authentication-zero 2.16.5 → 2.16.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 02c890d34404e8613c543d9597e31f5a3cd3b7c14ea066f2096d1fbcb57ef372
-  data.tar.gz: 93cb08256ae2817af9ebf3a5f4a4391c6012ee27854a8437a2cba47166521b7c
+  metadata.gz: 2759ec10946a7ca08a682e430a1035c2c6903bcde53cf65b1dd75abeb12e5fd5
+  data.tar.gz: 56097dbc2b99da7c03ffa308a5d69980c63583d0832d7219c77f19a62e6a8671
 SHA512:
-  metadata.gz: 5af869dca3d8bc1b6ff2321687e6e241adb4f278910697b588421722f0cb92346fcb214042ccb7fe1acf510fc66bc35d473edc4d7152054bdcd3f9d52f1def8f
-  data.tar.gz: 360a9e95c2794105966c7b76720a4ac123bcb7558389e27fa3aa87e8b71d995e5fd33e2ee066551f48c82b8c0c9734b9eae1b6a72bafc14486f645e07694544d
+  metadata.gz: 3b8a831fbe073cd0770f28c10f22a265fc2af63d520436c11df99da104f20097fbfaf1379025658729295e61485a400f801e01a2b9d596bd242ceac02995e9fb
+  data.tar.gz: 373df629f7a95f12aa0842063ca87b704f68b4dae5edf3a38d37627f5ea50ee5c54d2380479f9959357e34457cfc7efa6c72cd7919757a4d75801b0061ebc623

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## Authentication Zero 2.16.6 ##
+
+* Remove passwordless from api template
+* Remove sudoable, I want to make things simple for new users,
+  and it will became even simpler with the new rails 7.1 "password challenge api"
+
 ## Authentication Zero 2.16.5 ##
 
 * Revoke all password reset tokens (security enhancement)

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authentication-zero (2.16.5)
+    authentication-zero (2.16.7)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -32,7 +32,6 @@ Since Authentication Zero generates this code into your application instead of b
 - Social Login with OmniAuth (--omniauthable)
 - Verify email using a link with token
 - Verify email using a six random digits code for api (--code-verifiable)
-- Ask password before sensitive data changes, aka: sudo (--sudoable)
 - Reset the user password and send reset instructions
 - Reset the user password only from verified emails
 - Lock mechanism for resetting password and sign-in (--lockable)

data/lib/authentication_zero/version.rb

@@ -1,3 +1,3 @@
 module AuthenticationZero
-  VERSION = "2.16.5"
+  VERSION = "2.16.7"
 end

data/lib/generators/authentication/authentication_generator.rb

@@ -6,7 +6,6 @@ class AuthenticationGenerator < Rails::Generators::Base
   class_option :api,             type: :boolean, desc: "Generates API authentication"
   class_option :pwned,           type: :boolean, desc: "Add pwned password validation"
   class_option :code_verifiable, type: :boolean, desc: "Add email verification using a code for api"
-  class_option :sudoable,        type: :boolean, desc: "Add password request before sensitive data changes"
   class_option :lockable,        type: :boolean, desc: "Add password reset locking"
   class_option :passwordless,    type: :boolean, desc: "Add passwordless sign"
   class_option :omniauthable,    type: :boolean, desc: "Add social login support"
@@ -53,7 +52,7 @@ class AuthenticationGenerator < Rails::Generators::Base
     migration_template "migrations/create_sessions_migration.rb", "#{db_migrate_path}/create_sessions.rb"
     migration_template "migrations/create_email_verification_tokens_migration.rb", "#{db_migrate_path}/create_email_verification_tokens.rb"
     migration_template "migrations/create_password_reset_tokens_migration.rb", "#{db_migrate_path}/create_password_reset_tokens.rb"
-    migration_template "migrations/create_sign_in_tokens_migration.rb", "#{db_migrate_path}/create_sign_in_tokens_migration.rb" if options.passwordless?
+    migration_template "migrations/create_sign_in_tokens_migration.rb", "#{db_migrate_path}/create_sign_in_tokens_migration.rb" if passwordless?
     migration_template "migrations/create_events_migration.rb", "#{db_migrate_path}/create_events.rb" if options.trackable?
   end
 
@@ -62,7 +61,7 @@ class AuthenticationGenerator < Rails::Generators::Base
     template "models/session.rb", "app/models/session.rb"
     template "models/email_verification_token.rb", "app/models/email_verification_token.rb"
     template "models/password_reset_token.rb", "app/models/password_reset_token.rb"
-    template "models/sign_in_token.rb", "app/models/sign_in_token.rb" if options.passwordless?
+    template "models/sign_in_token.rb", "app/models/sign_in_token.rb" if passwordless?
     template "models/current.rb", "app/models/current.rb"
     template "models/event.rb", "app/models/event.rb" if options.trackable?
   end
@@ -80,9 +79,8 @@ class AuthenticationGenerator < Rails::Generators::Base
     template  "controllers/#{format_folder}/passwords_controller.rb", "app/controllers/passwords_controller.rb"
     template  "controllers/#{format_folder}/registrations_controller.rb", "app/controllers/registrations_controller.rb"
     template  "controllers/#{format_folder}/home_controller.rb", "app/controllers/home_controller.rb" unless options.api?
-    template  "controllers/#{format_folder}/sessions/sudos_controller.rb", "app/controllers/sessions/sudos_controller.rb" if options.sudoable?
     template  "controllers/#{format_folder}/sessions/omniauth_controller.rb", "app/controllers/sessions/omniauth_controller.rb" if omniauthable?
-    template  "controllers/#{format_folder}/sessions/passwordlesses_controller.rb", "app/controllers/sessions/passwordlesses_controller.rb" if options.passwordless?
+    template  "controllers/#{format_folder}/sessions/passwordlesses_controller.rb", "app/controllers/sessions/passwordlesses_controller.rb" if passwordless?
     template  "controllers/#{format_folder}/authentications/events_controller.rb", "app/controllers/authentications/events_controller.rb" if options.trackable?
   end
 
@@ -103,8 +101,7 @@ class AuthenticationGenerator < Rails::Generators::Base
       template "erb/sessions/index.html.erb", "app/views/sessions/index.html.erb"
       template "erb/sessions/new.html.erb", "app/views/sessions/new.html.erb"
 
-      directory "erb/sessions/sudos", "app/views/sessions/sudos" if options.sudoable?
-      directory "erb/sessions/passwordlesses", "app/views/sessions/passwordlesses" if options.passwordless?
+      directory "erb/sessions/passwordlesses", "app/views/sessions/passwordlesses" if passwordless?
 
       directory "erb/two_factor_authentication", "app/views/two_factor_authentication" if two_factor?
       directory "erb/authentications/events", "app/views/authentications/events" if options.trackable?
@@ -118,7 +115,7 @@ class AuthenticationGenerator < Rails::Generators::Base
   def add_routes
     route "root 'home#index'" unless options.api?
 
-    if options.passwordless?
+    if passwordless?
       route "resource :passwordless, only: [:new, :edit, :create]", namespace: :sessions
     end
 
@@ -140,7 +137,6 @@ class AuthenticationGenerator < Rails::Generators::Base
     route "resource :password_reset,     only: [:new, :edit, :create, :update]", namespace: :identity
     route "resource :email_verification, only: [:edit, :create]", namespace: :identity
     route "resource :email,              only: [:edit, :update]", namespace: :identity
-    route "resource :sudo, only: [:new, :create]", namespace: :sessions if options.sudoable?
     route "resource  :password, only: [:edit, :update]"
     route "resources :sessions, only: [:index, :show, :destroy]"
     route "post 'sign_up', to: 'registrations#create'"
@@ -166,6 +162,10 @@ class AuthenticationGenerator < Rails::Generators::Base
       options.omniauthable? && !options.api?
     end
 
+    def passwordless?
+      options.passwordless? && !options.api?
+    end
+
     def two_factor?
       options.two_factor? && !options.api?
     end
@@ -175,6 +175,6 @@ class AuthenticationGenerator < Rails::Generators::Base
     end
 
     def redis?
-      options.lockable? || options.sudoable? || code_verifiable?
+      options.lockable? || code_verifiable?
     end
 end

data/lib/generators/authentication/templates/controllers/api/application_controller.rb.tt

@@ -3,13 +3,6 @@ class ApplicationController < ActionController::API
 
   before_action :set_current_request_details
   before_action :authenticate
-  <%- if options.sudoable? %>
-  def require_sudo
-    unless Current.session.sudo?
-      render json: { error: "Enter your password to continue" }, status: :forbidden
-    end
-  end
-  <%- end -%>
   <%- if options.lockable? %>
   def require_lock(wait: 1.hour, attempts: 10)
     counter = Kredis.counter("require_lock:#{request.remote_ip}:#{params[:controller]}:#{params[:action]}", expires_in: wait)

data/lib/generators/authentication/templates/controllers/api/identity/emails_controller.rb.tt

@@ -1,11 +1,10 @@
 class Identity::EmailsController < ApplicationController
-  <%- if options.sudoable? -%>
-  before_action :require_sudo
-  <%- end -%>
   before_action :set_user
 
   def update
-    if @user.update(user_params)
+   if !@user.authenticate(params[:current_password])
+      render json: { error: "The password you entered is incorrect" }, status: :bad_request
+    elsif @user.update(user_params)
       render_show
     else
       render json: @user.errors, status: :unprocessable_entity

data/lib/generators/authentication/templates/controllers/html/application_controller.rb.tt

@@ -1,17 +1,6 @@
 class ApplicationController < ActionController::Base
   before_action :set_current_request_details
   before_action :authenticate
-  <%- if options.sudoable? %>
-  def require_sudo
-    <%- if omniauthable? -%>
-    unless Current.session.sudo? || Current.session.user.provider.present?
-    <%- else -%>
-    unless Current.session.sudo?
-    <%- end -%>
-      redirect_to new_sessions_sudo_path(proceed_to_url: request.url)
-    end
-  end
-  <%- end -%>
   <%- if options.lockable? %>
   def require_lock(wait: 1.hour, attempts: 10)
     counter = Kredis.counter("require_lock:#{request.remote_ip}:#{params[:controller]}:#{params[:action]}", expires_in: wait)

data/lib/generators/authentication/templates/controllers/html/identity/emails_controller.rb.tt

@@ -1,14 +1,13 @@
 class Identity::EmailsController < ApplicationController
-  <%- if options.sudoable? -%>
-  before_action :require_sudo
-  <%- end -%>
   before_action :set_user
 
   def edit
   end
 
   def update
-    if @user.update(user_params)
+   if !@user.authenticate(params[:current_password])
+      redirect_to edit_identity_email_path, alert: "The password you entered is incorrect"
+    elsif @user.update(user_params)
       redirect_to_root
     else
       render :edit, status: :unprocessable_entity

data/lib/generators/authentication/templates/controllers/html/two_factor_authentication/totps_controller.rb.tt

@@ -1,7 +1,4 @@
 class TwoFactorAuthentication::TotpsController < ApplicationController
-  <%- if options.sudoable? -%>
-  before_action :require_sudo
-  <%- end -%>
   before_action :set_user
   before_action :set_totp
 
@@ -10,7 +7,9 @@ class TwoFactorAuthentication::TotpsController < ApplicationController
   end
 
   def create
-    if @totp.verify(params[:code], drift_behind: 15)
+    if !@user.authenticate(params[:current_password])
+      redirect_to two_factor_authentication_totp_path, alert: "The password you entered is incorrect"
+    elsif @totp.verify(params[:code], drift_behind: 15)
       @user.update! otp_secret: params[:secret]
       redirect_to root_path, notice: "2FA is enabled on your account"
     else

data/lib/generators/authentication/templates/erb/identity/emails/edit.html.erb.tt

@@ -23,7 +23,12 @@
 
   <div>
     <%%= form.label :email, "New email", style: "display: block" %>
-    <%%= form.email_field :email %>
+    <%%= form.email_field :email, required: true, autofocus: true %>
+  </div>
+
+  <div>
+    <%%= form.label :current_password, style: "display: block" %>
+    <%%= form.password_field :current_password, required: true, autocomplete: "current-password" %>
   </div>
 
   <div>

data/lib/generators/authentication/templates/erb/identity/password_resets/new.html.erb.tt

@@ -5,7 +5,7 @@
 <%%= form_with(url: identity_password_reset_path) do |form| %>
   <div>
     <%%= form.label :email, style: "display: block" %>
-    <%%= form.email_field :email, autofocus: true, required: true %>
+    <%%= form.email_field :email, required: true, autofocus: true %>
   </div>
 
   <div>

data/lib/generators/authentication/templates/erb/registrations/new.html.erb.tt

@@ -15,7 +15,7 @@
 
   <div>
     <%%= form.label :email, style: "display: block" %>
-    <%%= form.email_field :email, autofocus: true, autocomplete: "email" %>
+    <%%= form.email_field :email, required: true, autofocus: true, autocomplete: "email" %>
   </div>
 
   <div>

data/lib/generators/authentication/templates/erb/sessions/new.html.erb.tt

@@ -6,7 +6,7 @@
 <%%= form_with(url: sign_in_path) do |form| %>
   <div>
     <%%= form.label :email, style: "display: block" %>
-    <%%= form.email_field :email, value: params[:email_hint], autofocus: true, required: true, autocomplete: "email" %>
+    <%%= form.email_field :email, value: params[:email_hint], required: true, autofocus: true, autocomplete: "email" %>
   </div>
 
   <div>
@@ -21,7 +21,7 @@
 
 <br>
 
-<%- if options.passwordless? %>
+<%- if passwordless? %>
 <div>
   <%%= link_to "Sign in without password", new_sessions_passwordless_path %>
 </div>

data/lib/generators/authentication/templates/erb/sessions/passwordlesses/new.html.erb.tt

@@ -5,7 +5,7 @@
 <%%= form_with(url: sessions_passwordless_path) do |form| %>
   <div>
     <%%= form.label :email, style: "display: block" %>
-    <%%= form.email_field :email, autofocus: true, required: true %>
+    <%%= form.email_field :email, required: true, autofocus: true%>
   </div>
 
   <div>

data/lib/generators/authentication/templates/erb/two_factor_authentication/totps/new.html.erb.tt

@@ -19,7 +19,12 @@
 
   <div>
     <%%= form.label :code, "After scanning with your camera, the app will generate a six-digit code. Enter it here:", style: "display: block" %>
-    <%%= form.text_field :code, autofocus: true, required: true, autocomplete: :off %>
+    <%%= form.text_field :code, required: true, autofocus: true, autocomplete: :off %>
+  </div>
+
+  <div>
+    <%%= form.label :current_password, style: "display: block" %>
+    <%%= form.password_field :current_password, required: true, autocomplete: "current-password" %>
   </div>
 
   <div>

data/lib/generators/authentication/templates/mailers/user_mailer.rb.tt

@@ -16,7 +16,7 @@ class UserMailer < ApplicationMailer
 
     mail to: @user.email, subject: "Verify your email"
   end
-  <%- if options.passwordless? %>
+  <%- if passwordless? %>
   def passwordless
     @user = params[:user]
     @signed_id = @user.sign_in_tokens.create.signed_id(expires_in: 1.day)

data/lib/generators/authentication/templates/models/session.rb.tt

@@ -1,18 +1,10 @@
 class Session < ApplicationRecord
   belongs_to :user
-  <%- if options.sudoable? %>
-  kredis_flag :sudo, expires_in: 30.minutes
-  <%- end -%>
 
   before_create do
     self.user_agent = Current.user_agent
     self.ip_address = Current.ip_address
   end
-  <%- if options.sudoable? %>
-  after_create_commit do
-    self.sudo.mark
-  end
-  <%- end -%>
 
   after_create_commit do
     SessionMailer.with(session: self).signed_in_notification.deliver_later

data/lib/generators/authentication/templates/models/user.rb.tt

@@ -3,7 +3,7 @@ class User < ApplicationRecord
 
   has_many :email_verification_tokens, dependent: :destroy
   has_many :password_reset_tokens, dependent: :destroy
-  <%- if options.passwordless? -%>
+  <%- if passwordless? -%>
   has_many :sign_in_tokens, dependent: :destroy
   <%- end -%>
 

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/emails_controller_test.rb.tt

@@ -10,7 +10,14 @@ class Identity::EmailsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update email" do
-    patch identity_email_url, params: { email: "new_email@hey.com" }, headers: default_headers
+    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "Secret1*3*5*" }, headers: default_headers
     assert_response :success
   end
+
+  test "should not update email with wrong current password" do
+    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "SecretWrong1*3" }, headers: default_headers
+
+    assert_response :bad_request
+    assert_equal "The password you entered is incorrect", response.parsed_body["error"]
+  end
 end

data/lib/generators/authentication/templates/test_unit/controllers/html/identity/emails_controller_test.rb.tt

@@ -11,7 +11,14 @@ class Identity::EmailsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update email" do
-    patch identity_email_url, params: { email: "new_email@hey.com" }
+    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "Secret1*3*5*" }
     assert_redirected_to root_url
   end
+
+  test "should not update email with wrong current password" do
+    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "SecretWrong1*3" }
+
+    assert_redirected_to edit_identity_email_url
+    assert_equal "The password you entered is incorrect", flash[:alert]
+  end
 end

data/lib/generators/authentication/templates/test_unit/controllers/html/identity/password_resets_controller_test.rb.tt

@@ -55,7 +55,7 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   test "should not update password with expired token" do
     sid_exp = @user.password_reset_tokens.create.signed_id(expires_in: 0.minutes)
 
-    patch identity_password_reset_url, params: { sid: @sid_exp, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
+    patch identity_password_reset_url, params: { sid: sid_exp, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
     assert_redirected_to new_identity_password_reset_url
     assert_equal "That password reset link is invalid", flash[:alert]
   end

data/lib/generators/authentication/templates/test_unit/system/identity/emails_test.rb.tt

@@ -9,6 +9,7 @@ class Identity::EmailsTest < ApplicationSystemTestCase
     click_on "Change email address"
 
     fill_in "New email", with: "new_email@hey.com"
+    fill_in "Current password", with: "Secret1*3*5*"
     click_on "Save changes"
 
     assert_text "Your email has been changed"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authentication-zero
 version: !ruby/object:Gem::Version
-  version: 2.16.5
+  version: 2.16.7
 platform: ruby
 authors:
 - Nixon
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-02-13 00:00:00.000000000 Z
+date: 2023-02-15 00:00:00.000000000 Z
 dependencies: []
 description:
 email:
@@ -44,8 +44,6 @@ files:
 - lib/generators/authentication/templates/controllers/api/identity/password_resets_controller.rb.tt
 - lib/generators/authentication/templates/controllers/api/passwords_controller.rb.tt
 - lib/generators/authentication/templates/controllers/api/registrations_controller.rb.tt
-- lib/generators/authentication/templates/controllers/api/sessions/passwordlesses_controller.rb.tt
-- lib/generators/authentication/templates/controllers/api/sessions/sudos_controller.rb.tt
 - lib/generators/authentication/templates/controllers/api/sessions_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/application_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/authentications/events_controller.rb.tt
@@ -57,7 +55,6 @@ files:
 - lib/generators/authentication/templates/controllers/html/registrations_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/sessions/omniauth_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/sessions/passwordlesses_controller.rb.tt
-- lib/generators/authentication/templates/controllers/html/sessions/sudos_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/sessions_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/two_factor_authentication/challenges_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/two_factor_authentication/totps_controller.rb.tt
@@ -72,7 +69,6 @@ files:
 - lib/generators/authentication/templates/erb/sessions/index.html.erb.tt
 - lib/generators/authentication/templates/erb/sessions/new.html.erb.tt
 - lib/generators/authentication/templates/erb/sessions/passwordlesses/new.html.erb.tt
-- lib/generators/authentication/templates/erb/sessions/sudos/new.html.erb.tt
 - lib/generators/authentication/templates/erb/two_factor_authentication/challenges/new.html.erb.tt
 - lib/generators/authentication/templates/erb/two_factor_authentication/totps/new.html.erb.tt
 - lib/generators/authentication/templates/erb/user_mailer/email_verification.html.erb.tt

data/lib/generators/authentication/templates/controllers/api/sessions/passwordlesses_controller.rb.tt

@@ -1,34 +0,0 @@
-class Sessions::PasswordlessesController < ApplicationController
-  skip_before_action :authenticate
-
-  <%- if options.lockable? -%>
-  before_action :require_lock, only: :create
-  <%- end -%>
-  before_action :set_user, only: :edit
-
-  def edit
-    @session = @user.sessions.create!
-    response.set_header "X-Session-Token", @session.signed_id
-
-    revoke_tokens; render(json: @session, status: :created)
-  end
-
-  def create
-    if @user = User.find_by(email: params[:email], verified: true)
-      UserMailer.with(user: @user).passwordless.deliver_later
-    else
-      render json: { error: "You can't sign in until you verify your email" }, status: :bad_request
-    end
-  end
-
-  private
-    def set_user
-      @token = SignInToken.find_signed!(params[:sid]); @user = @token.user
-    rescue
-      render json: { error: "That sign in link is invalid" }, status: :bad_request
-    end
-
-    def revoke_tokens
-      @user.sign_in_tokens.delete_all
-    end
-end

data/lib/generators/authentication/templates/controllers/api/sessions/sudos_controller.rb.tt

@@ -1,11 +0,0 @@
-class Sessions::SudosController < ApplicationController
-  def create
-    session = Current.session
-
-    if session.user.authenticate(params[:password])
-      session.sudo.mark
-    else
-      render json: { error: "The password you entered is incorrect" }, status: :bad_request
-    end
-  end
-end

data/lib/generators/authentication/templates/controllers/html/sessions/sudos_controller.rb.tt

@@ -1,14 +0,0 @@
-class Sessions::SudosController < ApplicationController
-  def new
-  end
-
-  def create
-    session = Current.session
-
-    if session.user.authenticate(params[:password])
-      session.sudo.mark; redirect_to(params[:proceed_to_url])
-    else
-      redirect_to new_sessions_sudo_path(proceed_to_url: params[:proceed_to_url]), alert: "The password you entered is incorrect"
-    end
-  end
-end

data/lib/generators/authentication/templates/erb/sessions/sudos/new.html.erb.tt

@@ -1,28 +0,0 @@
-<p style="color: red"><%%= alert %></p>
-
-<h1>Enter your password to continue</h1>
-
-<%%= form_with(url: sessions_sudo_path) do |form| %>
-
-  <%%= form.hidden_field :proceed_to_url, value: params[:proceed_to_url] %>
-
-  <div>
-    <%%= form.password_field :password, required: true, autofocus: true, autocomplete: "current-password" %>
-  </div>
-
-  <div>
-    <%%= form.submit "Continue" %>
-  </div>
-<%% end %>
-
-<br>
-
-<p>
-  <strong>Why are you asking me to do this?</strong><br>
-  To better protect your account, we'll occasionally ask you to confirm your password before performing sensitive actions.
-</p>
-
-<p>
-  <strong>Forgot your password?</strong><br>
-  We'll help you <%%= link_to "reset it", new_identity_password_reset_path %> so you can continue.
-</p>