warden-auth0 0.5.1 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d436b13b2f5bcd2e23c8c92a0ab77dff9a8f456f201c4dadeb519bd45eaaa3e0
-  data.tar.gz: 0fbfb06fed450decec2449ac708b3806cbf270eadb9ac0039f132911ad6e8497
+  metadata.gz: 8c9e553549199de29e2c2bc57d460446f5ab3a703713062a0a6a813814c47af2
+  data.tar.gz: 62bcd022d6d526c3bfc80963754476ad8b698ad3b7d7f2a3c6a30efc0ba2e536
 SHA512:
-  metadata.gz: 5b990bc54c906b61def45124b8ecc9c779d78db73d5bb5af0f3ceacfb47aa3bf34beee0bd6a25b266d001c5e6da4066c52cb4953fc5c562afde9a3efa905b6c3
-  data.tar.gz: 30b18151d82429d942c9cc27f685501beb2db713beb6dd5d24d874edd7c72f94bea30259623ad85c1c1b4d49a6d40e152a98f64754f2c4214ce083c4140efdfc
+  metadata.gz: e6fd5caf3bfd2f5474f990fe424a5be1c42b82b9e7577a843b7721041d57e53a0909a6b7d1b25885305a8f375e0e812088b9587ef3c1ae1ec8ca1da96a2516cd
+  data.tar.gz: aefd93fdc3655f844ca867ad08c75bd8410c3096f17b1bc3b028aa4c18b413c92f34e055fe2d8b3d1aeb946fdd8f12c95e2b7d72bb113e8461c796927b5b5528

data/README.md

@@ -39,6 +39,29 @@ Or install it yourself as:
 
 You can look at this gem's wiki to see some [example applications](https://github.com/waiting-for-dev/warden-jwt_auth/wiki). Please, add yours if you think it can help somebody.
 
+### Auth0 JWT strategy and JWKS
+
+Tokens are verified with `issuer`, `audience`, `algorithm`, and a **JWKS** object passed to `ruby-jwt`. The strategy does **not** define a `jwks_url` setting: you assign `jwks` yourself, usually once at boot.
+
+```ruby
+Warden::Auth0::Strategy.configure do |config|
+  config.issuer = 'https://YOUR_DOMAIN.auth0.com/'
+  config.aud = 'https://your-api-identifier' # Auth0 API audience
+  config.algorithm = 'RS256'
+  config.jwks = Warden::Auth0::Strategy.fetch_jwks(
+    'https://YOUR_DOMAIN.auth0.com/.well-known/jwks.json'
+  )
+  # Optional: TLS verification for JWKS HTTP fetch (default: true)
+  # config.verify_ssl = true
+end
+```
+
+`fetch_jwks` returns signing keys (`use: sig`) suitable for verification. For tests or advanced cases, set `config.jwks` to any value accepted by `JWT.decode`’s `jwks:` option (see [ruby-jwt](https://github.com/jwt/ruby-jwt)).
+
+**Migration:** If you previously relied on a `jwks_url` strategy setting, remove it and set `jwks` explicitly as above (or load keys another way and assign `config.jwks`).
+
+Register the strategy and implement a resolver for your Warden scope (e.g. `user_resolver`) as in the examples under [Warden scopes configuration](#warden-scopes-configuration).
+
 At its core, this library consists of:
 
 - A Warden strategy that authenticates a user if a valid JWT token is present in the request headers.

data/lib/warden/auth0/strategy.rb

@@ -1,12 +1,25 @@
 # frozen_string_literal: true
 
 require 'warden'
+require 'dry/configurable'
 
 module Warden
   module Auth0
     # Warden strategy to authenticate a user through a JWT token in the
-    # `Authorization` request header
+    # request header (see Warden::Auth0.config.token_header).
+    #
+    # Configure issuer, aud, algorithm on the strategy before adding to Warden.
     class Strategy < Warden::Strategies::Base
+      extend Dry::Configurable
+
+      setting :algorithm
+      setting :issuer
+      setting :aud
+      setting :verify_ssl, default: true
+
+      # Store the JWKS after fetching it
+      setting :jwks
+
       def valid?
         token_exists? && issuer_claim_valid? && aud_claim_valid?
       end
@@ -42,7 +55,8 @@ module Warden
       end
 
       def decoded_token
-        TokenDecoder.new.call(token)
+        cfg = self.class.config
+        TokenDecoder.new(algorithm: cfg.algorithm, jwks: cfg.jwks).call(token)
       end
 
       def issuer_claim_valid?
@@ -60,14 +74,14 @@ module Warden
       end
 
       def configured_aud
-        audience = Warden::Auth0.config.aud
+        audience = self.class.config.aud
         raise Errors::NoConfiguredAud if audience.nil?
 
         audience
       end
 
       def configured_issuer
-        configured_issuer = Warden::Auth0.config.issuer
+        configured_issuer = self.class.config.issuer
         raise Errors::NoConfiguredIssuer if configured_issuer.nil?
 
         configured_issuer
@@ -100,6 +114,23 @@ module Warden
 
         false
       end
+
+      # Fetches JWKS from the given URL.
+      def self.fetch_jwks(jwks_url)
+        puts "Fetching JWKS from #{jwks_url}"
+        raise 'No url provided for fetching jwks' if jwks_url.nil?
+        jwks_response = self.connection.get(jwks_url).body
+        jwks = JWT::JWK::Set.new(jwks_response)
+        jwks.select { |key| key[:use] == 'sig' }
+      rescue StandardError => e
+        raise "Failed to fetch JWKS: #{e.message}"
+      end
+
+      def self.connection
+        Faraday.new(request: { timeout: 5 }, ssl: { verify: config.verify_ssl }) do |conn|
+          conn.response :json
+        end
+      end
     end
   end
 end

data/lib/warden/auth0/token_decoder.rb

@@ -4,24 +4,22 @@ require 'jwt/error'
 
 module Warden
   module Auth0
-    # Decodes a JWT into a hash payload into a JWT token
+    # Decodes a JWT into a hash payload. Algorithm and JWKS are provided by the strategy config.
     class TokenDecoder
-      include Auth0::Import['algorithm', 'jwks']
+      attr_reader :algorithm, :jwks
+
+      # @param algorithm [String] algorithm (e.g. 'RS256')
+      # @param jwks [Object] JWKS used to verify (e.g. JWT::JWK::Set)
+      def initialize(algorithm:, jwks:)
+        @algorithm = algorithm
+        @jwks = jwks
+      end
 
       # Decodes the payload from a JWT as a hash
       #
-      # @see JWT.decode for all the exceptions than can be raised when given
-      # token is invalid
-      #
       # @param token [String] a JWT
       # @return [Hash] payload decoded from the JWT
       def call(token)
-        decode(token)
-      end
-
-      private
-
-      def decode(token)
         JWT.decode(token, nil, true, algorithms: algorithm, jwks: jwks)[0]
       end
     end

data/lib/warden/auth0/version.rb

@@ -2,6 +2,6 @@
 
 module Warden
   module Auth0
-    VERSION = '0.5.1'
+    VERSION = '2.0.0'
   end
 end

data/lib/warden/auth0.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require 'dry/configurable'
-require 'dry/auto_inject'
 require 'jwt'
 require 'warden'
 require 'faraday'
@@ -10,53 +9,13 @@ module Warden
   # Auth0 authentication plugin for warden.
   #
   # It consists of a strategy which tries to authenticate an user decoding a
-  # token present in the `Authentication` header (as `Bearer %token%`).
+  # token present in the request header (as `Bearer %token%`). The header name
+  # is configured via +token_header+.
   module Auth0
     extend Dry::Configurable
-    # Request header that will be used for receiving and returning the token.
-    setting :token_header, default: 'Authorization'
-
-    # The algorithm used to encode the token
-    setting :algorithm
-
-    # The issuer claims associated with the tokens
-    #
-    # Will be used to only apply the warden strategy when the issuer matches.
-    # This allows for multiple token issuers being used.
-    # @see https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.1
-    setting :issuer, default: nil
-
-    # The aud claims associated with the tokens
-    #
-    # Will be used to only apply the warden strategy when the audience matches.
-    setting :aud, default: nil
-
-    # The url to fetch jwks from
-    setting :jwks_url
-
-    setting :verify_ssl, default: true
 
-    # Store the JWKS after fetching it
-    setting :jwks, constructor: ->(jwks) { jwks || fetch_jwks(config.jwks_url) }
-
-    Import = Dry::AutoInject(config)
-
-    # Method to fetch JWKS from the specified URL
-    def self.fetch_jwks(jwks_url)
-      raise 'No url provided for fetching jwks' if jwks_url.nil?
-
-      jwks_response = connection.get(jwks_url).body
-      jwks = JWT::JWK::Set.new(jwks_response)
-      jwks.select { |key| key[:use] == 'sig' }
-    rescue StandardError => e
-      raise "Failed to fetch JWKS: #{e.message}"
-    end
-
-    def self.connection
-      Faraday.new(request: { timeout: 5 }, ssl: { verify: config.verify_ssl }) do |conn|
-        conn.response :json
-      end
-    end
+    # Request header used for receiving and returning the token.
+    setting :token_header, default: 'Authorization'
   end
 end
 

data/warden-auth0.gemspec

@@ -21,7 +21,6 @@ Gem::Specification.new do |spec|
 
   spec.metadata['rubygems_mfa_required'] = 'true'
 
-  spec.add_dependency 'dry-auto_inject', '>= 0.8', '< 2'
   spec.add_dependency 'dry-configurable', '>= 0.13', '< 2'
   spec.add_dependency 'faraday', '2.9.0'
   spec.add_dependency 'jwt', '~> 2.1'

metadata

@@ -1,35 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: warden-auth0
 version: !ruby/object:Gem::Version
-  version: 0.5.1
+  version: 2.0.0
 platform: ruby
 authors:
 - 1KOMMA5º
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-07-16 00:00:00.000000000 Z
+date: 2026-04-08 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: dry-auto_inject
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0.8'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '2'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0.8'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '2'
 - !ruby/object:Gem::Dependency
   name: dry-configurable
   requirement: !ruby/object:Gem::Requirement