devise-sqrl 0.1.1 → 0.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +37 -4
- data/README.md +9 -3
- metadata +3 -3
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: d9e4316db02a315eebe3f8808e1b54ab075077ed526b9d09d40208f23290f858
|
|
4
|
+
data.tar.gz: 71417ae549c98e190ed119d01f165945f831619f2d371ddfdfb827c8485677d1
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: abbd1483ed159a7df0c483438dda0dceea2c98a22f73e57138c48874c8a7faee10ec7c4606d5a481db9a9482be14c65294e0176dcfaf2700b5e1d65581480713
|
|
7
|
+
data.tar.gz: 7ae83ebc0fdf74a74fe93215efd0d19261df34a0bb62044f089da49401a10023f7f3ad0d627a87bf9ec9ddad7f90cb26583d02de28e1fbc3faa2ca8d6d1b11c6
|
data/CHANGELOG.md
CHANGED
|
@@ -1,14 +1,42 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
All notable changes to `devise-sqrl` are documented in this file.
|
|
4
4
|
|
|
5
|
-
|
|
6
|
-
|
|
5
|
+
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this
|
|
6
|
+
project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Every gem in
|
|
7
|
+
the family shares one version number and is released in lockstep.
|
|
7
8
|
|
|
8
|
-
##
|
|
9
|
+
## [Unreleased]
|
|
10
|
+
|
|
11
|
+
## [0.1.2] - 2026-10-21
|
|
12
|
+
|
|
13
|
+
### Changed
|
|
14
|
+
|
|
15
|
+
- Requires sqrl-rails 0.1.2, and through it sqrl-core and sqrl-rack 0.1.2. sqrl-core fixes
|
|
16
|
+
binary S4 identity files whose last byte is whitespace being truncated on parse and brings
|
|
17
|
+
the server into line with Steve Gibson's final specification (`suk=` on every command, the
|
|
18
|
+
post-update TIF after a re-key, `url=` on a CPS `disable`, and more). No code changes in
|
|
19
|
+
this gem.
|
|
20
|
+
|
|
21
|
+
### Security
|
|
22
|
+
|
|
23
|
+
- Through sqrl-rack 0.1.2, a login the SQRL client completed in CPS mode can no longer be
|
|
24
|
+
completed through the browser's status poll; only the browser holding the one-time
|
|
25
|
+
`url=` token is signed in, as the specification requires.
|
|
26
|
+
|
|
27
|
+
## [0.1.1] - 2026-10-20
|
|
28
|
+
|
|
29
|
+
### Changed
|
|
30
|
+
|
|
31
|
+
- Requires sqrl-core 0.1.1, which fixes the `NoMethodError` on Ruby 3.1 and 3.2. No other
|
|
32
|
+
changes.
|
|
33
|
+
|
|
34
|
+
## [0.1.0] - 2026-10-20
|
|
9
35
|
|
|
10
36
|
First release.
|
|
11
37
|
|
|
38
|
+
### Added
|
|
39
|
+
|
|
12
40
|
- `devise :sqrl_authenticatable`: routes under the mapping (`/users/sqrl`, `cli`, `status`,
|
|
13
41
|
`callback`, `sqrl.js`, `refresh`, `identities`), a Warden strategy that signs in through
|
|
14
42
|
Devise's own hooks (trackable, rememberable, activatable), a controller, views and a
|
|
@@ -19,3 +47,8 @@ First release.
|
|
|
19
47
|
- Identity management under the mapping; `ask` with deny button; 429/400 handling for
|
|
20
48
|
rate-limit hooks and disallowed hosts.
|
|
21
49
|
- Requires Ruby 3.2+, Devise 4.9 or 5.0, Rails 7.1 to 8.1, and `sqrl-rails`.
|
|
50
|
+
|
|
51
|
+
[Unreleased]: https://github.com/danielpclark/sqrl-ruby/compare/v0.1.2...HEAD
|
|
52
|
+
[0.1.2]: https://github.com/danielpclark/sqrl-ruby/compare/v0.1.1...v0.1.2
|
|
53
|
+
[0.1.1]: https://github.com/danielpclark/sqrl-ruby/compare/v0.1.0...v0.1.1
|
|
54
|
+
[0.1.0]: https://github.com/danielpclark/sqrl-ruby/releases/tag/v0.1.0
|
data/README.md
CHANGED
|
@@ -40,6 +40,7 @@ end
|
|
|
40
40
|
| `GET /users/sqrl/sqrl.js` | the browser-side script |
|
|
41
41
|
| `GET /users/sqrl/refresh` | a fresh login URL for the page (JSON) |
|
|
42
42
|
| `GET /users/sqrl/identities` | the signed-in user's identities, with Unlink |
|
|
43
|
+
| `DELETE /users/sqrl/identities/:id` | unlink one identity |
|
|
43
44
|
|
|
44
45
|
## How a login completes
|
|
45
46
|
|
|
@@ -76,11 +77,12 @@ Protocol and storage settings live in `Rails.application.config.sqrl` (see
|
|
|
76
77
|
|
|
77
78
|
```ruby
|
|
78
79
|
Devise.setup do |config|
|
|
79
|
-
config.sqrl_on_unknown_identity = :create # :create
|
|
80
|
+
config.sqrl_on_unknown_identity = :create # :create, :link or :refuse; nil (default) defers to config.sqrl (:create)
|
|
80
81
|
config.sqrl_create_resource = ->(identity, klass) { klass.new(email: "...", password: SecureRandom.hex(32)) }
|
|
81
82
|
config.sqrl_remember_me = false # treat SQRL logins as "remember me"
|
|
82
83
|
config.sqrl_login_block = { link_text: "Sign in with SQRL" }
|
|
83
84
|
config.sqrl_failure_path = nil # default: the scope's SQRL login page
|
|
85
|
+
config.sqrl_only_blocked_strategies = [:database_authenticatable] # refused for sqrlonly users
|
|
84
86
|
end
|
|
85
87
|
```
|
|
86
88
|
|
|
@@ -145,11 +147,15 @@ under the Devise scope.
|
|
|
145
147
|
The [sqrl-client](../sqrl-client) gem logs in without a browser:
|
|
146
148
|
|
|
147
149
|
```ruby
|
|
148
|
-
|
|
149
|
-
|
|
150
|
+
transport = SQRL::Client::Transport.new(ca_file: "cert.pem") # the certificate you gave bin/dev via SQRL_TLS_CERT
|
|
151
|
+
agent = SQRL::Client::Agent.new(identity: SQRL::Client::Identity.ephemeral, transport: transport)
|
|
152
|
+
result = agent.login("https://127.0.0.1:3000/users/sign_in")
|
|
150
153
|
result.authenticated? # => true; result.cookies carries the Devise session
|
|
151
154
|
```
|
|
152
155
|
|
|
156
|
+
Against a server started with `SQRL_INSECURE_HTTP=1` (plain http on localhost), use
|
|
157
|
+
`Agent.new(identity:, insecure: true)` and an `http://` URL instead.
|
|
158
|
+
|
|
153
159
|
See [`examples/devise-app`](../../examples/devise-app) for a complete application;
|
|
154
160
|
`bundle exec rake spec:devise-sqrl` runs this gem's specs against an in-gem dummy app.
|
|
155
161
|
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: devise-sqrl
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.1.
|
|
4
|
+
version: 0.1.2
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Daniel P. Clark
|
|
@@ -35,14 +35,14 @@ dependencies:
|
|
|
35
35
|
requirements:
|
|
36
36
|
- - "~>"
|
|
37
37
|
- !ruby/object:Gem::Version
|
|
38
|
-
version: 0.1.
|
|
38
|
+
version: 0.1.2
|
|
39
39
|
type: :runtime
|
|
40
40
|
prerelease: false
|
|
41
41
|
version_requirements: !ruby/object:Gem::Requirement
|
|
42
42
|
requirements:
|
|
43
43
|
- - "~>"
|
|
44
44
|
- !ruby/object:Gem::Version
|
|
45
|
-
version: 0.1.
|
|
45
|
+
version: 0.1.2
|
|
46
46
|
email:
|
|
47
47
|
- 6ftdan@gmail.com
|
|
48
48
|
executables: []
|