authie 4.0.0.rc6 → 4.0.0.rc9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3f0ed5ff2724edcadbe4c3da00f495f61c49fb8527a9a3ea990d6cbb0d1b3481
-  data.tar.gz: f3c621bd0cd8561123e39b508647d1bc5b356038928682d1b541635d9913c9cd
+  metadata.gz: f06ec249cc2efa9d4924d524769752cc9702cf017a1d0020d010e8d4a9eae9f8
+  data.tar.gz: f056af849c503c3870f69a707a4409428d6b200cff4df73237cd21e3ca5ce2ed
 SHA512:
-  metadata.gz: f326f7e0aee77baccff01544c98730902fd77c722c803b49257bad520eb6f5340ab00bf585050b6a5d447409f86954147ec9e701d9af404948cb8f7977008c78
-  data.tar.gz: 55da617f47e858b869fb4e3f1afb14a45dd3ff2a661656db89906bdf66fd2c2a785ac70163de3e60e342f3e91601fcb058ff7a77663f840502268e77a224d7d5
+  metadata.gz: 55baf7050e12a28da721b94764740a9267b1ea6b16cb7fe515cf306bfa695463055fae8b2aa16badf47b541f470cb6357b40611d5965d8d51c03a18f7cf985db
+  data.tar.gz: 4853c8cafca07ec918c2d5f1e3ccfa01988432021ded6350470be15f369561aa534bc1a845521107f8e5d2a5a602d37e160a556d936b09e9b4f8573b9fa70ccb

data/db/migrate/20220502180100_add_two_factor_required_to_sessions.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class AddTwoFactorRequiredToSessions < ActiveRecord::Migration[4.2]
+  def change
+    add_column :authie_sessions, :skip_two_factor, :boolean, default: false
+  end
+end

data/lib/authie/config.rb

@@ -8,6 +8,8 @@ module Authie
     attr_accessor :persistent_session_length
     attr_accessor :sudo_session_timeout
     attr_accessor :browser_id_cookie_name
+    attr_accessor :session_token_length
+    attr_accessor :extend_session_expiry_on_touch
     attr_accessor :events
 
     def initialize
@@ -15,6 +17,8 @@ module Authie
       @persistent_session_length = 2.months
       @sudo_session_timeout = 10.minutes
       @browser_id_cookie_name = :browser_id
+      @session_token_length = 64
+      @extend_session_expiry_on_touch = false
       @events = EventManager.new
     end
   end

data/lib/authie/session.rb

@@ -92,6 +92,7 @@ module Authie
       @session.last_activity_ip = @controller.request.ip
       @session.last_activity_path = @controller.request.path
       @session.requests += 1
+      extend_session_expiry_if_appropriate
       @session.save!
       Authie.config.events.dispatch(:session_touched, self)
       self
@@ -113,9 +114,10 @@ module Authie
     #
     # @raises [ActiveRecord::RecordInvalid]
     # @return [Authie::Session]
-    def mark_as_two_factored
+    def mark_as_two_factored(skip: nil)
       @session.two_factored_at = Time.now
       @session.two_factored_ip = @controller.request.ip
+      @session.skip_two_factor = skip unless skip.nil?
       @session.save!
       Authie.config.events.dispatch(:marked_as_two_factor, self)
       self
@@ -132,6 +134,15 @@ module Authie
       self
     end
 
+    # Resets the token for the currently active session to a new string
+    #
+    # @return [Authie::Session]
+    def reset_token
+      @session.reset_token
+      set_cookie
+      self
+    end
+
     private
 
     # rubocop:disable Naming/AccessorMethodName
@@ -201,6 +212,16 @@ module Authie
       self
     end
 
+    def extend_session_expiry_if_appropriate
+      return if @session.expires_at.nil?
+      return unless Authie.config.extend_session_expiry_on_touch
+
+      # If enabled, sessions with an expiry time will automatiaclly be incremented
+      # whenever a page is touched. The cookie will also be updated as appropriate.
+      @session.expires_at = Authie.config.persistent_session_length.from_now
+      set_cookie
+    end
+
     class << self
       # Create a new session within the given controller for the
       #
@@ -284,6 +305,7 @@ module Authie
     delegate :two_factored_at, to: :session
     delegate :two_factored_ip, to: :session
     delegate :two_factored?, to: :session
+    delegate :skip_two_factor?, to: :session
     delegate :update, to: :session
     delegate :update!, to: :session
     delegate :user_agent, to: :session

data/lib/authie/session_model.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require 'active_record/base'
-require 'secure_random_string'
+require 'securerandom'
 require 'authie/config'
 
 module Authie
@@ -19,15 +19,8 @@ module Authie
     # Attributes
     serialize :data, Hash
 
-    before_validation do
-      self.user_agent = user_agent[0, 255] if user_agent.is_a?(String)
-      self.last_activity_path = last_activity_path[0, 255] if last_activity_path.is_a?(String)
-    end
-
-    before_create do
-      self.temporary_token = SecureRandomString.new(44)
-      self.token_hash = self.class.hash_token(temporary_token)
-    end
+    before_validation :shorten_strings
+    before_create :set_new_token
 
     # Return the user that
     def user
@@ -109,6 +102,27 @@ module Authie
       self.class.where('id < ?', id).for_user(user).where(login_ip: login_ip).empty?
     end
 
+    # Reset a new token for the session and return the new token
+    #
+    # @return [String]
+    def reset_token
+      set_new_token
+      save!
+      temporary_token
+    end
+
+    private
+
+    def shorten_strings
+      self.user_agent = user_agent[0, 255] if user_agent.is_a?(String)
+      self.last_activity_path = last_activity_path[0, 255] if last_activity_path.is_a?(String)
+    end
+
+    def set_new_token
+      self.temporary_token = SecureRandom.alphanumeric(Authie.config.session_token_length)
+      self.token_hash = self.class.hash_token(temporary_token)
+    end
+
     class << self
       # Find a session from the database for the given controller instance.
       # Returns a session object or :none if no session is found.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authie
 version: !ruby/object:Gem::Version
-  version: 4.0.0.rc6
+  version: 4.0.0.rc9
 platform: ruby
 authors:
 - Adam Cooke
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-05-02 00:00:00.000000000 Z
+date: 2022-05-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
@@ -30,20 +30,6 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '8.0'
-- !ruby/object:Gem::Dependency
-  name: secure_random_string
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: appraisal
   requirement: !ruby/object:Gem::Requirement
@@ -246,6 +232,7 @@ files:
 - db/migrate/20170417170000_add_token_hashes_to_authie_sessions.rb
 - db/migrate/20170421174100_add_index_to_token_hashes_on_authie_sessions.rb
 - db/migrate/20180215152200_add_host_to_authie_sessions.rb
+- db/migrate/20220502180100_add_two_factor_required_to_sessions.rb
 - lib/authie.rb
 - lib/authie/config.rb
 - lib/authie/controller_delegate.rb