moj-simple-jwt-auth 0.0.1 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '069216a49c032609b1b2d4bb2b9fa9841efb7ff086d6eabec5f5f3394be7c6f7'
-  data.tar.gz: 6d6571c76a08ca15844b6e3251f900f53fcdcf981b90f3a5509835b80acf4306
+  metadata.gz: 60dcec9d18f24f29367e1d83d17c3c3309ec1ca09bc556390181b05bda6f7279
+  data.tar.gz: 981c1cd77b2e674184d07b4ca70c3c87657f8c4ec5e997a44c05f1ae8fabf08a
 SHA512:
-  metadata.gz: 1dfe076548da296f2233ae2b1103c01e5dad5940cbd6a2133b35258f41a24b36fe785681f940d191c57f3a1d92de96dbd968746a986f3e2a958e8150552644da
-  data.tar.gz: ff1c2a743a8f8d03c2a3f9d61cf8ba423e38fbd3b07847a85c7e78d5cd04c81c74615ee39baab1a3af233c87c87fb0651a9e95c873feb1336bbf4731d0aeb76e
+  metadata.gz: aa4da80b4fef3838177b572d7c8b257a9827a51ad2435f4e85dc030403bd0c2f7704fbd4aa1250526f1489f41f48140683431bb8bea78b40f1c77f97ac259e62
+  data.tar.gz: 13b5b74a4e4e9a43d2b45480077676d9c9331785709310241c017e93995ed96aca8771ae115f194da36422ea70fc9fc6c13fc1c94b1bb6c8a313e72346c40549

data/.github/workflows/main.yml

@@ -13,7 +13,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ruby: ['3.0.4', '3.1.2']
+        ruby: ['3.3', '3.4', '3.5']
 
     steps:
     - uses: actions/checkout@v3

data/.rubocop.yml

@@ -1,5 +1,5 @@
 AllCops:
-  TargetRubyVersion: 3.0
+  TargetRubyVersion: 3.3
   SuggestExtensions: false
   NewCops: enable
   Exclude:

data/README.md

@@ -36,6 +36,37 @@ For the **producer** side (the API service for instance) you will need to config
 
 There are several options you can configure, like expiration, leeway, logging, and more. Please refer to the [Configuration class](lib/simple_jwt_auth/configuration.rb) for more details.
 
+### Example of token
+
+This is a valid format token (might become invalid due to expiration at some point):
+
+`eyJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE2ODI1OTMwMzAsImV4cCI6MTY5ODQwNDU1NSwiaXNzIjoiY3JpbWUtYXBwbHkifQ.x2UE5VnwN5mf8elByPBnjiNChvsySqDjiLht6eN3ZPY`
+
+It has 3 parts, separated by dots, base64-encoded:
+
+1. Header (`eyJhbGciOiJIUzI1NiJ9`), containing the algorithm used. No other details are needed.
+    ```json
+    {
+      "alg": "HS256"
+    }
+    ```
+
+2. Payload (`eyJpYXQiOjE2ODI1OTMwMzAsImV4cCI6MTY5ODQwNDU1NSwiaXNzIjoiY3JpbWUtYXBwbHkifQ`), with some mandatory details.
+    ```json
+    {
+      "iat": 1682593030,
+      "exp": 1698404555,
+      "iss": "crime-apply"
+    }
+    ```
+   *iat* is the issued at seconds since epoch, *exp* is the expire at seconds since epoch, and finally *iss* is the issuer identifier or the name of the consumer to whom this token belongs.
+
+3. Signature (`x2UE5VnwN5mf8elByPBnjiNChvsySqDjiLht6eN3ZPY`)
+
+   To create the signature part you have to take the encoded header, the encoded payload, a secret, the algorithm specified in the header, and sign that.
+
+The token must be included in each request, in an Authorization header (bearer).
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `bundle exec rake` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.

data/lib/simple_jwt_auth/errors.rb

@@ -2,7 +2,10 @@
 
 module SimpleJwtAuth
   module Errors
-    class UndefinedIssuer < StandardError; end
-    class UnknownIssuer < StandardError; end
+    class Forbidden < StandardError; end
+    class IssuerError < StandardError; end
+
+    class UndefinedIssuer < IssuerError; end
+    class UnknownIssuer < IssuerError; end
   end
 end

data/lib/simple_jwt_auth/middleware/grape/authorisation.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module SimpleJwtAuth
+  module Middleware
+    module Grape
+      class Authorisation < ::Grape::Middleware::Base
+        def initialize(app, options = nil)
+          super(app, **(options || {}))
+        end
+
+        def before
+          return if test_env? || consumer_authorised?
+
+          raise SimpleJwtAuth::Errors::Forbidden,
+                "access to endpoint forbidden for issuer `#{current_issuer}`"
+        end
+
+        private
+
+        def test_env?
+          env['rack.test'] == true
+        end
+
+        def consumer_authorised?
+          route_authorised_consumers.include?(current_issuer) ||
+            route_authorised_consumers.include?('*')
+        end
+
+        def route_authorised_consumers
+          context.route.settings.fetch(:authorised_consumers, [])
+        end
+
+        def current_issuer
+          env.fetch(Jwt::ENV_PAYLOAD_KEY, {})['iss']
+        end
+      end
+    end
+  end
+end

data/lib/simple_jwt_auth/middleware/grape/jwt.rb

@@ -3,10 +3,15 @@
 module SimpleJwtAuth
   module Middleware
     module Grape
-      class Jwt < ::Grape::Middleware::Auth::Base
+      class Jwt < ::Grape::Middleware::Base
         ENV_AUTH_KEY = 'HTTP_AUTHORIZATION'
         ENV_PAYLOAD_KEY = 'grape_jwt.payload'
 
+        def initialize(app, options = nil)
+          super(app, **(options || {}))
+        end
+
+        # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
         def call(env)
           return app.call(env) if test_env?(env)
 
@@ -19,12 +24,18 @@ module SimpleJwtAuth
             logger.debug "Authorized request, JWT payload: #{payload}"
 
             app.call(env)
+          rescue SimpleJwtAuth::Errors::Forbidden => e
+            logger.warn "JWT issuer forbidden: #{e.message}"
+            rack_response(403, e.message)
+          rescue SimpleJwtAuth::Errors::IssuerError => e
+            logger.warn "JWT issuer error: #{e.message}"
+            rack_response(400, e.message)
           rescue JWT::DecodeError => e
             logger.warn "Unauthorized request, JWT error: #{e.message}"
-
-            [401, { 'Content-Type' => 'application/json' }, [{ status: 401, error: e.message }.to_json]]
+            rack_response(401, e.message)
           end
         end
+        # rubocop:enable Metrics/AbcSize, Metrics/MethodLength
 
         private
 
@@ -32,6 +43,10 @@ module SimpleJwtAuth
           env['rack.test'] == true
         end
 
+        def rack_response(http_code, error_msg)
+          [http_code, { 'Content-Type' => 'application/json' }, [{ error: error_msg }.to_json]]
+        end
+
         def logger
           SimpleJwtAuth.configuration.logger
         end

data/lib/simple_jwt_auth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SimpleJwtAuth
-  VERSION = '0.0.1'
+  VERSION = '0.2.0'
 end

data/lib/simple_jwt_auth.rb

@@ -17,6 +17,7 @@ require_relative 'simple_jwt_auth/decode'
 # Middleware helpers
 require_relative 'simple_jwt_auth/middleware/faraday/jwt' if defined?(Faraday)
 require_relative 'simple_jwt_auth/middleware/grape/jwt' if defined?(Grape)
+require_relative 'simple_jwt_auth/middleware/grape/authorisation' if defined?(Grape)
 
 module SimpleJwtAuth
 end

data/simple-jwt-auth.gemspec

@@ -26,7 +26,7 @@ Gem::Specification.new do |spec|
   spec.bindir        = 'exe'
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ['lib']
-  spec.required_ruby_version = '>= 3.0.0'
+  spec.required_ruby_version = '>= 3.3.4'
 
   spec.add_dependency 'json'
   spec.add_dependency 'jwt'

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: moj-simple-jwt-auth
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.2.0
 platform: ruby
 authors:
 - Jesus Laiz
-autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-02-14 00:00:00.000000000 Z
+date: 2026-07-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json
@@ -38,7 +37,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description:
 email:
 - zheileman@users.noreply.github.com
 executables: []
@@ -62,6 +60,7 @@ files:
 - lib/simple_jwt_auth/encode.rb
 - lib/simple_jwt_auth/errors.rb
 - lib/simple_jwt_auth/middleware/faraday/jwt.rb
+- lib/simple_jwt_auth/middleware/grape/authorisation.rb
 - lib/simple_jwt_auth/middleware/grape/jwt.rb
 - lib/simple_jwt_auth/secrets.rb
 - lib/simple_jwt_auth/traits/configurable.rb
@@ -73,7 +72,6 @@ licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'true'
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -81,15 +79,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.0.0
+      version: 3.3.4
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
-signing_key:
+rubygems_version: 3.6.2
 specification_version: 4
 summary: Simple JWT Auth ruby gem with middleware for Faraday and Grape.
 test_files: []