warden-auth0 1.0.0 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c0393f5a1b3774024bb3c8eecd94658c1b99e40b9305f0aca2d57419e739d366
-  data.tar.gz: 995ab21d0112fcb53ff6065f3d92b605e7436d0d3b7cfa94d6fbf409f7db8d30
+  metadata.gz: 8c9e553549199de29e2c2bc57d460446f5ab3a703713062a0a6a813814c47af2
+  data.tar.gz: 62bcd022d6d526c3bfc80963754476ad8b698ad3b7d7f2a3c6a30efc0ba2e536
 SHA512:
-  metadata.gz: a3c52ab6403319bc1b555b67670bc622c29946983f2d7cfdfc6f23b29e5530006caa043bc802aae282a1fba840c132d1dca7773db103588ed351b5ba5e8c10eb
-  data.tar.gz: 1cbe71324f0769f76ecbfbd7dc01c7658430e3eeab6d155e79bf26a15907c054858ebf8d733b4b56972a9c92e6edca3ee658ea15f7c4fca6fa70f7a9b416b80d
+  metadata.gz: e6fd5caf3bfd2f5474f990fe424a5be1c42b82b9e7577a843b7721041d57e53a0909a6b7d1b25885305a8f375e0e812088b9587ef3c1ae1ec8ca1da96a2516cd
+  data.tar.gz: aefd93fdc3655f844ca867ad08c75bd8410c3096f17b1bc3b028aa4c18b413c92f34e055fe2d8b3d1aeb946fdd8f12c95e2b7d72bb113e8461c796927b5b5528

data/README.md

@@ -39,6 +39,29 @@ Or install it yourself as:
 
 You can look at this gem's wiki to see some [example applications](https://github.com/waiting-for-dev/warden-jwt_auth/wiki). Please, add yours if you think it can help somebody.
 
+### Auth0 JWT strategy and JWKS
+
+Tokens are verified with `issuer`, `audience`, `algorithm`, and a **JWKS** object passed to `ruby-jwt`. The strategy does **not** define a `jwks_url` setting: you assign `jwks` yourself, usually once at boot.
+
+```ruby
+Warden::Auth0::Strategy.configure do |config|
+  config.issuer = 'https://YOUR_DOMAIN.auth0.com/'
+  config.aud = 'https://your-api-identifier' # Auth0 API audience
+  config.algorithm = 'RS256'
+  config.jwks = Warden::Auth0::Strategy.fetch_jwks(
+    'https://YOUR_DOMAIN.auth0.com/.well-known/jwks.json'
+  )
+  # Optional: TLS verification for JWKS HTTP fetch (default: true)
+  # config.verify_ssl = true
+end
+```
+
+`fetch_jwks` returns signing keys (`use: sig`) suitable for verification. For tests or advanced cases, set `config.jwks` to any value accepted by `JWT.decode`’s `jwks:` option (see [ruby-jwt](https://github.com/jwt/ruby-jwt)).
+
+**Migration:** If you previously relied on a `jwks_url` strategy setting, remove it and set `jwks` explicitly as above (or load keys another way and assign `config.jwks`).
+
+Register the strategy and implement a resolver for your Warden scope (e.g. `user_resolver`) as in the examples under [Warden scopes configuration](#warden-scopes-configuration).
+
 At its core, this library consists of:
 
 - A Warden strategy that authenticates a user if a valid JWT token is present in the request headers.

data/lib/warden/auth0/strategy.rb

@@ -8,15 +8,17 @@ module Warden
     # Warden strategy to authenticate a user through a JWT token in the
     # request header (see Warden::Auth0.config.token_header).
     #
-    # Configure issuer, aud, algorithm, jwks_url on the strategy before adding to Warden.
+    # Configure issuer, aud, algorithm on the strategy before adding to Warden.
     class Strategy < Warden::Strategies::Base
       extend Dry::Configurable
 
       setting :algorithm
       setting :issuer
       setting :aud
-      setting :jwks_url
-      setting :jwks, default: nil
+      setting :verify_ssl, default: true
+
+      # Store the JWKS after fetching it
+      setting :jwks
 
       def valid?
         token_exists? && issuer_claim_valid? && aud_claim_valid?
@@ -54,7 +56,7 @@ module Warden
 
       def decoded_token
         cfg = self.class.config
-        TokenDecoder.new(algorithm: cfg.algorithm, jwks: jwks).call(token)
+        TokenDecoder.new(algorithm: cfg.algorithm, jwks: cfg.jwks).call(token)
       end
 
       def issuer_claim_valid?
@@ -85,11 +87,6 @@ module Warden
         configured_issuer
       end
 
-      def jwks
-        cfg = self.class.config
-        cfg.jwks || Warden::Auth0.fetch_jwks(cfg.jwks_url)
-      end
-
       def issuer_matches?(payload, issuer_config)
         token_issuer = payload['iss'].to_s
         return false unless token_issuer
@@ -117,6 +114,23 @@ module Warden
 
         false
       end
+
+      # Fetches JWKS from the given URL.
+      def self.fetch_jwks(jwks_url)
+        puts "Fetching JWKS from #{jwks_url}"
+        raise 'No url provided for fetching jwks' if jwks_url.nil?
+        jwks_response = self.connection.get(jwks_url).body
+        jwks = JWT::JWK::Set.new(jwks_response)
+        jwks.select { |key| key[:use] == 'sig' }
+      rescue StandardError => e
+        raise "Failed to fetch JWKS: #{e.message}"
+      end
+
+      def self.connection
+        Faraday.new(request: { timeout: 5 }, ssl: { verify: config.verify_ssl }) do |conn|
+          conn.response :json
+        end
+      end
     end
   end
 end

data/lib/warden/auth0/version.rb

@@ -2,6 +2,6 @@
 
 module Warden
   module Auth0
-    VERSION = '1.0.0'
+    VERSION = '2.0.0'
   end
 end

data/lib/warden/auth0.rb

@@ -16,25 +16,6 @@ module Warden
 
     # Request header used for receiving and returning the token.
     setting :token_header, default: 'Authorization'
-
-    setting :verify_ssl, default: true
-
-    # Fetches JWKS from the given URL. Used by the strategy when jwks_url is configured.
-    def self.fetch_jwks(jwks_url)
-      raise 'No url provided for fetching jwks' if jwks_url.nil?
-
-      jwks_response = connection.get(jwks_url).body
-      jwks = JWT::JWK::Set.new(jwks_response)
-      jwks.select { |key| key[:use] == 'sig' }
-    rescue StandardError => e
-      raise "Failed to fetch JWKS: #{e.message}"
-    end
-
-    def self.connection
-      Faraday.new(request: { timeout: 5 }, ssl: { verify: config.verify_ssl }) do |conn|
-        conn.response :json
-      end
-    end
   end
 end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: warden-auth0
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 2.0.0
 platform: ruby
 authors:
 - 1KOMMA5º
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-03-12 00:00:00.000000000 Z
+date: 2026-04-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dry-configurable