firejwt 0.4.1 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e9f92d3a9e3bc19d0f29b167acfb4e9c1101a3dc8186b9ea33fd9327de25dc0b
-  data.tar.gz: 13bda374efe299021fc0778add9d58fa850f95f22021f18b0ed858e07cb03d43
+  metadata.gz: ab69a025ab89bc78cc7100320e86215b969e65b861321e8166ff0facf2aca0c7
+  data.tar.gz: 566c9ec8876efdde35f727a61c2b6ffc87203c241bd287ee5dbea302f35a5d5b
 SHA512:
-  metadata.gz: 311080f5997340532acfb2d98f42090d18d3a9aa039c72d17cadf756c8e51aea2b46ee3ba83aaf30e61c3db8e3c9022067f8e822586f3d963688f1321a67fc0e
-  data.tar.gz: 4f13449932fc23d94c211eea7e7bc2a8ddf6615987d6e315d92a54a1efc415b6546f959f461865f5780f8f98c679dd54d2a428d40016dd79f81440c05921da1c
+  metadata.gz: 254b2653d48d41c64b4837e044a19f2412ffd93a019417c1ddf050b715643c0502b93a11439cefde9e13f9ab7416eb5b059f57a4ca9b8b080ad4ad4e7780be74
+  data.tar.gz: 44eb4c65193a62c0a3ae38d2c80898c623168f267caa74080260a9c37c59148a9918ec9e02371e6bb03358705873d5b8314f993cc2707692e5938a4de559f6bd

data/.github/workflows/test.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go-version: [1.16.x, 1.17.x]
+        go-version: [1.18.x, 1.17.x]
     steps:
       - name: Checkout
         uses: actions/checkout@v2
@@ -41,7 +41,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        ruby-version: ["2.6", "2.7", "3.0", "3.1"]
+        ruby-version: ["2.7", "3.0", "3.1"]
     steps:
       - uses: actions/checkout@v2
       - uses: ruby/setup-ruby@v1

data/.rubocop.yml

@@ -6,7 +6,7 @@ inherit_mode:
     - Exclude
 
 AllCops:
-  TargetRubyVersion: "2.6"
+  TargetRubyVersion: "2.7"
 
 RSpec/FilePath:
   Enabled: false

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    firejwt (0.4.1)
+    firejwt (0.5.0)
       jwt
 
 GEM
@@ -16,7 +16,7 @@ GEM
     hashdiff (1.0.1)
     jwt (2.3.0)
     parallel (1.21.0)
-    parser (3.1.0.0)
+    parser (3.1.1.0)
       ast (~> 2.4.1)
     public_suffix (4.0.6)
     rainbow (3.1.1)
@@ -36,28 +36,28 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.11.0)
     rspec-support (3.11.0)
-    rubocop (1.25.1)
+    rubocop (1.26.0)
       parallel (~> 1.10)
       parser (>= 3.1.0.0)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 1.8, < 3.0)
       rexml
-      rubocop-ast (>= 1.15.1, < 2.0)
+      rubocop-ast (>= 1.16.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.15.2)
-      parser (>= 3.0.1.1)
+    rubocop-ast (1.16.0)
+      parser (>= 3.1.1.0)
     rubocop-bsm (0.6.0)
       rubocop (~> 1.0)
       rubocop-performance
       rubocop-rake
       rubocop-rspec
-    rubocop-performance (1.13.2)
+    rubocop-performance (1.13.3)
       rubocop (>= 1.7.0, < 2.0)
       rubocop-ast (>= 0.4.0)
     rubocop-rake (0.6.0)
       rubocop (~> 1.0)
-    rubocop-rspec (2.8.0)
+    rubocop-rspec (2.9.0)
       rubocop (~> 1.19)
     ruby-progressbar (1.11.0)
     unicode-display_width (2.1.0)

data/firejwt.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name          = 'firejwt'
-  s.version       = '0.4.1'
+  s.version       = '0.5.0'
   s.authors       = ['Black Square Media Ltd']
   s.email         = ['info@blacksquaremedia.com']
   s.summary       = %(Firebase JWT validation)
@@ -11,7 +11,7 @@ Gem::Specification.new do |s|
   s.files         = `git ls-files -z`.split("\x0").reject {|f| f.match(%r{^spec/}) }
   s.test_files    = `git ls-files -z -- spec/*`.split("\x0")
   s.require_paths = ['lib']
-  s.required_ruby_version = '>= 2.6'
+  s.required_ruby_version = '>= 2.7'
 
   s.add_dependency 'jwt'
   s.add_development_dependency 'rake'

data/firejwt.go

@@ -16,6 +16,10 @@ import (
 	"github.com/golang-jwt/jwt/v4"
 )
 
+func init() {
+	jwt.MarshalSingleStringAsArray = false
+}
+
 const defaultURL = "https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com"
 
 // Validator validates Firebase JWTs
@@ -99,11 +103,9 @@ func (v *Validator) Refresh() error {
 }
 
 var (
-	errKIDMissing   = errors.New("missing kid header")
-	errExpired      = errors.New("token has expired")
-	errIssuedFuture = errors.New("issued in the future")
-	errNoSubject    = errors.New("subject is missing")
-	errAuthFuture   = errors.New("auth-time in the future")
+	errKIDMissing   = errors.New("token is missing kid header")
+	errNoSubject    = errors.New("token has no subject")
+	errAuthFuture   = errors.New("token auth_time not valid")
 	errTokenInvalid = errors.New("token is invalid")
 )
 
@@ -118,22 +120,10 @@ func (v *Validator) verify(token *jwt.Token) (interface{}, error) {
 		return nil, fmt.Errorf("invalid kid header %q", kid)
 	}
 
-	now := time.Now().Unix()
 	claims := token.Claims.(*Claims)
-	if claims.Audience != v.audience {
-		return nil, fmt.Errorf("invalid audience claim %q", claims.Audience)
-	} else if claims.Issuer != v.issuer {
-		return nil, fmt.Errorf("invalid issuer claim %q", claims.Issuer)
-	} else if claims.Subject == "" {
-		return nil, errNoSubject
-	} else if claims.ExpiresAt <= now {
-		return nil, errExpired
-	} else if claims.IssuedAt > now {
-		return nil, errIssuedFuture
-	} else if claims.AuthAt > now {
-		return nil, errAuthFuture
+	if err := claims.validate(time.Now(), v.audience, v.issuer); err != nil {
+		return nil, err
 	}
-
 	return key.PublicKey, nil
 }
 
@@ -188,19 +178,34 @@ func (k *publicKey) UnmarshalText(data []byte) error {
 
 // Claims are included in the token.
 type Claims struct {
-	Subject   string `json:"sub,omitempty"`
-	Audience  string `json:"aud,omitempty"`
-	Issuer    string `json:"iss,omitempty"`
-	IssuedAt  int64  `json:"iat,omitempty"`
-	ExpiresAt int64  `json:"exp,omitempty"`
-
-	Name          string         `json:"name,omitempty"`
-	Picture       string         `json:"picture,omitempty"`
-	UserID        string         `json:"user_id,omitempty"`
-	AuthAt        int64          `json:"auth_time,omitempty"`
-	Email         string         `json:"email,omitempty"`
-	EmailVerified bool           `json:"email_verified"`
-	Firebase      *FirebaseClaim `json:"firebase,omitempty"`
+	Name          string           `json:"name,omitempty"`
+	Picture       string           `json:"picture,omitempty"`
+	UserID        string           `json:"user_id,omitempty"`
+	AuthAt        *jwt.NumericDate `json:"auth_time,omitempty"`
+	Email         string           `json:"email,omitempty"`
+	EmailVerified bool             `json:"email_verified"`
+	Firebase      *FirebaseClaim   `json:"firebase,omitempty"`
+
+	jwt.RegisteredClaims
+}
+
+func (c *Claims) validate(now time.Time, audience, issuer string) error {
+	if !c.VerifyExpiresAt(now, false) {
+		return jwt.ErrTokenExpired
+	} else if !c.VerifyIssuedAt(now, false) {
+		return jwt.ErrTokenUsedBeforeIssued
+	} else if !c.VerifyNotBefore(now, false) {
+		return jwt.ErrTokenNotValidYet
+	} else if !c.VerifyAudience(audience, true) {
+		return jwt.ErrTokenInvalidAudience
+	} else if !c.VerifyIssuer(issuer, true) {
+		return jwt.ErrTokenInvalidIssuer
+	} else if c.Subject == "" {
+		return errNoSubject
+	} else if c.AuthAt.After(now) {
+		return errAuthFuture
+	}
+	return nil
 }
 
 // FirebaseClaim represents firebase specific claim.
@@ -208,8 +213,3 @@ type FirebaseClaim struct {
 	SignInProvider string              `json:"sign_in_provider,omitempty"`
 	Identities     map[string][]string `json:"identities,omitempty"`
 }
-
-// Valid implements the jwt.Claims interface.
-func (c *Claims) Valid() error {
-	return nil
-}

data/firejwt_test.go

@@ -43,7 +43,7 @@ var _ = Describe("Validator", func() {
 				certKID: string(certPEM),
 			})
 		}))
-		seeds = mockClaims(time.Now().Unix())
+		seeds = mockClaims(time.Now())
 
 		var err error
 		subject, err = firejwt.Mocked(server.URL)
@@ -72,51 +72,51 @@ var _ = Describe("Validator", func() {
 	})
 
 	It("should verify exp", func() {
-		seeds.ExpiresAt = time.Now().Unix() - 1
+		seeds.ExpiresAt = jwt.NewNumericDate(time.Now().Add(-time.Second))
 		_, err := subject.Decode(generate())
-		Expect(err).To(MatchError(`token has expired`))
+		Expect(err).To(MatchError(`token is expired`))
 		Expect(err).To(BeAssignableToTypeOf(&jwt.ValidationError{}))
 	})
 
 	It("should verify iat", func() {
-		seeds.IssuedAt = time.Now().Unix() + 1
+		seeds.IssuedAt = jwt.NewNumericDate(time.Now().Add(time.Second))
 		_, err := subject.Decode(generate())
-		Expect(err).To(MatchError(`issued in the future`))
+		Expect(err).To(MatchError(`token used before issued`))
 		Expect(err).To(BeAssignableToTypeOf(&jwt.ValidationError{}))
 	})
 
 	It("should verify aud", func() {
-		seeds.Audience = "other"
+		seeds.Audience = jwt.ClaimStrings{"other"}
 		_, err := subject.Decode(generate())
-		Expect(err).To(MatchError(`invalid audience claim "other"`))
+		Expect(err).To(MatchError(`token has invalid audience`))
 		Expect(err).To(BeAssignableToTypeOf(&jwt.ValidationError{}))
 	})
 
 	It("should verify iss", func() {
 		seeds.Issuer = "other"
 		_, err := subject.Decode(generate())
-		Expect(err).To(MatchError(`invalid issuer claim "other"`))
+		Expect(err).To(MatchError(`token has invalid issuer`))
 		Expect(err).To(BeAssignableToTypeOf(&jwt.ValidationError{}))
 	})
 
 	It("should verify sub", func() {
 		seeds.Subject = ""
 		_, err := subject.Decode(generate())
-		Expect(err).To(MatchError(`subject is missing`))
+		Expect(err).To(MatchError(`token has no subject`))
 		Expect(err).To(BeAssignableToTypeOf(&jwt.ValidationError{}))
 	})
 
 	It("should verify auth time", func() {
-		seeds.AuthAt = time.Now().Unix() + 1
+		seeds.AuthAt = jwt.NewNumericDate(time.Now().Add(time.Second))
 		_, err := subject.Decode(generate())
-		Expect(err).To(MatchError(`auth-time in the future`))
+		Expect(err).To(MatchError(`token auth_time not valid`))
 		Expect(err).To(BeAssignableToTypeOf(&jwt.ValidationError{}))
 	})
 })
 
 var _ = Describe("Claims", func() {
 	It("should be JWT compatible", func() {
-		subject := mockClaims(1515151515)
+		subject := mockClaims(time.Unix(1515151515, 0))
 		Expect(json.Marshal(subject)).To(MatchJSON(`{
 			"name": "Me",
 			"picture": "https://test.host/me.jpg",
@@ -185,17 +185,12 @@ var _ = BeforeSuite(func() {
 	certPEM = buf.String()
 })
 
-func mockClaims(now int64) *firejwt.Claims {
+func mockClaims(now time.Time) *firejwt.Claims {
 	return &firejwt.Claims{
 		Name:          "Me",
 		Picture:       "https://test.host/me.jpg",
-		Subject:       "MDYwNDQwNjUtYWQ0ZC00ZDkwLThl",
 		UserID:        "MDYwNDQwNjUtYWQ0ZC00ZDkwLThl",
-		Audience:      "mock-project",
-		Issuer:        "https://securetoken.google.com/mock-project",
-		IssuedAt:      now - 1800,
-		ExpiresAt:     now + 3600,
-		AuthAt:        now,
+		AuthAt:        jwt.NewNumericDate(now),
 		Email:         "me@example.com",
 		EmailVerified: true,
 		Firebase: &firejwt.FirebaseClaim{
@@ -205,5 +200,12 @@ func mockClaims(now int64) *firejwt.Claims {
 				"email":      {"me@example.com"},
 			},
 		},
+		RegisteredClaims: jwt.RegisteredClaims{
+			Subject:   "MDYwNDQwNjUtYWQ0ZC00ZDkwLThl",
+			Audience:  jwt.ClaimStrings{"mock-project"},
+			Issuer:    "https://securetoken.google.com/mock-project",
+			IssuedAt:  jwt.NewNumericDate(now.Add(-30 * time.Minute)),
+			ExpiresAt: jwt.NewNumericDate(now.Add(time.Hour)),
+		},
 	}
 }

data/go.mod

@@ -5,5 +5,5 @@ go 1.16
 require (
 	github.com/bsm/ginkgo/v2 v2.0.0
 	github.com/bsm/gomega v1.11.0
-	github.com/golang-jwt/jwt/v4 v4.3.0
+	github.com/golang-jwt/jwt/v4 v4.4.0
 )

data/go.sum

@@ -2,5 +2,5 @@ github.com/bsm/ginkgo/v2 v2.0.0 h1:JZAs5u7SmJCrZlGFrC3v1stg/uC7OIj2q2FW9NxeIVE=
 github.com/bsm/ginkgo/v2 v2.0.0/go.mod h1:AiKlXPm7ItEHNc/2+OkrNG4E0ITzojb9/xWzvQ9XZ9w=
 github.com/bsm/gomega v1.11.0 h1:wg9DVGPETNZLIbMsseneMV1a7uo/x+wsCyNXdEcifDI=
 github.com/bsm/gomega v1.11.0/go.mod h1:JifAceMQ4crZIWYUKrlGcmbN3bqHogVTADMD2ATsbwk=
-github.com/golang-jwt/jwt/v4 v4.3.0 h1:kHL1vqdqWNfATmA0FNMdmZNMyZI1U6O31X4rlIPoBog=
-github.com/golang-jwt/jwt/v4 v4.3.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
+github.com/golang-jwt/jwt/v4 v4.4.0 h1:EmVIxB5jzbllGIjiCV5JG4VylbK3KE400tLGLI1cdfU=
+github.com/golang-jwt/jwt/v4 v4.4.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: firejwt
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.5.0
 platform: ruby
 authors:
 - Black Square Media Ltd
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-02-18 00:00:00.000000000 Z
+date: 2022-03-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt
@@ -121,7 +121,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.6'
+      version: '2.7'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="