jwt_auth_cognito 1.0.0.pre.beta.13 → 1.0.0.pre.beta.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 21369d98a11f9f2dc8a1539f4f4db6071822ae94901f15e0c4eb3496d4d74585
-  data.tar.gz: 7bcdd497bcb3ebb395a43ccb54c803efb525e739d1425670f488f675bb4d4d86
+  metadata.gz: 77eed5e47f35c5f0a7e693bab6c09e70cf2ea950670273d203ff3611d94b8a70
+  data.tar.gz: 21a499f3e1ad917bf9587cd8695e2dc44cceb7fb77f3ada93185ae2ed855c0d7
 SHA512:
-  metadata.gz: 2d68c23981b7efd4d919bda74cc2f67f15326b46d27a02103daf04bba9f76ed3de9c9b7b07de4d30d36a6a78660e9d07ac73d272767e76e765b2a8900a29d153
-  data.tar.gz: d50fc1f4f3fe447543cf0f7dfeff79de88082ec0d5aecf9cd602654349387a50100e6e7c4e8adcbfeb8af2f6962e060bac06d8a38a9b5362314e0e623351f241
+  metadata.gz: 2fb3defb3e11e9cc318ac1d387cf58c99fa6b1b3152bc34841db21645fb6a6fa67ab99af956fb4fd539aeaa44132df9994bc55256f9bb4412e30ebd112801c6a
+  data.tar.gz: cba58be12f1fd5dfe1d199a83e27e60fa851bedfd1b39a2d7b8a0f6c2669c99c9f4459fbe6390977aef177c1c797abecd83ffb447e966615d6556ac8192acf3c

data/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.0-beta.14] - 2026-06-18
+
+### Changed
+
+- **`create_cognito_validator` enables identity enrichment by default.** The
+  convenience constructor always receives the region, so
+  `validate(token, enrich_user_data: true)` now returns `payload['email']`
+  without extra setup. Pass `enable_user_identity_enrichment: false` to opt out.
+  The `configure` + `JwtValidator.new` path stays opt-in (gated on
+  `config.enable_user_identity_enrichment`), since it may run without Cognito
+  network access. Mirrors the npm package's `createCognitoValidatorAsync` default.
+
+### Fixed
+
+- **`RedisService#set` hardened against `SETEX key 0`**: `0` is truthy in Ruby, so
+  `set(key, value, 0)` would have issued `SETEX key 0` (rejected by Redis with
+  "ERR invalid expire time"). `set` now attaches an expiry only for a positive TTL;
+  a nil/non-positive ttl persists the key with a plain `SET`. Current callers were
+  unaffected (`update_last_used` passes no TTL); this prevents the footgun and
+  matches the npm package's `RedisService.set` behavior.
+
 ## [1.0.0-beta.13] - 2026-06-17
 
 ### Added

data/README.md

@@ -120,6 +120,8 @@ Estas opciones permiten control granular sobre qué características están acti
 
 Los **access tokens de Cognito NO incluyen `email`** (solo los ID tokens lo traen). Si tu backend valida el access token y necesita el email (p. ej. para trazabilidad/logging), habilita `enable_user_identity_enrichment`. La gema obtiene los atributos del usuario con `GetUser` —autorizado por el propio scope `aws.cognito.signin.user.admin` del access token, **sin credenciales AWS IAM**— y los fusiona en el `payload`.
 
+> **Con `create_cognito_validator(...)` está activado por defecto** (ese constructor siempre recibe la región): `validate(token, enrich_user_data: true)` ya trae `payload['email']`. Para desactivarlo pasa `enable_user_identity_enrichment: false`. El path `configure` + `JwtValidator.new` de abajo sí requiere el flag explícito (puede correr sin acceso de red a Cognito).
+
 ```ruby
 JwtAuthCognito.configure do |config|
   config.cognito_region = 'us-east-1'

data/lib/jwt_auth_cognito/redis_service.rb

@@ -105,7 +105,10 @@ module JwtAuthCognito
 
     def set(key, value, ttl = nil)
       connect_redis
-      if ttl
+      # Only attach an expiry for a positive TTL. A nil or non-positive ttl (note:
+      # 0 is truthy in Ruby) means a persistent key — `SETEX key 0` is rejected by
+      # Redis with "ERR invalid expire time", so fall back to a plain SET.
+      if ttl&.positive?
         @redis.setex(key, ttl, value)
       else
         @redis.set(key, value)

data/lib/jwt_auth_cognito/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JwtAuthCognito
-  VERSION = '1.0.0-beta.13'
+  VERSION = '1.0.0-beta.14'
 end

data/lib/jwt_auth_cognito.rb

@@ -42,9 +42,13 @@ module JwtAuthCognito
   end
 
   # Convenience factory method to create a Cognito validator
+  # Convenience constructor. Identity enrichment (email on access tokens) is ON
+  # by default here because the region is always provided; pass
+  # enable_user_identity_enrichment: false to opt out. (The configure +
+  # JwtValidator.new path keeps it opt-in, gated on config.enable_user_identity_enrichment.)
   def self.create_cognito_validator(region:, user_pool_id:, client_id: nil, client_secret: nil, redis_config: {},
                                     enable_api_key_validation: false, enable_user_data_retrieval: false,
-                                    enable_user_identity_enrichment: false)
+                                    enable_user_identity_enrichment: true)
     old_config = configuration.dup
 
     configure do |config|

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jwt_auth_cognito
 version: !ruby/object:Gem::Version
-  version: 1.0.0.pre.beta.13
+  version: 1.0.0.pre.beta.14
 platform: ruby
 authors:
 - The Optimal
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-06-17 00:00:00.000000000 Z
+date: 2026-06-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-cognitoidentityprovider