action_auth 1.2.0 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2199e638d124811034db20d5d3cd6f0b23d56acf260d42e18f9559bf54405295
-  data.tar.gz: ab312a35ead67087ab41cfb30f54a42696521924fb1e695870e87632742497d6
+  metadata.gz: 1370e1eb71e677f2fc9be43d6cf7cb96940f3b59916615c06bc0af02c6231fff
+  data.tar.gz: 10332892a9e4379fa282688161fcc9127a4ffb97da386b5858d612f460d50073
 SHA512:
-  metadata.gz: 53f6e3b604bc0037a751269cd16975e243e84ebd1018419764c88a2b60a8309455736b2b7a2ec1e6b29cb2970e4e0020348756fed9658400f32d2d3a2f3b179a
-  data.tar.gz: 0ccad04b7a3e4ccbb50e80149b40d452364089600a2a5462ea2392ece13151f8903f65c491d8bd3dc5507ae6fac3ac6430ae18b0b0ac247acb434f898a3c3055
+  metadata.gz: f59840cc7ab77c07e19e6a181bdc8705d1fdbd9cc643a78fe270175bee205ce1f35c404577c49a2ffe2e638780caa00ed3c18c6d1016763d772039521d37213f
+  data.tar.gz: b5f26e0a11f7e241d3697d6933ef8ff6047b433c407f1878705fef608ca85415645ba0ea932dba0eaad8860e7ef041766511750eeebca7e1366fb672981bab38

data/README.md

@@ -15,12 +15,13 @@ user experience akin to that offered by the well-regarded Devise gem.
    - [Routes](#routes)
    - [Helper Methods](#helper-methods)
    - [Restricting and Changing Routes](#restricting-and-changing-routes)
-5. [WebAuthn](#webauthn)
-6. [Within Your Application](#within-your-application)
-7. Customizing
+5. [Have I Been Pwned](#have-i-been-pwned)
+6. [WebAuthn](#webauthn)
+7. [Within Your Application](#within-your-application)
+8. Customizing
    - [Sign In Page](https://github.com/kobaltz/action_auth/wiki/Overriding-Sign-In-page-view)
-7. [License](#license)
-8. [Credits](#credits)
+9. [License](#license)
+10. [Credits](#credits)
 
 ## Breaking Changes
 
@@ -130,6 +131,8 @@ These are the planned features for ActionAuth. The ones that are checked off are
 
 ⏳ - OAuth with Google, Facebook, Github, Twitter, etc.
 
+✅ - Have I Been Pwned Integration
+
 ✅ - Account Deletion
 
 ⏳ - Account Lockout
@@ -206,13 +209,15 @@ versus a user that is not logged in.
     end
     root to: 'welcome#index'
 
-## WebAuthn
+## Have I Been Pwned
 
-ActionAuth's approach for WebAuthn is simplicity. It is used as a multifactor authentication step,
-so users will still need to register their email address and password. Once the user is registered,
-they can add a Passkey to their account. The Passkey could be an iCloud Keychain, a hardware security
-key like a Yubikey, or a mobile device. If enabled and configured, the user will be prompted to use
-their Passkey after they log in.
+[Have I Been Pwned](https://haveibeenpwned.com/) is a way that youre able to check if a password has been compromised in a data breach. This is a great way to ensure that your users are using secure passwords.
+
+Add the `pwned` gem to your Gemfile. That's all you'll have to do to enable this functionality.
+
+```ruby
+bundle add pwned
+```
 
 ## Magic Links
 
@@ -236,6 +241,13 @@ will want to style this to fit your application and have some kind of confirmati
   <%= button_to "Delete Account", action_auth.users_path, method: :delete %>
 </p>
 ```
+## WebAuthn
+
+ActionAuth's approach for WebAuthn is simplicity. It is used as a multifactor authentication step,
+so users will still need to register their email address and password. Once the user is registered,
+they can add a Passkey to their account. The Passkey could be an iCloud Keychain, a hardware security
+key like a Yubikey, or a mobile device. If enabled and configured, the user will be prompted to use
+their Passkey after they log in.
 
 #### Configuration
 

data/app/controllers/action_auth/identity/password_resets_controller.rb

@@ -2,6 +2,7 @@ module ActionAuth
   module Identity
     class PasswordResetsController < ApplicationController
       before_action :set_user, only: %i[ edit update ]
+      before_action :validate_pwned_password, only: :update
 
       def new
       end
@@ -41,6 +42,16 @@ module ActionAuth
       def send_password_reset_email
         UserMailer.with(user: @user).password_reset.deliver_later
       end
+
+      def validate_pwned_password
+        return unless ActionAuth.configuration.pwned_enabled?
+
+        pwned = Pwned::Password.new(params[:password])
+        if pwned.pwned?
+          @user.errors.add(:password, "has been pwned #{pwned.pwned_count} times. Please choose a different password.")
+          render :edit, status: :unprocessable_entity
+        end
+      end
     end
   end
 end

data/app/controllers/action_auth/passwords_controller.rb

@@ -1,6 +1,7 @@
 module ActionAuth
   class PasswordsController < ApplicationController
     before_action :set_user
+    before_action :validate_pwned_password, only: :update
 
     def edit
     end
@@ -22,5 +23,15 @@ module ActionAuth
     def user_params
       params.permit(:password, :password_confirmation, :password_challenge).with_defaults(password_challenge: "")
     end
+
+    def validate_pwned_password
+      return unless ActionAuth.configuration.pwned_enabled?
+
+      pwned = Pwned::Password.new(params[:password])
+      if pwned.pwned?
+        @user.errors.add(:password, "has been pwned #{pwned.pwned_count} times. Please choose a different password.")
+        render :new, status: :unprocessable_entity
+      end
+    end
   end
 end

data/app/controllers/action_auth/registrations_controller.rb

@@ -1,5 +1,7 @@
 module ActionAuth
   class RegistrationsController < ApplicationController
+    before_action :validate_pwned_password, only: :create
+
     def new
       @user = User.new
     end
@@ -23,12 +25,25 @@ module ActionAuth
     end
 
     private
-      def user_params
-        params.permit(:email, :password, :password_confirmation)
-      end
 
-      def send_email_verification
-        UserMailer.with(user: @user).email_verification.deliver_later
+    def user_params
+      params.permit(:email, :password, :password_confirmation)
+    end
+
+    def send_email_verification
+      UserMailer.with(user: @user).email_verification.deliver_later
+    end
+
+    def validate_pwned_password
+      return unless ActionAuth.configuration.pwned_enabled?
+
+      pwned = Pwned::Password.new(params[:password])
+
+      if pwned.pwned?
+        @user = User.new(email: params[:email])
+        @user.errors.add(:password, "has been pwned #{pwned.pwned_count} times. Please choose a different password.")
+        render :new, status: :unprocessable_entity
       end
+    end
   end
 end

data/app/views/action_auth/identity/password_resets/edit.html.erb

@@ -15,18 +15,18 @@
 
   <%= form.hidden_field :sid, value: params[:sid] %>
 
-  <div>
+  <div class="mb-3">
     <%= form.label :password, "New password", style: "display: block" %>
     <%= form.password_field :password, required: true, autofocus: true, autocomplete: "new-password" %>
     <div>12 characters minimum.</div>
   </div>
 
-  <div>
+  <div class="mb-3">
     <%= form.label :password_confirmation, "Confirm new password", style: "display: block" %>
     <%= form.password_field :password_confirmation, required: true, autocomplete: "new-password" %>
   </div>
 
   <div>
-    <%= form.submit "Save changes" %>
+    <%= form.submit "Save changes", class: "btn btn-primary" %>
   </div>
 <% end %>

data/lib/action_auth/configuration.rb

@@ -14,6 +14,7 @@ module ActionAuth
       @allow_user_deletion = true
       @default_from_email = "from@example.com"
       @magic_link_enabled = true
+      @pwned_enabled = defined?(Pwned)
       @verify_email_on_sign_in = true
       @webauthn_enabled = defined?(WebAuthn)
       @webauthn_origin = "http://localhost:3000"
@@ -21,16 +22,20 @@ module ActionAuth
     end
 
     def allow_user_deletion?
-      @allow_user_deletion.respond_to?(:call) ? @allow_user_deletion.call : @allow_user_deletion
+      @allow_user_deletion == true
     end
 
     def magic_link_enabled?
-      @magic_link_enabled.respond_to?(:call) ? @magic_link_enabled.call : @magic_link_enabled
+      @magic_link_enabled == true
     end
 
     def webauthn_enabled?
       @webauthn_enabled.respond_to?(:call) ? @webauthn_enabled.call : @webauthn_enabled
     end
 
+    def pwned_enabled?
+      @pwned_enabled.respond_to?(:call) ? @pwned_enabled.call : @pwned_enabled
+    end
+
   end
 end

data/lib/action_auth/version.rb

@@ -1,3 +1,3 @@
 module ActionAuth
-  VERSION = "1.2.0"
+  VERSION = "1.4.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: action_auth
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.4.0
 platform: ruby
 authors:
 - Dave Kimura
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-08-09 00:00:00.000000000 Z
+date: 2024-08-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -125,7 +125,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.16
+rubygems_version: 3.5.17
 signing_key:
 specification_version: 4
 summary: A simple Rails engine for authorization.