jwt_sessions 2.6.0 → 2.7.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8a485796c7aa19c00c79992111ed0135c0ec93af6e88aff80b233be779bb2301
-  data.tar.gz: d0b89a924589aa8450cfcaefb2061674db4d61cb32ed5ace92f1cab021db1fb1
+  metadata.gz: ed69732617f15f4c07c0fb37d3ad938807224b729f136d24755a90f58b7b28ab
+  data.tar.gz: 27bee3f1c2bd4b099b0dadea703143d70e6abf1aaa6e5556f67515dfbc6f2e5b
 SHA512:
-  metadata.gz: e0bef3934719502d51f1299b210fad2df87360ef91cc3471384c3840870f3d548f43c5c5c1ff89a33e9e8847b706f9b7e1d2c240f288a21a16533369d8b0fce5
-  data.tar.gz: cd8b450b1a09e13290e3ac6ec5bcd17cf52c7314f01044ca1c2888321816585ff27eb7ae7b3935f5aa388fec3c11d9b8ebb0fe2c5fdde5a99cbc390932c4a646
+  metadata.gz: a0a81d8d8013a1393b441ddd15ec34fb57ceb0bd3198f9ee4a2554dff653efbe4379ad6992d1a8678895e0391f45626068a2f16b422ad8c658b7a086a08241d3
+  data.tar.gz: 46e744a4512da3d90b54f6552c42f35c7b3b3d25a9d73292058ac5782102ed9d9c77ac6a734a865b40e2fcccd675257cc5c41d27be45bd5fde758e8d6c97537f

data/CHANGELOG.md

@@ -1,3 +1,31 @@
+## 2.7.3 (August 26, 2022)
+
+Bugfixes:
+
+- compatibility with jwt 2.5
+
+Support:
+
+- add rspec to development deps
+
+## 2.7.2 (January 24, 2022)
+
+Bugfixes:
+
+- 2.7.1 version didn't include the correct patch
+
+## 2.7.1 (January 22, 2022)
+
+Bugfixes:
+
+- Correctly init namespaced refresh tokens when fetching all tokens from Redis
+
+## 2.7.0 (October 05, 2021)
+
+Features:
+
+- added redis_client setting to JWTSessions::StoreAdapters::RedisStoreAdapter
+
 ## 2.6.0 (June 01, 2021)
 
 Features:

data/README.md

@@ -153,11 +153,11 @@ end
 ```
 
 Specify an encryption key for JSON Web Tokens in `config/initializers/jwt_session.rb` \
-It is advisable to store the key itself within the app secrets.
+It is advisable to store the key itself in a secure way, f.e. within app credentials.
 
 ```ruby
 JWTSessions.algorithm = "HS256"
-JWTSessions.encryption_key = Rails.application.secrets.secret_jwt_encryption_key
+JWTSessions.encryption_key = Rails.application.credentials.secret_jwt_encryption_key
 ```
 
 Most of the encryption algorithms require private and public keys to sign a token. However, HMAC requires only a single key and you can use the `encryption_key` shortcut to sign the token. For other algorithms you must specify private and public keys separately.
@@ -378,6 +378,12 @@ JWTSessions.token_store = :redis, {
 }
 ```
 
+If you already have a configured Redis client, you can pass it among the options to reduce opened connections to a Redis server:
+
+```ruby
+JWTSessions.token_store = :redis, {redis_client: Redis.current}
+```
+
 ##### JWT signature
 
 ```ruby

data/lib/jwt_sessions/refresh_token.rb

@@ -61,7 +61,7 @@ module JWTSessions
           token_attrs[:access_uid],
           token_attrs[:access_expiration],
           store,
-          namespace: namespace,
+          namespace: token_attrs[:namespace] || namespace,
           payload: {},
           uid: uid,
           expiration: token_attrs[:expiration]

data/lib/jwt_sessions/store_adapters/redis_store_adapter.rb

@@ -7,16 +7,20 @@ module JWTSessions
 
       REFRESH_KEYS = %i[csrf access_uid access_expiration expiration].freeze
 
-      def initialize(token_prefix: JWTSessions.token_prefix, **options)
+      def initialize(token_prefix: JWTSessions.token_prefix, redis_client: nil, **options)
         @prefix = token_prefix
 
-        begin
-          require "redis"
-          @storage = configure_redis_client(**options)
-        rescue LoadError => e
-          msg = "Could not load the 'redis' gem, please add it to your gemfile or " \
-                "configure a different adapter (e.g. JWTSessions.store_adapter = :memory)"
-          raise e.class, msg, e.backtrace
+        if redis_client
+          @storage = redis_client
+        else
+          begin
+            require "redis"
+            @storage = configure_redis_client(**options)
+          rescue LoadError => e
+            msg = "Could not load the 'redis' gem, please add it to your gemfile or " \
+                  "configure a different adapter (e.g. JWTSessions.store_adapter = :memory)"
+            raise e.class, msg, e.backtrace
+          end
         end
       end
 
@@ -36,7 +40,10 @@ module JWTSessions
         values = storage.hmget(key, *REFRESH_KEYS).compact
 
         return {} if values.length != REFRESH_KEYS.length
-        REFRESH_KEYS.each_with_index.each_with_object({}) { |(key, index), acc| acc[key] = values[index] }
+        REFRESH_KEYS
+          .each_with_index
+          .each_with_object({}) { |(key, index), acc| acc[key] = values[index] }
+          .merge({ namespace: namespace })
       end
 
       def persist_refresh(uid:, access_expiration:, access_uid:, csrf:, expiration:, namespace: nil)
@@ -65,7 +72,10 @@ module JWTSessions
         keys_in_namespace = scan_keys(refresh_key("*", namespace))
         (keys_in_namespace || []).each_with_object({}) do |key, acc|
           uid = uid_from_key(key)
-          acc[uid] = fetch_refresh(uid, namespace)
+          # to be able to properly initialize namespaced tokens extract their namespaces
+          # and pass down to fetch_refresh
+          token_namespace = namespace.to_s.empty? ? namespace_from_key(key) : namespace
+          acc[uid] = fetch_refresh(uid, token_namespace)
         end
       end
 
@@ -127,6 +137,14 @@ module JWTSessions
         key.split("_").last
       end
 
+      def namespace_from_key(key)
+        ns_regexp.match(key)&.[](:namespace)
+      end
+
+      def ns_regexp
+        @ns_regexp ||= Regexp.new("#{prefix}_(?<namespace>.+)_refresh")
+      end
+
       def scan_keys(key_pattern)
         cursor = 0
         all_keys = []

data/lib/jwt_sessions/token.rb

@@ -13,7 +13,7 @@ module JWTSessions
       end
 
       def decode(token, claims = {})
-        decode_options = { algorithm: JWTSessions.algorithm }.merge(JWTSessions.jwt_options.to_h).merge(claims)
+        decode_options = { algorithm: JWTSessions.algorithm }.merge(JWTSessions.jwt_options).merge(claims)
         JWT.decode(token, JWTSessions.public_key, JWTSessions.validate?, decode_options)
       rescue JWT::ExpiredSignature => e
         raise Errors::Expired, e.message

data/lib/jwt_sessions/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JWTSessions
-  VERSION = "2.6.0"
+  VERSION = "2.7.3"
 end

data/lib/jwt_sessions.rb

@@ -21,8 +21,6 @@ module JWTSessions
 
   NONE = "none"
 
-  JWTOptions = Struct.new(*JWT::DefaultOptions::DEFAULT_OPTIONS.keys)
-
   DEFAULT_SETTINGS_KEYS = %i[access_cookie
                              access_exp_time
                              access_header
@@ -66,7 +64,7 @@ module JWTSessions
   end
 
   def jwt_options
-    @jwt_options ||= JWTOptions.new(*JWT::DefaultOptions::DEFAULT_OPTIONS.values)
+    @jwt_options ||= JWT::Configuration::Container.new.decode.to_h
   end
 
   def algorithm=(algo)

data/test/units/jwt_sessions/store_adapters/test_redis_store_adapter.rb

@@ -77,4 +77,10 @@ class TestRedisStoreAdapter < Minitest::Test
     adapter = JWTSessions::StoreAdapters::RedisStoreAdapter.new
     assert_equal "redis://127.0.0.2:6322/0", adapter.storage.connection[:id]
   end
+
+  def test_configuration_via_redis_client
+    client = Object.new
+    adapter = JWTSessions::StoreAdapters::RedisStoreAdapter.new(redis_client: client)
+    assert_equal client, adapter.storage
+  end
 end

data/test/units/jwt_sessions/test_token.rb

@@ -24,7 +24,7 @@ class TestToken < Minitest::Test
 
   def teardown
     JWTSessions.algorithm = JWTSessions::DEFAULT_ALGORITHM
-    JWTSessions.instance_variable_set(:"@jwt_options", JWTSessions::JWTOptions.new(*JWT::DefaultOptions::DEFAULT_OPTIONS.values))
+    JWTSessions.instance_variable_set(:"@jwt_options", JWT::Configuration::Container.new.decode.to_h)
   end
 
   def test_rsa_token_decode
@@ -73,7 +73,7 @@ class TestToken < Minitest::Test
 
   def test_token_sub_claim
     JWTSessions.encryption_key = "abcdefghijklmnopqrstuvwxyzABCDEF"
-    JWTSessions.jwt_options.verify_sub = true
+    JWTSessions.jwt_options[:verify_sub] = true
     token   = JWTSessions::Token.encode(payload.merge(sub: "subject"))
     decoded = JWTSessions::Token.decode(token, { sub: "subject" }).first
     assert_equal payload["user_id"], decoded["user_id"]
@@ -85,7 +85,7 @@ class TestToken < Minitest::Test
 
   def test_token_iss_claim
     JWTSessions.encryption_key = "abcdefghijklmnopqrstuvwxyzABCDEF"
-    JWTSessions.jwt_options.verify_iss = true
+    JWTSessions.jwt_options[:verify_iss] = true
     token   = JWTSessions::Token.encode(payload.merge(iss: "Me"))
     decoded = JWTSessions::Token.decode(token, { iss: "Me" }).first
     assert_equal payload["user_id"], decoded["user_id"]
@@ -97,7 +97,7 @@ class TestToken < Minitest::Test
 
   def test_token_aud_claim
     JWTSessions.encryption_key = "abcdefghijklmnopqrstuvwxyzABCDEF"
-    JWTSessions.jwt_options.verify_aud = true
+    JWTSessions.jwt_options[:verify_aud] = true
     token   = JWTSessions::Token.encode(payload.merge(aud: ["young", "old"]))
     decoded = JWTSessions::Token.decode(token, { aud: ["young"] }).first
     assert_equal payload["user_id"], decoded["user_id"]
@@ -109,7 +109,7 @@ class TestToken < Minitest::Test
 
   def test_token_leeway_decode
     JWTSessions.encryption_key = "abcdefghijklmnopqrstuvwxyzABCDEF"
-    JWTSessions.jwt_options.leeway = 50
+    JWTSessions.jwt_options[:leeway] = 50
     token   = JWTSessions::Token.encode(payload.merge("exp" => Time.now.to_i - 20))
     decoded = JWTSessions::Token.decode(token).first
     assert_equal payload["user_id"], decoded["user_id"]

metadata

@@ -1,22 +1,22 @@
 --- !ruby/object:Gem::Specification
 name: jwt_sessions
 version: !ruby/object:Gem::Version
-  version: 2.6.0
+  version: 2.7.3
 platform: ruby
 authors:
 - Yulia Oletskaya
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-06-01 00:00:00.000000000 Z
+date: 2022-08-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.3
+        version: '2.5'
     - - "<"
       - !ruby/object:Gem::Version
         version: '3'
@@ -24,9 +24,9 @@ dependencies:
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.2.3
+        version: '2.5'
     - - "<"
       - !ruby/object:Gem::Version
         version: '3'
@@ -58,6 +58,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '12.3'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.11'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.11'
 description: XSS/CSRF safe JWT auth designed for SPA
 email: yulia.oletskaya@gmail.com
 executables: []
@@ -113,7 +127,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.0.3.1
 signing_key: 
 specification_version: 4
 summary: JWT Sessions