authentication-zero 2.16.36 → 3.0.0.alpha1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 01c6ab07811e6c670432fb66c4ceb3580c69cb45c438e18a947b231d86041b35
-  data.tar.gz: de1d633031898842969cebc414d84c543e7efcf7675b65e2b552e5ec2c318bf3
+  metadata.gz: a1c102d5a72628c6d1ffbe5d5e7724b5e0ffdfe52259754d4f39c09bd900622a
+  data.tar.gz: 679af3cd9f3120b50a46abb4e460eac87612116f21bb182456c76de3010a8e5f
 SHA512:
-  metadata.gz: 1b1eacc6b8b9551a63d8bce3a49780f12dfa999901169e51370c34a4e272bccf885e00a5dcd69e9c163a216729fa1f1f8673ec6969613b2f4c444cbdfbd381ea
-  data.tar.gz: 82084da636d5b44ed85ee1c2c9c928ffe40549ecf742a93206f9d804a0bc6d4c4e63dc414fb558d4a551e7e73fc76ae96159ec45eb3cfde98d143dd4b1920aa9
+  metadata.gz: 778ea21bb5f23e80f16a773cd095146737eb646d5688fe238a4eb6604b234230c092ecf85af31c6e15dbddb3934d936a582307651a4e6737280fbaa03715247b
+  data.tar.gz: 9e42dcc5bd6ff6dbc4731326f3c25555e90c26c37e683e1666b0de862276615ef0235e4dc03991ce66e94a95460bcdaff315d0293dbd82eaf5eb04c8e5dbb48b

data/.github/workflows/CI.yml

@@ -31,7 +31,7 @@ jobs:
 
       - name: Create fresh Rails app and run generator
         run: |
-          rails new test-app
+          rails new test-app --main
           cp .rubocop.yml test-app/.rubocop.yml
           cd test-app
           bundle add authentication-zero --path ..
@@ -74,7 +74,7 @@ jobs:
 
       - name: Create fresh Rails app and run generator
         run: |
-          rails new test-app
+          rails new test-app --main
           cp .rubocop.yml test-app/.rubocop.yml
           cd test-app
           bundle add authentication-zero --path ..
@@ -90,4 +90,3 @@ jobs:
 
       - name: Tests
         run: cd test-app && bin/rails test
-

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+## Authentication Zero 3.0.0 ##
+
+* Use the new normalizes API
+* Use the new password_challenge API
+* Use the new authenticate_by API
+* Use the new generates_token_for API
+
 ## Authentication Zero 2.16.35 ##
 
 * Adjust relationship so that account has many users

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authentication-zero (2.16.36)
+    authentication-zero (3.0.0.alpha1)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -5,7 +5,7 @@ The purpose of authentication zero is to generate a pre-built authentication sys
 ## Installation
 
 ```
-$ bundle add authentication-zero
+$ bundle add authentication-zero --version=3.0.0.alpha1
 ```
 
 ## Usage

data/lib/authentication_zero/version.rb

@@ -1,3 +1,3 @@
 module AuthenticationZero
-  VERSION = "2.16.36"
+  VERSION = "3.0.0.alpha1"
 end

data/lib/generators/authentication/authentication_generator.rb

@@ -70,8 +70,6 @@ class AuthenticationGenerator < Rails::Generators::Base
     migration_template "migrations/create_accounts_migration.rb", "#{db_migrate_path}/create_accounts_migration.rb" if options.tenantable?
     migration_template "migrations/create_users_migration.rb", "#{db_migrate_path}/create_users.rb"
     migration_template "migrations/create_sessions_migration.rb", "#{db_migrate_path}/create_sessions.rb"
-    migration_template "migrations/create_password_reset_tokens_migration.rb", "#{db_migrate_path}/create_password_reset_tokens.rb"
-    migration_template "migrations/create_email_verification_tokens_migration.rb", "#{db_migrate_path}/create_email_verification_tokens.rb"
     migration_template "migrations/create_events_migration.rb", "#{db_migrate_path}/create_events.rb" if options.trackable?
     migration_template "migrations/create_recovery_codes_migration.rb", "#{db_migrate_path}/create_recovery_codes.rb" if two_factor?
     migration_template "migrations/create_security_keys_migration.rb", "#{db_migrate_path}/create_security_keys.rb" if webauthn?
@@ -83,9 +81,7 @@ class AuthenticationGenerator < Rails::Generators::Base
 
     template "models/account.rb", "app/models/account.rb" if options.tenantable?
     template "models/current.rb", "app/models/current.rb"
-    template "models/email_verification_token.rb", "app/models/email_verification_token.rb"
     template "models/event.rb", "app/models/event.rb" if options.trackable?
-    template "models/password_reset_token.rb", "app/models/password_reset_token.rb"
     template "models/recovery_code.rb", "app/models/recovery_code.rb" if two_factor?
     template "models/security_key.rb", "app/models/security_key.rb" if webauthn?
     template "models/session.rb", "app/models/session.rb"

data/lib/generators/authentication/templates/controllers/api/identity/email_verifications_controller.rb.tt

@@ -13,7 +13,7 @@ class Identity::EmailVerificationsController < ApplicationController
 
   private
     def set_user
-      token = EmailVerificationToken.find_signed!(params[:sid]); @user = token.user
+      @user = User.find_by_token_for!(:email_verification, params[:sid])
     rescue StandardError
       render json: { error: "That email verification link is invalid" }, status: :bad_request
     end

data/lib/generators/authentication/templates/controllers/api/identity/emails_controller.rb.tt

@@ -2,9 +2,7 @@ class Identity::EmailsController < ApplicationController
   before_action :set_user
 
   def update
-    if !@user.authenticate(params[:current_password])
-      render json: { error: "The password you entered is incorrect" }, status: :bad_request
-    elsif @user.update(email: params[:email])
+    if @user.update(user_params)
       render_show
     else
       render json: @user.errors, status: :unprocessable_entity
@@ -16,6 +14,10 @@ class Identity::EmailsController < ApplicationController
       @user = Current.user
     end
 
+    def user_params
+      params.permit(:email, :password_challenge).with_defaults(password_challenge: "")
+    end
+
     def render_show
       if @user.email_previously_changed?
         resend_email_verification; render(json: @user)

data/lib/generators/authentication/templates/controllers/api/identity/password_resets_controller.rb.tt

@@ -20,7 +20,7 @@ class Identity::PasswordResetsController < ApplicationController
 
   def update
     if @user.update(user_params)
-      revoke_tokens; render(json: @user)
+      render json: @user
     else
       render json: @user.errors, status: :unprocessable_entity
     end
@@ -28,7 +28,7 @@ class Identity::PasswordResetsController < ApplicationController
 
   private
     def set_user
-      token = PasswordResetToken.find_signed!(params[:sid]); @user = token.user
+      @user = User.find_by_token_for!(:password_reset, params[:sid])
     rescue StandardError
       render json: { error: "That password reset link is invalid" }, status: :bad_request
     end
@@ -36,8 +36,4 @@ class Identity::PasswordResetsController < ApplicationController
     def user_params
       params.permit(:password, :password_confirmation)
     end
-
-    def revoke_tokens
-      @user.password_reset_tokens.delete_all
-    end
 end

data/lib/generators/authentication/templates/controllers/api/passwords_controller.rb.tt

@@ -2,9 +2,7 @@ class PasswordsController < ApplicationController
   before_action :set_user
 
   def update
-    if !@user.authenticate(params[:current_password])
-      render json: { error: "The current password you entered is incorrect" }, status: :bad_request
-    elsif @user.update(user_params)
+    if @user.update(user_params)
       render json: @user
     else
       render json: @user.errors, status: :unprocessable_entity
@@ -17,6 +15,6 @@ class PasswordsController < ApplicationController
     end
 
     def user_params
-      params.permit(:password, :password_confirmation)
+      params.permit(:password, :password_confirmation, :password_challenge).with_defaults(password_challenge: "")
     end
 end

data/lib/generators/authentication/templates/controllers/api/sessions_controller.rb.tt

@@ -12,9 +12,7 @@ class SessionsController < ApplicationController
   end
 
   def create
-    user = User.find_by(email: params[:email])
-
-    if user && user.authenticate(params[:password])
+    if user = User.authenticate_by(email: params[:email], password: params[:password])
       @session = user.sessions.create!
       response.set_header "X-Session-Token", @session.signed_id
 

data/lib/generators/authentication/templates/controllers/html/identity/email_verifications_controller.rb.tt

@@ -15,7 +15,7 @@ class Identity::EmailVerificationsController < ApplicationController
 
   private
     def set_user
-      token = EmailVerificationToken.find_signed!(params[:sid]); @user = token.user
+      @user = User.find_by_token_for!(:email_verification, params[:sid])
     rescue StandardError
       redirect_to edit_identity_email_path, alert: "That email verification link is invalid"
     end

data/lib/generators/authentication/templates/controllers/html/identity/emails_controller.rb.tt

@@ -5,9 +5,7 @@ class Identity::EmailsController < ApplicationController
   end
 
   def update
-    if !@user.authenticate(params[:current_password])
-      redirect_to edit_identity_email_path, alert: "The password you entered is incorrect"
-    elsif @user.update(email: params[:email])
+    if @user.update(user_params)
       redirect_to_root
     else
       render :edit, status: :unprocessable_entity
@@ -19,6 +17,10 @@ class Identity::EmailsController < ApplicationController
       @user = Current.user
     end
 
+    def user_params
+      params.permit(:email, :password_challenge).with_defaults(password_challenge: "")
+    end
+
     def redirect_to_root
       if @user.email_previously_changed?
         resend_email_verification

data/lib/generators/authentication/templates/controllers/html/identity/password_resets_controller.rb.tt

@@ -23,7 +23,7 @@ class Identity::PasswordResetsController < ApplicationController
 
   def update
     if @user.update(user_params)
-      revoke_tokens; redirect_to(sign_in_path, notice: "Your password was reset successfully. Please sign in")
+      redirect_to sign_in_path, notice: "Your password was reset successfully. Please sign in"
     else
       render :edit, status: :unprocessable_entity
     end
@@ -31,7 +31,7 @@ class Identity::PasswordResetsController < ApplicationController
 
   private
     def set_user
-      token = PasswordResetToken.find_signed!(params[:sid]); @user = token.user
+      @user = User.find_by_token_for!(:password_reset, params[:sid])
     rescue StandardError
       redirect_to new_identity_password_reset_path, alert: "That password reset link is invalid"
     end
@@ -43,8 +43,4 @@ class Identity::PasswordResetsController < ApplicationController
     def send_password_reset_email
       UserMailer.with(user: @user).password_reset.deliver_later
     end
-
-    def revoke_tokens
-      @user.password_reset_tokens.delete_all
-    end
 end

data/lib/generators/authentication/templates/controllers/html/passwords_controller.rb.tt

@@ -5,9 +5,7 @@ class PasswordsController < ApplicationController
   end
 
   def update
-    if !@user.authenticate(params[:current_password])
-      redirect_to edit_password_path, alert: "The current password you entered is incorrect"
-    elsif @user.update(user_params)
+    if @user.update(user_params)
       redirect_to root_path, notice: "Your password has been changed"
     else
       render :edit, status: :unprocessable_entity
@@ -20,6 +18,6 @@ class PasswordsController < ApplicationController
     end
 
     def user_params
-      params.permit(:password, :password_confirmation)
+      params.permit(:password, :password_confirmation, :password_challenge).with_defaults(password_challenge: "")
     end
 end

data/lib/generators/authentication/templates/controllers/html/sessions_controller.rb.tt

@@ -11,9 +11,7 @@ class SessionsController < ApplicationController
   end
 
   def create
-    user = User.find_by(email: params[:email])
-
-    if user && user.authenticate(params[:password])
+    if user = User.authenticate_by(email: params[:email], password: params[:password])
       <%- if two_factor? -%>
       if user.otp_required_for_sign_in?
         session[:challenge_token] = user.signed_id(purpose: :authentication_challenge, expires_in: 20.minutes)

data/lib/generators/authentication/templates/erb/identity/emails/edit.html.erb.tt

@@ -27,8 +27,8 @@
   </div>
 
   <div>
-    <%%= form.label :current_password, style: "display: block" %>
-    <%%= form.password_field :current_password, required: true, autocomplete: "current-password" %>
+    <%%= form.label :password_challenge, style: "display: block" %>
+    <%%= form.password_field :password_challenge, required: true, autocomplete: "current-password" %>
   </div>
 
   <div>

data/lib/generators/authentication/templates/erb/passwords/edit.html.erb.tt

@@ -16,8 +16,8 @@
   <%% end %>
 
   <div>
-    <%%= form.label :current_password, style: "display: block" %>
-    <%%= form.password_field :current_password, required: true, autofocus: true, autocomplete: "current-password" %>
+    <%%= form.label :password_challenge, style: "display: block" %>
+    <%%= form.password_field :password_challenge, required: true, autofocus: true, autocomplete: "current-password" %>
   </div>
 
   <div>

data/lib/generators/authentication/templates/mailers/user_mailer.rb.tt

@@ -1,14 +1,14 @@
 class UserMailer < ApplicationMailer
   def password_reset
     @user = params[:user]
-    @signed_id = @user.password_reset_tokens.create.signed_id(expires_in: 20.minutes)
+    @signed_id = @user.generate_token_for(:password_reset)
 
     mail to: @user.email, subject: "Reset your password"
   end
 
   def email_verification
     @user = params[:user]
-    @signed_id = @user.email_verification_tokens.create.signed_id(expires_in: 2.days)
+    @signed_id = @user.generate_token_for(:email_verification)
 
     mail to: @user.email, subject: "Verify your email"
   end
@@ -23,7 +23,7 @@ class UserMailer < ApplicationMailer
   <%- if invitable? %>
   def invitation_instructions
     @user = params[:user]
-    @signed_id = @user.password_reset_tokens.create.signed_id(expires_in: 2.days)
+    @signed_id = @user.generate_token_for(:password_reset)
 
     mail to: @user.email, subject: "Invitation instructions"
   end

data/lib/generators/authentication/templates/models/user.rb.tt

@@ -1,11 +1,13 @@
 class User < ApplicationRecord
   has_secure_password
+
+  generates_token_for :email_verification, expires_in: 2.days { email }
+  generates_token_for :password_reset, expires_in: 20.minutes { password_salt.last(10) }
+
   <%- if options.tenantable? %>
   belongs_to :account
   <%- end -%>
 
-  has_many :email_verification_tokens, dependent: :destroy
-  has_many :password_reset_tokens, dependent: :destroy
   has_many :sessions, dependent: :destroy
   <%- if two_factor? -%>
   has_many :recovery_codes, dependent: :destroy
@@ -26,9 +28,7 @@ class User < ApplicationRecord
   validates :password, not_pwned: { message: "might easily be guessed" }
   <%- end -%>
 
-  before_validation if: -> { email.present? } do
-    self.email = email.downcase.strip
-  end
+  normalizes :email, with: -> { _1.strip.downcase }
 
   before_validation if: :email_changed?, on: :update do
     self.verified = false

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/email_verifications_controller_test.rb.tt

@@ -11,7 +11,7 @@ class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTe
   end
 
   test "should send a verification email" do
-    assert_enqueued_email_with UserMailer, :email_verification, args: { user: @user } do
+    assert_enqueued_email_with UserMailer, :email_verification, params: { user: @user } do
       post identity_email_verification_url, headers: default_headers
     end
 
@@ -19,16 +19,19 @@ class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTe
   end
 
   test "should verify email" do
-    sid = @user.email_verification_tokens.create.signed_id(expires_in: 2.days)
+    sid = @user.generate_token_for(:email_verification)
 
     get identity_email_verification_url, params: { sid: sid }, headers: default_headers
     assert_response :no_content
   end
 
   test "should not verify email with expired token" do
-    sid_exp = @user.email_verification_tokens.create.signed_id(expires_in: 0.minutes)
+    sid = @user.generate_token_for(:email_verification)
+
+    travel 3.days
+
+    get identity_email_verification_url, params: { sid: sid }, headers: default_headers
 
-    get identity_email_verification_url, params: { sid: sid_exp }, headers: default_headers
     assert_response :bad_request
     assert_equal "That email verification link is invalid", response.parsed_body["error"]
   end

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/emails_controller_test.rb.tt

@@ -10,14 +10,14 @@ class Identity::EmailsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update email" do
-    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "Secret1*3*5*" }, headers: default_headers
+    patch identity_email_url, params: { email: "new_email@hey.com", password_challenge: "Secret1*3*5*" }, headers: default_headers
     assert_response :success
   end
 
-  test "should not update email with wrong current password" do
-    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "SecretWrong1*3" }, headers: default_headers
+  test "should not update email with wrong password challenge" do
+    patch identity_email_url, params: { email: "new_email@hey.com", password_challenge: "SecretWrong1*3" }, headers: default_headers
 
-    assert_response :bad_request
-    assert_equal "The password you entered is incorrect", response.parsed_body["error"]
+    assert_response :unprocessable_entity
+    assert_equal ["is invalid"], response.parsed_body["password_challenge"]
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/password_resets_controller_test.rb.tt

@@ -6,14 +6,14 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should get edit" do
-    sid = @user.password_reset_tokens.create.signed_id(expires_in: 20.minutes)
+    sid = @user.generate_token_for(:password_reset)
 
     get edit_identity_password_reset_url(sid: sid)
     assert_response :no_content
   end
 
   test "should send a password reset email" do
-    assert_enqueued_email_with UserMailer, :password_reset, args: { user: @user } do
+    assert_enqueued_email_with UserMailer, :password_reset, params: { user: @user } do
       post identity_password_reset_url, params: { email: @user.email }
     end
 
@@ -41,16 +41,19 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update password" do
-    sid = @user.password_reset_tokens.create.signed_id(expires_in: 20.minutes)
+    sid = @user.generate_token_for(:password_reset)
 
     patch identity_password_reset_url, params: { sid: sid, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
     assert_response :success
   end
 
   test "should not update password with expired token" do
-    sid_exp = @user.password_reset_tokens.create.signed_id(expires_in: 0.minutes)
+    sid = @user.generate_token_for(:password_reset)
+
+    travel 30.minutes
+
+    patch identity_password_reset_url, params: { sid: sid, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
 
-    patch identity_password_reset_url, params: { sid: sid_exp, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
     assert_response :bad_request
     assert_equal "That password reset link is invalid", response.parsed_body["error"]
   end

data/lib/generators/authentication/templates/test_unit/controllers/api/passwords_controller_test.rb.tt

@@ -10,14 +10,14 @@ class PasswordsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update password" do
-    patch password_url, params: { current_password: "Secret1*3*5*", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }, headers: default_headers
+    patch password_url, params: { password_challenge: "Secret1*3*5*", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }, headers: default_headers
     assert_response :success
   end
 
-  test "should not update password with wrong current password" do
-    patch password_url, params: { current_password: "SecretWrong1*3", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }, headers: default_headers
+  test "should not update password with wrong password challenge" do
+    patch password_url, params: { password_challenge: "SecretWrong1*3", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }, headers: default_headers
 
-    assert_response :bad_request
-    assert_equal "The current password you entered is incorrect", response.parsed_body["error"]
+    assert_response :unprocessable_entity
+    assert_equal ["is invalid"], response.parsed_body["password_challenge"]
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/html/identity/email_verifications_controller_test.rb.tt

@@ -7,7 +7,7 @@ class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTe
   end
 
   test "should send a verification email" do
-    assert_enqueued_email_with UserMailer, :email_verification, args: { user: @user } do
+    assert_enqueued_email_with UserMailer, :email_verification, params: { user: @user } do
       post identity_email_verification_url
     end
 
@@ -15,16 +15,18 @@ class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTe
   end
 
   test "should verify email" do
-    sid = @user.email_verification_tokens.create.signed_id(expires_in: 2.days)
+    sid = @user.generate_token_for(:email_verification)
 
     get identity_email_verification_url(sid: sid, email: @user.email)
     assert_redirected_to root_url
   end
 
   test "should not verify email with expired token" do
-    sid_exp = @user.email_verification_tokens.create.signed_id(expires_in: 0.minutes)
+    sid = @user.generate_token_for(:email_verification)
 
-    get identity_email_verification_url(sid: sid_exp, email: @user.email)
+    travel 3.days
+
+    get identity_email_verification_url(sid: sid, email: @user.email)
 
     assert_redirected_to edit_identity_email_url
     assert_equal "That email verification link is invalid", flash[:alert]

data/lib/generators/authentication/templates/test_unit/controllers/html/identity/emails_controller_test.rb.tt

@@ -11,14 +11,15 @@ class Identity::EmailsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update email" do
-    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "Secret1*3*5*" }
+    patch identity_email_url, params: { email: "new_email@hey.com", password_challenge: "Secret1*3*5*" }
     assert_redirected_to root_url
   end
 
-  test "should not update email with wrong current password" do
-    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "SecretWrong1*3" }
 
-    assert_redirected_to edit_identity_email_url
-    assert_equal "The password you entered is incorrect", flash[:alert]
+  test "should not update password with wrong password challenge" do
+    patch password_url, params: { password_challenge: "SecretWrong1*3", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
+
+    assert_response :unprocessable_entity
+    assert_select "li", /Password challenge is invalid/
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/html/identity/password_resets_controller_test.rb.tt

@@ -11,14 +11,14 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should get edit" do
-    sid = @user.password_reset_tokens.create.signed_id(expires_in: 20.minutes)
+    sid = @user.generate_token_for(:password_reset)
 
     get edit_identity_password_reset_url(sid: sid)
     assert_response :success
   end
 
   test "should send a password reset email" do
-    assert_enqueued_email_with UserMailer, :password_reset, args: { user: @user } do
+    assert_enqueued_email_with UserMailer, :password_reset, params: { user: @user } do
       post identity_password_reset_url, params: { email: @user.email }
     end
 
@@ -46,16 +46,19 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update password" do
-    sid = @user.password_reset_tokens.create.signed_id(expires_in: 20.minutes)
+    sid = @user.generate_token_for(:password_reset)
 
     patch identity_password_reset_url, params: { sid: sid, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
     assert_redirected_to sign_in_url
   end
 
   test "should not update password with expired token" do
-    sid_exp = @user.password_reset_tokens.create.signed_id(expires_in: 0.minutes)
+    sid = @user.generate_token_for(:password_reset)
+
+    travel 30.minutes
+
+    patch identity_password_reset_url, params: { sid: sid, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
 
-    patch identity_password_reset_url, params: { sid: sid_exp, password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
     assert_redirected_to new_identity_password_reset_url
     assert_equal "That password reset link is invalid", flash[:alert]
   end

data/lib/generators/authentication/templates/test_unit/controllers/html/passwords_controller_test.rb.tt

@@ -11,14 +11,14 @@ class PasswordsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update password" do
-    patch password_url, params: { current_password: "Secret1*3*5*", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
+    patch password_url, params: { password_challenge: "Secret1*3*5*", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
     assert_redirected_to root_url
   end
 
-  test "should not update password with wrong current password" do
-    patch password_url, params: { current_password: "SecretWrong1*3", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
+  test "should not update password with wrong password challenge" do
+    patch password_url, params: { password_challenge: "SecretWrong1*3", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }
 
-    assert_redirected_to edit_password_url
-    assert_equal "The current password you entered is incorrect", flash[:alert]
+    assert_response :unprocessable_entity
+    assert_select "li", /Password challenge is invalid/
   end
 end

data/lib/generators/authentication/templates/test_unit/system/identity/emails_test.rb.tt

@@ -9,7 +9,7 @@ class Identity::EmailsTest < ApplicationSystemTestCase
     click_on "Change email address"
 
     fill_in "New email", with: "new_email@hey.com"
-    fill_in "Current password", with: "Secret1*3*5*"
+    fill_in "Password challenge", with: "Secret1*3*5*"
     click_on "Save changes"
 
     assert_text "Your email has been changed"

data/lib/generators/authentication/templates/test_unit/system/identity/password_resets_test.rb.tt

@@ -3,7 +3,7 @@ require "application_system_test_case"
 class Identity::PasswordResetsTest < ApplicationSystemTestCase
   setup do
     @user = users(:lazaro_nixon)
-    @sid = @user.password_reset_tokens.create.signed_id(expires_in: 20.minutes)
+    @sid = @user.generate_token_for(:password_reset)
   end
 
   test "sending a password reset email" do

data/lib/generators/authentication/templates/test_unit/system/passwords_test.rb.tt

@@ -8,7 +8,7 @@ class PasswordsTest < ApplicationSystemTestCase
   test "updating the password" do
     click_on "Change password"
 
-    fill_in "Current password", with: "Secret1*3*5*"
+    fill_in "Password challenge", with: "Secret1*3*5*"
     fill_in "New password", with: "Secret6*4*2*"
     fill_in "Confirm new password", with: "Secret6*4*2*"
     click_on "Save changes"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authentication-zero
 version: !ruby/object:Gem::Version
-  version: 2.16.36
+  version: 3.0.0.alpha1
 platform: ruby
 authors:
 - Nixon
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-07-17 00:00:00.000000000 Z
+date: 2023-07-19 00:00:00.000000000 Z
 dependencies: []
 description:
 email:
@@ -98,9 +98,7 @@ files:
 - lib/generators/authentication/templates/lib/account_middleware.rb
 - lib/generators/authentication/templates/mailers/user_mailer.rb.tt
 - lib/generators/authentication/templates/migrations/create_accounts_migration.rb.tt
-- lib/generators/authentication/templates/migrations/create_email_verification_tokens_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_events_migration.rb.tt
-- lib/generators/authentication/templates/migrations/create_password_reset_tokens_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_recovery_codes_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_security_keys_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_sessions_migration.rb.tt
@@ -109,9 +107,7 @@ files:
 - lib/generators/authentication/templates/models/account.rb.tt
 - lib/generators/authentication/templates/models/concerns/account_scoped.rb
 - lib/generators/authentication/templates/models/current.rb.tt
-- lib/generators/authentication/templates/models/email_verification_token.rb.tt
 - lib/generators/authentication/templates/models/event.rb.tt
-- lib/generators/authentication/templates/models/password_reset_token.rb.tt
 - lib/generators/authentication/templates/models/recovery_code.rb.tt
 - lib/generators/authentication/templates/models/security_key.rb.tt
 - lib/generators/authentication/templates/models/session.rb.tt
@@ -156,9 +152,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements: []
 rubygems_version: 3.4.10
 signing_key:

data/lib/generators/authentication/templates/migrations/create_email_verification_tokens_migration.rb.tt

@@ -1,7 +0,0 @@
-class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
-  def change
-    create_table :email_verification_tokens do |t|
-      t.references :user, null: false, foreign_key: true
-    end
-  end
-end

data/lib/generators/authentication/templates/migrations/create_password_reset_tokens_migration.rb.tt

@@ -1,7 +0,0 @@
-class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
-  def change
-    create_table :password_reset_tokens do |t|
-      t.references :user, null: false, foreign_key: true
-    end
-  end
-end

data/lib/generators/authentication/templates/models/email_verification_token.rb.tt

@@ -1,3 +0,0 @@
-class EmailVerificationToken < ApplicationRecord
-  belongs_to :user
-end

data/lib/generators/authentication/templates/models/password_reset_token.rb.tt

@@ -1,3 +0,0 @@
-class PasswordResetToken < ApplicationRecord
-  belongs_to :user
-end