authentication-zero 0.0.15 → 0.0.19

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 39cf93fc2be059b756c15125cfd0d4e35e0a8f96a803fbfcfb3aa31f64b2a704
4
- data.tar.gz: 728fdd4a2af75e207db825c581e8fb1856be8d55b4fbfe6ac19aaa8e373b8557
3
+ metadata.gz: 4b1eabca1df60e043a1cc139cee3426a19c4a2bb494fcd2ceeb68875baecc126
4
+ data.tar.gz: ca697e2d442e566a3f3b5fe051ca03840756185edd963679636ad76eaac4f972
5
5
  SHA512:
6
- metadata.gz: ca7dc09acf69d59ada1e204fb77076731212afadddf77337eccc22466307917eed2e5cc1f11b92eee6bcd8722970a021c4ca48664f92714acd9f4c7579978db0
7
- data.tar.gz: fe83d4649cf6c24fbbadecfee09dfdd1d245fb689da031eb187f061df26a9d6704cee1db904aa6c3c7c17763c51665637dd58f20515c08e93a88542c01879991
6
+ metadata.gz: 9cc259932fe245e5031f48aafa8407ed190f04e56a884eef339cfe04b1f21394dcede01d945f601193783caca66d83404f58817ca50d375d52816061cc05b4f5
7
+ data.tar.gz: 97b372c3e3598d391d254c6b01819a17100475d108fc10f04b2c2d7d4074feb5a00c4703aebe031ccd0800df43344cee7a8c88601d24c0aceeb7150aeed48997
data/Gemfile.lock CHANGED
@@ -1,7 +1,7 @@
1
1
  PATH
2
2
  remote: .
3
3
  specs:
4
- authentication-zero (0.0.15)
4
+ authentication-zero (0.0.19)
5
5
 
6
6
  GEM
7
7
  remote: https://rubygems.org/
data/README.md CHANGED
@@ -17,15 +17,15 @@ The purpose of authentication zero is to generate a pre-built authentication sys
17
17
 
18
18
  ## Security and best practices
19
19
 
20
- - [Current attributes](https://api.rubyonrails.org/classes/ActiveSupport/CurrentAttributes.html): Abstract super class that provides a thread-isolated attributes singleton, which resets automatically before and after each request.
21
20
  - [has_secure_password](https://api.rubyonrails.org/classes/ActiveModel/SecurePassword/ClassMethods.html#method-i-has_secure_password): Adds methods to set and authenticate against a BCrypt password.
22
21
  - [has_secure_token](https://api.rubyonrails.org/classes/ActiveRecord/SecureToken/ClassMethods.html#method-i-has_secure_token): Adds methods to generate unique tokens.
23
- - [authenticate_with_http_token](https://api.rubyonrails.org/classes/ActionController/HttpAuthentication/Token.html): Compare the tokens in a time-constant manner, to mitigate timing attacks.
22
+ - [encrypts](https://guides.rubyonrails.org/active_record_encryption.html) Encrypts the session_token on database so if an attacker gained access to your database, a snapshot of it, or your application logs, they wouldn't be able to make sense of the encrypted information.
23
+ - [httponly cookies](https://api.rubyonrails.org/classes/ActionDispatch/Cookies.html): A cookie with the httponly attribute is inaccessible to the JavaScript, this precaution helps mitigate cross-site scripting (XSS) attacks.
24
24
  - [signed_id](https://api.rubyonrails.org/classes/ActiveRecord/SignedId.html): Returns a signed id that is tamper proof, so it's safe to send in an email or otherwise share with the outside world.
25
- - [Http only cookies](https://api.rubyonrails.org/classes/ActionDispatch/Cookies.html): A cookie with the httponly attribute is inaccessible to the JavaScript, this precaution helps mitigate cross-site scripting (XSS) attacks.
26
- - [Log filtering](https://guides.rubyonrails.org/action_controller_overview.html#log-filtering): Parameters 'token' and 'password' are marked [FILTERED] in the log.
27
- - [Callbacks](https://api.rubyonrails.org/classes/ActiveRecord/Callbacks.html): We use callbacks to send emails before changing an email or password.
28
- - [ActionMailer](https://api.rubyonrails.org/classes/ActionMailer/Base.html): Action Mailer allows you to send email from your application using a mailer model and views.
25
+ - [Current Attributes](https://api.rubyonrails.org/classes/ActiveSupport/CurrentAttributes.html): Abstract super class that provides a thread-isolated attributes singleton, which resets automatically before and after each request.
26
+ - [Log Filtering](https://guides.rubyonrails.org/action_controller_overview.html#log-filtering): Parameters 'token' and 'password' are marked [FILTERED] in the log.
27
+ - [Callbacks](https://api.rubyonrails.org/classes/ActiveRecord/Callbacks.html): We use callbacks to send emails after changing an email or password.
28
+ - [Action Mailer](https://api.rubyonrails.org/classes/ActionMailer/Base.html): Action Mailer allows you to send email from your application using a mailer model and views.
29
29
 
30
30
  ## Installation
31
31
 
@@ -38,6 +38,11 @@ gem "authentication-zero"
38
38
 
39
39
  Then run `bundle install`
40
40
 
41
+ You'll need to set up active record encryption, run the command below and follow the instructions.
42
+ ```
43
+ $ rails db:encryption:init
44
+ ```
45
+
41
46
  You'll need to set the root path in your routes.rb, for this example let's use the following:
42
47
 
43
48
  ```ruby
@@ -1,3 +1,3 @@
1
1
  module AuthenticationZero
2
- VERSION = "0.0.15"
2
+ VERSION = "0.0.19"
3
3
  end
@@ -16,7 +16,7 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
16
16
  end
17
17
 
18
18
  def create_mailers
19
- template "mailers/email_mailer.rb", "app/mailers/email_mailer.rb"
19
+ template "mailers/email_mailer.rb", "app/mailers/email_mailer.rb"
20
20
  template "mailers/password_mailer.rb", "app/mailers/password_mailer.rb"
21
21
  end
22
22
 
@@ -59,8 +59,8 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
59
59
 
60
60
  private
61
61
  def authenticate
62
- if #{singular_table_name} = authenticate_with_http_token { |token, _| #{class_name}.find_by_session_token(token) }
63
- Current.user = #{singular_table_name}
62
+ if #{singular_table_name} = authenticate_with_http_token { |t, _| #{class_name}.find_by_session_token(t) }
63
+ Current.#{singular_table_name} = #{singular_table_name}
64
64
  else
65
65
  request_http_token_authentication
66
66
  end
@@ -73,8 +73,8 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
73
73
 
74
74
  private
75
75
  def authenticate
76
- if #{singular_table_name} = cookies[:session_token] && #{class_name}.find_by_session_token(cookies[:session_token])
77
- Current.user = #{singular_table_name}
76
+ if #{singular_table_name} = #{class_name}.find_by_session_token(cookies[:session_token])
77
+ Current.#{singular_table_name} = #{singular_table_name}
78
78
  else
79
79
  redirect_to sign_in_path, alert: "You need to sign in or sign up before continuing"
80
80
  end
@@ -7,7 +7,7 @@ class SessionsController < ApplicationController
7
7
  if @<%= singular_table_name %>.try(:authenticate, params[:password])
8
8
  render json: { session_token: @<%= singular_table_name %>.session_token }
9
9
  else
10
- render json: { error: "Invalid session token" }, status: :unauthorized
10
+ render json: { error: "Invalid email or password" }, status: :unauthorized
11
11
  end
12
12
  end
13
13
 
@@ -13,7 +13,7 @@ class PasswordResetsController < ApplicationController
13
13
  PasswordMailer.with(<%= singular_table_name %>: @<%= singular_table_name %>).reset.deliver_later
14
14
  redirect_to sign_in_path, notice: "You will receive an email with instructions on how to reset your password in a few minutes"
15
15
  else
16
- redirect_to new_password_resets_path, alert: "The email address doesn't exist in our database"
16
+ redirect_to new_password_resets_path(email_hint: params[:email]), alert: "The email address doesn't exist in our database"
17
17
  end
18
18
  end
19
19
 
@@ -2,6 +2,8 @@ class <%= class_name %> < ApplicationRecord
2
2
  has_secure_password :password
3
3
  has_secure_token :session_token
4
4
 
5
+ encrypts :session_token, deterministic: true
6
+
5
7
  validates :email, presence: true, uniqueness: true
6
8
  validates :email, format: { with: /\A[^@\s]+@[^@\s]+\z/ }
7
9
  validates_length_of :password, minimum: 8, allow_blank: true
@@ -21,8 +23,4 @@ class <%= class_name %> < ApplicationRecord
21
23
  PasswordMailer.with(<%= singular_table_name %>: self).changed.deliver_later
22
24
  end
23
25
  end
24
-
25
- def as_json(options = {})
26
- super(options.merge(except: [:password_digest, :session_token]))
27
- end
28
26
  end
@@ -5,7 +5,7 @@
5
5
  <%%= form_with(url: password_resets_path) do |form| %>
6
6
  <div>
7
7
  <%%= form.label :email, style: "display: block" %>
8
- <%%= form.email_field :email, autofocus: true, required: true %>
8
+ <%%= form.email_field :email, value: params[:email_hint], autofocus: true, required: true %>
9
9
  </div>
10
10
 
11
11
  <div>
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: authentication-zero
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.0.15
4
+ version: 0.0.19
5
5
  platform: ruby
6
6
  authors:
7
7
  - Nixon
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2022-02-17 00:00:00.000000000 Z
11
+ date: 2022-02-18 00:00:00.000000000 Z
12
12
  dependencies: []
13
13
  description:
14
14
  email: