devise-passwordless 1.0.0 → 1.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8c2ccc142bc114ca58125c72ea17c9646a6bd602d2a70e99de49b6412df12950
-  data.tar.gz: 7682b97e852e56559ef5babf8bf4f9e0c323083a32b3e16f8d932976e3204aea
+  metadata.gz: 897ecbae9b1eab423447003362253109504478955ae120b2fb81602e78d83d0a
+  data.tar.gz: 892716d7fe7fda88cb153ed9eb561b47272081e066f34720a3a567812c653435
 SHA512:
-  metadata.gz: 4ac233d2eff38815cca3fadbe0c5b84e919b6129e7e763f30fb18cb5e75b095d10362126e8448fed612dad292463a997d82b36c8ffcb8b95252aacc20db5e46d
-  data.tar.gz: 4feb6345e80a8f2a0ea37527f7926cbff412e70a6bfda8a35166cc686f7eef0bb28d8a63a3702c59ac5ccbba308ca2386ec86e083d748e57bd6fdcdd176f49b1
+  metadata.gz: 4cd0fe91740b1fdd19b68de208ed790c46336e87ead4515ba71775e214edd4b25ee46ca62e311f6573e93be44f7ef644811cf5ed9b66081a24eb76690db7dde7
+  data.tar.gz: 44bb12db02ea4d0fcf9867edbce48a93a5f836df0e15ec89aa2fd71a9b5fd9070d42dc8300b7a9c6ab5251bad68a95676997667cf0c0b33a422181262b21fc78

data/CHANGELOG.md

@@ -1,4 +1,10 @@
-## 1.0.0
+## 1.0.1 - Sep 18, 2023
+
+### Bugfixes
+
+* Fixed bug where `filter_parameters` check erred on regex keys ([#39] - thanks [@thimo]!)
+
+## 1.0.0 - Sep 15, 2023
 
 ### Enhancements
 
@@ -32,6 +38,7 @@
 [@iainbeeston]: https://github.com/iainbeeston
 [@joeyparis]: https://github.com/joeyparis
 [@JoeyLeadJig]: https://github.com/JoeyLeadJig
+[@thimo]: https://github.com/thimo
 [@til]: https://github.com/til
 
 [#13]: https://github.com/abevoelker/devise-passwordless/issues/13
@@ -42,3 +49,4 @@
 [#27]: https://github.com/abevoelker/devise-passwordless/pull/27
 [#33]: https://github.com/abevoelker/devise-passwordless/pull/33
 [#36]: https://github.com/abevoelker/devise-passwordless/pull/36
+[#39]: https://github.com/abevoelker/devise-passwordless/issues/39

data/README.md

@@ -119,9 +119,10 @@ config.passwordless_tokenizer = "SignedGlobalIDTokenizer"
 # generate your own secret value with e.g. `rake secret`
 # config.passwordless_secret_key = nil
 
-# When using the :trackable module, set to true to consider magic link tokens
-# generated before the user's current sign in time to be expired. In other words,
-# each time you sign in, all existing magic links will be considered invalid.
+# When using the :trackable module and MessageEncryptorTokenizer, set to true to 
+# consider magic link tokens generated before the user's current sign in time to 
+# be expired. In other words, each time you sign in, all existing magic links 
+# will be considered invalid.
 # config.passwordless_expire_old_tokens_on_sign_in = false
 ```
 
@@ -233,12 +234,12 @@ you can write something like this:
 
 ```ruby
 class ApplicationController < ActionController::Base
-  def after_magic_link_sent_path_for(resource)
-    case resource.class
-    when FooUser
-      happy_path
-    when BarUser
-      sad_path
+  def after_magic_link_sent_path_for(resource_or_scope)
+    case Devise::Mapping.find_scope!(resource_or_scope)
+    when :user
+      some_path
+    when :admin
+      some_other_path
     end
   end
 end

data/app/mailers/devise/passwordless/mailer.rb

@@ -7,6 +7,7 @@ if defined?(ActionMailer)
         def magic_link(record, token, remember_me, opts = {})
           @token = token
           @remember_me = remember_me
+          @opts = opts
           devise_mail(record, :magic_link, opts)
         end
       end

data/lib/devise/hooks/magic_link_authenticatable.rb

@@ -2,7 +2,7 @@
 
 # Deny user access when magic link authentication is disabled
 Warden::Manager.after_set_user do |record, warden, options|
-  if record && record.respond_to?(:active_for_magic_link_authentication?) && !record.active_for_magic_link_authentication?
+  if record && record.respond_to?(:active_for_magic_link_authentication?) && !record.active_for_magic_link_authentication? && warden.winning_strategy.is_a?(Devise::Strategies::MagicLinkAuthenticatable)
     scope = options[:scope]
     warden.logout(scope)
     throw :warden, scope: scope, message: record.magic_link_inactive_message

data/lib/devise/passwordless/rails.rb

@@ -14,12 +14,7 @@ module Devise::Passwordless
     initializer "devise_passwordless.log_filter_check" do
       params = Rails.try(:application).try(:config).try(:filter_parameters) || []
 
-      unless params.map(&:to_sym).include?(:token)
-        warn "[DEVISE-PASSWORDLESS] We have detected that your Rails configuration does not " \
-              "filter :token parameters out of your logs. You should append :token to your " \
-              "config.filter_parameters Rails setting so that magic link tokens don't " \
-              "leak out of your logs."
-      end
+      ::Devise::Passwordless.check_filter_parameters(params)
     end
   end
 end

data/lib/devise/passwordless/version.rb

@@ -2,6 +2,6 @@
 
 module Devise
   module Passwordless
-    VERSION = "1.0.0"
+    VERSION = "1.0.2"
   end
 end

data/lib/devise/passwordless.rb

@@ -23,5 +23,21 @@ module Devise
         Devise.secret_key
       end
     end
+
+    FILTER_PARAMS_WARNING = "[DEVISE-PASSWORDLESS] We have detected that your Rails configuration does not " \
+                            "filter :token parameters out of your logs. You should append :token to your " \
+                            "config.filter_parameters Rails setting so that magic link tokens don't " \
+                            "leak out of your logs."
+
+    def self.check_filter_parameters(params)
+      begin
+        unless params.find{|p| p.to_sym == :token}
+          warn FILTER_PARAMS_WARNING
+        end
+      # Cancel the check if filter_parameters contains regular expressions or other exotic values
+      rescue NoMethodError
+        return
+      end
+    end
   end
 end

data/lib/generators/devise/passwordless/install_generator.rb

@@ -33,9 +33,10 @@ module Devise::Passwordless
           # generate your own secret value with e.g. `rake secret`
           # config.passwordless_secret_key = nil
 
-          # When using the :trackable module, set to true to consider magic link tokens
-          # generated before the user's current sign in time to be expired. In other words,
-          # each time you sign in, all existing magic links will be considered invalid.
+          # When using the :trackable module and MessageEncryptorTokenizer, set to true to
+          # consider magic link tokens generated before the user's current sign in time to
+          # be expired. In other words, each time you sign in, all existing magic links
+          # will be considered invalid.
           # config.passwordless_expire_old_tokens_on_sign_in = false
         CONFIG
         end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise-passwordless
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.2
 platform: ruby
 authors:
 - Abe Voelker
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-09-15 00:00:00.000000000 Z
+date: 2024-04-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: devise
@@ -101,7 +101,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.10
+rubygems_version: 3.4.19
 signing_key: 
 specification_version: 4
 summary: Passwordless (email-only) login strategy for Devise