json-jwt 0.0.1 → 0.0.2

data/Gemfile.lock

@@ -1,15 +1,21 @@
 PATH
   remote: .
   specs:
-    json-jwt (0.0.0)
+    json-jwt (0.0.1)
+      activesupport (>= 2.3)
+      i18n
       json (>= 1.4.3)
       url_safe_base64
 
 GEM
   remote: http://rubygems.org/
   specs:
+    activesupport (3.1.0)
+      multi_json (~> 1.0)
     diff-lcs (1.1.3)
+    i18n (0.6.0)
     json (1.6.0)
+    multi_json (1.0.3)
     rake (0.9.2)
     rcov (0.9.10)
     rspec (2.6.0)

data/README.rdoc

@@ -13,6 +13,8 @@ JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and JSON
 
 == Examples
 
+=== Encoding
+
   claim = {
     iss: 'nov',
     exp: 1.week.from_now,
@@ -28,6 +30,12 @@ JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and JSON
   # With signature & encryption
   JSON::JWT.new(claim).sign(key, algorithm).encrypt(key, algorithm).to_s
 
+=== Decoding
+
+  jwt_string = "jwt_header.jwt_claims.jwt_signature"
+
+  JSON::JWT.decode(jwt_string, public_key)
+
 == Note on Patches/Pull Requests
  
 * Fork the project.

data/VERSION

@@ -1 +1 @@
-0.0.1
+0.0.2

data/json-jwt.gemspec

@@ -12,6 +12,8 @@ Gem::Specification.new do |s|
   s.require_paths = ["lib"]
   s.add_runtime_dependency "json", ">= 1.4.3"
   s.add_runtime_dependency "url_safe_base64"
+  s.add_runtime_dependency "activesupport", ">= 2.3"
+  s.add_runtime_dependency "i18n"
   s.add_development_dependency "rake", ">= 0.8"
   s.add_development_dependency "rcov", ">= 0.9"
   s.add_development_dependency "rspec", ">= 2"

data/lib/json/jws.rb

@@ -1,35 +1,29 @@
 module JSON
   class JWS < JWT
+    class InvalidFormat < JWT::InvalidFormat; end
+    class VerificationFailed < JWT::VerificationFailed; end
+
     def initialize(jwt)
-      @header = jwt.header
       replace jwt
+      raise InvalidFormat.new('Signature Algorithm Required') unless algorithm
     end
 
-    def sign(private_key_or_secret, algorithm)
-      header[:alg] = algorithm
-      digest = OpenSSL::Digest::Digest.new "SHA#{algorithm.to_s[2, 3]}"
-      self.signature = case algorithm
-      when :HS256, :HS384, :HS512
-        secret = private_key_or_secret
-        OpenSSL::HMAC.digest(
-          digest,
-          secret,
-          signature_base_string
-        )
-      when :RS256, :RS384, :RS512
-        private_key = private_key_or_secret
-        private_key.sign(
-          digest,
-          signature_base_string
-        )
-      when :ES256, :ES384, :ES512
-        # TODO
-      end
+    def sign!(private_key_or_secret)
+      self.signature = sign signature_base_string, private_key_or_secret
       self
     end
 
+    def verify(signature_base_string, signature, public_key_or_secret)
+      sign(signature_base_string, public_key_or_secret) == signature or
+      raise VerificationFailed
+    end
+
     private
 
+    def algorithm
+      @header[:alg]
+    end
+
     def signature_base_string
       [
         header.to_json,
@@ -38,5 +32,22 @@ module JSON
         UrlSafeBase64.encode64 segment
       end.join('.')
     end
+
+    def sign(signature_base_string, private_key_or_secret)
+      digest = OpenSSL::Digest::Digest.new "SHA#{algorithm.to_s[2, 3]}"
+      case algorithm
+      when :HS256, :HS384, :HS512
+        secret = private_key_or_secret
+        OpenSSL::HMAC.digest digest, secret, signature_base_string
+      when :RS256, :RS384, :RS512
+        private_key = private_key_or_secret
+        private_key.sign digest, signature_base_string
+      when :ES256, :ES384, :ES512
+        # TODO
+        raise NotImplementedError.new
+      else
+        raise InvalidFormat.new('Unknown Signature Algorithm')
+      end
+    end
   end
 end

data/lib/json/jwt.rb

@@ -6,21 +6,33 @@ module JSON
   class JWT < Hash
     attr_accessor :header, :signature
 
-    def initialize(claim)
+    class Exception < StandardError; end
+    class InvalidFormat < Exception; end
+    class VerificationFailed < Exception; end
+
+    def initialize(claims)
       @header = {
         :typ => :JWT,
         :alg => :none
       }
       [:exp, :nbf, :iat].each do |key|
-        if claim[key]
-          claim[key] = claim[key].to_i
-        end
+        claims[key] = claims[key].to_i if claims[key]
       end
-      replace claim
+      replace claims
     end
 
-    def sign(private_key_or_secret, algorithm = :RS256)
-      JWS.new(self).sign(private_key_or_secret, algorithm)
+    def sign(private_key_or_secret, algorithm = :HS256)
+      header[:alg] = algorithm
+      JWS.new(self).sign!(private_key_or_secret)
+    end
+
+    def verify(signature_base_string, signature = '', prublic_key_or_secret = nil)
+      case header[:alg]
+      when :none
+        signature == '' or raise VerificationFailed
+      else
+        JWS.new(self).verify(signature_base_string, signature, prublic_key_or_secret)
+      end
     end
 
     def to_s
@@ -32,6 +44,32 @@ module JSON
         UrlSafeBase64.encode64 segment.to_s
       end.join('.')
     end
+
+    class << self
+      def decode(jwt_string, public_key_or_secret = nil)
+        raise InvalidFormat.new('Invalid JWT Format. JWT should include 2 dots.') unless jwt_string.count('.') == 2
+        header, claims, signature = jwt_string.split('.').collect do |segment|
+          UrlSafeBase64.decode64 segment.to_s
+        end
+        jwt = new JSON.parse(claims).with_indifferent_access
+        jwt.header = JSON.parse(header).with_indifferent_access
+        jwt.verify [header, claims].join('.'), signature, public_key_or_secret
+        jwt
+      rescue JSON::ParserError
+        raise InvalidFormat.new("Invalid JSON Format")
+      end
+    end
+
+    private
+
+    def replace(hash_or_jwt)
+      super hash_or_jwt
+      if hash_or_jwt.is_a? JSON::JWT
+        self.header = hash_or_jwt.header
+        self.signature = hash_or_jwt.signature
+      end
+      self
+    end
   end
 end
 

data/spec/json/jws_spec.rb

@@ -1,9 +1,14 @@
 require 'spec_helper'
 
 describe JSON::JWS do
-  let(:jwt) { JSON::JWT.new claim }
+  let(:alg) { :none }
+  let(:jwt) do
+    _jwt_ = JSON::JWT.new claims
+    _jwt_.header[:alg] = alg
+    _jwt_
+  end
   let(:jws) { JSON::JWS.new jwt }
-  let(:claim) do
+  let(:claims) do
     {
       :iss => 'joe',
       :exp => 1300819380,
@@ -22,7 +27,7 @@ describe JSON::JWS do
     its(:signature) { should be_nil }
   end
 
-  describe '#sign' do
+  describe '#sign!' do
     shared_examples_for :jwt_with_expected_signature do
       it 'should generate expected signature' do
         UrlSafeBase64.encode64(signed.signature).should == expected_signature[alg]
@@ -42,10 +47,10 @@ describe JSON::JWS do
       }
     }
     let(:signed) do
-      jws.sign key, alg
+      jws.sign! key
     end
     subject { signed }
-    
+
     [:HS256, :HS384, :HS512].each do |algorithm|
       describe algorithm do
         let(:key) { shared_secret }

data/spec/json/jwt_spec.rb

@@ -1,26 +1,25 @@
 require 'spec_helper'
 
 describe JSON::JWT do
-  let(:jwt) { JSON::JWT.new claim }
-  let(:claim) do
+  let(:jwt) { JSON::JWT.new claims }
+  let(:claims) do
     {
       :iss => 'joe',
       :exp => 1300819380,
       'http://example.com/is_root' => true
     }
   end
+  let(:no_signed) do
+    'eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJpc3MiOiJqb2UiLCJleHAiOjEzMDA4MTkzODAsImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.'
+  end
 
-  context 'when no sign no encryption' do
-    let :result do
-      'eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJpc3MiOiJqb2UiLCJleHAiOjEzMDA4MTkzODAsImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.'
-    end
-
+  context 'when not signed nor encrypted' do
     it do
-      jwt.to_s.should == result
+      jwt.to_s.should == no_signed
     end
   end
 
-  describe '.sign' do
+  describe '#sign' do
     [:HS256, :HS384, :HS512].each do |algorithm|
       context algorithm do
         it do
@@ -37,4 +36,32 @@ describe JSON::JWT do
       end
     end
   end
+
+  describe '#verify' do
+    context 'when not signed nor encrypted' do
+      context 'no signature given' do
+        it do
+          jwt.verify(no_signed.chop).should be_true
+        end
+      end
+
+      context 'otherwise' do
+        it do
+          expect do
+            jwt.verify(no_signed.chop, 'signature')
+          end.should raise_error JSON::JWT::VerificationFailed
+        end
+      end
+    end
+
+    context 'when signed' do
+      before { jwt.header[:alg] = :HS256 }
+      it 'should delegate verification to JWS' do
+        jws = JSON::JWS.new jwt
+        jws.should_receive(:verify)
+        JSON::JWS.should_receive(:new).and_return(jws)
+        jwt.verify 'signature_base_string', 'signature', 'shared_secret'
+      end
+    end
+  end
 end

metadata

@@ -1,13 +1,8 @@
 --- !ruby/object:Gem::Specification 
 name: json-jwt
 version: !ruby/object:Gem::Version 
-  hash: 29
   prerelease: 
-  segments: 
-  - 0
-  - 0
-  - 1
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors: 
 - nov matake
@@ -15,7 +10,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-09-15 00:00:00 Z
+date: 2011-09-21 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: json
@@ -25,11 +20,6 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 1
-        segments: 
-        - 1
-        - 4
-        - 3
         version: 1.4.3
   type: :runtime
   version_requirements: *id001
@@ -41,56 +31,64 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 3
-        segments: 
-        - 0
         version: "0"
   type: :runtime
   version_requirements: *id002
 - !ruby/object:Gem::Dependency 
-  name: rake
+  name: activesupport
   prerelease: false
   requirement: &id003 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 27
-        segments: 
-        - 0
-        - 8
+        version: "2.3"
+  type: :runtime
+  version_requirements: *id003
+- !ruby/object:Gem::Dependency 
+  name: i18n
+  prerelease: false
+  requirement: &id004 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        version: "0"
+  type: :runtime
+  version_requirements: *id004
+- !ruby/object:Gem::Dependency 
+  name: rake
+  prerelease: false
+  requirement: &id005 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
         version: "0.8"
   type: :development
-  version_requirements: *id003
+  version_requirements: *id005
 - !ruby/object:Gem::Dependency 
   name: rcov
   prerelease: false
-  requirement: &id004 !ruby/object:Gem::Requirement 
+  requirement: &id006 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 25
-        segments: 
-        - 0
-        - 9
         version: "0.9"
   type: :development
-  version_requirements: *id004
+  version_requirements: *id006
 - !ruby/object:Gem::Dependency 
   name: rspec
   prerelease: false
-  requirement: &id005 !ruby/object:Gem::Requirement 
+  requirement: &id007 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 7
-        segments: 
-        - 2
         version: "2"
   type: :development
-  version_requirements: *id005
+  version_requirements: *id007
 description: JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and JSON Web Key) in Ruby
 email: 
 - nov@matake.jp
@@ -133,23 +131,17 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
-      hash: 3
-      segments: 
-      - 0
       version: "0"
 required_rubygems_version: !ruby/object:Gem::Requirement 
   none: false
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
-      hash: 3
-      segments: 
-      - 0
       version: "0"
 requirements: []
 
 rubyforge_project: 
-rubygems_version: 1.8.5
+rubygems_version: 1.8.10
 signing_key: 
 specification_version: 3
 summary: JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and JSON Web Key) in Ruby