warden-jwt_auth 0.8.0 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d1170f1a68adb34c8769b7c202ba91ca706494562205ef9b8ab56956f0d66393
-  data.tar.gz: 9334625e9e7711c76a90c6d22414871402171e317f9825cc3d6e4d3e5ca486fd
+  metadata.gz: 639d91603d4e369d3d94c0dadc24816c08019ebdfef3c093fc9b8cd79a5d6bd3
+  data.tar.gz: 39f9a053ed2af021eed742b94aa3e2360481c5120d8690085d40773470ec21e2
 SHA512:
-  metadata.gz: 6ab3bbcd295d3206006878d307006a7033be2bfa94237f45e607979b8217d5b84222f076700e1893633b9d716b159d5d576183ca9a261a36c0b76f341c8f1d22
-  data.tar.gz: 95619a1fee6709a8aa7eb883af56abf1e7540acde7b3eb690a7b6da142f203cd41bc222af6cac12937ac18f909a5974437cedf7d76f32262f4f6cca275ada89b
+  metadata.gz: 727924aa4f6c6a993548c397e108bdb43b281047928aeaf8dcbe0a291784aa4bc4e2f25804b36a7d5549cb858e3006ba7997b0ec6d3dc762196586fe282aeedb
+  data.tar.gz: 9152d951c19f477c23cde9e0e1b5437f8b33821e39825e355a1edfedf14ce3f7b14ea5798e0b1ae23ffb274892c58287dbdab1d06f38c49393f23a9007006f53

data/CHANGELOG.md

@@ -4,6 +4,9 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/) 
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [0.8.0] - 2024-06-28
+- Add support for issue claim ([56](https://github.com/waiting-for-dev/warden-jwt_auth/pull/56))
+
 ## [0.8.0] - 2023-01-31
 - Add support for secret rotation ([49](https://github.com/waiting-for-dev/warden-jwt_auth/pull/49))
 - Support dry-* v1 ([52](https://github.com/waiting-for-dev/warden-jwt_auth/pull/52))

data/README.md

@@ -182,7 +182,7 @@ module RevocationStrategy
   def self.jwt_revoked?(payload, user)
     # Does something to check whether the JWT token is revoked for given user
   end
-  
+
   def self.revoke_jwt(payload, user)
     # Does something to revoke the JWT token for given user
   end
@@ -208,6 +208,17 @@ end
 
 You can remove the `rotation_secret` when you are condifent that large enough user base has the fetched the token encrypted with the new secret.
 
+### Multiple issuers
+
+When your application handles JWT tokens from multiple sources (e.g. webhooks authenticated via provider JTW tokens) you can configure this gem to use the [issuer claim](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.1) to only handle tokens it has issued.
+
+```ruby
+Warden::JWTAuth.configure do |config|
+  config.secret = ENV['WARDEN_JWT_SECRET_KEY']
+  config.issuer = 'http://my-application.com'
+end
+```
+
 ## Development
 
 There are docker and docker-compose files configured to create a development environment for this gem. So, if you use Docker you only need to run:

data/lib/warden/jwt_auth/payload_user_helper.rb

@@ -29,6 +29,14 @@ module Warden
         payload['aud'] == aud
       end
 
+      # Returns whether given issuer matches with the one encoded in the payload
+      # @param payload [Hash] JWT payload
+      # @param issuer [String] The issuer to match
+      # @return [Boolean]
+      def self.issuer_matches?(payload, issuer)
+        payload['iss'] == issuer.to_s
+      end
+
       # Returns the payload to encode for a given user in a scope
       #
       # @param user [Interfaces::User] an user, whatever it is

data/lib/warden/jwt_auth/strategy.rb

@@ -8,7 +8,7 @@ module Warden
     # `Authorization` request header
     class Strategy < Warden::Strategies::Base
       def valid?
-        !token.nil?
+        token_exists? && issuer_claim_valid?
       end
 
       def store?
@@ -25,6 +25,20 @@ module Warden
 
       private
 
+      def issuer_claim_valid?
+        configured_issuer = Warden::JWTAuth.config.issuer
+        return true if configured_issuer.nil?
+
+        payload = TokenDecoder.new.call(token)
+        PayloadUserHelper.issuer_matches?(payload, configured_issuer)
+      rescue JWT::DecodeError
+        true
+      end
+
+      def token_exists?
+        !token.nil?
+      end
+
       def token
         @token ||= HeaderParser.from_env(env)
       end

data/lib/warden/jwt_auth/token_encoder.rb

@@ -7,7 +7,7 @@ module Warden
     # Encodes a payload into a JWT token, adding some configurable
     # claims
     class TokenEncoder
-      include JWTAuth::Import['secret', 'algorithm', 'expiration_time']
+      include JWTAuth::Import['secret', 'algorithm', 'expiration_time', 'issuer']
 
       # Encodes a payload into a JWT
       #
@@ -24,6 +24,7 @@ module Warden
         now = Time.now.to_i
         payload['iat'] ||= now
         payload['exp'] ||= now + expiration_time
+        payload['iss'] ||= issuer if issuer
         payload['jti'] ||= SecureRandom.uuid
         payload
       end

data/lib/warden/jwt_auth/version.rb

@@ -2,6 +2,6 @@
 
 module Warden
   module JWTAuth
-    VERSION = '0.8.0'
+    VERSION = '0.9.0'
   end
 end

data/lib/warden/jwt_auth.rb

@@ -53,6 +53,13 @@ module Warden
     # Expiration time for tokens
     setting :expiration_time, default: 3600
 
+    # The issuer claims associated with the tokens
+    #
+    # Will be used to only apply the warden strategy when the issuer matches.
+    # This allows for multiple token issuers being used.
+    # @see https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.1
+    setting :issuer, default: nil
+
     # Request header which value will be encoded as `aud` claim in JWT. If
     # the header is not present `aud` will be `nil`.
     setting :aud_header, default: 'JWT_AUD'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: warden-jwt_auth
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.9.0
 platform: ruby
 authors:
 - Marc Busqué
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-01-31 00:00:00.000000000 Z
+date: 2024-06-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dry-auto_inject
@@ -252,7 +252,7 @@ licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'true'
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -267,8 +267,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
-signing_key: 
+rubygems_version: 3.5.9
+signing_key:
 specification_version: 4
 summary: JWT authentication for Warden.
 test_files: []