jwt_signed_request 2.4.0 → 2.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: f1437c1fe1c8ace216bfb4794b2d8f434383a6a0
-  data.tar.gz: 8f6cf18fe5b27219e659e53495308324494f20e8
+SHA256:
+  metadata.gz: 223bee2fbebac240f4545a6743a8142caa85e53368888efcd15b122d879fb0aa
+  data.tar.gz: eda9041c02891f02c67f88b0b5d5877a8540c89bc619212ebb06507d5c1a44f5
 SHA512:
-  metadata.gz: 17a865b7d0439a4cebdb9f7a280729681ff442e05c52c722b81f792a2b33fa62050b89cf1c4b69c6ede112d62d4967f64d7915553396b2ec934bda5cb9eafac5
-  data.tar.gz: 2755fcdccfb5f398647d97699a7082196b723b2ff32e41700691dc8348e697c138edc09193be2fa495dec904cfbdbda06832b207b98caa0d2856e2242b6b75c2
+  metadata.gz: 2f6b10faac1fb80562ed2f9240cf32f96b96c81b2ee04b2bd097cc53714a45f420411a94bfa8bf541fe81e5103a23aad185ba88dfa0aec679f4ad03d493be626
+  data.tar.gz: 1dabc24f6f7476b4fddeebd6662d81e63f93ff9fa5caad5ff93f8214c82586b1a83e8070c054dc4df381d13d2218b551a6e0ab303cab78f8f26588aea14c7535

data/lib/jwt_signed_request.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'jwt'
 require 'jwt_signed_request/key_store'
 require 'jwt_signed_request/sign'

data/lib/jwt_signed_request/claims.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'digest'
 require 'json'
 require 'rack/utils'

data/lib/jwt_signed_request/errors.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module JWTSignedRequest
   UnauthorizedRequestError = Class.new(StandardError)
   MissingAuthorizationHeaderError = Class.new(UnauthorizedRequestError)
@@ -11,6 +13,7 @@ module JWTSignedRequest
   RequestQueryVerificationFailedError = Class.new(RequestVerificationFailedError)
 
   MissingKeyIdError = Class.new(UnauthorizedRequestError)
+  MissingAlgorithmError = Class.new(UnauthorizedRequestError)
   UnknownKeyIdError = Class.new(UnauthorizedRequestError)
   AlgorithmMismatchError = Class.new(UnauthorizedRequestError)
 end

data/lib/jwt_signed_request/headers.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # We need a way to pull out the headers from a RAW Rack ENV hash.
 #
 # We took out the bits we need to lookup the headers from:

data/lib/jwt_signed_request/key_store.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module JWTSignedRequest
   class KeyStore
     def initialize

data/lib/jwt_signed_request/middlewares/faraday.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'faraday'
 require 'jwt_signed_request'
 

data/lib/jwt_signed_request/middlewares/rack.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'rack'
 require 'jwt_signed_request'
 

data/lib/jwt_signed_request/sign.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'jwt_signed_request/claims'
 
 module JWTSignedRequest

data/lib/jwt_signed_request/verify.rb

@@ -1,5 +1,8 @@
+# frozen_string_literal: true
+
 require 'jwt_signed_request/headers'
 require 'jwt_signed_request/errors'
+require 'jwt/version'
 
 module JWTSignedRequest
   class Verify
@@ -39,6 +42,10 @@ module JWTSignedRequest
       end
     end
 
+    def algorithm
+      @algorithm ||= stored_key.fetch(:algorithm) { raise MissingAlgorithmError }
+    end
+
     def secret_key
       @secret_key ||= stored_key.fetch(:key) { raise MissingKeyIdError }
     end
@@ -52,6 +59,8 @@ module JWTSignedRequest
         verify = true
         options = {}
 
+        options[:algorithm] = algorithm if jwt_algorithm_required?
+
         if leeway
           # TODO: Once JWT v2.0.0 has been released, we should upgrade to it
           # and start using `exp_leeway` instead 'leeway' will still work, but
@@ -124,5 +133,9 @@ module JWTSignedRequest
     def request_query_values
       standard_query_values(URI.parse(request.fullpath))
     end
+
+    def jwt_algorithm_required?
+      JWT::VERSION::MAJOR >= 2
+    end
   end
 end

data/lib/jwt_signed_request/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module JWTSignedRequest
-  VERSION = "2.4.0".freeze
+  VERSION = '2.4.1'.freeze
 end

metadata

@@ -1,29 +1,35 @@
 --- !ruby/object:Gem::Specification
 name: jwt_signed_request
 version: !ruby/object:Gem::Version
-  version: 2.4.0
+  version: 2.4.1
 platform: ruby
 authors:
 - Envato
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-07-24 00:00:00.000000000 Z
+date: 2019-01-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.5.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 2.2.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.5.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 2.2.0
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -128,7 +134,10 @@ files:
 - lib/jwt_signed_request/version.rb
 homepage: https://github.com/envato/jwt_signed_request
 licenses: []
-metadata: {}
+metadata:
+  bug_tracker_uri: https://github.com/envato/jwt_signed_request/issues
+  changelog_uri: https://github.com/envato/jwt_signed_request/blob/master/CHANGELOG.md
+  source_code_uri: https://github.com/envato/jwt_signed_request
 post_install_message: 
 rdoc_options: []
 require_paths:
@@ -145,7 +154,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.1
+rubygems_version: 2.7.6
 signing_key: 
 specification_version: 4
 summary: JWT request signing and verification for Internal APIs