padlock_auth-jwt 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d72b209f99d0f31ea6a71feec733bbef0e11e4e3cbe2e6088b3539fc5f980783
-  data.tar.gz: cd0bdb5a17c3da8ca6a5f521d981c50df7a350221102f00985ed76928ab70210
+  metadata.gz: 7107cd7b8a99f461e2fdf0abbd526c2d1bced943a2542ee07c141ef600c4b233
+  data.tar.gz: c278724c8e66fb4b14a6f1f8f72eec4505630605d044d44200d41f706ebf07d6
 SHA512:
-  metadata.gz: d06dec8e41a9ec8899b8a45831e2d08afa9478f703659ab16f35c9d1c51ac8b28a72a7fc0941e2e894c1be4342390e642f9b8c6158b3ba05ad6754c114ac410d
-  data.tar.gz: b063001999e0b26a009b9bc332dbaf4873304797efd6579d456feed81b67adc68fbb200045e2e29d832a76fdacb94f7e7dcafc5260c2aaa0a2238efd7d58dafd
+  metadata.gz: 7beca857afbe76c930455a880f481bffd179de924a178c5b1d6cb5f410393999818d9eacd67b5c83d36deb246d723e75a8117ce517c42111c8e42b825e863dc1
+  data.tar.gz: c5daa9a7f997452b38a2c4f6dbbd4f0107a21845a8f83b6a4f3a10d22eadd72d48f4fc674d3b0ca932d38da4e648df0edc7dfe8ac645229c671f36a6eae32471

data/lib/padlock_auth/jwt/access_token.rb

@@ -12,8 +12,6 @@ module PadlockAuth
       def accessible?
         return false unless valid_jwt_token?
 
-        return false unless valid_signature?
-
         return false unless includes_required_claims?
 
         # "exp" (Expiration Time) Claim
@@ -35,8 +33,7 @@ module PadlockAuth
       end
 
       def invalid_token_reason
-        return :invalid_jwt_token unless valid_jwt_token?
-        return :invalid_signature unless valid_signature?
+        return valid_header? ? :invalid_signature : :invalid_jwt_token unless valid_jwt_token?
 
         return :missing_exp_claim unless includes_required_exp_claim?
         return :invalid_exp_claim unless valid_exp_claim?
@@ -83,19 +80,25 @@ module PadlockAuth
 
       private
 
+      def valid_jwt_token?
+        valid_signature? && valid_header?
+      end
+
       # https://datatracker.ietf.org/doc/html/rfc9068#JWTATLValidate
       # The resource server MUST verify that the "typ" header value is "at+jwt" or "application/at+jwt" and reject tokens carrying any other value.
-      def valid_jwt_token?
-        return @valid_jwt_token if instance_variable_defined?(:@valid_jwt_token)
-        @valid_jwt_token = @encoded_token.header.present? &&
+      def valid_header?
+        return @valid_header if instance_variable_defined?(:@valid_header)
+        @valid_header = @encoded_token.header.present? &&
           @strategy.header_types.include?(@encoded_token.header["typ"])
       rescue JWT::DecodeError
-        @valid_jwt_token = false
+        @valid_header = false
       end
 
       def valid_signature?
         return @valid_signature if instance_variable_defined?(:@valid_signature)
         @valid_signature = @encoded_token.valid_signature?(algorithm: @strategy.algorithm, key: @strategy.secret_key)
+      rescue JWT::DecodeError
+        @valid_signature = false
       end
 
       def includes_required_claims?

data/lib/padlock_auth/jwt/version.rb

@@ -1,5 +1,5 @@
 module PadlockAuth
   module Jwt
-    VERSION = "0.2.0"
+    VERSION = "0.2.1"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: padlock_auth-jwt
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Ben Morrall
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-01-07 00:00:00.000000000 Z
+date: 2025-01-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: padlock_auth
@@ -31,9 +31,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 2.9.4
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -41,9 +38,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 2.9.4
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: rspec-rails
   requirement: !ruby/object:Gem::Requirement