authentication-zero 2.12.4 → 2.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e153855bfc24252626eb9ccb0381fadf99eda55f66db6d80081de90ea07eede5
-  data.tar.gz: a0fe741b9b4c073401fea77218fcfb2b7665041a073655bce689d0b84f5ee6ca
+  metadata.gz: 34663ddecbc5d0c0276a99a7f7d0f867e90c2f731e1c56a5d508738469647795
+  data.tar.gz: bbffe8e2dff90913524ff9744efa49cb1097d78745206579bb49251472a016ed
 SHA512:
-  metadata.gz: 661fa249b995fd6c7e0076a480597c972178a9f05231ff271fc4ecd6e24916f7d0eda5a428d4e4251c2fc0c29de6ea4b8c902f1f3665557bf15e6e2aa5897533
-  data.tar.gz: 699dc8d96580ba018fd238ff843ceed4d07a0b623f7b3dedd8ec88db2a2fa886025f26e8b5d526a817c0209d80db9a2b0bca0bdcb8c5f3122d10017d45e0b6f0
+  metadata.gz: 38dd57dfb438408fb9ff4099508568c90bc9416fe5e624b4e38eaeba4f886e61340a2104976e62d9214d95d57f45a15a8dac6dd8789022a4cf24f6225f4e98be
+  data.tar.gz: 9393b6ceb9203be1bf0c5643640422ec8c64d96af34b01087f20d533ed781dd8f6b553350d698658a8b5cf1a07b36c965822a03d836451bdcec44c882f87a39f

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## Authentication Zero 2.13.0 (May 2, 2022) ##
+
+* Migrate tokens to a table structure
+* Refactor lockable to a controller method
+
 ## Authentication Zero 2.12.0 (March 28, 2022) ##
 
 * Remove model option from generator

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authentication-zero (2.12.4)
+    authentication-zero (2.13.0)
 
 GEM
   remote: https://rubygems.org/

data/lib/authentication_zero/version.rb

@@ -1,3 +1,3 @@
 module AuthenticationZero
-  VERSION = "2.12.4"
+  VERSION = "2.13.0"
 end

data/lib/generators/authentication/authentication_generator.rb

@@ -46,8 +46,8 @@ class AuthenticationGenerator < Rails::Generators::Base
 
   def add_environment_configurations
     ratelimit_code = <<~CODE
-      # Rate limit general requests by IP address in a rate of 1000 requests per hour
-      config.middleware.use(Rack::Ratelimit, name: "General", rate: [1000, 1.hour], redis: Redis.new, logger: Rails.logger) { |env| ActionDispatch::Request.new(env).ip }
+      # Rate limit general requests by IP address in a rate of 1000 requests per minute
+      config.middleware.use(Rack::Ratelimit, name: "General", rate: [1000, 1.minute], redis: Redis.new, logger: Rails.logger) { |env| ActionDispatch::Request.new(env).ip }
     CODE
 
     environment ratelimit_code, env: "production" if options.ratelimit?
@@ -56,14 +56,17 @@ class AuthenticationGenerator < Rails::Generators::Base
   def create_migrations
     migration_template "migrations/create_users_migration.rb", "#{db_migrate_path}/create_users.rb"
     migration_template "migrations/create_sessions_migration.rb", "#{db_migrate_path}/create_sessions.rb"
+    migration_template "migrations/create_email_verification_tokens_migration.rb", "#{db_migrate_path}/create_email_verification_tokens.rb"
+    migration_template "migrations/create_password_reset_tokens_migration.rb", "#{db_migrate_path}/create_password_reset_tokens.rb"
     migration_template "migrations/create_events_migration.rb", "#{db_migrate_path}/create_events.rb" if options.trackable?
   end
 
   def create_models
     template "models/user.rb", "app/models/user.rb"
     template "models/session.rb", "app/models/session.rb"
+    template "models/email_verification_token.rb", "app/models/email_verification_token.rb"
+    template "models/password_reset_token.rb", "app/models/password_reset_token.rb"
     template "models/current.rb", "app/models/current.rb"
-    template "models/locking.rb", "app/models/locking.rb" if options.lockable?
     template "models/event.rb", "app/models/event.rb" if options.trackable?
   end
 

data/lib/generators/authentication/templates/controllers/api/application_controller.rb.tt

@@ -10,6 +10,18 @@ class ApplicationController < ActionController::API
     end
   end
   <%- end -%>
+  <%- if options.lockable? %>
+  def self.lock_on(actions, wait: 1.minute, attempts: 1000, &block)
+    before_action(only: actions) do
+      counter = Kredis.counter("lock_on:#{request.remote_ip}:#{params[:controller]}:#{params[:action]}", expires_in: wait)
+      counter.increment
+
+      if counter.value > attempts
+        instance_exec(&block)
+      end
+    end
+  end
+  <%- end -%>
 
   private
     def authenticate

data/lib/generators/authentication/templates/controllers/api/identity/email_verifications_controller.rb.tt

@@ -8,7 +8,7 @@ class Identity::EmailVerificationsController < ApplicationController
   end
 
   def create
-    UserMailer.with(user: Current.user).email_verify_confirmation.deliver_later
+    UserMailer.with(user: Current.user).email_verification.deliver_later
   end
 
   private
@@ -22,7 +22,7 @@ class Identity::EmailVerificationsController < ApplicationController
         render json: { error: "That email verification code is invalid" }, status: :bad_request
       end
     <%- else -%>
-      @user = User.where(email: params[:email]).find_signed!(params[:token], purpose: params[:email])
+      @token = EmailVerificationToken.find_signed!(params[:sid]); @user = @token.user
     rescue
       render json: { error: "That email verification link is invalid" }, status: :bad_request
     <%- end -%>

data/lib/generators/authentication/templates/controllers/api/identity/password_resets_controller.rb.tt

@@ -1,22 +1,24 @@
 class Identity::PasswordResetsController < ApplicationController
   skip_before_action :authenticate
 
-  <%- if options.lockable? -%>
-  before_action :require_locking, only: :create
-  <%- end -%>
   before_action :set_user, only: :update
+  <%- if options.lockable? %>
+  lock_on :create, wait: 1.hour, attempts: 10 do
+    render json: { error: "You've exceeded the maximum number of attempts" }, status: :too_many_requests
+  end
+  <%- end -%>
 
   def create
     if @user = User.find_by(email: params[:email], verified: true)
-      UserMailer.with(user: @user).password_reset_provision.deliver_later
+      UserMailer.with(user: @user).password_reset.deliver_later
     else
-      render json: { error: "You can't reset your password until you verify your email" }, status: :not_found
+      render json: { error: "You can't reset your password until you verify your email" }, status: :bad_request
     end
   end
 
   def update
     if @user.update(user_params)
-      render json: @user
+      @token.destroy; render json: @user
     else
       render json: @user.errors, status: :unprocessable_entity
     end
@@ -24,7 +26,7 @@ class Identity::PasswordResetsController < ApplicationController
 
   private
     def set_user
-      @user = User.find_signed!(params[:token], purpose: :password_reset)
+      @token = PasswordResetToken.find_signed!(params[:sid]); @user = @token.user
     rescue
       render json: { error: "That password reset link is invalid" }, status: :bad_request
     end
@@ -32,11 +34,4 @@ class Identity::PasswordResetsController < ApplicationController
     def user_params
       params.permit(:password, :password_confirmation)
     end
-    <%- if options.lockable? %>
-    def require_locking
-      Locking.lock_on("password_reset_lock:#{request.remote_ip}", wait: 1.hour, attempts: 10) do
-        render json: { error: "You've exceeded the maximum number of attempts" }, status: :too_many_requests
-      end
-    end
-    <%- end -%>
 end

data/lib/generators/authentication/templates/controllers/html/application_controller.rb.tt

@@ -8,6 +8,18 @@ class ApplicationController < ActionController::Base
     end
   end
   <%- end -%>
+  <%- if options.lockable? %>
+  def self.lock_on(actions, wait: 1.minute, attempts: 1000, &block)
+    before_action(only: actions) do
+      counter = Kredis.counter("lock_on:#{request.remote_ip}:#{params[:controller]}:#{params[:action]}", expires_in: wait)
+      counter.increment
+
+      if counter.value > attempts
+        instance_exec(&block)
+      end
+    end
+  end
+  <%- end -%>
 
   private
     def authenticate

data/lib/generators/authentication/templates/controllers/html/identity/email_verifications_controller.rb.tt

@@ -9,13 +9,13 @@ class Identity::EmailVerificationsController < ApplicationController
   end
 
   def create
-    UserMailer.with(user: Current.user).email_verify_confirmation.deliver_later
+    UserMailer.with(user: Current.user).email_verification.deliver_later
     redirect_to root_path, notice: "We sent a verification email to your email address"
   end
 
   private
     def set_user
-      @user = User.where(email: params[:email]).find_signed!(params[:token], purpose: params[:email])
+      @token = EmailVerificationToken.find_signed!(params[:sid]); @user = @token.user
     rescue
       redirect_to edit_identity_email_path, alert: "That email verification link is invalid"
     end

data/lib/generators/authentication/templates/controllers/html/identity/password_resets_controller.rb.tt

@@ -1,10 +1,12 @@
 class Identity::PasswordResetsController < ApplicationController
   skip_before_action :authenticate
 
-  <%- if options.lockable? -%>
-  before_action :require_locking, only: :create
-  <%- end -%>
   before_action :set_user, only: %i[ edit update ]
+  <%- if options.lockable? %>
+  lock_on :create, wait: 1.hour, attempts: 10 do
+    redirect_to new_identity_password_reset_path, alert: "You've exceeded the maximum number of attempts"
+  end
+  <%- end -%>
 
   def new
   end
@@ -14,7 +16,7 @@ class Identity::PasswordResetsController < ApplicationController
 
   def create
     if @user = User.find_by(email: params[:email], verified: true)
-      UserMailer.with(user: @user).password_reset_provision.deliver_later
+      UserMailer.with(user: @user).password_reset.deliver_later
       redirect_to sign_in_path, notice: "Check your email for reset instructions"
     else
       redirect_to new_identity_password_reset_path, alert: "You can't reset your password until you verify your email"
@@ -23,7 +25,7 @@ class Identity::PasswordResetsController < ApplicationController
 
   def update
     if @user.update(user_params)
-      redirect_to sign_in_path, notice: "Your password was reset successfully. Please sign in"
+      @token.destroy; redirect_to sign_in_path, notice: "Your password was reset successfully. Please sign in"
     else
       render :edit, status: :unprocessable_entity
     end
@@ -31,7 +33,7 @@ class Identity::PasswordResetsController < ApplicationController
 
   private
     def set_user
-      @user = User.find_signed!(params[:token], purpose: :password_reset)
+      @token = PasswordResetToken.find_signed!(params[:sid]); @user = @token.user
     rescue
       redirect_to new_identity_password_reset_path, alert: "That password reset link is invalid"
     end
@@ -39,11 +41,4 @@ class Identity::PasswordResetsController < ApplicationController
     def user_params
       params.permit(:password, :password_confirmation)
     end
-    <%- if options.lockable? %>
-    def require_locking
-      Locking.lock_on("password_reset_lock:#{request.remote_ip}", wait: 1.hour, attempts: 10) do
-        redirect_to new_identity_password_reset_path, alert: "You've exceeded the maximum number of attempts"
-      end
-    end
-    <%- end -%>
 end

data/lib/generators/authentication/templates/erb/user_mailer/{email_verify_confirmation.html.erb.tt → email_verification.html.erb.tt}

@@ -7,7 +7,7 @@
 <%- if code_verifiable? -%>
 <strong><%%= @user.verification_code.value %></strong>
 <%- else -%>
-<%%= link_to "Yes, use this email for my account", edit_identity_email_verification_url(token: @signed_id, email: @user.email) %>
+<%%= link_to "Yes, use this email for my account", edit_identity_email_verification_url(sid: @signed_id) %>
 <%- end -%>
 
 <hr>

data/lib/generators/authentication/templates/erb/user_mailer/{email_verify_confirmation.text.erb.tt → email_verification.text.erb.tt}

@@ -7,7 +7,7 @@ You must <%= code_verifiable? ? "put the code" : "hit the link" %> below to conf
 <%- if code_verifiable? -%>
 <%%= @user.verification_code.value %>
 <%- else -%>
-[Yes, use this email for my account]<%%= edit_identity_email_verification_url(token: @signed_id, email: @user.email) %>
+[Yes, use this email for my account]<%%= edit_identity_email_verification_url(sid: @signed_id) %>
 <%- end -%>
 
 Have questions or need help? Just reply to this email and our support team will help you sort it out.

data/lib/generators/authentication/templates/erb/user_mailer/{password_reset_provision.html.erb.tt → password_reset.html.erb.tt}

@@ -2,7 +2,7 @@
 
 <p>Can't remember your password for <strong><%%= @user.email %></strong>? That's OK, it happens. Just hit the link below to set a new one.</p>
 
-<p><%%= link_to "Reset my password", edit_identity_password_reset_url(token: @signed_id) %></p>
+<p><%%= link_to "Reset my password", edit_identity_password_reset_url(sid: @signed_id) %></p>
 
 <p>If you did not request a password reset you can safely ignore this email, it expires in 20 minutes. Only someone with access to this email account can reset your password.</p>
 

data/lib/generators/authentication/templates/erb/user_mailer/{password_reset_provision.text.erb.tt → password_reset.text.erb.tt}

@@ -2,7 +2,7 @@ Hey there,
 
 Can't remember your password for <%%= @user.email %>? That's OK, it happens. Just hit the link below to set a new one.
 
-[Reset my password]<%%= edit_identity_password_reset_url(token: @signed_id) %>
+[Reset my password]<%%= edit_identity_password_reset_url(sid: @signed_id) %>
 
 If you did not request a password reset you can safely ignore this email, it expires in 20 minutes. Only someone with access to this email account can reset your password.
 

data/lib/generators/authentication/templates/mailers/user_mailer.rb.tt

@@ -1,17 +1,17 @@
 class UserMailer < ApplicationMailer
-  def password_reset_provision
+  def password_reset
     @user = params[:user]
-    @signed_id = @user.signed_id(purpose: :password_reset, expires_in: 20.minutes)
+    @signed_id = @user.create_password_reset_token.signed_id(expires_in: 20.minutes)
 
     mail to: @user.email, subject: "Reset your password"
   end
 
-  def email_verify_confirmation
+  def email_verification
     @user = params[:user]
     <%- if code_verifiable? -%>
     @user.verification_code.value = rand.to_s[2..7]
     <%- else -%>
-    @signed_id = @user.signed_id(purpose: @user.email, expires_in: 2.days)
+    @signed_id = @user.create_email_verification_token.signed_id(expires_in: 2.days)
     <%- end -%>
 
     mail to: @user.email, subject: "Verify your email"

data/lib/generators/authentication/templates/migrations/create_email_verification_tokens_migration.rb.tt

@@ -0,0 +1,7 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    create_table :email_verification_tokens do |t|
+      t.references :user, null: false, foreign_key: true
+    end
+  end
+end

data/lib/generators/authentication/templates/migrations/create_password_reset_tokens_migration.rb.tt

@@ -0,0 +1,7 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    create_table :password_reset_tokens do |t|
+      t.references :user, null: false, foreign_key: true
+    end
+  end
+end

data/lib/generators/authentication/templates/models/email_verification_token.rb.tt

@@ -0,0 +1,3 @@
+class EmailVerificationToken < ApplicationRecord
+  belongs_to :user
+end

data/lib/generators/authentication/templates/models/password_reset_token.rb.tt

@@ -0,0 +1,3 @@
+class PasswordResetToken < ApplicationRecord
+  belongs_to :user
+end

data/lib/generators/authentication/templates/models/user.rb.tt

@@ -1,6 +1,9 @@
 class User < ApplicationRecord
   has_secure_password
 
+  has_one :email_verification_token, dependent: :destroy
+  has_one :password_reset_token, dependent: :destroy
+
   has_many :sessions, dependent: :destroy
   <%- if options.trackable? -%>
   has_many :events, dependent: :destroy
@@ -28,7 +31,7 @@ class User < ApplicationRecord
   end
 
   after_save_commit if: :email_previously_changed? do
-    UserMailer.with(user: self).email_verify_confirmation.deliver_later
+    UserMailer.with(user: self).email_verification.deliver_later
   end
   <%- if options.trackable? %>
   after_save_commit if: :email_previously_changed? do

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/email_verifications_controller_test.rb.tt

@@ -3,9 +3,6 @@ require "test_helper"
 class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTest
   setup do
     @user, @token = sign_in_as(users(:lazaro_nixon))
-    @sid = @user.signed_id(purpose: @user.email, expires_in: 20.minutes)
-    @sid_exp = @user.signed_id(purpose: @user.email, expires_in: 0.minutes)
-
     @user.update! verified: false
   end
 
@@ -14,7 +11,7 @@ class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTe
   end
 
   test "should send a verification email" do
-    assert_enqueued_email_with UserMailer, :email_verify_confirmation, args: { user: @user } do
+    assert_enqueued_email_with UserMailer, :email_verification, args: { user: @user } do
       post identity_email_verification_url, headers: default_headers
     end
 
@@ -22,22 +19,16 @@ class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTe
   end
 
   test "should verify email" do
-    get edit_identity_email_verification_url, params: { token: @sid, email: @user.email }, headers: default_headers
+    sid = @user.create_email_verification_token.signed_id(expires_in: 2.days)
+
+    get edit_identity_email_verification_url, params: { sid: sid }, headers: default_headers
     assert_response :no_content
   end
 
   test "should not verify email with expired token" do
-    get edit_identity_email_verification_url, params: { token: @sid_exp, email: @user.email }, headers: default_headers
-
-    assert_response :bad_request
-    assert_equal "That email verification link is invalid", response.parsed_body["error"]
-  end
-
-  test "should not verify email with previous token" do
-    @user.update! email: "other_email@hey.com"
-
-    get edit_identity_email_verification_url, params: { token: @sid, email: @user.email_previously_was }, headers: default_headers
+    sid_exp = @user.create_email_verification_token.signed_id(expires_in: 0.minutes)
 
+    get edit_identity_email_verification_url, params: { sid: sid_exp }, headers: default_headers
     assert_response :bad_request
     assert_equal "That email verification link is invalid", response.parsed_body["error"]
   end

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/password_resets_controller_test.rb.tt

@@ -3,12 +3,10 @@ require "test_helper"
 class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   setup do
     @user = users(:lazaro_nixon)
-    @sid = @user.signed_id(purpose: :password_reset, expires_in: 20.minutes)
-    @sid_exp = @user.signed_id(purpose: :password_reset, expires_in: 0.minutes)
   end
 
   test "should send a password reset email" do
-    assert_enqueued_email_with UserMailer, :password_reset_provision, args: { user: @user } do
+    assert_enqueued_email_with UserMailer, :password_reset, args: { user: @user } do
       post identity_password_reset_url, params: { email: @user.email }
     end
 
@@ -20,7 +18,7 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
       post identity_password_reset_url, params: { email: "invalid_email@hey.com" }
     end
 
-    assert_response :not_found
+    assert_response :bad_request
     assert_equal "You can't reset your password until you verify your email", response.parsed_body["error"]
   end
 
@@ -31,18 +29,21 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
       post identity_password_reset_url, params: { email: @user.email }
     end
 
-    assert_response :not_found
+    assert_response :bad_request
     assert_equal "You can't reset your password until you verify your email", response.parsed_body["error"]
   end
 
   test "should update password" do
-    patch identity_password_reset_url, params: { token: @sid, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
+    sid = @user.create_password_reset_token.signed_id(expires_in: 20.minutes)
+
+    patch identity_password_reset_url, params: { sid: sid, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
     assert_response :success
   end
 
   test "should not update password with expired token" do
-    patch identity_password_reset_url, params: { token: @sid_exp, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
+    sid_exp = @user.create_password_reset_token.signed_id(expires_in: 0.minutes)
 
+    patch identity_password_reset_url, params: { sid: sid_exp, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
     assert_response :bad_request
     assert_equal "That password reset link is invalid", response.parsed_body["error"]
   end

data/lib/generators/authentication/templates/test_unit/controllers/html/identity/email_verifications_controller_test.rb.tt

@@ -3,14 +3,11 @@ require "test_helper"
 class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTest
   setup do
     @user = sign_in_as(users(:lazaro_nixon))
-    @sid = @user.signed_id(purpose: @user.email, expires_in: 20.minutes)
-    @sid_exp = @user.signed_id(purpose: @user.email, expires_in: 0.minutes)
-
     @user.update! verified: false
   end
 
   test "should send a verification email" do
-    assert_enqueued_email_with UserMailer, :email_verify_confirmation, args: { user: @user } do
+    assert_enqueued_email_with UserMailer, :email_verification, args: { user: @user } do
       post identity_email_verification_url
     end
 
@@ -18,21 +15,16 @@ class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTe
   end
 
   test "should verify email" do
-    get edit_identity_email_verification_url(token: @sid, email: @user.email)
+    sid = @user.create_email_verification_token.signed_id(expires_in: 2.days)
+
+    get edit_identity_email_verification_url(sid: sid, email: @user.email)
     assert_redirected_to root_url
   end
 
   test "should not verify email with expired token" do
-    get edit_identity_email_verification_url(token: @sid_exp, email: @user.email)
-
-    assert_redirected_to edit_identity_email_url
-    assert_equal "That email verification link is invalid", flash[:alert]
-  end
-
-  test "should not verify email with previous token" do
-    @user.update! email: "other_email@hey.com"
+    sid_exp = @user.create_email_verification_token.signed_id(expires_in: 0.minutes)
 
-    get edit_identity_email_verification_url(token: @sid, email: @user.email_previously_was)
+    get edit_identity_email_verification_url(sid: sid_exp, email: @user.email)
 
     assert_redirected_to edit_identity_email_url
     assert_equal "That email verification link is invalid", flash[:alert]

data/lib/generators/authentication/templates/test_unit/controllers/html/identity/password_resets_controller_test.rb.tt

@@ -3,8 +3,6 @@ require "test_helper"
 class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   setup do
     @user = users(:lazaro_nixon)
-    @sid = @user.signed_id(purpose: :password_reset, expires_in: 20.minutes)
-    @sid_exp = @user.signed_id(purpose: :password_reset, expires_in: 0.minutes)
   end
 
   test "should get new" do
@@ -13,12 +11,14 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should get edit" do
-    get edit_identity_password_reset_url(token: @sid)
+    sid = @user.create_password_reset_token.signed_id(expires_in: 20.minutes)
+
+    get edit_identity_password_reset_url(sid: sid)
     assert_response :success
   end
 
   test "should send a password reset email" do
-    assert_enqueued_email_with UserMailer, :password_reset_provision, args: { user: @user } do
+    assert_enqueued_email_with UserMailer, :password_reset, args: { user: @user } do
       post identity_password_reset_url, params: { email: @user.email }
     end
 
@@ -46,13 +46,16 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update password" do
-    patch identity_password_reset_url, params: { token: @sid, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
+    sid = @user.create_password_reset_token.signed_id(expires_in: 20.minutes)
+
+    patch identity_password_reset_url, params: { sid: sid, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
     assert_redirected_to sign_in_url
   end
 
   test "should not update password with expired token" do
-    patch identity_password_reset_url, params: { token: @sid_exp, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
+    sid_exp = @user.create_password_reset_token.signed_id(expires_in: 0.minutes)
 
+    patch identity_password_reset_url, params: { sid: @sid_exp, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
     assert_redirected_to new_identity_password_reset_url
     assert_equal "That password reset link is invalid", flash[:alert]
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authentication-zero
 version: !ruby/object:Gem::Version
-  version: 2.12.4
+  version: 2.13.0
 platform: ruby
 authors:
 - Nixon
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-04-16 00:00:00.000000000 Z
+date: 2022-05-02 00:00:00.000000000 Z
 dependencies: []
 description:
 email:
@@ -70,18 +70,21 @@ files:
 - lib/generators/authentication/templates/erb/sessions/sudos/new.html.erb.tt
 - lib/generators/authentication/templates/erb/two_factor_authentication/challenges/new.html.erb.tt
 - lib/generators/authentication/templates/erb/two_factor_authentication/totps/new.html.erb.tt
-- lib/generators/authentication/templates/erb/user_mailer/email_verify_confirmation.html.erb.tt
-- lib/generators/authentication/templates/erb/user_mailer/email_verify_confirmation.text.erb.tt
-- lib/generators/authentication/templates/erb/user_mailer/password_reset_provision.html.erb.tt
-- lib/generators/authentication/templates/erb/user_mailer/password_reset_provision.text.erb.tt
+- lib/generators/authentication/templates/erb/user_mailer/email_verification.html.erb.tt
+- lib/generators/authentication/templates/erb/user_mailer/email_verification.text.erb.tt
+- lib/generators/authentication/templates/erb/user_mailer/password_reset.html.erb.tt
+- lib/generators/authentication/templates/erb/user_mailer/password_reset.text.erb.tt
 - lib/generators/authentication/templates/mailers/session_mailer.rb.tt
 - lib/generators/authentication/templates/mailers/user_mailer.rb.tt
+- lib/generators/authentication/templates/migrations/create_email_verification_tokens_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_events_migration.rb.tt
+- lib/generators/authentication/templates/migrations/create_password_reset_tokens_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_sessions_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_users_migration.rb.tt
 - lib/generators/authentication/templates/models/current.rb.tt
+- lib/generators/authentication/templates/models/email_verification_token.rb.tt
 - lib/generators/authentication/templates/models/event.rb.tt
-- lib/generators/authentication/templates/models/locking.rb.tt
+- lib/generators/authentication/templates/models/password_reset_token.rb.tt
 - lib/generators/authentication/templates/models/session.rb.tt
 - lib/generators/authentication/templates/models/user.rb.tt
 - lib/generators/authentication/templates/test_unit/application_system_test_case.rb.tt

data/lib/generators/authentication/templates/models/locking.rb.tt

@@ -1,10 +0,0 @@
-class Locking
-  def self.lock_on(key, wait:, attempts:, &block)
-    counter = Kredis.counter(key, expires_in: wait)
-    counter.increment
-
-    if counter.value > attempts
-      yield
-    end
-  end
-end