devise-argon2 2.0.1 → 2.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d036bff0c949c49457df0df4a4ac902d4ed0e65e84fd26f2940bfcc973b6bcc3
-  data.tar.gz: 82024dfd476f476514c5548b4aac5a93c49ffffad6fe33252c153381d0b803c1
+  metadata.gz: 4d16c11636eaa7c98ef99536fdb71ed654c7ec37d9fbc9c1b16fa9da33b0a462
+  data.tar.gz: 208892689f1d8702ac262b4bd40dda7631102932c88d90b0be3e79290999ea0e
 SHA512:
-  metadata.gz: fb3857086fc9f31fd22bec613c3fe9e93534234036db242c49b1e5aae6ac9340611916e62ec92f84e67b8fafe97610b6d947c98df7846e62d91d9e550586689b
-  data.tar.gz: b7e523688dab140c94d9aed10232a57a1dcb144b437073d8ec41952fe0595f8713215d5ed9658701927f50182d2cf49adb0fd7bc5792d21255edaf70ffa603f5
+  metadata.gz: 305e754064c5b079e9a96fc921c3907b712514b42f1ce63cc58e19e3f55c1008ba6ca5b85ea3bbd272e71cfe3219321a5966168529f50a440d544afde385c3ad
+  data.tar.gz: '0292c12e1fef0d399574181f76bc10b33b73fc122a579de94446f7f633e0ff597e4395f52c65e611dfedb6d7494c817835ffbd63aa4a757f408de793bfd55005'

data/.github/workflows/test.yml

@@ -1,61 +1,96 @@
 name: Test suite
 
-on: [push, pull_request]
+on: [push, pull_request, workflow_dispatch]
 
 jobs:
   test:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        ruby-version: ['2.7', '3.0', '3.1', '3.2', 'ruby-head']
-        rails-version: ['~> 7.0', '~> 6.1']
+        ruby-version: ['2.7', '3.0', '3.1', '3.2', '3.3', '3.4']
+        rails-version: ['~> 6.1', '~> 7.0', '~> 7.1', '~> 7.2', '~> 8.0']
         argon2-version: ['2.2', '2.3']
         orm:
           - adapter: active_record
           - adapter: mongoid
-            mongoid-version: 8.1.2
+            mongoid-version: 9.0.2
           - adapter: mongoid
-            mongoid-version: 8.0.6
+            mongoid-version: 8.1.6
+          - adapter: mongoid
+            mongoid-version: 8.0.8
           - adapter: mongoid
             mongoid-version: 7.5.4
-        include:
-          - rails-version: '~> 6.1'
+        exclude:
+          - rails-version: '~> 7.2'
+            ruby-version: '2.7'
+          - rails-version: '~> 7.2'
+            ruby-version: '3.0'
+          - rails-version: '~> 8.0'
+            ruby-version: '2.7'
+          - rails-version: '~> 8.0'
+            ruby-version: '3.0'
+          - rails-version: '~> 8.0'
             ruby-version: '3.1'
-            argon2-version: '2.3'
-            devise-version: '4.8'
-            orm:
-              adapter: active_record
-          - rails-version: '~> 7.1'
-            ruby-version: '3.1'
-            argon2-version: '2.3'
-            devise-version: '4.9'
-            orm:
-              adapter: active_record
-          - rails-version: '~> 7.1'
+          - rails-version: '~> 6.1'
+            ruby-version: '3.4'
+          - orm:
+              adapter: mongoid
+            rails-version: '~> 8.0'
+          - orm:
+              adapter: mongoid
+              mongoid-version: 8.0.8
+            ruby-version: '3.3'
+          - orm:
+              adapter: mongoid
+              mongoid-version: 8.0.8
+            ruby-version: '3.4'
+          - orm:
+              adapter: mongoid
+              mongoid-version: 8.0.8
             ruby-version: '3.2'
-            argon2-version: '2.3'
-            devise-version: '4.9'
-            orm:
-              adapter: active_record
-          - rails-version: '~> 7.1'
-            ruby-version: '3.1'
-            argon2-version: '2.1'
-            devise-version: '4.9'
-            orm:
-              adapter: active_record
+          - orm:
+              adapter: mongoid
+              mongoid-version: 7.5.4
+            ruby-version: '3.3'
+          - orm:
+              adapter: mongoid
+              mongoid-version: 7.5.4
+            ruby-version: '3.4'
+          - orm:
+              adapter: mongoid
+              mongoid-version: 7.5.4
+            ruby-version: '3.2'
+          - orm:
+              adapter: mongoid
+              mongoid-version: 8.0.8
+            rails-version: '~> 7.2'
+          - orm:
+              adapter: mongoid
+              mongoid-version: 7.5.4
+            rails-version: '~> 7.2'
+          - orm:
+              adapter: mongoid
+              mongoid-version: 7.5.4
+            rails-version: '~> 7.1'
     env:
-      RAILS_VERSION: ${{ matrix.rails-version  || '~> 7.0'}}
-      MONGOID_VERSION: ${{ matrix.orm.mongoid-version || '8.1.2'}}
+      RAILS_VERSION: ${{ matrix.rails-version  || '~> 8.0'}}
+      MONGOID_VERSION: ${{ matrix.orm.mongoid-version || '8.1.6'}}
       ORM: ${{ matrix.orm.adapter }}
       ARGON2_VERSION: ${{ matrix.argon2-version }}
       DEVISE_VERSION: ${{ matrix.devise-version || '~> 4.9' }}
     steps:
+    - name: Login to Docker Hub
+      uses: docker/login-action@v3
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_TOKEN }}
     - uses: actions/checkout@v4
     - name: Set up Ruby ${{ matrix.ruby-version }}
       uses: ruby/setup-ruby@v1
       with:
         ruby-version: ${{ matrix.ruby-version }}
         bundler-cache: true
+        cache-version: 1
     - uses: supercharge/mongodb-github-action@1.10.0
       if: ${{ matrix.orm.adapter == 'mongoid' }}
     - name: Setup rails test environment

data/.gitignore

@@ -18,4 +18,5 @@ spec/rails_app/db/test.sqlite3*
 test/tmp
 test/version_tmp
 tmp
-.ruby-gemset
+.ruby-gemset
+.idea

data/CHANGELOG.md

@@ -1,7 +1,20 @@
-# Changelog 
+# Changelog
 
 ## Unreleased
 
+## [2.0.3] - 2025-03-23
+
+### Fixed
+- Fix bug where users would not be migrated from v1 when setting a password manually. (#21)
+
+## [2.0.2] - 2024-09-30
+
+### Changed
+- When migrating users from v1 to v2, the `encrypted_password` update will no longer trigger callbacks (ie send email to users)
+
+### Added
+- Tests for newer dependency versions
+
 ## [2.0.1] - 2023-10-18
 
 ### Added
@@ -19,12 +32,12 @@
 - Add support for migrating bcrypt hashes
 - Add tests for Mongoid
 - Add Changelog :)
- 
+
 ### Changed
 - Change salting / peppering mechanism
 - Change CI from Travis to GitHub Actions
- 
-### Removed 
+
+### Removed
 - Remove `devise-encryptable` dependency
 - Remove superflous dependency on devise `password_salt` column
 

data/Gemfile

@@ -5,11 +5,21 @@ gemspec
 gem 'rspec'
 gem 'simplecov'
 gem 'activerecord'
-gem 'sqlite3'
-gem 'rails', ENV['RAILS_VERSION'] || '~> 7.0'
+gem 'rails', ENV['RAILS_VERSION'] || '~> 8.0'
 gem 'argon2', ENV['ARGON2_VERSION'] || '~> 2.3'
 gem 'devise', ENV['DEVISE_VERSION'] || '~> 4.9'
 
 if ENV['ORM'] == 'mongoid'
   gem 'mongoid', ENV['MONGOID_VERSION'] || '~> 7.5'
 end
+
+if ENV['RAILS_VERSION'] == '~> 8.0'
+  gem 'sqlite3', '~> 2.1'
+else
+  gem 'sqlite3', '~> 1.6', '>= 1.6.6'
+end
+
+if ['~> 6.1', '~> 7.0'].include? ENV['RAILS_VERSION']
+  gem 'concurrent-ruby', '1.3.4'
+end
+

data/lib/devise-argon2/model.rb

@@ -38,6 +38,11 @@ module Devise
         is_valid
       end
 
+      def password=(new_password)
+        self.password_salt = nil if migrate_hash_from_devise_argon2_v1?
+        super
+      end
+
       protected
 
       def password_digest(password)
@@ -53,8 +58,19 @@ module Devise
         attributes = { encrypted_password: password_digest(password) }
         attributes[:password_salt] = nil if migrate_hash_from_devise_argon2_v1?
 
-        self.assign_attributes(attributes)
-        self.save if self.persisted?
+        if self.persisted?
+          update_without_callbacks(attributes)
+        else
+          self.assign_attributes(attributes)
+        end
+      end
+
+      def update_without_callbacks(attributes)
+        if defined?(Mongoid) && Mongoid.models.include?(self.class)
+          self.set(attributes)
+        else
+          self.update_columns(attributes)
+        end
       end
 
       def outdated_work_factors?

data/lib/devise-argon2/version.rb

@@ -1,5 +1,5 @@
 module Devise
   module Argon2
-    ARGON2_VERSION = '2.0.1'
+    ARGON2_VERSION = '2.0.3'
   end
 end

data/spec/devise-argon2_spec.rb

@@ -19,6 +19,7 @@ describe Devise::Models::Argon2 do
       p_cost: DEFAULT_P_COST
     }
     User.destroy_all
+    OldUser.destroy_all
   end
 
   def work_factors(hash)
@@ -127,6 +128,14 @@ describe Devise::Models::Argon2 do
       it 'does not update the hash if an invalid password is given' do
         expect{ user.valid_password?(INCORRECT_PASSWORD) }.not_to(change(user, :encrypted_password))
       end
+
+      it 'does not send password change notification emails on hash updates' do
+        user.email = 'test@example.com'
+        user.save!
+        Devise.send_password_change_notification = true
+        expect{ user.valid_password?(CORRECT_PASSWORD) }
+          .not_to(change { ActionMailer::Base.deliveries.count })
+      end
     end
 
     describe 'updating outdated work factors' do
@@ -293,4 +302,38 @@ describe Devise::Models::Argon2 do
       )
     end
   end
+
+  describe 'password reset' do
+    NEW_PASSWORD = 'new password'
+
+    shared_examples 'ways of resetting the password' do
+      it 'can be done via password_reset' do
+        user.reset_password(NEW_PASSWORD, NEW_PASSWORD)
+        expect(user.valid_password?(NEW_PASSWORD)).to be true
+      end
+
+      it 'can be done via password=' do
+        user.password = NEW_PASSWORD
+        expect(user.valid_password?(NEW_PASSWORD)).to be true
+      end
+    end
+
+    context 'encrypted_password is hashed with the current version of devise-argon2' do
+      include_examples 'ways of resetting the password'
+    end
+
+    context 'encrypted_password is hashed with version 1 of devise-argon2' do
+      let(:user) { OldUser.new(password: CORRECT_PASSWORD) }
+
+      before do
+        Devise.argon2_options.merge!({ migrate_from_devise_argon2_v1: true })
+        user.password_salt = 'devise-argon2 v1 salt'
+        user.encrypted_password = ::Argon2::Password.create(
+          "#{CORRECT_PASSWORD}#{user.password_salt}#{Devise.pepper}"
+        )
+      end
+
+      include_examples 'ways of resetting the password'
+    end
+  end
 end

data/spec/rails_app/app/active_record/old_user.rb

@@ -1,3 +1,3 @@
 class OldUser < ActiveRecord::Base
-  devise :database_authenticatable, :argon2
+  devise :database_authenticatable, :recoverable, :argon2
 end

data/spec/rails_app/app/active_record/user.rb

@@ -1,3 +1,3 @@
 class User < ActiveRecord::Base
-  devise :database_authenticatable, :argon2
+  devise :database_authenticatable, :recoverable, :argon2
 end

data/spec/rails_app/app/mongoid/old_user.rb

@@ -1,7 +1,7 @@
 class OldUser
   include Mongoid::Document
   
-  devise :database_authenticatable, :argon2
+  devise :database_authenticatable, :recoverable, :argon2
 
   field :email,              type: String, default: ""
   field :encrypted_password, type: String, default: ""

data/spec/rails_app/app/mongoid/user.rb

@@ -1,7 +1,7 @@
 class User
   include Mongoid::Document
   
-  devise :database_authenticatable, :argon2
+  devise :database_authenticatable, :recoverable, :argon2
 
   field :email,              type: String, default: ""
   field :encrypted_password, type: String, default: ""

data/spec/rails_app/config/application.rb

@@ -20,5 +20,7 @@ module DummyRailsApp
     config.eager_load = false
     config.autoload_paths.reject!{ |p| p =~ /\/app\/(\w+)$/ && !%w(controllers helpers mailers views).include?($1) }
     config.autoload_paths += ["#{config.root}/app/#{ORM}"]
+    config.action_mailer.delivery_method = :test
+    config.action_mailer.default_options = { from: 'test@example.com' }
   end
 end

data/spec/rails_app/config/routes.rb

@@ -0,0 +1,3 @@
+Rails.application.routes.draw do
+  devise_for :old_users
+end

data/spec/rails_app/db/migrate/20250319085725_add_recoverable_fields_to_users.rb

@@ -0,0 +1,6 @@
+class AddRecoverableFieldsToUsers < ActiveRecord::Migration[7.2]
+  def change
+    add_column :users, :reset_password_token, :string
+    add_column :users, :reset_password_sent_at, :datetime
+  end
+end

data/spec/rails_app/db/migrate/20250319085738_add_recoverable_fields_to_old_users.rb

@@ -0,0 +1,6 @@
+class AddRecoverableFieldsToOldUsers < ActiveRecord::Migration[7.2]
+  def change
+    add_column :old_users, :reset_password_token, :string
+    add_column :old_users, :reset_password_sent_at, :datetime
+  end
+end

data/spec/rails_app/db/schema.rb

@@ -10,13 +10,15 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2023_10_04_084147) do
+ActiveRecord::Schema.define(version: 2025_03_19_085738) do
   create_table "old_users", force: :cascade do |t|
     t.string "email", default: "", null: false
     t.string "encrypted_password", default: "", null: false
     t.string "password_salt"
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
+    t.string "reset_password_token"
+    t.datetime "reset_password_sent_at"
     t.index ["email"], name: "index_old_users_on_email", unique: true
   end
 
@@ -25,7 +27,8 @@ ActiveRecord::Schema.define(version: 2023_10_04_084147) do
     t.string "encrypted_password", default: "", null: false
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
+    t.string "reset_password_token"
+    t.datetime "reset_password_sent_at"
     t.index ["email"], name: "index_users_on_email", unique: true
   end
-
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: devise-argon2
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 2.0.3
 platform: ruby
 authors:
 - Tamas Erdos
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-10-19 00:00:00.000000000 Z
+date: 2025-03-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: devise
@@ -78,8 +78,11 @@ files:
 - spec/rails_app/config/environment.rb
 - spec/rails_app/config/initializers/devise.rb
 - spec/rails_app/config/mongoid.yml
+- spec/rails_app/config/routes.rb
 - spec/rails_app/db/migrate/20230617201921_devise_create_users.rb
 - spec/rails_app/db/migrate/20231004084147_devise_create_old_users.rb
+- spec/rails_app/db/migrate/20250319085725_add_recoverable_fields_to_users.rb
+- spec/rails_app/db/migrate/20250319085738_add_recoverable_fields_to_old_users.rb
 - spec/rails_app/db/schema.rb
 - spec/spec_helper.rb
 homepage: https://github.com/erdostom/devise-argon2
@@ -102,7 +105,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.3
+rubygems_version: 3.1.6
 signing_key: 
 specification_version: 4
 summary: Enables Devise to hash passwords with Argon2id
@@ -127,7 +130,10 @@ test_files:
 - spec/rails_app/config/environment.rb
 - spec/rails_app/config/initializers/devise.rb
 - spec/rails_app/config/mongoid.yml
+- spec/rails_app/config/routes.rb
 - spec/rails_app/db/migrate/20230617201921_devise_create_users.rb
 - spec/rails_app/db/migrate/20231004084147_devise_create_old_users.rb
+- spec/rails_app/db/migrate/20250319085725_add_recoverable_fields_to_users.rb
+- spec/rails_app/db/migrate/20250319085738_add_recoverable_fields_to_old_users.rb
 - spec/rails_app/db/schema.rb
 - spec/spec_helper.rb