sorcery-jwt 0.1.13 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: adb4d9ffaf4afc6d3fcec35d9101b699d8985b5304c2767625781b0a8e76b8ac
-  data.tar.gz: 5281e03b1e243165b870433dea084976bf2955bd97d8ee3dcc8dea2904d459f6
+  metadata.gz: 0bda8036589ded6b4a9870c7b0bcae86e6e7a4a2c7a33e4541aba3ed0e6b13c5
+  data.tar.gz: cd0e7e47c7bd2b4a3a74e035c0e78a478beaf28d9b40d2d6dba353ae68fc0e9c
 SHA512:
-  metadata.gz: 410e26d8ac465776c84d9cbb5e84fdc266d7adefa87c6b1d97ad9ae7a542eb2b1c1dd820ecbdcceb6ee7c461883ce4d2bad47b322797ed8529c50a82c36956d5
-  data.tar.gz: '08f4afb85fa904eb01e5542d335f00baabcd1a331b3f0fb56f188844052ce2b98252ed54d4fa0f8b5ab37de53e8cc544e8509b42eb5413c2d7f0056b28aa702c'
+  metadata.gz: 7ae9d70d53abf1cc192b2c1d37d91e62c70b0c0f7c83ce1618ab794d85978295e1a48be02ecff17a49653649c1c3b98ec6ecec375d29c2fc639d5dd0eef5f7fd
+  data.tar.gz: d4ef75f3664bcf002ebf684e0ea5d78637de18856fad4996275592a23d19d189dc2bde5c82498ebc9082c8733b819ec13de530eba927d0d6ad5e841a6581f24d

data/.github/workflows/ci.yml

@@ -0,0 +1,23 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: ["3.2", "3.3", "3.4"]
+        sorcery: ["0.16.5", "0.17.0", "0.18.0"]
+    env:
+      BUNDLE_GEMFILE: gemfiles/sorcery_${{ matrix.sorcery }}.gemfile
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+      - run: bundle exec rspec

data/.gitignore

@@ -9,3 +9,4 @@
 
 # rspec failure tracking
 .rspec_status
+PLAN.md

data/.ruby-version

@@ -0,0 +1 @@
+3.4

data/CHANGELOG.md

@@ -0,0 +1,43 @@
+# Changelog
+
+## 0.2.1 (2026-09-03)
+
+### Changed
+
+- Supported sorcery range widened to `>= 0.16.5, < 0.19` (0.17 and 0.18
+  verified). Previously pinned `< 0.17`, which blocked installs alongside
+  current sorcery.
+- CI now runs a matrix: Ruby 3.2–3.4 × sorcery 0.16.5 / 0.17 / 0.18.
+
+## 0.2.0 (2026-09-03)
+
+### Security
+
+- **Fix auth bypass**: a validly-signed token without `id`/`email` claims hit
+  `find_by({})`, which returns the first user in the table. `login_from_jwt`
+  now rejects such tokens outright.
+- `login_from_jwt` now requires the token's `email` claim to match the
+  looked-up user's email.
+
+### Fixed
+
+- The model submodule now registers correctly on modern Rubies. The included
+  hook called `sorcery_config.class_eval` on a Config *instance*, which was
+  never a valid Ruby call; in applications, sorcery's `rescue NameError`
+  silently skipped the submodule, leaving `issue_token`/`decode_token`
+  undefined at runtime. The hook now uses `singleton_class.class_eval`.
+- Removed an `include InstanceMethods` reference to a module that never
+  existed (it resolved to sorcery's core `InstanceMethods` by accident).
+- `token_valid?` no longer depends on ActiveSupport (`.present?`).
+- Failed JWT authentication sets `@current_user` to `nil` (sorcery
+  convention) instead of `false`.
+
+### Added
+
+- Spec suite covering issuance, decoding, expiry, tamper rejection (wrong
+  secret/algorithm), the claim contract, and controller login paths.
+- CI via GitHub Actions.
+
+## 0.1.13 (2022-02-02)
+
+- Last release of the original series.

data/CODE_OF_CONDUCT.md

@@ -55,7 +55,7 @@ further defined and clarified by project maintainers.
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team at hluckenb@gmail.com. All
+reported by contacting the project team at . All
 complaints will be reviewed and investigated and will result in a response that
 is deemed necessary and appropriate to the circumstances. The project team is
 obligated to maintain confidentiality with regard to the reporter of an incident.

data/Gemfile.lock

@@ -1,64 +1,210 @@
 PATH
   remote: .
   specs:
-    sorcery-jwt (0.1.11)
+    sorcery-jwt (0.2.1)
       jwt (>= 1.0, < 3.0)
-      sorcery (>= 0.13, < 0.16)
+      sorcery (>= 0.16.5, < 0.19)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    bcrypt (3.1.16)
-    coderay (1.1.2)
-    diff-lcs (1.3)
-    faraday (1.0.1)
-      multipart-post (>= 1.2, < 3)
-    jwt (2.2.2)
-    method_source (0.8.2)
-    multi_json (1.15.0)
-    multi_xml (0.6.0)
-    multipart-post (2.1.1)
-    oauth (0.5.6)
-    oauth2 (1.4.4)
-      faraday (>= 0.8, < 2.0)
-      jwt (>= 1.0, < 3.0)
-      multi_json (~> 1.3)
+    actionpack (8.1.3.1)
+      actionview (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      nokogiri (>= 1.8.5)
+      rack (>= 2.2.4)
+      rack-session (>= 1.0.1)
+      rack-test (>= 0.6.3)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+      useragent (~> 0.16)
+    actionview (8.1.3.1)
+      activesupport (= 8.1.3.1)
+      builder (~> 3.1)
+      erubi (~> 1.11)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+    activesupport (8.1.3.1)
+      base64
+      bigdecimal
+      concurrent-ruby (~> 1.0, >= 1.3.1)
+      connection_pool (>= 2.2.5)
+      drb
+      i18n (>= 1.6, < 2)
+      json
+      logger (>= 1.4.2)
+      minitest (>= 5.1)
+      securerandom (>= 0.3)
+      tzinfo (~> 2.0, >= 2.0.5)
+      uri (>= 0.13.1)
+    anonymous_loader (0.1.3)
+      version_gem (~> 1.1, >= 1.1.14)
+    auth-sanitizer (0.2.3)
+      version_gem (~> 1.1, >= 1.1.14)
+    base64 (0.3.0)
+    bcrypt (3.1.22)
+    bigdecimal (4.1.2)
+    builder (3.3.0)
+    concurrent-ruby (1.3.8)
+    connection_pool (3.0.2)
+    crass (1.0.7)
+    diff-lcs (1.6.2)
+    drb (2.2.3)
+    erb (6.0.7)
+    erubi (1.13.1)
+    faraday (2.14.3)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-net_http (3.4.4)
+      net-http (~> 0.5)
+    hashie (5.1.0)
+      logger
+    i18n (1.15.2)
+      concurrent-ruby (~> 1.0)
+    io-console (0.9.2)
+    irb (1.18.0)
+      pp (>= 0.6.0)
+      prism (>= 1.3.0)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
+    json (2.21.2)
+    jwt (2.10.3)
+      base64
+    logger (1.7.0)
+    loofah (2.25.2)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.12.0)
+    minitest (6.0.6)
+      drb (~> 2.0)
+      prism (~> 1.5)
+    multi_xml (0.9.1)
+      bigdecimal (>= 3.1, < 5)
+    net-http (0.9.1)
+      uri (>= 0.11.1)
+    nokogiri (1.19.4-aarch64-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.4-aarch64-linux-musl)
+      racc (~> 1.4)
+    nokogiri (1.19.4-arm-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.4-arm-linux-musl)
+      racc (~> 1.4)
+    nokogiri (1.19.4-arm64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.19.4-x86_64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.19.4-x86_64-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.4-x86_64-linux-musl)
+      racc (~> 1.4)
+    oauth (1.1.8)
+      anonymous_loader (~> 0.1, >= 0.1.3)
+      auth-sanitizer (~> 0.2, >= 0.2.3)
+      base64 (~> 0.1)
+      oauth-tty (~> 1.0, >= 1.0.13)
+      snaky_hash (~> 2.0, >= 2.0.7)
+      version_gem (~> 1.1, >= 1.1.14)
+    oauth-tty (1.0.13)
+      anonymous_loader (~> 0.1, >= 0.1.3)
+      auth-sanitizer (~> 0.2, >= 0.2.3)
+      version_gem (~> 1.1, >= 1.1.14)
+    oauth2 (2.0.25)
+      anonymous_loader (~> 0.1, >= 0.1.3)
+      auth-sanitizer (~> 0.2, >= 0.2.3)
+      faraday (>= 0.17.3, < 4.0)
+      jwt (>= 1.0, < 4.0)
+      logger (~> 1.2)
       multi_xml (~> 0.5)
-      rack (>= 1.2, < 3)
-    pry (0.10.4)
-      coderay (~> 1.1.0)
-      method_source (~> 0.8.1)
-      slop (~> 3.4)
-    rack (2.2.3)
-    rake (13.0.1)
-    rspec (3.8.0)
-      rspec-core (~> 3.8.0)
-      rspec-expectations (~> 3.8.0)
-      rspec-mocks (~> 3.8.0)
-    rspec-core (3.8.0)
-      rspec-support (~> 3.8.0)
-    rspec-expectations (3.8.2)
+      rack (>= 1.2, < 4)
+      snaky_hash (~> 2.0, >= 2.0.7)
+      version_gem (~> 1.1, >= 1.1.14)
+    pp (0.6.4)
+      prettyprint
+    prettyprint (0.2.0)
+    prism (1.9.0)
+    racc (1.8.1)
+    rack (3.2.7)
+    rack-session (2.1.2)
+      base64 (>= 0.1.0)
+      rack (>= 3.0.0)
+    rack-test (2.2.0)
+      rack (>= 1.3)
+    rackup (2.3.1)
+      rack (>= 3)
+    rails-dom-testing (2.3.0)
+      activesupport (>= 5.0.0)
+      minitest
+      nokogiri (>= 1.6)
+    rails-html-sanitizer (1.7.1)
+      loofah (~> 2.25, >= 2.25.2)
+      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
+    railties (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      irb (~> 1.13)
+      rackup (>= 1.0.0)
+      rake (>= 12.2)
+      thor (~> 1.0, >= 1.2.2)
+      tsort (>= 0.2)
+      zeitwerk (~> 2.6)
+    rake (13.4.2)
+    rbs (4.2.0)
+      logger
+      prism (>= 1.6.0)
+      tsort
+    rdoc (8.0.0)
+      erb
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
+      tsort
+    reline (0.7.0)
+      io-console (~> 0.5)
+    rspec (3.13.2)
+      rspec-core (~> 3.13.0)
+      rspec-expectations (~> 3.13.0)
+      rspec-mocks (~> 3.13.0)
+    rspec-core (3.13.6)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.8.0)
-    rspec-mocks (3.8.0)
+      rspec-support (~> 3.13.0)
+    rspec-mocks (3.13.8)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.8.0)
-    rspec-support (3.8.0)
-    slop (3.6.0)
-    sorcery (0.15.0)
+      rspec-support (~> 3.13.0)
+    rspec-support (3.13.7)
+    securerandom (0.4.1)
+    snaky_hash (2.0.7)
+      hashie (>= 0.1.0, < 6)
+      version_gem (~> 1.1, >= 1.1.14)
+    sorcery (0.18.0)
       bcrypt (~> 3.1)
-      oauth (~> 0.4, >= 0.4.4)
-      oauth2 (~> 1.0, >= 0.8.0)
+      oauth (>= 0.6)
+      oauth2 (~> 2.0)
+      railties (>= 7.1)
+    thor (1.5.0)
+    tsort (0.2.0)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
+    uri (1.1.1)
+    useragent (0.16.11)
+    version_gem (1.1.15)
+    zeitwerk (2.8.3)
 
 PLATFORMS
-  ruby
+  aarch64-linux-gnu
+  aarch64-linux-musl
+  arm-linux-gnu
+  arm-linux-musl
+  arm64-darwin
+  x86_64-darwin
+  x86_64-linux-gnu
+  x86_64-linux-musl
 
 DEPENDENCIES
-  bundler (~> 1.16)
-  pry (~> 0.10.0)
   rake (~> 13.0)
   rspec (~> 3.0)
   sorcery-jwt!
 
 BUNDLED WITH
-   1.17.2
+   2.6.9

data/LICENSE.txt

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2018 Hayden Luckenbach
+Copyright (c) 2018 
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

data/lib/sorcery/controller/submodules/jwt.rb

@@ -11,13 +11,14 @@ module Sorcery
           protected
 
           def login_from_jwt
-            user = decoded_token.first.slice("id", "email")
+            claims = decoded_token.first.slice("id", "email")
+            return @current_user = nil if claims.empty?
 
-            @current_user = user_class.find_by(user)
+            @current_user = user_class.find_by(claims)
             auto_login(@current_user) if @current_user
             @current_user
           rescue JWT::DecodeError, JWT::ExpiredSignature
-            @current_user = false
+            @current_user = nil
           end
 
           def login_and_issue_token(*credentials)

data/lib/sorcery/jwt/version.rb

@@ -1,5 +1,5 @@
 module Sorcery
   module Jwt
-    VERSION = "0.1.13".freeze
+    VERSION = "0.2.1".freeze
   end
 end

data/lib/sorcery/model/submodules/jwt.rb

@@ -6,7 +6,9 @@ module Sorcery
     module Submodules
       module Jwt
         def self.included(base)
-          base.sorcery_config.class_eval do
+          # Define the jwt accessors on the config instance's singleton class;
+          # Config#class_eval is not a valid Ruby call.
+          base.sorcery_config.singleton_class.class_eval do
             # Secret used to encode JWTs. Should correspond to the type needed by the algorithm used.
             attr_accessor :jwt_secret
             # Type of the algorithm used to encode JWTs. Corresponds to the options available in jwt/ruby-jwt.
@@ -25,7 +27,6 @@ module Sorcery
           base.sorcery_config.after_config << :validate_secret_defined
 
           base.extend(ClassMethods)
-          base.send(:include, InstanceMethods)
         end
 
         module ClassMethods
@@ -39,7 +40,7 @@ module Sorcery
           end
 
           def token_valid?(token)
-            decode_token(token).present?
+            !!decode_token(token)
           rescue JWT::DecodeError, JWT::ExpiredSignature
             false
           end

data/mise.toml

@@ -0,0 +1,2 @@
+[tools]
+ruby = "3.4"

data/sorcery-jwt.gemspec

@@ -6,22 +6,18 @@ Gem::Specification.new do |spec|
   spec.name          = "sorcery-jwt"
   spec.version       = Sorcery::Jwt::VERSION
   spec.authors       = ["Hayden Luckenbach"]
-  spec.email         = ["hluckenb@gmail.com"]
 
   spec.summary       = "Jwt extension for the Sorcery authentication library"
-  spec.description   = ""
+  spec.description   = "Adds JWT issuance and authentication to the Sorcery " \
+                        "authentication library, for API-only Rails apps."
   spec.homepage      = "https://github.com/hayfever/sorcery-jwt"
   spec.license       = "MIT"
 
-  # Prevent pushing this gem to RubyGems.org. To allow pushes either set the
-  # 'allowed_push_host' to allow pushing to a single host or delete this section
-  # to allow pushing to any host.
-  # if spec.respond_to?(:metadata)
-  #   spec.metadata["allowed_push_host"] = "TODO: Set to 'http://mygemserver.com'"
-  # else
-  #   raise "RubyGems 2.0 or newer is required to protect against " \
-  #     "public gem pushes."
-  # end
+  spec.metadata["homepage_uri"] = spec.homepage
+  spec.metadata["source_code_uri"] = spec.homepage
+  spec.metadata["changelog_uri"] = "#{spec.homepage}/CHANGELOG.md"
+
+  spec.required_ruby_version = ">= 3.0"
 
   # Specify which files should be added to the gem when it is released.
   # The `git ls-files -z` loads the files in the RubyGem that have been
@@ -36,11 +32,9 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_development_dependency "bundler", ">= 2.1.0"
-  spec.add_development_dependency "pry", "~> 0.10.0"
   spec.add_development_dependency "rake", "~> 13.0"
   spec.add_development_dependency "rspec", "~> 3.0"
 
   spec.add_runtime_dependency "jwt", ">= 1.0", "< 3.0"
-  spec.add_runtime_dependency "sorcery", ">= 0.13", "< 0.17"
-end
+  spec.add_runtime_dependency "sorcery", ">= 0.16.5", "< 0.19"
+end

metadata

@@ -1,43 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sorcery-jwt
 version: !ruby/object:Gem::Version
-  version: 0.1.13
+  version: 0.2.1
 platform: ruby
 authors:
 - Hayden Luckenbach
-autorequire:
 bindir: exe
 cert_chain: []
-date: 2022-02-02 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: bundler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 2.1.0
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 2.1.0
-- !ruby/object:Gem::Dependency
-  name: pry
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.10.0
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.10.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -92,30 +63,31 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0.13'
+        version: 0.16.5
     - - "<"
       - !ruby/object:Gem::Version
-        version: '0.17'
+        version: '0.19'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0.13'
+        version: 0.16.5
     - - "<"
       - !ruby/object:Gem::Version
-        version: '0.17'
-description: ''
-email:
-- hluckenb@gmail.com
+        version: '0.19'
+description: Adds JWT issuance and authentication to the Sorcery authentication library,
+  for API-only Rails apps.
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/workflows/ci.yml"
 - ".gitignore"
 - ".rspec"
-- ".travis.yml"
+- ".ruby-version"
+- CHANGELOG.md
 - CODE_OF_CONDUCT.md
 - Gemfile
 - Gemfile.lock
@@ -128,12 +100,15 @@ files:
 - lib/sorcery/jwt.rb
 - lib/sorcery/jwt/version.rb
 - lib/sorcery/model/submodules/jwt.rb
+- mise.toml
 - sorcery-jwt.gemspec
 homepage: https://github.com/hayfever/sorcery-jwt
 licenses:
 - MIT
-metadata: {}
-post_install_message:
+metadata:
+  homepage_uri: https://github.com/hayfever/sorcery-jwt
+  source_code_uri: https://github.com/hayfever/sorcery-jwt
+  changelog_uri: https://github.com/hayfever/sorcery-jwt/CHANGELOG.md
 rdoc_options: []
 require_paths:
 - lib
@@ -141,15 +116,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '3.0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Jwt extension for the Sorcery authentication library
 test_files: []

data/.travis.yml

@@ -1,5 +0,0 @@
-sudo: false
-language: ruby
-rvm:
-  - 2.5.1
-before_install: gem install bundler -v 1.16.2