sorcery-jwt 0.1.13 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: adb4d9ffaf4afc6d3fcec35d9101b699d8985b5304c2767625781b0a8e76b8ac
-  data.tar.gz: 5281e03b1e243165b870433dea084976bf2955bd97d8ee3dcc8dea2904d459f6
+  metadata.gz: 06d8787815dcfcbf9652ed2a264e817bf5a0b7e9f411069ac8df1d8059826824
+  data.tar.gz: 9d51d9a8b2b516bfa0f3953e3fb6ba14947faa4c83405a7d2d02e734dd7efec0
 SHA512:
-  metadata.gz: 410e26d8ac465776c84d9cbb5e84fdc266d7adefa87c6b1d97ad9ae7a542eb2b1c1dd820ecbdcceb6ee7c461883ce4d2bad47b322797ed8529c50a82c36956d5
-  data.tar.gz: '08f4afb85fa904eb01e5542d335f00baabcd1a331b3f0fb56f188844052ce2b98252ed54d4fa0f8b5ab37de53e8cc544e8509b42eb5413c2d7f0056b28aa702c'
+  metadata.gz: 1cf6e7c1459975031eacc72405acc288a1de4396ee6c415862b475ad0bc2ec9fa3f164d17cec139960243c7eab913ad436cf55ecf06959e200d6d59d483d4bce
+  data.tar.gz: fe7ec5f7c97409b00d290a595315b5431fb6a1182d06e69053b5a065e1995d213732e4c730175c7a2ab7bf48068129aa05303f1ca700c33150dded768aab5538

data/.github/workflows/ci.yml

@@ -0,0 +1,16 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+      - run: bundle exec rspec

data/CHANGELOG.md

@@ -0,0 +1,34 @@
+# Changelog
+
+## 0.2.0 (2026-09-03)
+
+### Security
+
+- **Fix auth bypass**: a validly-signed token without `id`/`email` claims hit
+  `find_by({})`, which returns the first user in the table. `login_from_jwt`
+  now rejects such tokens outright.
+- `login_from_jwt` now requires the token's `email` claim to match the
+  looked-up user's email.
+
+### Fixed
+
+- The model submodule now registers correctly on modern Rubies. The included
+  hook called `sorcery_config.class_eval` on a Config *instance*, which was
+  never a valid Ruby call; in applications, sorcery's `rescue NameError`
+  silently skipped the submodule, leaving `issue_token`/`decode_token`
+  undefined at runtime. The hook now uses `singleton_class.class_eval`.
+- Removed an `include InstanceMethods` reference to a module that never
+  existed (it resolved to sorcery's core `InstanceMethods` by accident).
+- `token_valid?` no longer depends on ActiveSupport (`.present?`).
+- Failed JWT authentication sets `@current_user` to `nil` (sorcery
+  convention) instead of `false`.
+
+### Added
+
+- Spec suite covering issuance, decoding, expiry, tamper rejection (wrong
+  secret/algorithm), the claim contract, and controller login paths.
+- CI via GitHub Actions.
+
+## 0.1.13 (2022-02-02)
+
+- Last release of the original series.

data/CODE_OF_CONDUCT.md

@@ -55,7 +55,7 @@ further defined and clarified by project maintainers.
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team at hluckenb@gmail.com. All
+reported by contacting the project team at . All
 complaints will be reviewed and investigated and will result in a response that
 is deemed necessary and appropriate to the circumstances. The project team is
 obligated to maintain confidentiality with regard to the reporter of an incident.

data/Gemfile.lock

@@ -1,64 +1,91 @@
 PATH
   remote: .
   specs:
-    sorcery-jwt (0.1.11)
+    sorcery-jwt (0.2.0)
       jwt (>= 1.0, < 3.0)
-      sorcery (>= 0.13, < 0.16)
+      sorcery (>= 0.13, < 0.17)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    bcrypt (3.1.16)
-    coderay (1.1.2)
-    diff-lcs (1.3)
-    faraday (1.0.1)
-      multipart-post (>= 1.2, < 3)
-    jwt (2.2.2)
-    method_source (0.8.2)
-    multi_json (1.15.0)
-    multi_xml (0.6.0)
-    multipart-post (2.1.1)
-    oauth (0.5.6)
-    oauth2 (1.4.4)
-      faraday (>= 0.8, < 2.0)
-      jwt (>= 1.0, < 3.0)
-      multi_json (~> 1.3)
+    anonymous_loader (0.1.3)
+      version_gem (~> 1.1, >= 1.1.14)
+    auth-sanitizer (0.2.3)
+      version_gem (~> 1.1, >= 1.1.14)
+    base64 (0.3.0)
+    bcrypt (3.1.22)
+    bigdecimal (4.1.2)
+    diff-lcs (1.6.2)
+    faraday (2.14.3)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-net_http (3.4.4)
+      net-http (~> 0.5)
+    hashie (5.1.0)
+      logger
+    json (2.21.2)
+    jwt (2.10.3)
+      base64
+    logger (1.7.0)
+    multi_xml (0.9.1)
+      bigdecimal (>= 3.1, < 5)
+    net-http (0.9.1)
+      uri (>= 0.11.1)
+    oauth (1.1.8)
+      anonymous_loader (~> 0.1, >= 0.1.3)
+      auth-sanitizer (~> 0.2, >= 0.2.3)
+      base64 (~> 0.1)
+      oauth-tty (~> 1.0, >= 1.0.13)
+      snaky_hash (~> 2.0, >= 2.0.7)
+      version_gem (~> 1.1, >= 1.1.14)
+    oauth-tty (1.0.13)
+      anonymous_loader (~> 0.1, >= 0.1.3)
+      auth-sanitizer (~> 0.2, >= 0.2.3)
+      version_gem (~> 1.1, >= 1.1.14)
+    oauth2 (2.0.25)
+      anonymous_loader (~> 0.1, >= 0.1.3)
+      auth-sanitizer (~> 0.2, >= 0.2.3)
+      faraday (>= 0.17.3, < 4.0)
+      jwt (>= 1.0, < 4.0)
+      logger (~> 1.2)
       multi_xml (~> 0.5)
-      rack (>= 1.2, < 3)
-    pry (0.10.4)
-      coderay (~> 1.1.0)
-      method_source (~> 0.8.1)
-      slop (~> 3.4)
-    rack (2.2.3)
-    rake (13.0.1)
-    rspec (3.8.0)
-      rspec-core (~> 3.8.0)
-      rspec-expectations (~> 3.8.0)
-      rspec-mocks (~> 3.8.0)
-    rspec-core (3.8.0)
-      rspec-support (~> 3.8.0)
-    rspec-expectations (3.8.2)
+      rack (>= 1.2, < 4)
+      snaky_hash (~> 2.0, >= 2.0.7)
+      version_gem (~> 1.1, >= 1.1.14)
+    rack (3.2.7)
+    rake (13.4.2)
+    rspec (3.13.2)
+      rspec-core (~> 3.13.0)
+      rspec-expectations (~> 3.13.0)
+      rspec-mocks (~> 3.13.0)
+    rspec-core (3.13.6)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.8.0)
-    rspec-mocks (3.8.0)
+      rspec-support (~> 3.13.0)
+    rspec-mocks (3.13.8)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.8.0)
-    rspec-support (3.8.0)
-    slop (3.6.0)
-    sorcery (0.15.0)
+      rspec-support (~> 3.13.0)
+    rspec-support (3.13.7)
+    snaky_hash (2.0.7)
+      hashie (>= 0.1.0, < 6)
+      version_gem (~> 1.1, >= 1.1.14)
+    sorcery (0.16.5)
       bcrypt (~> 3.1)
-      oauth (~> 0.4, >= 0.4.4)
-      oauth2 (~> 1.0, >= 0.8.0)
+      oauth (>= 0.6)
+      oauth2 (~> 2.0)
+    uri (1.1.1)
+    version_gem (1.1.15)
 
 PLATFORMS
   ruby
+  x86_64-linux
 
 DEPENDENCIES
-  bundler (~> 1.16)
-  pry (~> 0.10.0)
   rake (~> 13.0)
   rspec (~> 3.0)
   sorcery-jwt!
 
 BUNDLED WITH
-   1.17.2
+   2.6.9

data/LICENSE.txt

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2018 Hayden Luckenbach
+Copyright (c) 2018 
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

data/PLAN.md

@@ -0,0 +1,94 @@
+# Sorcery::Jwt — Completion plan (1.0.0, no rewrite)
+
+Goal: ship 1.0.0 = the **existing API**, bug-fixed, tested, CI'd, compatible
+with current sorcery. No architectural changes. Everything that would break
+the public API is deferred (§5).
+
+Public API frozen as-is (from `0.1.13`):
+`issue_token(payload)` · `decode_token(token)` · `token_valid?(token)` ·
+`login_from_jwt` (login source) · `login_and_issue_token(*credentials)` ·
+token claims `id` + `email` · config: `jwt_secret`, `jwt_algorithm`,
+`session_expiry`.
+
+Current version `0.1.13`. Target `1.0.0`. Est. **~3 days**.
+
+---
+
+## Phase 0 — Environment & packaging  *(~0.5 day)*
+
+- [ ] Install Ruby 3.2+ (none on this machine).
+- [ ] Refresh `Gemfile.lock` on modern Bundler; drop `spec.add_development_dependency "bundler"`.
+- [ ] Fill gemspec: `authors`, `email`, `description`, `metadata[...]`
+      (`homepage_uri`, `source_code_uri`, `changelog_uri`).
+- [ ] Dependency check: gemspec allows `sorcery (>= 0.13, < 0.17)` and
+      `jwt (>= 1.0, < 3.0)`. Latest sorcery is **0.18.0** (Dec 2025, needs
+      Ruby ≥ 3.2). Plan: test 0.16.5 / 0.17 / 0.18, widen the range to what
+      CI proves. Keep `jwt < 3.0` unless 3.x is proven stable.
+
+## Phase 1 — Bug fixes, API unchanged  *(~0.5 day)*
+
+All fixes are in-place; no caller-visible changes except corrected behavior.
+
+- [ ] **Auth bypass** (`login_from_jwt`): `decoded_token.first.slice("id",
+      "email")` can be `{}` for a validly-signed token → `find_by({})`
+      returns the first user in the table. Fix: reject empty slice before
+      lookup (~2 lines). This is the only security-critical item.
+- [ ] `token_valid?`: `.present?` is an undeclared ActiveSupport dependency.
+      Replace with a plain truthy check; add spec proving it works without
+      ActiveSupport loaded.
+- [ ] Failed JWT login sets `@current_user = false` → `nil` (sorcery
+      convention).
+- [ ] Keep the `JWT::ExpiredSignature` rescue clause (redundant on jwt 2.x,
+      correct on 1.x — harmless either way).
+
+## Phase 2 — Test suite  *(~1 day, the long pole)*
+
+- [ ] PORO test doubles, not a dummy Rails app: stub `User#find_by` /
+      `authenticate`, fake controller with stubbed `request.headers`.
+      Time-box **half a day**; if sorcery's Model included-hook fights a
+      PORO, mirror sorcery's own spec helper pattern instead.
+- [ ] Specs (all public methods + failure modes):
+      - issue → decode round-trip; `exp` set and enforced
+      - wrong secret / wrong algorithm → rejected
+      - **missing claims → no login** (bypass regression test)
+      - valid sig, user not in DB → no login
+      - `token_valid?` without ActiveSupport
+      - `login_and_issue_token` bad credentials → nil, no `current_user`
+      - missing/malformed Authorization header → no login, no exception
+- [ ] **Ship `0.2.0`** here: tested + security fix for the existing user base
+      (95K downloads on 0.1.13), zero API break. Don't hold it for 1.0.
+
+## Phase 3 — Compat verification + CI  *(~0.5 day)*
+
+- [ ] Replace `.travis.yml` with GitHub Actions: `bundle exec rspec` on
+      Ruby 3.2 / 3.3 / 3.4 × sorcery 0.16.5 / 0.17 / 0.18 (or appraisal).
+- [ ] Fix whatever breaks on sorcery 0.17/0.18 (candidate:
+      `Config.login_sources` internals, `Time.now` usage).
+- [ ] Set final dependency ranges from what CI proves green.
+
+## Phase 4 — Docs + release  *(~0.5 day)*
+
+- [ ] README: claim contract (`id` + `email` required in payload), config
+      reference, security notes (no built-in revocation — link
+      waiting-for-dev revocation strategies), upstream note (sorcery v1
+      plans an official JWT plugin).
+- [ ] `CHANGELOG.md` 0.1.13 → 1.0.0: framing = same API, bugs fixed, suite +
+      CI added, current sorcery supported. No breaking changes from 0.1.13.
+- [ ] `bundle exec rake build`, install locally, smoke test.
+- [ ] Tag `v1.0.0`, `gem push` (hayfever owns the rubygems slot).
+
+---
+
+## 5. Explicitly deferred (API-breaking — out of scope for 1.0)
+
+From the earlier review; revisit only if upstream v1 stalls indefinitely:
+
+- `token_version` revocation (logout / password-change invalidation)
+- Refresh tokens with rotation + reuse detection
+- `sub` / `iat` / `jti` claims, `exp` leeway, email decoupling
+- `authenticate_from_token` encapsulation (decode contract stays as-is)
+
+Endgame note: upstream sorcery is active (commits through mid-2026, V1
+roadmap on main) and plans an official `sorcery-jwt` plugin for v1 — same
+gem name we own. After 1.0, talk to maintainers (history in
+sorcery-rework#9) about handover vs. parallel.

data/lib/sorcery/controller/submodules/jwt.rb

@@ -11,13 +11,14 @@ module Sorcery
           protected
 
           def login_from_jwt
-            user = decoded_token.first.slice("id", "email")
+            claims = decoded_token.first.slice("id", "email")
+            return @current_user = nil if claims.empty?
 
-            @current_user = user_class.find_by(user)
+            @current_user = user_class.find_by(claims)
             auto_login(@current_user) if @current_user
             @current_user
           rescue JWT::DecodeError, JWT::ExpiredSignature
-            @current_user = false
+            @current_user = nil
           end
 
           def login_and_issue_token(*credentials)

data/lib/sorcery/jwt/version.rb

@@ -1,5 +1,5 @@
 module Sorcery
   module Jwt
-    VERSION = "0.1.13".freeze
+    VERSION = "0.2.0".freeze
   end
 end

data/lib/sorcery/model/submodules/jwt.rb

@@ -6,7 +6,9 @@ module Sorcery
     module Submodules
       module Jwt
         def self.included(base)
-          base.sorcery_config.class_eval do
+          # Define the jwt accessors on the config instance's singleton class;
+          # Config#class_eval is not a valid Ruby call.
+          base.sorcery_config.singleton_class.class_eval do
             # Secret used to encode JWTs. Should correspond to the type needed by the algorithm used.
             attr_accessor :jwt_secret
             # Type of the algorithm used to encode JWTs. Corresponds to the options available in jwt/ruby-jwt.
@@ -25,7 +27,6 @@ module Sorcery
           base.sorcery_config.after_config << :validate_secret_defined
 
           base.extend(ClassMethods)
-          base.send(:include, InstanceMethods)
         end
 
         module ClassMethods
@@ -39,7 +40,7 @@ module Sorcery
           end
 
           def token_valid?(token)
-            decode_token(token).present?
+            !!decode_token(token)
           rescue JWT::DecodeError, JWT::ExpiredSignature
             false
           end

data/mise.toml

@@ -0,0 +1,2 @@
+[tools]
+ruby = "3.4"

data/sorcery-jwt.gemspec

@@ -6,22 +6,18 @@ Gem::Specification.new do |spec|
   spec.name          = "sorcery-jwt"
   spec.version       = Sorcery::Jwt::VERSION
   spec.authors       = ["Hayden Luckenbach"]
-  spec.email         = ["hluckenb@gmail.com"]
 
   spec.summary       = "Jwt extension for the Sorcery authentication library"
-  spec.description   = ""
+  spec.description   = "Adds JWT issuance and authentication to the Sorcery " \
+                        "authentication library, for API-only Rails apps."
   spec.homepage      = "https://github.com/hayfever/sorcery-jwt"
   spec.license       = "MIT"
 
-  # Prevent pushing this gem to RubyGems.org. To allow pushes either set the
-  # 'allowed_push_host' to allow pushing to a single host or delete this section
-  # to allow pushing to any host.
-  # if spec.respond_to?(:metadata)
-  #   spec.metadata["allowed_push_host"] = "TODO: Set to 'http://mygemserver.com'"
-  # else
-  #   raise "RubyGems 2.0 or newer is required to protect against " \
-  #     "public gem pushes."
-  # end
+  spec.metadata["homepage_uri"] = spec.homepage
+  spec.metadata["source_code_uri"] = spec.homepage
+  spec.metadata["changelog_uri"] = "#{spec.homepage}/CHANGELOG.md"
+
+  spec.required_ruby_version = ">= 3.0"
 
   # Specify which files should be added to the gem when it is released.
   # The `git ls-files -z` loads the files in the RubyGem that have been
@@ -36,11 +32,9 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_development_dependency "bundler", ">= 2.1.0"
-  spec.add_development_dependency "pry", "~> 0.10.0"
   spec.add_development_dependency "rake", "~> 13.0"
   spec.add_development_dependency "rspec", "~> 3.0"
 
   spec.add_runtime_dependency "jwt", ">= 1.0", "< 3.0"
   spec.add_runtime_dependency "sorcery", ">= 0.13", "< 0.17"
-end
+end

metadata

@@ -1,43 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sorcery-jwt
 version: !ruby/object:Gem::Version
-  version: 0.1.13
+  version: 0.2.0
 platform: ruby
 authors:
 - Hayden Luckenbach
-autorequire:
 bindir: exe
 cert_chain: []
-date: 2022-02-02 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: bundler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 2.1.0
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 2.1.0
-- !ruby/object:Gem::Dependency
-  name: pry
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.10.0
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.10.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -106,20 +77,21 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '0.17'
-description: ''
-email:
-- hluckenb@gmail.com
+description: Adds JWT issuance and authentication to the Sorcery authentication library,
+  for API-only Rails apps.
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/workflows/ci.yml"
 - ".gitignore"
 - ".rspec"
-- ".travis.yml"
+- CHANGELOG.md
 - CODE_OF_CONDUCT.md
 - Gemfile
 - Gemfile.lock
 - LICENSE.txt
+- PLAN.md
 - README.md
 - Rakefile
 - bin/console
@@ -128,12 +100,15 @@ files:
 - lib/sorcery/jwt.rb
 - lib/sorcery/jwt/version.rb
 - lib/sorcery/model/submodules/jwt.rb
+- mise.toml
 - sorcery-jwt.gemspec
 homepage: https://github.com/hayfever/sorcery-jwt
 licenses:
 - MIT
-metadata: {}
-post_install_message:
+metadata:
+  homepage_uri: https://github.com/hayfever/sorcery-jwt
+  source_code_uri: https://github.com/hayfever/sorcery-jwt
+  changelog_uri: https://github.com/hayfever/sorcery-jwt/CHANGELOG.md
 rdoc_options: []
 require_paths:
 - lib
@@ -141,15 +116,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '3.0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Jwt extension for the Sorcery authentication library
 test_files: []

data/.travis.yml

@@ -1,5 +0,0 @@
-sudo: false
-language: ruby
-rvm:
-  - 2.5.1
-before_install: gem install bundler -v 1.16.2