usps-jwt_auth 1.2.1 → 1.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8c900a7d07163d9ac0be04b7c4ae2ef44a60e02fc081ccd6c776bd056445e2e8
-  data.tar.gz: db7b6e04885c6b2ab24e4a6a05af456466e5f33efa39b85e77741523fa95d186
+  metadata.gz: 55690055320ed2dfe5ace756f990bedd8769a5003750baa7ab13828330a78052
+  data.tar.gz: 9bbadbdcb087a8645b2b057a01020589aacbf0d6a5d498fcc907f30f3e667150
 SHA512:
-  metadata.gz: cf1fb79f6441f3571aacd5e2bd2c888a3125fc52c3c5c9a59f7a78bc7c4d0eacd314973976b12d4abdc3703e4cc2ba4d8083fab2fa2fa3fa48c42ae2fc87e02c
-  data.tar.gz: 96c07d7c4689b3818f8cf4d497bed1b17b77fc46aa584583a663beb5d00609e4c65306fb8c5503a95bb85ba87b1ea1f01e9a6f7d1676cb48e54d6248f1b20bcd
+  metadata.gz: 57e395c8ee636d9ac8b7d1709927fab0506f4b20acf146925e22829da835bcf943c6151e5732c9b9c6271f348355e8daf7f0c346b31c8bfb9114c93591f03620
+  data.tar.gz: f7bdfdb5a52b589639f81481e9bb2bf6906f94b037b0865bb22e91a94db10bd91c0c049922f9243f87c2faa49599e08b97a3686a2e2a74921ef2c98166a2fb23

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    usps-jwt_auth (1.2.1)
+    usps-jwt_auth (1.2.3)
       activesupport (~> 8.0)
       colorize (~> 1.1)
       fileutils (~> 1.7)

data/lib/usps/jwt_auth/concern.rb

@@ -64,7 +64,12 @@ module Usps
       end
 
       def jwt_user
-        @jwt_user ||= JwtAuth.config.find_member.call(jwt['certificate']) if fetch_jwt
+        return unless fetch_jwt
+        # A blank certificate claim is malformed and must never resolve to a member
+        # (e.g. a stray blank-certificate row would otherwise authenticate as that record).
+        return if jwt['certificate'].blank?
+
+        @jwt_user ||= JwtAuth.config.find_member.call(jwt['certificate'])
       end
 
       def set_new_jwt
@@ -79,9 +84,15 @@ module Usps
         @set_new_jwt = true
       end
 
+      # Back to where the login began, with the query it began with. The query rides through the login
+      # as a single `query_string` parameter, and is unpacked here rather than handed on still packed.
+      # It is re-encoded rather than passed through as received, so the redirect stays well-formed
+      # whatever arrives.
       def redirect_to_path!
         path = params[:path] || root_path
-        redirect_to(params.key?(:query_string) ? "#{path}?query_string=#{CGI.escape(params[:query_string])}" : path)
+        pairs = URI.decode_www_form(params[:query_string].to_s).reject { |key, _value| key.empty? }
+
+        redirect_to(pairs.empty? ? path : "#{path}?#{URI.encode_www_form(pairs)}")
       end
 
       def store_jwt(token)

data/lib/usps/jwt_auth/version.rb

@@ -2,6 +2,6 @@
 
 module Usps
   module JwtAuth
-    VERSION = '1.2.1'
+    VERSION = '1.2.3'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: usps-jwt_auth
 version: !ruby/object:Gem::Version
-  version: 1.2.1
+  version: 1.2.3
 platform: ruby
 authors:
 - Julian Fiander