Allow 10-second leeway when decoding tokens (#27)

* allow 10-second leeway when decoding tokens

* Bump VERSION to 0.2.0

Co-authored-by: Julia Allen <julia.l.allen@gsa.gov>

Author: MothOnMars

lib/omniauth/login_dot_gov/id_token.rb

@@ -38,7 +38,8 @@ def decoded_id_token
           id_token,
           client.idp_configuration.public_key,
           true,
-          algorithm: 'RS256'
+          algorithm: 'RS256',
+          leeway: 10
         ).first
       end
     end

lib/omniauth/login_dot_gov/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module LoginDotGov
-    VERSION = '0.1.2'.freeze
+    VERSION = '0.2.0'.freeze
   end
 end

spec/omniauth/login_dot_gov/id_token_spec.rb

@@ -35,5 +35,22 @@
         )
       end
     end
+    context 'when the token nbf is within 10 seconds past decoding time' do
+      let(:jwt) { JWT.encode({ nbf: Time.now.to_i + 10, nonce: jwt_nonce }, IdpFixtures.private_key, 'RS256') }
+
+      it 'allows 10 seconds of leeway' do
+        expect(subject.verify_nonce(session_nonce_digest)).to eq true
+      end
+    end
+
+    context 'when the token nbf is not within 10 seconds past decoding time' do
+      let(:jwt) { JWT.encode({ nbf: Time.now.to_i + 11, nonce: jwt_nonce }, IdpFixtures.private_key, 'RS256') }
+
+      it 'raises ImmatureSignature error' do
+        expect { subject.verify_nonce(session_nonce_digest) }.to raise_error(
+          JWT::ImmatureSignature
+        )
+      end
+    end
   end
 end