minimalist_authentication 3.3.0 → 3.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a00b1f4d3eca783ae2d6f0998b164bf1cc2cb26e2721b807c9c95e5b7c9c1ed4
-  data.tar.gz: 9a881ed13f89438464d09f574e6ab24f4a2b6a49483a88ec12b4b1afcc937d89
+  metadata.gz: 30a0e5b2c5f11655889d24977dc758a7742a83621143a0a217838277d115325d
+  data.tar.gz: 86833ecb6f4e387fa385f3f5de89f0b17073ee291f706626a543c3858879d90b
 SHA512:
-  metadata.gz: 7001e00701070f34b03aa012841452fa75d58fdab35f5ae0cf551190d50f5c8319f746b71754858fba02f5e12365838d2dff398786895bd5ba9919da0b06575d
-  data.tar.gz: 0f82b8cd2b1d47b6b899ee3a31fa4f50cb7ac54b958e3216c3acc13a1303ba5068c3170af7840ede8835130af379286b1ddd8b712a6c6ec81e30c62aa907a4f5
+  metadata.gz: 401499f54f4973a1cb93944728cd8fa8a8538eb328a41ff76de290050a437a60b37543c54189154029ee6e6d3b144cbd55612f4000079f2725065cce409f6c14
+  data.tar.gz: ece50dc5d0dd86534fec1225370232dc7029a039228fc3047379de0505d99a426cf8c036c7e918c10569e6499a74c49bf1047444be0009cf1a552c5879d0be01

data/app/controllers/password_resets_controller.rb

@@ -5,7 +5,10 @@ class PasswordResetsController < ApplicationController
 
   layout "sessions"
 
-  # Renders form for user to request a password reset
+  # Limit create requests by ip address
+  limit_creations
+
+  # Password reset request form
   def new
     # new.html.erb
   end

data/app/controllers/passwords_controller.rb

@@ -39,8 +39,9 @@ class PasswordsController < ApplicationController
 
   def authenticate_with_token
     @token = params[:token]
-    @user = MinimalistAuthentication.user_model.active.find_by_token_for(purpose, @token)
-    redirect_to(new_session_path, alert: t(".invalid_token")) unless @user
+    @user = MinimalistAuthentication.user_model.active.find_by_token_for!(purpose, @token)
+  rescue ActiveRecord::RecordNotFound, ActiveSupport::MessageVerifier::InvalidSignature
+    redirect_to(new_session_path, alert: t(".invalid_token"))
   end
 
   def password_params

data/config/locales/minimalist_authentication.en.yml

@@ -14,6 +14,8 @@ en:
       title: Email Update
     update:
       notice: Email successfully updated
+  limit_creations:
+    alert: Please try again later.
   minimalist_authentication_mailer:
     update_password:
       opening: Please click the link below to update your password.

data/lib/minimalist_authentication/controller.rb

@@ -17,6 +17,18 @@ module MinimalistAuthentication
       helper_method :authorized?, :current_user, :logged_in?, :login_redirect_to
     end
 
+    module ClassMethods
+      def limit_creations(**)
+        rate_limit(
+          to:     10,
+          within: 3.minutes,
+          only:   :create,
+          with:   -> { redirect_to new_session_path, alert: t("limit_creations.alert") },
+          **
+        )
+      end
+    end
+
     # Returns true if the user is logged in
     # Override this method in your controller to customize authorization
     def authorized?(_action = action_name, _resource = controller_name)

data/lib/minimalist_authentication/sessions.rb

@@ -10,6 +10,10 @@ module MinimalistAuthentication
 
       skip_before_action  :authorization_required,    only: %i[new create]
       before_action       :redirect_logged_in_users,  only: :new
+
+      # Limit create requests by ip address and user identifier
+      limit_creations(to: 50)
+      limit_creations(by: -> { identifier&.downcase })
     end
 
     def new
@@ -80,7 +84,7 @@ module MinimalistAuthentication
     end
 
     def identifier
-      user_params.values_at(*MinimalistAuthentication::Authenticator::LOGIN_FIELDS).compact.first
+      user_params[:email] || user_params[:username]
     end
 
     def logout_redirect_to

data/lib/minimalist_authentication/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module MinimalistAuthentication
-  VERSION = "3.3.0"
+  VERSION = "3.4.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: minimalist_authentication
 version: !ruby/object:Gem::Version
-  version: 3.3.0
+  version: 3.4.0
 platform: ruby
 authors:
 - Aaron Baldwin