ahoy_email 2.2.0 → 2.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9c664f526e52ac8f97cf3d5fe5b154ab6396e3f5c8db3d42c7c76022df9e0b35
-  data.tar.gz: 063f9ac13bebe763ff2e33677e68bebd75f46837c5e63b920208e2547725a2a9
+  metadata.gz: 238e4d5f6eb74588ea6d9d628cce5b7c69fa584741280c9d766fa13c5ef8164a
+  data.tar.gz: 3dedf13c78c400d139bb9450fc01ceb1a56c844b463ff0cafdf12fc7f6553573
 SHA512:
-  metadata.gz: 1d7556134bb052f06eea6755f668cdd7c4eb5355dcbe46098894ff6b5ed8735b4c20b240378bafebb9b03b9c2525cf4e7b79e9a0fa240bf1a86289b8c0eb2c2b
-  data.tar.gz: b576323d7768c3c0872afecbbfa35a7ce12b1d8df9a6dc9877d96e691e1d4675a60ef590e00705be8c245a543dc151249504ba511a96d6bbf37ead17afcf6666
+  metadata.gz: 4cc75f90c29e23f1c4dc5e87cfa626cbff9a6a0f3c23850f5813bb3890f1afbc72912e94bc8fb5f15f87c0f32794c7031f5559d0255d52065412e73dba793985
+  data.tar.gz: 559b2bec029c2d659c10799ff38453b939ff615f84a7a4041670badf3b96c8faa91d9f6037f9147d0003422197bdc430ddd2e075f391391c01905cb522abc2f6

data/CHANGELOG.md

@@ -1,3 +1,12 @@
+## 2.3.1 (2024-09-09)
+
+- Fixed deprecation warning with Rails 7.1
+
+## 2.3.0 (2024-06-01)
+
+- Added support for secret token rotation
+- Improved secret token generation
+
 ## 2.2.0 (2023-07-02)
 
 - Removed support for Ruby < 3 and Rails < 6.1

data/README.md

@@ -4,9 +4,9 @@ First-party email analytics for Rails
 
 :fire: For web and native app analytics, check out [Ahoy](https://github.com/ankane/ahoy)
 
-:bullettrain_side: To manage unsubscribes, check out [Mailkick](https://github.com/ankane/mailkick)
+:bullettrain_side: To manage email subscriptions, check out [Mailkick](https://github.com/ankane/mailkick)
 
-[![Build Status](https://github.com/ankane/ahoy_email/workflows/build/badge.svg?branch=master)](https://github.com/ankane/ahoy_email/actions)
+[![Build Status](https://github.com/ankane/ahoy_email/actions/workflows/build.yml/badge.svg)](https://github.com/ankane/ahoy_email/actions)
 
 ## Installation
 
@@ -106,7 +106,7 @@ user.messages
 Add extra data to messages. Create a migration like:
 
 ```ruby
-class AddCouponIdToAhoyMessages < ActiveRecord::Migration[7.0]
+class AddCouponIdToAhoyMessages < ActiveRecord::Migration[7.2]
   def change
     add_column :ahoy_messages, :coupon_id, :integer
   end
@@ -156,7 +156,7 @@ end
 Delete older data with:
 
 ```ruby
-Ahoy::Message.where("created_at < ?", 1.year.ago).in_batches.delete_all
+Ahoy::Message.where("sent_at < ?", 1.year.ago).in_batches.delete_all
 ```
 
 Delete data for a specific user with:
@@ -324,54 +324,6 @@ Get stats for a campaign
 AhoyEmail.stats("my-campaign")
 ```
 
-## Upgrading
-
-### 2.0
-
-Ahoy Email 2.0 brings a number of changes. Here are a few to be aware of:
-
-- The `to` field is encrypted by default for new installations. If you’d like to encrypt an existing installation, install [Lockbox](https://github.com/ankane/lockbox) and [Blind Index](https://github.com/ankane/blind_index) and follow the Lockbox instructions for [migrating existing data](https://github.com/ankane/lockbox#migrating-existing-data).
-
-  For the model, create `app/models/ahoy/message.rb` with:
-
-  ```ruby
-  class Ahoy::Message < ActiveRecord::Base
-    self.table_name = "ahoy_messages"
-
-    belongs_to :user, polymorphic: true, optional: true
-
-    encrypts :to, migrating: true
-    blind_index :to, migrating: true
-  end
-  ```
-
-- The `track` method has been broken into:
-
-  - `has_history` for message history
-  - `utm_params` for UTM tagging
-  - `track_clicks` for click analytics
-
-- Message history is no longer enabled by default. Add `has_history` to individual mailers, or create an initializer with:
-
-  ```ruby
-  AhoyEmail.default_options[:message] = true
-  ```
-
-- For privacy, open tracking has been removed.
-
-- For clicks, we encourage you to try [aggregate analytics](#click-analytics) to measure the performance of campaigns. You can use a library like [Rollup](https://github.com/ankane/rollup) to aggregate existing data, then drop the `token` and `clicked_at` columns.
-
-  To keep individual analytics, use `has_history` and `track_clicks campaign: false` and create an initializer with:
-
-  ```ruby
-  AhoyEmail.save_token = true
-  AhoyEmail.subscribers << AhoyEmail::MessageSubscriber
-  ```
-
-  If you use a custom subscriber, `:message` is no longer included in click events. You can use `:token` to query the message if needed.
-
-- Users are shown a link expired page when signature verification fails instead of being redirected to the homepage when `AhoyEmail.invalid_redirect_url` is not set
-
 ## History
 
 View the [changelog](https://github.com/ankane/ahoy_email/blob/master/CHANGELOG.md)

data/app/controllers/ahoy/messages_controller.rb

@@ -11,24 +11,23 @@ module Ahoy
     end
 
     def click
-      if params[:id]
-        # legacy
+      legacy = params[:id]
+      if legacy
         token = params[:id].to_s
+        campaign = nil
         url = params[:url].to_s
         signature = params[:signature].to_s
-        expected_signature = OpenSSL::HMAC.hexdigest("SHA1", AhoyEmail::Utils.secret_token, url)
       else
         token = params[:t].to_s
         campaign = params[:c].to_s
         url = params[:u].to_s
         signature = params[:s].to_s
-        expected_signature = AhoyEmail::Utils.signature(token: token, campaign: campaign, url: url)
       end
 
       redirect_options = {}
       redirect_options[:allow_other_host] = true if ActionPack::VERSION::MAJOR >= 7
 
-      if ActiveSupport::SecurityUtils.secure_compare(signature, expected_signature)
+      if AhoyEmail::Utils.signature_verified?(legacy: legacy, token: token, campaign: campaign, url: url, signature: signature)
         data = {}
         data[:campaign] = campaign if campaign
         data[:token] = token

data/lib/ahoy_email/engine.rb

@@ -4,10 +4,14 @@ module AhoyEmail
   class Engine < ::Rails::Engine
     initializer "ahoy_email" do |app|
       AhoyEmail.secret_token ||= begin
+        tokens = []
+        tokens << app.key_generator.generate_key("ahoy_email")
+
+        # TODO remove in 3.0
         creds =
           if app.respond_to?(:credentials) && app.credentials.secret_key_base
             app.credentials
-          elsif app.respond_to?(:secrets)
+          elsif app.respond_to?(:secrets) && (Rails::VERSION::STRING.to_f < 7.1 || app.config.paths["config/secrets"].existent.any?)
             app.secrets
           else
             app.config
@@ -15,7 +19,9 @@ module AhoyEmail
 
         token = creds.respond_to?(:secret_key_base) ? creds.secret_key_base : creds.secret_token
         token ||= app.secret_key_base # should come first, but need to maintain backward compatibility
-        token
+        tokens << token
+
+        tokens
       end
     end
   end

data/lib/ahoy_email/utils.rb

@@ -7,13 +7,28 @@ module AhoyEmail
     }
 
     class << self
-      def signature(token:, campaign:, url:)
+      def signature(token:, campaign:, url:, secret_token: nil)
+        secret_token ||= secret_tokens.first
+
         # encode and join with a character outside encoding
         data = [token, campaign, url].map { |v| Base64.strict_encode64(v.to_s) }.join("|")
 
         Base64.urlsafe_encode64(OpenSSL::HMAC.digest("SHA256", secret_token, data), padding: false)
       end
 
+      def signature_verified?(legacy:, token:, campaign:, url:, signature:)
+        secret_tokens.any? do |secret_token|
+          expected_signature =
+            if legacy
+              OpenSSL::HMAC.hexdigest("SHA1", secret_token, url)
+            else
+              signature(token: token, campaign: campaign, url: url, secret_token: secret_token)
+            end
+
+          ActiveSupport::SecurityUtils.secure_compare(signature, expected_signature)
+        end
+      end
+
       def publish(name, event)
         method_name = "track_#{name}"
         AhoyEmail.subscribers.each do |subscriber|
@@ -27,8 +42,8 @@ module AhoyEmail
         end
       end
 
-      def secret_token
-        AhoyEmail.secret_token || (raise "Secret token is empty")
+      def secret_tokens
+        Array(AhoyEmail.secret_token || (raise "Secret token is empty"))
       end
     end
   end

data/lib/ahoy_email/version.rb

@@ -1,3 +1,3 @@
 module AhoyEmail
-  VERSION = "2.2.0"
+  VERSION = "2.3.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ahoy_email
 version: !ruby/object:Gem::Version
-  version: 2.2.0
+  version: 2.3.1
 platform: ruby
 authors:
 - Andrew Kane
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-07-02 00:00:00.000000000 Z
+date: 2024-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionmailer
@@ -123,7 +123,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.10
+rubygems_version: 3.5.16
 signing_key:
 specification_version: 4
 summary: First-party email analytics for Rails