authentication-zero 0.0.15 → 0.0.16

Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 39cf93fc2be059b756c15125cfd0d4e35e0a8f96a803fbfcfb3aa31f64b2a704
4
- data.tar.gz: 728fdd4a2af75e207db825c581e8fb1856be8d55b4fbfe6ac19aaa8e373b8557
3
+ metadata.gz: 99e38209d9e08d15cc9edabeb10704f340f5b903f3e6582119c0c086f7a821b0
4
+ data.tar.gz: 7c0c7c3fdc4d858f30df3f48aabb0ae73f7d175c04ef6babdb9ae3f458bceb4d
5
5
  SHA512:
6
- metadata.gz: ca7dc09acf69d59ada1e204fb77076731212afadddf77337eccc22466307917eed2e5cc1f11b92eee6bcd8722970a021c4ca48664f92714acd9f4c7579978db0
7
- data.tar.gz: fe83d4649cf6c24fbbadecfee09dfdd1d245fb689da031eb187f061df26a9d6704cee1db904aa6c3c7c17763c51665637dd58f20515c08e93a88542c01879991
6
+ metadata.gz: 499be6541793f23e314a7e82fcee557d0bb84430d55dccf200ec7cffaf761fabd9d6783293f5a257485105f6484d023b757012753c7a0d9f80830346eb4ce9c5
7
+ data.tar.gz: 66da6b4184558ede3a23aa294aa7b9f09b52bd7e4ed5ecc90d2e9ab62e6c109d82fa095472b74284e00112ab391950c6925cb2ab7693f0606bcbbde7e23d49a6
data/Gemfile.lock CHANGED
@@ -1,7 +1,7 @@
1
1
  PATH
2
2
  remote: .
3
3
  specs:
4
- authentication-zero (0.0.15)
4
+ authentication-zero (0.0.16)
5
5
 
6
6
  GEM
7
7
  remote: https://rubygems.org/
data/README.md CHANGED
@@ -20,12 +20,12 @@ The purpose of authentication zero is to generate a pre-built authentication sys
20
20
  - [Current attributes](https://api.rubyonrails.org/classes/ActiveSupport/CurrentAttributes.html): Abstract super class that provides a thread-isolated attributes singleton, which resets automatically before and after each request.
21
21
  - [has_secure_password](https://api.rubyonrails.org/classes/ActiveModel/SecurePassword/ClassMethods.html#method-i-has_secure_password): Adds methods to set and authenticate against a BCrypt password.
22
22
  - [has_secure_token](https://api.rubyonrails.org/classes/ActiveRecord/SecureToken/ClassMethods.html#method-i-has_secure_token): Adds methods to generate unique tokens.
23
- - [authenticate_with_http_token](https://api.rubyonrails.org/classes/ActionController/HttpAuthentication/Token.html): Compare the tokens in a time-constant manner, to mitigate timing attacks.
24
23
  - [signed_id](https://api.rubyonrails.org/classes/ActiveRecord/SignedId.html): Returns a signed id that is tamper proof, so it's safe to send in an email or otherwise share with the outside world.
24
+ - [Signed cookies](https://api.rubyonrails.org/classes/ActionDispatch/Cookies.html): Returns a jar that'll automatically generate a signed representation of cookie value and verify it when reading from the cookie again.
25
25
  - [Http only cookies](https://api.rubyonrails.org/classes/ActionDispatch/Cookies.html): A cookie with the httponly attribute is inaccessible to the JavaScript, this precaution helps mitigate cross-site scripting (XSS) attacks.
26
26
  - [Log filtering](https://guides.rubyonrails.org/action_controller_overview.html#log-filtering): Parameters 'token' and 'password' are marked [FILTERED] in the log.
27
27
  - [Callbacks](https://api.rubyonrails.org/classes/ActiveRecord/Callbacks.html): We use callbacks to send emails before changing an email or password.
28
- - [ActionMailer](https://api.rubyonrails.org/classes/ActionMailer/Base.html): Action Mailer allows you to send email from your application using a mailer model and views.
28
+ - [Action mailer](https://api.rubyonrails.org/classes/ActionMailer/Base.html): Action Mailer allows you to send email from your application using a mailer model and views.
29
29
 
30
30
  ## Installation
31
31
 
@@ -1,3 +1,3 @@
1
1
  module AuthenticationZero
2
- VERSION = "0.0.15"
2
+ VERSION = "0.0.16"
3
3
  end
@@ -16,7 +16,7 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
16
16
  end
17
17
 
18
18
  def create_mailers
19
- template "mailers/email_mailer.rb", "app/mailers/email_mailer.rb"
19
+ template "mailers/email_mailer.rb", "app/mailers/email_mailer.rb"
20
20
  template "mailers/password_mailer.rb", "app/mailers/password_mailer.rb"
21
21
  end
22
22
 
@@ -59,7 +59,7 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
59
59
 
60
60
  private
61
61
  def authenticate
62
- if #{singular_table_name} = authenticate_with_http_token { |token, _| #{class_name}.find_by_session_token(token) }
62
+ if #{singular_table_name} = authenticate_with_http_token { |t, _| #{class_name}.find_signed_session_token(t) }
63
63
  Current.user = #{singular_table_name}
64
64
  else
65
65
  request_http_token_authentication
@@ -73,7 +73,7 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
73
73
 
74
74
  private
75
75
  def authenticate
76
- if #{singular_table_name} = cookies[:session_token] && #{class_name}.find_by_session_token(cookies[:session_token])
76
+ if #{singular_table_name} = #{class_name}.find_by_session_token(cookies.signed[:session_token])
77
77
  Current.user = #{singular_table_name}
78
78
  else
79
79
  redirect_to sign_in_path, alert: "You need to sign in or sign up before continuing"
@@ -5,9 +5,9 @@ class SessionsController < ApplicationController
5
5
  @<%= singular_table_name %> = <%= class_name %>.find_by_email(params[:email])
6
6
 
7
7
  if @<%= singular_table_name %>.try(:authenticate, params[:password])
8
- render json: { session_token: @<%= singular_table_name %>.session_token }
8
+ render json: { session_token: @<%= singular_table_name %>.signed_session_token }
9
9
  else
10
- render json: { error: "Invalid session token" }, status: :unauthorized
10
+ render json: { error: "Invalid email or password" }, status: :unauthorized
11
11
  end
12
12
  end
13
13
 
@@ -13,7 +13,7 @@ class PasswordResetsController < ApplicationController
13
13
  PasswordMailer.with(<%= singular_table_name %>: @<%= singular_table_name %>).reset.deliver_later
14
14
  redirect_to sign_in_path, notice: "You will receive an email with instructions on how to reset your password in a few minutes"
15
15
  else
16
- redirect_to new_password_resets_path, alert: "The email address doesn't exist in our database"
16
+ redirect_to new_password_resets_path(email_hint: params[:email]), alert: "The email address doesn't exist in our database"
17
17
  end
18
18
  end
19
19
 
@@ -9,7 +9,7 @@ class RegistrationsController < ApplicationController
9
9
  @<%= singular_table_name %> = <%= class_name %>.new(<%= "#{singular_table_name}_params" %>)
10
10
 
11
11
  if @<%= singular_table_name %>.save
12
- cookies[:session_token] = { value: @<%= singular_table_name %>.session_token, httponly: true }
12
+ cookies.signed[:session_token] = { value: @<%= singular_table_name %>.session_token, httponly: true }
13
13
  redirect_to root_path, notice: "Welcome! You have signed up successfully"
14
14
  else
15
15
  render :new, status: :unprocessable_entity
@@ -10,9 +10,9 @@ class SessionsController < ApplicationController
10
10
 
11
11
  if @<%= singular_table_name %>.try(:authenticate, params[:password])
12
12
  if params[:remember_me] == "1"
13
- cookies.permanent[:session_token] = { value: @<%= singular_table_name %>.session_token, httponly: true }
13
+ cookies.signed.permanent[:session_token] = { value: @<%= singular_table_name %>.session_token, httponly: true }
14
14
  else
15
- cookies[:session_token] = { value: @<%= singular_table_name %>.session_token, httponly: true }
15
+ cookies.signed[:session_token] = { value: @<%= singular_table_name %>.session_token, httponly: true }
16
16
  end
17
17
 
18
18
  redirect_to root_path, notice: "Signed in successfully"
@@ -21,8 +21,15 @@ class <%= class_name %> < ApplicationRecord
21
21
  PasswordMailer.with(<%= singular_table_name %>: self).changed.deliver_later
22
22
  end
23
23
  end
24
+ <% if options.api? -%>
25
+ def signed_session_token
26
+ self.class.signed_id_verifier.generate(session_token)
27
+ end
24
28
 
25
- def as_json(options = {})
26
- super(options.merge(except: [:password_digest, :session_token]))
29
+ def self.find_signed_session_token(signed_session_token)
30
+ if session_token = signed_id_verifier.verified(signed_session_token)
31
+ find_by_session_token(session_token)
32
+ end
27
33
  end
34
+ <% end -%>
28
35
  end
@@ -5,7 +5,7 @@
5
5
  <%%= form_with(url: password_resets_path) do |form| %>
6
6
  <div>
7
7
  <%%= form.label :email, style: "display: block" %>
8
- <%%= form.email_field :email, autofocus: true, required: true %>
8
+ <%%= form.email_field :email, value: params[:email_hint], autofocus: true, required: true %>
9
9
  </div>
10
10
 
11
11
  <div>
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: authentication-zero
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.0.15
4
+ version: 0.0.16
5
5
  platform: ruby
6
6
  authors:
7
7
  - Nixon
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2022-02-17 00:00:00.000000000 Z
11
+ date: 2022-02-18 00:00:00.000000000 Z
12
12
  dependencies: []
13
13
  description:
14
14
  email: