authie 4.0.0.rc6 → 4.0.0.rc7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3f0ed5ff2724edcadbe4c3da00f495f61c49fb8527a9a3ea990d6cbb0d1b3481
-  data.tar.gz: f3c621bd0cd8561123e39b508647d1bc5b356038928682d1b541635d9913c9cd
+  metadata.gz: 44634d5c60eeabd533457e52d0c6926fc7e72a91affd8d9bd1ff18bc07884c5c
+  data.tar.gz: 310b072244bbcd463d7615e2e77b94c7829bae98af0508276b952ea000e3bb44
 SHA512:
-  metadata.gz: f326f7e0aee77baccff01544c98730902fd77c722c803b49257bad520eb6f5340ab00bf585050b6a5d447409f86954147ec9e701d9af404948cb8f7977008c78
-  data.tar.gz: 55da617f47e858b869fb4e3f1afb14a45dd3ff2a661656db89906bdf66fd2c2a785ac70163de3e60e342f3e91601fcb058ff7a77663f840502268e77a224d7d5
+  metadata.gz: c560dafa6d2b626f753e6afac7152ea2d950536b4a520fcd4454b88fbd8978884523fe44ce1ae90547565a1090e8e447d48a983f91d2a52cf8824f77c1ac993d
+  data.tar.gz: 75642d5fb4aa28807e9fc32e77e4de90cf1527da81ddccdcd4b2bf0c233240c2642acb7b100e7931bc2a169429289626c962ab88bc305a2cf016446e2ac229b5

data/lib/authie/config.rb

@@ -8,6 +8,8 @@ module Authie
     attr_accessor :persistent_session_length
     attr_accessor :sudo_session_timeout
     attr_accessor :browser_id_cookie_name
+    attr_accessor :session_token_length
+    attr_accessor :extend_session_expiry_on_touch
     attr_accessor :events
 
     def initialize
@@ -15,6 +17,8 @@ module Authie
       @persistent_session_length = 2.months
       @sudo_session_timeout = 10.minutes
       @browser_id_cookie_name = :browser_id
+      @session_token_length = 64
+      @extend_session_expiry_on_touch = false
       @events = EventManager.new
     end
   end

data/lib/authie/session.rb

@@ -92,6 +92,7 @@ module Authie
       @session.last_activity_ip = @controller.request.ip
       @session.last_activity_path = @controller.request.path
       @session.requests += 1
+      extend_session_expiry_if_appropriate
       @session.save!
       Authie.config.events.dispatch(:session_touched, self)
       self
@@ -132,6 +133,15 @@ module Authie
       self
     end
 
+    # Resets the token for the currently active session to a new string
+    #
+    # @return [Authie::Session]
+    def reset_token
+      @session.reset_token
+      set_cookie
+      self
+    end
+
     private
 
     # rubocop:disable Naming/AccessorMethodName
@@ -201,6 +211,16 @@ module Authie
       self
     end
 
+    def extend_session_expiry_if_appropriate
+      return if @session.expires_at.nil?
+      return unless Authie.config.extend_session_expiry_on_touch
+
+      # If enabled, sessions with an expiry time will automatiaclly be incremented
+      # whenever a page is touched. The cookie will also be updated as appropriate.
+      @session.expires_at = Authie.config.persistent_session_length.from_now
+      set_cookie
+    end
+
     class << self
       # Create a new session within the given controller for the
       #

data/lib/authie/session_model.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require 'active_record/base'
-require 'secure_random_string'
+require 'securerandom'
 require 'authie/config'
 
 module Authie
@@ -19,15 +19,8 @@ module Authie
     # Attributes
     serialize :data, Hash
 
-    before_validation do
-      self.user_agent = user_agent[0, 255] if user_agent.is_a?(String)
-      self.last_activity_path = last_activity_path[0, 255] if last_activity_path.is_a?(String)
-    end
-
-    before_create do
-      self.temporary_token = SecureRandomString.new(44)
-      self.token_hash = self.class.hash_token(temporary_token)
-    end
+    before_validation :shorten_strings
+    before_create :set_new_token
 
     # Return the user that
     def user
@@ -109,6 +102,27 @@ module Authie
       self.class.where('id < ?', id).for_user(user).where(login_ip: login_ip).empty?
     end
 
+    # Reset a new token for the session and return the new token
+    #
+    # @return [String]
+    def reset_token
+      set_new_token
+      save!
+      temporary_token
+    end
+
+    private
+
+    def shorten_strings
+      self.user_agent = user_agent[0, 255] if user_agent.is_a?(String)
+      self.last_activity_path = last_activity_path[0, 255] if last_activity_path.is_a?(String)
+    end
+
+    def set_new_token
+      self.temporary_token = SecureRandom.alphanumeric(Authie.config.session_token_length)
+      self.token_hash = self.class.hash_token(temporary_token)
+    end
+
     class << self
       # Find a session from the database for the given controller instance.
       # Returns a session object or :none if no session is found.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: authie
 version: !ruby/object:Gem::Version
-  version: 4.0.0.rc6
+  version: 4.0.0.rc7
 platform: ruby
 authors:
 - Adam Cooke
@@ -30,20 +30,6 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '8.0'
-- !ruby/object:Gem::Dependency
-  name: secure_random_string
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: appraisal
   requirement: !ruby/object:Gem::Requirement