aha_builder_core 1.0.5 → 1.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8242fcb16eead2a99076077e2722d5815501f5fc3234eebfbf53a37648d79e5d
-  data.tar.gz: 854469a275e4e2cc06469e9d3fd967c3039b565c66ca344ac2df39f37daf94d0
+  metadata.gz: 9b8f4ea89a8c48e32987674fde51690fb12724503ca2284af49bb462c3daf70e
+  data.tar.gz: 0ce63753cead6d93aff650414fad65863903326409508c243df9c24bfc7f912e
 SHA512:
-  metadata.gz: 51e7277709855e865c53940dfec85081cab5c9c2b0b74c53cfd383a70c5cc01ad4cd725451f0268ae3515d2c0985ec17704ae3fb1d51a4f8204a398f438aa13b
-  data.tar.gz: 9385a9e023d76fc58f4dd802cb0dcacd2f773e055f75b549e2be59f11c2832dd9cc357de0c31c13e857ccf85e9645d26c760b1a765e8a61f9f95886f0976b50d
+  metadata.gz: 795df34548c6321d7bd28f514071fbbb3b797ad5aaabb5f52b86ca8fc1b186741e4bdd87a9d91efbc7151c38e81b8d81340bcff1bb6de42e10832fe47f1bda3b
+  data.tar.gz: 417d5fe39792591decf0e02be88c2095da37cf972ae94dbf5c683e7081cd2252bfc51398d9d3e1737681b280caa85b89ba9acf3dd5905afb9133462bb66bc5f6

data/lib/aha/auth/version.rb

@@ -2,6 +2,6 @@
 
 module Aha
   module Auth
-    VERSION = "1.0.5"
+    VERSION = "1.0.6"
   end
 end

data/lib/aha/auth.rb

@@ -42,15 +42,15 @@ module Aha
 
       # Generate login URL for redirecting users to the auth server
       #
-      # @param session [Hash] Session hash to store the nonce for CSRF verification
+      # @param cookies [Hash] Cookies hash to store the nonce for CSRF verification
       # @param state [String] Optional state parameter to pass through the auth flow
       # @return [String] The login URL
-      def login_url(session:, state: nil)
+      def login_url(cookies:, state: nil)
         # Generate a nonce for CSRF protection
         nonce = SecureRandom.hex(10)
 
         # Store nonce in the client's session if provided
-        session[:auth_nonce] = nonce if session
+        cookies[:auth_nonce] = nonce
 
         # Encode the state with nonce
         state_data = {
@@ -72,23 +72,27 @@ module Aha
       # Exchange an authorization code for tokens
       #
       # @param code [String] The authorization code from the callback (may include nonce)
-      # @param session [Hash] Session hash containing the nonce for CSRF verification
+      # @param cookies [Hash] Cookies hash containing the nonce for CSRF verification
       # @return [Hash] Token response with :session_token, :refresh_token, :expires_at, :user
-      def authenticate_with_code(code:, session:)
+      def authenticate_with_code(code:, cookies:)
         # Split the code and nonce if present
         actual_code, nonce = code.split(".", 2)
 
         # Verify CSRF protection if nonce is present
         if nonce
-          session_nonce = session[:auth_nonce]
+          cookie_nonce = cookies[:auth_nonce]
 
           # Verify nonce matches
-          if session_nonce.blank? || session_nonce != nonce
+          if cookie_nonce.blank? 
+            raise "CSRF verification failed: nonce missing in session"
+          end
+
+          if cookie_nonce != nonce
             raise "CSRF verification failed: nonce mismatch"
           end
 
           # Clear the nonce from session after verification
-          session.delete(:auth_nonce)
+          cookies.delete(:auth_nonce)
         else
           # If we fon't have a none, we can't verify CSRF.
           raise "CSRF verification failed: unable to verify nonce"

data/lib/generators/aha_builder_core/auth/templates/sessions_controller.rb.tt

@@ -4,13 +4,13 @@ class SessionsController < ApplicationController
   def new
     redirect_to Aha::Auth.login_url(
       state: { return_to: params[:return_to] || root_path }.to_json,
-      session:
+      cookies:
     ), allow_other_host: true
   end
 
   def callback
     if params[:code].present?
-      result = Aha::Auth.authenticate_with_code(code: params[:code], session:)
+      result = Aha::Auth.authenticate_with_code(code: params[:code], cookies:)
 
       user = User.find_or_initialize_by(auth_identifier: result[:user]["id"])
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aha_builder_core
 version: !ruby/object:Gem::Version
-  version: 1.0.5
+  version: 1.0.6
 platform: ruby
 authors:
 - Aha! Labs Inc.