authentication-zero 2.16.18 → 2.16.20

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ae2a40d4e3930043e09c68b96f68f4fc07431f2ed3eb5a7b0fdf58cef8f6f144
-  data.tar.gz: 61fed59ae5047fb60a26c6ba8267211bb0b928e3a787682942bfd3912b1ea4f8
+  metadata.gz: 9e14fa9b399611bdbb9d3a01b3f81408fa45983d06b989d92da3669a8b777476
+  data.tar.gz: 95396bf303a6454d7d6605cbe53e41423ba2113bf9635ebbf2e177ca0f17c1f4
 SHA512:
-  metadata.gz: 12b1614899d5aa9b0628bf70031857695e5800f40559b68eeff7957e7e1540afd93a8b9d574c86d6b57ae5e3369060dc141d1ed53964a0935eed60286a2b1949
-  data.tar.gz: 2abb77f18952aa72b08d8a59b701ce71087246669735b6ec045a69a9a8000cd4773d3f7a69d0743401b7848b8a3509a23be3be7f7a7a34772dc13fedd0bfbaae
+  metadata.gz: 4c2f8259a291ab4fa9fdb91521b3e8cf6ed03d678aa72ce148302f940575d7107132e7c71aea4aacf1f195b22ac500d528237add10a1db90853c8bd1b643f8f0
+  data.tar.gz: 01f856238d22656fcac3c71708ca36c69e8b5d44356934b4e021a84409f49dd48a432fcf3f3d58e383d3466be001b9f9d3d8558c368dc1d59bee28fccf1e54b0

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authentication-zero (2.16.18)
+    authentication-zero (2.16.20)
 
 GEM
   remote: https://rubygems.org/

data/lib/authentication_zero/version.rb

@@ -1,3 +1,3 @@
 module AuthenticationZero
-  VERSION = "2.16.18"
+  VERSION = "2.16.20"
 end

data/lib/generators/authentication/templates/config/redis/shared.yml

@@ -6,10 +6,5 @@ development: &development
   url: <%= ENV.fetch("REDIS_URL", "redis://127.0.0.1:6379/0") %>
   timeout: 1
 
-  # You can also specify host, port, and db instead of url
-  # host: <%= ENV.fetch("REDIS_SHARED_HOST", "127.0.0.1") %>
-  # port: <%= ENV.fetch("REDIS_SHARED_PORT", "6379") %>
-  # db: <%= ENV.fetch("REDIS_SHARED_DB", "11") %>
-
 test:
   <<: *development

data/lib/generators/authentication/templates/controllers/api/application_controller.rb.tt

@@ -3,16 +3,6 @@ class ApplicationController < ActionController::API
 
   before_action :set_current_request_details
   before_action :authenticate
-  <%- if options.lockable? %>
-  def require_lock(wait: 1.hour, attempts: 10)
-    counter = Kredis.counter("require_lock:#{request.remote_ip}:#{controller_path}:#{action_name}", expires_in: wait)
-    counter.increment
-
-    if counter.value > attempts
-      render json: { error: "You've exceeded the maximum number of attempts" }, status: :too_many_requests
-    end
-  end
-  <%- end -%>
 
   private
     def authenticate
@@ -27,4 +17,14 @@ class ApplicationController < ActionController::API
       Current.user_agent = request.user_agent
       Current.ip_address = request.ip
     end
+    <%- if options.lockable? %>
+    def require_lock(wait: 1.hour, attempts: 10)
+      counter = Kredis.counter("require_lock:#{request.remote_ip}:#{controller_path}:#{action_name}", expires_in: wait)
+      counter.increment
+
+      if counter.value > attempts
+        render json: { error: "You've exceeded the maximum number of attempts" }, status: :too_many_requests
+      end
+    end
+    <%- end -%>
 end

data/lib/generators/authentication/templates/controllers/api/identity/email_verifications_controller.rb.tt

@@ -13,7 +13,7 @@ class Identity::EmailVerificationsController < ApplicationController
 
   private
     def set_user
-      @token = EmailVerificationToken.find_signed!(params[:sid]); @user = @token.user
+      token = EmailVerificationToken.find_signed!(params[:sid]); @user = token.user
     rescue StandardError
       render json: { error: "That email verification link is invalid" }, status: :bad_request
     end

data/lib/generators/authentication/templates/controllers/api/identity/emails_controller.rb.tt

@@ -4,7 +4,7 @@ class Identity::EmailsController < ApplicationController
   def update
     if !@user.authenticate(params[:current_password])
       render json: { error: "The password you entered is incorrect" }, status: :bad_request
-    elsif @user.update(user_params)
+    elsif @user.update(email: params[:email])
       render_show
     else
       render json: @user.errors, status: :unprocessable_entity
@@ -16,10 +16,6 @@ class Identity::EmailsController < ApplicationController
       @user = Current.user
     end
 
-    def user_params
-      params.permit(:email)
-    end
-
     def render_show
       if @user.email_previously_changed?
         resend_email_verification; render(json: @user)

data/lib/generators/authentication/templates/controllers/api/identity/password_resets_controller.rb.tt

@@ -28,7 +28,7 @@ class Identity::PasswordResetsController < ApplicationController
 
   private
     def set_user
-      @token = PasswordResetToken.find_signed!(params[:sid]); @user = @token.user
+      token = PasswordResetToken.find_signed!(params[:sid]); @user = token.user
     rescue StandardError
       render json: { error: "That password reset link is invalid" }, status: :bad_request
     end

data/lib/generators/authentication/templates/controllers/html/application_controller.rb.tt

@@ -1,22 +1,6 @@
 class ApplicationController < ActionController::Base
   before_action :set_current_request_details
   before_action :authenticate
-  <%- if sudoable? %>
-  def require_sudo
-    return if Current.session.sudo?
-    redirect_to new_sessions_sudo_path(proceed_to_url: request.url)
-  end
-  <%- end -%>
-  <%- if options.lockable? %>
-  def require_lock(wait: 1.hour, attempts: 10)
-    counter = Kredis.counter("require_lock:#{request.remote_ip}:#{controller_path}:#{action_name}", expires_in: wait)
-    counter.increment
-
-    if counter.value > attempts
-      redirect_to root_path, alert: "You've exceeded the maximum number of attempts"
-    end
-  end
-  <%- end -%>
 
   private
     def authenticate
@@ -31,4 +15,21 @@ class ApplicationController < ActionController::Base
       Current.user_agent = request.user_agent
       Current.ip_address = request.ip
     end
+    <%- if options.lockable? %>
+    def require_lock(wait: 1.hour, attempts: 10)
+      counter = Kredis.counter("require_lock:#{request.remote_ip}:#{controller_path}:#{action_name}", expires_in: wait)
+      counter.increment
+
+      if counter.value > attempts
+        redirect_to root_path, alert: "You've exceeded the maximum number of attempts"
+      end
+    end
+    <%- end -%>
+    <%- if sudoable? %>
+    def require_sudo
+      unless Current.session.sudo?
+        redirect_to new_sessions_sudo_path(proceed_to_url: request.url)
+      end
+    end
+    <%- end -%>
 end

data/lib/generators/authentication/templates/controllers/html/identity/email_verifications_controller.rb.tt

@@ -15,7 +15,7 @@ class Identity::EmailVerificationsController < ApplicationController
 
   private
     def set_user
-      @token = EmailVerificationToken.find_signed!(params[:sid]); @user = @token.user
+      token = EmailVerificationToken.find_signed!(params[:sid]); @user = token.user
     rescue StandardError
       redirect_to edit_identity_email_path, alert: "That email verification link is invalid"
     end

data/lib/generators/authentication/templates/controllers/html/identity/emails_controller.rb.tt

@@ -7,7 +7,7 @@ class Identity::EmailsController < ApplicationController
   def update
     if !@user.authenticate(params[:current_password])
       redirect_to edit_identity_email_path, alert: "The password you entered is incorrect"
-    elsif @user.update(user_params)
+    elsif @user.update(email: params[:email])
       redirect_to_root
     else
       render :edit, status: :unprocessable_entity
@@ -19,10 +19,6 @@ class Identity::EmailsController < ApplicationController
       @user = Current.user
     end
 
-    def user_params
-      params.permit(:email)
-    end
-
     def redirect_to_root
       if @user.email_previously_changed?
         resend_email_verification

data/lib/generators/authentication/templates/controllers/html/identity/password_resets_controller.rb.tt

@@ -31,7 +31,7 @@ class Identity::PasswordResetsController < ApplicationController
 
   private
     def set_user
-      @token = PasswordResetToken.find_signed!(params[:sid]); @user = @token.user
+      token = PasswordResetToken.find_signed!(params[:sid]); @user = token.user
     rescue StandardError
       redirect_to new_identity_password_reset_path, alert: "That password reset link is invalid"
     end

data/lib/generators/authentication/templates/controllers/html/sessions/passwordlesses_controller.rb.tt

@@ -27,7 +27,7 @@ class Sessions::PasswordlessesController < ApplicationController
 
   private
     def set_user
-      @token = SignInToken.find_signed!(params[:sid]); @user = @token.user
+      token = SignInToken.find_signed!(params[:sid]); @user = token.user
     rescue StandardError
       redirect_to new_sessions_passwordless_path, alert: "That sign in link is invalid"
     end

data/lib/generators/authentication/templates/controllers/html/two_factor_authentication/recovery_codes_controller.rb.tt

@@ -26,6 +26,6 @@ class TwoFactorAuthentication::RecoveryCodesController < ApplicationController
     end
 
     def new_recovery_code
-      SecureRandom.alphanumeric(10).insert(5, "-").downcase
+      SecureRandom.alphanumeric(10).downcase
     end
 end

data/lib/generators/authentication/templates/erb/home/index.html.erb.tt

@@ -1,47 +1,49 @@
 <p style="color: green"><%%= notice %></p>
 
-<%% if Current.user.present? %>
-  <p>Signed as <%%= Current.user.email %></p>
-
-  <div>
-    <%%= link_to "Change email address", edit_identity_email_path %>
-  </div>
-
-  <div>
-    <%%= link_to "Change password", edit_password_path %>
-  </div>
-
-  <div>
-    <%%= link_to "Devices & Sessions", sessions_path %>
-  </div>
-  <%- if options.trackable? %>
-  <div>
-    <%%= link_to "Activity Log", authentications_events_path %>
-  </div>
-  <%- end -%>
-  <%- if invitable? %>
-  <div>
-    <%%= link_to "Send invitation", new_invitation_path %>
-  </div>
-  <%- end -%>
-  <%- if masqueradable? %>
-  <div>
-    <%%= button_to "Signin as last user", user_masquerade_path(User.last) %>
-  </div>
-  <%- end -%>
-  <%- if two_factor? %>
-  <div>
-    <%%= link_to "Two-Factor Authentication", new_two_factor_authentication_totp_path %>
-  </div>
-
-  <%% if Current.user.otp_secret.present? %>
-    <div><%%= link_to "Recovery Codes", two_factor_authentication_recovery_codes_path %></div>
-  <%% end %>
-  <%- end -%>
-
-  <br>
+<p>Signed as <%%= Current.user.email %></p>
 
-  <%%= button_to "Log out", Current.session, method: :delete %>
-<%% else %>
-  Please <%%= link_to "sign in", sign_in_path %> or <%%= link_to "sign up", sign_up_path %>.
+<h2>Login and verification</h2>
+
+<div>
+  <%%= link_to "Change password", edit_password_path %>
+</div>
+
+<div>
+  <%%= link_to "Change email address", edit_identity_email_path %>
+</div>
+<%- if two_factor? %>
+<div>
+  <%%= link_to "Two-Factor Authentication", new_two_factor_authentication_totp_path %>
+</div>
+
+<%% if Current.user.otp_secret.present? %>
+  <div><%%= link_to "Recovery Codes", two_factor_authentication_recovery_codes_path %></div>
 <%% end %>
+<%- end -%>
+<%- if invitable? %>
+<div>
+  <%%= link_to "Send invitation", new_invitation_path %>
+</div>
+<%- end -%>
+<%- if masqueradable? %>
+<div>
+  <%%= button_to "Signin as last user", user_masquerade_path(User.last) %>
+</div>
+<%- end -%>
+
+<h2>Access history</h2>
+
+<div>
+  <%%= link_to "Devices & Sessions", sessions_path %>
+</div>
+<%- if options.trackable? %>
+<div>
+  <%%= link_to "Activity Log", authentications_events_path %>
+</div>
+<%- end -%>
+
+<br>
+
+<div>
+  <%%= button_to "Log out", Current.session, method: :delete %>
+</div>

data/lib/generators/authentication/templates/models/user.rb.tt

@@ -3,14 +3,13 @@ class User < ApplicationRecord
 
   has_many :email_verification_tokens, dependent: :destroy
   has_many :password_reset_tokens, dependent: :destroy
+  has_many :sessions, dependent: :destroy
   <%- if two_factor? -%>
   has_many :recovery_codes, dependent: :destroy
   <%- end -%>
   <%- if passwordless? -%>
   has_many :sign_in_tokens, dependent: :destroy
   <%- end -%>
-
-  has_many :sessions, dependent: :destroy
   <%- if options.trackable? -%>
   has_many :events, dependent: :destroy
   <%- end -%>

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authentication-zero
 version: !ruby/object:Gem::Version
-  version: 2.16.18
+  version: 2.16.20
 platform: ruby
 authors:
 - Nixon
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-04-07 00:00:00.000000000 Z
+date: 2023-04-09 00:00:00.000000000 Z
 dependencies: []
 description:
 email: