authentication-zero 2.13.0 → 2.15.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 34663ddecbc5d0c0276a99a7f7d0f867e90c2f731e1c56a5d508738469647795
-  data.tar.gz: bbffe8e2dff90913524ff9744efa49cb1097d78745206579bb49251472a016ed
+  metadata.gz: d77763ad7dead2a863eda83bfac8f792968850885e267126dfd1b1ea64851c6d
+  data.tar.gz: b0387c9925290b63802b32b0cddd08bbf0e9ff55c71b5fcb8c87ce684d180a13
 SHA512:
-  metadata.gz: 38dd57dfb438408fb9ff4099508568c90bc9416fe5e624b4e38eaeba4f886e61340a2104976e62d9214d95d57f45a15a8dac6dd8789022a4cf24f6225f4e98be
-  data.tar.gz: 9393b6ceb9203be1bf0c5643640422ec8c64d96af34b01087f20d533ed781dd8f6b553350d698658a8b5cf1a07b36c965822a03d836451bdcec44c882f87a39f
+  metadata.gz: '0944d14cbacd55436ace47b3665397e20a08603d73e46d25d25f0bdd6fbab79df9d9b2efe0957cc5f9a71b9c0cec5e9a92c9107e414326e470ec68a213aaecc0'
+  data.tar.gz: 6f9732bfb46252e50318d2fccf409aaabb07e110c2b6aaed150cabff4475bdb0cb9d4e1b2a887b9e87b65c948515667f6990f9d7460d2d66f5bb353355d6f85a

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authentication-zero (2.13.0)
+    authentication-zero (2.15.1)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -19,7 +19,7 @@ The purpose of authentication zero is to generate a pre-built authentication sys
 - Reset the user password and send reset instructions
 - Reset the user password only from verified emails
 - Lock sending reset password email after many attempts (--lockable)
-- Rate limiting for your app, 1000 reqs/hour (--ratelimit)
+- Rate limiting for your app, 1000 reqs/minute (--ratelimit)
 - Send e-mail confirmation when your email has been changed
 - Send e-mail notification when someone has logged into your account
 - Manage multiple sessions & devices

data/lib/authentication_zero/version.rb

@@ -1,3 +1,3 @@
 module AuthenticationZero
-  VERSION = "2.13.0"
+  VERSION = "2.15.1"
 end

data/lib/generators/authentication/templates/controllers/api/application_controller.rb.tt

@@ -11,14 +11,12 @@ class ApplicationController < ActionController::API
   end
   <%- end -%>
   <%- if options.lockable? %>
-  def self.lock_on(actions, wait: 1.minute, attempts: 1000, &block)
-    before_action(only: actions) do
-      counter = Kredis.counter("lock_on:#{request.remote_ip}:#{params[:controller]}:#{params[:action]}", expires_in: wait)
-      counter.increment
+  def require_lock(wait: 1.hour, attempts: 10)
+    counter = Kredis.counter("require_lock:#{request.remote_ip}:#{params[:controller]}:#{params[:action]}", expires_in: wait)
+    counter.increment
 
-      if counter.value > attempts
-        instance_exec(&block)
-      end
+    if counter.value > attempts
+      render json: { error: "You've exceeded the maximum number of attempts" }, status: :too_many_requests
     end
   end
   <%- end -%>

data/lib/generators/authentication/templates/controllers/api/identity/emails_controller.rb.tt

@@ -5,13 +5,7 @@ class Identity::EmailsController < ApplicationController
   before_action :set_user
 
   def update
-    <%- unless options.sudoable? -%>
-    if !@user.authenticate(params[:current_password])
-      render json: { error: "The password you entered is incorrect" }, status: :bad_request
-    elsif @user.update(user_params)
-    <%- else -%>
     if @user.update(user_params)
-    <%- end -%>
       render json: @user
     else
       render json: @user.errors, status: :unprocessable_entity

data/lib/generators/authentication/templates/controllers/api/identity/password_resets_controller.rb.tt

@@ -2,10 +2,8 @@ class Identity::PasswordResetsController < ApplicationController
   skip_before_action :authenticate
 
   before_action :set_user, only: :update
-  <%- if options.lockable? %>
-  lock_on :create, wait: 1.hour, attempts: 10 do
-    render json: { error: "You've exceeded the maximum number of attempts" }, status: :too_many_requests
-  end
+  <%- if options.lockable? -%>
+  before_action :require_lock, only: :create
   <%- end -%>
 
   def create

data/lib/generators/authentication/templates/controllers/html/application_controller.rb.tt

@@ -9,14 +9,12 @@ class ApplicationController < ActionController::Base
   end
   <%- end -%>
   <%- if options.lockable? %>
-  def self.lock_on(actions, wait: 1.minute, attempts: 1000, &block)
-    before_action(only: actions) do
-      counter = Kredis.counter("lock_on:#{request.remote_ip}:#{params[:controller]}:#{params[:action]}", expires_in: wait)
-      counter.increment
+  def require_lock(wait: 1.hour, attempts: 10)
+    counter = Kredis.counter("require_lock:#{request.remote_ip}:#{params[:controller]}:#{params[:action]}", expires_in: wait)
+    counter.increment
 
-      if counter.value > attempts
-        instance_exec(&block)
-      end
+    if counter.value > attempts
+      redirect_to root_path, alert: "You've exceeded the maximum number of attempts"
     end
   end
   <%- end -%>

data/lib/generators/authentication/templates/controllers/html/identity/emails_controller.rb.tt

@@ -8,13 +8,7 @@ class Identity::EmailsController < ApplicationController
   end
 
   def update
-    <%- unless options.sudoable? -%>
-    if !@user.authenticate(params[:current_password])
-      redirect_to edit_identity_email_path, alert: "The password you entered is incorrect"
-    elsif @user.update(user_params)
-    <%- else -%>
     if @user.update(user_params)
-    <%- end -%>
       redirect_to root_path, notice: "Your email has been changed"
     else
       render :edit, status: :unprocessable_entity

data/lib/generators/authentication/templates/controllers/html/identity/password_resets_controller.rb.tt

@@ -2,10 +2,8 @@ class Identity::PasswordResetsController < ApplicationController
   skip_before_action :authenticate
 
   before_action :set_user, only: %i[ edit update ]
-  <%- if options.lockable? %>
-  lock_on :create, wait: 1.hour, attempts: 10 do
-    redirect_to new_identity_password_reset_path, alert: "You've exceeded the maximum number of attempts"
-  end
+  <%- if options.lockable? -%>
+  before_action :require_lock, only: :create
   <%- end -%>
 
   def new
@@ -25,7 +23,7 @@ class Identity::PasswordResetsController < ApplicationController
 
   def update
     if @user.update(user_params)
-      @token.destroy; redirect_to sign_in_path, notice: "Your password was reset successfully. Please sign in"
+      @token.destroy; redirect_to(sign_in_path, notice: "Your password was reset successfully. Please sign in")
     else
       render :edit, status: :unprocessable_entity
     end

data/lib/generators/authentication/templates/controllers/html/two_factor_authentication/totps_controller.rb.tt

@@ -10,13 +10,7 @@ class TwoFactorAuthentication::TotpsController < ApplicationController
   end
 
   def create
-    <%- unless options.sudoable? -%>
-    if !@user.authenticate(params[:current_password])
-      redirect_to two_factor_authentication_totp_path, alert: "The password you entered is incorrect"
-    elsif @totp.verify(params[:code], drift_behind: 15)
-    <%- else -%>
     if @totp.verify(params[:code], drift_behind: 15)
-    <%- end -%>
       @user.update! otp_secret: params[:secret]
       redirect_to root_path, notice: "2FA is enabled on your account"
     else

data/lib/generators/authentication/templates/erb/identity/emails/edit.html.erb.tt

@@ -21,13 +21,6 @@
     </div>
   <%% end %>
 
-  <%- unless options.sudoable? -%>
-  <div>
-    <%%= form.label :current_password, style: "display: block" %>
-    <%%= form.password_field :current_password, required: true, autofocus: true, autocomplete: "current-password" %>
-  </div>
-  <%- end -%>  
-
   <div>
     <%%= form.label :email, "New email", style: "display: block" %>
     <%%= form.email_field :email %>

data/lib/generators/authentication/templates/erb/two_factor_authentication/totps/new.html.erb.tt

@@ -17,13 +17,6 @@
 <%%= form_with(url: two_factor_authentication_totp_path) do |form| %>
   <%%= form.hidden_field :secret, value: @totp.secret %>
 
-  <%- unless options.sudoable? -%>
-  <div>
-    <%%= form.label :current_password, style: "display: block" %>
-    <%%= form.password_field :current_password, required: true, autofocus: true, autocomplete: "current-password" %>
-  </div>
-  <%- end -%>
-
   <div>
     <%%= form.label :code, "After scanning with your camera, the app will generate a six-digit code. Enter it here:", style: "display: block" %>
     <%%= form.text_field :code, autofocus: true, required: true, autocomplete: :off %>

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/emails_controller_test.rb.tt

@@ -10,14 +10,7 @@ class Identity::EmailsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update email" do
-    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "Secret1*3*5*" }, headers: default_headers
+    patch identity_email_url, params: { email: "new_email@hey.com" }, headers: default_headers
     assert_response :success
   end
-
-  test "should not update email with wrong current password" do
-    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "SecretWrong1*3" }, headers: default_headers
-
-    assert_response :bad_request
-    assert_equal "The password you entered is incorrect", response.parsed_body["error"]
-  end
 end

data/lib/generators/authentication/templates/test_unit/controllers/html/identity/emails_controller_test.rb.tt

@@ -11,14 +11,7 @@ class Identity::EmailsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update email" do
-    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "Secret1*3*5*" }
+    patch identity_email_url, params: { email: "new_email@hey.com" }
     assert_redirected_to root_url
   end
-
-  test "should not update email with wrong current password" do
-    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "SecretWrong1*3" }
-
-    assert_redirected_to edit_identity_email_url
-    assert_equal "The password you entered is incorrect", flash[:alert]
-  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authentication-zero
 version: !ruby/object:Gem::Version
-  version: 2.13.0
+  version: 2.15.1
 platform: ruby
 authors:
 - Nixon
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-05-02 00:00:00.000000000 Z
+date: 2022-06-01 00:00:00.000000000 Z
 dependencies: []
 description:
 email: