otp-jwt 0.2.7 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 16fc6a7023ef65ec63c539e7a43ad48b6a5a8a64b41269687c8c1db53e321c4b
-  data.tar.gz: 4c7e06c0dd6e1b29ea12de1f75c4f25310c8557965c7d8bbdeaf294c244683c2
+  metadata.gz: 4e4d38ef8b50541c6606645a9f75229e2599e47ec92323637886532853da6baa
+  data.tar.gz: 582df0752fead7e8b96615107a3d2db80a68d87b4fa2d533d6eaf9e2b7aaf035
 SHA512:
-  metadata.gz: 7ee896f4d70eb673ce977a8db560cc8f193255802f36da5074791b883cfa453045a5e57c98f98ad919735eee0bbd191025e12cdaa253447f7b5fae71aed429a3
-  data.tar.gz: b9a82e89ba20bf80d5e7ebfe3d292452d8fa487b5f3645ea3b94862f77078386c20f77ac97cecdfd5e9740a1aee592480ab53dd6e5c6d50f7cbcf423cd1aea90
+  metadata.gz: 89b0dc892cc73c5a863084a2017f1a23d621cd026a63c75256bb9be6642a909c03ed91be033e74fa28643af2453e662b12eb9ca3a0cbc35530de167348895fe6
+  data.tar.gz: 9e5b016cd192f8d5274257b1173a44868a5378b1cbb05f8e4de93136be887df6a623956054d756be6bd60c1fc30406d818713fee1285775bce5b2e39f990435b

data/README.md

@@ -10,7 +10,7 @@ One time password (email, SMS) authentication support for HTTP APIs.
 This project provides a couple of mixins to help you build
 applications/HTTP APIs without asking your users to provide passwords.
 
-[Your browser probably can work seamlessly with OTPs](https://web.dev/web-otp/)!!! :heart_eyes: 
+[Your browser probably can work seamlessly with OTPs](https://web.dev/web-otp/)!!! :heart_eyes:
 
 ## About
 
@@ -40,6 +40,16 @@ and [JWT](https://github.com/jwt/ruby-jwt/).
 
 Thanks to everyone who worked on these amazing projects!
 
+
+## Sponsors
+
+I'm grateful for the following companies for supporting this project!
+
+<p align="center">
+<a href="https://www.luneteyewear.com"><img src="https://user-images.githubusercontent.com/112147/136836142-2bfba96e-447f-4eb6-b137-2445aee81b37.png"/></a>
+<a href="https://www.startuplandia.io"><img src="https://user-images.githubusercontent.com/112147/136836147-93f8ab17-2465-4477-a7ab-e38255483c66.png"/></a>
+</p>
+
 ## Installation
 
 Add this line to your application's Gemfile:
@@ -77,6 +87,12 @@ require 'otp'
 # To load the JWT related support.
 require 'otp/jwt'
 
+# Set to 'none' to disable verification at all.
+# OTP::JWT::Token.jwt_algorithm = 'HS256'
+
+# How long the token will be valid.
+# OTP::JWT::Token.jwt_lifetime = 60 * 60 * 24
+
 OTP::JWT::Token.jwt_signature_key = ENV['YOUR-SIGN-KEY']
 ```
 ### OTP for Active Record models
@@ -99,6 +115,7 @@ one time passwords:
 This concern expects two attributes to be provided by the model, the:
  * `otp_secret`: of type string, used to store the OTP signature key
  * `otp_counter`: of type integer, used to store the OTP counter
+ * `expire_jwt_at`: of type datetime, **optional** and used to force a token to expire
 
 A migration to add these two looks like this:
 ```
@@ -111,6 +128,13 @@ User.all.each do |u|
   u.save()
 end
 ```
+
+##### Force a token to expire
+
+If there's an `expire_jwt_at` value that is in the past, the user token will
+be reset and it will require a new authentication to receive a working token.
+
+This is handy if the user access needs to be scheduled and/or removed.
 #### Mailer support
 
 You can use the built-in mailer to deliver the OTP, just require it and
@@ -304,4 +328,5 @@ contributors are expected to adhere to the
 
 ## License
 
-TBD
+The gem is available as open source under the terms of the
+[MIT License](https://opensource.org/licenses/MIT).

data/lib/otp/jwt/active_record.rb

@@ -17,6 +17,7 @@ module OTP
             val = payload[claim_name]
             pk_col = self.column_for_attribute(self.primary_key)
 
+
             # Arel casts the values to the primary key type,
             # which means that an UUID becomes an integer by default...
             if self.connection.respond_to?(:lookup_cast_type_from_column)
@@ -28,7 +29,7 @@ module OTP
 
             return if casted_val.to_s != val.to_s.strip
 
-            self.find_by(self.primary_key => val)
+            self.find_by(self.primary_key => val).expire_jwt?
           end
         end
       end
@@ -43,6 +44,17 @@ module OTP
           **(claims || {})
         )
       end
+
+      # Reset the [JWT] token if it is set to expire
+      #
+      # This method allows you to expire any token, independently from
+      # the JWT flags/payload.
+      #
+      # @return nil if the expiration worked, otherwise returns the model
+      def expire_jwt?
+        return self unless self.respond_to?(:expire_jwt_at)
+        return self unless expire_jwt_at? && expire_jwt_at.past?
+      end
     end
   end
 end

data/lib/otp/jwt/token.rb

@@ -37,7 +37,10 @@ module OTP
       #
       # @return [Hash], JWT token payload
       def self.verify(token, opts = nil)
-        ::JWT.decode(token.to_s, self.jwt_signature_key, true, opts || {})
+        verify = self.jwt_algorithm != 'none'
+        opts ||= { algorithm: self.jwt_algorithm }
+
+        ::JWT.decode(token.to_s, self.jwt_signature_key, verify, opts)
       end
 
       # Decodes a valid token into [Hash]

data/lib/otp/jwt/version.rb

@@ -1,5 +1,5 @@
 module OTP
   module JWT
-    VERSION = '0.2.7'
+    VERSION = '0.3.0'
   end
 end

data/spec/dummy.rb

@@ -32,6 +32,7 @@ ActiveRecord::Schema.define do
     t.string :otp_secret
     t.integer :otp_counter
     t.timestamp :last_login_at
+    t.timestamp :expire_jwt_at
     t.timestamps
   end
 end

data/spec/otp/jwt/token_spec.rb

@@ -12,6 +12,18 @@ RSpec.describe OTP::JWT::Token, type: :model do
 
   describe '#sign' do
     it { expect(described_class.sign(payload)).to eq(token) }
+
+    context 'with the none algorithm' do
+      before do
+        OTP::JWT::Token.jwt_algorithm = 'none'
+      end
+
+      after do
+        OTP::JWT::Token.jwt_algorithm = 'HS256'
+      end
+
+      it { expect(described_class.sign(payload)).to eq(token) }
+    end
   end
 
   describe '#verify' do
@@ -31,6 +43,22 @@ RSpec.describe OTP::JWT::Token, type: :model do
       expect { described_class.verify(token) }
         .to raise_error(JWT::ExpiredSignature)
     end
+
+    context 'with an RSA key' do
+      before do
+        OTP::JWT::Token.jwt_signature_key = OpenSSL::PKey::RSA.new(2048)
+        OTP::JWT::Token.jwt_algorithm = 'RS256'
+      end
+
+      after do
+        OTP::JWT::Token.jwt_signature_key = '_'
+        OTP::JWT::Token.jwt_algorithm = 'HS256'
+      end
+
+      it do
+        expect(described_class.verify(token).first).to include(payload)
+      end
+    end
   end
 
   describe '#decode' do
@@ -50,5 +78,21 @@ RSpec.describe OTP::JWT::Token, type: :model do
         expect(described_class.decode(token)).to eq(nil)
       end
     end
+
+    context 'with the none algorithm' do
+      before do
+        OTP::JWT::Token.jwt_algorithm = 'none'
+      end
+
+      after do
+        OTP::JWT::Token.jwt_algorithm = 'HS256'
+      end
+
+      it do
+        expect(
+          described_class.decode(token) { |p| User.find(p['sub']) }
+        ).to eq(user)
+      end
+    end
   end
 end

data/spec/spec_helper.rb

@@ -23,11 +23,12 @@ module OTP::JWT::FactoryHelpers
   # Creates an user
   #
   # @return [User]
-  def create_user
+  def create_user(attrs = {})
     User.create!(
       full_name: FFaker::Name.name,
       email: FFaker::Internet.email,
-      phone_number: FFaker::PhoneNumber.phone_number
+      phone_number: FFaker::PhoneNumber.phone_number,
+      **attrs
     )
   end
 end

data/spec/users_controller_spec.rb

@@ -13,6 +13,24 @@ RSpec.describe UsersController, type: :request do
     let(:user) { create_user }
 
     it { expect(response).to have_http_status(:ok) }
+
+    context 'with the expiration for JWT in future' do
+      let(:user) { create_user(expire_jwt_at: DateTime.tomorrow) }
+
+      it do
+        expect(response).to have_http_status(:ok)
+        expect(user.reload.expire_jwt_at).not_to be_nil
+      end
+    end
+
+    context 'with the expiration past for JWT' do
+      let(:user) { create_user(expire_jwt_at: DateTime.yesterday) }
+
+      it do
+        expect(response).to have_http_status(:unauthorized)
+        expect(user.reload.expire_jwt_at).not_to be_nil
+      end
+    end
   end
 
   context 'with bad subject' do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: otp-jwt
 version: !ruby/object:Gem::Version
-  version: 0.2.7
+  version: 0.3.0
 platform: ruby
 authors:
 - Stas Suscov
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-02-15 00:00:00.000000000 Z
+date: 2021-10-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -250,7 +250,7 @@ homepage: https://github.com/stas/otp-jwt
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -265,8 +265,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.3
-signing_key: 
+rubygems_version: 3.2.22
+signing_key:
 specification_version: 4
 summary: Passwordless HTTP APIs
 test_files: []