usps-jwt_auth 1.2.0 → 1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a248993ec7c0ad7e97d4bfcb7e89302f3366f7c3fd95c122f71d116f9c541bcf
-  data.tar.gz: ef4e072d124dd0f398fbb80202523c3a99b5a25220c48dfeaf27c8a732800259
+  metadata.gz: 8c900a7d07163d9ac0be04b7c4ae2ef44a60e02fc081ccd6c776bd056445e2e8
+  data.tar.gz: db7b6e04885c6b2ab24e4a6a05af456466e5f33efa39b85e77741523fa95d186
 SHA512:
-  metadata.gz: f38759de429b850a32caa02b412fbbc644dca520f74422bef274fe30dc0f709b272057b81aaf411afce3a7c979bc550e1bb1531dbd228f0185fb6e12bff6ea73
-  data.tar.gz: 57c98a347480941fbf0f7c88a27252228eb0198d91ffb11f7259b5abf5dfb79f50b4c6db7113dbbe5fe5748ffa7a90a4fdc172268123741d6b27faec0023124c
+  metadata.gz: cf1fb79f6441f3571aacd5e2bd2c888a3125fc52c3c5c9a59f7a78bc7c4d0eacd314973976b12d4abdc3703e4cc2ba4d8083fab2fa2fa3fa48c42ae2fc87e02c
+  data.tar.gz: 96c07d7c4689b3818f8cf4d497bed1b17b77fc46aa584583a663beb5d00609e4c65306fb8c5503a95bb85ba87b1ea1f01e9a6f7d1676cb48e54d6248f1b20bcd

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    usps-jwt_auth (1.2.0)
+    usps-jwt_auth (1.2.1)
       activesupport (~> 8.0)
       colorize (~> 1.1)
       fileutils (~> 1.7)

data/lib/usps/jwt_auth/concern.rb

@@ -71,7 +71,9 @@ module Usps
         return if params[:jwt].blank? || @set_new_jwt
 
         store_jwt(params[:jwt])
-        ensure_valid_jwt_has_valid_member!
+        # An unverifiable token (e.g. a key we cannot resolve) clears the jwt and returns
+        # nil; fall through so the visitor is sent to login rather than into the app.
+        return unless ensure_valid_jwt_has_valid_member!
 
         redirect_to_path!
         @set_new_jwt = true
@@ -124,6 +126,12 @@ module Usps
       def ensure_valid_jwt_has_valid_member!
         fetch_jwt
         jwt_user
+      rescue JWT::DecodeError
+        # The token cannot be verified (e.g. an unresolvable key). Drop it and report
+        # "not signed in" so the caller redirects to login — never let this escape as an
+        # unhandled 500, which the error page would re-trigger when it re-authenticates.
+        clear_jwt
+        @current_user = nil
       rescue ActiveRecord::RecordNotFound
         reset_session
         clear_jwt

data/lib/usps/jwt_auth/decode.rb

@@ -9,6 +9,10 @@ module Usps
     # Decode and validate data from a JWT
     #
     class Decode
+      # Keep a slow or unreachable store from tying up the caller (e.g. a web worker).
+      OPEN_TIMEOUT = 2
+      READ_TIMEOUT = 2
+
       def self.decode(token, audience: [], issuer: nil)
         new.decode(token, audience: audience, issuer: issuer)
       end
@@ -75,15 +79,27 @@ module Usps
           raise JWT::VerificationError, 'Fetched public key does not match token fingerprint'
         end
 
+        cache_key(fingerprint, pem)
+        key
+      end
+
+      # Persist the verified key so the next decode skips the fetch — but best-effort: an
+      # unwritable cache dir (e.g. a read-only or wrong-owner deploy) must NOT fail a token
+      # we have already fetched and verified. On a write error we just refetch next time.
+      def cache_key(fingerprint, pem)
         path = cache_path(fingerprint)
         FileUtils.mkdir_p(File.dirname(path))
         File.write(path, pem)
-        key
+      rescue SystemCallError
+        nil
       end
 
       def http_get(url)
         uri = URI.parse(url)
-        response = Net::HTTP.get_response(uri)
+        response = Net::HTTP.start(
+          uri.host, uri.port,
+          use_ssl: uri.scheme == 'https', open_timeout: OPEN_TIMEOUT, read_timeout: READ_TIMEOUT
+        ) { |http| http.get(uri.request_uri) }
         raise "HTTP #{response.code} for #{url}" unless response.is_a?(Net::HTTPSuccess)
 
         response.body

data/lib/usps/jwt_auth/version.rb

@@ -2,6 +2,6 @@
 
 module Usps
   module JwtAuth
-    VERSION = '1.2.0'
+    VERSION = '1.2.1'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: usps-jwt_auth
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.2.1
 platform: ruby
 authors:
 - Julian Fiander