authentication-zero 4.0.0 → 4.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 10cffeda250c03651c8f0d1f60ae0c726fe9884c4ac40b62de7a7deceb27374c
-  data.tar.gz: 1b3421b4b3053fd76db8500d332e8ee0db4478bb8bf547988192ba646b1a8534
+  metadata.gz: a27f54fb7d0351d835f355c5018136265f190a0b55929aa5e9a1ef4572dda2db
+  data.tar.gz: 61003cd5539e38851b2de9125cfdc5e94ae73366eb9a0b66514a9fbd8e67a43d
 SHA512:
-  metadata.gz: 7f8c89fb438dfc43fd47416f5320b4a98e14617896e30e3e0060245f71e2f0e356b1b8d9f709b2c0c930a9cffc8a20e9eff168ffe48cf74c288a3ce191e5a1d6
-  data.tar.gz: 37f2810abcec42035ece7447836eb966a5de77359ef907bdbd336d6918d4ef2b4ca2330e80824084ec4941a250a55f31f21863f23d21fa9e89503b5b3f5fc94f
+  metadata.gz: 6744a2f7059c69e90aefbc6053738f11a44379c37ee443ecb2ebbd4be139615399eef151bf97d9588fa940b516726c8f001b3fcb81eb6458d1a10e1141ee42b3
+  data.tar.gz: 5ac18f8698a62505bb9fe8edf8298e077e2cc8a8b2031f285e71e4c8dc5d745bc6545125228dbbed8debe7a98b871485dba9ab98a80f554c29b1b32c46c9874a

data/.github/workflows/CI.yml

@@ -22,7 +22,7 @@ jobs:
           bundler-cache: true
 
       - name: Install the latest Rails gem
-        run: gem install rails -v "7.1.0"
+        run: gem install rails -v "7.2.1"
 
       - name: Install Rubocop
         run: gem install rubocop rubocop-performance rubocop-minitest rubocop-packaging rubocop-minitest rubocop-rails
@@ -65,7 +65,7 @@ jobs:
           bundler-cache: true
 
       - name: Install the latest Rails gem
-        run: gem install rails -v "7.1.0"
+        run: gem install rails -v "7.2.1"
 
       - name: Install Rubocop
         run: gem install rubocop rubocop-performance rubocop-minitest rubocop-packaging rubocop-minitest rubocop-rails

data/CHANGELOG.md

@@ -1,3 +1,14 @@
+## New version
+
+* Remove dependency on redis / kredis for sudoable
+* Fix --webauthn option. (add @github/webauthn-json)
+* Update application_controller to rails 8
+* Remove --ratelimit option
+
+## Authentication Zero 4.0.1 ##
+
+* Remove rate limit from api generator
+
 ## Authentication Zero 4.0.0 ##
 
 * Remove system tests

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authentication-zero (4.0.0)
+    authentication-zero (4.0.2)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -8,7 +8,7 @@ The purpose of authentication zero is to generate a pre-built authentication sys
 $ bundle add authentication-zero
 ```
 
-If you are using Rails < 8, you must use version 3.
+If you are using Rails < 7.2, you must use version 3.
 
 ```
 $ bundle add authentication-zero --version "~> 3"
@@ -46,7 +46,6 @@ Since Authentication Zero generates this code into your application instead of b
 - Reset the user password and send reset instructions
 - Reset the user password only from verified emails
 - Lock mechanism to prevent email bombing (--lockable)
-- Rate limiting for your app, 1000 reqs/minute (--ratelimit)
 - Send e-mail confirmation when your email has been changed
 - Manage multiple sessions & devices
 - Activity log (--trackable)

data/lib/authentication_zero/version.rb

@@ -1,3 +1,3 @@
 module AuthenticationZero
-  VERSION = "4.0.0"
+  VERSION = "4.0.2"
 end

data/lib/generators/authentication/authentication_generator.rb

@@ -7,8 +7,7 @@ class AuthenticationGenerator < Rails::Generators::Base
   class_option :pwned,         type: :boolean, desc: "Add pwned password validation"
   class_option :sudoable,      type: :boolean, desc: "Add password request before sensitive data changes"
   class_option :lockable,      type: :boolean, desc: "Add password reset locking"
-  class_option :ratelimit,     type: :boolean, desc: "Add request rate limiting"
-  class_option :passwordless,  type: :boolean, desc: "Add passwordless sign"
+  class_option :passwordless,  type: :boolean, desc: "Add passwordless sign in"
   class_option :omniauthable,  type: :boolean, desc: "Add social login support"
   class_option :trackable,     type: :boolean, desc: "Add activity log support"
   class_option :two_factor,    type: :boolean, desc: "Add two factor authentication"
@@ -22,15 +21,6 @@ class AuthenticationGenerator < Rails::Generators::Base
   def add_gems
     gem "bcrypt", "~> 3.1.7", comment: "Use Active Model has_secure_password [https://guides.rubyonrails.org/active_model_basics.html#securepassword]"
 
-    if options.ratelimit?
-      gem "rack-ratelimit", group: :production, comment: "Use Rack::Ratelimit to rate limit requests [https://github.com/jeremy/rack-ratelimit]"
-    end
-
-    if redis?
-      gem "redis", "~> 4.0", comment: "Use Redis adapter to run additional authentication features"
-      gem "kredis", comment: "Use Kredis to get higher-level data types in Redis [https://github.com/rails/kredis]"
-    end
-
     if options.pwned?
       gem "pwned", comment: "Use Pwned to check if a password has been found in any of the huge data breaches [https://github.com/philnash/pwned]"
     end
@@ -53,11 +43,9 @@ class AuthenticationGenerator < Rails::Generators::Base
   def add_environment_configurations
     application "config.action_mailer.default_url_options = { host: \"localhost\", port: 3000 }", env: "development"
     application "config.action_mailer.default_url_options = { host: \"localhost\", port: 3000 }", env: "test"
-    environment ratelimit_block, env: "production" if options.ratelimit?
   end
 
   def create_configuration_files
-    copy_file "config/redis/shared.yml" if redis?
     copy_file "config/initializers/omniauth.rb" if omniauthable?
     copy_file "config/initializers/webauthn.rb" if webauthn?
   end
@@ -124,8 +112,8 @@ class AuthenticationGenerator < Rails::Generators::Base
   def install_javascript
     return unless webauthn?
     copy_file "javascript/controllers/web_authn_controller.js", "app/javascript/controllers/web_authn_controller.js"
-    run "bin/importmap pin @rails/request.js" if importmaps?
-    run "yarn add @rails/request.js" if node?
+    run "bin/importmap pin @rails/request.js @github/webauthn-json" if importmaps?
+    run "yarn add @rails/request.js @github/webauthn-json" if node?
   end
 
   def create_views
@@ -258,10 +246,6 @@ class AuthenticationGenerator < Rails::Generators::Base
       options.sudoable? && !options.api?
     end
 
-    def redis?
-      options.ratelimit? || sudoable?
-    end
-
     def importmaps?
       Rails.root.join("config/importmap.rb").exist?
     end
@@ -269,11 +253,4 @@ class AuthenticationGenerator < Rails::Generators::Base
     def node?
       Rails.root.join("package.json").exist?
     end
-
-    def ratelimit_block
-      <<~CODE
-        # Rate limit general requests by IP address in a rate of 1000 requests per minute
-        config.middleware.use(Rack::Ratelimit, name: "General", rate: [1000, 1.minute], redis: Redis.new, logger: Rails.logger) { |env| ActionDispatch::Request.new(env).ip }
-      CODE
-    end
 end

data/lib/generators/authentication/templates/controllers/api/identity/password_resets_controller.rb.tt

@@ -1,9 +1,6 @@
 class Identity::PasswordResetsController < ApplicationController
   skip_before_action :authenticate
 
-  <%- if options.lockable? -%>
-  rate_limit to: 10, within: 1.hour, only: :create
-  <%- end -%>
   before_action :set_user, only: :update
 
   def edit

data/lib/generators/authentication/templates/controllers/html/application_controller.rb.tt

@@ -1,4 +1,7 @@
 class ApplicationController < ActionController::Base
+  # Only allow modern browsers supporting webp images, web push, badges, import maps, CSS nesting, and CSS :has.
+  allow_browser versions: :modern
+
   before_action :set_current_request_details
   before_action :authenticate
 

data/lib/generators/authentication/templates/controllers/html/sessions/sudos_controller.rb.tt

@@ -6,7 +6,7 @@ class Sessions::SudosController < ApplicationController
     session_record = Current.session
 
     if session_record.user.authenticate(params[:password])
-      session_record.sudo.mark; redirect_to(params[:proceed_to_url])
+      session_record.touch(:sudo_at); redirect_to(params[:proceed_to_url])
     else
       redirect_to new_sessions_sudo_path(proceed_to_url: params[:proceed_to_url]), alert: "The password you entered is incorrect"
     end

data/lib/generators/authentication/templates/migrations/create_sessions_migration.rb.tt

@@ -4,6 +4,9 @@ class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Mi
       t.references :user, null: false, foreign_key: true
       t.string :user_agent
       t.string :ip_address
+      <%- if sudoable? %>
+      t.datetime :sudo_at, null: false
+      <%- end -%>
 
       t.timestamps
     end

data/lib/generators/authentication/templates/models/session.rb.tt

@@ -1,18 +1,21 @@
 class Session < ApplicationRecord
   belongs_to :user
-  <%- if sudoable? %>
-  kredis_flag :sudo, expires_in: 30.minutes
-  <%- end -%>
 
   before_create do
     self.user_agent = Current.user_agent
     self.ip_address = Current.ip_address
+    <%- if sudoable? %>
+    self.sudo_at = Time.current
+    <%- end -%>
   end
-  <%- if sudoable? %>
-  after_create { sudo.mark }
-  <%- end -%>
   <%- if options.trackable? %>
   after_create  { user.events.create! action: "signed_in" }
   after_destroy { user.events.create! action: "signed_out" }
   <%- end -%>
+  <%- if sudoable? %>
+
+  def sudo?
+    sudo_at > 30.minutes.ago
+  end
+  <%- end -%>
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authentication-zero
 version: !ruby/object:Gem::Version
-  version: 4.0.0
+  version: 4.0.2
 platform: ruby
 authors:
 - Nixon
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-10-08 00:00:00.000000000 Z
+date: 2024-10-26 00:00:00.000000000 Z
 dependencies: []
 description:
 email:
@@ -37,7 +37,6 @@ files:
 - lib/generators/authentication/authentication_generator.rb
 - lib/generators/authentication/templates/config/initializers/omniauth.rb
 - lib/generators/authentication/templates/config/initializers/webauthn.rb
-- lib/generators/authentication/templates/config/redis/shared.yml
 - lib/generators/authentication/templates/controllers/api/application_controller.rb.tt
 - lib/generators/authentication/templates/controllers/api/authentications/events_controller.rb.tt
 - lib/generators/authentication/templates/controllers/api/identity/email_verifications_controller.rb.tt

data/lib/generators/authentication/templates/config/redis/shared.yml

@@ -1,10 +0,0 @@
-production: &production
-  url: <%= ENV.fetch("REDIS_URL", "redis://127.0.0.1:6379/0") %>
-  timeout: 1
-
-development: &development
-  url: <%= ENV.fetch("REDIS_URL", "redis://127.0.0.1:6379/0") %>
-  timeout: 1
-
-test:
-  <<: *development