codeword 0.2.0.beta4 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +3 -1
- data/UPGRADE-0.2.md +51 -0
- data/lib/codeword/version.rb +1 -1
- metadata +2 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: edc4c98d1d7d4aaeecc0e2d0b7afcb8a532753e057ae77998f804d4fc74203b7
|
|
4
|
+
data.tar.gz: 0abf677be13b090ab310441dd01e07b403fe7296b747f92b8729dc87cc1b21d1
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: bd5f76a4bd9cc4560fb55d2645bbe6229c00fec7a9969b003835ef85927ede1fac0eb27dcc918fe626671643e64d5e1cd2ee448379b4f5209e42deab498e70b4
|
|
7
|
+
data.tar.gz: 24e3c1cddb91cf2a2f08582fbde8184b81abcdf96c29fb70c10fcbcba2dcadd281a53c5e931eda35f25cb66bef32e878c121da4cd9c45f5d8f402d28f5e183c9
|
data/CHANGELOG.md
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
## [
|
|
1
|
+
## [0.2.0] - 2025-09-25
|
|
2
2
|
|
|
3
3
|
- BREAKING: Only support namespaced Rails credentials under `codeword` (e.g. `codeword.codeword`, `codeword.hint`, `codeword.cookie_lifetime_in_weeks`)
|
|
4
4
|
- BREAKING: Drop support for Rails < 7.2
|
|
@@ -11,6 +11,8 @@
|
|
|
11
11
|
- `codeword_cookie_lifetime` now returns an `ActiveSupport::Duration`; cookie expiry uses `from_now`
|
|
12
12
|
- Updated crawler detection regex (removed duplicate `spider` and generic `click` token)
|
|
13
13
|
|
|
14
|
+
Migration: see [UPGRADE-0.2.md](./UPGRADE-0.2.md) for steps to upgrade from 0.1.x to 0.2.0.
|
|
15
|
+
|
|
14
16
|
## [0.1.1] - 2021-12-17
|
|
15
17
|
|
|
16
18
|
- Fix unlocks
|
data/UPGRADE-0.2.md
ADDED
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
# Migrating from 0.1.x to 0.2.0
|
|
2
|
+
|
|
3
|
+
This guide walks you through the changes required to upgrade from 0.1.x to 0.2.0.
|
|
4
|
+
|
|
5
|
+
## TL;DR checklist
|
|
6
|
+
|
|
7
|
+
- Update to Rails >= 7.2.
|
|
8
|
+
- Move credentials to the namespaced structure under `codeword`.
|
|
9
|
+
- Ensure controllers use `require_codeword!` (and skip it only where access is allowed).
|
|
10
|
+
- Stop relying on external `return_to` redirects; they are blocked now.
|
|
11
|
+
|
|
12
|
+
## 1) Credentials: namespaced only
|
|
13
|
+
|
|
14
|
+
Codeword now reads credentials only from the namespaced structure:
|
|
15
|
+
|
|
16
|
+
```yml
|
|
17
|
+
# config/credentials.yml.enc
|
|
18
|
+
codeword:
|
|
19
|
+
codeword: "love"
|
|
20
|
+
hint: "Pepé Le Pew"
|
|
21
|
+
cookie_lifetime_in_weeks: 4
|
|
22
|
+
```
|
|
23
|
+
|
|
24
|
+
- Non‑namespaced keys like `codeword_hint:` at the root are no longer read.
|
|
25
|
+
- Environment variable fallbacks still work: `ENV['CODEWORD']`, `ENV['CODEWORD_HINT']`, `ENV['COOKIE_LIFETIME_IN_WEEKS']`.
|
|
26
|
+
|
|
27
|
+
## 2) Controller hook rename and usage
|
|
28
|
+
|
|
29
|
+
- Use `require_codeword!` to enforce the codeword gate.
|
|
30
|
+
|
|
31
|
+
```ruby
|
|
32
|
+
class ApplicationController < ActionController::Base
|
|
33
|
+
include Codeword::Authentication
|
|
34
|
+
before_action :require_codeword!
|
|
35
|
+
end
|
|
36
|
+
```
|
|
37
|
+
|
|
38
|
+
- Skip it only for controllers/actions you want to allow without the codeword:
|
|
39
|
+
|
|
40
|
+
```ruby
|
|
41
|
+
class APIController < ApplicationController
|
|
42
|
+
skip_before_action :require_codeword!
|
|
43
|
+
end
|
|
44
|
+
```
|
|
45
|
+
|
|
46
|
+
- The old `check_for_codeword` name is deprecated; switch to `require_codeword!`.
|
|
47
|
+
|
|
48
|
+
## 3) Redirect hardening (open redirects)
|
|
49
|
+
|
|
50
|
+
- After a successful unlock, external `return_to` URLs are no longer allowed. Redirects now use `allow_other_host: false` and will fall back to the root path if unsafe.
|
|
51
|
+
- If you previously depended on redirecting to external domains, move that flow behind your own internal path and perform external navigation server‑side or client‑side after the unlock.
|
data/lib/codeword/version.rb
CHANGED
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: codeword
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.2.0
|
|
4
|
+
version: 0.2.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Dan Kim
|
|
@@ -95,6 +95,7 @@ files:
|
|
|
95
95
|
- LICENSE.txt
|
|
96
96
|
- README.md
|
|
97
97
|
- Rakefile
|
|
98
|
+
- UPGRADE-0.2.md
|
|
98
99
|
- app/controllers/codeword/application_controller.rb
|
|
99
100
|
- app/controllers/codeword/codeword_controller.rb
|
|
100
101
|
- app/helpers/codeword/application_helper.rb
|