jwt_keeper 5.0.0 → 5.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0781e4deae7439d13aadad57e1c3fa6dd224cd791c90672ee647815af2ebf70a'
-  data.tar.gz: 9be046da200f6d6f6e17c2f747c398e7b5abe13e1fe1517a7b288d9dec468ea8
+  metadata.gz: 4ce4912150544b5d9944105ef36f43022c480578eb922d6a5f001c2044a53de6
+  data.tar.gz: 8f1ef7fa13008c88133aac5babbf8622070db55ac3ea49eb45ef515c23e1751b
 SHA512:
-  metadata.gz: a58d6573eb512abce406c8726a15eebac3136d5c05b5305c9b5cd8d040f2facd6c050071d86a8bb885523485ea6217b2596f6bc14771d0e5d0c878278b0bdd66
-  data.tar.gz: 6a1086f9933a1daf4fc48e2ea7af4c2fe8c7b26c248a84f096cde00e9e2af3302258a894cdcb88211a281756a2b847713d6a6bd87233b66d1ca10fe64b3b6459
+  metadata.gz: df62c535a49f323772ee6b7fe995ada5a1906c1ac3d80916949a30c7030c058eea47105368edc97351c1853bdf11cf6f561452e21d71d2d79f32246964acf3b5
+  data.tar.gz: b03abb09f142d3d5b27706b9792be412ea8c5698b4c7c385a343f15cd147cf9b71202c32b24b7dbbd892a9ac054be6918b9562498f7f8a347d30d054d54ddc19

data/lib/jwt_keeper/configuration.rb

@@ -4,8 +4,8 @@ module JWTKeeper
       algorithm:       'HS512',
       secret:           nil,
       expiry:           24.hours,
-      issuer:           'api.example.com',
-      audience:         'example.com',
+      issuer:           nil,
+      audience:         nil,
       redis_connection: nil,
       version:          nil,
       cookie_lock:      false,

data/lib/jwt_keeper/token.rb

@@ -36,11 +36,11 @@ module JWTKeeper
     # @param raw_token [String] the raw token
     # @param cookie_secret [String] the cookie secret
     # @return [Token] token object
-    def self.find(raw_token, secret: nil, cookie_secret: nil)
-      claims = decode(raw_token, secret: secret, cookie_secret: cookie_secret)
+    def self.find(raw_token, secret: nil, cookie_secret: nil, iss: nil)
+      claims = decode(raw_token, secret: secret, cookie_secret: cookie_secret, iss: iss)
       return nil if claims.nil?
 
-      new_token = new(secret: secret, cookie_secret: cookie_secret)
+      new_token = new(secret: secret, cookie_secret: cookie_secret, iss: iss)
       new_token.claims = claims
 
       return nil if new_token.revoked?
@@ -73,6 +73,7 @@ module JWTKeeper
     # @param new_claims [Hash] Used to override and update claims during rotation
     # @return [Token]
     def rotate(new_claims = nil)
+      return self if claims[:iss] != JWTKeeper.configuration.issuer
       revoke
 
       new_claims ||= claims.except(:iss, :aud, :exp, :nbf, :iat, :jti)
@@ -141,8 +142,9 @@ module JWTKeeper
     end
 
     # @!visibility private
-    def self.decode(raw_token, secret: nil, cookie_secret: nil)
+    def self.decode(raw_token, secret: nil, cookie_secret: nil, iss: nil)
       secret ||= JWTKeeper.configuration.secret
+      iss ||= JWTKeeper.configuration.issuer
 
       JWT.decode(raw_token, secret.to_s + cookie_secret.to_s, true,
                  algorithm: JWTKeeper.configuration.algorithm,
@@ -152,7 +154,7 @@ module JWTKeeper
                  verify_sub: false,
                  verify_jti: false,
                  leeway: 0,
-                 iss: JWTKeeper.configuration.issuer,
+                 iss: iss,
                  aud: JWTKeeper.configuration.audience
                 ).first.symbolize_keys
 

data/lib/jwt_keeper/version.rb

@@ -1,4 +1,4 @@
 # Gem Version
 module JWTKeeper
-  VERSION = '5.0.0'.freeze
+  VERSION = '5.0.1'.freeze
 end

data/spec/lib/jwt_keeper/token_spec.rb

@@ -33,6 +33,16 @@ module JWTKeeper
         it { is_expected.to be_instance_of described_class }
         it { expect(subject.claims[:claim]).to eql private_claims[:claim] }
       end
+
+      context 'when overriding default issuer' do
+        subject { described_class.create(**private_claims, iss: issuer) }
+
+        let(:issuer) { 'ISSUER' }
+
+        it { is_expected.to be_instance_of described_class }
+        it { expect(subject.claims[:claim]).to eql private_claims[:claim] }
+        it { expect(subject.claims[:iss]).to eql issuer }
+      end
     end
 
     describe '.find' do
@@ -79,6 +89,23 @@ module JWTKeeper
         it { is_expected.to be_instance_of described_class }
         it { expect(subject.claims[:claim]).to eql private_claims[:claim] }
       end
+
+      context 'when overriding default issuer' do
+        subject { described_class.find(raw_token, iss: issuer) }
+
+        let(:token) { described_class.create(**private_claims, iss: issuer) }
+        let(:issuer) { 'ISSUER' }
+
+        it { is_expected.to be_instance_of described_class }
+        it { expect(subject.claims[:claim]).to eql private_claims[:claim] }
+        it { expect(subject.claims[:iss]).to eql issuer }
+
+        context 'with an issuer mismatch' do
+          subject { described_class.find(raw_token) }
+
+          it { is_expected.to be nil }
+        end
+      end
     end
 
     describe '.rotate' do
@@ -200,6 +227,13 @@ module JWTKeeper
       it { expect(new_token).to be_valid }
       it { expect(old_token.claims[:claim]).to eq new_token.claims[:claim] }
       it { expect(old_token.cookie_secret).not_to eq new_token.cookie_secret }
+
+      context 'with a foreign issued token' do
+        let(:old_token) { described_class.create(**private_claims, iss: 'ISSUER') }
+        let(:new_token) { old_token.rotate }
+
+        it { expect(old_token).to eq new_token }
+      end
     end
 
     describe '#valid?' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jwt_keeper
 version: !ruby/object:Gem::Version
-  version: 5.0.0
+  version: 5.0.1
 platform: ruby
 authors:
 - David Rivera
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-02-28 00:00:00.000000000 Z
+date: 2021-03-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler