jwt 2.9.1 → 2.10.1

data/lib/jwt/jwa/signing_algorithm.rb

@@ -1,8 +1,11 @@
 # frozen_string_literal: true
 
 module JWT
+  # JSON Web Algorithms
   module JWA
+    # Base functionality for signing algorithms
     module SigningAlgorithm
+      # Class methods for the SigningAlgorithm module
       module ClassMethods
         def register_algorithm(algo)
           ::JWT::JWA.register_algorithm(algo)
@@ -11,6 +14,7 @@ module JWT
 
       def self.included(klass)
         klass.extend(ClassMethods)
+        klass.include(JWT::JWA::Compat)
       end
 
       attr_reader :alg

data/lib/jwt/jwa/unsupported.rb

@@ -2,6 +2,7 @@
 
 module JWT
   module JWA
+    # Represents an unsupported algorithm
     module Unsupported
       class << self
         include JWT::JWA::SigningAlgorithm

data/lib/jwt/jwa/wrapper.rb

@@ -2,6 +2,7 @@
 
 module JWT
   module JWA
+    # @api private
     class Wrapper
       include SigningAlgorithm
 

data/lib/jwt/jwa.rb

@@ -8,6 +8,7 @@ rescue LoadError
   raise if defined?(RbNaCl)
 end
 
+require_relative 'jwa/compat'
 require_relative 'jwa/signing_algorithm'
 require_relative 'jwa/ecdsa'
 require_relative 'jwa/hmac'
@@ -17,9 +18,7 @@ require_relative 'jwa/rsa'
 require_relative 'jwa/unsupported'
 require_relative 'jwa/wrapper'
 
-if JWT.rbnacl?
-  require_relative 'jwa/eddsa'
-end
+require_relative 'jwa/eddsa' if JWT.rbnacl?
 
 if JWT.rbnacl_6_or_greater?
   require_relative 'jwa/hmac_rbnacl'
@@ -28,18 +27,32 @@ elsif JWT.rbnacl?
 end
 
 module JWT
+  # The JWA module contains all supported algorithms.
   module JWA
     class << self
+      # @api private
       def resolve(algorithm)
         return find(algorithm) if algorithm.is_a?(String) || algorithm.is_a?(Symbol)
 
         unless algorithm.is_a?(SigningAlgorithm)
-          Deprecations.warning('Custom algorithms are required to include JWT::JWA::SigningAlgorithm')
+          Deprecations.warning('Custom algorithms are required to include JWT::JWA::SigningAlgorithm. Custom algorithms that do not include this module may stop working in the next major version of ruby-jwt.')
           return Wrapper.new(algorithm)
         end
 
         algorithm
       end
+
+      # @api private
+      def resolve_and_sort(algorithms:, preferred_algorithm:)
+        algs = Array(algorithms).map { |alg| JWA.resolve(alg) }
+        algs.partition { |alg| alg.valid_alg?(preferred_algorithm) }.flatten
+      end
+
+      # @deprecated The `::JWT::JWA.create` method is deprecated and will be removed in the next major version of ruby-jwt.
+      def create(algorithm)
+        Deprecations.warning('The ::JWT::JWA.create method is deprecated and will be removed in the next major version of ruby-jwt.')
+        resolve(algorithm)
+      end
     end
   end
 end

data/lib/jwt/jwk/ec.rb

@@ -4,6 +4,7 @@ require 'forwardable'
 
 module JWT
   module JWK
+    # JWK representation for Elliptic Curve (EC) keys
     class EC < KeyBase # rubocop:disable Metrics/ClassLength
       KTY    = 'EC'
       KTYS   = [KTY, OpenSSL::PKey::EC, JWT::JWK::EC].freeze
@@ -65,9 +66,7 @@ module JWT
       end
 
       def []=(key, value)
-        if EC_KEY_ELEMENTS.include?(key.to_sym)
-          raise ArgumentError, 'cannot overwrite cryptographic key attributes'
-        end
+        raise ArgumentError, 'cannot overwrite cryptographic key attributes' if EC_KEY_ELEMENTS.include?(key.to_sym)
 
         super(key, value)
       end

data/lib/jwt/jwk/hmac.rb

@@ -2,6 +2,7 @@
 
 module JWT
   module JWK
+    # JWK for HMAC keys
     class HMAC < KeyBase
       KTY  = 'oct'
       KTYS = [KTY, String, JWT::JWK::HMAC].freeze
@@ -61,9 +62,7 @@ module JWT
       end
 
       def []=(key, value)
-        if HMAC_KEY_ELEMENTS.include?(key.to_sym)
-          raise ArgumentError, 'cannot overwrite cryptographic key attributes'
-        end
+        raise ArgumentError, 'cannot overwrite cryptographic key attributes' if HMAC_KEY_ELEMENTS.include?(key.to_sym)
 
         super(key, value)
       end

data/lib/jwt/jwk/key_base.rb

@@ -2,6 +2,7 @@
 
 module JWT
   module JWK
+    # Base for JWK implementations
     class KeyBase
       def self.inherited(klass)
         super

data/lib/jwt/jwk/key_finder.rb

@@ -2,6 +2,7 @@
 
 module JWT
   module JWK
+    # @api private
     class KeyFinder
       def initialize(options)
         @allow_nil_kid = options[:allow_nil_kid]

data/lib/jwt/jwk/kid_as_key_digest.rb

@@ -2,6 +2,7 @@
 
 module JWT
   module JWK
+    # @api private
     class KidAsKeyDigest
       def initialize(jwk)
         @jwk = jwk

data/lib/jwt/jwk/okp_rbnacl.rb

@@ -2,6 +2,7 @@
 
 module JWT
   module JWK
+    # JSON Web Key (JWK) representation for Ed25519 keys
     class OKPRbNaCl < KeyBase
       KTY  = 'OKP'
       KTYS = [KTY, JWT::JWK::OKPRbNaCl, RbNaCl::Signatures::Ed25519::SigningKey, RbNaCl::Signatures::Ed25519::VerifyKey].freeze
@@ -10,7 +11,7 @@ module JWT
 
       def initialize(key, params = nil, options = {})
         params ||= {}
-
+        Deprecations.warning('Using the OKP JWK for Ed25519 keys is deprecated and will be removed in a future version of ruby-jwt. Please use the ruby-eddsa gem instead.')
         # For backwards compatibility when kid was a String
         params = { kid: params } if params.is_a?(String)
 
@@ -83,9 +84,7 @@ module JWT
           x: ::JWT::Base64.url_encode(verify_key.to_bytes)
         }
 
-        if signing_key
-          params[:d] = ::JWT::Base64.url_encode(signing_key.to_bytes)
-        end
+        params[:d] = ::JWT::Base64.url_encode(signing_key.to_bytes) if signing_key
 
         params
       end

data/lib/jwt/jwk/rsa.rb

@@ -2,6 +2,7 @@
 
 module JWT
   module JWK
+    # JSON Web Key (JWK) representation of a RSA key
     class RSA < KeyBase # rubocop:disable Metrics/ClassLength
       BINARY = 2
       KTY    = 'RSA'
@@ -64,9 +65,7 @@ module JWT
       end
 
       def []=(key, value)
-        if RSA_KEY_ELEMENTS.include?(key.to_sym)
-          raise ArgumentError, 'cannot overwrite cryptographic key attributes'
-        end
+        raise ArgumentError, 'cannot overwrite cryptographic key attributes' if RSA_KEY_ELEMENTS.include?(key.to_sym)
 
         super(key, value)
       end

data/lib/jwt/jwk/set.rb

@@ -4,6 +4,8 @@ require 'forwardable'
 
 module JWT
   module JWK
+    # JSON Web Key Set (JWKS) representation
+    # https://tools.ietf.org/html/rfc7517
     class Set
       include Enumerable
       extend Forwardable

data/lib/jwt/jwk.rb

@@ -4,6 +4,7 @@ require_relative 'jwk/key_finder'
 require_relative 'jwk/set'
 
 module JWT
+  # JSON Web Key (JWK)
   module JWK
     class << self
       def create_from(key, params = nil, options = {})

data/lib/jwt/token.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+module JWT
+  # Represents a JWT token
+  #
+  # Basic token signed using the HS256 algorithm:
+  #
+  #   token = JWT::Token.new(payload: {pay: 'load'})
+  #   token.sign!(algorithm: 'HS256', key: 'secret')
+  #   token.jwt # => eyJhb....
+  #
+  # Custom headers will be combined with generated headers:
+  #   token = JWT::Token.new(payload: {pay: 'load'}, header: {custom: "value"})
+  #   token.sign!(algorithm: 'HS256', key: 'secret')
+  #   token.header # => {"custom"=>"value", "alg"=>"HS256"}
+  #
+  class Token
+    include Claims::VerificationMethods
+
+    # Initializes a new Token instance.
+    #
+    # @param header [Hash] the header of the JWT token.
+    # @param payload [Hash] the payload of the JWT token.
+    def initialize(payload:, header: {})
+      @header  = header&.transform_keys(&:to_s)
+      @payload = payload
+    end
+
+    # Returns the decoded signature of the JWT token.
+    #
+    # @return [String] the decoded signature of the JWT token.
+    def signature
+      @signature ||= ::JWT::Base64.url_decode(encoded_signature || '')
+    end
+
+    # Returns the encoded signature of the JWT token.
+    #
+    # @return [String] the encoded signature of the JWT token.
+    def encoded_signature
+      @encoded_signature ||= ::JWT::Base64.url_encode(signature)
+    end
+
+    # Returns the decoded header of the JWT token.
+    #
+    # @return [Hash] the header of the JWT token.
+    attr_reader :header
+
+    # Returns the encoded header of the JWT token.
+    #
+    # @return [String] the encoded header of the JWT token.
+    def encoded_header
+      @encoded_header ||= ::JWT::Base64.url_encode(JWT::JSON.generate(header))
+    end
+
+    # Returns the payload of the JWT token.
+    #
+    # @return [Hash] the payload of the JWT token.
+    attr_reader :payload
+
+    # Returns the encoded payload of the JWT token.
+    #
+    # @return [String] the encoded payload of the JWT token.
+    def encoded_payload
+      @encoded_payload ||= ::JWT::Base64.url_encode(JWT::JSON.generate(payload))
+    end
+
+    # Returns the signing input of the JWT token.
+    #
+    # @return [String] the signing input of the JWT token.
+    def signing_input
+      @signing_input ||= [encoded_header, encoded_payload].join('.')
+    end
+
+    # Returns the JWT token as a string.
+    #
+    # @return [String] the JWT token as a string.
+    # @raise [JWT::EncodeError] if the token is not signed or other encoding issues
+    def jwt
+      @jwt ||= (@signature && [encoded_header, @detached_payload ? '' : encoded_payload, encoded_signature].join('.')) || raise(::JWT::EncodeError, 'Token is not signed')
+    end
+
+    # Detaches the payload according to https://datatracker.ietf.org/doc/html/rfc7515#appendix-F
+    #
+    def detach_payload!
+      @detached_payload = true
+
+      nil
+    end
+
+    # Signs the JWT token.
+    #
+    # @param algorithm [String, Object] the algorithm to use for signing.
+    # @param key [String] the key to use for signing.
+    # @return [void]
+    # @raise [JWT::EncodeError] if the token is already signed or other problems when signing
+    def sign!(algorithm:, key:)
+      raise ::JWT::EncodeError, 'Token already signed' if @signature
+
+      JWA.resolve(algorithm).tap do |algo|
+        header.merge!(algo.header)
+        @signature = algo.sign(data: signing_input, signing_key: key)
+      end
+
+      nil
+    end
+
+    # Returns the JWT token as a string.
+    #
+    # @return [String] the JWT token as a string.
+    alias to_s jwt
+  end
+end

data/lib/jwt/verify.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require_relative 'error'
+
+module JWT
+  # @deprecated This class is deprecated and will be removed in the next major version of ruby-jwt.
+  class Verify
+    DEFAULTS = { leeway: 0 }.freeze
+    METHODS = %w[verify_aud verify_expiration verify_iat verify_iss verify_jti verify_not_before verify_sub verify_required_claims].freeze
+
+    private_constant(:DEFAULTS, :METHODS)
+    class << self
+      METHODS.each do |method_name|
+        define_method(method_name) do |payload, options|
+          new(payload, options).send(method_name)
+        end
+      end
+
+      # @deprecated This method is deprecated and will be removed in the next major version of ruby-jwt.
+      def verify_claims(payload, options)
+        Deprecations.warning('The ::JWT::Verify.verify_claims method is deprecated and will be removed in the next major version of ruby-jwt')
+        ::JWT::Claims.verify!(payload, options)
+        true
+      end
+    end
+
+    # @deprecated This class is deprecated and will be removed in the next major version of ruby-jwt.
+    def initialize(payload, options)
+      Deprecations.warning('The ::JWT::Verify class is deprecated and will be removed in the next major version of ruby-jwt')
+      @payload = payload
+      @options = DEFAULTS.merge(options)
+    end
+
+    METHODS.each do |method_name|
+      define_method(method_name) do
+        ::JWT::Claims.verify!(@payload, @options.merge(method_name => true))
+      end
+    end
+  end
+end

data/lib/jwt/version.rb

@@ -1,44 +1,65 @@
 # frozen_string_literal: true
 
-# Moments version builder module
+# JSON Web Token implementation
+#
+# Should be up to date with the latest spec:
+# https://tools.ietf.org/html/rfc7519
 module JWT
+  # Returns the gem version of the JWT library.
+  #
+  # @return [Gem::Version] the gem version.
   def self.gem_version
-    Gem::Version.new VERSION::STRING
+    Gem::Version.new(VERSION::STRING)
   end
 
-  # Moments version builder module
+  # @api private
   module VERSION
-    # major version
     MAJOR = 2
-    # minor version
-    MINOR = 9
-    # tiny version
+    MINOR = 10
     TINY  = 1
-    # alpha, beta, etc. tag
     PRE   = nil
 
-    # Build version string
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')
   end
 
+  # Checks if the OpenSSL version is 3 or greater.
+  #
+  # @return [Boolean] true if OpenSSL version is 3 or greater, false otherwise.
+  # @api private
   def self.openssl_3?
     return false if OpenSSL::OPENSSL_VERSION.include?('LibreSSL')
 
     true if 3 * 0x10000000 <= OpenSSL::OPENSSL_VERSION_NUMBER
   end
 
+  # Checks if the RbNaCl library is defined.
+  #
+  # @return [Boolean] true if RbNaCl is defined, false otherwise.
+  # @api private
   def self.rbnacl?
     defined?(::RbNaCl)
   end
 
+  # Checks if the RbNaCl library version is 6.0.0 or greater.
+  #
+  # @return [Boolean] true if RbNaCl version is 6.0.0 or greater, false otherwise.
+  # @api private
   def self.rbnacl_6_or_greater?
     rbnacl? && ::Gem::Version.new(::RbNaCl::VERSION) >= ::Gem::Version.new('6.0.0')
   end
 
+  # Checks if there is an OpenSSL 3 HMAC empty key regression.
+  #
+  # @return [Boolean] true if there is an OpenSSL 3 HMAC empty key regression, false otherwise.
+  # @api private
   def self.openssl_3_hmac_empty_key_regression?
     openssl_3? && openssl_version <= ::Gem::Version.new('3.0.0')
   end
 
+  # Returns the OpenSSL version.
+  #
+  # @return [Gem::Version] the OpenSSL version.
+  # @api private
   def self.openssl_version
     @openssl_version ||= ::Gem::Version.new(OpenSSL::VERSION)
   end

data/lib/jwt.rb

@@ -10,6 +10,11 @@ require 'jwt/encode'
 require 'jwt/error'
 require 'jwt/jwk'
 require 'jwt/claims'
+require 'jwt/encoded_token'
+require 'jwt/token'
+
+require 'jwt/claims_validator'
+require 'jwt/verify'
 
 # JSON Web Token implementation
 #
@@ -20,6 +25,13 @@ module JWT
 
   module_function
 
+  # Encodes a payload into a JWT.
+  #
+  # @param payload [Hash] the payload to encode.
+  # @param key [String] the key used to sign the JWT.
+  # @param algorithm [String] the algorithm used to sign the JWT.
+  # @param header_fields [Hash] additional headers to include in the JWT.
+  # @return [String] the encoded JWT.
   def encode(payload, key, algorithm = 'HS256', header_fields = {})
     Encode.new(payload: payload,
                key: key,
@@ -27,6 +39,13 @@ module JWT
                headers: header_fields).segments
   end
 
+  # Decodes a JWT to extract the payload and header
+  #
+  # @param jwt [String] the JWT to decode.
+  # @param key [String] the key used to verify the JWT.
+  # @param verify [Boolean] whether to verify the JWT signature.
+  # @param options [Hash] additional options for decoding.
+  # @return [Array<Hash>] the decoded payload and headers.
   def decode(jwt, key = nil, verify = true, options = {}, &keyfinder) # rubocop:disable Style/OptionalBooleanParameter
     Deprecations.context do
       Decode.new(jwt, key, verify, configuration.decode.to_h.merge(options), &keyfinder).decode_segments

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: jwt
 version: !ruby/object:Gem::Version
-  version: 2.9.1
+  version: 2.10.1
 platform: ruby
 authors:
 - Tim Rudat
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-09-23 00:00:00.000000000 Z
+date: 2024-12-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64
@@ -125,6 +124,8 @@ files:
 - lib/jwt/base64.rb
 - lib/jwt/claims.rb
 - lib/jwt/claims/audience.rb
+- lib/jwt/claims/crit.rb
+- lib/jwt/claims/decode_verifier.rb
 - lib/jwt/claims/expiration.rb
 - lib/jwt/claims/issued_at.rb
 - lib/jwt/claims/issuer.rb
@@ -133,6 +134,9 @@ files:
 - lib/jwt/claims/numeric.rb
 - lib/jwt/claims/required.rb
 - lib/jwt/claims/subject.rb
+- lib/jwt/claims/verification_methods.rb
+- lib/jwt/claims/verifier.rb
+- lib/jwt/claims_validator.rb
 - lib/jwt/configuration.rb
 - lib/jwt/configuration/container.rb
 - lib/jwt/configuration/decode_configuration.rb
@@ -140,9 +144,11 @@ files:
 - lib/jwt/decode.rb
 - lib/jwt/deprecations.rb
 - lib/jwt/encode.rb
+- lib/jwt/encoded_token.rb
 - lib/jwt/error.rb
 - lib/jwt/json.rb
 - lib/jwt/jwa.rb
+- lib/jwt/jwa/compat.rb
 - lib/jwt/jwa/ecdsa.rb
 - lib/jwt/jwa/eddsa.rb
 - lib/jwt/jwa/hmac.rb
@@ -164,6 +170,8 @@ files:
 - lib/jwt/jwk/rsa.rb
 - lib/jwt/jwk/set.rb
 - lib/jwt/jwk/thumbprint.rb
+- lib/jwt/token.rb
+- lib/jwt/verify.rb
 - lib/jwt/version.rb
 - lib/jwt/x5c_key_finder.rb
 - ruby-jwt.gemspec
@@ -172,9 +180,8 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/jwt/ruby-jwt/issues
-  changelog_uri: https://github.com/jwt/ruby-jwt/blob/v2.9.1/CHANGELOG.md
+  changelog_uri: https://github.com/jwt/ruby-jwt/blob/v2.10.1/CHANGELOG.md
   rubygems_mfa_required: 'true'
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -189,8 +196,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.16
-signing_key: 
+rubygems_version: 3.6.2
 specification_version: 4
 summary: JSON Web Token implementation in Ruby
 test_files: []