researchable_jwt-authenticable 1.1.0 → 1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: abeaaf5f3a590567cc0e31b701204f3fea0ef6598fddfa03eb97dcb34beb4436
-  data.tar.gz: e72942114fc0c82482d01d8a6e9b8c4083fc2223466290de06e2b6ffb4c4397e
+  metadata.gz: 6779a8f7597e46e6d8fd58f2c4ee4fb50412377722fec09112f54f29e0356567
+  data.tar.gz: 87edc735717c5fe7fffd7bd7dd1a6eccdef1461035b98b6402d616773d8f6969
 SHA512:
-  metadata.gz: '00519275b196a8d5b2dd2d75c1a1951ed8b91076e937ed34285f768eec98365468aaa4881c9a7084c03b5d0d495b0ce70bc7ffc6ebd19148f8335a3def579ef9'
-  data.tar.gz: ba644ed5e3a31da8d29ca334d393857ae3abf97e9d694613b850d9ee98ddb4d27e16be5113450d9859dda256fafbb582594a9af78c07275a50d33cb4305ab63f
+  metadata.gz: 6b53d00ed3d314492f326274efd6f7b0a67f5dcc1d27d9c52a2c33bdec096d868bc507728cbb48b2507cf12884798db5e3d1ea2dd359af67329766225586b437
+  data.tar.gz: e1cacbadcfcae8ceff9cfc733ee1e4f023b70735329d671dd9c2beefafaff7f6431ed2a58d6a01335129181a16e11e1af0c2d001f781657993d6f2ad2ffabf8c

data/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [1.2.1](https://gitlab.com/researchable/general/gems/jwt-authenticable/compare/v1.2.0...v1.2.1) (2026-08-12)
+
+
+### Bug Fixes
+
+* allow jwt 3.x by loosening the gemspec constraint ([bceed30](https://gitlab.com/researchable/general/gems/jwt-authenticable/commit/bceed30caaaeb734cc4a9c23da50457dd338660a))
+
+# [1.2.0](https://gitlab.com/researchable/general/gems/jwt-authenticable/compare/v1.1.0...v1.2.0) (2023-10-11)
+
+
+### Features
+
+* allow skipping 2fa ([541de8a](https://gitlab.com/researchable/general/gems/jwt-authenticable/commit/541de8a7ac4cc2029c00b44f30dde2486b4dfb06))
+
 # [1.1.0](https://gitlab.com/researchable/general/gems/jwt-authenticable/compare/v1.0.1...v1.1.0) (2023-06-30)
 
 

data/Gemfile.lock

@@ -1,9 +1,9 @@
 PATH
   remote: .
   specs:
-    researchable_jwt-authenticable (1.0.0)
+    researchable_jwt-authenticable (1.2.0)
       dry-configurable (~> 0.16)
-      jwt (~> 2.6)
+      jwt (>= 2.6, < 4)
 
 GEM
   remote: https://rubygems.org/
@@ -14,11 +14,9 @@ GEM
       minitest (>= 5.1)
       tzinfo (~> 2.0)
     ast (2.4.2)
+    base64 (0.3.0)
     byebug (11.1.3)
     concurrent-ruby (1.2.2)
-    debase (0.2.5.beta2)
-      debase-ruby_core_source (>= 0.10.12)
-    debase-ruby_core_source (3.2.1)
     diff-lcs (1.5.0)
     dry-configurable (0.16.1)
       dry-core (~> 0.6)
@@ -28,7 +26,8 @@ GEM
       zeitwerk (~> 2.6)
     i18n (1.12.0)
       concurrent-ruby (~> 1.0)
-    jwt (2.7.0)
+    jwt (3.2.0)
+      base64
     minitest (5.18.0)
     parallel (1.22.1)
     parser (3.2.1.1)
@@ -79,8 +78,6 @@ GEM
       rubocop-rails (= 2.12.4)
       rubocop-rake (= 0.6.0)
       rubocop-rspec (= 2.6.0)
-    ruby-debug-ide (0.7.3)
-      rake (>= 0.8.1)
     ruby-progressbar (1.13.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
@@ -92,12 +89,10 @@ PLATFORMS
 
 DEPENDENCIES
   byebug
-  debase
   rake (~> 13.0)
   researchable_jwt-authenticable!
   rspec (~> 3.0)
   ruboguide (~> 1.0)
-  ruby-debug-ide
 
 BUNDLED WITH
    2.4.6

data/README.md

@@ -46,6 +46,24 @@ class ApplicationController < ActionController::API
   end
 end
 ```
+
+## Configuration
+
+This gem works with `jwt` 2.6 or newer, including `jwt` 3.x.
+
+```ruby
+JwtAuthenticable.configure do |config|
+  # One of HS256, HS384, HS512, RS256, RS384 or RS512. Anything else falls back to HS256.
+  config.algorithm = 'HS256'
+
+  # The shared secret, or for the RS* algorithms the public key used to verify the signature.
+  config.jwt_secret_key = ENV.fetch('JWT_SECRET_KEY', nil)
+
+  # When true, a token is only considered valid if it carries a truthy `2fa` claim.
+  config.enforce_2fa = false
+end
+```
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.

data/lib/jwt_authenticable/auth.rb

@@ -11,28 +11,33 @@ module JwtAuthenticable
 
     # Authenticates a user.
     # @raise MissingAuthScope if the jwt does not have the right scope
-    def authenticate_user!
-      validate_jwt_token! token: authorization_token!
+    def authenticate_user!(skip_2fa: false)
+      validate_jwt_token! token: authorization_token!, skip_2fa: skip_2fa
     rescue MissingAuth, MissingAuthScope, InvalidAuthScheme, TwoFANotEnabledError, JWT::VerificationError,
            JWT::ExpiredSignature => e
       unauthorized(e.message)
     end
 
+    def authenticate_user_without_2fa!
+      authenticate_user!(skip_2fa: true)
+    end
+
     # Consider any method below as private and not meant to be used by including classes
 
     # Validate that the JWT token signature and the following claims are valid:
     #  - exp
     #  - scope
     # @param token [String] JWT token string (just the token, with the header, payload and signature separated by '.')
-    # @param is_researcher [Boolean] Whether to validate the token as a researcher's or a participant's
+    # @param skip_2fa [Boolean] When set to true it will not raise a TwoFANotEnabledError if the jwt payload does not
+    #                           contain the 2fa claim.
     # @raise AuthorizationError if the user is trying to login with the incorrect rights.
     # @return [Hash] the JWT payload
-    def validate_jwt_token!(token:)
+    def validate_jwt_token!(token:, skip_2fa: false)
       # NOTE: it is still safe if JWT_SECRET_KEY is not set. The method will trigger a JWT exception
       payload = JWT.decode(token, JwtAuthenticable.config.jwt_secret_key, true,
                            { algorithm: algorithm }).first
 
-      raise TwoFANotEnabledError if JwtAuthenticable.config.enforce_2fa && !payload['2fa']
+      raise TwoFANotEnabledError if JwtAuthenticable.config.enforce_2fa && !payload['2fa'] && !skip_2fa
 
       payload
     end
@@ -59,7 +64,7 @@ module JwtAuthenticable
     end
 
     def supported_algos
-      SUPPORTED_ALGOS.flat_map { |algo_class| algo_class.const_get(:SUPPORTED) }
+      SUPPORTED_ALGOS
     end
   end
 end

data/lib/jwt_authenticable/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JwtAuthenticable
-  VERSION = '1.1.0'
+  VERSION = '1.2.1'
 end

data/lib/jwt_authenticable.rb

@@ -14,7 +14,7 @@ module JwtAuthenticable
   # If set to true, a jwt will only be considered valid if 2fa has been enabled
   setting :enforce_2fa, default: false
 
-  SUPPORTED_ALGOS = [JWT::Algos::Hmac, JWT::Algos::Rsa].freeze
+  SUPPORTED_ALGOS = %w[HS256 HS384 HS512 RS256 RS384 RS512].freeze
 
   class Error < StandardError; end
 end

data/node_modules/semantic-release-rubygem/src/__tests__/fixtures/valid/lib/test-gem/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module TestGem
-  VERSION = '1.1.0'
+  VERSION = '1.2.1'
 end

data/sig/jwt_authenticable.rbs

@@ -1,4 +1,5 @@
 module JwtAuthenticable
   VERSION: String
+  SUPPORTED_ALGOS: Array[String]
   # See the writing guide of rbs: https://github.com/ruby/rbs#guides
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: researchable_jwt-authenticable
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.2.1
 platform: ruby
 authors:
 - Researchable
-autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-06-30 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dry-configurable
@@ -28,16 +27,22 @@ dependencies:
   name: jwt
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.6'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.6'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
 description: "    Researchable's JwtAuthenticable relies on Json Web Tokens to deal
   with authentication.\n"
 email:
@@ -67,12 +72,11 @@ files:
 - node_modules/semantic-release-rubygem/src/__tests__/fixtures/prerelease/lib/test-gem/version.rb
 - node_modules/semantic-release-rubygem/src/__tests__/fixtures/valid/lib/test-gem/version.rb
 - sig/jwt_authenticable.rbs
-homepage: https://gitlab.com/researchable/general/gems/jwt-authenticable/-/blob/v1.1.0/README.md
+homepage: https://gitlab.com/researchable/general/gems/jwt-authenticable/-/blob/v1.2.1/README.md
 licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'true'
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -87,8 +91,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.10
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Researchable's gem to deal with JWT authentication
 test_files: []