jwt_sessions 3.2.4 → 3.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3d616f460afd8b13982064b340c2ea3f3e326bb99dff16ec2e159599ffa4aebd
-  data.tar.gz: baed64f2320056748d33c1f08c955e4b37cb958d6442f28ade5fa7c61656be56
+  metadata.gz: a1d64a93985f3ada50556e0d6b411b4452e8496363c99e72429ad44adf48bdf8
+  data.tar.gz: d8d8c55c021199059141fd392478c8c65896fec65df88ebbeab16d1d48035b9d
 SHA512:
-  metadata.gz: d31922314b428ab7bb82d0817b5a357b8fec1f47361d11e194f9d8c8e9e3dc9cda791c095af43c12aa7f71b06c36e3d1912b83808644a9dcd55888d19679342b
-  data.tar.gz: 3ffb8fa65a4c9d5599be7cc7d387773d2fee8a3f10c70b5c4ed1a7b30912d33400a678d69c07d469b4ce4113e021f3035b0d2e62949472cd32b707d3efded94b
+  metadata.gz: ccabd8a853a29a58b95c6ad66b8ed3d77437bc4c3ab4c107c935659639b0995e2f3463cbc1c66df1ad1f773d041148c66ff86cbc1276535998281d8e065783b4
+  data.tar.gz: 12d1e412ff49d36585c059447bffda9349ac7fdbb73bb5a6346207d5e75c3ec579830106a3d1255874b0debe3321d474359c41aa47fa5fac87fd6c34ec3babd2

data/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 3.3.0 (October 13, 2026)
+
+Fixes:
+
+ - do not restore a flushed refresh token during a refresh; a refresh racing a flush now raises `Unauthorized`
+
+Support:
+
+ - `update_refresh` of a store adapter returns `false` when the refresh token no longer exists
+ - test against Ruby 4.0 and Rails 8.0 / 8.1
+
 ## 3.2.4 (Septemper 21, 2024)
 
 Support:

data/lib/jwt_sessions/session.rb

@@ -221,7 +221,12 @@ module JWTSessions
     end
 
     def update_refresh_token
-      @_refresh.update(@_access.uid, @_access.expiration, @_csrf.encoded)
+      updated = @_refresh.update(@_access.uid, @_access.expiration, @_csrf.encoded)
+      if updated == false
+        AccessToken.destroy(@_access.uid, store)
+        raise Errors::Unauthorized, "Refresh token not found"
+      end
+
       @refresh_token = @_refresh.token
       link_access_to_refresh
     end

data/lib/jwt_sessions/store_adapters/abstract_store_adapter.rb

@@ -20,6 +20,8 @@ module JWTSessions
         raise NotImplementedError
       end
 
+      # Return false when the refresh token no longer exists. A refresh then
+      # fails instead of writing back a token that a flush has just removed.
       def update_refresh(_uid:, _access_expiration:, _access_uid:, _csrf:, _namespace:)
         raise NotImplementedError
       end

data/lib/jwt_sessions/store_adapters/memory_store_adapter.rb

@@ -46,6 +46,8 @@ module JWTSessions
       end
 
       def update_refresh(uid:, access_expiration:, access_uid:, csrf:, namespace: "")
+        return false if value_if_not_expired(uid, "refresh", namespace.to_s).empty?
+
         update_refresh_fields(
           uid,
           namespace.to_s,
@@ -53,6 +55,7 @@ module JWTSessions
           access_expiration: access_expiration,
           access_uid: access_uid
         )
+        true
       end
 
       def all_refresh_tokens(namespace)

data/lib/jwt_sessions/store_adapters/redis_store_adapter.rb

@@ -7,6 +7,15 @@ module JWTSessions
 
       REFRESH_KEYS = %i[csrf access_uid access_expiration expiration].freeze
       DEFAULT_POOL_SIZE = 5
+      # Updates a refresh token only while it exists, so that a refresh which
+      # races a flush cannot write the flushed token back.
+      UPDATE_REFRESH_SCRIPT = <<~LUA
+        if redis.call("EXISTS", KEYS[1]) == 0 then
+          return 0
+        end
+        redis.call("HMSET", KEYS[1], "csrf", ARGV[1], "access_expiration", ARGV[2], "access_uid", ARGV[3])
+        return 1
+      LUA
 
       def initialize(token_prefix: JWTSessions.token_prefix, redis_client: nil, **options)
         @prefix = token_prefix
@@ -51,24 +60,27 @@ module JWTSessions
 
       def persist_refresh(uid:, access_expiration:, access_uid:, csrf:, expiration:, namespace: nil)
         key = full_refresh_key(uid, namespace)
-        update_refresh(
-          uid: uid,
-          access_expiration: access_expiration,
-          access_uid: access_uid,
-          csrf: csrf,
-          namespace: namespace
+        storage.call("HMSET",
+          key,
+          :csrf, csrf,
+          :access_expiration, access_expiration,
+          :access_uid, access_uid,
+          :expiration, expiration
         )
-        storage.call("HSET", key, :expiration, expiration)
         storage.call("EXPIREAT", key, expiration)
       end
 
       def update_refresh(uid:, access_expiration:, access_uid:, csrf:, namespace: nil)
-        storage.call("HMSET",
+        updated = storage.call(
+          "EVAL",
+          UPDATE_REFRESH_SCRIPT,
+          1,
           full_refresh_key(uid, namespace),
-          :csrf, csrf,
-          :access_expiration, access_expiration,
-          :access_uid, access_uid
+          csrf,
+          access_expiration,
+          access_uid
         )
+        updated == 1
       end
 
       def all_refresh_tokens(namespace)

data/lib/jwt_sessions/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JWTSessions
-  VERSION = "3.2.4"
+  VERSION = "3.3.0"
 end

data/test/units/jwt_sessions/store_adapters/test_memory_store_adapter.rb

@@ -60,7 +60,7 @@ class TestMemoryStoreAdapter < Minitest::Test
       expiration: expiration,
       namespace: ""
     )
-    store.update_refresh(
+    assert store.update_refresh(
       uid: "uid",
       access_expiration: expiration,
       access_uid: "access_uid",
@@ -71,6 +71,28 @@ class TestMemoryStoreAdapter < Minitest::Test
     assert_equal "csrf2", refresh[:csrf]
   end
 
+  def test_update_refresh_after_destroy
+    expiration = Time.now.to_i + 3600
+    store.persist_refresh(
+      uid: "uid",
+      access_expiration: expiration,
+      access_uid: "access_uid",
+      csrf: "csrf",
+      expiration: expiration,
+      namespace: ""
+    )
+    store.destroy_refresh("uid", "")
+
+    refute store.update_refresh(
+      uid: "uid",
+      access_expiration: expiration,
+      access_uid: "access_uid",
+      csrf: "csrf2",
+      namespace: ""
+    )
+    assert_equal({}, store.fetch_refresh("uid", ""))
+  end
+
   def test_all_refresh_tokens
     expiration = Time.now.to_i + 3600
     store.persist_refresh(

data/test/units/jwt_sessions/store_adapters/test_redis_store_adapter.rb

@@ -11,6 +11,55 @@ class TestRedisStoreAdapter < Minitest::Test
     JWTSessions.remove_instance_variable(:@redis_url) if JWTSessions.instance_variable_defined?(:@redis_url)
   end
 
+  def test_update_refresh
+    store = JWTSessions::StoreAdapters::RedisStoreAdapter.new
+    expiration = Time.now.to_i + 3600
+    store.persist_refresh(
+      uid: "uid",
+      access_expiration: expiration,
+      access_uid: "access_uid",
+      csrf: "csrf",
+      expiration: expiration,
+      namespace: "update_refresh"
+    )
+
+    assert store.update_refresh(
+      uid: "uid",
+      access_expiration: expiration,
+      access_uid: "access_uid",
+      csrf: "csrf2",
+      namespace: "update_refresh"
+    )
+    assert_equal "csrf2", store.fetch_refresh("uid", "update_refresh")[:csrf]
+  ensure
+    store.destroy_refresh("uid", "update_refresh")
+  end
+
+  def test_update_refresh_after_destroy
+    store = JWTSessions::StoreAdapters::RedisStoreAdapter.new
+    expiration = Time.now.to_i + 3600
+    store.persist_refresh(
+      uid: "uid",
+      access_expiration: expiration,
+      access_uid: "access_uid",
+      csrf: "csrf",
+      expiration: expiration,
+      namespace: "update_refresh_after_destroy"
+    )
+    store.destroy_refresh("uid", "update_refresh_after_destroy")
+
+    refute store.update_refresh(
+      uid: "uid",
+      access_expiration: expiration,
+      access_uid: "access_uid",
+      csrf: "csrf2",
+      namespace: "update_refresh_after_destroy"
+    )
+    assert_empty store.storage.call("KEYS", "#{store.prefix}_update_refresh_after_destroy_*")
+  ensure
+    store.destroy_refresh("uid", "update_refresh_after_destroy")
+  end
+
   def test_error_on_mixed_redis_options
     assert_raises ArgumentError do
       JWTSessions::StoreAdapters::RedisStoreAdapter.new(

data/test/units/jwt_sessions/test_authorization.rb

@@ -20,6 +20,8 @@ class TestAuthorization < Minitest::Test
   def teardown
     JWTSessions.jwt_options[:verify_iss] = false
     JWTSessions.jwt_options[:verify_aud] = false
+
+    JWTSessions::Session.flush_all
   end
 
   def test_payload_when_token_is_nil

data/test/units/jwt_sessions/test_refresh_token.rb

@@ -7,9 +7,9 @@ class TestRefreshToken < Minitest::Test
    attr_reader :csrf, :token, :access_uid
 
   def setup
+    JWTSessions.signing_key = "secure key"
     JWTSessions::Session.flush_all
 
-    JWTSessions.signing_key = "secure key"
     @access_uid = SecureRandom.uuid
     @csrf = JWTSessions::CSRFToken.new
     @token = JWTSessions::RefreshToken.create(@csrf.encoded,

data/test/units/jwt_sessions/test_session.rb

@@ -336,6 +336,21 @@ class TestSession < Minitest::Test
     assert_equal 0, session.flush_namespaced_access_tokens
   end
 
+  def test_refresh_after_concurrent_flush
+    refresh_token = tokens[:refresh]
+    racing_store = JWTSessions.token_store.dup
+    racing_store.define_singleton_method(:update_refresh) do |**fields|
+      JWTSessions::Session.new.flush_by_token(refresh_token)
+      super(**fields)
+    end
+    racing_session = JWTSessions::Session.new(payload: payload, store: racing_store)
+
+    assert_raises JWTSessions::Errors::Unauthorized do
+      racing_session.refresh(refresh_token)
+    end
+    assert_empty RedisClient.new.call("KEYS", "jwt_*")
+  end
+
   def test_flush_all
     refresh_token = @session.instance_variable_get(:"@_refresh")
     flushed_count = JWTSessions::Session.flush_all

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: jwt_sessions
 version: !ruby/object:Gem::Version
-  version: 3.2.4
+  version: 3.3.0
 platform: ruby
 authors:
 - Julija Alieckaja
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-09-21 00:00:00.000000000 Z
+date: 2026-10-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt
@@ -113,7 +112,6 @@ metadata:
   changelog_uri: https://github.com/tuwukee/jwt_sessions/blob/master/CHANGELOG.md
   source_code_uri: https://github.com/tuwukee/jwt_sessions
   bug_tracker_uri: https://github.com/tuwukee/jwt_sessions/issues
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -128,13 +126,10 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.12
-signing_key:
+rubygems_version: 4.0.3
 specification_version: 4
 summary: JWT Sessions
 test_files:
-- test/units/test_jwt_sessions.rb
-- test/units/test_token_store.rb
 - test/units/jwt_sessions/store_adapters/test_memory_store_adapter.rb
 - test/units/jwt_sessions/store_adapters/test_redis_store_adapter.rb
 - test/units/jwt_sessions/test_access_token.rb
@@ -143,3 +138,5 @@ test_files:
 - test/units/jwt_sessions/test_refresh_token.rb
 - test/units/jwt_sessions/test_session.rb
 - test/units/jwt_sessions/test_token.rb
+- test/units/test_jwt_sessions.rb
+- test/units/test_token_store.rb