd8431413064538e6b1554aba31df67f8
+  data.tar.gz: a59ad9854285ba3380bec8b0a1c9337c8b3c17dab4f66554a3b0843c9a11e270ee3f5ac30adc5541d7d43daa981175a405947c68e9b5f5229156463d07c506c8

data/README.md

@@ -7,7 +7,7 @@
 Add this line to your application's Gemfile:
 
 ```ruby
-gem 'devise-jwt-cookie2', '~> 0.6.0'
+gem 'devise-jwt-cookie2', '~> 0.7.0'
 ```
 
 And then execute:
@@ -66,3 +66,17 @@ The domain the cookie should be issued to. Will be omitted if not set.
 #### same_site ([MDN](https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/Cookies#samesite))
 
 Set's the SameSite attribute on the cookie. Defaults to `none`.
+
+#### refresher
+
+An object that renews the JWT while the cookie strategy authenticates a request. Defaults to `nil`, which never renews a token.
+
+Set it to `Devise::JWT::Cookie::Refresher.new` to re-issue a still-valid token once it is past half its lifetime, so an active user's cookie slides forward instead of expiring:
+
+```ruby
+config.jwt_cookie do |jwt_cookie|
+  jwt_cookie.refresher = Devise::JWT::Cookie::Refresher.new
+end
+```
+
+A refresher responds to `call(token, scope, env)`, where `token` is the cookie's JWT (`nil` when the request has none), and returns a new JWT or `nil` to keep the current one. The strategy authenticates the request with the returned token and the middleware writes it to the cookie, unless the request revokes the token. Subclass `Refresher` to supply your own rules, such as recovering a session from a separate refresh credential after the JWT has expired, or capping a session's total lifetime. The private `issue(user, scope, aud)` helper encodes a token and calls the model's `on_jwt_dispatch`, so revocation strategies such as `Allowlist` record it.

data/lib/devise/jwt/cookie/middleware.rb

@@ -6,6 +6,7 @@ module Devise
       # Rack middleware to handle JWT token in cookies
       class Middleware
         ENV_KEY = 'warden-jwt_auth.token'
+        REFRESHED_TOKEN_KEY = 'devise-jwt-cookie.refreshed_token'
 
         attr_reader :app, :config
 
@@ -30,6 +31,9 @@ module Devise
           elsif token_should_be_revoked
             name, cookie = CookieHelper.new.build(nil)
             Rack::Utils.set_cookie_header!(headers, name, cookie)
+          elsif env[REFRESHED_TOKEN_KEY]
+            name, cookie = CookieHelper.new.build(env[REFRESHED_TOKEN_KEY])
+            Rack::Utils.set_cookie_header!(headers, name, cookie)
           end
           [status, headers, response]
         end

data/lib/devise/jwt/cookie/refresher.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Devise
+  module JWT
+    module Cookie
+      # Default refresher: re-issues a still-valid JWT once it is past half its lifetime, so a user who
+      # keeps making requests never sees the cookie expire. Subclass it to apply your own session
+      # rules, such as recovering a session after the JWT has expired or capping its total lifetime.
+      #
+      # A refresher receives the cookie's token (nil when there is none), the Warden scope and the
+      # Rack env, and returns a new token to authenticate the request with, or nil to keep the
+      # current one. The middleware writes a returned token to the cookie.
+      class Refresher
+        def call(token, scope, env)
+          return if token.nil?
+          return unless renew?(Warden::JWTAuth::TokenDecoder.new.call(token))
+
+          aud = Warden::JWTAuth::EnvHelper.aud_header(env)
+          issue(Warden::JWTAuth::UserDecoder.new.call(token, scope, aud), scope, aud)
+        rescue ::JWT::DecodeError
+          nil
+        end
+
+        private
+
+        def renew?(payload)
+          issued_at, expires_at = payload.values_at('iat', 'exp')
+          return false unless issued_at && expires_at
+
+          Time.now.to_i >= issued_at + ((expires_at - issued_at) / 2)
+        end
+
+        # Mirrors devise-jwt's dispatch hook, so revocation strategies such as Allowlist record the token.
+        def issue(user, scope, aud)
+          token, payload = Warden::JWTAuth::UserEncoder.new.call(user, scope, aud)
+          user.on_jwt_dispatch(token, payload) if user.respond_to?(:on_jwt_dispatch)
+          token
+        end
+      end
+    end
+  end
+end

data/lib/devise/jwt/cookie/strategy.rb

@@ -9,7 +9,7 @@ module Devise
       # an http-only cookie
       class Strategy < Warden::Strategies::Base
         def valid?
-          !token.nil?
+          !token.nil? || !refresher.nil?
         end
 
         def store?
@@ -17,6 +17,10 @@ module Devise
         end
 
         def authenticate!
+          refresh
+          # Without a token there is nothing to reject, so other strategies still get a turn.
+          return if token.nil?
+
           aud = Warden::JWTAuth::EnvHelper.aud_header(env)
           user = Warden::JWTAuth::UserDecoder.new.call(token, scope, aud)
           success!(user)
@@ -29,6 +33,19 @@ module Devise
         def token
           @token ||= CookieHelper.new.read_from(cookies)
         end
+
+        def refresher
+          Cookie.config.refresher
+        end
+
+        # Warden re-runs a strategy that did not succeed or fail, so only ask the refresher once.
+        def refresh
+          return if @refreshed
+
+          @refreshed = true
+          refreshed_token = refresher&.call(token, scope, env)
+          env[Middleware::REFRESHED_TOKEN_KEY] = @token = refreshed_token if refreshed_token
+        end
       end
     end
   end

data/lib/devise/jwt/cookie/version.rb

@@ -3,7 +3,7 @@
 module Devise
   module JWT
     module Cookie
-      VERSION = '0.6.0'
+      VERSION = '0.7.0'
     end
   end
 end

data/lib/devise/jwt/cookie2.rb

@@ -24,6 +24,7 @@ module Devise
       setting :httponly, default: true
       setting :same_site, default: :none
       setting :domain
+      setting :refresher
 
       Import = Dry::AutoInject(config)
     end
@@ -34,4 +35,5 @@ require 'devise/jwt/cookie/version'
 require 'devise/jwt/cookie/railtie'
 require 'devise/jwt/cookie/cookie_helper'
 require 'devise/jwt/cookie/middleware'
+require 'devise/jwt/cookie/refresher'
 require 'devise/jwt/cookie/models'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise-jwt-cookie2
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.7.0
 platform: ruby
 authors:
 - Major League Hacking
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-02-18 00:00:00.000000000 Z
+date: 2026-10-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: devise-jwt
@@ -193,6 +193,7 @@ files:
 - lib/devise/jwt/cookie/models.rb
 - lib/devise/jwt/cookie/models/jwt_cookie_authenticatable.rb
 - lib/devise/jwt/cookie/railtie.rb
+- lib/devise/jwt/cookie/refresher.rb
 - lib/devise/jwt/cookie/strategy.rb
 - lib/devise/jwt/cookie/version.rb
 - lib/devise/jwt/cookie2.rb