devise-api 0.1.3 → 0.3.0

data/lib/devise/api/rails/engine.rb

@@ -5,6 +5,12 @@ module Devise
     module Rails
       class Engine < ::Rails::Engine
         isolate_namespace Devise::Api
+
+        # Keep raw token secrets out of the host app's request logs (tokens can arrive as
+        # query/body params when authorization.location is :params or :both)
+        initializer 'devise.api.filter_parameters' do |app|
+          app.config.filter_parameters |= %i[access_token refresh_token previous_refresh_token]
+        end
       end
     end
   end

data/lib/devise/api/responses/error_response.rb

@@ -15,6 +15,7 @@ module Devise
           sign_up_disabled
           invalid_refresh_token
           invalid_email
+          invalid_login
           invalid_resource_owner
           resource_owner_create_error
           devise_api_token_create_error
@@ -22,6 +23,15 @@ module Devise
           invalid_authentication
         ].freeze
 
+        UNAUTHORIZED_ERRORS = %i[
+          invalid_token expired_token expired_refresh_token revoked_token invalid_authentication
+        ].freeze
+
+        BAD_REQUEST_ERRORS = %i[
+          invalid_email invalid_login invalid_refresh_token refresh_token_disabled sign_up_disabled
+          invalid_resource_owner
+        ].freeze
+
         ERROR_TYPES.each do |error_type|
           method_name = error_type.end_with?('_error') ? error_type : "#{error_type}_error"
 
@@ -55,33 +65,34 @@ module Devise
 
         private
 
-        # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
         def error_description
           return [I18n.t("devise.api.error_response.#{error}")] if record.blank?
-          if invalid_authentication_error? && devise_lockable_info.present? && record.access_locked?
-            return [I18n.t('devise.api.error_response.lockable.locked')]
-          end
-          if invalid_authentication_error? && devise_confirmable_info.present? && !record.confirmed?
-            return [I18n.t('devise.api.error_response.confirmable.unconfirmed')]
-          end
-          return [I18n.t('devise.api.error_response.invalid_authentication')] if invalid_authentication_error?
+          return invalid_authentication_description if invalid_authentication_error?
 
           record.errors.full_messages
         end
-        # rubocop:enable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
 
-        def devise_lockable_info
-          unless resource_class.present? &&
-                 resource_class.supported_devise_modules.lockable? &&
-                 invalid_authentication_error?
-            return nil
+        def invalid_authentication_description
+          unless Devise.api.config.paranoid
+            return [I18n.t('devise.api.error_response.lockable.locked')] if lockable_record? && record.access_locked?
+            if confirmable_record? && !record.confirmed?
+              return [I18n.t('devise.api.error_response.confirmable.unconfirmed')]
+            end
           end
 
+          [I18n.t('devise.api.error_response.invalid_authentication')]
+        end
+
+        def devise_lockable_info
+          return nil unless verbose_account_state? && lockable_record? && invalid_authentication_error?
+
           unlock_at = record.access_locked? ? record.locked_at + ::Devise.unlock_in : nil
 
           {
             locked: record.access_locked?,
             max_attempts: ::Devise.maximum_attempts,
+            failed_attempts: record.failed_attempts,
+            # Deprecated misspelling kept for backward compatibility; will be removed in the next major release
             failed_attemps: record.failed_attempts,
             locked_at: record.locked_at,
             unlock_at: unlock_at
@@ -89,11 +100,7 @@ module Devise
         end
 
         def devise_confirmable_info
-          unless resource_class.present? &&
-                 resource_class.supported_devise_modules.confirmable? &&
-                 invalid_authentication_error?
-            return nil
-          end
+          return nil unless verbose_account_state? && confirmable_record? && invalid_authentication_error?
 
           {
             confirmed: record.confirmed?,
@@ -101,20 +108,24 @@ module Devise
           }.compact
         end
 
+        def lockable_record?
+          record.present? && resource_class.present? && resource_class.supported_devise_modules.lockable?
+        end
+
+        def confirmable_record?
+          record.present? && resource_class.present? && resource_class.supported_devise_modules.confirmable?
+        end
+
+        def verbose_account_state?
+          !Devise.api.config.paranoid && Devise.api.config.error_response.verbose_account_state
+        end
+
         def unauthorized_status?
-          invalid_token_error? ||
-            expired_token_error? ||
-            expired_refresh_token_error? ||
-            revoked_token_error? ||
-            invalid_authentication_error?
+          UNAUTHORIZED_ERRORS.include?(error)
         end
 
         def bad_request_status?
-          invalid_email_error? ||
-            invalid_refresh_token_error? ||
-            refresh_token_disabled_error? ||
-            sign_up_disabled_error? ||
-            invalid_resource_owner_error?
+          BAD_REQUEST_ERRORS.include?(error)
         end
       end
     end

data/lib/devise/api/responses/token_response.rb

@@ -41,15 +41,19 @@ module Devise
             refresh_token: Devise.api.config.refresh_token.enabled ? token.refresh_token : nil,
             expires_in: token.expires_in,
             token_type: ::Devise.api.config.authorization.scheme,
-            resource_owner: {
-              id: resource_owner.id,
-              email: resource_owner.email,
-              created_at: resource_owner.created_at,
-              updated_at: resource_owner.updated_at
-            }
+            resource_owner: default_resource_owner
           }.compact
         end
 
+        def default_resource_owner
+          keys_to_extract = %i[id email created_at updated_at]
+          if Devise.api.config.sign_up.extra_fields.present?
+            keys_to_extract |= Devise.api.config.sign_up.extra_fields.map(&:to_sym)
+          end
+
+          resource_owner.slice(*keys_to_extract)
+        end
+
         def status
           return :created if sign_up_action?
           return :no_content if revoke_action?
@@ -62,7 +66,11 @@ module Devise
         def signed_up_body
           return default_body unless resource_owner.class.supported_devise_modules.confirmable?
 
-          message = resource_owner.confirmed? ? nil : I18n.t('devise.api.registerable.signed_up_but_unconfirmed')
+          message = if resource_owner.confirmed?
+                      nil
+                    else
+                      I18n.t('devise.api.error_response.registerable.signed_up_but_unconfirmed')
+                    end
 
           default_body.merge(confirmable: { confirmed: resource_owner.confirmed?, message: message }.compact)
         end

data/lib/devise/api/token.rb

@@ -7,6 +7,10 @@ module Devise
     class Token < ::ActiveRecord::Base
       self.table_name = 'devise_api_tokens'
 
+      # Redact raw token secrets from #inspect / pretty_print output (see also the
+      # devise.api.filter_parameters engine initializer for request-log filtering)
+      self.filter_attributes += %i[access_token refresh_token previous_refresh_token]
+
       # associations
       belongs_to :resource_owner,
                  polymorphic: true,
@@ -36,6 +40,21 @@ module Devise
         revoked_at.present?
       end
 
+      def revoke!
+        return self if revoked?
+
+        update!(revoked_at: Time.current)
+        self
+      end
+
+      # Revokes every token in this token's refresh chain (ancestors and descendants). Used for
+      # refresh-token reuse detection when refresh_token.rotation_enabled is on.
+      def revoke_family!
+        transaction do
+          family_tokens.each(&:revoke!)
+        end
+      end
+
       def active?
         !inactive?
       end
@@ -47,13 +66,13 @@ module Devise
       def expired?
         return false if Devise.api.config.access_token.expires_in_infinite.call(resource_owner)
 
-        !!(expires_in && Time.now.utc > expires_at)
+        !!(expires_in && Time.current > expires_at)
       end
 
       def refresh_token_expired?
         return false if Devise.api.config.refresh_token.expires_in_infinite.call(resource_owner)
 
-        Time.now.utc > refresh_token_expires_at
+        Time.current > refresh_token_expires_at
       end
 
       def self.generate_uniq_access_token(resource_owner)
@@ -83,6 +102,19 @@ module Devise
       def refresh_token_expires_at
         created_at + Devise.api.config.refresh_token.expires_in.seconds
       end
+
+      def family_tokens
+        root = self
+        root = root.previous_refresh while root.previous_refresh.present?
+
+        tokens = []
+        queue = [root]
+        while (token = queue.shift)
+          tokens << token
+          queue.concat(token.refreshes.to_a)
+        end
+        tokens
+      end
     end
   end
 end

data/lib/devise/api/version.rb

@@ -2,6 +2,6 @@
 
 module Devise
   module Api
-    VERSION = '0.1.3'
+    VERSION = '0.3.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise-api
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.3.0
 platform: ruby
 authors:
 - nejdetkadir
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-08-08 00:00:00.000000000 Z
+date: 2026-08-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: devise
@@ -113,9 +113,13 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".claude/commands/commit.md"
+- ".claude/commands/create-branch.md"
+- ".claude/commands/create-pr.md"
 - ".rspec"
 - ".rubocop.yml"
 - CHANGELOG.md
+- CLAUDE.md
 - CODE_OF_CONDUCT.md
 - Gemfile
 - Gemfile.lock
@@ -132,6 +136,17 @@ files:
 - app/services/devise/api/tokens_service/revoke.rb
 - config/locales/en.yml
 - devise-api.gemspec
+- docs/README.md
+- docs/analysis/known-issues.md
+- docs/analysis/security-review.md
+- docs/api-reference.md
+- docs/architecture.md
+- docs/configuration.md
+- docs/data-model.md
+- docs/development.md
+- docs/extending.md
+- docs/services.md
+- docs/testing.md
 - lib/devise/api.rb
 - lib/devise/api/configuration.rb
 - lib/devise/api/controllers/helpers.rb
@@ -143,7 +158,6 @@ files:
 - lib/devise/api/responses/token_response.rb
 - lib/devise/api/token.rb
 - lib/devise/api/version.rb
-- sig/devise/api.rbs
 homepage: https://github.com/nejdetkadir/devise-api
 licenses:
 - MIT
@@ -166,7 +180,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.12
+rubygems_version: 3.4.19
 signing_key:
 specification_version: 4
 summary: The devise-api gem is a convenient way to add authentication to your Ruby

data/sig/devise/api.rbs

@@ -1,6 +0,0 @@
-module Devise
-  module Api
-    VERSION: String
-    # See the writing guide of rbs: https://github.com/ruby/rbs#guides
-  end
-end