authtrail 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e54d90f6f3527e7f9f37276deda00150f33b472069b97bd66b0d27f0a3a44c6f
-  data.tar.gz: aa1cd0b4fc8e01590efbd51cd872a57a3ef6e984c844166f261ebd01230a771a
+  metadata.gz: eb0329a5efc01b445b4686a7e1712d6937f57d52443ad880802c5a79c6e746c4
+  data.tar.gz: d4ac5c96149eebd39ba9964303758e48b537e1823345e27117ce35bf1ff7752a
 SHA512:
-  metadata.gz: b640a2f9705502d2405fc15d1bf4bf6082cac388addef26b3592514af117508db8b5f35306f5bd93555472f25e58a86b42d1ade276083bf4b4c4db6dea284ec8
-  data.tar.gz: 80475eaba75303cffdf3313706a3a58e73718804414002559780a55a1041616de61da596f9b67f79b57e71998e9c27a8c590faefdb0febaaa9834fd74b897a55
+  metadata.gz: 837b7df27b74e7c4ac54855bc40584c0fb7ed5291abb5f7627d13d9bd5fa8adfb25bdb50f2292721c67394ca5a8274b8e95a881bf63213dea7a73b927da204ae
+  data.tar.gz: 20b98bad8507a73e67fececc5cb2811a98013e4f449ab8d8b9c97227a4ffb33ecdf1237228c3282ebd3449f2b04cd080369b75d3c1f4f6fa585155169d1433cd

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.3.1 (2021-03-03)
+
+- Added `--lockbox` option to install generator
+
 ## 0.3.0 (2021-03-01)
 
 - Disabled geocoding by default for new installations

data/README.md

@@ -14,7 +14,14 @@ Add this line to your application’s Gemfile:
 gem 'authtrail'
 ```
 
-And run:
+To encrypt email and IP addresses, install [Lockbox](https://github.com/ankane/lockbox) and [Blind Index](https://github.com/ankane/blind_index) and run:
+
+```sh
+rails generate authtrail:install --lockbox
+rails db:migrate
+```
+
+If you prefer not to encrypt data, run:
 
 ```sh
 rails generate authtrail:install
@@ -95,7 +102,7 @@ The `LoginActivity` model uses a [polymorphic association](https://guides.rubyon
 
 ## Geocoding
 
-AuthTrail uses [Geocoder](https://github.com/alexreisner/geocoder) for geocoding. We recommend configuring [local geocoding](#local-geocoding) so IP addresses are not sent to a 3rd party service. If you do use a 3rd party service and adhere to GDPR, be sure to add it to your subprocessor list.
+AuthTrail uses [Geocoder](https://github.com/alexreisner/geocoder) for geocoding. We recommend configuring [local geocoding](#local-geocoding) or [load balancer geocoding](#load-balancer-geocoding) so IP addresses are not sent to a 3rd party service. If you do use a 3rd party service and adhere to GDPR, be sure to add it to your subprocessor list.
 
 To enable geocoding, update `config/initializers/authtrail.rb`:
 
@@ -146,17 +153,25 @@ Geocoder.configure(
 )
 ```
 
-## Data Protection
+### Load Balancer Geocoding
+
+Some load balancers can add geocoding information to request headers.
 
-Protect the privacy of your users by encrypting fields that contain personal data, such as `identity` and `ip`. [Lockbox](https://github.com/ankane/lockbox) is great for this. Use [Blind Index](https://github.com/ankane/blind_index) so you can still query the fields.
+- [nginx](https://nginx.org/en/docs/http/ngx_http_geoip_module.html)
+- [Google Cloud](https://cloud.google.com/load-balancing/docs/custom-headers)
+- [Cloudflare](https://support.cloudflare.com/hc/en-us/articles/200168236-Configuring-Cloudflare-IP-Geolocation)
 
 ```ruby
-class LoginActivity < ApplicationRecord
-  encrypts :identity, :ip
-  blind_index :identity, :ip
+AuthTrail.geocode = false
+AuthTrail.transform_method = lambda do |data, request|
+  data[:country] = request.headers["<country-header>"]
+  data[:region] = request.headers["<region-header>"]
+  data[:city] = request.headers["<city-header>"]
 end
 ```
 
+Check out [this example](https://github.com/ankane/authtrail/issues/40)
+
 ## Other Notes
 
 We recommend using this in addition to Devise’s `Lockable` module and [Rack::Attack](https://github.com/kickstarter/rack-attack).

data/lib/auth_trail/version.rb

@@ -1,3 +1,3 @@
 module AuthTrail
-  VERSION = "0.3.0"
+  VERSION = "0.3.1"
 end

data/lib/generators/authtrail/install_generator.rb

@@ -6,6 +6,8 @@ module Authtrail
       include ActiveRecord::Generators::Migration
       source_root File.join(__dir__, "templates")
 
+      class_option :lockbox, type: :boolean
+
       def copy_migration
         migration_template "login_activities_migration.rb", "db/migrate/create_login_activities.rb", migration_version: migration_version
       end
@@ -15,12 +17,36 @@ module Authtrail
       end
 
       def generate_model
-        template "login_activity_model.rb", "app/models/login_activity.rb"
+        if lockbox?
+          template "model_lockbox.rb", "app/models/login_activity.rb"
+        else
+          template "model.rb", "app/models/login_activity.rb"
+        end
       end
 
       def migration_version
         "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
       end
+
+      def identity_column
+        if lockbox?
+          "t.text :identity_ciphertext\n      t.string :identity_bidx, index: true"
+        else
+          "t.string :identity, index: true"
+        end
+      end
+
+      def ip_column
+        if lockbox?
+          "t.text :ip_ciphertext\n      t.string :ip_bidx, index: true"
+        else
+          "t.string :ip, index: true"
+        end
+      end
+
+      def lockbox?
+        options[:lockbox]
+      end
     end
   end
 end

data/lib/generators/authtrail/templates/login_activities_migration.rb.tt

@@ -3,12 +3,12 @@ class <%= migration_class_name %> < ActiveRecord::Migration<%= migration_version
     create_table :login_activities do |t|
       t.string :scope
       t.string :strategy
-      t.string :identity
+      <%= identity_column %>
       t.boolean :success
       t.string :failure_reason
       t.references :user, polymorphic: true
       t.string :context
-      t.string :ip
+      <%= ip_column %>
       t.text :user_agent
       t.text :referrer
       t.string :city
@@ -18,8 +18,5 @@ class <%= migration_class_name %> < ActiveRecord::Migration<%= migration_version
       t.float :longitude
       t.datetime :created_at
     end
-
-    add_index :login_activities, :identity
-    add_index :login_activities, :ip
   end
 end

data/lib/generators/authtrail/templates/model_lockbox.rb.tt

@@ -0,0 +1,14 @@
+class LoginActivity < ApplicationRecord
+  belongs_to :user, polymorphic: true, optional: true
+
+  encrypts :identity, :ip
+  blind_index :identity, :ip
+
+  before_save :reduce_precision
+
+  # reduce precision to city level to protect IP
+  def reduce_precision
+    self.latitude = latitude&.round(1) if try(:latitude_changed?)
+    self.longitude = longitude&.round(1) if try(:longitude_changed?)
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authtrail
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Andrew Kane
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-03-02 00:00:00.000000000 Z
+date: 2021-03-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -83,7 +83,8 @@ files:
 - lib/generators/authtrail/install_generator.rb
 - lib/generators/authtrail/templates/initializer.rb.tt
 - lib/generators/authtrail/templates/login_activities_migration.rb.tt
-- lib/generators/authtrail/templates/login_activity_model.rb.tt
+- lib/generators/authtrail/templates/model.rb.tt
+- lib/generators/authtrail/templates/model_lockbox.rb.tt
 homepage: https://github.com/ankane/authtrail
 licenses:
 - MIT