otp-jwt 0.2.5 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e7d17e5145dd260643ff8c5af4e8bdd866282b126d9873d0eb7db432fa289e97
-  data.tar.gz: bdedfcdb0ad970bc380f18aa4e518030b15b08f439d0854043ac45d22ba55c81
+  metadata.gz: ec8cd90193a14ccefd5ee90e2893186ca468083c354b12f671f1b53436fd6b50
+  data.tar.gz: 319db7a5d6dbdca708c0d161a224bbc722ef1fe7fe9209d329a0d5cdd657d2d8
 SHA512:
-  metadata.gz: b287bc6b7d738be7ef9028d224a77794a27e1da869115de54b693ee9b6c7f5ce094672bf021e4b79956171bae351fd36c39b2506ce4d0c58f5081a43679294d5
-  data.tar.gz: bdae8f51b91ef4e488d867b9281a604437524dcf0c40486901402393341ca563ba465c3cc2eb554f76ebda928124a2ae382302acd418852311368c98f39c08a5
+  metadata.gz: 96eccb938f849cb05ecad34fa92cd3df5a3c80a784091f5c318b7006908b5bf06f4d2ca8659fa14585eb9ad2b311fccd69b6a7dee30b15152ea019ed205ee7ea
+  data.tar.gz: 04abfadfe129775bb7fadaff00f8d20ff23b490fa8bbdc25a505cba85b2ff693c0947e7c6ac725cef34e4a0ad66531ce8d12ce445eeae6e3a504e37e6cfd7c4e

data/README.md

@@ -10,7 +10,7 @@ One time password (email, SMS) authentication support for HTTP APIs.
 This project provides a couple of mixins to help you build
 applications/HTTP APIs without asking your users to provide passwords.
 
-[Your browser probably can work seamlessly with OTPs](https://web.dev/web-otp/)!!! :heart_eyes: 
+[Your browser probably can work seamlessly with OTPs](https://web.dev/web-otp/)!!! :heart_eyes:
 
 ## About
 
@@ -40,6 +40,16 @@ and [JWT](https://github.com/jwt/ruby-jwt/).
 
 Thanks to everyone who worked on these amazing projects!
 
+
+## Sponsors
+
+I'm grateful for the following companies for supporting this project!
+
+<p align="center">
+<a href="https://www.luneteyewear.com"><img src="https://user-images.githubusercontent.com/112147/136836142-2bfba96e-447f-4eb6-b137-2445aee81b37.png"/></a>
+<a href="https://www.startuplandia.io"><img src="https://user-images.githubusercontent.com/112147/136836147-93f8ab17-2465-4477-a7ab-e38255483c66.png"/></a>
+</p>
+
 ## Installation
 
 Add this line to your application's Gemfile:
@@ -77,6 +87,12 @@ require 'otp'
 # To load the JWT related support.
 require 'otp/jwt'
 
+# Set to 'none' to disable verification at all.
+# OTP::JWT::Token.jwt_algorithm = 'HS256'
+
+# How long the token will be valid.
+# OTP::JWT::Token.jwt_lifetime = 60 * 60 * 24
+
 OTP::JWT::Token.jwt_signature_key = ENV['YOUR-SIGN-KEY']
 ```
 ### OTP for Active Record models
@@ -99,6 +115,7 @@ one time passwords:
 This concern expects two attributes to be provided by the model, the:
  * `otp_secret`: of type string, used to store the OTP signature key
  * `otp_counter`: of type integer, used to store the OTP counter
+ * `expire_jwt_at`: of type datetime, **optional** and used to force a token to expire
 
 A migration to add these two looks like this:
 ```
@@ -111,6 +128,13 @@ User.all.each do |u|
   u.save()
 end
 ```
+
+##### Force a token to expire
+
+If there's an `expire_jwt_at` value that is in the past, the user token will
+be reset and it will require a new authentication to receive a working token.
+
+This is handy if the user access needs to be scheduled and/or removed.
 #### Mailer support
 
 You can use the built-in mailer to deliver the OTP, just require it and
@@ -304,4 +328,5 @@ contributors are expected to adhere to the
 
 ## License
 
-TBD
+The gem is available as open source under the terms of the
+[MIT License](https://opensource.org/licenses/MIT).

data/lib/otp/active_record.rb

@@ -36,7 +36,8 @@ module OTP
     def verify_otp(otp)
       return nil if !valid? || !persisted? || otp_secret.blank?
 
-      hotp = ROTP::HOTP.new(otp_secret, digits: OTP_DIGITS)
+      otp_digits = self.class.const_get(:OTP_DIGITS)
+      hotp = ROTP::HOTP.new(otp_secret, digits: otp_digits)
       transaction do
         otp_status = hotp.verify(otp.to_s, otp_counter)
         increment!(:otp_counter)

data/lib/otp/jwt/active_record.rb

@@ -17,17 +17,19 @@ module OTP
             val = payload[claim_name]
             pk_col = self.column_for_attribute(self.primary_key)
 
+
             # Arel casts the values to the primary key type,
             # which means that an UUID becomes an integer by default...
-            if self.connection.respond_to?(:type_cast_from_column)
-              casted_val = self.connection.type_cast_from_column(pk_col, val)
+            if self.connection.respond_to?(:lookup_cast_type_from_column)
+              pk_type = self.connection.lookup_cast_type_from_column(pk_col)
+              casted_val = pk_type.serialize(val)
             else
               casted_val = self.connection.type_cast(val, pk_col)
             end
 
             return if casted_val.to_s != val.to_s.strip
 
-            self.find_by(self.primary_key => val)
+            self.find_by(self.primary_key => val)&.expire_jwt?
           end
         end
       end
@@ -42,6 +44,17 @@ module OTP
           **(claims || {})
         )
       end
+
+      # Reset the [JWT] token if it is set to expire
+      #
+      # This method allows you to expire any token, independently from
+      # the JWT flags/payload.
+      #
+      # @return nil if the expiration worked, otherwise returns the model
+      def expire_jwt?
+        return self unless self.respond_to?(:expire_jwt_at)
+        return self unless expire_jwt_at? && expire_jwt_at.past?
+      end
     end
   end
 end

data/lib/otp/jwt/token.rb

@@ -37,7 +37,10 @@ module OTP
       #
       # @return [Hash], JWT token payload
       def self.verify(token, opts = nil)
-        ::JWT.decode(token.to_s, self.jwt_signature_key, true, opts || {})
+        verify = self.jwt_algorithm != 'none'
+        opts ||= { algorithm: self.jwt_algorithm }
+
+        ::JWT.decode(token.to_s, self.jwt_signature_key, verify, opts)
       end
 
       # Decodes a valid token into [Hash]

data/lib/otp/jwt/version.rb

@@ -1,5 +1,5 @@
 module OTP
   module JWT
-    VERSION = '0.2.5'
+    VERSION = '0.3.1'
   end
 end

data/spec/dummy.rb

@@ -32,6 +32,7 @@ ActiveRecord::Schema.define do
     t.string :otp_secret
     t.integer :otp_counter
     t.timestamp :last_login_at
+    t.timestamp :expire_jwt_at
     t.timestamps
   end
 end

data/spec/otp/jwt/token_spec.rb

@@ -12,6 +12,18 @@ RSpec.describe OTP::JWT::Token, type: :model do
 
   describe '#sign' do
     it { expect(described_class.sign(payload)).to eq(token) }
+
+    context 'with the none algorithm' do
+      before do
+        OTP::JWT::Token.jwt_algorithm = 'none'
+      end
+
+      after do
+        OTP::JWT::Token.jwt_algorithm = 'HS256'
+      end
+
+      it { expect(described_class.sign(payload)).to eq(token) }
+    end
   end
 
   describe '#verify' do
@@ -31,6 +43,22 @@ RSpec.describe OTP::JWT::Token, type: :model do
       expect { described_class.verify(token) }
         .to raise_error(JWT::ExpiredSignature)
     end
+
+    context 'with an RSA key' do
+      before do
+        OTP::JWT::Token.jwt_signature_key = OpenSSL::PKey::RSA.new(2048)
+        OTP::JWT::Token.jwt_algorithm = 'RS256'
+      end
+
+      after do
+        OTP::JWT::Token.jwt_signature_key = '_'
+        OTP::JWT::Token.jwt_algorithm = 'HS256'
+      end
+
+      it do
+        expect(described_class.verify(token).first).to include(payload)
+      end
+    end
   end
 
   describe '#decode' do
@@ -50,5 +78,21 @@ RSpec.describe OTP::JWT::Token, type: :model do
         expect(described_class.decode(token)).to eq(nil)
       end
     end
+
+    context 'with the none algorithm' do
+      before do
+        OTP::JWT::Token.jwt_algorithm = 'none'
+      end
+
+      after do
+        OTP::JWT::Token.jwt_algorithm = 'HS256'
+      end
+
+      it do
+        expect(
+          described_class.decode(token) { |p| User.find(p['sub']) }
+        ).to eq(user)
+      end
+    end
   end
 end

data/spec/spec_helper.rb

@@ -23,11 +23,12 @@ module OTP::JWT::FactoryHelpers
   # Creates an user
   #
   # @return [User]
-  def create_user
+  def create_user(attrs = {})
     User.create!(
       full_name: FFaker::Name.name,
       email: FFaker::Internet.email,
-      phone_number: FFaker::PhoneNumber.phone_number
+      phone_number: FFaker::PhoneNumber.phone_number,
+      **attrs
     )
   end
 end

data/spec/users_controller_spec.rb

@@ -13,6 +13,24 @@ RSpec.describe UsersController, type: :request do
     let(:user) { create_user }
 
     it { expect(response).to have_http_status(:ok) }
+
+    context 'with the expiration for JWT in future' do
+      let(:user) { create_user(expire_jwt_at: DateTime.tomorrow) }
+
+      it do
+        expect(response).to have_http_status(:ok)
+        expect(user.reload.expire_jwt_at).not_to be_nil
+      end
+    end
+
+    context 'with the expiration past for JWT' do
+      let(:user) { create_user(expire_jwt_at: DateTime.yesterday) }
+
+      it do
+        expect(response).to have_http_status(:unauthorized)
+        expect(user.reload.expire_jwt_at).not_to be_nil
+      end
+    end
   end
 
   context 'with bad subject' do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: otp-jwt
 version: !ruby/object:Gem::Version
-  version: 0.2.5
+  version: 0.3.1
 platform: ruby
 authors:
 - Stas Suscov
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-01-09 00:00:00.000000000 Z
+date: 2021-10-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -84,16 +84,16 @@ dependencies:
   name: rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '4'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '4'
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rspec-rails
   requirement: !ruby/object:Gem::Requirement
@@ -112,16 +112,16 @@ dependencies:
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '0.81'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '0.81'
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
@@ -182,16 +182,16 @@ dependencies:
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.3.6
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.3.6
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: tzinfo-data
   requirement: !ruby/object:Gem::Requirement
@@ -250,7 +250,7 @@ homepage: https://github.com/stas/otp-jwt
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -265,8 +265,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
-signing_key: 
+rubygems_version: 3.2.22
+signing_key:
 specification_version: 4
 summary: Passwordless HTTP APIs
 test_files: []