authentication-zero 2.16.36 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 01c6ab07811e6c670432fb66c4ceb3580c69cb45c438e18a947b231d86041b35
-  data.tar.gz: de1d633031898842969cebc414d84c543e7efcf7675b65e2b552e5ec2c318bf3
+  metadata.gz: 1a3d3b8586f1e31b0110ad4dab428c38798c8a014f3f305a128bd90b8f51efe0
+  data.tar.gz: 4064bc5928d671f0403c12537d4b65adbbc4940d0efa8e8cfbaffd709b7677e4
 SHA512:
-  metadata.gz: 1b1eacc6b8b9551a63d8bce3a49780f12dfa999901169e51370c34a4e272bccf885e00a5dcd69e9c163a216729fa1f1f8673ec6969613b2f4c444cbdfbd381ea
-  data.tar.gz: 82084da636d5b44ed85ee1c2c9c928ffe40549ecf742a93206f9d804a0bc6d4c4e63dc414fb558d4a551e7e73fc76ae96159ec45eb3cfde98d143dd4b1920aa9
+  metadata.gz: e08062d6b3710305fa2e7ac251bf816761cfd80aa8a4d0662b03cef95f072bc6a2a60803d66150e7d34830fd54abf33d20073730e6818a4aaf009a421beb9971
+  data.tar.gz: c0388c5e3a9f2eb9628a4fd1bd031543f4dbd56072631d5da7312cd3fbc3b4bd9d0ba873037218c274cecb25522154ca4ad6ed40221def8e1607d4ed410984de

data/.github/workflows/CI.yml

@@ -18,10 +18,11 @@ jobs:
       - name: Install Ruby and gems
         uses: ruby/setup-ruby@v1
         with:
+          ruby-version: "3.2"
           bundler-cache: true
 
       - name: Install the latest Rails gem
-        run: gem install rails -v "~> 7.0.0"
+        run: gem install rails -v "7.1.0"
 
       - name: Install Rubocop
         run: gem install rubocop rubocop-performance rubocop-minitest rubocop-packaging rubocop-minitest rubocop-rails
@@ -31,7 +32,7 @@ jobs:
 
       - name: Create fresh Rails app and run generator
         run: |
-          rails new test-app
+          rails new test-app --skip-action-mailbox --skip-action-text --skip-active-storage
           cp .rubocop.yml test-app/.rubocop.yml
           cd test-app
           bundle add authentication-zero --path ..
@@ -61,10 +62,11 @@ jobs:
       - name: Install Ruby and gems
         uses: ruby/setup-ruby@v1
         with:
+          ruby-version: "3.2"
           bundler-cache: true
 
       - name: Install the latest Rails gem
-        run: gem install rails -v "~> 7.0.0"
+        run: gem install rails -v "7.1.0"
 
       - name: Install Rubocop
         run: gem install rubocop rubocop-performance rubocop-minitest rubocop-packaging rubocop-minitest rubocop-rails
@@ -74,7 +76,7 @@ jobs:
 
       - name: Create fresh Rails app and run generator
         run: |
-          rails new test-app
+          rails new test-app --skip-action-mailbox --skip-action-text --skip-active-storage
           cp .rubocop.yml test-app/.rubocop.yml
           cd test-app
           bundle add authentication-zero --path ..
@@ -90,4 +92,3 @@ jobs:
 
       - name: Tests
         run: cd test-app && bin/rails test
-

data/.rubocop.yml

@@ -4,5 +4,13 @@ Style/HashSyntax:
   Exclude:
     - Gemfile
 
+Layout/EmptyLinesAroundBlockBody:
+  Exclude:
+    - Gemfile
+
+Layout/TrailingWhitespace:
+  Exclude:
+    - config/initializers/filter_parameter_logging.rb
+
 Style/FrozenStringLiteralComment:
   Enabled: false

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+## Authentication Zero 3.0.0 ##
+
+* Use the new normalizes API
+* Use the new password_challenge API
+* Use the new authenticate_by API
+* Use the new generates_token_for API
+
 ## Authentication Zero 2.16.35 ##
 
 * Adjust relationship so that account has many users

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authentication-zero (2.16.36)
+    authentication-zero (3.0.0)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -8,6 +8,12 @@ The purpose of authentication zero is to generate a pre-built authentication sys
 $ bundle add authentication-zero
 ```
 
+If you are using Rails < 7.1, you must use version 2.
+
+```
+$ bundle add authentication-zero --version "~> 2"
+```
+
 ## Usage
 
 ```
@@ -51,6 +57,8 @@ Since Authentication Zero generates this code into your application instead of b
 ## Generated code
 
 - [has_secure_password](https://api.rubyonrails.org/classes/ActiveModel/SecurePassword/ClassMethods.html#method-i-has_secure_password): Adds methods to set and authenticate against a bcrypt password.
+- [authenticate_by](https://edgeapi.rubyonrails.org/classes/ActiveRecord/SecurePassword/ClassMethods.html#method-i-authenticate_by): Given a set of attributes, finds a record using the non-password attributes, and then authenticates that record using the password attributes.
+- [generates_token_for](https://edgeapi.rubyonrails.org/classes/ActiveRecord/TokenFor/ClassMethods.html#method-i-generates_token_for): Defines the behavior of tokens generated for a specific purpose.
 - [signed cookies](https://api.rubyonrails.org/classes/ActionDispatch/Cookies.html): Returns a jar that'll automatically generate a signed representation of cookie value and verify it when reading from the cookie again.
 - [httponly cookies](https://api.rubyonrails.org/classes/ActionDispatch/Cookies.html): A cookie with the httponly attribute is inaccessible to the JavaScript, this precaution helps mitigate cross-site scripting (XSS) attacks.
 - [signed_id](https://api.rubyonrails.org/classes/ActiveRecord/SignedId.html): Returns a signed id that is tamper proof, so it's safe to send in an email or otherwise share with the outside world.

data/lib/authentication_zero/version.rb

@@ -1,3 +1,3 @@
 module AuthenticationZero
-  VERSION = "2.16.36"
+  VERSION = "3.0.0"
 end

data/lib/generators/authentication/authentication_generator.rb

@@ -70,8 +70,6 @@ class AuthenticationGenerator < Rails::Generators::Base
     migration_template "migrations/create_accounts_migration.rb", "#{db_migrate_path}/create_accounts_migration.rb" if options.tenantable?
     migration_template "migrations/create_users_migration.rb", "#{db_migrate_path}/create_users.rb"
     migration_template "migrations/create_sessions_migration.rb", "#{db_migrate_path}/create_sessions.rb"
-    migration_template "migrations/create_password_reset_tokens_migration.rb", "#{db_migrate_path}/create_password_reset_tokens.rb"
-    migration_template "migrations/create_email_verification_tokens_migration.rb", "#{db_migrate_path}/create_email_verification_tokens.rb"
     migration_template "migrations/create_events_migration.rb", "#{db_migrate_path}/create_events.rb" if options.trackable?
     migration_template "migrations/create_recovery_codes_migration.rb", "#{db_migrate_path}/create_recovery_codes.rb" if two_factor?
     migration_template "migrations/create_security_keys_migration.rb", "#{db_migrate_path}/create_security_keys.rb" if webauthn?
@@ -83,9 +81,7 @@ class AuthenticationGenerator < Rails::Generators::Base
 
     template "models/account.rb", "app/models/account.rb" if options.tenantable?
     template "models/current.rb", "app/models/current.rb"
-    template "models/email_verification_token.rb", "app/models/email_verification_token.rb"
     template "models/event.rb", "app/models/event.rb" if options.trackable?
-    template "models/password_reset_token.rb", "app/models/password_reset_token.rb"
     template "models/recovery_code.rb", "app/models/recovery_code.rb" if two_factor?
     template "models/security_key.rb", "app/models/security_key.rb" if webauthn?
     template "models/session.rb", "app/models/session.rb"

data/lib/generators/authentication/templates/controllers/api/identity/email_verifications_controller.rb.tt

@@ -13,7 +13,7 @@ class Identity::EmailVerificationsController < ApplicationController
 
   private
     def set_user
-      token = EmailVerificationToken.find_signed!(params[:sid]); @user = token.user
+      @user = User.find_by_token_for!(:email_verification, params[:sid])
     rescue StandardError
       render json: { error: "That email verification link is invalid" }, status: :bad_request
     end

data/lib/generators/authentication/templates/controllers/api/identity/emails_controller.rb.tt

@@ -2,9 +2,7 @@ class Identity::EmailsController < ApplicationController
   before_action :set_user
 
   def update
-    if !@user.authenticate(params[:current_password])
-      render json: { error: "The password you entered is incorrect" }, status: :bad_request
-    elsif @user.update(email: params[:email])
+    if @user.update(user_params)
       render_show
     else
       render json: @user.errors, status: :unprocessable_entity
@@ -16,6 +14,10 @@ class Identity::EmailsController < ApplicationController
       @user = Current.user
     end
 
+    def user_params
+      params.permit(:email, :password_challenge).with_defaults(password_challenge: "")
+    end
+
     def render_show
       if @user.email_previously_changed?
         resend_email_verification; render(json: @user)

data/lib/generators/authentication/templates/controllers/api/identity/password_resets_controller.rb.tt

@@ -20,7 +20,7 @@ class Identity::PasswordResetsController < ApplicationController
 
   def update
     if @user.update(user_params)
-      revoke_tokens; render(json: @user)
+      render json: @user
     else
       render json: @user.errors, status: :unprocessable_entity
     end
@@ -28,7 +28,7 @@ class Identity::PasswordResetsController < ApplicationController
 
   private
     def set_user
-      token = PasswordResetToken.find_signed!(params[:sid]); @user = token.user
+      @user = User.find_by_token_for!(:password_reset, params[:sid])
     rescue StandardError
       render json: { error: "That password reset link is invalid" }, status: :bad_request
     end
@@ -36,8 +36,4 @@ class Identity::PasswordResetsController < ApplicationController
     def user_params
       params.permit(:password, :password_confirmation)
     end
-
-    def revoke_tokens
-      @user.password_reset_tokens.delete_all
-    end
 end

data/lib/generators/authentication/templates/controllers/api/passwords_controller.rb.tt

@@ -2,9 +2,7 @@ class PasswordsController < ApplicationController
   before_action :set_user
 
   def update
-    if !@user.authenticate(params[:current_password])
-      render json: { error: "The current password you entered is incorrect" }, status: :bad_request
-    elsif @user.update(user_params)
+    if @user.update(user_params)
       render json: @user
     else
       render json: @user.errors, status: :unprocessable_entity
@@ -17,6 +15,6 @@ class PasswordsController < ApplicationController
     end
 
     def user_params
-      params.permit(:password, :password_confirmation)
+      params.permit(:password, :password_confirmation, :password_challenge).with_defaults(password_challenge: "")
     end
 end

data/lib/generators/authentication/templates/controllers/api/sessions_controller.rb.tt

@@ -12,9 +12,7 @@ class SessionsController < ApplicationController
   end
 
   def create
-    user = User.find_by(email: params[:email])
-
-    if user && user.authenticate(params[:password])
+    if user = User.authenticate_by(email: params[:email], password: params[:password])
       @session = user.sessions.create!
       response.set_header "X-Session-Token", @session.signed_id
 

data/lib/generators/authentication/templates/controllers/html/identity/email_verifications_controller.rb.tt

@@ -15,7 +15,7 @@ class Identity::EmailVerificationsController < ApplicationController
 
   private
     def set_user
-      token = EmailVerificationToken.find_signed!(params[:sid]); @user = token.user
+      @user = User.find_by_token_for!(:email_verification, params[:sid])
     rescue StandardError
       redirect_to edit_identity_email_path, alert: "That email verification link is invalid"
     end

data/lib/generators/authentication/templates/controllers/html/identity/emails_controller.rb.tt

@@ -5,9 +5,7 @@ class Identity::EmailsController < ApplicationController
   end
 
   def update
-    if !@user.authenticate(params[:current_password])
-      redirect_to edit_identity_email_path, alert: "The password you entered is incorrect"
-    elsif @user.update(email: params[:email])
+    if @user.update(user_params)
       redirect_to_root
     else
       render :edit, status: :unprocessable_entity
@@ -19,6 +17,10 @@ class Identity::EmailsController < ApplicationController
       @user = Current.user
     end
 
+    def user_params
+      params.permit(:email, :password_challenge).with_defaults(password_challenge: "")
+    end
+
     def redirect_to_root
       if @user.email_previously_changed?
         resend_email_verification

data/lib/generators/authentication/templates/controllers/html/identity/password_resets_controller.rb.tt

@@ -23,7 +23,7 @@ class Identity::PasswordResetsController < ApplicationController
 
   def update
     if @user.update(user_params)
-      revoke_tokens; redirect_to(sign_in_path, notice: "Your password was reset successfully. Please sign in")
+      redirect_to sign_in_path, notice: "Your password was reset successfully. Please sign in"
     else
       render :edit, status: :unprocessable_entity
     end
@@ -31,7 +31,7 @@ class Identity::PasswordResetsController < ApplicationController
 
   private
     def set_user
-      token = PasswordResetToken.find_signed!(params[:sid]); @user = token.user
+      @user = User.find_by_token_for!(:password_reset, params[:sid])
     rescue StandardError
       redirect_to new_identity_password_reset_path, alert: "That password reset link is invalid"
     end
@@ -43,8 +43,4 @@ class Identity::PasswordResetsController < ApplicationController
     def send_password_reset_email
       UserMailer.with(user: @user).password_reset.deliver_later
     end
-
-    def revoke_tokens
-      @user.password_reset_tokens.delete_all
-    end
 end

data/lib/generators/authentication/templates/controllers/html/passwords_controller.rb.tt

@@ -5,9 +5,7 @@ class PasswordsController < ApplicationController
   end
 
   def update
-    if !@user.authenticate(params[:current_password])
-      redirect_to edit_password_path, alert: "The current password you entered is incorrect"
-    elsif @user.update(user_params)
+    if @user.update(user_params)
       redirect_to root_path, notice: "Your password has been changed"
     else
       render :edit, status: :unprocessable_entity
@@ -20,6 +18,6 @@ class PasswordsController < ApplicationController
     end
 
     def user_params
-      params.permit(:password, :password_confirmation)
+      params.permit(:password, :password_confirmation, :password_challenge).with_defaults(password_challenge: "")
     end
 end

data/lib/generators/authentication/templates/controllers/html/sessions_controller.rb.tt

@@ -11,9 +11,7 @@ class SessionsController < ApplicationController
   end
 
   def create
-    user = User.find_by(email: params[:email])
-
-    if user && user.authenticate(params[:password])
+    if user = User.authenticate_by(email: params[:email], password: params[:password])
       <%- if two_factor? -%>
       if user.otp_required_for_sign_in?
         session[:challenge_token] = user.signed_id(purpose: :authentication_challenge, expires_in: 20.minutes)

data/lib/generators/authentication/templates/erb/identity/emails/edit.html.erb.tt

@@ -27,8 +27,8 @@
   </div>
 
   <div>
-    <%%= form.label :current_password, style: "display: block" %>
-    <%%= form.password_field :current_password, required: true, autocomplete: "current-password" %>
+    <%%= form.label :password_challenge, style: "display: block" %>
+    <%%= form.password_field :password_challenge, required: true, autocomplete: "current-password" %>
   </div>
 
   <div>

data/lib/generators/authentication/templates/erb/passwords/edit.html.erb.tt

@@ -16,8 +16,8 @@
   <%% end %>
 
   <div>
-    <%%= form.label :current_password, style: "display: block" %>
-    <%%= form.password_field :current_password, required: true, autofocus: true, autocomplete: "current-password" %>
+    <%%= form.label :password_challenge, style: "display: block" %>
+    <%%= form.password_field :password_challenge, required: true, autofocus: true, autocomplete: "current-password" %>
   </div>
 
   <div>

data/lib/generators/authentication/templates/lib/account_middleware.rb

@@ -6,13 +6,11 @@ class AccountMiddleware
   def call(env)
     request = ActionDispatch::Request.new(env)
 
-    _, account_id, request_path = request.path.split("/", 3)
-
-    if account_id !~ /\D/
+    if m = /\A(\/(\d{1,}))/.match(request.path_info)
+      script_name, account_id, path_info = [m[1], m[2], m.post_match]
+      request.script_name = script_name
+      request.path_info   = path_info.presence || "/"
       set_current_account(account_id)
-
-      request.script_name = "/#{account_id}"
-      request.path_info   = "/#{request_path}"
       @app.call(request.env)
     else
       @app.call(request.env)

data/lib/generators/authentication/templates/mailers/user_mailer.rb.tt

@@ -1,14 +1,14 @@
 class UserMailer < ApplicationMailer
   def password_reset
     @user = params[:user]
-    @signed_id = @user.password_reset_tokens.create.signed_id(expires_in: 20.minutes)
+    @signed_id = @user.generate_token_for(:password_reset)
 
     mail to: @user.email, subject: "Reset your password"
   end
 
   def email_verification
     @user = params[:user]
-    @signed_id = @user.email_verification_tokens.create.signed_id(expires_in: 2.days)
+    @signed_id = @user.generate_token_for(:email_verification)
 
     mail to: @user.email, subject: "Verify your email"
   end
@@ -23,7 +23,7 @@ class UserMailer < ApplicationMailer
   <%- if invitable? %>
   def invitation_instructions
     @user = params[:user]
-    @signed_id = @user.password_reset_tokens.create.signed_id(expires_in: 2.days)
+    @signed_id = @user.generate_token_for(:password_reset)
 
     mail to: @user.email, subject: "Invitation instructions"
   end

data/lib/generators/authentication/templates/models/user.rb.tt

@@ -1,11 +1,12 @@
 class User < ApplicationRecord
   has_secure_password
+
+  generates_token_for :email_verification, expires_in: 2.days { email }
+  generates_token_for :password_reset, expires_in: 20.minutes { password_salt.last(10) }
   <%- if options.tenantable? %>
   belongs_to :account
   <%- end -%>
 
-  has_many :email_verification_tokens, dependent: :destroy
-  has_many :password_reset_tokens, dependent: :destroy
   has_many :sessions, dependent: :destroy
   <%- if two_factor? -%>
   has_many :recovery_codes, dependent: :destroy
@@ -26,9 +27,7 @@ class User < ApplicationRecord
   validates :password, not_pwned: { message: "might easily be guessed" }
   <%- end -%>
 
-  before_validation if: -> { email.present? } do
-    self.email = email.downcase.strip
-  end
+  normalizes :email, with: -> { _1.strip.downcase }
 
   before_validation if: :email_changed?, on: :update do
     self.verified = false

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/email_verifications_controller_test.rb.tt

@@ -11,7 +11,7 @@ class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTe
   end
 
   test "should send a verification email" do
-    assert_enqueued_email_with UserMailer, :email_verification, args: { user: @user } do
+    assert_enqueued_email_with UserMailer, :email_verification, params: { user: @user } do
       post identity_email_verification_url, headers: default_headers
     end
 
@@ -19,16 +19,19 @@ class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTe
   end
 
   test "should verify email" do
-    sid = @user.email_verification_tokens.create.signed_id(expires_in: 2.days)
+    sid = @user.generate_token_for(:email_verification)
 
     get identity_email_verification_url, params: { sid: sid }, headers: default_headers
     assert_response :no_content
   end
 
   test "should not verify email with expired token" do
-    sid_exp = @user.email_verification_tokens.create.signed_id(expires_in: 0.minutes)
+    sid = @user.generate_token_for(:email_verification)
+
+    travel 3.days
+
+    get identity_email_verification_url, params: { sid: sid }, headers: default_headers
 
-    get identity_email_verification_url, params: { sid: sid_exp }, headers: default_headers
     assert_response :bad_request
     assert_equal "That email verification link is invalid", response.parsed_body["error"]
   end

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/emails_controller_test.rb.tt

@@ -10,14 +10,14 @@ class Identity::EmailsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update email" do
-    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "Secret1*3*5*" }, headers: default_headers
+    patch identity_email_url, params: { email: "new_email@hey.com", password_challenge: "Secret1*3*5*" }, headers: default_headers
     assert_response :success
   end
 
-  test "should not update email with wrong current password" do
-    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "SecretWrong1*3" }, headers: default_headers
+  test "should not update email with wrong password challenge" do
+    patch identity_email_url, params: { email: "new_email@hey.com", password_challenge: "SecretWrong1*3" }, headers: default_headers
 
-    assert_response :bad_request
-    assert_equal "The password you entered is incorrect", response.parsed_body["error"]
+    assert_response :unprocessable_entity
+    assert_equal ["is invalid"], response.parsed_body["password_challenge"]
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/password_resets_controller_test.rb.tt

@@ -6,14 +6,14 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should get edit" do
-    sid = @user.password_reset_tokens.create.signed_id(expires_in: 20.minutes)
+    sid = @user.generate_token_for(:password_reset)
 
     get edit_identity_password_reset_url(sid: sid)
     assert_response :no_content
   end
 
   test "should send a password reset email" do
-    assert_enqueued_email_with UserMailer, :password_reset, args: { user: @user } do
+    assert_enqueued_email_with UserMailer, :password_reset, params: { user: @user } do
       post identity_password_reset_url, params: { email: @user.email }
     end
 
@@ -41,16 +41,19 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update password" do
-    sid = @user.password_reset_tokens.create.signed_id(expires_in: 20.minutes)
+    sid = @user.generate_token_for(:password_reset)
 
     patch identity_password_reset_url, params: { sid: sid, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
     assert_response :success
   end
 
   test "should not update password with expired token" do
-    sid_exp = @user.password_reset_tokens.create.signed_id(expires_in: 0.minutes)
+    sid = @user.generate_token_for(:password_reset)
+
+    travel 30.minutes
+
+    patch identity_password_reset_url, params: { sid: sid, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
 
-    patch identity_password_reset_url, params: { sid: sid_exp, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
     assert_response :bad_request
     assert_equal "That password reset link is invalid", response.parsed_body["error"]
   end

data/lib/generators/authentication/templates/test_unit/controllers/api/passwords_controller_test.rb.tt

@@ -10,14 +10,14 @@ class PasswordsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update password" do
-    patch password_url, params: { current_password: "Secret1*3*5*", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }, headers: default_headers
+    patch password_url, params: { password_challenge: "Secret1*3*5*", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }, headers: default_headers
     assert_response :success
   end
 
-  test "should not update password with wrong current password" do
-    patch password_url, params: { current_password: "SecretWrong1*3", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }, headers: default_headers
+  test "should not update password with wrong password challenge" do
+    patch password_url, params: { password_challenge: "SecretWrong1*3", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }, headers: default_headers
 
-    assert_response :bad_request
-    assert_equal "The current password you entered is incorrect", response.parsed_body["error"]
+    assert_response :unprocessable_entity
+    assert_equal ["is invalid"], response.parsed_body["password_challenge"]
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/html/identity/email_verifications_controller_test.rb.tt

@@ -7,7 +7,7 @@ class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTe
   end
 
   test "should send a verification email" do
-    assert_enqueued_email_with UserMailer, :email_verification, args: { user: @user } do
+    assert_enqueued_email_with UserMailer, :email_verification, params: { user: @user } do
       post identity_email_verification_url
     end
 
@@ -15,16 +15,18 @@ class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTe
   end
 
   test "should verify email" do
-    sid = @user.email_verification_tokens.create.signed_id(expires_in: 2.days)
+    sid = @user.generate_token_for(:email_verification)
 
     get identity_email_verification_url(sid: sid, email: @user.email)
     assert_redirected_to root_url
   end
 
   test "should not verify email with expired token" do
-    sid_exp = @user.email_verification_tokens.create.signed_id(expires_in: 0.minutes)
+    sid = @user.generate_token_for(:email_verification)
 
-    get identity_email_verification_url(sid: sid_exp, email: @user.email)
+    travel 3.days
+
+    get identity_email_verification_url(sid: sid, email: @user.email)
 
     assert_redirected_to edit_identity_email_url
     assert_equal "That email verification link is invalid", flash[:alert]

data/lib/generators/authentication/templates/test_unit/controllers/html/identity/emails_controller_test.rb.tt

@@ -11,14 +11,15 @@ class Identity::EmailsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update email" do
-    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "Secret1*3*5*" }
+    patch identity_email_url, params: { email: "new_email@hey.com", password_challenge: "Secret1*3*5*" }
     assert_redirected_to root_url
   end
 
-  test "should not update email with wrong current password" do
-    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "SecretWrong1*3" }
 
-    assert_redirected_to edit_identity_email_url
-    assert_equal "The password you entered is incorrect", flash[:alert]
+  test "should not update password with wrong password challenge" do
+    patch password_url, params: { password_challenge: "SecretWrong1*3", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
+
+    assert_response :unprocessable_entity
+    assert_select "li", /Password challenge is invalid/
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/html/identity/password_resets_controller_test.rb.tt

@@ -11,14 +11,14 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should get edit" do
-    sid = @user.password_reset_tokens.create.signed_id(expires_in: 20.minutes)
+    sid = @user.generate_token_for(:password_reset)
 
     get edit_identity_password_reset_url(sid: sid)
     assert_response :success
   end
 
   test "should send a password reset email" do
-    assert_enqueued_email_with UserMailer, :password_reset, args: { user: @user } do
+    assert_enqueued_email_with UserMailer, :password_reset, params: { user: @user } do
       post identity_password_reset_url, params: { email: @user.email }
     end
 
@@ -46,16 +46,19 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update password" do
-    sid = @user.password_reset_tokens.create.signed_id(expires_in: 20.minutes)
+    sid = @user.generate_token_for(:password_reset)
 
     patch identity_password_reset_url, params: { sid: sid, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
     assert_redirected_to sign_in_url
   end
 
   test "should not update password with expired token" do
-    sid_exp = @user.password_reset_tokens.create.signed_id(expires_in: 0.minutes)
+    sid = @user.generate_token_for(:password_reset)
+
+    travel 30.minutes
+
+    patch identity_password_reset_url, params: { sid: sid, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
 
-    patch identity_password_reset_url, params: { sid: sid_exp, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
     assert_redirected_to new_identity_password_reset_url
     assert_equal "That password reset link is invalid", flash[:alert]
   end

data/lib/generators/authentication/templates/test_unit/controllers/html/passwords_controller_test.rb.tt

@@ -11,14 +11,14 @@ class PasswordsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update password" do
-    patch password_url, params: { current_password: "Secret1*3*5*", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
+    patch password_url, params: { password_challenge: "Secret1*3*5*", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
     assert_redirected_to root_url
   end
 
-  test "should not update password with wrong current password" do
-    patch password_url, params: { current_password: "SecretWrong1*3", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
+  test "should not update password with wrong password challenge" do
+    patch password_url, params: { password_challenge: "SecretWrong1*3", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
 
-    assert_redirected_to edit_password_url
-    assert_equal "The current password you entered is incorrect", flash[:alert]
+    assert_response :unprocessable_entity
+    assert_select "li", /Password challenge is invalid/
   end
 end

data/lib/generators/authentication/templates/test_unit/system/identity/emails_test.rb.tt

@@ -9,7 +9,7 @@ class Identity::EmailsTest < ApplicationSystemTestCase
     click_on "Change email address"
 
     fill_in "New email", with: "new_email@hey.com"
-    fill_in "Current password", with: "Secret1*3*5*"
+    fill_in "Password challenge", with: "Secret1*3*5*"
     click_on "Save changes"
 
     assert_text "Your email has been changed"

data/lib/generators/authentication/templates/test_unit/system/identity/password_resets_test.rb.tt

@@ -3,7 +3,7 @@ require "application_system_test_case"
 class Identity::PasswordResetsTest < ApplicationSystemTestCase
   setup do
     @user = users(:lazaro_nixon)
-    @sid = @user.password_reset_tokens.create.signed_id(expires_in: 20.minutes)
+    @sid = @user.generate_token_for(:password_reset)
   end
 
   test "sending a password reset email" do

data/lib/generators/authentication/templates/test_unit/system/passwords_test.rb.tt

@@ -8,7 +8,7 @@ class PasswordsTest < ApplicationSystemTestCase
   test "updating the password" do
     click_on "Change password"
 
-    fill_in "Current password", with: "Secret1*3*5*"
+    fill_in "Password challenge", with: "Secret1*3*5*"
     fill_in "New password", with: "Secret6*4*2*"
     fill_in "Confirm new password", with: "Secret6*4*2*"
     click_on "Save changes"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authentication-zero
 version: !ruby/object:Gem::Version
-  version: 2.16.36
+  version: 3.0.0
 platform: ruby
 authors:
 - Nixon
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-07-17 00:00:00.000000000 Z
+date: 2023-10-05 00:00:00.000000000 Z
 dependencies: []
 description:
 email:
@@ -98,9 +98,7 @@ files:
 - lib/generators/authentication/templates/lib/account_middleware.rb
 - lib/generators/authentication/templates/mailers/user_mailer.rb.tt
 - lib/generators/authentication/templates/migrations/create_accounts_migration.rb.tt
-- lib/generators/authentication/templates/migrations/create_email_verification_tokens_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_events_migration.rb.tt
-- lib/generators/authentication/templates/migrations/create_password_reset_tokens_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_recovery_codes_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_security_keys_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_sessions_migration.rb.tt
@@ -109,9 +107,7 @@ files:
 - lib/generators/authentication/templates/models/account.rb.tt
 - lib/generators/authentication/templates/models/concerns/account_scoped.rb
 - lib/generators/authentication/templates/models/current.rb.tt
-- lib/generators/authentication/templates/models/email_verification_token.rb.tt
 - lib/generators/authentication/templates/models/event.rb.tt
-- lib/generators/authentication/templates/models/password_reset_token.rb.tt
 - lib/generators/authentication/templates/models/recovery_code.rb.tt
 - lib/generators/authentication/templates/models/security_key.rb.tt
 - lib/generators/authentication/templates/models/session.rb.tt
@@ -160,7 +156,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.10
+rubygems_version: 3.4.19
 signing_key:
 specification_version: 4
 summary: An authentication system generator for Rails applications

data/lib/generators/authentication/templates/migrations/create_email_verification_tokens_migration.rb.tt

@@ -1,7 +0,0 @@
-class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
-  def change
-    create_table :email_verification_tokens do |t|
-      t.references :user, null: false, foreign_key: true
-    end
-  end
-end

data/lib/generators/authentication/templates/migrations/create_password_reset_tokens_migration.rb.tt

@@ -1,7 +0,0 @@
-class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
-  def change
-    create_table :password_reset_tokens do |t|
-      t.references :user, null: false, foreign_key: true
-    end
-  end
-end

data/lib/generators/authentication/templates/models/email_verification_token.rb.tt

@@ -1,3 +0,0 @@
-class EmailVerificationToken < ApplicationRecord
-  belongs_to :user
-end

data/lib/generators/authentication/templates/models/password_reset_token.rb.tt

@@ -1,3 +0,0 @@
-class PasswordResetToken < ApplicationRecord
-  belongs_to :user
-end