sorcery-jwt 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 06d8787815dcfcbf9652ed2a264e817bf5a0b7e9f411069ac8df1d8059826824
-  data.tar.gz: 9d51d9a8b2b516bfa0f3953e3fb6ba14947faa4c83405a7d2d02e734dd7efec0
+  metadata.gz: 0bda8036589ded6b4a9870c7b0bcae86e6e7a4a2c7a33e4541aba3ed0e6b13c5
+  data.tar.gz: cd0e7e47c7bd2b4a3a74e035c0e78a478beaf28d9b40d2d6dba353ae68fc0e9c
 SHA512:
-  metadata.gz: 1cf6e7c1459975031eacc72405acc288a1de4396ee6c415862b475ad0bc2ec9fa3f164d17cec139960243c7eab913ad436cf55ecf06959e200d6d59d483d4bce
-  data.tar.gz: fe7ec5f7c97409b00d290a595315b5431fb6a1182d06e69053b5a065e1995d213732e4c730175c7a2ab7bf48068129aa05303f1ca700c33150dded768aab5538
+  metadata.gz: 7ae9d70d53abf1cc192b2c1d37d91e62c70b0c0f7c83ce1618ab794d85978295e1a48be02ecff17a49653649c1c3b98ec6ecec375d29c2fc639d5dd0eef5f7fd
+  data.tar.gz: d4ef75f3664bcf002ebf684e0ea5d78637de18856fad4996275592a23d19d189dc2bde5c82498ebc9082c8733b819ec13de530eba927d0d6ad5e841a6581f24d

data/.github/workflows/ci.yml

@@ -7,10 +7,17 @@ on:
 jobs:
   test:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: ["3.2", "3.3", "3.4"]
+        sorcery: ["0.16.5", "0.17.0", "0.18.0"]
+    env:
+      BUNDLE_GEMFILE: gemfiles/sorcery_${{ matrix.sorcery }}.gemfile
     steps:
       - uses: actions/checkout@v4
       - uses: ruby/setup-ruby@v1
         with:
-          ruby-version: "3.4"
+          ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
       - run: bundle exec rspec

data/.gitignore

@@ -9,3 +9,4 @@
 
 # rspec failure tracking
 .rspec_status
+PLAN.md

data/.ruby-version

@@ -0,0 +1 @@
+3.4

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.2.1 (2026-09-03)
+
+### Changed
+
+- Supported sorcery range widened to `>= 0.16.5, < 0.19` (0.17 and 0.18
+  verified). Previously pinned `< 0.17`, which blocked installs alongside
+  current sorcery.
+- CI now runs a matrix: Ruby 3.2–3.4 × sorcery 0.16.5 / 0.17 / 0.18.
+
 ## 0.2.0 (2026-09-03)
 
 ### Security

data/Gemfile.lock

@@ -1,13 +1,42 @@
 PATH
   remote: .
   specs:
-    sorcery-jwt (0.2.0)
+    sorcery-jwt (0.2.1)
       jwt (>= 1.0, < 3.0)
-      sorcery (>= 0.13, < 0.17)
+      sorcery (>= 0.16.5, < 0.19)
 
 GEM
   remote: https://rubygems.org/
   specs:
+    actionpack (8.1.3.1)
+      actionview (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      nokogiri (>= 1.8.5)
+      rack (>= 2.2.4)
+      rack-session (>= 1.0.1)
+      rack-test (>= 0.6.3)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+      useragent (~> 0.16)
+    actionview (8.1.3.1)
+      activesupport (= 8.1.3.1)
+      builder (~> 3.1)
+      erubi (~> 1.11)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+    activesupport (8.1.3.1)
+      base64
+      bigdecimal
+      concurrent-ruby (~> 1.0, >= 1.3.1)
+      connection_pool (>= 2.2.5)
+      drb
+      i18n (>= 1.6, < 2)
+      json
+      logger (>= 1.4.2)
+      minitest (>= 5.1)
+      securerandom (>= 0.3)
+      tzinfo (~> 2.0, >= 2.0.5)
+      uri (>= 0.13.1)
     anonymous_loader (0.1.3)
       version_gem (~> 1.1, >= 1.1.14)
     auth-sanitizer (0.2.3)
@@ -15,7 +44,14 @@ GEM
     base64 (0.3.0)
     bcrypt (3.1.22)
     bigdecimal (4.1.2)
+    builder (3.3.0)
+    concurrent-ruby (1.3.8)
+    connection_pool (3.0.2)
+    crass (1.0.7)
     diff-lcs (1.6.2)
+    drb (2.2.3)
+    erb (6.0.7)
+    erubi (1.13.1)
     faraday (2.14.3)
       faraday-net_http (>= 2.0, < 3.5)
       json
@@ -24,14 +60,44 @@ GEM
       net-http (~> 0.5)
     hashie (5.1.0)
       logger
+    i18n (1.15.2)
+      concurrent-ruby (~> 1.0)
+    io-console (0.9.2)
+    irb (1.18.0)
+      pp (>= 0.6.0)
+      prism (>= 1.3.0)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
     json (2.21.2)
     jwt (2.10.3)
       base64
     logger (1.7.0)
+    loofah (2.25.2)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.12.0)
+    minitest (6.0.6)
+      drb (~> 2.0)
+      prism (~> 1.5)
     multi_xml (0.9.1)
       bigdecimal (>= 3.1, < 5)
     net-http (0.9.1)
       uri (>= 0.11.1)
+    nokogiri (1.19.4-aarch64-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.4-aarch64-linux-musl)
+      racc (~> 1.4)
+    nokogiri (1.19.4-arm-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.4-arm-linux-musl)
+      racc (~> 1.4)
+    nokogiri (1.19.4-arm64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.19.4-x86_64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.19.4-x86_64-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.4-x86_64-linux-musl)
+      racc (~> 1.4)
     oauth (1.1.8)
       anonymous_loader (~> 0.1, >= 0.1.3)
       auth-sanitizer (~> 0.2, >= 0.2.3)
@@ -53,8 +119,47 @@ GEM
       rack (>= 1.2, < 4)
       snaky_hash (~> 2.0, >= 2.0.7)
       version_gem (~> 1.1, >= 1.1.14)
+    pp (0.6.4)
+      prettyprint
+    prettyprint (0.2.0)
+    prism (1.9.0)
+    racc (1.8.1)
     rack (3.2.7)
+    rack-session (2.1.2)
+      base64 (>= 0.1.0)
+      rack (>= 3.0.0)
+    rack-test (2.2.0)
+      rack (>= 1.3)
+    rackup (2.3.1)
+      rack (>= 3)
+    rails-dom-testing (2.3.0)
+      activesupport (>= 5.0.0)
+      minitest
+      nokogiri (>= 1.6)
+    rails-html-sanitizer (1.7.1)
+      loofah (~> 2.25, >= 2.25.2)
+      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
+    railties (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      irb (~> 1.13)
+      rackup (>= 1.0.0)
+      rake (>= 12.2)
+      thor (~> 1.0, >= 1.2.2)
+      tsort (>= 0.2)
+      zeitwerk (~> 2.6)
     rake (13.4.2)
+    rbs (4.2.0)
+      logger
+      prism (>= 1.6.0)
+      tsort
+    rdoc (8.0.0)
+      erb
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
+      tsort
+    reline (0.7.0)
+      io-console (~> 0.5)
     rspec (3.13.2)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
@@ -68,19 +173,33 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
     rspec-support (3.13.7)
+    securerandom (0.4.1)
     snaky_hash (2.0.7)
       hashie (>= 0.1.0, < 6)
       version_gem (~> 1.1, >= 1.1.14)
-    sorcery (0.16.5)
+    sorcery (0.18.0)
       bcrypt (~> 3.1)
       oauth (>= 0.6)
       oauth2 (~> 2.0)
+      railties (>= 7.1)
+    thor (1.5.0)
+    tsort (0.2.0)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
     uri (1.1.1)
+    useragent (0.16.11)
     version_gem (1.1.15)
+    zeitwerk (2.8.3)
 
 PLATFORMS
-  ruby
-  x86_64-linux
+  aarch64-linux-gnu
+  aarch64-linux-musl
+  arm-linux-gnu
+  arm-linux-musl
+  arm64-darwin
+  x86_64-darwin
+  x86_64-linux-gnu
+  x86_64-linux-musl
 
 DEPENDENCIES
   rake (~> 13.0)

data/lib/sorcery/jwt/version.rb

@@ -1,5 +1,5 @@
 module Sorcery
   module Jwt
-    VERSION = "0.2.0".freeze
+    VERSION = "0.2.1".freeze
   end
 end

data/sorcery-jwt.gemspec

@@ -36,5 +36,5 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rspec", "~> 3.0"
 
   spec.add_runtime_dependency "jwt", ">= 1.0", "< 3.0"
-  spec.add_runtime_dependency "sorcery", ">= 0.13", "< 0.17"
+  spec.add_runtime_dependency "sorcery", ">= 0.16.5", "< 0.19"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sorcery-jwt
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Hayden Luckenbach
@@ -63,20 +63,20 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0.13'
+        version: 0.16.5
     - - "<"
       - !ruby/object:Gem::Version
-        version: '0.17'
+        version: '0.19'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0.13'
+        version: 0.16.5
     - - "<"
       - !ruby/object:Gem::Version
-        version: '0.17'
+        version: '0.19'
 description: Adds JWT issuance and authentication to the Sorcery authentication library,
   for API-only Rails apps.
 executables: []
@@ -86,12 +86,12 @@ files:
 - ".github/workflows/ci.yml"
 - ".gitignore"
 - ".rspec"
+- ".ruby-version"
 - CHANGELOG.md
 - CODE_OF_CONDUCT.md
 - Gemfile
 - Gemfile.lock
 - LICENSE.txt
-- PLAN.md
 - README.md
 - Rakefile
 - bin/console

data/PLAN.md

@@ -1,94 +0,0 @@
-# Sorcery::Jwt — Completion plan (1.0.0, no rewrite)
-
-Goal: ship 1.0.0 = the **existing API**, bug-fixed, tested, CI'd, compatible
-with current sorcery. No architectural changes. Everything that would break
-the public API is deferred (§5).
-
-Public API frozen as-is (from `0.1.13`):
-`issue_token(payload)` · `decode_token(token)` · `token_valid?(token)` ·
-`login_from_jwt` (login source) · `login_and_issue_token(*credentials)` ·
-token claims `id` + `email` · config: `jwt_secret`, `jwt_algorithm`,
-`session_expiry`.
-
-Current version `0.1.13`. Target `1.0.0`. Est. **~3 days**.
-
----
-
-## Phase 0 — Environment & packaging  *(~0.5 day)*
-
-- [ ] Install Ruby 3.2+ (none on this machine).
-- [ ] Refresh `Gemfile.lock` on modern Bundler; drop `spec.add_development_dependency "bundler"`.
-- [ ] Fill gemspec: `authors`, `email`, `description`, `metadata[...]`
-      (`homepage_uri`, `source_code_uri`, `changelog_uri`).
-- [ ] Dependency check: gemspec allows `sorcery (>= 0.13, < 0.17)` and
-      `jwt (>= 1.0, < 3.0)`. Latest sorcery is **0.18.0** (Dec 2025, needs
-      Ruby ≥ 3.2). Plan: test 0.16.5 / 0.17 / 0.18, widen the range to what
-      CI proves. Keep `jwt < 3.0` unless 3.x is proven stable.
-
-## Phase 1 — Bug fixes, API unchanged  *(~0.5 day)*
-
-All fixes are in-place; no caller-visible changes except corrected behavior.
-
-- [ ] **Auth bypass** (`login_from_jwt`): `decoded_token.first.slice("id",
-      "email")` can be `{}` for a validly-signed token → `find_by({})`
-      returns the first user in the table. Fix: reject empty slice before
-      lookup (~2 lines). This is the only security-critical item.
-- [ ] `token_valid?`: `.present?` is an undeclared ActiveSupport dependency.
-      Replace with a plain truthy check; add spec proving it works without
-      ActiveSupport loaded.
-- [ ] Failed JWT login sets `@current_user = false` → `nil` (sorcery
-      convention).
-- [ ] Keep the `JWT::ExpiredSignature` rescue clause (redundant on jwt 2.x,
-      correct on 1.x — harmless either way).
-
-## Phase 2 — Test suite  *(~1 day, the long pole)*
-
-- [ ] PORO test doubles, not a dummy Rails app: stub `User#find_by` /
-      `authenticate`, fake controller with stubbed `request.headers`.
-      Time-box **half a day**; if sorcery's Model included-hook fights a
-      PORO, mirror sorcery's own spec helper pattern instead.
-- [ ] Specs (all public methods + failure modes):
-      - issue → decode round-trip; `exp` set and enforced
-      - wrong secret / wrong algorithm → rejected
-      - **missing claims → no login** (bypass regression test)
-      - valid sig, user not in DB → no login
-      - `token_valid?` without ActiveSupport
-      - `login_and_issue_token` bad credentials → nil, no `current_user`
-      - missing/malformed Authorization header → no login, no exception
-- [ ] **Ship `0.2.0`** here: tested + security fix for the existing user base
-      (95K downloads on 0.1.13), zero API break. Don't hold it for 1.0.
-
-## Phase 3 — Compat verification + CI  *(~0.5 day)*
-
-- [ ] Replace `.travis.yml` with GitHub Actions: `bundle exec rspec` on
-      Ruby 3.2 / 3.3 / 3.4 × sorcery 0.16.5 / 0.17 / 0.18 (or appraisal).
-- [ ] Fix whatever breaks on sorcery 0.17/0.18 (candidate:
-      `Config.login_sources` internals, `Time.now` usage).
-- [ ] Set final dependency ranges from what CI proves green.
-
-## Phase 4 — Docs + release  *(~0.5 day)*
-
-- [ ] README: claim contract (`id` + `email` required in payload), config
-      reference, security notes (no built-in revocation — link
-      waiting-for-dev revocation strategies), upstream note (sorcery v1
-      plans an official JWT plugin).
-- [ ] `CHANGELOG.md` 0.1.13 → 1.0.0: framing = same API, bugs fixed, suite +
-      CI added, current sorcery supported. No breaking changes from 0.1.13.
-- [ ] `bundle exec rake build`, install locally, smoke test.
-- [ ] Tag `v1.0.0`, `gem push` (hayfever owns the rubygems slot).
-
----
-
-## 5. Explicitly deferred (API-breaking — out of scope for 1.0)
-
-From the earlier review; revisit only if upstream v1 stalls indefinitely:
-
-- `token_version` revocation (logout / password-change invalidation)
-- Refresh tokens with rotation + reuse detection
-- `sub` / `iat` / `jti` claims, `exp` leeway, email decoupling
-- `authenticate_from_token` encapsulation (decode contract stays as-is)
-
-Endgame note: upstream sorcery is active (commits through mid-2026, V1
-roadmap on main) and plans an official `sorcery-jwt` plugin for v1 — same
-gem name we own. After 1.0, talk to maintainers (history in
-sorcery-rework#9) about handover vs. parallel.