forget-passwords 0.2.12 → 0.2.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a3215dc2df30a7f53896530fe46e576ccc68e69a9bdeb9dfdcc1d8d55f482077
-  data.tar.gz: 56479273ba73c937bda4449b3a9ebbae2aa41736cf8e01bc58c3c209f3179b51
+  metadata.gz: 4db3ce83ab06fe2e7ba9fbf453370f1182e8fc6e7f888e1edd2851e1eb4dfe1a
+  data.tar.gz: '049d12c72b928352235e422c2c737a7c7827d5284a68054ea09f50c7d3a962d0'
 SHA512:
-  metadata.gz: 4c95ee03bc4b33e7bce7ef05ea11633defac41664eecec042b0ff15ccdd2ef5dbd95ad3faa9336e9f2dcbd583adf0db4cf1674a585007027a31c73d3a732e9b9
-  data.tar.gz: 4f98e7c9feb6fd09470c93f820ff5aca5bdfaa27a4e845e6a8efb484cde2ff319224cb3a18435c805ac4998f0ad1f6975d22c8ccb813e76343beadc981625de3
+  metadata.gz: 2d3bc2353a0b41009cb7b537a67bc58210670095949afbe21ada7221912c3d6a91c580240d56803b159a32a73c3d4e1c756f7b34c288879be61f842740c6bf20
+  data.tar.gz: 3c7771eb7709deeeca3c7617be519168d6387c619b5e0de0a61243905bb8a4f5a9a2667ab6a63ada192c962a426301e2d83400a5370dc212aaa7e2ee1f69eefb

data/README.md

@@ -524,6 +524,15 @@ email:
   # additional SMTP configuration would go here, if applicable.
 ```
 
+## Alternate Authentication Methods
+
+It is possible to take the token in the cookie and feed it in as
+either a `Basic` authentication password or `Bearer` token. In the
+case of `Basic`, the username is ignored. This enables `curl` or API
+access, or other automated things like feed readers. There is
+currently no UI for this, but an "app password" management screen is
+potentially on the horizon.
+
 ## Future Directions
 
 This project began on something of a lark, with the intent to make a

data/lib/forget-passwords/version.rb

@@ -1,3 +1,3 @@
 module ForgetPasswords
-  VERSION = '0.2.12'
+  VERSION = '0.2.13'
 end

data/lib/forget-passwords.rb

@@ -11,6 +11,7 @@ require 'rack'
 require 'rack/request'
 require 'rack/response'
 
+require 'base64'
 require 'mail'
 
 module ForgetPasswords
@@ -531,17 +532,20 @@ module ForgetPasswords
     end
 
     def handle_auth req
-      if auth = req.get_header('Authorization')
-        token = if req.basic?
-                  # auto-decodes (XXX do we care about the username??)
-                  req.credentials.last
-                elsif auth.strip.downcase.start_with? 'bearer'
-                  auth.strip.split[1]
+      auth = req.get_header('Authorization') || req.env['HTTP_AUTHORIZATION']
+      if auth and !auth.strip.empty?
+        mech, *auth = auth.strip.split
+        token = case mech.downcase
+                when 'basic'
+                  # can't trust/use rack here
+                  Base64.decode64(auth.first || '').split(?:, 2).last
+                when 'bearer'
+                  auth.first
                 end
+
         if token
           handle_token req, token
         else
-          # XXX one day maybe this can be more descriptive??
           default_401 req
         end
       elsif knock = req.GET[@keys[:query]]

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: forget-passwords
 version: !ruby/object:Gem::Version
-  version: 0.2.12
+  version: 0.2.13
 platform: ruby
 authors:
 - Dorian Taylor
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2022-12-07 00:00:00.000000000 Z
+date: 2022-12-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler