zaikio-jwt_auth 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 025f45746c3a1a8f50fe821e580f5b41e3ae0126bf450a785488941200e2b0bf
-  data.tar.gz: 0ded26e92d822a537c8238f01f13ae3a51f3fc6e2e48863b88455ec25d26dd7b
+  metadata.gz: 5e75e96ec3854a6fcaad1f5d4dcc01f92ba444741c34af7de567427cfeec6159
+  data.tar.gz: 9250c75142635ac6eb4a8f31f7c5b16c541493cf660bf99da268f5233ddb4485
 SHA512:
-  metadata.gz: 819316b9aa09aa764ce734b1f177da3aeb108c9b5b7e0cfb3426aac674dbc13115df3767d2cf933321241c88ff0721caecebef4eb7be630d04882e2a7c91eac2
-  data.tar.gz: 762dd6bb4b7e0abd44cc4333d6c5799ed2802d893875cab1808f690f46f10a6a3844fbe8a1c26004895846375be4832ad4afd218cf84ebf9eb79abe993a9714b
+  metadata.gz: b6c823c6798566123fcf7fc20b1c40e98bc1acf00314b91e1d6b8d8b645716b347bad5179f58e002484c95945fdcafcc4a30a3f7ffe9843ca46e2ca35583d91d
+  data.tar.gz: 9c9ebfb94fb8b9c2f62f42a9e2bafad58918830f20463dab24dd209cf7a9a33a270f0a52b8f2ac8d2339bc71097736ada9766baadd840d671231ddbefa2a7d60

data/README.md

@@ -61,6 +61,8 @@ class API::ResourcesController < API::ApplicationController
 end
 ```
 
+By convention, `authorize_by_jwt_scopes` automatically maps all CRUD actions in a controller. Requests for `show` and `index` with a read or read_write scope are allowed. All other actions like `create`, `update` and `destroy` are accepted if the scope is a write or read_write scope. Therefore it is strongly recommended to always create standard Rails resources. If a custom action is required, you will need to authorize yourself using the `after_jwt_auth`.
+
 ### 6. Optionally, if you are using SSO: Check revoked tokens
 
 Additionally, the API provides a method called `revoked_jwt?` which expects the `jti` of the JWT.
@@ -73,10 +75,23 @@ Zaikio::JWTAuth.revoked_jwt?('jti-of-token') # returns true if token was revoked
 
 ```rb
 # in your test_helper.rb
-include Zaikio::JWTAuth::TestHelper
+class ActiveSupport::TestCase
+  # ...
+  include Zaikio::JWTAuth::TestHelper
+  # ...
+end
+
+# in your integration tests you can use:
+class ResourcesControllerTest < ActionDispatch::IntegrationTest
+  def setup
+    mock_jwt(sub: 'Organization/123', scope: ['directory.organization.r'])
+  end
 
-# in your tests you can use:
-mock_jwt(sub: 'Organization/123', scope: ['directory.organization.r'])
+  test "do a request with a mocked jwt" do
+    get resources_path
+    # test the actual business logic
+  end
+end
 ```
 
 ## Advanced

data/app/jobs/zaikio/jwt_auth/revoke_access_token_job.rb

@@ -2,8 +2,8 @@ module Zaikio
   module JWTAuth
     class RevokeAccessTokenJob < ApplicationJob
       def perform(event)
-        DirectoryCache.update("api/v1/blacklisted_access_tokens.json", expires_after: 60.minutes) do |data|
-          data["blacklisted_token_ids"] << event.payload["access_token_id"]
+        DirectoryCache.update("api/v1/revoked_access_tokens.json", expires_after: 60.minutes) do |data|
+          data["revoked_token_ids"] << event.payload["access_token_id"]
           data
         end
       end

data/config/initializers/inflections.rb

@@ -1,3 +1,3 @@
 ActiveSupport::Inflector.inflections(:en) do |inflect|
-  inflect.acronym 'JWT'
+  inflect.acronym "JWT"
 end

data/lib/zaikio/jwt_auth.rb

@@ -26,15 +26,16 @@ module Zaikio
     end
 
     def self.revoked_jwt?(jti)
-      blacklisted_token_ids.include?(jti)
+      revoked_token_ids.include?(jti)
     end
 
-    def self.blacklisted_token_ids
+    def self.revoked_token_ids
       return [] if mocked_jwt_payload
 
-      return configuration.blacklisted_token_ids if configuration.blacklisted_token_ids
-
-      DirectoryCache.fetch("api/v1/blacklisted_access_tokens.json", expires_after: 60.minutes)["blacklisted_token_ids"]
+      configuration.revoked_token_ids || DirectoryCache.fetch(
+        "api/v1/revoked_access_tokens.json",
+        expires_after: 60.minutes
+      )["revoked_token_ids"]
     end
 
     def self.included(base)
@@ -70,24 +71,24 @@ module Zaikio
 
         token_data = TokenData.new(jwt_payload)
 
-        return if show_error_if_token_is_blacklisted(token_data)
+        return if show_error_if_token_is_revoked(token_data)
 
         return if show_error_if_authorize_by_jwt_subject_type_fails(token_data)
 
         return if show_error_if_authorize_by_jwt_scopes_fails(token_data)
 
-        send(:after_jwt_auth, token_data) if respond_to?(:after_jwt_auth)
+        send(:after_jwt_auth, token_data) if respond_to?(:after_jwt_auth, true)
       rescue JWT::ExpiredSignature
         render_error("jwt_expired") && (return)
       rescue JWT::DecodeError
         render_error("invalid_jwt") && (return)
       end
 
-      def update_blacklisted_access_tokens_by_webhook
+      def update_revoked_access_tokens_by_webhook
         return unless params[:name] == "directory.revoked_access_token"
 
-        DirectoryCache.update("api/v1/blacklisted_access_tokens.json", expires_after: 60.minutes) do |data|
-          data["blacklisted_token_ids"] << params[:payload][:access_token_id]
+        DirectoryCache.update("api/v1/revoked_access_tokens.json", expires_after: 60.minutes) do |data|
+          data["revoked_token_ids"] << params[:payload][:access_token_id]
           data
         end
 
@@ -130,7 +131,7 @@ module Zaikio
         render_error("unpermitted_subject")
       end
 
-      def show_error_if_token_is_blacklisted(token_data)
+      def show_error_if_token_is_revoked(token_data)
         return unless Zaikio::JWTAuth.revoked_jwt?(token_data.jti)
 
         render_error("invalid_jwt")

data/lib/zaikio/jwt_auth/configuration.rb

@@ -14,11 +14,11 @@ module Zaikio
       attr_accessor :app_name
       attr_accessor :redis, :host
       attr_reader :environment
-      attr_writer :logger, :blacklisted_token_ids, :keys
+      attr_writer :logger, :revoked_token_ids, :keys
 
       def initialize
         @environment = :sandbox
-        @blacklisted_token_ids = nil
+        @revoked_token_ids = nil
       end
 
       def logger
@@ -31,11 +31,11 @@ module Zaikio
       end
 
       def keys
-        @keys.is_a?(Proc) ? @keys.call : @keys
+        defined?(@keys) && @keys.is_a?(Proc) ? @keys.call : @keys
       end
 
-      def blacklisted_token_ids
-        @blacklisted_token_ids.is_a?(Proc) ? @blacklisted_token_ids.call : @blacklisted_token_ids
+      def revoked_token_ids
+        @revoked_token_ids.is_a?(Proc) ? @revoked_token_ids.call : @revoked_token_ids
       end
 
       private

data/lib/zaikio/jwt_auth/test_helper.rb

@@ -1,7 +1,7 @@
 module Zaikio
   module JWTAuth
     module TestHelper
-      def after_setup
+      def after_teardown
         Zaikio::JWTAuth.mocked_jwt_payload = nil
         super
       end

data/lib/zaikio/jwt_auth/version.rb

@@ -1,5 +1,5 @@
 module Zaikio
   module JWTAuth
-    VERSION = "0.2.1".freeze
+    VERSION = "0.3.0".freeze
   end
 end

metadata

@@ -1,14 +1,16 @@
 --- !ruby/object:Gem::Specification
 name: zaikio-jwt_auth
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
-- Crispy Mountain GmbH
+- crispymtn
+- Jalyna Schröder
+- Martin Spickermann
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-04-02 00:00:00.000000000 Z
+date: 2020-06-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: oj
@@ -30,14 +32,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 6.0.2.2
+        version: 5.0.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 6.0.2.2
+        version: 5.0.0
 - !ruby/object:Gem::Dependency
   name: jwt
   requirement: !ruby/object:Gem::Requirement
@@ -54,7 +56,9 @@ dependencies:
         version: 2.2.1
 description: JWT-Based authentication and authorization with zaikio.
 email:
+- op@crispymtn.com
 - js@crispymtn.com
+- spickermann@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -93,7 +97,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: JWT-Based authentication and authorization with zaikio