json-jwt 1.5.2 → 1.6.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: c89e8876d50ba67374f768113e49c6f4e1486328
-  data.tar.gz: 4dc7ccdfd93385c4275b95ad7690d9f02521ac4b
+  metadata.gz: 2d76ce03978dc2dcfb42f7061d0613fdf9d8dba2
+  data.tar.gz: ad36d966f39107a7e9e7ecd0521780674d7b31b5
 SHA512:
-  metadata.gz: 2b1976c4c86abb0de914273c1594da22250b62d88b183e031f6e67b336f7ee98096a7e9605888fdccd7fd0a13bdf71088a39632c7ff107c12219ef6a65ca9ffe
-  data.tar.gz: 4a7f3f081a0adab03c6ea43154c329d52ee86dde606719b2391fda556490f1085f9f93090eb25ab1bb367ba230dd484fd39da55a765f154c073c4e7a4d3ddb48
+  metadata.gz: f9fff9a8a5519bcec6cb67eb2153c2ca6f852191b18ddc98011e56fa228bcc94be9c1621fcef734402053d4755b83120e0b1a89b7396a0ea26396cdedda17f9d
+  data.tar.gz: 258a78cfd221accbf30f91ff35c0b5774cc1f463a61311b5412bacb0425fb0bbf1887f900a39197bd2d83bd7210b40c215824dd5a71a4b508f2b91b5e6cbadb1

data/.travis.yml

@@ -3,8 +3,6 @@ before_install:
   - git submodule update --init --recursive
 
 rvm:
-  - 1.9.3
-  - 2.0
-  - 2.1
-  - 2.2
-  - 2.3.0
+  - 2.2.2 # NOTE: 2.2.1 or lower aren't supported by activesupport 5.0, CI isn't needed for such legacy versions.
+  - 2.2.5
+  - 2.3.1

data/VERSION

@@ -1 +1 @@
-1.5.2
+1.6.3

data/lib/json/jose.rb

@@ -20,6 +20,19 @@ module JSON
       end
     end
 
+    def with_jwk_support(key)
+      case key
+      when JSON::JWK
+        key.to_key
+      when JSON::JWK::Set
+        key.detect do |jwk|
+          jwk[:kid] && jwk[:kid] == kid
+        end.try(:to_key) or raise JWK::Set::KidNotFound
+      else
+        key
+      end
+    end
+
     module ClassMethods
       def register_header_keys(*keys)
         keys.each do |header_key|

data/lib/json/jwe.rb

@@ -25,7 +25,7 @@ module JSON
     end
 
     def encrypt!(public_key_or_secret)
-      self.public_key_or_secret = public_key_or_secret
+      self.public_key_or_secret = with_jwk_support public_key_or_secret
       cipher.encrypt
       generate_cipher_keys!
       self.cipher_text = cipher.update(plain_text) + cipher.final
@@ -33,7 +33,7 @@ module JSON
     end
 
     def decrypt!(private_key_or_secret)
-      self.private_key_or_secret = private_key_or_secret
+      self.private_key_or_secret = with_jwk_support private_key_or_secret
       cipher.decrypt
       restore_cipher_keys!
       self.plain_text = cipher.update(cipher_text) + cipher.final

data/lib/json/jwk.rb

@@ -18,6 +18,7 @@ module JSON
         super params
         merge! ex_params
       end
+      self[:kid] ||= thumbprint rescue nil #ignore
     end
 
     def content_type

data/lib/json/jws.rb

@@ -30,7 +30,7 @@ module JSON
     def update(hash_or_jwt)
       super
       if hash_or_jwt.is_a? JSON::JWT
-        self.header = hash_or_jwt.header
+        self.header.update hash_or_jwt.header
         self.signature = hash_or_jwt.signature
       end
       self
@@ -106,19 +106,6 @@ module JSON
       raise UnexpectedAlgorithm.new(e.message)
     end
 
-    def with_jwk_support(key)
-      case key
-      when JSON::JWK
-        key.to_key
-      when JSON::JWK::Set
-        key.detect do |jwk|
-          jwk[:kid] && jwk[:kid] == kid
-        end.try(:to_key) or raise JWK::Set::KidNotFound
-      else
-        key
-      end
-    end
-
     def verify_ecdsa_group!(key)
       group_name = case digest.digest_length * 8
       when 256

data/lib/json/jwt.rb

@@ -26,14 +26,23 @@ module JSON
       update claims
     end
 
-    def sign(private_key_or_secret, algorithm = :HS256)
+    def sign(private_key_or_secret, algorithm = :autodetect)
+      if algorithm == :autodetect
+        # NOTE:
+        #  I'd like to make :RS256 default.
+        #  However, by histrical reasons, :HS256 was default.
+        #  This code is needed to keep legacy behavior.
+        algorithm = private_key_or_secret.is_a?(String) ? :HS256 : :RS256
+      end
       jws = JWS.new self
+      jws.kid ||= private_key_or_secret[:kid] if private_key_or_secret.is_a? JSON::JWK
       jws.alg = algorithm
       jws.sign! private_key_or_secret
     end
 
     def encrypt(public_key_or_secret, algorithm = :RSA1_5, encryption_method = :'A128CBC-HS256')
       jwe = JWE.new self
+      jwe.kid ||= public_key_or_secret[:kid] if public_key_or_secret.is_a? JSON::JWK
       jwe.alg = algorithm
       jwe.enc = encryption_method
       jwe.encrypt! public_key_or_secret

data/spec/json/jwe_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper'
 
 describe JSON::JWE do
-  let(:shared_key) { SecureRandom.hex 16 } # default shared key is too short
+  let(:shared_key) { SecureRandom.hex 32 } # default shared key is too short
   let(:private_key_path) { der_file_path 'rsa/private_key' }
 
   describe '#content_type' do
@@ -248,8 +248,37 @@ describe JSON::JWE do
 
     context 'when alg=dir' do
       let(:alg) { :dir }
-      let(:key) { 'todo' }
-      it :TODO
+      let(:key) { shared_key }
+
+      context 'when enc=A128GCM' do
+        let(:enc) { :A128GCM }
+        if gcm_supported?
+          it_behaves_like :decryptable
+        else
+          it_behaves_like :gcm_decryption_unsupported
+        end
+      end
+
+      context 'when enc=A256GCM' do
+        let(:enc) { :A256GCM }
+        if gcm_supported?
+          it_behaves_like :decryptable
+        else
+          it_behaves_like :gcm_decryption_unsupported
+        end
+      end
+
+      context 'when enc=A128CBC-HS256' do
+        let(:enc) { :'A128CBC-HS256' }
+        it_behaves_like :decryptable
+        it_behaves_like :verify_cbc_authentication_tag
+      end
+
+      context 'when enc=A256CBC-HS512' do
+        let(:enc) { :'A256CBC-HS512' }
+        it_behaves_like :decryptable
+        it_behaves_like :verify_cbc_authentication_tag
+      end
     end
 
     context 'when unknonw/unsupported algorithm given' do

data/spec/json/jwk_spec.rb

@@ -2,21 +2,38 @@ require 'spec_helper'
 
 describe JSON::JWK do
   describe '#initialize' do
-    subject { JSON::JWK.new key }
+    let(:jwk) { JSON::JWK.new key }
+    subject { jwk }
+
+    shared_examples_for :jwk_with_kid do
+      it { should be_instance_of JSON::JWK }
+      describe 'kid' do
+        subject { jwk[:kid] }
+        it { should == jwk.thumbprint }
+      end
+    end
+
+    shared_examples_for :jwk_without_kid do
+      it { should be_instance_of JSON::JWK }
+      describe 'kid' do
+        subject { jwk[:kid] }
+        it { should be_blank }
+      end
+    end
 
     context 'with OpenSSL::PKey::RSA' do
       let(:key) { public_key }
-      it { should be_instance_of JSON::JWK }
+      it_behaves_like :jwk_with_kid
     end
 
     context 'with OpenSSL::PKey::EC' do
       let(:key) { public_key :ecdsa }
-      it { should be_instance_of JSON::JWK }
+      it_behaves_like :jwk_with_kid
     end
 
     context 'with String' do
       let(:key) { 'secret' }
-      it { should be_instance_of JSON::JWK }
+      it_behaves_like :jwk_with_kid
     end
 
     context 'with JSON::JWK' do
@@ -26,7 +43,7 @@ describe JSON::JWK do
           kty: :oct
         )
       end
-      it { should be_instance_of JSON::JWK }
+      it_behaves_like :jwk_with_kid
     end
 
     context 'with Hash' do
@@ -36,7 +53,12 @@ describe JSON::JWK do
           kty: :oct
         }
       end
-      it { should be_instance_of JSON::JWK }
+      it_behaves_like :jwk_with_kid
+    end
+
+    context 'with nothing' do
+      let(:jwk) { JSON::JWK.new }
+      it_behaves_like :jwk_without_kid
     end
   end
 

data/spec/json/jws_spec.rb

@@ -265,7 +265,7 @@ describe JSON::JWS do
     end
   end
 
-  describe 'to_json' do
+  describe '#to_json' do
     let(:alg) { :RS256 }
     let(:private_key_or_secret) { private_key }
 

data/spec/json/jwt_spec.rb

@@ -47,6 +47,72 @@ describe JSON::JWT do
         end
       end
     end
+
+    context 'when no algirithm specified' do
+      subject { jwt.sign(key) }
+
+      context 'when key is String' do
+        let(:key) { shared_secret }
+        its(:alg) { should == :HS256 }
+      end
+
+      context 'otherwise' do
+        let(:key) { private_key }
+        its(:alg) { should == :RS256 }
+      end
+    end
+
+    context 'when non-JWK key is given' do
+      let(:key) { private_key }
+      it 'should not set kid header automatically' do
+        jws = jwt.sign(key, :RS256)
+        jws.kid.should be_blank
+      end
+    end
+
+    context 'when JWK is given' do
+      let(:key) { JSON::JWK.new private_key }
+      it 'should set kid header automatically' do
+        jws = jwt.sign(key, :RS256)
+        jwt.kid.should be_blank
+        jws.kid.should == key[:kid]
+      end
+    end
+
+    describe 'object copy behaviour' do
+      before do
+        @jwt = JSON::JWT.new(obj: {foo: :bar})
+        @jws = @jwt.sign('secret')
+      end
+
+      context 'when original JWT is modified' do
+        before do
+          @jwt.header[:x] = :x
+          @jwt[:obj][:x] = :x
+        end
+
+        describe 'copied JWS' do
+          it 'should be affected as shallow copy, but not as a simple reference' do
+            @jws.header.should_not include :x
+            @jws[:obj].should include :x
+          end
+        end
+      end
+
+      context 'when copied JWS is modified' do
+        before do
+          @jws.header[:x] = :x
+          @jws[:obj][:x] = :x
+        end
+
+        describe 'original JWT' do
+          it 'should be affected as shallow copy, but not as a simple reference' do
+            @jwt.header.should_not include :x
+            @jwt[:obj].should include :x
+          end
+        end
+      end
+    end
   end
 
   describe '#encrypt' do
@@ -67,6 +133,23 @@ describe JSON::JWT do
     it 'should accept optional algorithm and encryption method' do
       jwt.encrypt(SecureRandom.hex(32), :dir, :'A256CBC-HS512').should be_a JSON::JWE
     end
+
+    context 'when non-JWK key is given' do
+      let(:key) { shared_key }
+      it 'should not set kid header automatically' do
+        jwe = jwt.encrypt(key, :dir)
+        jwe.kid.should be_blank
+      end
+    end
+
+    context 'when JWK is given' do
+      let(:key) { JSON::JWK.new shared_key }
+      it 'should set kid header automatically' do
+        jwe = jwt.encrypt(key, :dir)
+        jwt.kid.should be_blank
+        jwe.kid.should == key[:kid]
+      end
+    end
   end
 
   describe '.decode' do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: json-jwt
 version: !ruby/object:Gem::Version
-  version: 1.5.2
+  version: 1.6.3
 platform: ruby
 authors:
 - nov matake
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-01-26 00:00:00.000000000 Z
+date: 2016-07-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: multi_json