authie 4.0.0.rc4 → 4.0.0.rc7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 99cb3ea1143001fdb259df6d251223036ae94ac4f2661d9732e01b9438a67702
-  data.tar.gz: 261dd3764202502100c0ba19bc649cb7cf3c09b57250d1643b0f14c35e10f2f3
+  metadata.gz: 44634d5c60eeabd533457e52d0c6926fc7e72a91affd8d9bd1ff18bc07884c5c
+  data.tar.gz: 310b072244bbcd463d7615e2e77b94c7829bae98af0508276b952ea000e3bb44
 SHA512:
-  metadata.gz: b1bfae12c744d812a64dc757b6524f3b09f951adf5f62528e96560dcb93f0424d4590575b5a082a715402c1dbfe8f8721b184fb4b369a9f71b1b51a9c318c81b
-  data.tar.gz: 8c344e7933ec8d13bea40130ba0974a9f2ac97fd5bcb3aa0694305b140b290f4a6a1082cfcfbba82261a11f0bf6c2611662acdb7fc65506b5107b09250f61fae
+  metadata.gz: c560dafa6d2b626f753e6afac7152ea2d950536b4a520fcd4454b88fbd8978884523fe44ce1ae90547565a1090e8e447d48a983f91d2a52cf8824f77c1ac993d
+  data.tar.gz: 75642d5fb4aa28807e9fc32e77e4de90cf1527da81ddccdcd4b2bf0c233240c2642acb7b100e7931bc2a169429289626c962ab88bc305a2cf016446e2ac229b5

data/lib/authie/config.rb

@@ -8,6 +8,8 @@ module Authie
     attr_accessor :persistent_session_length
     attr_accessor :sudo_session_timeout
     attr_accessor :browser_id_cookie_name
+    attr_accessor :session_token_length
+    attr_accessor :extend_session_expiry_on_touch
     attr_accessor :events
 
     def initialize
@@ -15,6 +17,8 @@ module Authie
       @persistent_session_length = 2.months
       @sudo_session_timeout = 10.minutes
       @browser_id_cookie_name = :browser_id
+      @session_token_length = 64
+      @extend_session_expiry_on_touch = false
       @events = EventManager.new
     end
   end

data/lib/authie/controller_delegate.rb

@@ -9,10 +9,13 @@ module Authie
   # The controller delegate implements methods that can be used by a controller. These are then
   # extended into controllers as needed (see ControllerExtension).
   class ControllerDelegate
+    attr_accessor :touch_auth_session_enabled
+
     # @param controller [ActionController::Base]
     # @return [Authie::ControllerDelegate]
     def initialize(controller)
       @controller = controller
+      @touch_auth_session_enabled = true
     end
 
     # Sets a browser ID. This must be performed on any page request where AUthie will be used.
@@ -36,18 +39,25 @@ module Authie
       proposed_browser_id
     end
 
-    # Touch the session on each request to ensure that it is validated and all last activity
-    # information is updated. This will return the session if one has been touched otherwise
-    # it will reteurn false if there is no session/not logged in. It is safe to run this on
-    # all requests even if there is no session.
+    # Validate the auth session to ensure that it is current validate and raise an error if it
+    # is not suitable for use.
     #
     # @return [Authie::Session, false]
-    def touch_auth_session
-      return auth_session.touch if logged_in?
+    def validate_auth_session
+      return auth_session.validate if logged_in?
 
       false
     end
 
+    # Touch the session to update details on the latest activity.
+    #
+    # @return [Authie::Session, false]
+    def touch_auth_session
+      yield if block_given?
+    ensure
+      auth_session.touch if @touch_auth_session_enabled && logged_in?
+    end
+
     # Return the user for the currently logged in user or nil if no user is logged in
     #
     # @return [ActiveRecord::Base, nil]

data/lib/authie/controller_extension.rb

@@ -7,9 +7,11 @@ module Authie
     class << self
       def included(base)
         base.helper_method :logged_in?, :current_user, :auth_session
-        base.before_action :set_browser_id, :touch_auth_session
+        base.before_action :set_browser_id, :validate_auth_session
+        base.around_action :touch_auth_session
 
         base.delegate :set_browser_id, to: :auth_session_delegate
+        base.delegate :validate_auth_session, to: :auth_session_delegate
         base.delegate :touch_auth_session, to: :auth_session_delegate
         base.delegate :current_user, to: :auth_session_delegate
         base.delegate :create_auth_session, to: :auth_session_delegate
@@ -24,5 +26,9 @@ module Authie
     def auth_session_delegate
       @auth_session_delegate ||= Authie::ControllerDelegate.new(self)
     end
+
+    def skip_touch_auth_session!
+      auth_session_delegate.touch_auth_session_enabled = false
+    end
   end
 end

data/lib/authie/session.rb

@@ -88,11 +88,11 @@ module Authie
     # @raises [ActiveRecord::RecordInvalid]
     # @return [Authie::Session]
     def touch
-      validate
       @session.last_activity_at = Time.now
       @session.last_activity_ip = @controller.request.ip
       @session.last_activity_path = @controller.request.path
       @session.requests += 1
+      extend_session_expiry_if_appropriate
       @session.save!
       Authie.config.events.dispatch(:session_touched, self)
       self
@@ -133,6 +133,15 @@ module Authie
       self
     end
 
+    # Resets the token for the currently active session to a new string
+    #
+    # @return [Authie::Session]
+    def reset_token
+      @session.reset_token
+      set_cookie
+      self
+    end
+
     private
 
     # rubocop:disable Naming/AccessorMethodName
@@ -202,6 +211,16 @@ module Authie
       self
     end
 
+    def extend_session_expiry_if_appropriate
+      return if @session.expires_at.nil?
+      return unless Authie.config.extend_session_expiry_on_touch
+
+      # If enabled, sessions with an expiry time will automatiaclly be incremented
+      # whenever a page is touched. The cookie will also be updated as appropriate.
+      @session.expires_at = Authie.config.persistent_session_length.from_now
+      set_cookie
+    end
+
     class << self
       # Create a new session within the given controller for the
       #

data/lib/authie/session_model.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require 'active_record/base'
-require 'secure_random_string'
+require 'securerandom'
 require 'authie/config'
 
 module Authie
@@ -19,15 +19,8 @@ module Authie
     # Attributes
     serialize :data, Hash
 
-    before_validation do
-      self.user_agent = user_agent[0, 255] if user_agent.is_a?(String)
-      self.last_activity_path = last_activity_path[0, 255] if last_activity_path.is_a?(String)
-    end
-
-    before_create do
-      self.temporary_token = SecureRandomString.new(44)
-      self.token_hash = self.class.hash_token(temporary_token)
-    end
+    before_validation :shorten_strings
+    before_create :set_new_token
 
     # Return the user that
     def user
@@ -109,6 +102,27 @@ module Authie
       self.class.where('id < ?', id).for_user(user).where(login_ip: login_ip).empty?
     end
 
+    # Reset a new token for the session and return the new token
+    #
+    # @return [String]
+    def reset_token
+      set_new_token
+      save!
+      temporary_token
+    end
+
+    private
+
+    def shorten_strings
+      self.user_agent = user_agent[0, 255] if user_agent.is_a?(String)
+      self.last_activity_path = last_activity_path[0, 255] if last_activity_path.is_a?(String)
+    end
+
+    def set_new_token
+      self.temporary_token = SecureRandom.alphanumeric(Authie.config.session_token_length)
+      self.token_hash = self.class.hash_token(temporary_token)
+    end
+
     class << self
       # Find a session from the database for the given controller instance.
       # Returns a session object or :none if no session is found.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authie
 version: !ruby/object:Gem::Version
-  version: 4.0.0.rc4
+  version: 4.0.0.rc7
 platform: ruby
 authors:
 - Adam Cooke
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-04-29 00:00:00.000000000 Z
+date: 2022-05-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
@@ -30,20 +30,6 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '8.0'
-- !ruby/object:Gem::Dependency
-  name: secure_random_string
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: appraisal
   requirement: !ruby/object:Gem::Requirement