sorcery-jwt 0.2.1 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0bda8036589ded6b4a9870c7b0bcae86e6e7a4a2c7a33e4541aba3ed0e6b13c5
-  data.tar.gz: cd0e7e47c7bd2b4a3a74e035c0e78a478beaf28d9b40d2d6dba353ae68fc0e9c
+  metadata.gz: f3291049e9e9a71c2160d00cbc1d83d574e2fcf17d37e93f915f7dd1a71f0d1e
+  data.tar.gz: d89a4edc63c58948f8b8382827f9e9a96e5644df46c5740909197ab70dee456e
 SHA512:
-  metadata.gz: 7ae9d70d53abf1cc192b2c1d37d91e62c70b0c0f7c83ce1618ab794d85978295e1a48be02ecff17a49653649c1c3b98ec6ecec375d29c2fc639d5dd0eef5f7fd
-  data.tar.gz: d4ef75f3664bcf002ebf684e0ea5d78637de18856fad4996275592a23d19d189dc2bde5c82498ebc9082c8733b819ec13de530eba927d0d6ad5e841a6581f24d
+  metadata.gz: d8e54c1b75b564bf861734cc3cd289237a92288e1adbe9190de1b7349ef180d9592c659aa6cd443ac4fa2f342a0a8e6011e37f0a3b1cff99c3e5842ba394fcaa
+  data.tar.gz: 2b7ad9a0a38719960a50602520e7bb5d109980d2bf520577d6620688b99b7389e444df2e9c3630ae060fa8badbb3cf5a8d8b743fdceb6b644252e408d4cacea2

data/.github/workflows/ci.yml

@@ -13,11 +13,11 @@ jobs:
         ruby: ["3.2", "3.3", "3.4"]
         sorcery: ["0.16.5", "0.17.0", "0.18.0"]
     env:
-      BUNDLE_GEMFILE: gemfiles/sorcery_${{ matrix.sorcery }}.gemfile
+      BUNDLE_GEMFILE: ${{ github.workspace }}/gemfiles/sorcery_${{ matrix.sorcery }}.gemfile
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ruby/setup-ruby@v1
         with:
           ruby-version: ${{ matrix.ruby }}
-          bundler-cache: true
+      - run: bundle install
       - run: bundle exec rspec

data/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 1.0.0 (2026-09-03)
+
+First stable release. The public API is identical to 0.1.x — tokens issued
+by earlier versions remain valid; no forced re-login.
+
+### Added
+
+- `exp_leeway` config: optional clock-skew tolerance (seconds) applied when
+  verifying `exp`. Default nil (previous behavior).
+- `iat` claim on issued tokens.
+- Integration spec exercising the real sorcery include path
+  (`authenticates_with_sorcery!`) — the path where failures were previously
+  swallowed silently by sorcery's `rescue NameError`.
+- Yard documentation for the public API; README rewritten (claim contract,
+  security notes, upgrade guide, tested matrix).
+
 ## 0.2.1 (2026-09-03)
 
 ### Changed

data/Gemfile.lock

@@ -1,13 +1,35 @@
 PATH
   remote: .
   specs:
-    sorcery-jwt (0.2.1)
+    sorcery-jwt (1.0.0)
       jwt (>= 1.0, < 3.0)
       sorcery (>= 0.16.5, < 0.19)
 
 GEM
   remote: https://rubygems.org/
   specs:
+    action_text-trix (2.1.19)
+      railties
+    actioncable (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      nio4r (~> 2.0)
+      websocket-driver (>= 0.6.1)
+      zeitwerk (~> 2.6)
+    actionmailbox (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      mail (>= 2.8.0)
+    actionmailer (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      actionview (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      mail (>= 2.8.0)
+      rails-dom-testing (~> 2.2)
     actionpack (8.1.3.1)
       actionview (= 8.1.3.1)
       activesupport (= 8.1.3.1)
@@ -18,12 +40,35 @@ GEM
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
       useragent (~> 0.16)
+    actiontext (8.1.3.1)
+      action_text-trix (~> 2.1.15)
+      actionpack (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      globalid (>= 0.6.0)
+      nokogiri (>= 1.8.5)
     actionview (8.1.3.1)
       activesupport (= 8.1.3.1)
       builder (~> 3.1)
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
+    activejob (8.1.3.1)
+      activesupport (= 8.1.3.1)
+      globalid (>= 0.3.6)
+    activemodel (8.1.3.1)
+      activesupport (= 8.1.3.1)
+    activerecord (8.1.3.1)
+      activemodel (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      timeout (>= 0.4.0)
+    activestorage (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      marcel (~> 1.0)
     activesupport (8.1.3.1)
       base64
       bigdecimal
@@ -48,6 +93,7 @@ GEM
     concurrent-ruby (1.3.8)
     connection_pool (3.0.2)
     crass (1.0.7)
+    date (3.5.1)
     diff-lcs (1.6.2)
     drb (2.2.3)
     erb (6.0.7)
@@ -58,6 +104,8 @@ GEM
       logger
     faraday-net_http (3.4.4)
       net-http (~> 0.5)
+    globalid (1.4.0)
+      activesupport (>= 6.1)
     hashie (5.1.0)
       logger
     i18n (1.15.2)
@@ -75,6 +123,14 @@ GEM
     loofah (2.25.2)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
+    mail (2.9.1)
+      logger
+      mini_mime (>= 0.1.1)
+      net-imap
+      net-pop
+      net-smtp
+    marcel (1.2.1)
+    mini_mime (1.1.5)
     minitest (6.0.6)
       drb (~> 2.0)
       prism (~> 1.5)
@@ -82,6 +138,16 @@ GEM
       bigdecimal (>= 3.1, < 5)
     net-http (0.9.1)
       uri (>= 0.11.1)
+    net-imap (0.6.6)
+      date
+      net-protocol
+    net-pop (0.1.2)
+      net-protocol
+    net-protocol (0.3.0)
+      timeout
+    net-smtp (0.5.1)
+      net-protocol
+    nio4r (2.7.5)
     nokogiri (1.19.4-aarch64-linux-gnu)
       racc (~> 1.4)
     nokogiri (1.19.4-aarch64-linux-musl)
@@ -132,6 +198,20 @@ GEM
       rack (>= 1.3)
     rackup (2.3.1)
       rack (>= 3)
+    rails (8.1.3.1)
+      actioncable (= 8.1.3.1)
+      actionmailbox (= 8.1.3.1)
+      actionmailer (= 8.1.3.1)
+      actionpack (= 8.1.3.1)
+      actiontext (= 8.1.3.1)
+      actionview (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activemodel (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      bundler (>= 1.15.0)
+      railties (= 8.1.3.1)
     rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
@@ -182,13 +262,26 @@ GEM
       oauth (>= 0.6)
       oauth2 (~> 2.0)
       railties (>= 7.1)
+    sqlite3 (2.9.6-aarch64-linux-gnu)
+    sqlite3 (2.9.6-aarch64-linux-musl)
+    sqlite3 (2.9.6-arm-linux-gnu)
+    sqlite3 (2.9.6-arm-linux-musl)
+    sqlite3 (2.9.6-arm64-darwin)
+    sqlite3 (2.9.6-x86_64-darwin)
+    sqlite3 (2.9.6-x86_64-linux-gnu)
+    sqlite3 (2.9.6-x86_64-linux-musl)
     thor (1.5.0)
+    timeout (0.6.1)
     tsort (0.2.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     uri (1.1.1)
     useragent (0.16.11)
     version_gem (1.1.15)
+    websocket-driver (0.8.2)
+      base64
+      websocket-extensions (>= 0.1.0)
+    websocket-extensions (0.1.5)
     zeitwerk (2.8.3)
 
 PLATFORMS
@@ -202,9 +295,12 @@ PLATFORMS
   x86_64-linux-musl
 
 DEPENDENCIES
+  activerecord (~> 8.0)
+  rails (~> 8.0)
   rake (~> 13.0)
   rspec (~> 3.0)
   sorcery-jwt!
+  sqlite3 (~> 2.0)
 
 BUNDLED WITH
    2.6.9

data/README.md

@@ -1,82 +1,132 @@
 # Sorcery::Jwt
 
-Jwt extension for the Sorcery authentication library
+[![CI](https://github.com/hayfever/sorcery-jwt/actions/workflows/ci.yml/badge.svg)](https://github.com/hayfever/sorcery-jwt/actions)
+[![Gem Version](https://badge.fury.io/rb/sorcery-jwt.svg)](https://rubygems.org/gems/sorcery-jwt)
 
-# NOTE: Sorcery v1 is being developed and JWT is being implemented as a core plugin. See https://github.com/Sorcery/sorcery-rework/issues/9 for more.
+Jwt extension for the [Sorcery](https://github.com/Sorcery/sorcery) authentication
+library, for API-only Rails apps.
+
+> **NOTE:** Sorcery v1 is being developed and JWT is planned as a core plugin.
+> See https://github.com/Sorcery/sorcery-rework/issues/9. This gem targets the
+> current (0.16–0.18) sorcery line.
 
 ## Installation
 
 Add this line to your application's Gemfile:
 
 ```ruby
-gem 'sorcery-jwt'
+gem "sorcery-jwt"
 ```
 
 And then execute:
 
     $ bundle
 
-Or install it yourself as:
-
-    $ gem install sorcery-jwt
-
 ## Usage
 
 First, include the `:jwt` submodule in your list of configured Sorcery submodules:
 
-```
+```ruby
 Rails.application.config.sorcery.submodules = [:jwt, ...]
 ```
 
-Next, in the Sorcery `user_config`, set the secret and algorithm that will be used to sign your tokens. You can also set length of time in seconds that the token will be valid for. Note that this is configured separately from the `:session_timeout` submodule.
+Next, in the Sorcery `user_config`, set the secret and algorithm used to sign
+tokens, the token lifetime in seconds, and (optionally) clock-skew tolerance:
 
-```
+```ruby
 Rails.application.config.sorcery.configure do |config|
   # ...
   config.user_config do |user|
-    # ...
-    user.jwt_secret = Rails.application.secrets.secret_key_base
-    user.jwt_algorithm = "HS256" # HS256 is used by default.
-    user.session_expiry = 60 * 60 * 24 * 7 * 2 # 2 weeks is used by default.
+    user.jwt_secret     = Rails.application.secrets.secret_key_base
+    user.jwt_algorithm  = "HS256"                  # default; see jwt/ruby-jwt for options
+    user.session_expiry = 60 * 60 * 24 * 7 * 2      # default: 2 weeks (seconds)
+    user.exp_leeway     = 30                        # optional; default nil = no leeway
   end
 end
 ```
 
-Available algorithms are listed at https://github.com/jwt/ruby-jwt.
+With the submodule included, each request checks the `Authorization` header
+for a bearer JWT. If the token is validly signed, unexpired, and its claims
+match a user, `current_user` is set. Handling invalid tokens (401s, etc.) is
+up to your application.
 
-You're now ready to start using the library. By including the submodule, each request will check for an authorization header with a JWT as the value. If the JWT is valid, it will set the `current_user` in the controller to the matching user. It is up to you to handle what happens when a token is invalid or JWTs need to be revoked. Some ideas here: http://waiting-for-dev.github.io/blog/2017/01/24/jwt_revocation_strategies.
+To log a user in and issue a token:
 
-To login a user and issue a token, use the `login_and_issue_token` method from a controller. This method takes the same `email` and `password` arguments that the Sorcery `authenticate` method does.
+```ruby
+class SessionsController < ApplicationController
+  def create
+    token = login_and_issue_token(params[:email], params[:password])
+
+    if token
+      render json: { token: token }, status: :created
+    else
+      render json: { error: "invalid credentials" }, status: :unauthorized
+    end
+  end
+end
+```
 
-Example:
+### Claim contract
 
-```
-def login
-  token = login_and_issue_token(params[:email], params[:password])
+Tokens issued by `login_and_issue_token` carry the user's `id` and `email`,
+plus the standard `exp` and `iat` claims. Authentication via
+`login_from_jwt` requires **all** of the following, evaluated in one place:
 
-  render json: {
-    user: serialize(current_user),
-    token: token
-  }
-end
+1. a valid signature under the configured secret and algorithm
+2. an unexpired `exp` (within `exp_leeway`, if configured)
+3. `id` and `email` claims are present
+4. the claims match an existing user
+
+A validly-signed token that fails any check authenticates nobody — notably,
+a token missing its identity claims can never fall through to an unfiltered
+lookup.
+
+### Token issuance API
+
+You can also issue tokens directly from the user model:
+
+```ruby
+User.issue_token(id: user.id, email: user.email)  # => signed JWT string
+User.decode_token(token)                           # => [payload, header]; raises JWT::DecodeError
+User.token_valid?(token)                           # => boolean; never raises
 ```
 
-By using `login_and_issue_token` with valid credentials, you're also setting `current_user` in your controller.
+## Security notes
 
-## Development
+- **No revocation is built in.** Tokens are valid until `exp`. If you need
+  logout, invalidation on password change, or single-session enforcement, see
+  [JWT revocation strategies](https://waiting-for-dev.github.io/blog/2017/01/24/jwt_revocation_strategies/)
+  — any denylist/token-version approach can be layered on top by your app.
+- The algorithm is pinned on decode: `alg: none` and key-confusion attacks
+  are rejected.
+- The signing secret should be at least as strong as `secret_key_base`
+  rotated from your credentials store.
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+## Upgrading from 0.1.x
 
-To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+No API changes: `issue_token`, `decode_token`, `token_valid?`,
+`login_and_issue_token`, and the `login_from_jwt` login source all behave as
+before, and **tokens issued by 0.1.x remain valid** — no forced re-login.
+Behavior fixes in the 0.2+ line:
 
-## Contributing
+- tokens with no `id`/`email` claims are rejected (previously authenticated
+  the first user in the table)
+- the `email` claim must match the looked-up user
+- failed JWT login sets `current_user` to `nil` (sorcery convention)
+- the model submodule actually registers on modern Rubies (see
+  [CHANGELOG](CHANGELOG.md) — before 0.2, sorcery's `rescue NameError`
+  could silently skip it, leaving `issue_token` undefined at runtime)
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/hayfever/sorcery-jwt. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](http://contributor-covenant.org) code of conduct.
+## Compatibility
 
-## License
+Tested matrix (CI): Ruby 3.2 / 3.3 / 3.4 × sorcery 0.16.5 / 0.17 / 0.18.
 
-The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
+## Contributing
 
-## Code of Conduct
+Bug reports and pull requests are welcome at
+https://github.com/hayfever/sorcery-jwt.
+
+## License
 
-Everyone interacting in the Sorcery::Jwt project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/hayfever/sorcery-jwt/blob/master/CODE_OF_CONDUCT.md).
+The gem is available as open source under the terms of the
+[MIT License](LICENSE.txt).

data/gemfiles/sorcery_0.16.5.gemfile

@@ -0,0 +1,4 @@
+source "https://rubygems.org"
+
+gem "sorcery", "= 0.16.5"
+gemspec path: "../"

data/gemfiles/sorcery_0.16.5.gemfile.lock

@@ -0,0 +1,278 @@
+PATH
+  remote: ..
+  specs:
+    sorcery-jwt (0.2.1)
+      jwt (>= 1.0, < 3.0)
+      sorcery (>= 0.16.5, < 0.19)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    action_text-trix (2.1.19)
+      railties
+    actioncable (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      nio4r (~> 2.0)
+      websocket-driver (>= 0.6.1)
+      zeitwerk (~> 2.6)
+    actionmailbox (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      mail (>= 2.8.0)
+    actionmailer (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      actionview (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      mail (>= 2.8.0)
+      rails-dom-testing (~> 2.2)
+    actionpack (8.1.3.1)
+      actionview (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      nokogiri (>= 1.8.5)
+      rack (>= 2.2.4)
+      rack-session (>= 1.0.1)
+      rack-test (>= 0.6.3)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+      useragent (~> 0.16)
+    actiontext (8.1.3.1)
+      action_text-trix (~> 2.1.15)
+      actionpack (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      globalid (>= 0.6.0)
+      nokogiri (>= 1.8.5)
+    actionview (8.1.3.1)
+      activesupport (= 8.1.3.1)
+      builder (~> 3.1)
+      erubi (~> 1.11)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+    activejob (8.1.3.1)
+      activesupport (= 8.1.3.1)
+      globalid (>= 0.3.6)
+    activemodel (8.1.3.1)
+      activesupport (= 8.1.3.1)
+    activerecord (8.1.3.1)
+      activemodel (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      timeout (>= 0.4.0)
+    activestorage (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      marcel (~> 1.0)
+    activesupport (8.1.3.1)
+      base64
+      bigdecimal
+      concurrent-ruby (~> 1.0, >= 1.3.1)
+      connection_pool (>= 2.2.5)
+      drb
+      i18n (>= 1.6, < 2)
+      json
+      logger (>= 1.4.2)
+      minitest (>= 5.1)
+      securerandom (>= 0.3)
+      tzinfo (~> 2.0, >= 2.0.5)
+      uri (>= 0.13.1)
+    anonymous_loader (0.1.3)
+      version_gem (~> 1.1, >= 1.1.14)
+    auth-sanitizer (0.2.3)
+      version_gem (~> 1.1, >= 1.1.14)
+    base64 (0.3.0)
+    bcrypt (3.1.22)
+    bigdecimal (4.1.2)
+    builder (3.3.0)
+    concurrent-ruby (1.3.8)
+    connection_pool (3.0.2)
+    crass (1.0.7)
+    date (3.5.1)
+    diff-lcs (1.6.2)
+    drb (2.2.3)
+    erb (6.0.7)
+    erubi (1.13.1)
+    faraday (2.14.3)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-net_http (3.4.4)
+      net-http (~> 0.5)
+    globalid (1.4.0)
+      activesupport (>= 6.1)
+    hashie (5.1.0)
+      logger
+    i18n (1.15.2)
+      concurrent-ruby (~> 1.0)
+    io-console (0.9.2)
+    irb (1.18.0)
+      pp (>= 0.6.0)
+      prism (>= 1.3.0)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
+    json (2.21.2)
+    jwt (2.10.3)
+      base64
+    logger (1.7.0)
+    loofah (2.25.2)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.12.0)
+    mail (2.9.1)
+      logger
+      mini_mime (>= 0.1.1)
+      net-imap
+      net-pop
+      net-smtp
+    marcel (1.2.1)
+    mini_mime (1.1.5)
+    minitest (6.0.6)
+      drb (~> 2.0)
+      prism (~> 1.5)
+    multi_xml (0.9.1)
+      bigdecimal (>= 3.1, < 5)
+    net-http (0.9.1)
+      uri (>= 0.11.1)
+    net-imap (0.6.6)
+      date
+      net-protocol
+    net-pop (0.1.2)
+      net-protocol
+    net-protocol (0.3.0)
+      timeout
+    net-smtp (0.5.1)
+      net-protocol
+    nio4r (2.7.5)
+    nokogiri (1.19.4-x86_64-linux-gnu)
+      racc (~> 1.4)
+    oauth (1.1.8)
+      anonymous_loader (~> 0.1, >= 0.1.3)
+      auth-sanitizer (~> 0.2, >= 0.2.3)
+      base64 (~> 0.1)
+      oauth-tty (~> 1.0, >= 1.0.13)
+      snaky_hash (~> 2.0, >= 2.0.7)
+      version_gem (~> 1.1, >= 1.1.14)
+    oauth-tty (1.0.13)
+      anonymous_loader (~> 0.1, >= 0.1.3)
+      auth-sanitizer (~> 0.2, >= 0.2.3)
+      version_gem (~> 1.1, >= 1.1.14)
+    oauth2 (2.0.25)
+      anonymous_loader (~> 0.1, >= 0.1.3)
+      auth-sanitizer (~> 0.2, >= 0.2.3)
+      faraday (>= 0.17.3, < 4.0)
+      jwt (>= 1.0, < 4.0)
+      logger (~> 1.2)
+      multi_xml (~> 0.5)
+      rack (>= 1.2, < 4)
+      snaky_hash (~> 2.0, >= 2.0.7)
+      version_gem (~> 1.1, >= 1.1.14)
+    pp (0.6.4)
+      prettyprint
+    prettyprint (0.2.0)
+    prism (1.9.0)
+    racc (1.8.1)
+    rack (3.2.7)
+    rack-session (2.1.2)
+      base64 (>= 0.1.0)
+      rack (>= 3.0.0)
+    rack-test (2.2.0)
+      rack (>= 1.3)
+    rackup (2.3.1)
+      rack (>= 3)
+    rails (8.1.3.1)
+      actioncable (= 8.1.3.1)
+      actionmailbox (= 8.1.3.1)
+      actionmailer (= 8.1.3.1)
+      actionpack (= 8.1.3.1)
+      actiontext (= 8.1.3.1)
+      actionview (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activemodel (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      bundler (>= 1.15.0)
+      railties (= 8.1.3.1)
+    rails-dom-testing (2.3.0)
+      activesupport (>= 5.0.0)
+      minitest
+      nokogiri (>= 1.6)
+    rails-html-sanitizer (1.7.1)
+      loofah (~> 2.25, >= 2.25.2)
+      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
+    railties (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
+      irb (~> 1.13)
+      rackup (>= 1.0.0)
+      rake (>= 12.2)
+      thor (~> 1.0, >= 1.2.2)
+      tsort (>= 0.2)
+      zeitwerk (~> 2.6)
+    rake (13.4.2)
+    rbs (4.2.0)
+      logger
+      prism (>= 1.6.0)
+      tsort
+    rdoc (8.0.0)
+      erb
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
+      tsort
+    reline (0.7.0)
+      io-console (~> 0.5)
+    rspec (3.13.2)
+      rspec-core (~> 3.13.0)
+      rspec-expectations (~> 3.13.0)
+      rspec-mocks (~> 3.13.0)
+    rspec-core (3.13.6)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.5)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.13.0)
+    rspec-mocks (3.13.8)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.13.0)
+    rspec-support (3.13.7)
+    securerandom (0.4.1)
+    snaky_hash (2.0.7)
+      hashie (>= 0.1.0, < 6)
+      version_gem (~> 1.1, >= 1.1.14)
+    sorcery (0.16.5)
+      bcrypt (~> 3.1)
+      oauth (>= 0.6)
+      oauth2 (~> 2.0)
+    sqlite3 (2.9.6-x86_64-linux-gnu)
+    thor (1.5.0)
+    timeout (0.6.1)
+    tsort (0.2.0)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
+    uri (1.1.1)
+    useragent (0.16.11)
+    version_gem (1.1.15)
+    websocket-driver (0.8.2)
+      base64
+      websocket-extensions (>= 0.1.0)
+    websocket-extensions (0.1.5)
+    zeitwerk (2.8.3)
+
+PLATFORMS
+  x86_64-linux
+
+DEPENDENCIES
+  activerecord (~> 8.0)
+  rails (~> 8.0)
+  rake (~> 13.0)
+  rspec (~> 3.0)
+  sorcery (= 0.16.5)
+  sorcery-jwt!
+  sqlite3 (~> 2.0)
+
+BUNDLED WITH
+   2.6.9

data/gemfiles/sorcery_0.17.0.gemfile

@@ -0,0 +1,4 @@
+source "https://rubygems.org"
+
+gem "sorcery", "= 0.17.0"
+gemspec path: "../"