jwt_sessions 2.0.0 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 6ab2b9607a84bdecaea7ec538b3ba194ae0d57e4
-  data.tar.gz: 3ade912f52efd6078fb676697187145c23e39024
+  metadata.gz: 7981af52568346a34f4c308e76b19b88ddc264ea
+  data.tar.gz: 48fe0cb349266922f0124a918c14e4c79c10d28b
 SHA512:
-  metadata.gz: 7761b2f89cf64203f8f82cef4e95c28f6ea602cee0a22d56318bbfd1299cb6e2c3b50ad41b840fddd458dc53b0b249b3d7820a99405b67b2ffb532b900f15d51
-  data.tar.gz: d4e087880bfc893c983c7187d2c206c521efe3beb0c0c245161e0c614bc59868a05c474c9479a36f778966c4ab017c220fd9e866448afd83f9444c59f5f5b33c
+  metadata.gz: 8c275a6504519c3447c36b9557223ba5403d87d590ba9d4d7215fc4f6580021a00a296b6daa71ef2e7f15c1fa61dd7fe0d1f9b62813ae63e93381e342a3e2640
+  data.tar.gz: cafceae22f54838b7745f4e26deaf5eba969212f235552e1d2fde547608f6219e76a4482135a02e5b4cc94818dc5d1ec5c256c79b67907b6531e06df980dc6ff

data/README.md

@@ -15,7 +15,7 @@ XSS/CSRF safe JWT auth designed for SPA
   * [Non-Rails usage](#non-rails-usage)
 - [Configuration](#configuration)
     + [Redis](#redis)
-    + [JWT encryption](#jwt-encryption)
+    + [JWT signature](#jwt-signature)
     + [Request headers and cookies names](#request-headers-and-cookies-names)
     + [Expiration time](#expiration-time)
     + [CSRF and cookies](#csrf-and-cookies)
@@ -290,11 +290,11 @@ Default token store configurations
 ```ruby
 JWTSessions.redis_host    = '127.0.0.1'
 JWTSessions.redis_port    = '6379'
-JWTSessions.redis_db_name = 'jwtokens'
+JWTSessions.redis_db_name = '0'
 JWTSessions.token_prefix  = 'jwt_' # used for redis db keys
 ```
 
-##### JWT encryption
+##### JWT signature
 
 ```ruby
 JWTSessions.algorithm = 'HS256'

data/lib/jwt_sessions/access_token.rb

@@ -38,6 +38,21 @@ module JWTSessions
       def destroy(uid, store)
         store.destroy_access(uid)
       end
+
+      # AccessToken's find method cannot be used to retrieve token's payload
+      # or any other information but is intended to identify if the token is present
+      # and to retrieve session's CSRF token
+      def find(uid, store)
+        token_attrs = store.fetch_access(uid)
+        raise Errors::Unauthorized, 'Access token not found' if token_attrs.empty?
+        build_with_token_attrs(store, uid, token_attrs)
+      end
+
+      private
+
+      def build_with_token_attrs(store, uid, token_attrs)
+        new(token_attrs[:csrf], {}, store, uid)
+      end
     end
   end
 end

data/lib/jwt_sessions/errors.rb

@@ -4,5 +4,6 @@ module JWTSessions
     class Malconfigured < Error; end
     class InvalidPayload < Error; end
     class Unauthorized < Error; end
+    class ClaimsVerification < Unauthorized; end
   end
 end

data/lib/jwt_sessions/session.rb

@@ -63,11 +63,13 @@ module JWTSessions
       flush_by_uid(ruid)
     end
 
+    # flush the session by refresh token
     def flush_by_token(token)
       uid = token_uid(token, :refresh, @refresh_claims)
       flush_by_uid(uid)
     end
 
+    # flush the session by refresh token uid
     def flush_by_uid(uid)
       token = retrieve_refresh_token(uid)
 
@@ -75,6 +77,15 @@ module JWTSessions
       token.destroy
     end
 
+    # flush access tokens only and keep refresh
+    def flush_namespaced_access_tokens
+      return 0 unless namespace
+      tokens = RefreshToken.all(namespace, store)
+      tokens.each do |token|
+        AccessToken.destroy(token.access_uid, store)
+      end.count
+    end
+
     def flush_namespaced
       return 0 unless namespace
       tokens = RefreshToken.all(namespace, store)

data/lib/jwt_sessions/token.rb

@@ -13,6 +13,8 @@ module JWTSessions
       def decode(token, claims = {})
         decode_options = { algorithm: JWTSessions.algorithm }.merge(JWTSessions.jwt_options.to_h).merge(claims)
         JWT.decode(token, JWTSessions.public_key, JWTSessions.validate?, decode_options)
+      rescue JWT::InvalidIssuerError, JWT::InvalidIatError, JWT::InvalidAudError, JWT::InvalidSubError, JWT::InvalidJtiError => e
+        raise Errors::ClaimsVerification, e.message
       rescue JWT::DecodeError => e
         raise Errors::Unauthorized, e.message
       rescue StandardError

data/lib/jwt_sessions/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JWTSessions
-  VERSION = '2.0.0'
+  VERSION = '2.1.0'
 end

data/lib/jwt_sessions.rb

@@ -36,7 +36,7 @@ module JWTSessions
 
   DEFAULT_REDIS_HOST       = '127.0.0.1'
   DEFAULT_REDIS_PORT       = '6379'
-  DEFAULT_REDIS_DB_NAME    = 'jwtokens'
+  DEFAULT_REDIS_DB_NAME    = '0'
   DEFAULT_TOKEN_PREFIX     = 'jwt_'
   DEFAULT_ALGORITHM        = 'HS256'
   DEFAULT_ACCESS_EXP_TIME  = 3600 # 1 hour in seconds

data/test/units/jwt_sessions/test_session.rb

@@ -166,6 +166,25 @@ class TestSession < Minitest::Test
     assert_equal refresh_token.token, JWTSessions::RefreshToken.find(refresh_token.uid, JWTSessions.token_store, nil).token
   end
 
+  def test_flush_namespaced_access_tokens
+    namespace = 'test_namespace'
+    @session1 = JWTSessions::Session.new(payload: payload, namespace: namespace)
+    @session1.login
+    refresh_token = @session1.instance_variable_get(:"@_refresh")
+    access_token = @session1.instance_variable_get(:"@_access")
+    uid = access_token.uid
+    ruid = refresh_token.uid
+
+    assert_equal access_token.csrf, JWTSessions::AccessToken.find(uid, JWTSessions.token_store).csrf
+    flushed_count = @session1.flush_namespaced_access_tokens
+
+    assert_equal 1, flushed_count
+    assert_raises JWTSessions::Errors::Unauthorized do
+      JWTSessions::AccessToken.find(uid, JWTSessions.token_store)
+    end
+    assert_equal ruid, JWTSessions::RefreshToken.find(ruid, JWTSessions.token_store, namespace).uid
+  end
+
   def test_flush_all
     refresh_token = @session.instance_variable_get(:"@_refresh")
     flushed_count = JWTSessions::Session.flush_all

data/test/units/jwt_sessions/test_token.rb

@@ -79,7 +79,7 @@ class TestToken < Minitest::Test
     decoded = JWTSessions::Token.decode(token, { sub: 'subject' }).first
     assert_equal payload['user_id'], decoded['user_id']
     assert_equal payload['secret'], decoded['secret']
-    assert_raises JWTSessions::Errors::Unauthorized do
+    assert_raises JWTSessions::Errors::ClaimsVerification do
       JWTSessions::Token.decode(token, { sub: 'different subject' })
     end
   end
@@ -91,7 +91,7 @@ class TestToken < Minitest::Test
     decoded = JWTSessions::Token.decode(token, { iss: 'Me' }).first
     assert_equal payload['user_id'], decoded['user_id']
     assert_equal payload['secret'], decoded['secret']
-    assert_raises JWTSessions::Errors::Unauthorized do
+    assert_raises JWTSessions::Errors::ClaimsVerification do
       JWTSessions::Token.decode(token, { iss: 'Not Me' })
     end
   end
@@ -103,7 +103,7 @@ class TestToken < Minitest::Test
     decoded = JWTSessions::Token.decode(token, { aud: ['young'] }).first
     assert_equal payload['user_id'], decoded['user_id']
     assert_equal payload['secret'], decoded['secret']
-    assert_raises JWTSessions::Errors::Unauthorized do
+    assert_raises JWTSessions::Errors::ClaimsVerification do
       JWTSessions::Token.decode(token, { aud: ['adult'] })
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jwt_sessions
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.1.0
 platform: ruby
 authors:
 - Yulia Oletskaya
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-06-17 00:00:00.000000000 Z
+date: 2018-06-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt