authentication-zero 0.0.14 → 0.0.15
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/Gemfile.lock +1 -1
- data/README.md +25 -0
- data/lib/authentication_zero/version.rb +1 -1
- data/lib/generators/authentication/templates/controllers/api/emails_controller.rb.tt +0 -4
- data/lib/generators/authentication/templates/controllers/api/password_resets_controller.rb.tt +1 -2
- data/lib/generators/authentication/templates/controllers/api/passwords_controller.rb.tt +0 -1
- data/lib/generators/authentication/templates/controllers/html/emails_controller.rb.tt +0 -4
- data/lib/generators/authentication/templates/controllers/html/password_resets_controller.rb.tt +1 -2
- data/lib/generators/authentication/templates/controllers/html/passwords_controller.rb.tt +0 -1
- data/lib/generators/authentication/templates/mailers/email_mailer.rb.tt +1 -1
- data/lib/generators/authentication/templates/models/resource.rb.tt +17 -3
- data/lib/generators/authentication/templates/views/password_mailer/reset.html.erb.tt +1 -1
- data/lib/generators/authentication/templates/views/password_mailer/reset.text.erb.tt +1 -1
- data/lib/generators/authentication/templates/views/password_resets/edit.html.erb.tt +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 39cf93fc2be059b756c15125cfd0d4e35e0a8f96a803fbfcfb3aa31f64b2a704
|
4
|
+
data.tar.gz: 728fdd4a2af75e207db825c581e8fb1856be8d55b4fbfe6ac19aaa8e373b8557
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: ca7dc09acf69d59ada1e204fb77076731212afadddf77337eccc22466307917eed2e5cc1f11b92eee6bcd8722970a021c4ca48664f92714acd9f4c7579978db0
|
7
|
+
data.tar.gz: fe83d4649cf6c24fbbadecfee09dfdd1d245fb689da031eb187f061df26a9d6704cee1db904aa6c3c7c17763c51665637dd58f20515c08e93a88542c01879991
|
data/Gemfile.lock
CHANGED
data/README.md
CHANGED
@@ -2,6 +2,31 @@
|
|
2
2
|
|
3
3
|
The purpose of authentication zero is to generate a pre-built authentication system into a rails application (web or api-only) that follows both security and rails best practices. By generating code into the user's application instead of using a library, the user has complete freedom to modify the authentication system so it works best with their app.
|
4
4
|
|
5
|
+
## Features
|
6
|
+
|
7
|
+
- Sign up
|
8
|
+
- Email and password validations
|
9
|
+
- Reset the user password and send reset instructions
|
10
|
+
- Authentication by cookie (html)
|
11
|
+
- Authentication by token (api)
|
12
|
+
- Remember me (html)
|
13
|
+
- Send e-mail when email is changed
|
14
|
+
- Send e-mail when password is changed
|
15
|
+
- Cancel my account
|
16
|
+
- Log out
|
17
|
+
|
18
|
+
## Security and best practices
|
19
|
+
|
20
|
+
- [Current attributes](https://api.rubyonrails.org/classes/ActiveSupport/CurrentAttributes.html): Abstract super class that provides a thread-isolated attributes singleton, which resets automatically before and after each request.
|
21
|
+
- [has_secure_password](https://api.rubyonrails.org/classes/ActiveModel/SecurePassword/ClassMethods.html#method-i-has_secure_password): Adds methods to set and authenticate against a BCrypt password.
|
22
|
+
- [has_secure_token](https://api.rubyonrails.org/classes/ActiveRecord/SecureToken/ClassMethods.html#method-i-has_secure_token): Adds methods to generate unique tokens.
|
23
|
+
- [authenticate_with_http_token](https://api.rubyonrails.org/classes/ActionController/HttpAuthentication/Token.html): Compare the tokens in a time-constant manner, to mitigate timing attacks.
|
24
|
+
- [signed_id](https://api.rubyonrails.org/classes/ActiveRecord/SignedId.html): Returns a signed id that is tamper proof, so it's safe to send in an email or otherwise share with the outside world.
|
25
|
+
- [Http only cookies](https://api.rubyonrails.org/classes/ActionDispatch/Cookies.html): A cookie with the httponly attribute is inaccessible to the JavaScript, this precaution helps mitigate cross-site scripting (XSS) attacks.
|
26
|
+
- [Log filtering](https://guides.rubyonrails.org/action_controller_overview.html#log-filtering): Parameters 'token' and 'password' are marked [FILTERED] in the log.
|
27
|
+
- [Callbacks](https://api.rubyonrails.org/classes/ActiveRecord/Callbacks.html): We use callbacks to send emails before changing an email or password.
|
28
|
+
- [ActionMailer](https://api.rubyonrails.org/classes/ActionMailer/Base.html): Action Mailer allows you to send email from your application using a mailer model and views.
|
29
|
+
|
5
30
|
## Installation
|
6
31
|
|
7
32
|
Add this lines to your application's Gemfile:
|
@@ -5,10 +5,6 @@ class EmailsController < ApplicationController
|
|
5
5
|
if !@<%= singular_table_name %>.authenticate(params[:current_password])
|
6
6
|
render json: { error: "The current password you entered is incorrect" }, status: :bad_request
|
7
7
|
elsif @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
|
8
|
-
if @<%= singular_table_name %>.email_previously_changed?
|
9
|
-
EmailMailer.with(email_change: @<%= singular_table_name %>.email_previous_change).changed.deliver_later
|
10
|
-
end
|
11
|
-
|
12
8
|
render json: @<%= singular_table_name %>
|
13
9
|
else
|
14
10
|
render json: @<%= singular_table_name %>.errors, status: :unprocessable_entity
|
data/lib/generators/authentication/templates/controllers/api/password_resets_controller.rb.tt
CHANGED
@@ -1,6 +1,5 @@
|
|
1
1
|
class PasswordResetsController < ApplicationController
|
2
2
|
skip_before_action :authenticate
|
3
|
-
|
4
3
|
before_action :set_<%= singular_table_name %>, only: %i[ edit update ]
|
5
4
|
|
6
5
|
def edit
|
@@ -25,7 +24,7 @@ class PasswordResetsController < ApplicationController
|
|
25
24
|
|
26
25
|
private
|
27
26
|
def set_<%= singular_table_name %>
|
28
|
-
@<%= singular_table_name %> = <%= class_name %>.find_signed!(params[:
|
27
|
+
@<%= singular_table_name %> = <%= class_name %>.find_signed!(params[:token], purpose: "password_reset")
|
29
28
|
rescue ActiveSupport::MessageVerifier::InvalidSignature
|
30
29
|
render json: { error: "Your token has expired, please request a new one" }, status: :bad_request
|
31
30
|
end
|
@@ -5,7 +5,6 @@ class PasswordsController < ApplicationController
|
|
5
5
|
if !@<%= singular_table_name %>.authenticate(params[:current_password])
|
6
6
|
render json: { error: "The current password you entered is incorrect" }, status: :bad_request
|
7
7
|
elsif @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
|
8
|
-
PasswordMailer.with(user: @<%= singular_table_name %>).changed.deliver_later
|
9
8
|
render json: @<%= singular_table_name %>
|
10
9
|
else
|
11
10
|
render json: @<%= singular_table_name %>.errors, status: :unprocessable_entity
|
@@ -8,10 +8,6 @@ class EmailsController < ApplicationController
|
|
8
8
|
if !@<%= singular_table_name %>.authenticate(params[:current_password])
|
9
9
|
redirect_to edit_emails_path, alert: "The current password you entered is incorrect"
|
10
10
|
elsif @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
|
11
|
-
if @<%= singular_table_name %>.email_previously_changed?
|
12
|
-
EmailMailer.with(email_change: @<%= singular_table_name %>.email_previous_change).changed.deliver_later
|
13
|
-
end
|
14
|
-
|
15
11
|
redirect_to root_path, notice: "Your email has been changed successfully"
|
16
12
|
else
|
17
13
|
render :edit, status: :unprocessable_entity
|
data/lib/generators/authentication/templates/controllers/html/password_resets_controller.rb.tt
CHANGED
@@ -1,6 +1,5 @@
|
|
1
1
|
class PasswordResetsController < ApplicationController
|
2
2
|
skip_before_action :authenticate
|
3
|
-
|
4
3
|
before_action :set_<%= singular_table_name %>, only: %i[ edit update ]
|
5
4
|
|
6
5
|
def new
|
@@ -28,7 +27,7 @@ class PasswordResetsController < ApplicationController
|
|
28
27
|
|
29
28
|
private
|
30
29
|
def set_<%= singular_table_name %>
|
31
|
-
@<%= singular_table_name %> = <%= class_name %>.find_signed!(params[:
|
30
|
+
@<%= singular_table_name %> = <%= class_name %>.find_signed!(params[:token], purpose: "password_reset")
|
32
31
|
rescue ActiveSupport::MessageVerifier::InvalidSignature
|
33
32
|
redirect_to new_password_resets_path, alert: "Your token has expired, please request a new one"
|
34
33
|
end
|
@@ -8,7 +8,6 @@ class PasswordsController < ApplicationController
|
|
8
8
|
if !@<%= singular_table_name %>.authenticate(params[:current_password])
|
9
9
|
redirect_to edit_passwords_path, alert: "The current password you entered is incorrect"
|
10
10
|
elsif @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
|
11
|
-
PasswordMailer.with(user: @<%= singular_table_name %>).changed.deliver_later
|
12
11
|
redirect_to root_path, notice: "Your password has been changed successfully"
|
13
12
|
else
|
14
13
|
render :edit, status: :unprocessable_entity
|
@@ -6,9 +6,23 @@ class <%= class_name %> < ApplicationRecord
|
|
6
6
|
validates :email, format: { with: /\A[^@\s]+@[^@\s]+\z/ }
|
7
7
|
validates_length_of :password, minimum: 8, allow_blank: true
|
8
8
|
|
9
|
-
before_validation
|
9
|
+
before_validation do
|
10
|
+
self.email = email.downcase.strip
|
11
|
+
end
|
10
12
|
|
11
|
-
|
13
|
+
after_update_commit do
|
14
|
+
if self.email_previously_changed?
|
15
|
+
EmailMailer.with(change: self.email_previous_change).changed.deliver_later
|
16
|
+
end
|
17
|
+
end
|
18
|
+
|
19
|
+
after_update_commit do
|
20
|
+
if self.password_digest_previously_changed?
|
21
|
+
PasswordMailer.with(<%= singular_table_name %>: self).changed.deliver_later
|
22
|
+
end
|
23
|
+
end
|
24
|
+
|
25
|
+
def as_json(options = {})
|
12
26
|
super(options.merge(except: [:password_digest, :session_token]))
|
13
|
-
end
|
27
|
+
end
|
14
28
|
end
|
@@ -2,7 +2,7 @@
|
|
2
2
|
|
3
3
|
<p>Can't remember your password for <strong><%%= params[:<%= singular_table_name %>].email %></strong>? That's OK, it happens. Just hit the link below to set a new one.</p>
|
4
4
|
|
5
|
-
<p><%%= link_to "Reset my password", edit_password_resets_url(
|
5
|
+
<p><%%= link_to "Reset my password", edit_password_resets_url(token: @signed_id) %></p>
|
6
6
|
|
7
7
|
<p>If you did not request a password reset you can safely ignore this email, it expires in 20 minutes. Only someone with access to this email account can reset your password.</p>
|
8
8
|
|
@@ -2,7 +2,7 @@ Hey there,
|
|
2
2
|
|
3
3
|
Can't remember your password for <%%= params[:<%= singular_table_name %>].email %>? That's OK, it happens. Just hit the link below to set a new one.
|
4
4
|
|
5
|
-
[Reset my password]<%%= edit_password_resets_url(
|
5
|
+
[Reset my password]<%%= edit_password_resets_url(token: @signed_id) %>
|
6
6
|
|
7
7
|
If you did not request a password reset you can safely ignore this email, it expires in 20 minutes. Only someone with access to this email account can reset your password.
|
8
8
|
|