usps-jwt_auth 1.0.6 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2b570538c78235e550ff7903dfb293cbf8d7116ee050af858a963db6ddc84c2e
-  data.tar.gz: e41a91e29de1b8449780e39d0bf93b8ca61f3f08eb43ff08f470ac244a2675ea
+  metadata.gz: be13d7639636f1abce28a82c032ea04883808bec8bb3925060f3f2071e1bf3ef
+  data.tar.gz: 8486bf2584dbcc901f00e17ef059ec3125db036f76f7c81080d68125177f50b0
 SHA512:
-  metadata.gz: 8eaf955b197330910784b35669dec3ef5d6cd073f910f66623188f2e6fa672c588e84ec45bea8f2e045b1809ff39241f356e398b501217d9a743a7f69b0b192f
-  data.tar.gz: 73f575a6f21f5efa3fdbdf485f208d163d7d25b2de288ce641048acaf27b9f4809a36478278c785bb148843f470d503fbf5fb8e9395b71e089b149e0686248f2
+  metadata.gz: 2a8d5e69bd26ed1a65da6f4c7beb907aa570e7ae1942c4f256fee3c42e8f39bdcbc938018b626825ac77e5d50a64d6b994534361acfac8fda025c2681f39d4a3
+  data.tar.gz: 5fc08818ac1c3cd4b13b1005f294d6bfd0d3837fc03fd0609c74235cf9de706d5311fc01aaa44cb3cda34edcad22636f56807f6a0ac7d5e7e7b5c79a43048f5f

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    usps-jwt_auth (1.0.6)
+    usps-jwt_auth (1.1.0)
       activesupport (~> 8.0)
       colorize (~> 1.1)
       fileutils (~> 1.7)
@@ -49,7 +49,9 @@ GEM
     language_server-protocol (3.17.0.5)
     lint_roller (1.1.0)
     logger (1.7.0)
-    minitest (5.26.0)
+    minitest (6.0.6)
+      drb (~> 2.0)
+      prism (~> 1.5)
     parallel (1.27.0)
     parser (3.3.9.0)
       ast (~> 2.4.1)
@@ -118,7 +120,7 @@ GEM
       concurrent-ruby (~> 1.0)
     unicode-display_width (3.2.0)
       unicode-emoji (~> 4.1)
-    unicode-emoji (4.1.0)
+    unicode-emoji (4.2.0)
     uri (1.0.4)
 
 PLATFORMS

data/lib/usps/jwt_auth/concern.rb

@@ -54,7 +54,7 @@ module Usps
 
         # Admin has entered impersonation mode -- override current_user
         @current_user = JwtAuth.config.find_member.call(session['impersonate']['impersonated'])
-      rescue JWT::ExpiredSignature
+      rescue JWT::DecodeError
         clear_jwt
         nil
       rescue ActiveRecord::RecordNotFound => e

data/lib/usps/jwt_auth/decode.rb

@@ -34,6 +34,10 @@ module Usps
 
       def public_key(token)
         OpenSSL::PKey::RSA.new(File.read("#{JwtAuth.config.public_keys_path}/#{fingerprint(token)}.pub"))
+      rescue Errno::ENOENT
+        # No public key matches the token's fingerprint (e.g. a stale token after key rotation),
+        # so the token cannot be verified and is treated as invalid.
+        raise JWT::VerificationError, 'No public key for token fingerprint'
       end
 
       def fingerprint(token)

data/lib/usps/jwt_auth/encode.rb

@@ -30,12 +30,34 @@ module Usps
         @public_key ||= private_key.public_key
       end
 
+      # OpenSSH-style SHA256 key fingerprint: base64url(SHA256(ssh-rsa wire blob)),
+      # i.e. the value `ssh-keygen -lf` prints as `SHA256:...`. This matches the key
+      # filenames and `key` claim that the consuming apps already recognize.
       def fingerprint
-        OpenSSL::Digest::SHA256.new(public_key.to_der).to_s
+        digest = OpenSSL::Digest::SHA256.digest(ssh_public_blob)
+        [digest].pack('m0').tr('+/', '-_').delete('=')
       end
 
     private
 
+      # Public key in the OpenSSH wire format: string('ssh-rsa') + mpint(e) + mpint(n).
+      def ssh_public_blob
+        ssh_string('ssh-rsa') + ssh_mpint(public_key.e) + ssh_mpint(public_key.n)
+      end
+
+      # SSH "string": 4-byte big-endian length prefix followed by the bytes.
+      def ssh_string(bytes)
+        [bytes.bytesize].pack('N') + bytes.b
+      end
+
+      # SSH "mpint": a length-prefixed big-endian integer; a leading zero byte is
+      # prepended when the high bit is set so the value stays non-negative.
+      def ssh_mpint(num)
+        bytes = num.to_s(2)
+        bytes = "\x00".b + bytes if bytes.bytes.first && bytes.bytes.first >= 0x80
+        ssh_string(bytes)
+      end
+
       def expires_at
         ::Time.now.to_i + @expiration_time
       end
@@ -64,8 +86,12 @@ module Usps
         ::FileUtils.chmod(0o600, path)
       end
 
+      # Ensure the public key is published, but only write it when missing — the file
+      # is stable for a given key, so rewriting it on every encode is needless churn.
       def store_public_key
         path = "#{JwtAuth.config.public_keys_path}/#{fingerprint}.pub"
+        return if File.exist?(path)
+
         File.open(path, 'w+') { |f| f.puts(public_key) }
         ::FileUtils.chmod(0o644, path)
       end

data/lib/usps/jwt_auth/version.rb

@@ -2,6 +2,6 @@
 
 module Usps
   module JwtAuth
-    VERSION = '1.0.6'
+    VERSION = '1.1.0'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: usps-jwt_auth
 version: !ruby/object:Gem::Version
-  version: 1.0.6
+  version: 1.1.0
 platform: ruby
 authors:
 - Julian Fiander