authentication-zero 2.16.2 → 2.16.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fa899dd7d78a0c135998ca417f8adb5c412b1f7fb5cc3fb84839d8992dc5dd1c
-  data.tar.gz: af3d846901b8810cb49bb4be027f5c107514bd8f03c4ecda80947ffe5bb4847d
+  metadata.gz: 32a85d186a97bb53ee18ac30be1acdd6eb64716c7ed30fd0cfe4d52afca0d990
+  data.tar.gz: b155fd90fe8df3d548cd6cfa5c2b3cbf7bea30ffa23db6c3381a68b1b1d0c3ed
 SHA512:
-  metadata.gz: 1f83cb1e7672a469ac38fade46e2feeb1200366fd6d8b57efdc0f6d871099a3cb18f3bd35421bb721c9c367cc21061fbc79055c8481e2c8c30765123e8b3dfa8
-  data.tar.gz: 4516a0ae989e67eb5d9dc23ec72965107031fa7d6a52f0a0c392225c816b1e9daac3d07168e9be135c84940d684fd393a6d31e191cdffcac8b682b61251187d6
+  metadata.gz: 5c0d67ddd39e6698f383ec398d32e3f7884776adb42a9d2724498007458760e9558310fab74609c151ce6eae633d83a55be366f978d457efe5ae433118a236e5
+  data.tar.gz: b710950c1407acdf4a689a7e5858aafd344248f8f5917af5207db04b4d24828499fd4f1a61d54a7463b69b3866aeed499b900eff86e28072c613c871c6c97e24

data/CHANGELOG.md

@@ -1,3 +1,24 @@
+## Authentication Zero 2.16.4 (February 11, 2023) ##
+
+* Increase attemps for lockable sign-in
+
+## Authentication Zero 2.16.3 (December 30, 2022) ##
+
+* Require lock for sign in when lockable
+
+## Authentication Zero 2.16.2 (December 21, 2022) ##
+
+* Remove api documentation and reference for api docs from README
+* Remove bundle install instruction
+* Dont require sudo for omniauth users
+* Add gems instead of uncomment gemfile lines
+* Fix home view
+
+## Authentication Zero 2.16.1 (December 20, 2022) ##
+
+* Safe navigation for email normalization
+* Fix omniauth not verifying user
+
 ## Authentication Zero 2.16.0 (May 2, 2022) ##
 
 * Generate home controller

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authentication-zero (2.16.2)
+    authentication-zero (2.16.4)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -2,6 +2,22 @@
 
 The purpose of authentication zero is to generate a pre-built authentication system into a rails application (web or api-only) that follows both security and rails best practices. By generating code into the user's application instead of using a library, the user has complete freedom to modify the authentication system so it works best with their app.
 
+## Installation
+
+```
+$ bundle add authentication-zero
+```
+
+## Usage
+
+```
+$ rails generate authentication
+```
+
+## Developer responsibilities
+
+Since Authentication Zero generates this code into your application instead of building these modules into the gem itself, you now have complete freedom to modify the authentication system, so it works best with your use case. The one caveat with using a generated authentication system is it will not be updated after it's been generated. Therefore, as improvements are made to the output of `rails generate authentication`, it becomes your responsibility to determine if these changes need to be ported into your application. Security-related and other important improvements will be explicitly and clearly marked in the `CHANGELOG.md` file and upgrade notes.
+
 ## Features
 
 - **Simplest code ever (~200 lines of code)**
@@ -18,7 +34,7 @@ The purpose of authentication zero is to generate a pre-built authentication sys
 - Ask password before sensitive data changes, aka: sudo (--sudoable)
 - Reset the user password and send reset instructions
 - Reset the user password only from verified emails
-- Lock sending reset password email after many attempts (--lockable)
+- Lock mechanism for resetting password and sign-in (--lockable)
 - Send e-mail confirmation when your email has been changed
 - Send e-mail notification when someone has logged into your account
 - Manage multiple sessions & devices
@@ -37,18 +53,6 @@ The purpose of authentication zero is to generate a pre-built authentication sys
 - [Functional Tests](https://guides.rubyonrails.org/testing.html#functional-tests-for-your-controllers): In Rails, testing the various actions of a controller is a form of writing functional tests.
 - [System Testing](https://guides.rubyonrails.org/testing.html#system-testing): System tests allow you to test user interactions with your application, running tests in either a real or a headless browser.
 
-## Installation
-
-```
-$ bundle add authentication-zero
-```
-
-## Usage
-
-```
-$ rails generate authentication
-```
-
 ## Development
 
 To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).

data/lib/authentication_zero/version.rb

@@ -1,3 +1,3 @@
 module AuthenticationZero
-  VERSION = "2.16.2"
+  VERSION = "2.16.4"
 end

data/lib/generators/authentication/templates/controllers/api/sessions_controller.rb.tt

@@ -1,6 +1,9 @@
 class SessionsController < ApplicationController
   skip_before_action :authenticate, only: :create
 
+  <%- if options.lockable? -%>
+  before_action :require_lock, attempts: 20, only: :create
+  <%- end -%>
   before_action :set_session, only: %i[ show destroy ]
 
   def index

data/lib/generators/authentication/templates/controllers/html/sessions_controller.rb.tt

@@ -1,6 +1,9 @@
 class SessionsController < ApplicationController
   skip_before_action :authenticate, only: %i[ new create ]
 
+  <%- if options.lockable? -%>
+  before_action :require_lock, attempts: 20, only: :create
+  <%- end -%>
   before_action :set_session, only: :destroy
 
   def index

data/lib/generators/authentication/templates/models/user.rb.tt

@@ -29,7 +29,6 @@ class User < ApplicationRecord
   after_update if: :password_digest_previously_changed? do
     sessions.where.not(id: Current.session).destroy_all
   end
-
   <%- if options.trackable? %>
   after_update if: :email_previously_changed? do
     events.create! action: "email_verification_requested"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authentication-zero
 version: !ruby/object:Gem::Version
-  version: 2.16.2
+  version: 2.16.4
 platform: ruby
 authors:
 - Nixon
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-12-30 00:00:00.000000000 Z
+date: 2023-02-11 00:00:00.000000000 Z
 dependencies: []
 description:
 email: