authentication-zero 0.0.14 → 0.0.18

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0f9beaffb78e2f198c9276df8dda0a72f8029b55cd7d5b282aeb5c30b9abe02e
-  data.tar.gz: 2f7fb5ced42bde9126bae2a876ce58127e0b1ad27f4b6fbf8b675656ea557873
+  metadata.gz: 5f48325c2122dac114a46a7949ba07ab7693872f198076dc7bcfae87b31441c1
+  data.tar.gz: 4117615d796766e17a773707f2dba9616eaf1ca7a59c007c831431d9b09e18eb
 SHA512:
-  metadata.gz: 3a6602f790b8e9da67546b711df55b9e6e196d22bf06b12dfa8a2c84359d1d21d77a22a28d8eec4c06208ff2d27090c93e2c034e1d5e859370552886d518ffe6
-  data.tar.gz: 9535c89a33b6b0f8bfc50a8b5039a989b68e3204fdbca48f2501ba13d84cab77a9ef737329f0adf874a1f1b53694c0452aafe1ef5278f93df59198cf28286bf9
+  metadata.gz: a6c76a600c3a82bb51bdb638bc1d114aef80ed13b2a252af3fac6bd4e1cd05992004a9bb6ec33457cb56e0fa93a3f48209acfb5d9c41c1ca7f9542104166e01b
+  data.tar.gz: 277192f60768925670f1580c13a0f593e27f92656987171818e09edff379b7571b88abcf0460ae9961477557bfe186e7b1a4e05e46c1ff24f760e2d0ff959301

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authentication-zero (0.0.14)
+    authentication-zero (0.0.18)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -2,6 +2,31 @@
 
 The purpose of authentication zero is to generate a pre-built authentication system into a rails application (web or api-only) that follows both security and rails best practices. By generating code into the user's application instead of using a library, the user has complete freedom to modify the authentication system so it works best with their app.
 
+## Features
+
+- Sign up
+- Email and password validations
+- Reset the user password and send reset instructions
+- Authentication by cookie (html)
+- Authentication by token (api)
+- Remember me (html)
+- Send e-mail when email is changed
+- Send e-mail when password is changed
+- Cancel my account
+- Log out
+
+## Security and best practices
+
+- [Current attributes](https://api.rubyonrails.org/classes/ActiveSupport/CurrentAttributes.html): Abstract super class that provides a thread-isolated attributes singleton, which resets automatically before and after each request.
+- [has_secure_password](https://api.rubyonrails.org/classes/ActiveModel/SecurePassword/ClassMethods.html#method-i-has_secure_password): Adds methods to set and authenticate against a BCrypt password.
+- [has_secure_token](https://api.rubyonrails.org/classes/ActiveRecord/SecureToken/ClassMethods.html#method-i-has_secure_token): Adds methods to generate unique tokens.
+- [signed_id](https://api.rubyonrails.org/classes/ActiveRecord/SignedId.html): Returns a signed id that is tamper proof, so it's safe to send in an email or otherwise share with the outside world.
+- [Signed cookies](https://api.rubyonrails.org/classes/ActionDispatch/Cookies.html): Returns a jar that'll automatically generate a signed representation of cookie value and verify it when reading from the cookie again.
+- [Http only cookies](https://api.rubyonrails.org/classes/ActionDispatch/Cookies.html): A cookie with the httponly attribute is inaccessible to the JavaScript, this precaution helps mitigate cross-site scripting (XSS) attacks.
+- [Log filtering](https://guides.rubyonrails.org/action_controller_overview.html#log-filtering): Parameters 'token' and 'password' are marked [FILTERED] in the log.
+- [Callbacks](https://api.rubyonrails.org/classes/ActiveRecord/Callbacks.html): We use callbacks to send emails after changing an email or password.
+- [Action mailer](https://api.rubyonrails.org/classes/ActionMailer/Base.html): Action Mailer allows you to send email from your application using a mailer model and views.
+
 ## Installation
 
 Add this lines to your application's Gemfile:

data/lib/authentication_zero/version.rb

@@ -1,3 +1,3 @@
 module AuthenticationZero
-  VERSION = "0.0.14"
+  VERSION = "0.0.18"
 end

data/lib/generators/authentication/authentication_generator.rb

@@ -16,7 +16,7 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
   end
 
   def create_mailers
-    template "mailers/email_mailer.rb", "app/mailers/email_mailer.rb"    
+    template "mailers/email_mailer.rb", "app/mailers/email_mailer.rb"
     template "mailers/password_mailer.rb", "app/mailers/password_mailer.rb"
   end
 
@@ -59,8 +59,8 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
 
         private
           def authenticate
-            if #{singular_table_name} = authenticate_with_http_token { |token, _| #{class_name}.find_by_session_token(token) }
-              Current.user = #{singular_table_name}
+            if #{singular_table_name} = authenticate_with_http_token { |t, _| #{class_name}.find_signed_session_token(t) }
+              Current.#{singular_table_name} = #{singular_table_name}
             else
               request_http_token_authentication
             end
@@ -73,8 +73,8 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
 
         private
           def authenticate
-            if #{singular_table_name} = cookies[:session_token] && #{class_name}.find_by_session_token(cookies[:session_token])
-              Current.user = #{singular_table_name}
+            if #{singular_table_name} = #{class_name}.find_by_session_token(cookies.signed[:session_token])
+              Current.#{singular_table_name} = #{singular_table_name}
             else
               redirect_to sign_in_path, alert: "You need to sign in or sign up before continuing"
             end

data/lib/generators/authentication/templates/controllers/api/emails_controller.rb.tt

@@ -5,10 +5,6 @@ class EmailsController < ApplicationController
     if !@<%= singular_table_name %>.authenticate(params[:current_password])
       render json: { error: "The current password you entered is incorrect" }, status: :bad_request
     elsif @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
-      if @<%= singular_table_name %>.email_previously_changed?
-        EmailMailer.with(email_change: @<%= singular_table_name %>.email_previous_change).changed.deliver_later
-      end
-
       render json: @<%= singular_table_name %>
     else
       render json: @<%= singular_table_name %>.errors, status: :unprocessable_entity

data/lib/generators/authentication/templates/controllers/api/password_resets_controller.rb.tt

@@ -1,6 +1,5 @@
 class PasswordResetsController < ApplicationController
   skip_before_action :authenticate
-
   before_action :set_<%= singular_table_name %>, only: %i[ edit update ]
 
   def edit
@@ -25,7 +24,7 @@ class PasswordResetsController < ApplicationController
 
   private
     def set_<%= singular_table_name %>
-      @<%= singular_table_name %> = <%= class_name %>.find_signed!(params[:sid], purpose: "password_reset")
+      @<%= singular_table_name %> = <%= class_name %>.find_signed!(params[:token], purpose: "password_reset")
     rescue ActiveSupport::MessageVerifier::InvalidSignature
       render json: { error: "Your token has expired, please request a new one" }, status: :bad_request
     end

data/lib/generators/authentication/templates/controllers/api/passwords_controller.rb.tt

@@ -5,7 +5,6 @@ class PasswordsController < ApplicationController
     if !@<%= singular_table_name %>.authenticate(params[:current_password])
       render json: { error: "The current password you entered is incorrect" }, status: :bad_request
     elsif @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
-      PasswordMailer.with(user: @<%= singular_table_name %>).changed.deliver_later
       render json: @<%= singular_table_name %>
     else
       render json: @<%= singular_table_name %>.errors, status: :unprocessable_entity

data/lib/generators/authentication/templates/controllers/api/sessions_controller.rb.tt

@@ -5,9 +5,9 @@ class SessionsController < ApplicationController
     @<%= singular_table_name %> = <%= class_name %>.find_by_email(params[:email])
 
     if @<%= singular_table_name %>.try(:authenticate, params[:password])
-      render json: { session_token: @<%= singular_table_name %>.session_token }
+      render json: { session_token: @<%= singular_table_name %>.signed_session_token }
     else
-      render json: { error: "Invalid session token" }, status: :unauthorized
+      render json: { error: "Invalid email or password" }, status: :unauthorized
     end
   end
 

data/lib/generators/authentication/templates/controllers/html/emails_controller.rb.tt

@@ -8,10 +8,6 @@ class EmailsController < ApplicationController
     if !@<%= singular_table_name %>.authenticate(params[:current_password])
       redirect_to edit_emails_path, alert: "The current password you entered is incorrect"
     elsif @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
-      if @<%= singular_table_name %>.email_previously_changed?
-        EmailMailer.with(email_change: @<%= singular_table_name %>.email_previous_change).changed.deliver_later
-      end
-
       redirect_to root_path, notice: "Your email has been changed successfully"
     else
       render :edit, status: :unprocessable_entity

data/lib/generators/authentication/templates/controllers/html/password_resets_controller.rb.tt

@@ -1,6 +1,5 @@
 class PasswordResetsController < ApplicationController
   skip_before_action :authenticate
-
   before_action :set_<%= singular_table_name %>, only: %i[ edit update ]
 
   def new
@@ -14,7 +13,7 @@ class PasswordResetsController < ApplicationController
       PasswordMailer.with(<%= singular_table_name %>: @<%= singular_table_name %>).reset.deliver_later
       redirect_to sign_in_path, notice: "You will receive an email with instructions on how to reset your password in a few minutes"
     else
-      redirect_to new_password_resets_path, alert: "The email address doesn't exist in our database"
+      redirect_to new_password_resets_path(email_hint: params[:email]), alert: "The email address doesn't exist in our database"
     end
   end
 
@@ -28,7 +27,7 @@ class PasswordResetsController < ApplicationController
 
   private
     def set_<%= singular_table_name %>
-      @<%= singular_table_name %> = <%= class_name %>.find_signed!(params[:sid], purpose: "password_reset")
+      @<%= singular_table_name %> = <%= class_name %>.find_signed!(params[:token], purpose: "password_reset")
     rescue ActiveSupport::MessageVerifier::InvalidSignature
       redirect_to new_password_resets_path, alert: "Your token has expired, please request a new one"
     end

data/lib/generators/authentication/templates/controllers/html/passwords_controller.rb.tt

@@ -8,7 +8,6 @@ class PasswordsController < ApplicationController
     if !@<%= singular_table_name %>.authenticate(params[:current_password])
       redirect_to edit_passwords_path, alert: "The current password you entered is incorrect"
     elsif @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
-      PasswordMailer.with(user: @<%= singular_table_name %>).changed.deliver_later
       redirect_to root_path, notice: "Your password has been changed successfully"
     else
       render :edit, status: :unprocessable_entity

data/lib/generators/authentication/templates/controllers/html/registrations_controller.rb.tt

@@ -9,7 +9,7 @@ class RegistrationsController < ApplicationController
     @<%= singular_table_name %> = <%= class_name %>.new(<%= "#{singular_table_name}_params" %>)
 
     if @<%= singular_table_name %>.save
-      cookies[:session_token] = { value: @<%= singular_table_name %>.session_token, httponly: true }
+      cookies.signed[:session_token] = { value: @<%= singular_table_name %>.session_token, httponly: true }
       redirect_to root_path, notice: "Welcome! You have signed up successfully"
     else
       render :new, status: :unprocessable_entity

data/lib/generators/authentication/templates/controllers/html/sessions_controller.rb.tt

@@ -10,9 +10,9 @@ class SessionsController < ApplicationController
 
     if @<%= singular_table_name %>.try(:authenticate, params[:password])
       if params[:remember_me] == "1"
-        cookies.permanent[:session_token] = { value: @<%= singular_table_name %>.session_token, httponly: true }
+        cookies.signed.permanent[:session_token] = { value: @<%= singular_table_name %>.session_token, httponly: true }
       else
-        cookies[:session_token] = { value: @<%= singular_table_name %>.session_token, httponly: true }
+        cookies.signed[:session_token] = { value: @<%= singular_table_name %>.session_token, httponly: true }
       end
 
       redirect_to root_path, notice: "Signed in successfully"

data/lib/generators/authentication/templates/mailers/email_mailer.rb.tt

@@ -1,6 +1,6 @@
 class EmailMailer < ApplicationMailer
   def changed
-    @previous_email, @current_email = params[:email_change]
+    @previous_email, @current_email = params[:change]
     mail to: @previous_email
   end
 end

data/lib/generators/authentication/templates/models/resource.rb.tt

@@ -6,9 +6,30 @@ class <%= class_name %> < ApplicationRecord
   validates :email, format: { with: /\A[^@\s]+@[^@\s]+\z/ }
   validates_length_of :password, minimum: 8, allow_blank: true
 
-  before_validation { self.email = email.downcase.strip }
+  before_validation do
+    self.email = email.downcase.strip
+  end
 
-  def as_json(options)
-    super(options.merge(except: [:password_digest, :session_token]))
-  end  
+  after_update_commit do
+    if self.email_previously_changed?
+      EmailMailer.with(change: self.email_previous_change).changed.deliver_later
+    end
+  end
+
+  after_update_commit do
+    if self.password_digest_previously_changed?
+      PasswordMailer.with(<%= singular_table_name %>: self).changed.deliver_later
+    end
+  end
+<% if options.api? %>
+  def signed_session_token
+    self.class.signed_id_verifier.generate(session_token)
+  end
+
+  def self.find_signed_session_token(signed_session_token)
+    if session_token = signed_id_verifier.verified(signed_session_token)
+      find_by_session_token(session_token)
+    end
+  end
+<% end -%>
 end

data/lib/generators/authentication/templates/views/password_mailer/reset.html.erb.tt

@@ -2,7 +2,7 @@
 
 <p>Can't remember your password for <strong><%%= params[:<%= singular_table_name %>].email %></strong>? That's OK, it happens. Just hit the link below to set a new one.</p>
 
-<p><%%= link_to "Reset my password", edit_password_resets_url(sid: @signed_id) %></p>
+<p><%%= link_to "Reset my password", edit_password_resets_url(token: @signed_id) %></p>
 
 <p>If you did not request a password reset you can safely ignore this email, it expires in 20 minutes. Only someone with access to this email account can reset your password.</p>
 

data/lib/generators/authentication/templates/views/password_mailer/reset.text.erb.tt

@@ -2,7 +2,7 @@ Hey there,
 
 Can't remember your password for <%%= params[:<%= singular_table_name %>].email %>? That's OK, it happens. Just hit the link below to set a new one.
 
-[Reset my password]<%%= edit_password_resets_url(sid: @signed_id) %>
+[Reset my password]<%%= edit_password_resets_url(token: @signed_id) %>
 
 If you did not request a password reset you can safely ignore this email, it expires in 20 minutes. Only someone with access to this email account can reset your password.
 

data/lib/generators/authentication/templates/views/password_resets/edit.html.erb.tt

@@ -13,7 +13,7 @@
     </div>
   <%% end %>
 
-  <%%= hidden_field_tag :sid, params[:sid] %>
+  <%%= hidden_field_tag :token, params[:token] %>
 
   <div>
     <%%= form.label :password, "New password", style: "display: block" %>

data/lib/generators/authentication/templates/views/password_resets/new.html.erb.tt

@@ -5,7 +5,7 @@
 <%%= form_with(url: password_resets_path) do |form| %>
   <div>
     <%%= form.label :email, style: "display: block" %>
-    <%%= form.email_field :email, autofocus: true, required: true %>
+    <%%= form.email_field :email, value: params[:email_hint], autofocus: true, required: true %>
   </div>
 
   <div>

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authentication-zero
 version: !ruby/object:Gem::Version
-  version: 0.0.14
+  version: 0.0.18
 platform: ruby
 authors:
 - Nixon
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-02-17 00:00:00.000000000 Z
+date: 2022-02-18 00:00:00.000000000 Z
 dependencies: []
 description: 
 email: