devise-jwt-cookie2 0.6.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: b102a530ecfb53046e5a429698e2db4c373e8f3a9569dc51d1153c12bbf10cae
+  data.tar.gz: ac17f1d3252c92b4e087472555017d856c815f8a456808af1dfc7acae77a8099
+SHA512:
+  metadata.gz: 8df2266a978c16560d9e307adbc83dc510ca5a1b1751ffb0ecc27d0d4daef394fce4a1d6dfe18a337cb6379ce72657efce51e0008a163e8b90df3e7443b311c4
+  data.tar.gz: 4d91703d5c8b425b52dfe777491135b1ae9633c9251331786345b722516f3c4a15ca349dbc92b43bfaf5761c56bbbb4a41122af405c9ba180c7fbd2348f38996

data/LICENSE

@@ -0,0 +1,7 @@
+Copyright 2025 Major League Hacking PBC Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,68 @@
+# Devise::JWT::Cookie
+
+`devise-jwt-cookie2` is a fork of [devise-jwt-cookie](https://github.com/scarhand/devise-jwt-cookie), a [devise](https://github.com/plataformatec/devise) extension based on [devise-jwt](https://github.com/waiting-for-dev/devise-jwt). It should be used alongside `devise-jwt`.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'devise-jwt-cookie2', '~> 0.6.0'
+```
+
+And then execute:
+
+    $ bundle
+
+## Usage
+
+First you need to setup up and configure devise and devise-jwt. This gem hooks into devise-jwt to add an httpOnly cookie with the JWT.
+
+### Model configuration
+
+You have to update the user model to be able to use the cookie method. For example:
+
+```ruby
+class User < ApplicationRecord
+  devise :database_authenticatable,
+         :jwt_cookie_authenticatable,
+         :jwt_authenticatable, jwt_revocation_strategy: Blacklist
+end
+```
+
+### Configuration reference
+
+This library can be configured by calling `jwt_cookie` on the devise config object:
+
+```ruby
+Devise.setup do |config|
+  config.jwt do |jwt|
+    # config for devise-jwt goes here
+  end
+  config.jwt_cookie do |jwt_cookie|
+    # ...
+    jwt_cookie.secure = false if Rails.env.development?
+  end
+end
+```
+
+#### name ([MDN](https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/Cookies#name))
+
+The name of the cookie. Defaults to `access_token`.
+
+#### secure ([MDN](https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/Cookies#secure))
+
+If a secure cookie should be set, this means the cookie must be sent over a secure connection. Defaults to `true`.
+
+#### httponly ([MDN](https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/Cookies#httponly))
+
+HttpOnly option on the cookie, if set to true JavaScript running in the browser cannot access the cookie. 
+Defaults to `true`
+
+#### domain ([MDN](https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/Cookies#domain))
+
+The domain the cookie should be issued to. Will be omitted if not set.
+
+#### same_site ([MDN](https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/Cookies#samesite))
+
+Set's the SameSite attribute on the cookie. Defaults to `none`.

data/lib/devise/jwt/cookie/cookie_helper.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module Devise
+  module JWT
+    module Cookie
+      # Helper class to build and remove cookies
+      class CookieHelper
+        include Cookie::Import['name', 'domain', 'secure', 'httponly', 'same_site']
+
+        def build(token)
+          if token.nil?
+            remove_cookie
+          else
+            create_cookie(token)
+          end
+        end
+
+        def read_from(cookies)
+          cookies[name]
+        end
+
+        private
+
+        def create_cookie(token)
+          jwt = Warden::JWTAuth::TokenDecoder.new.call(token)
+          res = {
+            value: token,
+            **global_options,
+            expires: Time.at(jwt['exp'].to_i)
+          }
+          [name, res]
+        end
+
+        def remove_cookie
+          res = {
+            value: nil,
+            **global_options,
+            max_age: '0',
+            expires: Time.at(0)
+          }
+          [name, res]
+        end
+
+        def global_options
+          res = {
+            path: '/',
+            httponly: httponly,
+            secure: secure,
+            same_site: same_site
+          }
+          res[:domain] = domain if domain.present?
+
+          res
+        end
+      end
+    end
+  end
+end

data/lib/devise/jwt/cookie/middleware.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Devise
+  module JWT
+    module Cookie
+      # Rack middleware to handle JWT token in cookies
+      class Middleware
+        ENV_KEY = 'warden-jwt_auth.token'
+
+        attr_reader :app, :config
+
+        def initialize(app)
+          @app = app
+          @config = Warden::JWTAuth.config
+        end
+
+        def call(env)
+          token_should_be_revoked = token_should_be_revoked?(env)
+          if token_should_be_revoked
+            # add the Authorization header, devise-jwt needs this to revoke tokens
+            # we need to make sure this is done before the other middleware is run
+            request = ActionDispatch::Request.new(env)
+            env['HTTP_AUTHORIZATION'] = "Bearer #{CookieHelper.new.read_from(request.cookies)}"
+          end
+
+          status, headers, response = app.call(env)
+          if headers['Authorization'] && env[ENV_KEY]
+            name, cookie = CookieHelper.new.build(env[ENV_KEY])
+            Rack::Utils.set_cookie_header!(headers, name, cookie)
+          elsif token_should_be_revoked
+            name, cookie = CookieHelper.new.build(nil)
+            Rack::Utils.set_cookie_header!(headers, name, cookie)
+          end
+          [status, headers, response]
+        end
+
+        def token_should_be_revoked?(env)
+          path_info = env['PATH_INFO'] || ''
+          method = env['REQUEST_METHOD']
+          revocation_requests = config.revocation_requests
+          revocation_requests.each do |tuple|
+            revocation_method, revocation_path = tuple
+            return true if path_info.match(revocation_path) &&
+                           method == revocation_method
+          end
+          false
+        end
+      end
+    end
+  end
+end

data/lib/devise/jwt/cookie/models/jwt_cookie_authenticatable.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require 'active_support/concern'
+
+module Devise
+  module Models
+    module JwtCookieAuthenticatable
+      extend ActiveSupport::Concern
+
+      included do
+        def self.find_for_jwt_authentication(sub)
+          find_by(primary_key => sub)
+        end
+      end
+
+      def jwt_subject
+        id
+      end
+    end
+  end
+end

data/lib/devise/jwt/cookie/models.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+require 'devise/jwt/cookie/models/jwt_cookie_authenticatable'
+
+module Devise
+  module Models
+  end
+end

data/lib/devise/jwt/cookie/railtie.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+require 'rails/railtie'
+
+module Devise
+  module JWT
+    module Cookie
+      class Railtie < Rails::Railtie
+        initializer 'devise-jwt-cookie-middleware' do |app|
+          app.middleware.insert_before Warden::JWTAuth::Middleware, Devise::JWT::Cookie::Middleware
+        end
+      end
+    end
+  end
+end

data/lib/devise/jwt/cookie/strategy.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require 'warden'
+
+module Devise
+  module JWT
+    module Cookie
+      # Warden strategy to authenticate an user through a JWT token in
+      # an http-only cookie
+      class Strategy < Warden::Strategies::Base
+        def valid?
+          !token.nil?
+        end
+
+        def store?
+          false
+        end
+
+        def authenticate!
+          aud = Warden::JWTAuth::EnvHelper.aud_header(env)
+          user = Warden::JWTAuth::UserDecoder.new.call(token, scope, aud)
+          success!(user)
+        rescue ::JWT::DecodeError => e
+          fail!(e.message)
+        end
+
+        private
+
+        def token
+          @token ||= CookieHelper.new.read_from(cookies)
+        end
+      end
+    end
+  end
+end
+
+Warden::Strategies.add(:jwt_cookie, Devise::JWT::Cookie::Strategy)

data/lib/devise/jwt/cookie/version.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Devise
+  module JWT
+    module Cookie
+      VERSION = '0.6.0'
+    end
+  end
+end

data/lib/devise/jwt/cookie2.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require 'dry/configurable'
+require 'dry/auto_inject'
+require 'devise'
+require 'devise/jwt'
+require 'devise/jwt/cookie/strategy'
+
+# Authentication library
+module Devise
+  def self.jwt_cookie
+    yield(Devise::JWT::Cookie.config)
+  end
+
+  add_module(:jwt_cookie_authenticatable, strategy: :jwt_cookie)
+
+  module JWT
+    # Devise extension for adding cookie support on top of devise-jwt
+    module Cookie
+      extend Dry::Configurable
+
+      setting :name, default: 'access_token'
+      setting :secure, default: true
+      setting :httponly, default: true
+      setting :same_site, default: :none
+      setting :domain
+
+      Import = Dry::AutoInject(config)
+    end
+  end
+end
+
+require 'devise/jwt/cookie/version'
+require 'devise/jwt/cookie/railtie'
+require 'devise/jwt/cookie/cookie_helper'
+require 'devise/jwt/cookie/middleware'
+require 'devise/jwt/cookie/models'

metadata

@@ -0,0 +1,222 @@
+--- !ruby/object:Gem::Specification
+name: devise-jwt-cookie2
+version: !ruby/object:Gem::Version
+  version: 0.6.0
+platform: ruby
+authors:
+- Major League Hacking
+autorequire:
+bindir: exe
+cert_chain: []
+date: 2025-02-18 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: devise-jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.10'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.10'
+- !ruby/object:Gem::Dependency
+  name: dry-auto_inject
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: dry-configurable
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">"
+      - !ruby/object:Gem::Version
+        version: '1'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">"
+      - !ruby/object:Gem::Version
+        version: '1'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 7.1.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 7.1.0
+- !ruby/object:Gem::Dependency
+  name: rspec-rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 7.1.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 7.1.0
+- !ruby/object:Gem::Dependency
+  name: sqlite3
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: mlh-rubocop-config
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: '0.17'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: '0.17'
+description: Cookie-based JWT authentication for devise with configurable token revocation
+  strategies, forked from devise-jwt-cookie
+email:
+- hi@mlh.io
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- lib/devise/jwt/cookie/cookie_helper.rb
+- lib/devise/jwt/cookie/middleware.rb
+- lib/devise/jwt/cookie/models.rb
+- lib/devise/jwt/cookie/models/jwt_cookie_authenticatable.rb
+- lib/devise/jwt/cookie/railtie.rb
+- lib/devise/jwt/cookie/strategy.rb
+- lib/devise/jwt/cookie/version.rb
+- lib/devise/jwt/cookie2.rb
+homepage: https://github.com/mlh/devise-jwt-cookie2
+licenses:
+- MIT
+metadata: {}
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.7.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.1.6
+signing_key:
+specification_version: 4
+summary: Cookie-based JWT authentication for devise
+test_files: []