composable-pwdless 0.0.13 → 0.0.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 681fd4262974ff32148dbc44f68f3b868b83afce96085128178558ec896f9274
-  data.tar.gz: e0a03f7bd16cb8afcb3d9318892c33f20d30ed909467615e3c646ef3e4cb0f91
+  metadata.gz: d8be6e95a72868e29205609ce41c057868b0a3d406c75b090fd28ee8fee9a217
+  data.tar.gz: f6f38b1248c802560d711555b4a2d94dea7aac2178d43fb2f25f9466b295b081
 SHA512:
-  metadata.gz: 05bd6d0d086ae17efed6f09668429b17e7815e01aace561b4bccf42bd9a363095d26f612e0f2b398622cca72997cc0c5a4de5691fb45d6fcb27713c0c58dd4d5
-  data.tar.gz: 05caa185a6e0cff9295204b1b1af361c141c6de55f23c7283762e808b73aac450b7de3405d37e93f18433f60a4de038d6fd51c000d97b55b4f353ee53c3f1484
+  metadata.gz: eb8505135ed8a78e7a779bc0f861396430e4d468aec2963c674cba0c45b718a1dea9e96a3433f78de052b2b3ea122ecf52c97ca494d57ac7c61bcddef2a90a24
+  data.tar.gz: 6f405c552cafef3d1c35aef7ba08ee20e833a9bb6f26b3d46555ee9b840e7f7023a0e27c84f15ff244a304a2f99ad1b31c72e4deca2df17775a8f293563d4462

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 ## [Unreleased]
 
+- Refresh cached verification challenges when inputs change; do not cache failed lookups.
+- Consume purpose-bound codes once with atomic attempt accounting and keyed digests.
+- Add explicit CSRF protection, issuance rate limiting and challenge parameter filtering.
+- Validate code configuration and remove codes from email subjects.
+- Fix direct dependencies, migration placement, routing, sign-out and text email templates.
+- Document application responsibilities and add complete coverage including PostgreSQL concurrency.
+
 ## [0.1.0] - 2022-12-01
 
 - Initial release

data/README.md

@@ -1,43 +1,247 @@
-# Composable::Pwdless
+# composable-pwdless
 
-Welcome to your new gem! In this directory, you'll find the files you need to be able to package up your Ruby library into a gem. Put your Ruby code in the file `lib/composable/pwdless`. To experiment with that code, run `bin/console` for an interactive prompt.
+A Rails engine for email verification challenges and single-use passwordless
+codes. Requires Ruby 3.2+ and Rails 7.2+. It depends on `composable-form` directly.
+Use PostgreSQL for the verified concurrent authentication behavior.
 
-TODO: Delete this and the text above, and describe your gem
+## Install and configure
 
-## Installation
+Add `gem "composable-pwdless"` to the application's Gemfile, then run:
 
-Add this line to your application's Gemfile:
+```sh
+bundle install
+bin/rails composable_pwdless:install:migrations
+bin/rails db:migrate
+```
+
+Configure the engine in a Rails initializer:
+
+```ruby
+Composable::Pwdless.setup do |config|
+  config.parent_controller = "ApplicationController"
+  config.parent_mailer = "ActionMailer::Base"
+  config.mailer_sender = "sign-in@example.test"
+  config.maximum_attempts = 3
+  config.expires_in = 5.minutes
+  config.code_length = 6
+  config.code_charset = [*"0".."9"]
+end
+```
+
+Set parent classes before the corresponding controller/mailer is loaded.
+`parent_controller` must support Rails browser controllers, CSRF protection and
+rate limiting. `mailer_template_path` defaults to `"composable/pwdless/mailer"`.
+`mailer_sender` may be a string or Proc; mailer default `from`/`reply_to` values
+(including callable defaults) take precedence.
+
+Attempts must be positive; expiry must be a positive ActiveSupport duration. Code length is an integer from 1 to 128;
+charset entries must be distinct single-character strings with at least two
+values. The character set and length must represent at least one million possible
+codes. Invalid configuration raises `ArgumentError` when creating a challenge.
+
+## Routes and application session
+
+Inside the application's routes, use `composable_pwdless_for :members,
+controller: "member_sessions"`. This creates GET/POST/PUT `members/sign_in` and
+DELETE `members/sign_out`, with `members_sign_in` and `members_sign_out` helpers.
+`as:` changes the helper prefix. The default controller is
+`composable/pwdless/auth`; leading slashes on explicit controller names are accepted.
 
 ```ruby
-gem 'composable-pwdless'
+class MemberSessionsController < Composable::Pwdless::AuthController
+  private
+
+  def verification_succeeded(email)
+    member = Member.find_by!(email: email) # Apply the application's eligibility rules.
+    reset_session
+    session[:member_id] = member.id
+    redirect_to main_app.root_path
+  end
+end
 ```
 
-And then execute:
+The application supplies `Member`, eligibility checks and its session policy.
+The default success/failure hooks only redirect to the application's root; they
+do not create accounts or sign users in. Default `destroy` resets the session.
+Authentication requires explicit account authorization even when an email code
+is valid. Use one resource name per identity realm: challenges issued for
+`members` cannot be verified through `admins` routes.
+
+## Forms and lifecycle
+
+`Form::Authentication.call(email:, purpose:)` validates email and creates a
+challenge. Its public `code` and `salt` are used for delivery; its `result` is a
+`Form::Verification` containing salt/data/purpose, never the code. A direct form's
+purpose defaults to `"authentication"`; controllers supply the trusted route's
+resource name, ignoring caller-supplied purpose parameters.
+
+`Form::Verification.call(salt:, data:, code:, purpose:)` looks up and verifies the
+challenge. It exposes `invalid_code?`, `has_expired?` and `has_exceeded_attempts?`.
+Status/result/error methods follow the normal form lifecycle.
+Verification caches its challenge lookup only while salt/data/purpose/code remain
+unchanged. Editing those inputs, including mutating a string in place, triggers
+a fresh lookup and binds the submitted code again. Failed database lookups are
+not cached. Use a fresh form for each request.
+
+The browser submits email for issuance and salt/data/code for verification under
+`composable_pwdless`. Controller hooks `deliver_authentication`,
+`verification_succeeded`, `verification_failed`, `verification_expired`, and
+`verification_exceeded_attempts` can be overridden. `create` also accepts a block
+receiving the verification form after successful delivery.
+
+## Security and operation
+
+- Verification locks the challenge row in a transaction. Exactly one valid
+  request consumes it; concurrent invalid requests cannot exceed the attempt
+  budget. Consumed challenges retain zero attempts and cannot be replayed.
+- Codes come from SecureRandom. The database stores keyed SHA-256 digests, bound
+  to purpose/salt/data, rather than plaintext codes or email. Comparisons use
+  constant-time helpers. The key is derived from Rails' key generator with a
+  dedicated purpose. Changing the application key invalidates existing codes.
+- POST/PUT/DELETE require CSRF protection. Browser forms include Rails tokens.
+  Code and salt are added to Rails filtered parameters; applications should also
+  filter email/data and sensitive custom fields as appropriate.
+- Issuance is limited to 10 requests per minute per IP using Rails controller rate
+  limiting. Configure a shared, persistent Rails cache in a multi-worker deployment;
+  NullStore disables effective throttling. Add per-recipient cooldowns and controls
+  against distributed email abuse in the application's delivery policy.
+- Configure HTTPS and secure session cookies in the application. Reset the session
+  before establishing authenticated identity. Avoid account enumeration, code
+  logging, mail-body logging and exposing codes in email subjects.
+- The application owns cleanup of expired/consumed rows, user eligibility,
+  account creation, delivery failure handling and session expiry. A mail failure
+  may leave an undelivered challenge; it never authenticates the user.
+
+Run the PostgreSQL concurrency and controller tests described in
+[testing](../docs/testing.md). SQLite exercises form/model behavior but is not a
+substitute for PostgreSQL row-lock verification.
+
+## Declare browser routes
 
-    $ bundle install
+```ruby
+# config/routes.rb
+Rails.application.routes.draw do
+  root "home#index"
+  composable_pwdless_for :members, controller: "member_sessions"
+end
+```
 
-Or install it yourself as:
+The application supplies `HomeController#index` and the session controller shown
+above. Link to sign-in and use a form-backed button for sign-out:
 
-    $ gem install composable-pwdless
+```erb
+<%= link_to "Sign in", members_sign_in_path %>
+<%= button_to "Sign out", members_sign_out_path, method: :delete %>
+```
 
-## Usage
+The engine renders its issuance and verification forms. For custom views, retain
+the `composable_pwdless` parameter scope and use POST for issuance and PUT for
+verification. Rails form helpers supply the CSRF token:
 
-TODO: Write usage instructions here
+```erb
+<%# Custom issuance form %>
+<%= form_with scope: :composable_pwdless, url: members_sign_in_path, method: :post do |f| %>
+  <%= f.email_field :email, autocomplete: "email", required: true %>
+  <%= f.submit "Send code" %>
+<% end %>
+```
 
-## Development
+```erb
+<%# Custom verification form; @form is the verification form from create %>
+<%= form_with scope: :composable_pwdless, url: members_sign_in_path, method: :put do |f| %>
+  <%= f.hidden_field :salt, value: @form.salt %>
+  <%= f.hidden_field :data, value: @form.data %>
+  <%= f.text_field :code, autocomplete: "one-time-code", required: true %>
+  <%= f.submit "Verify" %>
+<% end %>
+```
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+Do not put the issued code into a hidden field or return it in an issuance API
+response. The user must obtain it through the separate delivery channel.
 
-To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and the created tag, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+## Use the forms without the browser controller
 
-## Contributing
+Direct calls require an initialized Rails application and the migrated secret
+table. Your application owns delivery, throttling and session establishment:
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/composable-pwdless. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [code of conduct](https://github.com/[USERNAME]/composable-pwdless/blob/master/CODE_OF_CONDUCT.md).
+```ruby
+authentication = Composable::Pwdless::Form::Authentication.call(
+  email: "member@example.test", purpose: "members"
+)
+
+if authentication.success?
+  Composable::Pwdless::Mailer.with(authentication: authentication)
+    .notification_email.deliver_now
+  challenge = authentication.result
+  # Keep challenge.salt, challenge.data and challenge.purpose for verification.
+else
+  messages = authentication.errors.full_messages
+end
+```
 
-## License
+On a later request, use the code entered by the user. `submitted_code` below is
+application-provided input, not the issued code copied from the authentication
+object:
+
+```ruby
+verification = Composable::Pwdless::Form::Verification.call(
+  salt: challenge.salt,
+  data: challenge.data,
+  purpose: "members", # Choose this in trusted application code.
+  code: submitted_code
+)
+
+if verification.success?
+  verified_email = verification.data
+  # Apply eligibility rules before establishing a session.
+else
+  messages = verification.errors.full_messages
+  # Offer a fresh challenge after expiry or exhaustion.
+end
+```
+
+A successful verification consumes the challenge. Submit it again and it fails,
+even if the same correct code is supplied. `result` is not a user/session object;
+use the verified data and your application's authentication policy.
+
+## Customize delivery and clean up old challenges
+
+A session controller can replace the default mail delivery while retaining the
+engine's issuance and verification behavior:
+
+```ruby
+class MemberSessionsController < Composable::Pwdless::AuthController
+  private
+
+  def deliver_authentication(authentication)
+    Composable::Pwdless::Mailer.with(authentication: authentication)
+      .notification_email.deliver_now
+  end
+
+  # Also implement verification_succeeded as shown above.
+end
+```
+
+For a scheduled cleanup job, choose a retention period appropriate to your
+application. This example removes only challenges expired for more than a day:
+
+```ruby
+class CleanupPasswordlessChallengesJob < ApplicationJob
+  def perform
+    Composable::Pwdless::Secret.where("expires_at < ?", 1.day.ago).delete_all
+  end
+end
+```
 
-The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
+## Upgrade from unkeyed SHA-256
 
-## Code of Conduct
+The HMAC implementation uses the same database columns; no digest-conversion
+migration is required. Old SHA-256 challenges cannot be verified by this version
+and users must request a new code. Existing digests cannot be converted without
+the original values. Update application instances and workers together to avoid
+issuing and verifying challenges with different algorithms.
 
-Everyone interacting in the Composable::Pwdless project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/[USERNAME]/composable-pwdless/blob/master/CODE_OF_CONDUCT.md).
+The HMAC key is derived automatically from the Rails application key generator.
+Keep key configuration consistent across instances of the same environment;
+rotating it invalidates outstanding challenges. The algorithm change does not
+invalidate already established application sessions.

data/app/controllers/composable/pwdless/auth_controller.rb

@@ -6,7 +6,7 @@ module Composable
       end
 
       def create
-        @form = Form::Authentication.call(authentication_params)
+        @form = Form::Authentication.call(authentication_params.merge(purpose: resource_name))
 
         if @form.success?
           deliver_authentication(@form)
@@ -18,7 +18,7 @@ module Composable
       end
 
       def update
-        @form = Form::Verification.call(verification_params)
+        @form = Form::Verification.call(verification_params.merge(purpose: resource_name))
 
         if @form.success?
           verification_succeeded @form.data
@@ -33,11 +33,16 @@ module Composable
         end
       end
 
+      def destroy
+        reset_session
+        redirect_to main_app.root_url
+      end
+
       private
 
       # Override with your own logic to deliver a code to the user.
       def deliver_authentication(authentication)
-        Pwdless::Mailer.with(authentication: authentication).notification_email.deliver
+        Pwdless::Mailer.with(authentication: authentication).notification_email.deliver_now
       end
 
       # Override with your own logic to do something with the valid data. For
@@ -45,33 +50,35 @@ module Composable
       #
       # ```
       # def verification_succeeded(email)
-      #   session[:user_id] = User.find_or_create_by(email: email)
+      #   user = User.active.find_by!(email: email) # Application eligibility scope.
+      #   reset_session
+      #   session[:user_id] = user.id
       #   redirect_to dashboard_url
       # end
       # ```
-      def verification_succeeded(email)
-        redirect_to root_url
+      def verification_succeeded(_email)
+        redirect_to main_app.root_url
       end
 
       # Override with your own logic to do something when verification fails.
-      def verification_failed(verification)
-        redirect_to root_url
+      def verification_failed(_verification)
+        redirect_to main_app.root_url
       end
 
       # Override with logic for when verification attempts are exceeded. For
       # example, you might want to tweak the flash message that's displayed
       # or redirect them to a page other than the one where they'd re-verify.
-      def verification_exceeded_attempts(verification)
+      def verification_exceeded_attempts(_verification)
         flash[:composable_pwdless] =  Pwdless.t(:attempts_exceeded, scope: "errors.messages")
-        redirect_to url_for(action: :new)
+        redirect_to request.path
       end
 
       # Override with logic for when verification has expired. For
       # example, you might want to tweak the flash message that's displayed
       # or redirect them to a page other than the one where they'd re-verify.
-      def verification_expired(verification)
+      def verification_expired(_verification)
         flash[:composable_pwdless] =  Pwdless.t(:expired, scope: "errors.messages")
-        redirect_to url_for(action: :new)
+        redirect_to request.path
       end
 
       def verification_params

data/app/controllers/composable/pwdless/base_controller.rb

@@ -1,9 +1,11 @@
 module Composable
   module Pwdless
     class BaseController < Pwdless.parent_controller.constantize
+      protect_from_forgery with: :exception
+      rate_limit to: 10, within: 1.minute, only: :create
       # Find the resource name from the request
       def resource_name
-        @resource_name ||= request.env["composable_pwdless_resource"]
+        @resource_name ||= request.env.fetch("composable_pwdless_resource", "authentication")
       end
     end
   end

data/app/mailers/composable/pwdless/mailer.rb

@@ -24,15 +24,11 @@ module Composable
         mailer_sender(:reply_to)
       end
 
-      def mailer_from
-        mailer_sender(:from)
-      end
-
       def mailer_sender(sender = :from)
         default_sender = default_params[sender]
 
         if default_sender.present?
-          default_sender.respond_to?(:to_proc) ? instance_eval(&default_sender) : default_sender
+          default_sender.respond_to?(:to_proc) ? instance_exec(&default_sender) : default_sender
         elsif Pwdless.mailer_sender.is_a?(Proc)
           Pwdless.mailer_sender.call
         else

data/app/models/composable/pwdless/secret.rb

@@ -1,88 +1,77 @@
+# frozen_string_literal: true
+
 module Composable
   module Pwdless
-    class Secret < ApplicationRecord
+    class Secret < ActiveRecord::Base
       self.table_name = "composable_pwdless_secrets"
 
-      # Initialize new models with all the stuff needed to encrypt and store the data.
-      after_initialize :assign_defaults, unless: :persisted?
+      attr_accessor :salt, :data
+      attr_writer :purpose
+      attr_reader :code
 
+      after_initialize :assign_defaults, unless: :persisted?
       before_validation :assign_digests, on: :create
-      validates :data_digest, presence: true
-      validates :code_digest, presence: true
-
-      # This is used to derive the `data_digest`, which finds the secret.
-      attr_accessor :salt
-      validates :salt, presence: true
-
-      validates :expires_at, presence: true
+      validates :salt, :data, :data_digest, :code_digest, :expires_at, presence: true
+      validates :remaining_attempts, numericality: { only_integer: true, greater_than: 0 }
+      validate :code_format, on: :create
       validate :expiration
+      validate :data_tampering, on: :update
+      validate :code_authenticity, on: :update
 
-      validates :remaining_attempts, presence: true,
-                                     numericality: {
-                                       only_integer: true,
-                                       greater_than: 0
-                                     }
-
-      attr_reader :code
-      validate :code_authenticity
-      # Ensure the code is a non-empty string. The nil will
-      # trigger validations and blow up the downstream Encryptor.
-      def code=(code)
-        @code = code.to_s if code.present?
+      def purpose
+        @purpose ||= "authentication"
       end
 
-      attr_accessor :data
-      validates :data, presence: true
-      validate :data_tampering, on: :update
+      def code=(value)
+        @code = value.to_s
+      end
 
       def has_expired?
-        Time.current > expires_at
+        expires_at.nil? || Time.current >= expires_at
       end
 
       def has_exceeded_attempts?
-        remaining_attempts.zero?
+        remaining_attempts <= 0
       end
 
       def has_tampered_data?
-        self.data_digest != digest_data if persisted?
+        !ActiveSupport::SecurityUtils.secure_compare(data_digest, digest_data)
       end
 
       def has_authentic_code?
-        self.code_digest == digest_code
+        ActiveSupport::SecurityUtils.secure_compare(code_digest, digest_code)
       end
 
       def decrement_remaining_attempts!
         decrement!(:remaining_attempts)
       end
 
-      def self.find_by_digest(salt:, data:)
-        return if salt.nil? || data.nil?
+      def self.find_by_digest(salt:, data:, purpose: "authentication")
+        return if salt.blank? || data.blank?
 
-        find_by(data_digest: digest_data(salt: salt, data: data)).tap do |secret|
+        find_by(data_digest: digest_data(salt: salt, data: data, purpose: purpose)).tap do |secret|
           if secret
             secret.salt = salt
             secret.data = data
+            secret.purpose = purpose
           end
         end
       end
 
-      def self.digest_data(salt:, data:)
-        return if salt.nil? || data.nil?
-
-        Digest::SHA256.hexdigest(salt + data)
+      def self.digest_data(salt:, data:, purpose: "authentication")
+        OpenSSL::HMAC.hexdigest("SHA256", Pwdless.digest_key, [purpose, salt, data].to_json)
       end
 
       def self.digest_code(data_digest:, code:)
-        return if code.nil? || data_digest.nil?
-
-        Digest::SHA256.hexdigest(data_digest + code)
+        OpenSSL::HMAC.hexdigest("SHA256", Pwdless.digest_key, [data_digest, code].to_json)
       end
 
       private
 
       def assign_defaults
-        self.salt = SecureRandom.urlsafe_base64(ActiveSupport::MessageEncryptor.key_len)
-        self.code ||= SecureRandom.send(:choose, Pwdless.code_charset, Pwdless.code_length)
+        Pwdless.validate_configuration!
+        self.salt = SecureRandom.urlsafe_base64(32)
+        self.code ||= Array.new(Pwdless.code_length) { Pwdless.code_charset[SecureRandom.random_number(Pwdless.code_charset.length)] }.join
         self.expires_at ||= Pwdless.expires_in.from_now
         self.remaining_attempts ||= Pwdless.maximum_attempts
       end
@@ -93,13 +82,19 @@ module Composable
       end
 
       def digest_data
-        self.class.digest_data(salt: salt, data: data)
+        self.class.digest_data(salt: salt, data: data, purpose: purpose)
       end
 
       def digest_code
         self.class.digest_code(data_digest: data_digest, code: code)
       end
 
+      def code_format
+        unless code.length == Pwdless.code_length && code.each_char.all? { |character| Pwdless.code_charset.include?(character) }
+          errors.add(:code, :invalid)
+        end
+      end
+
       def expiration
         errors.add(:expires_at, "has been exceeded") if has_expired?
       end

data/app/services/composable/pwdless/form/authentication.rb

@@ -4,6 +4,7 @@ module Composable
   module Pwdless
     module Form
       class Authentication < Composable::Form::Command
+        attribute :purpose, type: :string, default: "authentication"
         attribute :email
         validates :email, presence: true
         validates :email, format: { with: URI::MailTo::EMAIL_REGEXP }, if: :email?
@@ -11,15 +12,15 @@ module Composable
         def save
           # We don't want the code in the verification, otherwise the user will
           # set it on the subsequent request, which would undermine the whole thing.
-          Form::Verification.new(salt: salt, data: email)
+          Form::Verification.new(salt: salt, data: email, purpose: purpose)
         end
 
-        private
-
         delegate :code, :salt, to: :secret
 
+        private
+
         def secret
-          @secret ||= Pwdless::Secret.create!(data: email)
+          @secret ||= Pwdless::Secret.create!(data: email, purpose: purpose)
         end
       end
     end

data/app/services/composable/pwdless/form/verification.rb

@@ -1,15 +1,27 @@
+# frozen_string_literal: true
+
 module Composable
   module Pwdless
     module Form
       class Verification < Composable::Form::Command
         attribute :salt, :data, :code
-        validates :data, :code, presence: true
-        validates :secret, presence: true, if: -> { data? && code? }
+        attribute :purpose, type: :string, default: "authentication"
+        validates :salt, :data, :code, presence: true
+        validates :secret, presence: true, if: -> { salt? && data? && code? }
 
-        after_save { secret.decrement_remaining_attempts! }
+        delegate :has_expired?, :has_exceeded_attempts?, to: :secret, allow_nil: true
 
         def save
-          errors.add(:code, :invalid) unless secret.valid?
+          secret.with_lock do
+            if secret.has_expired? || secret.has_exceeded_attempts? || secret.has_tampered_data?
+              errors.add(:code, :invalid)
+            elsif secret.has_authentic_code?
+              secret.update_columns(remaining_attempts: 0)
+            else
+              secret.decrement_remaining_attempts!
+              errors.add(:code, :invalid)
+            end
+          end
         end
 
         def invalid_code?
@@ -18,14 +30,15 @@ module Composable
 
         private
 
-        delegate :has_expired?, :has_exceeded_attempts?, to: :secret, allow_nil: true
-
         def secret
-          return @secret if defined?(@secret)
+          lookup = [salt, data, purpose, code]
+          return @secret if defined?(@secret_lookup) && @secret_lookup == lookup
 
-          @secret = Pwdless::Secret.find_by_digest(salt: salt, data: data).tap do |secret|
+          @secret = Pwdless::Secret.find_by_digest(salt: salt, data: data, purpose: purpose).tap do |secret|
             secret.code = code if secret
           end
+          @secret_lookup = lookup.deep_dup
+          @secret
         end
       end
     end

data/app/views/composable/pwdless/auth/edit.html.erb

@@ -1,8 +1,8 @@
 <h1>Verify login code</h1>
 
-<p>Look for a 6 digit code in the inbox or spam folder.</p>
+<p>Look for a <%= Composable::Pwdless.code_length %> character code in the inbox or spam folder.</p>
 
-<%= form_for @form, as: :composable_pwdless, url: url_for(action: :update), data: { turbo: false }, method: :put do |f| %>
+<%= form_for @form, as: :composable_pwdless, url: request.path, data: { turbo: false }, method: :put do |f| %>
   <%= f.hidden_field :salt %>
   <%= f.hidden_field :data %>
   <%= f.label :code %>
@@ -16,9 +16,9 @@
 
 <p>
   Launch
-  <%= link_to "Gmail", "https://gmail.com/", target: "_blank" %>
+  <%= link_to "Gmail", "https://gmail.com/", target: "_blank", rel: "noopener noreferrer" %>
   |
-  <%= link_to "Outlook", "https://outlook.live.com/", target: "_blank" %>
+  <%= link_to "Outlook", "https://outlook.live.com/", target: "_blank", rel: "noopener noreferrer" %>
   |
-  <%= link_to "Yahoo Mail", "https://mail.yahoo.com/", target: "_blank" %>
+  <%= link_to "Yahoo Mail", "https://mail.yahoo.com/", target: "_blank", rel: "noopener noreferrer" %>
 </p>

data/app/views/composable/pwdless/auth/new.html.erb

@@ -7,7 +7,7 @@
   <p>We'll email you a login code so we can securely get you to your account</p>
 <% end %>
 
-<%= form_for @form, as: :composable_pwdless, url: url_for(action: :create), data: { turbo: false } do |f| %>
+<%= form_for @form, as: :composable_pwdless, url: request.path, data: { turbo: false } do |f| %>
   <%= f.label :email %>
   <%= f.email_field :email, autofocus: true %>
   <%= f.submit "Continue" %>

data/config/locales/en.yml

@@ -2,7 +2,7 @@ en:
   composable_pwdless:
     mailer:
       notification_email:
-        default_subject: "Verification code: %{code}"
+        default_subject: "Your verification code"
     errors:
       messages:
         default_expired: "The code has expired"

data/db/migrate/{db/migrate/20221211203235_create_composable_pwdless_secrets.rb → 20221211203235_create_composable_pwdless_secrets.rb}

@@ -1,11 +1,11 @@
-class CreateComposablePwdlessSecrets < ActiveRecord::Migration[7.0]
+class CreateComposablePwdlessSecrets < ActiveRecord::Migration[7.2]
   def change
     create_table :composable_pwdless_secrets do |t|
       t.string :data_digest, null: false, index: { unique: true }
       t.string :code_digest, null: false
 
       t.datetime :expires_at, null: false
-      t.integer :remaining_attempts, null: false, unsigned: true
+      t.integer :remaining_attempts, null: false
 
       t.timestamps
     end

data/lib/composable/pwdless/engine.rb

@@ -3,6 +3,10 @@ module Composable
     class Engine < ::Rails::Engine
       isolate_namespace Composable::Pwdless
 
+      initializer "composable_pwdless.filter_parameters" do |app|
+        app.config.filter_parameters += [:code, :salt]
+      end
+
       config.to_prepare do
         require "composable/pwdless/router_helpers"
 

data/lib/composable/pwdless/gem_version.rb

@@ -10,7 +10,7 @@ module Composable
     module VERSION
       MAJOR = 0
       MINOR = 0
-      TINY  = 13
+      TINY  = 14
       PRE   = nil
 
       STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")

data/lib/composable/pwdless/router_helpers.rb

@@ -3,10 +3,11 @@ module Composable
     module RouterHelpers
       def composable_pwdless_for(resource, controller: nil, as: nil)
         as         ||= resource.to_s
-        controller ||= "/composable/pwdless/auth"
+        controller ||= "composable/pwdless/auth"
+        controller = controller.delete_prefix("/")
 
         constraints(->(req) { (req.env["composable_pwdless_resource"] = resource.to_s).present? }) do
-          scope resource.to_s, as: as do
+          scope resource.to_s, as: as, module: nil do
             get   "/sign_in",  to: "#{controller}#new", as: :sign_in
             post  "/sign_in",  to: "#{controller}#create"
             put   "/sign_in",  to: "#{controller}#update"

data/lib/composable/pwdless.rb

@@ -1,13 +1,34 @@
 # frozen_string_literal: true
 
-require "composable/core"
+require "rails"
+require "rails/engine"
+require "active_record"
+require "action_mailer"
+require "active_support/core_ext/numeric/time"
+require "openssl"
+require "securerandom"
+require "composable/form"
 require_relative "pwdless/version"
 require "composable/pwdless/engine"
 
 module Composable
   module Pwdless
     class Error < StandardError; end
-    # Your code goes here...
+    def self.validate_configuration!
+      unless maximum_attempts.is_a?(Integer) && maximum_attempts.positive? &&
+          code_length.is_a?(Integer) && code_length.between?(1, 128) &&
+          expires_in.is_a?(ActiveSupport::Duration) && expires_in.positive? &&
+          code_charset.is_a?(Array) && code_charset.uniq.length >= 2 && code_charset.uniq.length == code_charset.length &&
+          code_charset.uniq.length**code_length >= 1_000_000 &&
+          code_charset.all? { |character| character.is_a?(String) && character.length == 1 }
+        raise ArgumentError, "invalid passwordless configuration"
+      end
+    end
+
+    # Derive a separate key; never store this key alongside challenges.
+    def self.digest_key
+      Rails.application.key_generator.generate_key("composable-pwdless/v1", 32)
+    end
 
     # The parent controller all Composable::Pwdless controllers inherits from.
     # Defaults to ApplicationController. This should be set early

metadata

@@ -1,28 +1,42 @@
 --- !ruby/object:Gem::Specification
 name: composable-pwdless
 version: !ruby/object:Gem::Version
-  version: 0.0.13
+  version: 0.0.14
 platform: ruby
 authors:
 - Jairo Vazquez
 bindir: exe
 cert_chain: []
-date: 2025-08-09 00:00:00.000000000 Z
+date: 2026-10-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: composable-core
+  name: composable-form
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.0.13
+        version: 0.0.14
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.0.13
+        version: 0.0.14
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.2'
 description: Authentication composable objects to perform passwordless authentication
 email:
 - jairovm20@gmail.com
@@ -42,9 +56,9 @@ files:
 - app/views/composable/pwdless/auth/edit.html.erb
 - app/views/composable/pwdless/auth/new.html.erb
 - app/views/composable/pwdless/mailer/notification_email.html.erb
-- app/views/composable/pwdless/mailer/notification_email.html.txt
+- app/views/composable/pwdless/mailer/notification_email.text.erb
 - config/locales/en.yml
-- db/migrate/db/migrate/20221211203235_create_composable_pwdless_secrets.rb
+- db/migrate/20221211203235_create_composable_pwdless_secrets.rb
 - lib/composable/pwdless.rb
 - lib/composable/pwdless/engine.rb
 - lib/composable/pwdless/gem_version.rb
@@ -64,7 +78,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="