authentication-zero 2.12.6 → 2.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 39712c822deb0a2df94156ce44de1cbcd604be043498b56b2139c0dce6d81e51
-  data.tar.gz: 3e4704a6d3cc5c1e2da391deee5f9e5f2b4ce43374a555e3535f6ddbdfbfbb3d
+  metadata.gz: 34663ddecbc5d0c0276a99a7f7d0f867e90c2f731e1c56a5d508738469647795
+  data.tar.gz: bbffe8e2dff90913524ff9744efa49cb1097d78745206579bb49251472a016ed
 SHA512:
-  metadata.gz: b2ca2648b71d9429eab8811922bb44985d158702373908fbd4a58bc40e6f0bd08fc28b4e7e58f4f6ecb6cdb837ffede42ea8aadeb7c0991fc0e85558a7319644
-  data.tar.gz: '0897ed09e494352a9429db06982c160b5259578e2dfa0f21cd51e37d0dc57975e847af1e3147af84cf069cf3c4c28e06772581a85480c12686ca27d975a463b6'
+  metadata.gz: 38dd57dfb438408fb9ff4099508568c90bc9416fe5e624b4e38eaeba4f886e61340a2104976e62d9214d95d57f45a15a8dac6dd8789022a4cf24f6225f4e98be
+  data.tar.gz: 9393b6ceb9203be1bf0c5643640422ec8c64d96af34b01087f20d533ed781dd8f6b553350d698658a8b5cf1a07b36c965822a03d836451bdcec44c882f87a39f

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## Authentication Zero 2.13.0 (May 2, 2022) ##
+
+* Migrate tokens to a table structure
+* Refactor lockable to a controller method
+
 ## Authentication Zero 2.12.0 (March 28, 2022) ##
 
 * Remove model option from generator

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authentication-zero (2.12.6)
+    authentication-zero (2.13.0)
 
 GEM
   remote: https://rubygems.org/

data/lib/authentication_zero/version.rb

@@ -1,3 +1,3 @@
 module AuthenticationZero
-  VERSION = "2.12.6"
+  VERSION = "2.13.0"
 end

data/lib/generators/authentication/authentication_generator.rb

@@ -46,8 +46,8 @@ class AuthenticationGenerator < Rails::Generators::Base
 
   def add_environment_configurations
     ratelimit_code = <<~CODE
-      # Rate limit general requests by IP address in a rate of 1000 requests per hour
-      config.middleware.use(Rack::Ratelimit, name: "General", rate: [1000, 1.hour], redis: Redis.new, logger: Rails.logger) { |env| ActionDispatch::Request.new(env).ip }
+      # Rate limit general requests by IP address in a rate of 1000 requests per minute
+      config.middleware.use(Rack::Ratelimit, name: "General", rate: [1000, 1.minute], redis: Redis.new, logger: Rails.logger) { |env| ActionDispatch::Request.new(env).ip }
     CODE
 
     environment ratelimit_code, env: "production" if options.ratelimit?
@@ -56,14 +56,17 @@ class AuthenticationGenerator < Rails::Generators::Base
   def create_migrations
     migration_template "migrations/create_users_migration.rb", "#{db_migrate_path}/create_users.rb"
     migration_template "migrations/create_sessions_migration.rb", "#{db_migrate_path}/create_sessions.rb"
+    migration_template "migrations/create_email_verification_tokens_migration.rb", "#{db_migrate_path}/create_email_verification_tokens.rb"
+    migration_template "migrations/create_password_reset_tokens_migration.rb", "#{db_migrate_path}/create_password_reset_tokens.rb"
     migration_template "migrations/create_events_migration.rb", "#{db_migrate_path}/create_events.rb" if options.trackable?
   end
 
   def create_models
     template "models/user.rb", "app/models/user.rb"
     template "models/session.rb", "app/models/session.rb"
+    template "models/email_verification_token.rb", "app/models/email_verification_token.rb"
+    template "models/password_reset_token.rb", "app/models/password_reset_token.rb"
     template "models/current.rb", "app/models/current.rb"
-    template "models/locking.rb", "app/models/locking.rb" if options.lockable?
     template "models/event.rb", "app/models/event.rb" if options.trackable?
   end
 

data/lib/generators/authentication/templates/controllers/api/application_controller.rb.tt

@@ -10,6 +10,18 @@ class ApplicationController < ActionController::API
     end
   end
   <%- end -%>
+  <%- if options.lockable? %>
+  def self.lock_on(actions, wait: 1.minute, attempts: 1000, &block)
+    before_action(only: actions) do
+      counter = Kredis.counter("lock_on:#{request.remote_ip}:#{params[:controller]}:#{params[:action]}", expires_in: wait)
+      counter.increment
+
+      if counter.value > attempts
+        instance_exec(&block)
+      end
+    end
+  end
+  <%- end -%>
 
   private
     def authenticate

data/lib/generators/authentication/templates/controllers/api/identity/email_verifications_controller.rb.tt

@@ -22,7 +22,7 @@ class Identity::EmailVerificationsController < ApplicationController
         render json: { error: "That email verification code is invalid" }, status: :bad_request
       end
     <%- else -%>
-      @user = User.where(email: params[:email]).find_signed!(params[:token], purpose: "email_verification/#{params[:email]}")
+      @token = EmailVerificationToken.find_signed!(params[:sid]); @user = @token.user
     rescue
       render json: { error: "That email verification link is invalid" }, status: :bad_request
     <%- end -%>

data/lib/generators/authentication/templates/controllers/api/identity/password_resets_controller.rb.tt

@@ -1,10 +1,12 @@
 class Identity::PasswordResetsController < ApplicationController
   skip_before_action :authenticate
 
-  <%- if options.lockable? -%>
-  before_action :require_locking, only: :create
-  <%- end -%>
   before_action :set_user, only: :update
+  <%- if options.lockable? %>
+  lock_on :create, wait: 1.hour, attempts: 10 do
+    render json: { error: "You've exceeded the maximum number of attempts" }, status: :too_many_requests
+  end
+  <%- end -%>
 
   def create
     if @user = User.find_by(email: params[:email], verified: true)
@@ -16,7 +18,7 @@ class Identity::PasswordResetsController < ApplicationController
 
   def update
     if @user.update(user_params)
-      render json: @user
+      @token.destroy; render json: @user
     else
       render json: @user.errors, status: :unprocessable_entity
     end
@@ -24,7 +26,7 @@ class Identity::PasswordResetsController < ApplicationController
 
   private
     def set_user
-      @user = User.find_signed!(params[:token], purpose: :password_reset)
+      @token = PasswordResetToken.find_signed!(params[:sid]); @user = @token.user
     rescue
       render json: { error: "That password reset link is invalid" }, status: :bad_request
     end
@@ -32,11 +34,4 @@ class Identity::PasswordResetsController < ApplicationController
     def user_params
       params.permit(:password, :password_confirmation)
     end
-    <%- if options.lockable? %>
-    def require_locking
-      Locking.lock_on("password_reset_lock:#{request.remote_ip}", wait: 1.hour, attempts: 10) do
-        render json: { error: "You've exceeded the maximum number of attempts" }, status: :too_many_requests
-      end
-    end
-    <%- end -%>
 end

data/lib/generators/authentication/templates/controllers/html/application_controller.rb.tt

@@ -8,6 +8,18 @@ class ApplicationController < ActionController::Base
     end
   end
   <%- end -%>
+  <%- if options.lockable? %>
+  def self.lock_on(actions, wait: 1.minute, attempts: 1000, &block)
+    before_action(only: actions) do
+      counter = Kredis.counter("lock_on:#{request.remote_ip}:#{params[:controller]}:#{params[:action]}", expires_in: wait)
+      counter.increment
+
+      if counter.value > attempts
+        instance_exec(&block)
+      end
+    end
+  end
+  <%- end -%>
 
   private
     def authenticate

data/lib/generators/authentication/templates/controllers/html/identity/email_verifications_controller.rb.tt

@@ -15,7 +15,7 @@ class Identity::EmailVerificationsController < ApplicationController
 
   private
     def set_user
-      @user = User.where(email: params[:email]).find_signed!(params[:token], purpose: "email_verification/#{params[:email]}")
+      @token = EmailVerificationToken.find_signed!(params[:sid]); @user = @token.user
     rescue
       redirect_to edit_identity_email_path, alert: "That email verification link is invalid"
     end

data/lib/generators/authentication/templates/controllers/html/identity/password_resets_controller.rb.tt

@@ -1,10 +1,12 @@
 class Identity::PasswordResetsController < ApplicationController
   skip_before_action :authenticate
 
-  <%- if options.lockable? -%>
-  before_action :require_locking, only: :create
-  <%- end -%>
   before_action :set_user, only: %i[ edit update ]
+  <%- if options.lockable? %>
+  lock_on :create, wait: 1.hour, attempts: 10 do
+    redirect_to new_identity_password_reset_path, alert: "You've exceeded the maximum number of attempts"
+  end
+  <%- end -%>
 
   def new
   end
@@ -23,7 +25,7 @@ class Identity::PasswordResetsController < ApplicationController
 
   def update
     if @user.update(user_params)
-      redirect_to sign_in_path, notice: "Your password was reset successfully. Please sign in"
+      @token.destroy; redirect_to sign_in_path, notice: "Your password was reset successfully. Please sign in"
     else
       render :edit, status: :unprocessable_entity
     end
@@ -31,7 +33,7 @@ class Identity::PasswordResetsController < ApplicationController
 
   private
     def set_user
-      @user = User.find_signed!(params[:token], purpose: :password_reset)
+      @token = PasswordResetToken.find_signed!(params[:sid]); @user = @token.user
     rescue
       redirect_to new_identity_password_reset_path, alert: "That password reset link is invalid"
     end
@@ -39,11 +41,4 @@ class Identity::PasswordResetsController < ApplicationController
     def user_params
       params.permit(:password, :password_confirmation)
     end
-    <%- if options.lockable? %>
-    def require_locking
-      Locking.lock_on("password_reset_lock:#{request.remote_ip}", wait: 1.hour, attempts: 10) do
-        redirect_to new_identity_password_reset_path, alert: "You've exceeded the maximum number of attempts"
-      end
-    end
-    <%- end -%>
 end

data/lib/generators/authentication/templates/erb/user_mailer/email_verification.html.erb.tt

@@ -7,7 +7,7 @@
 <%- if code_verifiable? -%>
 <strong><%%= @user.verification_code.value %></strong>
 <%- else -%>
-<%%= link_to "Yes, use this email for my account", edit_identity_email_verification_url(token: @signed_id, email: @user.email) %>
+<%%= link_to "Yes, use this email for my account", edit_identity_email_verification_url(sid: @signed_id) %>
 <%- end -%>
 
 <hr>

data/lib/generators/authentication/templates/erb/user_mailer/email_verification.text.erb.tt

@@ -7,7 +7,7 @@ You must <%= code_verifiable? ? "put the code" : "hit the link" %> below to conf
 <%- if code_verifiable? -%>
 <%%= @user.verification_code.value %>
 <%- else -%>
-[Yes, use this email for my account]<%%= edit_identity_email_verification_url(token: @signed_id, email: @user.email) %>
+[Yes, use this email for my account]<%%= edit_identity_email_verification_url(sid: @signed_id) %>
 <%- end -%>
 
 Have questions or need help? Just reply to this email and our support team will help you sort it out.

data/lib/generators/authentication/templates/erb/user_mailer/password_reset.html.erb.tt

@@ -2,7 +2,7 @@
 
 <p>Can't remember your password for <strong><%%= @user.email %></strong>? That's OK, it happens. Just hit the link below to set a new one.</p>
 
-<p><%%= link_to "Reset my password", edit_identity_password_reset_url(token: @signed_id) %></p>
+<p><%%= link_to "Reset my password", edit_identity_password_reset_url(sid: @signed_id) %></p>
 
 <p>If you did not request a password reset you can safely ignore this email, it expires in 20 minutes. Only someone with access to this email account can reset your password.</p>
 

data/lib/generators/authentication/templates/erb/user_mailer/password_reset.text.erb.tt

@@ -2,7 +2,7 @@ Hey there,
 
 Can't remember your password for <%%= @user.email %>? That's OK, it happens. Just hit the link below to set a new one.
 
-[Reset my password]<%%= edit_identity_password_reset_url(token: @signed_id) %>
+[Reset my password]<%%= edit_identity_password_reset_url(sid: @signed_id) %>
 
 If you did not request a password reset you can safely ignore this email, it expires in 20 minutes. Only someone with access to this email account can reset your password.
 

data/lib/generators/authentication/templates/mailers/user_mailer.rb.tt

@@ -1,7 +1,7 @@
 class UserMailer < ApplicationMailer
   def password_reset
     @user = params[:user]
-    @signed_id = @user.signed_id(purpose: :password_reset, expires_in: 20.minutes)
+    @signed_id = @user.create_password_reset_token.signed_id(expires_in: 20.minutes)
 
     mail to: @user.email, subject: "Reset your password"
   end
@@ -11,7 +11,7 @@ class UserMailer < ApplicationMailer
     <%- if code_verifiable? -%>
     @user.verification_code.value = rand.to_s[2..7]
     <%- else -%>
-    @signed_id = @user.signed_id(purpose: "email_verification/#{@user.email}", expires_in: 2.days)
+    @signed_id = @user.create_email_verification_token.signed_id(expires_in: 2.days)
     <%- end -%>
 
     mail to: @user.email, subject: "Verify your email"

data/lib/generators/authentication/templates/migrations/create_email_verification_tokens_migration.rb.tt

@@ -0,0 +1,7 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    create_table :email_verification_tokens do |t|
+      t.references :user, null: false, foreign_key: true
+    end
+  end
+end

data/lib/generators/authentication/templates/migrations/create_password_reset_tokens_migration.rb.tt

@@ -0,0 +1,7 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    create_table :password_reset_tokens do |t|
+      t.references :user, null: false, foreign_key: true
+    end
+  end
+end

data/lib/generators/authentication/templates/models/email_verification_token.rb.tt

@@ -0,0 +1,3 @@
+class EmailVerificationToken < ApplicationRecord
+  belongs_to :user
+end

data/lib/generators/authentication/templates/models/password_reset_token.rb.tt

@@ -0,0 +1,3 @@
+class PasswordResetToken < ApplicationRecord
+  belongs_to :user
+end

data/lib/generators/authentication/templates/models/user.rb.tt

@@ -1,6 +1,9 @@
 class User < ApplicationRecord
   has_secure_password
 
+  has_one :email_verification_token, dependent: :destroy
+  has_one :password_reset_token, dependent: :destroy
+
   has_many :sessions, dependent: :destroy
   <%- if options.trackable? -%>
   has_many :events, dependent: :destroy

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/email_verifications_controller_test.rb.tt

@@ -3,9 +3,6 @@ require "test_helper"
 class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTest
   setup do
     @user, @token = sign_in_as(users(:lazaro_nixon))
-    @sid = @user.signed_id(purpose: "email_verification/#{@user.email}", expires_in: 20.minutes)
-    @sid_exp = @user.signed_id(purpose: "email_verification/#{@user.email}", expires_in: 0.minutes)
-
     @user.update! verified: false
   end
 
@@ -22,22 +19,16 @@ class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTe
   end
 
   test "should verify email" do
-    get edit_identity_email_verification_url, params: { token: @sid, email: @user.email }, headers: default_headers
+    sid = @user.create_email_verification_token.signed_id(expires_in: 2.days)
+
+    get edit_identity_email_verification_url, params: { sid: sid }, headers: default_headers
     assert_response :no_content
   end
 
   test "should not verify email with expired token" do
-    get edit_identity_email_verification_url, params: { token: @sid_exp, email: @user.email }, headers: default_headers
-
-    assert_response :bad_request
-    assert_equal "That email verification link is invalid", response.parsed_body["error"]
-  end
-
-  test "should not verify email with previous token" do
-    @user.update! email: "other_email@hey.com"
-
-    get edit_identity_email_verification_url, params: { token: @sid, email: @user.email_previously_was }, headers: default_headers
+    sid_exp = @user.create_email_verification_token.signed_id(expires_in: 0.minutes)
 
+    get edit_identity_email_verification_url, params: { sid: sid_exp }, headers: default_headers
     assert_response :bad_request
     assert_equal "That email verification link is invalid", response.parsed_body["error"]
   end

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/password_resets_controller_test.rb.tt

@@ -3,8 +3,6 @@ require "test_helper"
 class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   setup do
     @user = users(:lazaro_nixon)
-    @sid = @user.signed_id(purpose: :password_reset, expires_in: 20.minutes)
-    @sid_exp = @user.signed_id(purpose: :password_reset, expires_in: 0.minutes)
   end
 
   test "should send a password reset email" do
@@ -36,13 +34,16 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update password" do
-    patch identity_password_reset_url, params: { token: @sid, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
+    sid = @user.create_password_reset_token.signed_id(expires_in: 20.minutes)
+
+    patch identity_password_reset_url, params: { sid: sid, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
     assert_response :success
   end
 
   test "should not update password with expired token" do
-    patch identity_password_reset_url, params: { token: @sid_exp, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
+    sid_exp = @user.create_password_reset_token.signed_id(expires_in: 0.minutes)
 
+    patch identity_password_reset_url, params: { sid: sid_exp, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
     assert_response :bad_request
     assert_equal "That password reset link is invalid", response.parsed_body["error"]
   end

data/lib/generators/authentication/templates/test_unit/controllers/html/identity/email_verifications_controller_test.rb.tt

@@ -3,9 +3,6 @@ require "test_helper"
 class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTest
   setup do
     @user = sign_in_as(users(:lazaro_nixon))
-    @sid = @user.signed_id(purpose: "email_verification/#{@user.email}", expires_in: 20.minutes)
-    @sid_exp = @user.signed_id(purpose: "email_verification/#{@user.email}", expires_in: 0.minutes)
-
     @user.update! verified: false
   end
 
@@ -18,21 +15,16 @@ class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTe
   end
 
   test "should verify email" do
-    get edit_identity_email_verification_url(token: @sid, email: @user.email)
+    sid = @user.create_email_verification_token.signed_id(expires_in: 2.days)
+
+    get edit_identity_email_verification_url(sid: sid, email: @user.email)
     assert_redirected_to root_url
   end
 
   test "should not verify email with expired token" do
-    get edit_identity_email_verification_url(token: @sid_exp, email: @user.email)
-
-    assert_redirected_to edit_identity_email_url
-    assert_equal "That email verification link is invalid", flash[:alert]
-  end
-
-  test "should not verify email with previous token" do
-    @user.update! email: "other_email@hey.com"
+    sid_exp = @user.create_email_verification_token.signed_id(expires_in: 0.minutes)
 
-    get edit_identity_email_verification_url(token: @sid, email: @user.email_previously_was)
+    get edit_identity_email_verification_url(sid: sid_exp, email: @user.email)
 
     assert_redirected_to edit_identity_email_url
     assert_equal "That email verification link is invalid", flash[:alert]

data/lib/generators/authentication/templates/test_unit/controllers/html/identity/password_resets_controller_test.rb.tt

@@ -3,8 +3,6 @@ require "test_helper"
 class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   setup do
     @user = users(:lazaro_nixon)
-    @sid = @user.signed_id(purpose: :password_reset, expires_in: 20.minutes)
-    @sid_exp = @user.signed_id(purpose: :password_reset, expires_in: 0.minutes)
   end
 
   test "should get new" do
@@ -13,7 +11,9 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should get edit" do
-    get edit_identity_password_reset_url(token: @sid)
+    sid = @user.create_password_reset_token.signed_id(expires_in: 20.minutes)
+
+    get edit_identity_password_reset_url(sid: sid)
     assert_response :success
   end
 
@@ -46,13 +46,16 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update password" do
-    patch identity_password_reset_url, params: { token: @sid, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
+    sid = @user.create_password_reset_token.signed_id(expires_in: 20.minutes)
+
+    patch identity_password_reset_url, params: { sid: sid, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
     assert_redirected_to sign_in_url
   end
 
   test "should not update password with expired token" do
-    patch identity_password_reset_url, params: { token: @sid_exp, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
+    sid_exp = @user.create_password_reset_token.signed_id(expires_in: 0.minutes)
 
+    patch identity_password_reset_url, params: { sid: @sid_exp, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
     assert_redirected_to new_identity_password_reset_url
     assert_equal "That password reset link is invalid", flash[:alert]
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authentication-zero
 version: !ruby/object:Gem::Version
-  version: 2.12.6
+  version: 2.13.0
 platform: ruby
 authors:
 - Nixon
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-04-29 00:00:00.000000000 Z
+date: 2022-05-02 00:00:00.000000000 Z
 dependencies: []
 description:
 email:
@@ -76,12 +76,15 @@ files:
 - lib/generators/authentication/templates/erb/user_mailer/password_reset.text.erb.tt
 - lib/generators/authentication/templates/mailers/session_mailer.rb.tt
 - lib/generators/authentication/templates/mailers/user_mailer.rb.tt
+- lib/generators/authentication/templates/migrations/create_email_verification_tokens_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_events_migration.rb.tt
+- lib/generators/authentication/templates/migrations/create_password_reset_tokens_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_sessions_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_users_migration.rb.tt
 - lib/generators/authentication/templates/models/current.rb.tt
+- lib/generators/authentication/templates/models/email_verification_token.rb.tt
 - lib/generators/authentication/templates/models/event.rb.tt
-- lib/generators/authentication/templates/models/locking.rb.tt
+- lib/generators/authentication/templates/models/password_reset_token.rb.tt
 - lib/generators/authentication/templates/models/session.rb.tt
 - lib/generators/authentication/templates/models/user.rb.tt
 - lib/generators/authentication/templates/test_unit/application_system_test_case.rb.tt

data/lib/generators/authentication/templates/models/locking.rb.tt

@@ -1,10 +0,0 @@
-class Locking
-  def self.lock_on(key, wait:, attempts:, &block)
-    counter = Kredis.counter(key, expires_in: wait)
-    counter.increment
-
-    if counter.value > attempts
-      yield
-    end
-  end
-end