authentication-zero 0.0.14 → 0.0.15

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 0f9beaffb78e2f198c9276df8dda0a72f8029b55cd7d5b282aeb5c30b9abe02e
4
- data.tar.gz: 2f7fb5ced42bde9126bae2a876ce58127e0b1ad27f4b6fbf8b675656ea557873
3
+ metadata.gz: 39cf93fc2be059b756c15125cfd0d4e35e0a8f96a803fbfcfb3aa31f64b2a704
4
+ data.tar.gz: 728fdd4a2af75e207db825c581e8fb1856be8d55b4fbfe6ac19aaa8e373b8557
5
5
  SHA512:
6
- metadata.gz: 3a6602f790b8e9da67546b711df55b9e6e196d22bf06b12dfa8a2c84359d1d21d77a22a28d8eec4c06208ff2d27090c93e2c034e1d5e859370552886d518ffe6
7
- data.tar.gz: 9535c89a33b6b0f8bfc50a8b5039a989b68e3204fdbca48f2501ba13d84cab77a9ef737329f0adf874a1f1b53694c0452aafe1ef5278f93df59198cf28286bf9
6
+ metadata.gz: ca7dc09acf69d59ada1e204fb77076731212afadddf77337eccc22466307917eed2e5cc1f11b92eee6bcd8722970a021c4ca48664f92714acd9f4c7579978db0
7
+ data.tar.gz: fe83d4649cf6c24fbbadecfee09dfdd1d245fb689da031eb187f061df26a9d6704cee1db904aa6c3c7c17763c51665637dd58f20515c08e93a88542c01879991
data/Gemfile.lock CHANGED
@@ -1,7 +1,7 @@
1
1
  PATH
2
2
  remote: .
3
3
  specs:
4
- authentication-zero (0.0.14)
4
+ authentication-zero (0.0.15)
5
5
 
6
6
  GEM
7
7
  remote: https://rubygems.org/
data/README.md CHANGED
@@ -2,6 +2,31 @@
2
2
 
3
3
  The purpose of authentication zero is to generate a pre-built authentication system into a rails application (web or api-only) that follows both security and rails best practices. By generating code into the user's application instead of using a library, the user has complete freedom to modify the authentication system so it works best with their app.
4
4
 
5
+ ## Features
6
+
7
+ - Sign up
8
+ - Email and password validations
9
+ - Reset the user password and send reset instructions
10
+ - Authentication by cookie (html)
11
+ - Authentication by token (api)
12
+ - Remember me (html)
13
+ - Send e-mail when email is changed
14
+ - Send e-mail when password is changed
15
+ - Cancel my account
16
+ - Log out
17
+
18
+ ## Security and best practices
19
+
20
+ - [Current attributes](https://api.rubyonrails.org/classes/ActiveSupport/CurrentAttributes.html): Abstract super class that provides a thread-isolated attributes singleton, which resets automatically before and after each request.
21
+ - [has_secure_password](https://api.rubyonrails.org/classes/ActiveModel/SecurePassword/ClassMethods.html#method-i-has_secure_password): Adds methods to set and authenticate against a BCrypt password.
22
+ - [has_secure_token](https://api.rubyonrails.org/classes/ActiveRecord/SecureToken/ClassMethods.html#method-i-has_secure_token): Adds methods to generate unique tokens.
23
+ - [authenticate_with_http_token](https://api.rubyonrails.org/classes/ActionController/HttpAuthentication/Token.html): Compare the tokens in a time-constant manner, to mitigate timing attacks.
24
+ - [signed_id](https://api.rubyonrails.org/classes/ActiveRecord/SignedId.html): Returns a signed id that is tamper proof, so it's safe to send in an email or otherwise share with the outside world.
25
+ - [Http only cookies](https://api.rubyonrails.org/classes/ActionDispatch/Cookies.html): A cookie with the httponly attribute is inaccessible to the JavaScript, this precaution helps mitigate cross-site scripting (XSS) attacks.
26
+ - [Log filtering](https://guides.rubyonrails.org/action_controller_overview.html#log-filtering): Parameters 'token' and 'password' are marked [FILTERED] in the log.
27
+ - [Callbacks](https://api.rubyonrails.org/classes/ActiveRecord/Callbacks.html): We use callbacks to send emails before changing an email or password.
28
+ - [ActionMailer](https://api.rubyonrails.org/classes/ActionMailer/Base.html): Action Mailer allows you to send email from your application using a mailer model and views.
29
+
5
30
  ## Installation
6
31
 
7
32
  Add this lines to your application's Gemfile:
@@ -1,3 +1,3 @@
1
1
  module AuthenticationZero
2
- VERSION = "0.0.14"
2
+ VERSION = "0.0.15"
3
3
  end
@@ -5,10 +5,6 @@ class EmailsController < ApplicationController
5
5
  if !@<%= singular_table_name %>.authenticate(params[:current_password])
6
6
  render json: { error: "The current password you entered is incorrect" }, status: :bad_request
7
7
  elsif @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
8
- if @<%= singular_table_name %>.email_previously_changed?
9
- EmailMailer.with(email_change: @<%= singular_table_name %>.email_previous_change).changed.deliver_later
10
- end
11
-
12
8
  render json: @<%= singular_table_name %>
13
9
  else
14
10
  render json: @<%= singular_table_name %>.errors, status: :unprocessable_entity
@@ -1,6 +1,5 @@
1
1
  class PasswordResetsController < ApplicationController
2
2
  skip_before_action :authenticate
3
-
4
3
  before_action :set_<%= singular_table_name %>, only: %i[ edit update ]
5
4
 
6
5
  def edit
@@ -25,7 +24,7 @@ class PasswordResetsController < ApplicationController
25
24
 
26
25
  private
27
26
  def set_<%= singular_table_name %>
28
- @<%= singular_table_name %> = <%= class_name %>.find_signed!(params[:sid], purpose: "password_reset")
27
+ @<%= singular_table_name %> = <%= class_name %>.find_signed!(params[:token], purpose: "password_reset")
29
28
  rescue ActiveSupport::MessageVerifier::InvalidSignature
30
29
  render json: { error: "Your token has expired, please request a new one" }, status: :bad_request
31
30
  end
@@ -5,7 +5,6 @@ class PasswordsController < ApplicationController
5
5
  if !@<%= singular_table_name %>.authenticate(params[:current_password])
6
6
  render json: { error: "The current password you entered is incorrect" }, status: :bad_request
7
7
  elsif @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
8
- PasswordMailer.with(user: @<%= singular_table_name %>).changed.deliver_later
9
8
  render json: @<%= singular_table_name %>
10
9
  else
11
10
  render json: @<%= singular_table_name %>.errors, status: :unprocessable_entity
@@ -8,10 +8,6 @@ class EmailsController < ApplicationController
8
8
  if !@<%= singular_table_name %>.authenticate(params[:current_password])
9
9
  redirect_to edit_emails_path, alert: "The current password you entered is incorrect"
10
10
  elsif @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
11
- if @<%= singular_table_name %>.email_previously_changed?
12
- EmailMailer.with(email_change: @<%= singular_table_name %>.email_previous_change).changed.deliver_later
13
- end
14
-
15
11
  redirect_to root_path, notice: "Your email has been changed successfully"
16
12
  else
17
13
  render :edit, status: :unprocessable_entity
@@ -1,6 +1,5 @@
1
1
  class PasswordResetsController < ApplicationController
2
2
  skip_before_action :authenticate
3
-
4
3
  before_action :set_<%= singular_table_name %>, only: %i[ edit update ]
5
4
 
6
5
  def new
@@ -28,7 +27,7 @@ class PasswordResetsController < ApplicationController
28
27
 
29
28
  private
30
29
  def set_<%= singular_table_name %>
31
- @<%= singular_table_name %> = <%= class_name %>.find_signed!(params[:sid], purpose: "password_reset")
30
+ @<%= singular_table_name %> = <%= class_name %>.find_signed!(params[:token], purpose: "password_reset")
32
31
  rescue ActiveSupport::MessageVerifier::InvalidSignature
33
32
  redirect_to new_password_resets_path, alert: "Your token has expired, please request a new one"
34
33
  end
@@ -8,7 +8,6 @@ class PasswordsController < ApplicationController
8
8
  if !@<%= singular_table_name %>.authenticate(params[:current_password])
9
9
  redirect_to edit_passwords_path, alert: "The current password you entered is incorrect"
10
10
  elsif @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
11
- PasswordMailer.with(user: @<%= singular_table_name %>).changed.deliver_later
12
11
  redirect_to root_path, notice: "Your password has been changed successfully"
13
12
  else
14
13
  render :edit, status: :unprocessable_entity
@@ -1,6 +1,6 @@
1
1
  class EmailMailer < ApplicationMailer
2
2
  def changed
3
- @previous_email, @current_email = params[:email_change]
3
+ @previous_email, @current_email = params[:change]
4
4
  mail to: @previous_email
5
5
  end
6
6
  end
@@ -6,9 +6,23 @@ class <%= class_name %> < ApplicationRecord
6
6
  validates :email, format: { with: /\A[^@\s]+@[^@\s]+\z/ }
7
7
  validates_length_of :password, minimum: 8, allow_blank: true
8
8
 
9
- before_validation { self.email = email.downcase.strip }
9
+ before_validation do
10
+ self.email = email.downcase.strip
11
+ end
10
12
 
11
- def as_json(options)
13
+ after_update_commit do
14
+ if self.email_previously_changed?
15
+ EmailMailer.with(change: self.email_previous_change).changed.deliver_later
16
+ end
17
+ end
18
+
19
+ after_update_commit do
20
+ if self.password_digest_previously_changed?
21
+ PasswordMailer.with(<%= singular_table_name %>: self).changed.deliver_later
22
+ end
23
+ end
24
+
25
+ def as_json(options = {})
12
26
  super(options.merge(except: [:password_digest, :session_token]))
13
- end
27
+ end
14
28
  end
@@ -2,7 +2,7 @@
2
2
 
3
3
  <p>Can't remember your password for <strong><%%= params[:<%= singular_table_name %>].email %></strong>? That's OK, it happens. Just hit the link below to set a new one.</p>
4
4
 
5
- <p><%%= link_to "Reset my password", edit_password_resets_url(sid: @signed_id) %></p>
5
+ <p><%%= link_to "Reset my password", edit_password_resets_url(token: @signed_id) %></p>
6
6
 
7
7
  <p>If you did not request a password reset you can safely ignore this email, it expires in 20 minutes. Only someone with access to this email account can reset your password.</p>
8
8
 
@@ -2,7 +2,7 @@ Hey there,
2
2
 
3
3
  Can't remember your password for <%%= params[:<%= singular_table_name %>].email %>? That's OK, it happens. Just hit the link below to set a new one.
4
4
 
5
- [Reset my password]<%%= edit_password_resets_url(sid: @signed_id) %>
5
+ [Reset my password]<%%= edit_password_resets_url(token: @signed_id) %>
6
6
 
7
7
  If you did not request a password reset you can safely ignore this email, it expires in 20 minutes. Only someone with access to this email account can reset your password.
8
8
 
@@ -13,7 +13,7 @@
13
13
  </div>
14
14
  <%% end %>
15
15
 
16
- <%%= hidden_field_tag :sid, params[:sid] %>
16
+ <%%= hidden_field_tag :token, params[:token] %>
17
17
 
18
18
  <div>
19
19
  <%%= form.label :password, "New password", style: "display: block" %>
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: authentication-zero
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.0.14
4
+ version: 0.0.15
5
5
  platform: ruby
6
6
  authors:
7
7
  - Nixon