authie 2.0.1 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: db86dfa1839811d7896e1906d7e42a3b7ebcffc1
-  data.tar.gz: 7482919291dc9fffe55f5a9c7307a64fa882abac
+  metadata.gz: 9d1aceff4f3015b34c0f529d573ba5b38342a995
+  data.tar.gz: 4fcfced43fd5b139af44c8b2cdf0a5dd664eb8ad
 SHA512:
-  metadata.gz: d1ff02b07834284e53746ee7dcf9f894ba9801a535dc0fa786ef189328a15684fe9342e4894cdf454d61e06d72eb6220cc5c6ccde9decd31a812228b7875a41a
-  data.tar.gz: 5334c04d22104d0c7e9a4c2c0ff33975100bf44ad5d582ccaca31d17dced23ae840847ddfa404394423759cf664cb976a315477e9e101b52f38a22b9f07cf766
+  metadata.gz: 5156c899cbfa6dd8175790aec3f3b11ea4efb0dd05e28d1af6cd5334928ad3d0fce4a0f78f465a9be883a9f2fa3ae47ce2641b34019ec752cc497c8238b43bcb
+  data.tar.gz: 9a9865e44ea9fc20e7c5d2c3c1dd3f8bc0677837fd388a3f6a49c31667384273af913ca2cfe4de9a6f7430b321da216774714da85d96417108a95d643e610391

data/db/migrate/20170417170000_add_token_hashes_to_authie_sessions.rb

@@ -0,0 +1,5 @@
+class AddTokenHashesToAuthieSessions < ActiveRecord::Migration
+  def change
+    add_column :authie_sessions, :token_hash, :string
+  end
+end

data/db/migrate/20170421174100_add_index_to_token_hashes_on_authie_sessions.rb

@@ -0,0 +1,5 @@
+class AddIndexToTokenHashesOnAuthieSessions < ActiveRecord::Migration
+  def change
+    add_index :authie_sessions, :token_hash
+  end
+end

data/lib/authie/session.rb

@@ -11,11 +11,12 @@ module Authie
     self.table_name = "authie_sessions"
 
     # Relationships
-    belongs_to :user, {:polymorphic => true}.merge(Authie.config.user_relationship_options)
+    user_options = {:polymorphic => true}.merge(Authie.config.user_relationship_options)
+    user_options[:optional] = true if ActiveRecord::VERSION::MAJOR >= 5
+    belongs_to :user, user_options
+
     parent_options = {:class_name => "Authie::Session"}
-    if ActiveRecord::VERSION::MAJOR >= 5
-      parent_options[:optional] = true
-    end
+    parent_options[:optional] = true if ActiveRecord::VERSION::MAJOR >= 5
     belongs_to :parent, parent_options
 
     # Scopes
@@ -25,6 +26,7 @@ module Authie
     # Attributes
     serialize :data, Hash
     attr_accessor :controller
+    attr_accessor :temporary_token
 
     before_validation do
       if self.user_agent.is_a?(String)
@@ -33,7 +35,8 @@ module Authie
     end
 
     before_create do
-      self.token = SecureRandom.base64(32)
+      self.temporary_token = SecureRandom.base64(32)
+      self.token_hash = self.class.hash_token(self.temporary_token)
       if controller
         self.user_agent = controller.request.user_agent
         set_cookie!
@@ -58,7 +61,7 @@ module Authie
     # Sets the cookie on the associated controller.
     def set_cookie!
       cookies[:user_session] = {
-        :value => token,
+        :value => self.temporary_token,
         :secure => controller.request.ssl?,
         :httponly => true,
         :expires => self.expires_at
@@ -145,7 +148,7 @@ module Authie
 
     # Invalidate all sessions but this one for this user
     def invalidate_others!
-      self.class.where.not(:id => self.id).where(:user => self.user).each do |s|
+      self.class.where("id != ?", self.id).where(:user => self.user).each do |s|
         s.invalidate!
       end
     end
@@ -195,7 +198,8 @@ module Authie
     # Returns a session object or :none if no session is found.
     def self.get_session(controller)
       cookies = controller.send(:cookies)
-      if cookies[:user_session] && session = self.active.where(:token => cookies[:user_session]).first
+      if cookies[:user_session] && session = self.find_session_by_token(cookies[:user_session])
+        session.temporary_token = cookies[:user_session]
         session.controller = controller
         session
       else
@@ -203,6 +207,12 @@ module Authie
       end
     end
 
+    # Find a session by a token (either from a hash or from the raw token)
+    def self.find_session_by_token(token)
+      return nil if token.blank?
+      self.active.where("token = ? OR token_hash = ?", token, self.hash_token(token)).first
+    end
+
     # Create a new session and return the newly created session object.
     # Any other sessions for the browser will be invalidated.
     def self.start(controller, params = {})
@@ -219,7 +229,23 @@ module Authie
 
     # Cleanup any old sessions.
     def self.cleanup
+      # Invalidate transient sessions that haven't been used
       self.active.where("expires_at IS NULL AND last_activity_at < ?", Authie.config.session_inactivity_timeout.ago).each(&:invalidate!)
+      # Invalidate persistent sessions that have expired
+      self.active.where("expires_at IS NOT NULL AND expires_at < ?", Time.now).each(&:invalidate!)
+    end
+
+    # Return a hash of a given token
+    def self.hash_token(token)
+      Digest::SHA256.hexdigest(token)
+    end
+
+    # Convert all existing active sessions to store their tokens in the database
+    def self.convert_tokens_to_hashes
+      active.where(:token_hash => nil).where("token is not null").each do |s|
+        hash = self.hash_token(s.token)
+        self.where(:id => s.id).update_all(:token_hash => hash, :token => nil)
+      end
     end
 
     private

data/lib/authie/version.rb

@@ -1,3 +1,3 @@
 module Authie
-  VERSION = '2.0.1'
+  VERSION = '3.0.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authie
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 3.0.0
 platform: ruby
 authors:
 - Adam Cooke
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-02-24 00:00:00.000000000 Z
+date: 2017-04-21 00:00:00.000000000 Z
 dependencies: []
 description: A Rails library for storing user sessions in a backend database
 email:
@@ -21,6 +21,8 @@ files:
 - db/migrate/20141013115205_add_indexes_to_authie_sessions.rb
 - db/migrate/20150109144120_add_parent_id_to_authie_sessions.rb
 - db/migrate/20150305135400_add_two_factor_auth_fields_to_authie.rb
+- db/migrate/20170417170000_add_token_hashes_to_authie_sessions.rb
+- db/migrate/20170421174100_add_index_to_token_hashes_on_authie_sessions.rb
 - lib/authie.rb
 - lib/authie/config.rb
 - lib/authie/controller_delegate.rb
@@ -50,7 +52,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.5.2
 signing_key: 
 specification_version: 4
 summary: A Rails library for storing user sessions in a backend database