jwt_sessions 2.2.1 → 2.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 7b04e83f8dac3d2546364665988101a1a1fd6193
-  data.tar.gz: 9a84c2705ec41817a6ed79a5bdface8f5da48dba
+  metadata.gz: b7c7b8333b5fc365bfefa54f8ca7681f11d869e6
+  data.tar.gz: 24d2abe310c66c6a8752b9540edb589706d13d91
 SHA512:
-  metadata.gz: fc621aa40e3c9f4b5807655ee4198f8881cdb00814d32fa159fbf815f1061c47190456316606b67e4c4743b13a2c74a7fb1b1bea99219f8b4207beb693f263a2
-  data.tar.gz: c1bfcd3b9198dbdc641aa71dffaa8d0f9a1866dcb3ed800e690b967466a6f0d509daece7a3f58f45104d763aa4a7aafad0cb136608f91659f4d13db2fa64fc9a
+  metadata.gz: 8d2ddc5d2b470ad74d450ba96259bb3c22ffe5ad442455d6f0ceef95afd929cbbe9bf79439323ca03e74557520f5c360465eba6ee5c3c808efa37ba25a75061b
+  data.tar.gz: 9bd0aa2b726c9d23f503e8c9983b5ac163874f184fbeadedce870bf5b8c36fb68e985d7c8766cb87d992fb911243774d64312d942426dbf60637a49a1b701ec0

data/lib/jwt_sessions/session.rb

@@ -52,14 +52,17 @@ module JWTSessions
 
     def refresh_by_access_payload(&block)
       raise Errors::InvalidPayload if payload.nil?
-      ruid = retrive_ruid_from(payload)
+      ruid = retrieve_val_from(payload, :access, 'ruid', 'refresh uid')
       retrieve_refresh_token(ruid)
+
+      check_access_uid_within_refresh_token(&block) if block_given?
+
       refresh_by_uid(&block)
     end
 
     def flush_by_access_payload
       raise Errors::InvalidPayload if payload.nil?
-      ruid = retrive_ruid_from(payload)
+      ruid = retrieve_val_from(payload, :access, 'ruid', 'refresh uid')
       flush_by_uid(ruid)
     end
 
@@ -83,6 +86,8 @@ module JWTSessions
       tokens = RefreshToken.all(namespace, store)
       tokens.each do |token|
         AccessToken.destroy(token.access_uid, store)
+        # unlink refresh token from the current access token
+        token.update(nil, nil, token.csrf)
       end.count
     end
 
@@ -104,12 +109,9 @@ module JWTSessions
     end
 
     def valid_access_request?(external_csrf_token, external_payload)
-      ruid = external_payload.fetch('ruid', nil)
-      uid  = external_payload.fetch('uid', nil)
-      if ruid.nil? || uid.nil?
-        message = 'Token payload is invalid'
-        raise Errors::InvalidPayload, message
-      end
+      ruid = retrieve_val_from(external_payload, :access, 'ruid', 'refresh uid')
+      uid  = retrieve_val_from(external_payload, :access, 'uid', 'access uid')
+
       refresh_token = RefreshToken.find(ruid, JWTSessions.token_store)
       return false unless uid == refresh_token.access_uid
 
@@ -164,13 +166,13 @@ module JWTSessions
       uid
     end
 
-    def retrive_ruid_from(token_payload)
-      ruid = token_payload.fetch('ruid', nil)
-      if ruid.nil?
-        message = "Access token payload does not contain refresh uid"
+    def retrieve_val_from(token_payload, type, val_key, val_name)
+      val = token_payload.fetch(val_key, nil)
+      if val.nil?
+        message = "#{type.to_s.capitalize} token payload does not contain #{val_name}"
         raise Errors::InvalidPayload, message
       end
-      ruid
+      val
     end
 
     def retrieve_refresh_token(uid)
@@ -197,9 +199,17 @@ module JWTSessions
 
     def check_refresh_on_time
       expiration = @_refresh.access_expiration
+      return if expiration.size.zero?
       yield @_refresh.uid, expiration if expiration.to_i > Time.now.to_i
     end
 
+    def check_access_uid_within_refresh_token
+      uid = retrieve_val_from(payload, :access, 'uid', 'access uid')
+      access_uid = @_refresh.access_uid
+      return if access_uid.size.zero?
+      yield @_refresh.uid, @_refresh.access_expiration if access_uid != uid
+    end
+
     def issue_tokens_after_refresh
       create_csrf_token
       create_access_token

data/lib/jwt_sessions/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JWTSessions
-  VERSION = '2.2.1'
+  VERSION = '2.2.2'
 end

data/test/units/jwt_sessions/test_session.rb

@@ -84,6 +84,74 @@ class TestSession < Minitest::Test
     end
   end
 
+  def test_refresh_by_access_payload_invalid_uid
+    session = JWTSessions::Session.new(payload: payload, refresh_by_access_allowed: true)
+    session.login
+    access1 = session.instance_variable_get('@_access')
+    # should execute the code block for the cases when access UID within the refresh token
+    # does not match access UID from the session payload
+    session2 = JWTSessions::Session.new(payload: access1.payload, refresh_by_access_allowed: true)
+    assert_raises JWTSessions::Errors::Unauthorized do
+      session2.refresh_by_access_payload do
+        raise JWTSessions::Errors::Unauthorized
+      end
+    end
+  end
+
+  def test_refresh_by_access_payload_invalid_uid_with_multiple_refreshes
+    JWTSessions.access_exp_time = 0
+    session = JWTSessions::Session.new(payload: payload, refresh_by_access_allowed: true)
+    session.login
+    sleep(1)
+    JWTSessions.access_exp_time = 3600
+    session.refresh_by_access_payload do
+      raise JWTSessions::Errors::Unauthorized
+    end
+    assert_raises JWTSessions::Errors::Unauthorized do
+      session.refresh_by_access_payload do
+        raise JWTSessions::Errors::Unauthorized
+      end
+    end
+  end
+
+  def test_refresh_by_access_payload_invalid_uid_outdated_access_token
+    JWTSessions.access_exp_time = 0
+    session = JWTSessions::Session.new(payload: payload, refresh_by_access_allowed: true)
+    original_tokens  = session.login
+    session.refresh_by_access_payload do
+      raise JWTSessions::Errors::Unauthorized
+    end
+    decoded_access = JWTSessions::Token.decode!(original_tokens[:access]).first
+    session2 = JWTSessions::Session.new(payload: decoded_access, refresh_by_access_allowed: true)
+    JWTSessions.access_exp_time = 3600
+    assert_raises JWTSessions::Errors::Unauthorized do
+      session2.refresh_by_access_payload do
+        raise JWTSessions::Errors::Unauthorized
+      end
+    end
+  end
+
+  def test_refresh_by_access_payload_with_valid_uid
+    JWTSessions.access_exp_time = 0
+    session = JWTSessions::Session.new(payload: payload, refresh_by_access_allowed: true)
+    session.login
+    refreshed_tokens = session.refresh_by_access_payload do
+      raise JWTSessions::Errors::Unauthorized
+    end
+
+    decoded_access = JWTSessions::Token.decode!(refreshed_tokens[:access]).first
+    session2 = JWTSessions::Session.new(payload: decoded_access, refresh_by_access_allowed: true)
+    JWTSessions.access_exp_time = 3600
+
+    session2.refresh_by_access_payload do
+      raise JWTSessions::Errors::Unauthorized
+    end
+
+    assert_equal REFRESH_KEYS, refreshed_tokens.keys.sort
+    assert_equal payload[:test], decoded_access['test']
+    assert_equal session.instance_variable_get('@_refresh').uid, decoded_access['ruid']
+  end
+
   def test_refresh_with_block_not_expired
     assert_raises JWTSessions::Errors::Unauthorized do
       session.refresh(tokens[:refresh]) do
@@ -186,6 +254,31 @@ class TestSession < Minitest::Test
     assert_equal ruid, JWTSessions::RefreshToken.find(ruid, JWTSessions.token_store, namespace).uid
   end
 
+  def test_refresh_after_flush_namespaced_access_tokens
+    namespace = 'test_namespace'
+    session = JWTSessions::Session.new(payload: payload, namespace: namespace, refresh_by_access_allowed: true)
+    session.login
+
+    session.flush_namespaced_access_tokens
+    ruid = session.instance_variable_get(:"@_refresh").uid
+    refresh_token = JWTSessions::RefreshToken.find(ruid, JWTSessions.token_store, nil)
+    assert_equal '', refresh_token.access_uid
+    assert_equal '', refresh_token.access_expiration
+
+    # allows to refresh with un-expired but flushed access token payload
+    session.refresh_by_access_payload do
+      raise JWTSessions::Errors::Unauthorized
+    end
+    auid = session.instance_variable_get(:"@_access").uid
+    access_token = JWTSessions::AccessToken.find(auid, JWTSessions.token_store)
+    refresh_token = JWTSessions::RefreshToken.find(ruid, JWTSessions.token_store, nil)
+
+    assert_equal false, access_token.uid.size.zero?
+    assert_equal false, access_token.expiration.size.zero?
+    assert_equal access_token.uid.to_s, refresh_token.access_uid
+    assert_equal access_token.expiration.to_s, refresh_token.access_expiration
+  end
+
   def test_flush_all
     refresh_token = @session.instance_variable_get(:"@_refresh")
     flushed_count = JWTSessions::Session.flush_all

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jwt_sessions
 version: !ruby/object:Gem::Version
-  version: 2.2.1
+  version: 2.2.2
 platform: ruby
 authors:
 - Yulia Oletskaya
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-08-27 00:00:00.000000000 Z
+date: 2018-10-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt