authentication-zero 4.0.1 → 4.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 84ff6a85acc17f4561f1362e2e7fa15ad27c434cee6191f57dd7623f49b506ff
-  data.tar.gz: 75fef66fa0926ba2c2a797db8a7d85cb58cdbf90891f0cb50e3cb318873fff10
+  metadata.gz: a20860b4e4e996ed12ee1f8627c322cee71785051bb58569e8d3694bd8d46860
+  data.tar.gz: da8ceac9a2cd8d53028b446fd988b9604bbc6a72ab8f89dfe4cc0442cd0facd7
 SHA512:
-  metadata.gz: b80db262196da2d9107246f47949c88a73110f58298a9d29eb6c94eba2b8e255a9206f09539b3bad6702156e96fbfd1960ae789530d595e303858b36f92364b8
-  data.tar.gz: c234410b5f2458a41be599d2529b377ed62436ff071eb87bc8bb49479d06d7382ac835ff7e82be7caf9f4b173ea45007362fc1836cedc27cc836e82f6cc71c4b
+  metadata.gz: 03ba76dae5a7ae6862a45525d43bcbf1ca566b5e5bd1738a743f52a62d5af8c31838381e183d3eb2fd2776a7f909430c6a57746999c9bd4f4ead57bd67ccf6a1
+  data.tar.gz: 1d8aad9fc172635ba87cc4f154a25a1da38470967cd8a8e82f344318bf54e95e5a759f0956b38a48092d08ae29d6a626750d6076c45f40f84d96918db5c54f75

data/CHANGELOG.md

@@ -1,5 +1,19 @@
 ## New version
 
+## Authentication Zero 4.0.3 ##
+
+* We don't need to add `config.action_mailer.default_url_options` anymore
+* Make gem add bcrypt more resilient
+
+## Authentication Zero 4.0.2 ##
+
+* Remove dependency on redis / kredis for sudoable
+* Fix --webauthn option. (add @github/webauthn-json)
+* Update application_controller to rails 8
+* Remove --ratelimit option
+
+## Authentication Zero 4.0.1 ##
+
 * Remove rate limit from api generator
 
 ## Authentication Zero 4.0.0 ##

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authentication-zero (4.0.1)
+    authentication-zero (4.0.3)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -46,7 +46,6 @@ Since Authentication Zero generates this code into your application instead of b
 - Reset the user password and send reset instructions
 - Reset the user password only from verified emails
 - Lock mechanism to prevent email bombing (--lockable)
-- Rate limiting for your app, 1000 reqs/minute (--ratelimit)
 - Send e-mail confirmation when your email has been changed
 - Manage multiple sessions & devices
 - Activity log (--trackable)

data/lib/authentication_zero/version.rb

@@ -1,3 +1,3 @@
 module AuthenticationZero
-  VERSION = "4.0.1"
+  VERSION = "4.0.3"
 end

data/lib/generators/authentication/authentication_generator.rb

@@ -7,7 +7,6 @@ class AuthenticationGenerator < Rails::Generators::Base
   class_option :pwned,         type: :boolean, desc: "Add pwned password validation"
   class_option :sudoable,      type: :boolean, desc: "Add password request before sensitive data changes"
   class_option :lockable,      type: :boolean, desc: "Add password reset locking"
-  class_option :ratelimit,     type: :boolean, desc: "Add request rate limiting"
   class_option :passwordless,  type: :boolean, desc: "Add passwordless sign in"
   class_option :omniauthable,  type: :boolean, desc: "Add social login support"
   class_option :trackable,     type: :boolean, desc: "Add activity log support"
@@ -20,15 +19,10 @@ class AuthenticationGenerator < Rails::Generators::Base
   source_root File.expand_path("templates", __dir__)
 
   def add_gems
-    gem "bcrypt", "~> 3.1.7", comment: "Use Active Model has_secure_password [https://guides.rubyonrails.org/active_model_basics.html#securepassword]"
-
-    if options.ratelimit?
-      gem "rack-ratelimit", group: :production, comment: "Use Rack::Ratelimit to rate limit requests [https://github.com/jeremy/rack-ratelimit]"
-    end
-
-    if redis?
-      gem "redis", "~> 4.0", comment: "Use Redis adapter to run additional authentication features"
-      gem "kredis", comment: "Use Kredis to get higher-level data types in Redis [https://github.com/rails/kredis]"
+    if bcrypt_present?
+      uncomment_lines "Gemfile", /gem "bcrypt"/
+    else
+      gem "bcrypt", "~> 3.1.7", comment: "Use Active Model has_secure_password [https://guides.rubyonrails.org/active_model_basics.html#securepassword]"
     end
 
     if options.pwned?
@@ -50,14 +44,7 @@ class AuthenticationGenerator < Rails::Generators::Base
     end
   end
 
-  def add_environment_configurations
-    application "config.action_mailer.default_url_options = { host: \"localhost\", port: 3000 }", env: "development"
-    application "config.action_mailer.default_url_options = { host: \"localhost\", port: 3000 }", env: "test"
-    environment ratelimit_block, env: "production" if options.ratelimit?
-  end
-
   def create_configuration_files
-    copy_file "config/redis/shared.yml" if redis?
     copy_file "config/initializers/omniauth.rb" if omniauthable?
     copy_file "config/initializers/webauthn.rb" if webauthn?
   end
@@ -124,8 +111,8 @@ class AuthenticationGenerator < Rails::Generators::Base
   def install_javascript
     return unless webauthn?
     copy_file "javascript/controllers/web_authn_controller.js", "app/javascript/controllers/web_authn_controller.js"
-    run "bin/importmap pin @rails/request.js" if importmaps?
-    run "yarn add @rails/request.js" if node?
+    run "bin/importmap pin @rails/request.js @github/webauthn-json" if importmaps?
+    run "yarn add @rails/request.js @github/webauthn-json" if node?
   end
 
   def create_views
@@ -258,8 +245,8 @@ class AuthenticationGenerator < Rails::Generators::Base
       options.sudoable? && !options.api?
     end
 
-    def redis?
-      options.ratelimit? || sudoable?
+    def bcrypt_present?
+      File.read("Gemfile").include?('gem "bcrypt"')
     end
 
     def importmaps?
@@ -269,11 +256,4 @@ class AuthenticationGenerator < Rails::Generators::Base
     def node?
       Rails.root.join("package.json").exist?
     end
-
-    def ratelimit_block
-      <<~CODE
-        # Rate limit general requests by IP address in a rate of 1000 requests per minute
-        config.middleware.use(Rack::Ratelimit, name: "General", rate: [1000, 1.minute], redis: Redis.new, logger: Rails.logger) { |env| ActionDispatch::Request.new(env).ip }
-      CODE
-    end
 end

data/lib/generators/authentication/templates/controllers/html/application_controller.rb.tt

@@ -1,4 +1,7 @@
 class ApplicationController < ActionController::Base
+  # Only allow modern browsers supporting webp images, web push, badges, import maps, CSS nesting, and CSS :has.
+  allow_browser versions: :modern
+
   before_action :set_current_request_details
   before_action :authenticate
 

data/lib/generators/authentication/templates/controllers/html/sessions/sudos_controller.rb.tt

@@ -6,7 +6,7 @@ class Sessions::SudosController < ApplicationController
     session_record = Current.session
 
     if session_record.user.authenticate(params[:password])
-      session_record.sudo.mark; redirect_to(params[:proceed_to_url])
+      session_record.touch(:sudo_at); redirect_to(params[:proceed_to_url])
     else
       redirect_to new_sessions_sudo_path(proceed_to_url: params[:proceed_to_url]), alert: "The password you entered is incorrect"
     end

data/lib/generators/authentication/templates/migrations/create_sessions_migration.rb.tt

@@ -4,6 +4,9 @@ class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Mi
       t.references :user, null: false, foreign_key: true
       t.string :user_agent
       t.string :ip_address
+      <%- if sudoable? %>
+      t.datetime :sudo_at, null: false
+      <%- end -%>
 
       t.timestamps
     end

data/lib/generators/authentication/templates/models/session.rb.tt

@@ -1,18 +1,21 @@
 class Session < ApplicationRecord
   belongs_to :user
-  <%- if sudoable? %>
-  kredis_flag :sudo, expires_in: 30.minutes
-  <%- end -%>
 
   before_create do
     self.user_agent = Current.user_agent
     self.ip_address = Current.ip_address
+    <%- if sudoable? %>
+    self.sudo_at = Time.current
+    <%- end -%>
   end
-  <%- if sudoable? %>
-  after_create { sudo.mark }
-  <%- end -%>
   <%- if options.trackable? %>
   after_create  { user.events.create! action: "signed_in" }
   after_destroy { user.events.create! action: "signed_out" }
   <%- end -%>
+  <%- if sudoable? %>
+
+  def sudo?
+    sudo_at > 30.minutes.ago
+  end
+  <%- end -%>
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authentication-zero
 version: !ruby/object:Gem::Version
-  version: 4.0.1
+  version: 4.0.3
 platform: ruby
 authors:
 - Nixon
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-10-08 00:00:00.000000000 Z
+date: 2024-10-26 00:00:00.000000000 Z
 dependencies: []
 description:
 email:
@@ -37,7 +37,6 @@ files:
 - lib/generators/authentication/authentication_generator.rb
 - lib/generators/authentication/templates/config/initializers/omniauth.rb
 - lib/generators/authentication/templates/config/initializers/webauthn.rb
-- lib/generators/authentication/templates/config/redis/shared.yml
 - lib/generators/authentication/templates/controllers/api/application_controller.rb.tt
 - lib/generators/authentication/templates/controllers/api/authentications/events_controller.rb.tt
 - lib/generators/authentication/templates/controllers/api/identity/email_verifications_controller.rb.tt

data/lib/generators/authentication/templates/config/redis/shared.yml

@@ -1,10 +0,0 @@
-production: &production
-  url: <%= ENV.fetch("REDIS_URL", "redis://127.0.0.1:6379/0") %>
-  timeout: 1
-
-development: &development
-  url: <%= ENV.fetch("REDIS_URL", "redis://127.0.0.1:6379/0") %>
-  timeout: 1
-
-test:
-  <<: *development