castle_devise 0.4.3 → 0.7.0

data/gemfiles/rails_7.0.gemfile

@@ -1,17 +1,18 @@
-# This file was generated by Appraisal
-
 source "https://rubygems.org"
 
 gem "actionmailer"
 gem "activerecord"
+gem "byebug"
 gem "railties", "~> 7.0"
 gem "rake"
 gem "rspec"
 gem "rspec-rails"
 gem "simplecov"
 gem "standard"
-gem "sqlite3"
+gem "sqlite3", "~> 1.7"
 gem "vcr"
 gem "webmock"
+gem "mutex_m"
+gem "logger"
 
 gemspec path: "../"

data/gemfiles/rails_7.1.gemfile

@@ -0,0 +1,18 @@
+source "https://rubygems.org"
+
+gem "actionmailer"
+gem "activerecord"
+gem "byebug"
+gem "railties", "~> 7.1"
+gem "rake"
+gem "rspec"
+gem "rspec-rails"
+gem "simplecov"
+gem "standard"
+gem "sqlite3", "~> 1.7"
+gem "vcr"
+gem "webmock"
+gem "mutex_m"
+gem "logger"
+
+gemspec path: "../"

data/gemfiles/rails_7.2.gemfile

@@ -0,0 +1,18 @@
+source "https://rubygems.org"
+
+gem "actionmailer"
+gem "activerecord"
+gem "byebug"
+gem "railties", "~> 7.2"
+gem "rake"
+gem "rspec"
+gem "rspec-rails"
+gem "simplecov"
+gem "standard"
+gem "sqlite3", "~> 1.7"
+gem "vcr"
+gem "webmock"
+gem "mutex_m"
+gem "logger"
+
+gemspec path: "../"

data/gemfiles/rails_8.0.gemfile

@@ -0,0 +1,18 @@
+source "https://rubygems.org"
+
+gem "actionmailer"
+gem "activerecord"
+gem "byebug"
+gem "railties", "~> 8.0.0"
+gem "rake"
+gem "rspec"
+gem "rspec-rails"
+gem "simplecov"
+gem "standard"
+gem "sqlite3"
+gem "vcr"
+gem "webmock"
+gem "mutex_m"
+gem "logger"
+
+gemspec path: "../"

data/gemfiles/rails_8.1.gemfile

@@ -0,0 +1,17 @@
+source "https://rubygems.org"
+
+gem "actionmailer"
+gem "activerecord"
+gem "byebug"
+gem "devise", "~> 5.0"
+gem "railties", "~> 8.1.0"
+gem "rake"
+gem "rspec"
+gem "rspec-rails"
+gem "simplecov"
+gem "standard"
+gem "sqlite3"
+gem "vcr"
+gem "webmock"
+
+gemspec path: "../"

data/lib/castle_devise/configuration.rb

@@ -1,20 +1,20 @@
 # frozen_string_literal: true
 
-require "active_support/configurable"
 require "logger"
 
 module CastleDevise
-  # Configuration object using {ActiveSupport::Configurable}
+  # Plain Ruby configuration object for CastleDevise.
+  #
+  # Previously this used +ActiveSupport::Configurable+, which is deprecated
+  # and slated for removal in Rails 8.2.
   class Configuration
-    include ActiveSupport::Configurable
-
     # @!attribute api_secret
     #   @return [String] Your API secret
-    config_accessor(:api_secret)
+    attr_accessor :api_secret
 
-    # @!attribute app_id
-    #   @return [String] Your Castle App ID
-    config_accessor(:app_id)
+    # @!attribute publishable_key
+    #   @return [String] Publishable key passed to @castleio/castle-js as { pk: }
+    attr_accessor :publishable_key
 
     # @!attribute monitoring_mode
     #   When CastleDevise is in monitoring mode, it sends requests to Castle
@@ -25,27 +25,41 @@ module CastleDevise
     #   from logging in/registering.
     #
     #   @return [true, false] whether to act on deny requests or not
-    config_accessor(:monitoring_mode) { false }
-
-    # @!attribute logger
-    #   @return [Logger] A Logger instance. You might want to use Rails.logger here.
-    config_accessor(:logger) { Logger.new("/dev/null") }
+    attr_accessor :monitoring_mode
 
     # @!attribute before_request_hooks
     #   @return [Array<Proc>] Array of procs that will get called before a request to the Castle API
-    config_accessor(:before_request_hooks) { [] }
+    attr_accessor :before_request_hooks
 
     # @!attribute after_request_hooks
     #   @return [Array<Proc>] Array of procs that will get called after a request to the Castle API
-    config_accessor(:after_request_hooks) { [] }
+    attr_accessor :after_request_hooks
+
+    attr_writer :logger, :castle_sdk_facade_class, :castle_client
+
+    def initialize
+      @monitoring_mode = false
+      @before_request_hooks = []
+      @after_request_hooks = []
+    end
+
+    # @!attribute logger
+    #   @return [Logger] A Logger instance. You might want to use Rails.logger here.
+    def logger
+      @logger ||= Logger.new(File::NULL)
+    end
 
     # @!attribute castle_sdk_facade_class
     #   @return [Class] Castle API implementation
-    config_accessor(:castle_sdk_facade_class) { ::CastleDevise::SdkFacade }
+    def castle_sdk_facade_class
+      @castle_sdk_facade_class ||= ::CastleDevise::SdkFacade
+    end
 
     # @!attribute castle_client
-    #   @return [Class] Castle SDK client
-    config_accessor(:castle_client) { ::Castle::Client.new }
+    #   @return [Castle::Client] Castle SDK client
+    def castle_client
+      @castle_client ||= ::Castle::Client.new
+    end
 
     # Adds a new before_request hook
     # @param blk [Proc]

data/lib/castle_devise/helpers/castle_devise.js

@@ -0,0 +1,48 @@
+(function () {
+  var CastleGlobal = window.Castle || window["@castleio/castle-js"];
+  var pk = __CASTLE_DEVISE_PK__;
+  if (!window.__castleDevise && CastleGlobal && typeof CastleGlobal.configure === "function") {
+    window.__castleDevise = CastleGlobal.configure({ pk: pk });
+  }
+
+  window.castleDeviseOnFormSubmit = function (event) {
+    var client = window.__castleDevise || window.Castle || window["@castleio/castle-js"];
+    // 2.x exposes injectTokenOnSubmit; 3.x only has createRequestToken on the configured instance.
+    if (client && typeof client.injectTokenOnSubmit === "function") {
+      return client.injectTokenOnSubmit(event);
+    }
+    if (!client || typeof client.createRequestToken !== "function") {
+      event.preventDefault();
+      return false;
+    }
+    var form = event.target;
+    if (form.getAttribute("data-castle-submitting") === "1") {
+      return true;
+    }
+    event.preventDefault();
+    client.createRequestToken().then(function (token) {
+      var field = form.querySelector('input[name="castle_request_token"]');
+      if (!field) {
+        field = document.createElement("input");
+        field.type = "hidden";
+        field.name = "castle_request_token";
+        form.appendChild(field);
+      }
+      field.value = token || "";
+      form.setAttribute("data-castle-submitting", "1");
+      if (typeof form.requestSubmit === "function") {
+        form.requestSubmit();
+      } else {
+        form.submit();
+      }
+    }).catch(function () {
+      form.setAttribute("data-castle-submitting", "1");
+      if (typeof form.requestSubmit === "function") {
+        form.requestSubmit();
+      } else {
+        form.submit();
+      }
+    });
+    return false;
+  };
+})();

data/lib/castle_devise/helpers/castle_helper.rb

@@ -4,13 +4,23 @@ module CastleDevise
   module Helpers
     # Methods defined here will be available in all your views.
     module CastleHelper
-      # Creates a <script> tag that includes our c.js script from a CDN.
-      # You have to make sure that your app_id is valid, otherwise the script won't work.
-      #
-      # You shouldn't call this method if you bundle our c.js script with your other
-      # JS packages.
+      BOOTSTRAP_JS = File.read(File.expand_path("castle_devise.js", __dir__)).freeze
+      # 3.x UMD is named @castleio/castle-js, so seed module.exports as window.Castle before the script tag.
+      UMD_SHIM = <<~JS
+        if (!window.Castle) {
+          window.exports = window.exports || {};
+          window.module = window.module || { exports: window.exports };
+          window.Castle = window.module.exports;
+        }
+      JS
+
+      DEFAULT_UMD_SRC = "/vendor/castle-js/castle.umd.js"
+
+      # Loads castle.umd.js and configures it with { pk: }. Pass src: to use a
+      # different UMD URL, or src: nil when the host app already loaded the SDK.
       #
-      # You should put this in the <head> section of your page:
+      # @param src [String, nil] URL or path of castle.umd.js (keep workers in the same directory)
+      # @return [String]
       #
       # @example
       #   # app/views/layouts/application.html.erb
@@ -21,14 +31,18 @@ module CastleDevise
       #   <title>Your app title</title>
       #
       #   <!-- the rest of your layout -->
-      def castle_javascript_tag
-        javascript_include_tag(
-          "https://cdn.castle.io/v2/castle.js?#{CastleDevise.configuration.app_id}"
-        )
+      def castle_javascript_tag(src: DEFAULT_UMD_SRC)
+        parts = []
+        if src
+          parts << javascript_tag(UMD_SHIM)
+          parts << javascript_include_tag(src)
+        end
+        parts << javascript_tag(castle_js_bootstrap)
+        safe_join(parts)
       end
 
-      # Puts an inline <script> tag that includes a "castle_devise_token" field
-      # within the current form.
+      # onsubmit handler that mints castle_request_token via 2.x injectTokenOnSubmit
+      # or 2.x/3.x createRequestToken.
       #
       # @example
       #   <%= form_for(resource, as: resource_name, url: sessions_path(resource_name), html: { onsubmit: castle_on_form_submit }) do |f| %>
@@ -38,7 +52,13 @@ module CastleDevise
       #
       # @return [String]
       def castle_on_form_submit
-        "typeof(_castle)=='undefined'?event.preventDefault():_castle('onFormSubmit', event)"
+        "castleDeviseOnFormSubmit(event)"
+      end
+
+      private
+
+      def castle_js_bootstrap
+        BOOTSTRAP_JS.sub("__CASTLE_DEVISE_PK__", CastleDevise.configuration.publishable_key.to_json)
       end
     end
   end

data/lib/castle_devise/hooks/castle_protectable.rb

@@ -63,6 +63,6 @@ Warden::Manager.before_failure do |env, opts|
       context: context
     )
   rescue Castle::Error => e
-    CastleDevise.logger.error("[CastleDevise] filter($login, $failed): #{e}")
+    CastleDevise.logger.warn("[CastleDevise] filter($login, $failed): #{e}")
   end
 end

data/lib/castle_devise/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CastleDevise
-  VERSION = "0.4.3"
+  VERSION = "0.7.0"
 end

data/mise.toml

@@ -0,0 +1,11 @@
+[tasks.install]
+description = "Install Ruby gems"
+run = "bundle install"
+
+[tasks.test]
+description = "Run the RSpec suite"
+run = "bundle exec rspec"
+
+[tasks.lint]
+description = "Run Standard Ruby"
+run = "bundle exec standardrb"

metadata

@@ -1,16 +1,16 @@
 --- !ruby/object:Gem::Specification
 name: castle_devise
 version: !ruby/object:Gem::Version
-  version: 0.4.3
+  version: 0.7.0
 platform: ruby
 authors:
 - Kacper Madej
 - Dawid Libiszewski
+- Bartosz Knapik
 - Johan Brissmyr
-autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-07-11 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -18,14 +18,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
 - !ruby/object:Gem::Dependency
   name: castle-rb
   requirement: !ruby/object:Gem::Requirement
@@ -35,7 +35,7 @@ dependencies:
         version: '7.2'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '8.0'
+        version: '10.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -45,7 +45,7 @@ dependencies:
         version: '7.2'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '8.0'
+        version: '10.0'
 - !ruby/object:Gem::Dependency
   name: devise
   requirement: !ruby/object:Gem::Requirement
@@ -55,7 +55,7 @@ dependencies:
         version: 4.3.0
     - - "<"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -65,25 +65,11 @@ dependencies:
         version: 4.3.0
     - - "<"
       - !ruby/object:Gem::Version
-        version: '5.0'
-- !ruby/object:Gem::Dependency
-  name: appraisal
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 2.3.0
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 2.3.0
+        version: '6.0'
 description: castle_devise provides out-of-the-box protection against bot registrations
   and account takeover attacks.
 email:
-- kacper@castle.io
+- team@castle.io
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -91,8 +77,10 @@ files:
 - ".github/workflows/lint.yml"
 - ".github/workflows/specs.yml"
 - ".gitignore"
+- ".octocov.yml"
 - ".rspec"
-- Appraisals
+- ".standard.yml"
+- ".tool-versions"
 - CHANGELOG.md
 - Gemfile
 - Gemfile.lock
@@ -105,10 +93,15 @@ files:
 - gemfiles/rails_6.0.gemfile
 - gemfiles/rails_6.1.gemfile
 - gemfiles/rails_7.0.gemfile
+- gemfiles/rails_7.1.gemfile
+- gemfiles/rails_7.2.gemfile
+- gemfiles/rails_8.0.gemfile
+- gemfiles/rails_8.1.gemfile
 - lib/castle_devise.rb
 - lib/castle_devise/configuration.rb
 - lib/castle_devise/context.rb
 - lib/castle_devise/controllers/helpers.rb
+- lib/castle_devise/helpers/castle_devise.js
 - lib/castle_devise/helpers/castle_helper.rb
 - lib/castle_devise/hooks/castle_protectable.rb
 - lib/castle_devise/models/castle_protectable.rb
@@ -118,6 +111,7 @@ files:
 - lib/castle_devise/rails.rb
 - lib/castle_devise/sdk_facade.rb
 - lib/castle_devise/version.rb
+- mise.toml
 homepage: https://github.com/castle/castle_devise
 licenses:
 - MIT
@@ -125,7 +119,6 @@ metadata:
   homepage_uri: https://github.com/castle/castle_devise
   source_code_uri: https://github.com/castle/castle_devise
   changelog_uri: https://github.com/castle/castle_devise/CHANGELOG.md
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -133,15 +126,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.5.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.3
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Integrates Castle with Devise
 test_files: []

data/Appraisals

@@ -1,11 +0,0 @@
-appraise "rails-6.0" do
-  gem "railties", "~> 6.0.4"
-end
-
-appraise "rails-6.1" do
-  gem "railties", "~> 6.1.4"
-end
-
-appraise "rails-7.0" do
-  gem "railties", "~> 7.0"
-end