devise_auth0_jwt_strategy 0.0.7 → 0.0.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: d6c855f7077ea79e7c9d7f85817482c85a1c8343
-  data.tar.gz: cdf83e1cd0165cce13511fe1e71b1fa3ff255e2b
+SHA256:
+  metadata.gz: addef3a62f8cab3e6bce4d6c204766c2376ca6b8039ca78a3a67c45168248f8e
+  data.tar.gz: f314586b7b4c7c2e854906d0ae0eed283897d6637ddf3187755c60ad9111abbb
 SHA512:
-  metadata.gz: 36cba5729c339eff358f6ba61fd4386e5d178bc32141c90f77100bea8368081991274a186348316f3f3599dc82372b8d1a981614421cfff4796342afbe423167
-  data.tar.gz: 5ebeba694bd287cc1ab33f2ce911e7d32e8bcae3f86a1ed9bf4b5a1b54e131e1814671d8e26e6b42f6ff5aa7969539010a026835be615046e79ce4fd62756a3d
+  metadata.gz: 9104971155ab7a783893dab28c456169455629b9bcd823137efd7bbfeb5b34609bdcf994a25c5a76aaaca0bed79953d60dffd1617088e1ea153e8d2db375f2e1
+  data.tar.gz: f8ebbd0fe7baa394f396870afa1fd2cacb95c813f221bbb4239253f35baf73b8e682d33267239573b914557425d3c19a726b0d40d1bd8cbf8318b97facae068e

data/lib/devise_auth0_jwt_strategy/strategy.rb

@@ -1,5 +1,6 @@
 require 'jwt'
 require 'devise'
+require "request_store"
 
 module Devise
   module Strategies
@@ -51,6 +52,33 @@ module Devise
         ( auth0_client_secret? and auth0_client_id? and !!jwt_token )
       end
 
+      def to_boolean(value)
+        # Most calls to this will pass in nil so have this guard clause first
+        # as a performance optimization
+        return false if value.nil?
+
+        # We interpret a boolean true or the lowercase normalize strings 'true', and 't'
+        # as a true value
+        return value if value == !!value
+        return !!(['true', 't'].index(value.downcase)) if value.kind_of?(::String)
+
+        # All others are always false
+        return false
+      end
+
+      def decode_options
+        # We will continue doing our own claim checks just for backwards compatibility
+        {
+          verify_expiration: false,
+          verify_iat: false,
+          verify_iss: false,
+          verify_aud: false,
+          verify_jti: false,
+          verify_subj: false,
+          verify_not_before: false
+        }
+      end
+
       def authenticate!
 
         if ENV['DEBUG_AUTH0_JWT']
@@ -60,22 +88,26 @@ module Devise
         end
 
         if valid?
+          # Passing true will cause #decode to verify the token signature
           # This will throw JWT::DecodeError if it fails
-          payload, header = ::JWT.decode(@jwt_token,
-            ::JWT.base64url_decode(auth0_client_secret))
+          payload, header = ::JWT.decode(@jwt_token, auth0_client_secret, true, decode_options)
 
           STDERR.puts payload.inspect if ENV['DEBUG_AUTH0_JWT']
 
           raise ClaimInvalid.new('JWT has the wrong client id') unless payload['aud'] == auth0_client_id
           raise ClaimInvalid.new('JWT has expired') unless payload['exp'].to_i > Time.now.to_i
 
-          u = ::User.find_by_email(payload['email'])
+          u = ::User.find_for_devise_auth0_jwt_strategy(payload['email'])
 
           if u.nil?
             fail!("Could not log in")
 
           else
             u.ignore_timedout = true if u.respond_to?(:ignore_timedout=)
+            u.ignore_active = to_boolean(payload['ignore_active']) if u.respond_to?(:ignore_active=)
+
+            ::RequestStore.store[:jwt_scopes] = payload['scopes']
+
             success!(u)
 
           end

metadata

@@ -1,11 +1,11 @@
 --- !ruby/object:Gem::Specification
 name: devise_auth0_jwt_strategy
 version: !ruby/object:Gem::Version
-  version: 0.0.7
+  version: 0.0.12
 platform: ruby
 authors:
 - Patrick McGraw
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
 date: 2015-03-10 00:00:00.000000000 Z
@@ -14,16 +14,16 @@ dependencies:
   name: jwt
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: 2.2.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: 2.2.0
 - !ruby/object:Gem::Dependency
   name: devise
   requirement: !ruby/object:Gem::Requirement
@@ -38,36 +38,50 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '3.4'
+- !ruby/object:Gem::Dependency
+  name: request_store
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: 5.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: 5.0.0
 - !ruby/object:Gem::Dependency
   name: rspec-rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '3.7'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '3.7'
 description: Authenticate requests using an Auth0 JWT passed by HTTP header
-email: patrick@mcgraw-tech.com
+email: pat@bloodhub.com
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -79,7 +93,7 @@ homepage: http://rubygems.org/gems/devise_auth0_jwt_strategy
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -94,9 +108,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.5.1
-signing_key: 
+rubygems_version: 3.0.6
+signing_key:
 specification_version: 4
 summary: Authenticate requests using an Auth0 JWT passed by HTTP header
 test_files: []