jwt_sessions 3.2.3 → 3.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 022c03bac5aaaf4a0f238345ce73277b027edf1df4f634a1f3ccfe804c57ad32
-  data.tar.gz: '0082926879d500097e41b7c796ef082ca8ef5d8a1a6aae6a6ea99a18c636bae0'
+  metadata.gz: 3d616f460afd8b13982064b340c2ea3f3e326bb99dff16ec2e159599ffa4aebd
+  data.tar.gz: baed64f2320056748d33c1f08c955e4b37cb958d6442f28ade5fa7c61656be56
 SHA512:
-  metadata.gz: c334bcf7670a89711fad701bcc6f2a3ce46d8273e2ea8c516cc680a153978901cf395a788596a1f5becf54675ae1552eb3d553cfa1e58174f162cc6ae362c673
-  data.tar.gz: 76593854f622fac7c417b9857040de0afa9881bdad19650d08921736b4679801ec696dbe3eb2331a30986a2fac5f02033678f4bf9bc6c68492625a8d2e58b403
+  metadata.gz: d31922314b428ab7bb82d0817b5a357b8fec1f47361d11e194f9d8c8e9e3dc9cda791c095af43c12aa7f71b06c36e3d1912b83808644a9dcd55888d19679342b
+  data.tar.gz: 3ffb8fa65a4c9d5599be7cc7d387773d2fee8a3f10c70b5c4ed1a7b30912d33400a678d69c07d469b4ce4113e021f3035b0d2e62949472cd32b707d3efded94b

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 3.2.4 (Septemper 21, 2024)
+
+Support:
+
+ - always pass token claims when verifying session
+
 ## 3.2.3 (Septemper 18, 2024)
 
 Support:

data/lib/jwt_sessions/authorization.rb

@@ -79,11 +79,11 @@ module JWTSessions
     end
 
     def valid_csrf_token?(csrf_token, token_type)
-      JWTSessions::Session.new.valid_csrf?(found_token, csrf_token, token_type)
+      JWTSessions::Session.new(session_claims).valid_csrf?(found_token, csrf_token, token_type)
     end
 
     def session_exists?(token_type)
-      JWTSessions::Session.new.session_exists?(found_token, token_type)
+      JWTSessions::Session.new(session_claims).session_exists?(found_token, token_type)
     end
 
     def cookieless_auth(token_type)
@@ -150,5 +150,13 @@ module JWTSessions
       invalid_authorization unless session_exists?(token_type)
       check_csrf(token_type)
     end
+
+    def session_claims
+      claims = respond_to?(:token_claims) ? token_claims : {}
+      {
+        access_claims: claims,
+        refresh_claims: claims
+      }
+    end
   end
 end

data/lib/jwt_sessions/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JWTSessions
-  VERSION = "3.2.3"
+  VERSION = "3.2.4"
 end

data/test/units/jwt_sessions/test_authorization.rb

@@ -6,10 +6,22 @@ require "jwt_sessions"
 class TestAuthorization < Minitest::Test
   include JWTSessions::Authorization
 
+  def token_claims
+    {
+      iss: "issuer",
+      aud: "audience",
+    }
+  end
+
   def setup
     JWTSessions.signing_key = "abcdefghijklmnopqrstuvwxyzABCDEF"
   end
 
+  def teardown
+    JWTSessions.jwt_options[:verify_iss] = false
+    JWTSessions.jwt_options[:verify_aud] = false
+  end
+
   def test_payload_when_token_is_nil
     @_raw_token = nil
 
@@ -23,4 +35,94 @@ class TestAuthorization < Minitest::Test
     assert_equal payload['user_id'], 1
     assert_equal payload['secret'], 'mystery'
   end
+
+  def test_verify_iss
+    JWTSessions.jwt_options[:verify_iss] = true
+
+    session = JWTSessions::Session.new(payload: { user_id: 1, iss: "issuer" })
+    tokens = session.login
+
+    # Extract uid from access token
+    uid = JWT.decode(tokens[:access], JWTSessions.public_key).first["uid"]
+
+    @_raw_token =
+      JWTSessions::Token.encode({ user_id: 1, uid: uid, iss: "issuer" })
+
+    assert session_exists?(:access)
+  end
+
+  def test_verify_iss_when_iss_is_not_correct
+    JWTSessions.jwt_options[:verify_iss] = true
+
+    session = JWTSessions::Session.new(payload: { user_id: 1, iss: "issuer" })
+    tokens = session.login
+
+    # Extract uid from access token
+    uid = JWT.decode(tokens[:access], JWTSessions.public_key).first["uid"]
+
+    @_raw_token =
+      JWTSessions::Token.encode({ user_id: 1, uid: uid, iss: "another_issuer" })
+
+    assert !session_exists?(:access)
+  end
+
+  def test_verify_iss_when_iss_is_not_present
+    JWTSessions.jwt_options[:verify_iss] = true
+
+    session = JWTSessions::Session.new(payload: { user_id: 1, iss: "issuer" })
+    tokens = session.login
+
+    # Extract uid from access token
+    uid = JWT.decode(tokens[:access], JWTSessions.public_key).first["uid"]
+
+    @_raw_token =
+      JWTSessions::Token.encode({ user_id: 1, uid: uid })
+
+    assert !session_exists?(:access)
+  end
+
+  def test_verify_aud
+    JWTSessions.jwt_options[:verify_aud] = true
+
+    session = JWTSessions::Session.new(payload: { user_id: 1, aud: "audience" })
+    tokens = session.login
+
+    # Extract uid from access token
+    uid = JWT.decode(tokens[:access], JWTSessions.public_key).first["uid"]
+
+    @_raw_token =
+      JWTSessions::Token.encode({ user_id: 1, uid: uid, aud: "audience" })
+
+    assert session_exists?(:access)
+  end
+
+  def test_verify_aud_when_aud_is_not_correct
+    JWTSessions.jwt_options[:verify_aud] = true
+
+    session = JWTSessions::Session.new(payload: { user_id: 1, aud: "audience" })
+    tokens = session.login
+
+    # Extract uid from access token
+    uid = JWT.decode(tokens[:access], JWTSessions.public_key).first["uid"]
+
+    @_raw_token =
+      JWTSessions::Token.encode({ user_id: 1, uid: uid, aud: "another_audience" })
+
+    assert !session_exists?(:access)
+  end
+
+  def test_verify_aud_when_aud_is_not_present
+    JWTSessions.jwt_options[:verify_aud] = true
+
+    session = JWTSessions::Session.new(payload: { user_id: 1, aud: "audience" })
+    tokens = session.login
+
+    # Extract uid from access token
+    uid = JWT.decode(tokens[:access], JWTSessions.public_key).first["uid"]
+
+    @_raw_token =
+      JWTSessions::Token.encode({ user_id: 1, uid: uid })
+
+    assert !session_exists?(:access)
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jwt_sessions
 version: !ruby/object:Gem::Version
-  version: 3.2.3
+  version: 3.2.4
 platform: ruby
 authors:
 - Julija Alieckaja
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-09-18 00:00:00.000000000 Z
+date: 2024-09-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt