sorcery-jwt 0.2.0 → 1.0.0

data/gemfiles/sorcery_0.18.0.gemfile.lock

@@ -0,0 +1,307 @@
+PATH
+  remote: ..
+  specs:
+    sorcery-jwt (0.2.1)
+      jwt (>= 1.0, < 3.0)
+      sorcery (>= 0.16.5, < 0.19)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    action_text-trix (2.1.19)
+      railties
+    actioncable (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      nio4r (~> 2.0)
+      websocket-driver (>= 0.6.1)
+      zeitwerk (~> 2.6)
+    actionmailbox (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      mail (>= 2.8.0)
+    actionmailer (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      actionview (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      mail (>= 2.8.0)
+      rails-dom-testing (~> 2.2)
+    actionpack (8.1.3.1)
+      actionview (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      nokogiri (>= 1.8.5)
+      rack (>= 2.2.4)
+      rack-session (>= 1.0.1)
+      rack-test (>= 0.6.3)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+      useragent (~> 0.16)
+    actiontext (8.1.3.1)
+      action_text-trix (~> 2.1.15)
+      actionpack (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      globalid (>= 0.6.0)
+      nokogiri (>= 1.8.5)
+    actionview (8.1.3.1)
+      activesupport (= 8.1.3.1)
+      builder (~> 3.1)
+      erubi (~> 1.11)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+    activejob (8.1.3.1)
+      activesupport (= 8.1.3.1)
+      globalid (>= 0.3.6)
+    activemodel (8.1.3.1)
+      activesupport (= 8.1.3.1)
+    activerecord (8.1.3.1)
+      activemodel (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      timeout (>= 0.4.0)
+    activestorage (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      marcel (~> 1.0)
+    activesupport (8.1.3.1)
+      base64
+      bigdecimal
+      concurrent-ruby (~> 1.0, >= 1.3.1)
+      connection_pool (>= 2.2.5)
+      drb
+      i18n (>= 1.6, < 2)
+      json
+      logger (>= 1.4.2)
+      minitest (>= 5.1)
+      securerandom (>= 0.3)
+      tzinfo (~> 2.0, >= 2.0.5)
+      uri (>= 0.13.1)
+    anonymous_loader (0.1.3)
+      version_gem (~> 1.1, >= 1.1.14)
+    auth-sanitizer (0.2.3)
+      version_gem (~> 1.1, >= 1.1.14)
+    base64 (0.3.0)
+    bcrypt (3.1.22)
+    bigdecimal (4.1.2)
+    builder (3.3.0)
+    concurrent-ruby (1.3.8)
+    connection_pool (3.0.2)
+    crass (1.0.7)
+    date (3.5.1)
+    diff-lcs (1.6.2)
+    drb (2.2.3)
+    erb (6.0.7)
+    erubi (1.13.1)
+    faraday (2.14.3)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-net_http (3.4.4)
+      net-http (~> 0.5)
+    globalid (1.4.0)
+      activesupport (>= 6.1)
+    hashie (5.1.0)
+      logger
+    i18n (1.15.2)
+      concurrent-ruby (~> 1.0)
+    io-console (0.9.2)
+    irb (1.18.0)
+      pp (>= 0.6.0)
+      prism (>= 1.3.0)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
+    json (2.21.2)
+    jwt (2.10.3)
+      base64
+    logger (1.7.0)
+    loofah (2.25.2)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.12.0)
+    mail (2.9.1)
+      logger
+      mini_mime (>= 0.1.1)
+      net-imap
+      net-pop
+      net-smtp
+    marcel (1.2.1)
+    mini_mime (1.1.5)
+    minitest (6.0.6)
+      drb (~> 2.0)
+      prism (~> 1.5)
+    multi_xml (0.9.1)
+      bigdecimal (>= 3.1, < 5)
+    net-http (0.9.1)
+      uri (>= 0.11.1)
+    net-imap (0.6.6)
+      date
+      net-protocol
+    net-pop (0.1.2)
+      net-protocol
+    net-protocol (0.3.0)
+      timeout
+    net-smtp (0.5.1)
+      net-protocol
+    nio4r (2.7.5)
+    nokogiri (1.19.4-aarch64-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.4-aarch64-linux-musl)
+      racc (~> 1.4)
+    nokogiri (1.19.4-arm-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.4-arm-linux-musl)
+      racc (~> 1.4)
+    nokogiri (1.19.4-arm64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.19.4-x86_64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.19.4-x86_64-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.4-x86_64-linux-musl)
+      racc (~> 1.4)
+    oauth (1.1.8)
+      anonymous_loader (~> 0.1, >= 0.1.3)
+      auth-sanitizer (~> 0.2, >= 0.2.3)
+      base64 (~> 0.1)
+      oauth-tty (~> 1.0, >= 1.0.13)
+      snaky_hash (~> 2.0, >= 2.0.7)
+      version_gem (~> 1.1, >= 1.1.14)
+    oauth-tty (1.0.13)
+      anonymous_loader (~> 0.1, >= 0.1.3)
+      auth-sanitizer (~> 0.2, >= 0.2.3)
+      version_gem (~> 1.1, >= 1.1.14)
+    oauth2 (2.0.25)
+      anonymous_loader (~> 0.1, >= 0.1.3)
+      auth-sanitizer (~> 0.2, >= 0.2.3)
+      faraday (>= 0.17.3, < 4.0)
+      jwt (>= 1.0, < 4.0)
+      logger (~> 1.2)
+      multi_xml (~> 0.5)
+      rack (>= 1.2, < 4)
+      snaky_hash (~> 2.0, >= 2.0.7)
+      version_gem (~> 1.1, >= 1.1.14)
+    pp (0.6.4)
+      prettyprint
+    prettyprint (0.2.0)
+    prism (1.9.0)
+    racc (1.8.1)
+    rack (3.2.7)
+    rack-session (2.1.2)
+      base64 (>= 0.1.0)
+      rack (>= 3.0.0)
+    rack-test (2.2.0)
+      rack (>= 1.3)
+    rackup (2.3.1)
+      rack (>= 3)
+    rails (8.1.3.1)
+      actioncable (= 8.1.3.1)
+      actionmailbox (= 8.1.3.1)
+      actionmailer (= 8.1.3.1)
+      actionpack (= 8.1.3.1)
+      actiontext (= 8.1.3.1)
+      actionview (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activemodel (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      bundler (>= 1.15.0)
+      railties (= 8.1.3.1)
+    rails-dom-testing (2.3.0)
+      activesupport (>= 5.0.0)
+      minitest
+      nokogiri (>= 1.6)
+    rails-html-sanitizer (1.7.1)
+      loofah (~> 2.25, >= 2.25.2)
+      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
+    railties (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      irb (~> 1.13)
+      rackup (>= 1.0.0)
+      rake (>= 12.2)
+      thor (~> 1.0, >= 1.2.2)
+      tsort (>= 0.2)
+      zeitwerk (~> 2.6)
+    rake (13.4.2)
+    rbs (4.2.0)
+      logger
+      prism (>= 1.6.0)
+      tsort
+    rdoc (8.0.0)
+      erb
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
+      tsort
+    reline (0.7.0)
+      io-console (~> 0.5)
+    rspec (3.13.2)
+      rspec-core (~> 3.13.0)
+      rspec-expectations (~> 3.13.0)
+      rspec-mocks (~> 3.13.0)
+    rspec-core (3.13.6)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.5)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.13.0)
+    rspec-mocks (3.13.8)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.13.0)
+    rspec-support (3.13.7)
+    securerandom (0.4.1)
+    snaky_hash (2.0.7)
+      hashie (>= 0.1.0, < 6)
+      version_gem (~> 1.1, >= 1.1.14)
+    sorcery (0.18.0)
+      bcrypt (~> 3.1)
+      oauth (>= 0.6)
+      oauth2 (~> 2.0)
+      railties (>= 7.1)
+    sqlite3 (2.9.6-aarch64-linux-gnu)
+    sqlite3 (2.9.6-aarch64-linux-musl)
+    sqlite3 (2.9.6-arm-linux-gnu)
+    sqlite3 (2.9.6-arm-linux-musl)
+    sqlite3 (2.9.6-arm64-darwin)
+    sqlite3 (2.9.6-x86_64-darwin)
+    sqlite3 (2.9.6-x86_64-linux-gnu)
+    sqlite3 (2.9.6-x86_64-linux-musl)
+    thor (1.5.0)
+    timeout (0.6.1)
+    tsort (0.2.0)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
+    uri (1.1.1)
+    useragent (0.16.11)
+    version_gem (1.1.15)
+    websocket-driver (0.8.2)
+      base64
+      websocket-extensions (>= 0.1.0)
+    websocket-extensions (0.1.5)
+    zeitwerk (2.8.3)
+
+PLATFORMS
+  aarch64-linux-gnu
+  aarch64-linux-musl
+  arm-linux-gnu
+  arm-linux-musl
+  arm64-darwin
+  x86_64-darwin
+  x86_64-linux-gnu
+  x86_64-linux-musl
+
+DEPENDENCIES
+  activerecord (~> 8.0)
+  rails (~> 8.0)
+  rake (~> 13.0)
+  rspec (~> 3.0)
+  sorcery (= 0.18.0)
+  sorcery-jwt!
+  sqlite3 (~> 2.0)
+
+BUNDLED WITH
+   2.6.9

data/lib/sorcery/controller/submodules/jwt.rb

@@ -10,6 +10,9 @@ module Sorcery
         module InstanceMethods
           protected
 
+          # A sorcery login source: authenticates the request from the
+          # Authorization header when it carries a validly signed, unexpired
+          # JWT whose id and email claims match a user.
           def login_from_jwt
             claims = decoded_token.first.slice("id", "email")
             return @current_user = nil if claims.empty?
@@ -21,6 +24,10 @@ module Sorcery
             @current_user = nil
           end
 
+          # Authenticates credentials via sorcery and, on success, issues a
+          # JWT for the user carrying its id and email claims.
+          #
+          # @return [String, nil] the JWT, or nil when credentials fail
           def login_and_issue_token(*credentials)
             return unless (user = user_class.authenticate(*credentials))
 

data/lib/sorcery/jwt/version.rb

@@ -1,5 +1,5 @@
 module Sorcery
   module Jwt
-    VERSION = "0.2.0".freeze
+    VERSION = "1.0.0".freeze
   end
 end

data/lib/sorcery/model/submodules/jwt.rb

@@ -15,11 +15,14 @@ module Sorcery
             attr_accessor :jwt_algorithm
             # How long the session should be valid for in seconds. Will be set as the exp claim in the token.
             attr_accessor :session_expiry
+            # Clock-skew tolerance in seconds applied when verifying exp. nil disables leeway.
+            attr_accessor :exp_leeway
           end
 
           base.sorcery_config.instance_eval do
             @defaults[:@jwt_algorithm] = "HS256"
             @defaults[:@session_expiry] = 60 * 60 * 24 * 7 * 2 # 2 weeks
+            @defaults[:@exp_leeway] = nil
 
             reset!
           end
@@ -30,15 +33,33 @@ module Sorcery
         end
 
         module ClassMethods
+          # Encodes a JWT for a user, adding the exp and iat claims.
+          # Any claim in the payload except exp and iat is preserved.
+          #
+          # @param payload [Hash] claims to encode; must include "id" and "email"
+          #   for the token to authenticate via the controller submodule
+          # @return [String] the signed JWT
           def issue_token(payload)
-            exp_payload = payload.merge(exp: Time.now.to_i + @sorcery_config.session_expiry)
+            now = Time.now.to_i
+            exp_payload = payload.merge(iat: now, exp: now + @sorcery_config.session_expiry)
             JWT.encode(exp_payload, @sorcery_config.jwt_secret, @sorcery_config.jwt_algorithm)
           end
 
+          # Decodes and verifies a JWT with the configured secret and algorithm.
+          #
+          # @param token [String, nil] the JWT
+          # @return [Array<(Hash, Hash)>] payload and header, as returned by jwt
+          # @raise [JWT::DecodeError] if the signature, algorithm, or exp fail
           def decode_token(token)
-            JWT.decode(token, @sorcery_config.jwt_secret, true, algorithm: @sorcery_config.jwt_algorithm)
+            options = { algorithm: @sorcery_config.jwt_algorithm }
+            options[:exp_leeway] = @sorcery_config.exp_leeway if @sorcery_config.exp_leeway
+            JWT.decode(token, @sorcery_config.jwt_secret, true, options)
           end
 
+          # Returns whether a JWT is validly signed and unexpired.
+          #
+          # @param token [String, nil]
+          # @return [Boolean]
           def token_valid?(token)
             !!decode_token(token)
           rescue JWT::DecodeError, JWT::ExpiredSignature

data/sorcery-jwt.gemspec

@@ -16,6 +16,8 @@ Gem::Specification.new do |spec|
   spec.metadata["homepage_uri"] = spec.homepage
   spec.metadata["source_code_uri"] = spec.homepage
   spec.metadata["changelog_uri"] = "#{spec.homepage}/CHANGELOG.md"
+  spec.metadata["bug_tracker_uri"] = "#{spec.homepage}/issues"
+  spec.metadata["rubygems_mfa_required"] = "true"
 
   spec.required_ruby_version = ">= 3.0"
 
@@ -32,9 +34,12 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
+  spec.add_development_dependency "activerecord", "~> 8.0"
+  spec.add_development_dependency "rails", "~> 8.0"
   spec.add_development_dependency "rake", "~> 13.0"
   spec.add_development_dependency "rspec", "~> 3.0"
+  spec.add_development_dependency "sqlite3", "~> 2.0"
 
   spec.add_runtime_dependency "jwt", ">= 1.0", "< 3.0"
-  spec.add_runtime_dependency "sorcery", ">= 0.13", "< 0.17"
+  spec.add_runtime_dependency "sorcery", ">= 0.16.5", "< 0.19"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sorcery-jwt
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 1.0.0
 platform: ruby
 authors:
 - Hayden Luckenbach
@@ -9,6 +9,34 @@ bindir: exe
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: activerecord
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '8.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '8.0'
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '8.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '8.0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -37,6 +65,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: sqlite3
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: jwt
   requirement: !ruby/object:Gem::Requirement
@@ -63,20 +105,20 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0.13'
+        version: 0.16.5
     - - "<"
       - !ruby/object:Gem::Version
-        version: '0.17'
+        version: '0.19'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0.13'
+        version: 0.16.5
     - - "<"
       - !ruby/object:Gem::Version
-        version: '0.17'
+        version: '0.19'
 description: Adds JWT issuance and authentication to the Sorcery authentication library,
   for API-only Rails apps.
 executables: []
@@ -86,16 +128,22 @@ files:
 - ".github/workflows/ci.yml"
 - ".gitignore"
 - ".rspec"
+- ".ruby-version"
 - CHANGELOG.md
 - CODE_OF_CONDUCT.md
 - Gemfile
 - Gemfile.lock
 - LICENSE.txt
-- PLAN.md
 - README.md
 - Rakefile
 - bin/console
 - bin/setup
+- gemfiles/sorcery_0.16.5.gemfile
+- gemfiles/sorcery_0.16.5.gemfile.lock
+- gemfiles/sorcery_0.17.0.gemfile
+- gemfiles/sorcery_0.17.0.gemfile.lock
+- gemfiles/sorcery_0.18.0.gemfile
+- gemfiles/sorcery_0.18.0.gemfile.lock
 - lib/sorcery/controller/submodules/jwt.rb
 - lib/sorcery/jwt.rb
 - lib/sorcery/jwt/version.rb
@@ -109,6 +157,8 @@ metadata:
   homepage_uri: https://github.com/hayfever/sorcery-jwt
   source_code_uri: https://github.com/hayfever/sorcery-jwt
   changelog_uri: https://github.com/hayfever/sorcery-jwt/CHANGELOG.md
+  bug_tracker_uri: https://github.com/hayfever/sorcery-jwt/issues
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib

data/PLAN.md

@@ -1,94 +0,0 @@
-# Sorcery::Jwt — Completion plan (1.0.0, no rewrite)
-
-Goal: ship 1.0.0 = the **existing API**, bug-fixed, tested, CI'd, compatible
-with current sorcery. No architectural changes. Everything that would break
-the public API is deferred (§5).
-
-Public API frozen as-is (from `0.1.13`):
-`issue_token(payload)` · `decode_token(token)` · `token_valid?(token)` ·
-`login_from_jwt` (login source) · `login_and_issue_token(*credentials)` ·
-token claims `id` + `email` · config: `jwt_secret`, `jwt_algorithm`,
-`session_expiry`.
-
-Current version `0.1.13`. Target `1.0.0`. Est. **~3 days**.
-
----
-
-## Phase 0 — Environment & packaging  *(~0.5 day)*
-
-- [ ] Install Ruby 3.2+ (none on this machine).
-- [ ] Refresh `Gemfile.lock` on modern Bundler; drop `spec.add_development_dependency "bundler"`.
-- [ ] Fill gemspec: `authors`, `email`, `description`, `metadata[...]`
-      (`homepage_uri`, `source_code_uri`, `changelog_uri`).
-- [ ] Dependency check: gemspec allows `sorcery (>= 0.13, < 0.17)` and
-      `jwt (>= 1.0, < 3.0)`. Latest sorcery is **0.18.0** (Dec 2025, needs
-      Ruby ≥ 3.2). Plan: test 0.16.5 / 0.17 / 0.18, widen the range to what
-      CI proves. Keep `jwt < 3.0` unless 3.x is proven stable.
-
-## Phase 1 — Bug fixes, API unchanged  *(~0.5 day)*
-
-All fixes are in-place; no caller-visible changes except corrected behavior.
-
-- [ ] **Auth bypass** (`login_from_jwt`): `decoded_token.first.slice("id",
-      "email")` can be `{}` for a validly-signed token → `find_by({})`
-      returns the first user in the table. Fix: reject empty slice before
-      lookup (~2 lines). This is the only security-critical item.
-- [ ] `token_valid?`: `.present?` is an undeclared ActiveSupport dependency.
-      Replace with a plain truthy check; add spec proving it works without
-      ActiveSupport loaded.
-- [ ] Failed JWT login sets `@current_user = false` → `nil` (sorcery
-      convention).
-- [ ] Keep the `JWT::ExpiredSignature` rescue clause (redundant on jwt 2.x,
-      correct on 1.x — harmless either way).
-
-## Phase 2 — Test suite  *(~1 day, the long pole)*
-
-- [ ] PORO test doubles, not a dummy Rails app: stub `User#find_by` /
-      `authenticate`, fake controller with stubbed `request.headers`.
-      Time-box **half a day**; if sorcery's Model included-hook fights a
-      PORO, mirror sorcery's own spec helper pattern instead.
-- [ ] Specs (all public methods + failure modes):
-      - issue → decode round-trip; `exp` set and enforced
-      - wrong secret / wrong algorithm → rejected
-      - **missing claims → no login** (bypass regression test)
-      - valid sig, user not in DB → no login
-      - `token_valid?` without ActiveSupport
-      - `login_and_issue_token` bad credentials → nil, no `current_user`
-      - missing/malformed Authorization header → no login, no exception
-- [ ] **Ship `0.2.0`** here: tested + security fix for the existing user base
-      (95K downloads on 0.1.13), zero API break. Don't hold it for 1.0.
-
-## Phase 3 — Compat verification + CI  *(~0.5 day)*
-
-- [ ] Replace `.travis.yml` with GitHub Actions: `bundle exec rspec` on
-      Ruby 3.2 / 3.3 / 3.4 × sorcery 0.16.5 / 0.17 / 0.18 (or appraisal).
-- [ ] Fix whatever breaks on sorcery 0.17/0.18 (candidate:
-      `Config.login_sources` internals, `Time.now` usage).
-- [ ] Set final dependency ranges from what CI proves green.
-
-## Phase 4 — Docs + release  *(~0.5 day)*
-
-- [ ] README: claim contract (`id` + `email` required in payload), config
-      reference, security notes (no built-in revocation — link
-      waiting-for-dev revocation strategies), upstream note (sorcery v1
-      plans an official JWT plugin).
-- [ ] `CHANGELOG.md` 0.1.13 → 1.0.0: framing = same API, bugs fixed, suite +
-      CI added, current sorcery supported. No breaking changes from 0.1.13.
-- [ ] `bundle exec rake build`, install locally, smoke test.
-- [ ] Tag `v1.0.0`, `gem push` (hayfever owns the rubygems slot).
-
----
-
-## 5. Explicitly deferred (API-breaking — out of scope for 1.0)
-
-From the earlier review; revisit only if upstream v1 stalls indefinitely:
-
-- `token_version` revocation (logout / password-change invalidation)
-- Refresh tokens with rotation + reuse detection
-- `sub` / `iat` / `jti` claims, `exp` leeway, email decoupling
-- `authenticate_from_token` encapsulation (decode contract stays as-is)
-
-Endgame note: upstream sorcery is active (commits through mid-2026, V1
-roadmap on main) and plans an official `sorcery-jwt` plugin for v1 — same
-gem name we own. After 1.0, talk to maintainers (history in
-sorcery-rework#9) about handover vs. parallel.