jwt_sessions 3.2.3 → 3.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 022c03bac5aaaf4a0f238345ce73277b027edf1df4f634a1f3ccfe804c57ad32
-  data.tar.gz: '0082926879d500097e41b7c796ef082ca8ef5d8a1a6aae6a6ea99a18c636bae0'
+  metadata.gz: a1d64a93985f3ada50556e0d6b411b4452e8496363c99e72429ad44adf48bdf8
+  data.tar.gz: d8d8c55c021199059141fd392478c8c65896fec65df88ebbeab16d1d48035b9d
 SHA512:
-  metadata.gz: c334bcf7670a89711fad701bcc6f2a3ce46d8273e2ea8c516cc680a153978901cf395a788596a1f5becf54675ae1552eb3d553cfa1e58174f162cc6ae362c673
-  data.tar.gz: 76593854f622fac7c417b9857040de0afa9881bdad19650d08921736b4679801ec696dbe3eb2331a30986a2fac5f02033678f4bf9bc6c68492625a8d2e58b403
+  metadata.gz: ccabd8a853a29a58b95c6ad66b8ed3d77437bc4c3ab4c107c935659639b0995e2f3463cbc1c66df1ad1f773d041148c66ff86cbc1276535998281d8e065783b4
+  data.tar.gz: 12d1e412ff49d36585c059447bffda9349ac7fdbb73bb5a6346207d5e75c3ec579830106a3d1255874b0debe3321d474359c41aa47fa5fac87fd6c34ec3babd2

data/CHANGELOG.md

@@ -1,3 +1,20 @@
+## 3.3.0 (October 13, 2026)
+
+Fixes:
+
+ - do not restore a flushed refresh token during a refresh; a refresh racing a flush now raises `Unauthorized`
+
+Support:
+
+ - `update_refresh` of a store adapter returns `false` when the refresh token no longer exists
+ - test against Ruby 4.0 and Rails 8.0 / 8.1
+
+## 3.2.4 (Septemper 21, 2024)
+
+Support:
+
+ - always pass token claims when verifying session
+
 ## 3.2.3 (Septemper 18, 2024)
 
 Support:

data/lib/jwt_sessions/authorization.rb

@@ -79,11 +79,11 @@ module JWTSessions
     end
 
     def valid_csrf_token?(csrf_token, token_type)
-      JWTSessions::Session.new.valid_csrf?(found_token, csrf_token, token_type)
+      JWTSessions::Session.new(session_claims).valid_csrf?(found_token, csrf_token, token_type)
     end
 
     def session_exists?(token_type)
-      JWTSessions::Session.new.session_exists?(found_token, token_type)
+      JWTSessions::Session.new(session_claims).session_exists?(found_token, token_type)
     end
 
     def cookieless_auth(token_type)
@@ -150,5 +150,13 @@ module JWTSessions
       invalid_authorization unless session_exists?(token_type)
       check_csrf(token_type)
     end
+
+    def session_claims
+      claims = respond_to?(:token_claims) ? token_claims : {}
+      {
+        access_claims: claims,
+        refresh_claims: claims
+      }
+    end
   end
 end

data/lib/jwt_sessions/session.rb

@@ -221,7 +221,12 @@ module JWTSessions
     end
 
     def update_refresh_token
-      @_refresh.update(@_access.uid, @_access.expiration, @_csrf.encoded)
+      updated = @_refresh.update(@_access.uid, @_access.expiration, @_csrf.encoded)
+      if updated == false
+        AccessToken.destroy(@_access.uid, store)
+        raise Errors::Unauthorized, "Refresh token not found"
+      end
+
       @refresh_token = @_refresh.token
       link_access_to_refresh
     end

data/lib/jwt_sessions/store_adapters/abstract_store_adapter.rb

@@ -20,6 +20,8 @@ module JWTSessions
         raise NotImplementedError
       end
 
+      # Return false when the refresh token no longer exists. A refresh then
+      # fails instead of writing back a token that a flush has just removed.
       def update_refresh(_uid:, _access_expiration:, _access_uid:, _csrf:, _namespace:)
         raise NotImplementedError
       end

data/lib/jwt_sessions/store_adapters/memory_store_adapter.rb

@@ -46,6 +46,8 @@ module JWTSessions
       end
 
       def update_refresh(uid:, access_expiration:, access_uid:, csrf:, namespace: "")
+        return false if value_if_not_expired(uid, "refresh", namespace.to_s).empty?
+
         update_refresh_fields(
           uid,
           namespace.to_s,
@@ -53,6 +55,7 @@ module JWTSessions
           access_expiration: access_expiration,
           access_uid: access_uid
         )
+        true
       end
 
       def all_refresh_tokens(namespace)

data/lib/jwt_sessions/store_adapters/redis_store_adapter.rb

@@ -7,6 +7,15 @@ module JWTSessions
 
       REFRESH_KEYS = %i[csrf access_uid access_expiration expiration].freeze
       DEFAULT_POOL_SIZE = 5
+      # Updates a refresh token only while it exists, so that a refresh which
+      # races a flush cannot write the flushed token back.
+      UPDATE_REFRESH_SCRIPT = <<~LUA
+        if redis.call("EXISTS", KEYS[1]) == 0 then
+          return 0
+        end
+        redis.call("HMSET", KEYS[1], "csrf", ARGV[1], "access_expiration", ARGV[2], "access_uid", ARGV[3])
+        return 1
+      LUA
 
       def initialize(token_prefix: JWTSessions.token_prefix, redis_client: nil, **options)
         @prefix = token_prefix
@@ -51,24 +60,27 @@ module JWTSessions
 
       def persist_refresh(uid:, access_expiration:, access_uid:, csrf:, expiration:, namespace: nil)
         key = full_refresh_key(uid, namespace)
-        update_refresh(
-          uid: uid,
-          access_expiration: access_expiration,
-          access_uid: access_uid,
-          csrf: csrf,
-          namespace: namespace
+        storage.call("HMSET",
+          key,
+          :csrf, csrf,
+          :access_expiration, access_expiration,
+          :access_uid, access_uid,
+          :expiration, expiration
         )
-        storage.call("HSET", key, :expiration, expiration)
         storage.call("EXPIREAT", key, expiration)
       end
 
       def update_refresh(uid:, access_expiration:, access_uid:, csrf:, namespace: nil)
-        storage.call("HMSET",
+        updated = storage.call(
+          "EVAL",
+          UPDATE_REFRESH_SCRIPT,
+          1,
           full_refresh_key(uid, namespace),
-          :csrf, csrf,
-          :access_expiration, access_expiration,
-          :access_uid, access_uid
+          csrf,
+          access_expiration,
+          access_uid
         )
+        updated == 1
       end
 
       def all_refresh_tokens(namespace)

data/lib/jwt_sessions/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JWTSessions
-  VERSION = "3.2.3"
+  VERSION = "3.3.0"
 end

data/test/units/jwt_sessions/store_adapters/test_memory_store_adapter.rb

@@ -60,7 +60,7 @@ class TestMemoryStoreAdapter < Minitest::Test
       expiration: expiration,
       namespace: ""
     )
-    store.update_refresh(
+    assert store.update_refresh(
       uid: "uid",
       access_expiration: expiration,
       access_uid: "access_uid",
@@ -71,6 +71,28 @@ class TestMemoryStoreAdapter < Minitest::Test
     assert_equal "csrf2", refresh[:csrf]
   end
 
+  def test_update_refresh_after_destroy
+    expiration = Time.now.to_i + 3600
+    store.persist_refresh(
+      uid: "uid",
+      access_expiration: expiration,
+      access_uid: "access_uid",
+      csrf: "csrf",
+      expiration: expiration,
+      namespace: ""
+    )
+    store.destroy_refresh("uid", "")
+
+    refute store.update_refresh(
+      uid: "uid",
+      access_expiration: expiration,
+      access_uid: "access_uid",
+      csrf: "csrf2",
+      namespace: ""
+    )
+    assert_equal({}, store.fetch_refresh("uid", ""))
+  end
+
   def test_all_refresh_tokens
     expiration = Time.now.to_i + 3600
     store.persist_refresh(

data/test/units/jwt_sessions/store_adapters/test_redis_store_adapter.rb

@@ -11,6 +11,55 @@ class TestRedisStoreAdapter < Minitest::Test
     JWTSessions.remove_instance_variable(:@redis_url) if JWTSessions.instance_variable_defined?(:@redis_url)
   end
 
+  def test_update_refresh
+    store = JWTSessions::StoreAdapters::RedisStoreAdapter.new
+    expiration = Time.now.to_i + 3600
+    store.persist_refresh(
+      uid: "uid",
+      access_expiration: expiration,
+      access_uid: "access_uid",
+      csrf: "csrf",
+      expiration: expiration,
+      namespace: "update_refresh"
+    )
+
+    assert store.update_refresh(
+      uid: "uid",
+      access_expiration: expiration,
+      access_uid: "access_uid",
+      csrf: "csrf2",
+      namespace: "update_refresh"
+    )
+    assert_equal "csrf2", store.fetch_refresh("uid", "update_refresh")[:csrf]
+  ensure
+    store.destroy_refresh("uid", "update_refresh")
+  end
+
+  def test_update_refresh_after_destroy
+    store = JWTSessions::StoreAdapters::RedisStoreAdapter.new
+    expiration = Time.now.to_i + 3600
+    store.persist_refresh(
+      uid: "uid",
+      access_expiration: expiration,
+      access_uid: "access_uid",
+      csrf: "csrf",
+      expiration: expiration,
+      namespace: "update_refresh_after_destroy"
+    )
+    store.destroy_refresh("uid", "update_refresh_after_destroy")
+
+    refute store.update_refresh(
+      uid: "uid",
+      access_expiration: expiration,
+      access_uid: "access_uid",
+      csrf: "csrf2",
+      namespace: "update_refresh_after_destroy"
+    )
+    assert_empty store.storage.call("KEYS", "#{store.prefix}_update_refresh_after_destroy_*")
+  ensure
+    store.destroy_refresh("uid", "update_refresh_after_destroy")
+  end
+
   def test_error_on_mixed_redis_options
     assert_raises ArgumentError do
       JWTSessions::StoreAdapters::RedisStoreAdapter.new(

data/test/units/jwt_sessions/test_authorization.rb

@@ -6,10 +6,24 @@ require "jwt_sessions"
 class TestAuthorization < Minitest::Test
   include JWTSessions::Authorization
 
+  def token_claims
+    {
+      iss: "issuer",
+      aud: "audience",
+    }
+  end
+
   def setup
     JWTSessions.signing_key = "abcdefghijklmnopqrstuvwxyzABCDEF"
   end
 
+  def teardown
+    JWTSessions.jwt_options[:verify_iss] = false
+    JWTSessions.jwt_options[:verify_aud] = false
+
+    JWTSessions::Session.flush_all
+  end
+
   def test_payload_when_token_is_nil
     @_raw_token = nil
 
@@ -23,4 +37,94 @@ class TestAuthorization < Minitest::Test
     assert_equal payload['user_id'], 1
     assert_equal payload['secret'], 'mystery'
   end
+
+  def test_verify_iss
+    JWTSessions.jwt_options[:verify_iss] = true
+
+    session = JWTSessions::Session.new(payload: { user_id: 1, iss: "issuer" })
+    tokens = session.login
+
+    # Extract uid from access token
+    uid = JWT.decode(tokens[:access], JWTSessions.public_key).first["uid"]
+
+    @_raw_token =
+      JWTSessions::Token.encode({ user_id: 1, uid: uid, iss: "issuer" })
+
+    assert session_exists?(:access)
+  end
+
+  def test_verify_iss_when_iss_is_not_correct
+    JWTSessions.jwt_options[:verify_iss] = true
+
+    session = JWTSessions::Session.new(payload: { user_id: 1, iss: "issuer" })
+    tokens = session.login
+
+    # Extract uid from access token
+    uid = JWT.decode(tokens[:access], JWTSessions.public_key).first["uid"]
+
+    @_raw_token =
+      JWTSessions::Token.encode({ user_id: 1, uid: uid, iss: "another_issuer" })
+
+    assert !session_exists?(:access)
+  end
+
+  def test_verify_iss_when_iss_is_not_present
+    JWTSessions.jwt_options[:verify_iss] = true
+
+    session = JWTSessions::Session.new(payload: { user_id: 1, iss: "issuer" })
+    tokens = session.login
+
+    # Extract uid from access token
+    uid = JWT.decode(tokens[:access], JWTSessions.public_key).first["uid"]
+
+    @_raw_token =
+      JWTSessions::Token.encode({ user_id: 1, uid: uid })
+
+    assert !session_exists?(:access)
+  end
+
+  def test_verify_aud
+    JWTSessions.jwt_options[:verify_aud] = true
+
+    session = JWTSessions::Session.new(payload: { user_id: 1, aud: "audience" })
+    tokens = session.login
+
+    # Extract uid from access token
+    uid = JWT.decode(tokens[:access], JWTSessions.public_key).first["uid"]
+
+    @_raw_token =
+      JWTSessions::Token.encode({ user_id: 1, uid: uid, aud: "audience" })
+
+    assert session_exists?(:access)
+  end
+
+  def test_verify_aud_when_aud_is_not_correct
+    JWTSessions.jwt_options[:verify_aud] = true
+
+    session = JWTSessions::Session.new(payload: { user_id: 1, aud: "audience" })
+    tokens = session.login
+
+    # Extract uid from access token
+    uid = JWT.decode(tokens[:access], JWTSessions.public_key).first["uid"]
+
+    @_raw_token =
+      JWTSessions::Token.encode({ user_id: 1, uid: uid, aud: "another_audience" })
+
+    assert !session_exists?(:access)
+  end
+
+  def test_verify_aud_when_aud_is_not_present
+    JWTSessions.jwt_options[:verify_aud] = true
+
+    session = JWTSessions::Session.new(payload: { user_id: 1, aud: "audience" })
+    tokens = session.login
+
+    # Extract uid from access token
+    uid = JWT.decode(tokens[:access], JWTSessions.public_key).first["uid"]
+
+    @_raw_token =
+      JWTSessions::Token.encode({ user_id: 1, uid: uid })
+
+    assert !session_exists?(:access)
+  end
 end

data/test/units/jwt_sessions/test_refresh_token.rb

@@ -7,9 +7,9 @@ class TestRefreshToken < Minitest::Test
    attr_reader :csrf, :token, :access_uid
 
   def setup
+    JWTSessions.signing_key = "secure key"
     JWTSessions::Session.flush_all
 
-    JWTSessions.signing_key = "secure key"
     @access_uid = SecureRandom.uuid
     @csrf = JWTSessions::CSRFToken.new
     @token = JWTSessions::RefreshToken.create(@csrf.encoded,

data/test/units/jwt_sessions/test_session.rb

@@ -336,6 +336,21 @@ class TestSession < Minitest::Test
     assert_equal 0, session.flush_namespaced_access_tokens
   end
 
+  def test_refresh_after_concurrent_flush
+    refresh_token = tokens[:refresh]
+    racing_store = JWTSessions.token_store.dup
+    racing_store.define_singleton_method(:update_refresh) do |**fields|
+      JWTSessions::Session.new.flush_by_token(refresh_token)
+      super(**fields)
+    end
+    racing_session = JWTSessions::Session.new(payload: payload, store: racing_store)
+
+    assert_raises JWTSessions::Errors::Unauthorized do
+      racing_session.refresh(refresh_token)
+    end
+    assert_empty RedisClient.new.call("KEYS", "jwt_*")
+  end
+
   def test_flush_all
     refresh_token = @session.instance_variable_get(:"@_refresh")
     flushed_count = JWTSessions::Session.flush_all

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: jwt_sessions
 version: !ruby/object:Gem::Version
-  version: 3.2.3
+  version: 3.3.0
 platform: ruby
 authors:
 - Julija Alieckaja
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-09-18 00:00:00.000000000 Z
+date: 2026-10-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt
@@ -113,7 +112,6 @@ metadata:
   changelog_uri: https://github.com/tuwukee/jwt_sessions/blob/master/CHANGELOG.md
   source_code_uri: https://github.com/tuwukee/jwt_sessions
   bug_tracker_uri: https://github.com/tuwukee/jwt_sessions/issues
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -128,13 +126,10 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.12
-signing_key:
+rubygems_version: 4.0.3
 specification_version: 4
 summary: JWT Sessions
 test_files:
-- test/units/test_jwt_sessions.rb
-- test/units/test_token_store.rb
 - test/units/jwt_sessions/store_adapters/test_memory_store_adapter.rb
 - test/units/jwt_sessions/store_adapters/test_redis_store_adapter.rb
 - test/units/jwt_sessions/test_access_token.rb
@@ -143,3 +138,5 @@ test_files:
 - test/units/jwt_sessions/test_refresh_token.rb
 - test/units/jwt_sessions/test_session.rb
 - test/units/jwt_sessions/test_token.rb
+- test/units/test_jwt_sessions.rb
+- test/units/test_token_store.rb