forget-passwords 0.2.12 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a3215dc2df30a7f53896530fe46e576ccc68e69a9bdeb9dfdcc1d8d55f482077
-  data.tar.gz: 56479273ba73c937bda4449b3a9ebbae2aa41736cf8e01bc58c3c209f3179b51
+  metadata.gz: dacb56a002005cc14bb46809690604cccd905eee5c5fc8c5efb78557629611e6
+  data.tar.gz: 704b521acb64f33a934c8768e8bc1496a86ae55d27a0598f4172a7ddc6c8d0e0
 SHA512:
-  metadata.gz: 4c95ee03bc4b33e7bce7ef05ea11633defac41664eecec042b0ff15ccdd2ef5dbd95ad3faa9336e9f2dcbd583adf0db4cf1674a585007027a31c73d3a732e9b9
-  data.tar.gz: 4f98e7c9feb6fd09470c93f820ff5aca5bdfaa27a4e845e6a8efb484cde2ff319224cb3a18435c805ac4998f0ad1f6975d22c8ccb813e76343beadc981625de3
+  metadata.gz: 1e79d40cbf1151f1a6fb056e17e90f022f65cf575e9eac4a2d1931b4c9c32723924a7e27f83ec893acbafa46710c6da68de3e2791005066ba74eea2a880f0f39
+  data.tar.gz: c306b865ed182f590338d26a7a41a165c38626519dbfc627b77fac4f8a271f7a9d83274a10ec8ae7629a9992407fe92524a4b2a9eb5e4c74ebf1b3b5907e67de

data/README.md

@@ -524,6 +524,15 @@ email:
   # additional SMTP configuration would go here, if applicable.
 ```
 
+## Alternate Authentication Methods
+
+It is possible to take the token in the cookie and feed it in as
+either a `Basic` authentication password or `Bearer` token. In the
+case of `Basic`, the username is ignored. This enables `curl` or API
+access, or other automated things like feed readers. There is
+currently no UI for this, but an "app password" management screen is
+potentially on the horizon.
+
 ## Future Directions
 
 This project began on something of a lark, with the intent to make a
@@ -569,9 +578,11 @@ favourite flavour of templating engine.
 
 ### Reconcile with OAuth
 
-The authentication cookie used by Forget Passwords bears a striking
-resemblance to an [OAuth](https://oauth.net/) bearer token, such that
-could actually _be_ (at least a proxy for) an OAuth bearer token.
+Let's face it: this thing is 98% of what [OAuth](https://oauth.net/)
+does: it trades one token for another over a more-or-less secure side
+channel. It could be made a heck of a lot simpler by just…wrapping
+OAuth.
+
 Indeed, bearer tokens would make for an _excellent_ cleavage plane for
 _segmented_ authentication: Method X to bearer token, then bearer
 token to `REMOTE_USER`. This means we could have multiple

data/lib/forget-passwords/template.rb

@@ -4,6 +4,7 @@ require 'xml-mixup'
 require 'http-negotiate'
 require 'forget-passwords/types'
 require 'uri'
+require 'time'
 
 module ForgetPasswords
 
@@ -18,6 +19,8 @@ module ForgetPasswords
       DEFAULT_PATH = (
         Pathname(__FILE__).parent + '../../content').expand_path.freeze
 
+      # this is a default document root subpath
+      DEFAULT_DOCROOT = '.forgetpw'.freeze
 
       # Normalize the input to symbol `:like_this`.
       #
@@ -57,21 +60,67 @@ module ForgetPasswords
         @path      = Pathname(path).expand_path
         @base      = base
         @transform = transform
-        @mapping   = mapping.map do |k, v|
-          name = normalize k
-          template = v.is_a?(ForgetPasswords::Template) ? v :
-            ForgetPasswords::Template.new(self, k, @path + v)
-          [name, template]
-        end.to_h
+        @mapping   = mapping
+        @templates = {
+          @path => mapping.map do |k, v|
+            name = normalize k
+            template = v.is_a?(ForgetPasswords::Template) ? v :
+              ForgetPasswords::Template.new(self, k, @path + v)
+            [name, template]
+          end.to_h
+        }
       end
 
-      def [] key
-        @mapping[normalize key]
+      # Fetch the appropriate template, optionally relative to a given root.
+      #
+      # @param key [Symbol, #to_sym] the template key.
+      # @param root [nil, String] an optional document root.
+      #
+      # @return [nil, ForgetPasswords::Template] a template
+      #
+      def [] key, root = nil
+        key = normalize key
+        # bail early if we don't know the key
+        return unless @mapping[key]
+
+        # obtain optional root
+        root = if root
+                 r = root.respond_to?(:env) ? root.env['DOCUMENT_ROOT'] : root
+                 r = (Pathname(r) + DEFAULT_DOCROOT).expand_path
+                 r.readable? ? r : nil
+               end
+
+        if root
+          # get the full file path
+          fp = root + @mapping[key]
+          if fp.readable?
+            mt       = fp.mtime
+            rootmap  = @templates[root] ||= {}
+            template = rootmap[key]
+
+            # congratulations, you found it
+            return template if template and mt <= template.modified
+
+            # XXX this could explode obvs
+            begin
+              template = ForgetPasswords::Template.new(self, key, fp, mt)
+              rootmap[key] = template
+              return template
+            rescue
+              # XXX duhh what do we do here
+              nil
+            end
+          end
+        end
+
+        # otherwise just return the default
+        @templates[@path][key]
       end
 
       def []= key, path
         name = normalize key
-        @mapping[name] = path.is_a?(ForgetPasswords::Template) ? path :
+        # XXX do something less dumb here
+        @templates[@path][name] = path.is_a?(ForgetPasswords::Template) ? path :
           ForgetPasswords::Template.new(self, key, @path + path)
       end
 
@@ -132,12 +181,13 @@ module ForgetPasswords
 
     public
 
-    attr_reader :name, :doc, :mapper
+    attr_reader :name, :doc, :mapper, :modified
 
-    def initialize mapper, name, content
+    def initialize mapper, name, content, modified = Time.now
       # boring members
-      @mapper = mapper
-      @name   = name
+      @mapper   = mapper
+      @name     = name
+      @modified = modified
 
       # resolve content
       @doc = case content
@@ -253,6 +303,7 @@ module ForgetPasswords
     # @return [Rack::Response] the response object, updated in place
     #
     def populate resp, headers = {}, vars = {}, base: nil
+
       if (body, type = serialize(
         process(vars: vars, base: base), headers, full: true))
         #resp.length = body.bytesize # not sure if necessary

data/lib/forget-passwords/version.rb

@@ -1,3 +1,3 @@
 module ForgetPasswords
-  VERSION = '0.2.12'
+  VERSION = '0.3.0'
 end

data/lib/forget-passwords.rb

@@ -11,6 +11,7 @@ require 'rack'
 require 'rack/request'
 require 'rack/response'
 
+require 'base64'
 require 'mail'
 
 module ForgetPasswords
@@ -310,7 +311,7 @@ module ForgetPasswords
       }
 
       # grab the template since we'll use it
-      template = @templates[:email]
+      template = @templates[:email, req]
 
       # process the templates
       doc = template.process vars: vars
@@ -335,7 +336,7 @@ module ForgetPasswords
       uri = req_uri req
       resp = Rack::Response.new
       resp.status = status
-      @templates[key].populate resp, req, vars, base: uri
+      @templates[key, req].populate resp, req, vars, base: uri
       resp.set_header "Variable-#{@vars[:type]}", resp.content_type
       raise ForgetPasswords::ErrorResponse, resp
     end
@@ -346,7 +347,7 @@ module ForgetPasswords
       uri  = req_uri req
       resp = Rack::Response.new
       resp.status = 401
-      @templates[:default_401].populate resp, req, {
+      @templates[:default_401, req].populate resp, req, {
         FORWARD: req_uri(req).to_s, LOGIN: @targets[:login] }, base: uri
       resp.set_header "Variable-#{@vars[:type]}", resp.content_type
       resp
@@ -385,7 +386,7 @@ module ForgetPasswords
         target != uri # (note this should always be true)
       resp.set_cookie @keys[:cookie], {
         value: token, secure: req.ssl?, httponly: true,
-        domain: uri.host, path: ?/, same_site: :strict,
+        domain: uri.host, path: ?/, same_site: :lax, # strict is too strict
         expires: time_delta(@state.expiry[:cookie]),
       }
 
@@ -443,7 +444,7 @@ module ForgetPasswords
       # update the cookie expiration
       resp.set_cookie @keys[:cookie], {
         value: token, secure: req.ssl?, httponly: true,
-        domain: uri.host, path: ?/, same_site: :strict,
+        domain: uri.host, path: ?/, same_site: :lax, # strict is too strict
         expires: time_delta(@state.expiry[:cookie], now),
       }
 
@@ -494,7 +495,7 @@ module ForgetPasswords
 
       # return 200 now because this is now a content handler
       resp.status = 200
-      @templates[:email_sent].populate resp, req, {
+      @templates[:email_sent, req].populate resp, req, {
         FORWARD: forward.to_s, FROM: @email[:from].to_s, EMAIL: address.to_s },
         base: uri
     end
@@ -531,27 +532,33 @@ module ForgetPasswords
     end
 
     def handle_auth req
-      if auth = req.get_header('Authorization')
-        token = if req.basic?
-                  # auto-decodes (XXX do we care about the username??)
-                  req.credentials.last
-                elsif auth.strip.downcase.start_with? 'bearer'
-                  auth.strip.split[1]
+      auth = req.get_header('Authorization') || req.env['HTTP_AUTHORIZATION']
+      if auth and !auth.strip.empty?
+        # warn "has authorization header #{auth}"
+        mech, *auth = auth.strip.split
+        token = case mech.downcase
+                when 'basic'
+                  # can't trust/use rack here
+                  Base64.decode64(auth.first || '').split(?:, 2).last
+                when 'bearer'
+                  auth.first
                 end
+
         if token
           handle_token req, token
         else
-          # XXX one day maybe this can be more descriptive??
           default_401 req
         end
       elsif knock = req.GET[@keys[:query]]
-        # check for a knock first; this overrides everything
+        # check for a knock; this overrides an existing cookie
+        # warn "has knock token #{knock}"
         handle_knock req, knock
       # elsif req.post?
       #  # next check for a login/logout attempt
       #  handle_post req
       elsif token = req.cookies[@keys[:cookie]]
         # next check for a cookie
+        # warn "has cookie #{token}"
         handle_cookie req, token
       else
         default_401 req

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: forget-passwords
 version: !ruby/object:Gem::Version
-  version: 0.2.12
+  version: 0.3.0
 platform: ruby
 authors:
 - Dorian Taylor
-autorequire:
+autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-12-07 00:00:00.000000000 Z
+date: 2023-03-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -290,7 +290,7 @@ homepage: https://github.com/doriantaylor/rb-forget-passwords
 licenses:
 - Apache-2.0
 metadata: {}
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -305,8 +305,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.11
-signing_key:
+rubygems_version: 3.1.2
+signing_key: 
 specification_version: 4
 summary: Web authentication module for the extremely lazy
 test_files: []