padlock_auth-jwt 0.1.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 76622de62cd8065e302932783de9a3c02bff49880ec8f376fcdeed84cce97223
-  data.tar.gz: 460cb25344c8150779ad54a189a8d9ec371c63ae7bd1adf4b3b9af3183deca62
+  metadata.gz: 7107cd7b8a99f461e2fdf0abbd526c2d1bced943a2542ee07c141ef600c4b233
+  data.tar.gz: c278724c8e66fb4b14a6f1f8f72eec4505630605d044d44200d41f706ebf07d6
 SHA512:
-  metadata.gz: 39e6d74dbedae4ca68c3cef9a19bc3bcc8a4d2307877f2b557c616fd56ea4815e0e176726bb1a539141a2eb66b6c0bc503dce1160d290f4802f7cb2a4f928e2d
-  data.tar.gz: 4f3e41598b073669229e2de1da5543801e7b1182976dbdb67e84260af17215bb1245160da24a580bdd31454060d671f5a61b0510908983c31246c9eb3ec6ab0a
+  metadata.gz: 7beca857afbe76c930455a880f481bffd179de924a178c5b1d6cb5f410393999818d9eacd67b5c83d36deb246d723e75a8117ce517c42111c8e42b825e863dc1
+  data.tar.gz: c5daa9a7f997452b38a2c4f6dbbd4f0107a21845a8f83b6a4f3a10d22eadd72d48f4fc674d3b0ca932d38da4e648df0edc7dfe8ac645229c671f36a6eae32471

data/lib/padlock_auth/jwt/access_token.rb

@@ -12,8 +12,6 @@ module PadlockAuth
       def accessible?
         return false unless valid_jwt_token?
 
-        return false unless valid_signature?
-
         return false unless includes_required_claims?
 
         # "exp" (Expiration Time) Claim
@@ -35,8 +33,7 @@ module PadlockAuth
       end
 
       def invalid_token_reason
-        return :invalid_jwt_token unless valid_jwt_token?
-        return :invalid_signature unless valid_signature?
+        return valid_header? ? :invalid_signature : :invalid_jwt_token unless valid_jwt_token?
 
         return :missing_exp_claim unless includes_required_exp_claim?
         return :invalid_exp_claim unless valid_exp_claim?
@@ -83,19 +80,25 @@ module PadlockAuth
 
       private
 
+      def valid_jwt_token?
+        valid_signature? && valid_header?
+      end
+
       # https://datatracker.ietf.org/doc/html/rfc9068#JWTATLValidate
       # The resource server MUST verify that the "typ" header value is "at+jwt" or "application/at+jwt" and reject tokens carrying any other value.
-      def valid_jwt_token?
-        return @valid_jwt_token if instance_variable_defined?(:@valid_jwt_token)
-        @valid_jwt_token = @encoded_token.header.present? &&
+      def valid_header?
+        return @valid_header if instance_variable_defined?(:@valid_header)
+        @valid_header = @encoded_token.header.present? &&
           @strategy.header_types.include?(@encoded_token.header["typ"])
       rescue JWT::DecodeError
-        @valid_jwt_token = false
+        @valid_header = false
       end
 
       def valid_signature?
         return @valid_signature if instance_variable_defined?(:@valid_signature)
         @valid_signature = @encoded_token.valid_signature?(algorithm: @strategy.algorithm, key: @strategy.secret_key)
+      rescue JWT::DecodeError
+        @valid_signature = false
       end
 
       def includes_required_claims?

data/lib/padlock_auth/jwt/version.rb

@@ -1,5 +1,5 @@
 module PadlockAuth
   module Jwt
-    VERSION = "0.1.0"
+    VERSION = "0.2.1"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: padlock_auth-jwt
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Ben Morrall
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-12-09 00:00:00.000000000 Z
+date: 2025-01-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: padlock_auth