authentication-zero 0.0.21 → 0.0.22

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e4508d502f129d12c259168c7dc3076ae69adfc30622d512b52069a29bd677d7
-  data.tar.gz: f845c72250632ffaa4253ec6a51efee05ed7df67b6dff9ae153ccfc301a3f701
+  metadata.gz: f745db607e21f39bb22fec9452b30147cebbf4a41d49150450c14035b00b1d0e
+  data.tar.gz: f412264a06233f8571dad3640bf9b2ee853e289ad168ad5e12f5fa8d3a6bfb04
 SHA512:
-  metadata.gz: 07e8a137c6fcb03ce1de75f40a901d9df43038dc15086efc128ec5f727c160b4109e3956232acbd166948dc4ed01b2309aa868758fe578adc33afa706f318a8f
-  data.tar.gz: 0b8c33acc4d57eae5cd0fc4ff9272129f01eee5f42cd0f864d55411111b432ffed69c0693dcce1f5e96f83756b3b752af6366242fe58662ed95fcc7146c3ff16
+  metadata.gz: d28443fe294ac245251268f5130dc7c4776a793fcff46e89e37fbb34c419455735be7d63ac7a3fa4fbaaac976806e37f8770be6c32a44663cdee4374b2b2ffb3
+  data.tar.gz: 902d2c094e0d7fb1cd5c10a8b81d733fda6cb9580baf2312591cce588fe82b9b4302f80a41c6e75bd8dae037411028968cc82ff2159fb4155891f7ebd66587c1

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authentication-zero (0.0.21)
+    authentication-zero (0.0.22)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -19,7 +19,7 @@ The purpose of authentication zero is to generate a pre-built authentication sys
 
 - [has_secure_password](https://api.rubyonrails.org/classes/ActiveModel/SecurePassword/ClassMethods.html#method-i-has_secure_password): Adds methods to set and authenticate against a BCrypt password.
 - [has_secure_token](https://api.rubyonrails.org/classes/ActiveRecord/SecureToken/ClassMethods.html#method-i-has_secure_token): Adds methods to generate unique tokens.
-- [encrypts](https://guides.rubyonrails.org/active_record_encryption.html) Encrypts the session_token on database so if an attacker gained access to your database, a snapshot of it, or your application logs, they wouldn't be able to make sense of the encrypted information.
+- [signed cookies](https://api.rubyonrails.org/classes/ActionDispatch/Cookies.html): Returns a jar that'll automatically generate a signed representation of cookie value and verify it when reading from the cookie again.
 - [httponly cookies](https://api.rubyonrails.org/classes/ActionDispatch/Cookies.html): A cookie with the httponly attribute is inaccessible to the JavaScript, this precaution helps mitigate cross-site scripting (XSS) attacks.
 - [signed_id](https://api.rubyonrails.org/classes/ActiveRecord/SignedId.html): Returns a signed id that is tamper proof, so it's safe to send in an email or otherwise share with the outside world.
 - [Current attributes](https://api.rubyonrails.org/classes/ActiveSupport/CurrentAttributes.html): Abstract super class that provides a thread-isolated attributes singleton, which resets automatically before and after each request.
@@ -38,12 +38,6 @@ gem "authentication-zero"
 
 Then run `bundle install`
 
-First, you need to [set up active record encryption](https://guides.rubyonrails.org/active_record_encryption.html#setup), you must generate your keys and put them in your credentials:
-```
-$ rails db:encryption:init
-$ rails credentials:edit
-```
-
 You'll need to set the root path in your routes.rb, for this example let's use the following:
 
 ```ruby

data/lib/authentication_zero/version.rb

@@ -1,3 +1,3 @@
 module AuthenticationZero
-  VERSION = "0.0.21"
+  VERSION = "0.0.22"
 end

data/lib/generators/authentication/authentication_generator.rb

@@ -60,7 +60,7 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
         private
           def authenticate
             authenticate_or_request_with_http_token do |token, _options|
-              Current.#{singular_table_name} = #{class_name}.find_by_session_token(token)
+              Current.#{singular_table_name} = #{class_name}.find_signed_session_token(token)
             end
           end
       CODE
@@ -71,7 +71,7 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
 
         private
           def authenticate
-            if #{singular_table_name} = #{class_name}.find_by_session_token(cookies[:session_token])
+            if #{singular_table_name} = #{class_name}.find_by_session_token(cookies.signed[:session_token])
               Current.#{singular_table_name} = #{singular_table_name}
             else
               redirect_to sign_in_path, alert: "You need to sign in or sign up before continuing"

data/lib/generators/authentication/templates/controllers/api/sessions_controller.rb.tt

@@ -5,7 +5,7 @@ class SessionsController < ApplicationController
     @<%= singular_table_name %> = <%= class_name %>.find_by_email(params[:email])
 
     if @<%= singular_table_name %>.try(:authenticate, params[:password])
-      render json: { session_token: @<%= singular_table_name %>.session_token }
+      render json: { session_token: @<%= singular_table_name %>.signed_session_token }
     else
       render json: { error: "Invalid email or password" }, status: :unauthorized
     end

data/lib/generators/authentication/templates/controllers/html/registrations_controller.rb.tt

@@ -9,7 +9,7 @@ class RegistrationsController < ApplicationController
     @<%= singular_table_name %> = <%= class_name %>.new(<%= "#{singular_table_name}_params" %>)
 
     if @<%= singular_table_name %>.save
-      cookies[:session_token] = { value: @<%= singular_table_name %>.session_token, httponly: true }
+      cookies.signed[:session_token] = { value: @<%= singular_table_name %>.session_token, httponly: true }
       redirect_to root_path, notice: "Welcome! You have signed up successfully"
     else
       render :new, status: :unprocessable_entity

data/lib/generators/authentication/templates/controllers/html/sessions_controller.rb.tt

@@ -10,9 +10,9 @@ class SessionsController < ApplicationController
 
     if @<%= singular_table_name %>.try(:authenticate, params[:password])
       if params[:remember_me] == "1"
-        cookies.permanent[:session_token] = { value: @<%= singular_table_name %>.session_token, httponly: true }
+        cookies.signed.permanent[:session_token] = { value: @<%= singular_table_name %>.session_token, httponly: true }
       else
-        cookies[:session_token] = { value: @<%= singular_table_name %>.session_token, httponly: true }
+        cookies.signed[:session_token] = { value: @<%= singular_table_name %>.session_token, httponly: true }
       end
 
       redirect_to root_path, notice: "Signed in successfully"

data/lib/generators/authentication/templates/models/resource.rb.tt

@@ -6,8 +6,6 @@ class <%= class_name %> < ApplicationRecord
   validates :email, format: { with: /\A[^@\s]+@[^@\s]+\z/ }
   validates_length_of :password, minimum: 8, allow_blank: true
 
-  encrypts :session_token, deterministic: true
-
   before_validation do
     self.email = email.downcase.strip
   end
@@ -23,4 +21,16 @@ class <%= class_name %> < ApplicationRecord
       PasswordMailer.with(<%= singular_table_name %>: self).changed.deliver_later
     end
   end
+
+<% if options.api? -%>
+  def signed_session_token
+    self.class.signed_id_verifier.generate(session_token)
+  end
+
+  def self.find_signed_session_token(signed_session_token)
+    if session_token = signed_id_verifier.verified(signed_session_token)
+      find_by_session_token(session_token)
+    end
+  end
+<% end -%>
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authentication-zero
 version: !ruby/object:Gem::Version
-  version: 0.0.21
+  version: 0.0.22
 platform: ruby
 authors:
 - Nixon
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-02-18 00:00:00.000000000 Z
+date: 2022-02-19 00:00:00.000000000 Z
 dependencies: []
 description: 
 email: