model_driven_api 3.12.2 → 3.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 64d6dc96e02bf63e76a9948d41e1f7203433f9be2f3bb0a2abe16f19179351ad
-  data.tar.gz: 47bf8c07a5e6381bcabb15a150faae8bd08ae02000db9798c091b2a916e628df
+  metadata.gz: 9fcc02687ce88ff1cc47523ddd04f9d1a7c4918d40c2f2765d59f19a1697c0dd
+  data.tar.gz: 2eb8c0586bbbdaed24d44d5c8de670ff5339df53c7d6609eedcb8559cc49e16a
 SHA512:
-  metadata.gz: 6d7039ac2e39aa75800db5a1ecdabd121a7465c8ffdc966ab88dac7961e53bd00eff37c0b8794b5d6ecca68f5a8d9eed3e4a3a8dd9d800a084301e12a7e321b0
-  data.tar.gz: 37566ee9050bfe09de0f3d784d0c6b4b6aebb39ec365ceb8c7f59e045b4865d3bf66518ebd1a393c38a8a04db575a2bd3ee2c106df84551f17e79c2b27c33780
+  metadata.gz: c48fa599733f52da66626b80067df10d3cb223c3f950a3f3e4f62afe104e50f5b93778cf228b95b89268227b811e74e3b10455fd8d8a3cff0f9d8b8d0f1caf5b
+  data.tar.gz: bb50aa93d2b0ce0616e8128b9634b6e38e7fd066bb8fd7a0dba61429000dbf3d125b49930273ebe333126f8ee1104d922cf78eec8f4db6d946cb3f47768d8708

data/lib/json_web_token.rb

@@ -1,21 +1,44 @@
 class JsonWebToken
   class << self
     def encode(payload, expiry = ENV.fetch('SESSION_TIMEOUT_IN_MINUTES', 31).to_i.minutes.from_now.to_i)
-      result = ::JWT.encode(payload.merge(exp: expiry), ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])
+      result = ::JWT.encode(payload.merge(exp: expiry), signing_key)
       # Store the created token into the DB for later checks if is invalid
       # In a public environment management, without login, it has no interest, so I don't pollute the DB
       UsedToken.find_or_create_by(token: result, user_id: payload[:user_id]) if ENV["ALLOW_MULTISESSIONS"] == "false"
       result
     end
-    
+
     def decode(token)
-      # Check if the passed token is present and valid into the UsedToken 
+      # Check if the passed token is present and valid into the UsedToken
       raise "Token is invalidated by new login" if !UsedToken.exists?(token: token, is_valid: true) && ENV["ALLOW_MULTISESSIONS"] == "false"
-      body = ::JWT.decode(token, ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])[0]
+      body = verified_payload(token)
       Rails.logger.debug "JsonWebToken: decode -> body -> #{body}"
       ::HashWithIndifferentAccess.new body
     # rescue
     #   nil
     end
+
+    private
+
+    def signing_key
+      ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"]
+    end
+
+    # After a SECRET_KEY_BASE rotation, a token signed with the previous key is still accepted until
+    # SECRET_KEY_BASE_PREVIOUS_EXPIRES_AT (ISO 8601), so app users never log in again: every authenticated
+    # response renews the token with the current key. The previous key may be public, so it is never
+    # trusted without an expiry, and only a bad signature falls back to it (an expired token stays expired).
+    def verified_payload(token)
+      ::JWT.decode(token, signing_key)[0]
+    rescue ::JWT::VerificationError
+      previous = previous_signing_key or raise
+      ::JWT.decode(token, previous)[0]
+    end
+
+    def previous_signing_key
+      key = ENV["SECRET_KEY_BASE_PREVIOUS"].presence or return
+      expires_at = Time.iso8601(ENV["SECRET_KEY_BASE_PREVIOUS_EXPIRES_AT"].to_s) rescue nil
+      key if expires_at && Time.current < expires_at
+    end
   end
-end
+end

data/lib/model_driven_api/version.rb

@@ -1,3 +1,3 @@
 module ModelDrivenApi
-  VERSION = "3.12.2".freeze
+  VERSION = "3.13.0".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 3.12.2
+  version: 3.13.0
 platform: ruby
 authors:
 - Gabriele Tassoni