minimalist_authentication 3.3.0 → 3.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a00b1f4d3eca783ae2d6f0998b164bf1cc2cb26e2721b807c9c95e5b7c9c1ed4
-  data.tar.gz: 9a881ed13f89438464d09f574e6ab24f4a2b6a49483a88ec12b4b1afcc937d89
+  metadata.gz: 79d61a668a0923babb9c46da034f262af4dc8ed449b511bb44427b2c1af202c4
+  data.tar.gz: b6e226a4f03b89609870b4841bfa83cbb781eb3b1ffc2c7d201c4e99328a4921
 SHA512:
-  metadata.gz: 7001e00701070f34b03aa012841452fa75d58fdab35f5ae0cf551190d50f5c8319f746b71754858fba02f5e12365838d2dff398786895bd5ba9919da0b06575d
-  data.tar.gz: 0f82b8cd2b1d47b6b899ee3a31fa4f50cb7ac54b958e3216c3acc13a1303ba5068c3170af7840ede8835130af379286b1ddd8b712a6c6ec81e30c62aa907a4f5
+  metadata.gz: '09a6e851dd57f8541116348298da3e1d5b2227f40a03ae3aed99a75040b30d237f5641741bfbad5b2fee73daaf9e1f2951634f263adc2a4827dc3bf5220307d7'
+  data.tar.gz: d47f8f2afa9464bce14cc503a64850dacf774bdd50ca965f4077e808afbb51f6ee8e4f1dc4877a9769fac7ff26b19cb77a6ad05828564a9436a692730be83a2f

data/app/controllers/password_resets_controller.rb

@@ -5,7 +5,10 @@ class PasswordResetsController < ApplicationController
 
   layout "sessions"
 
-  # Renders form for user to request a password reset
+  # Limit create requests by ip address
+  limit_creations
+
+  # Password reset request form
   def new
     # new.html.erb
   end

data/app/controllers/passwords_controller.rb

@@ -39,8 +39,9 @@ class PasswordsController < ApplicationController
 
   def authenticate_with_token
     @token = params[:token]
-    @user = MinimalistAuthentication.user_model.active.find_by_token_for(purpose, @token)
-    redirect_to(new_session_path, alert: t(".invalid_token")) unless @user
+    @user = MinimalistAuthentication.user_model.active.find_by_token_for!(purpose, @token)
+  rescue ActiveRecord::RecordNotFound, ActiveSupport::MessageVerifier::InvalidSignature
+    redirect_to(new_session_path, alert: t(".invalid_token"))
   end
 
   def password_params

data/config/locales/minimalist_authentication.en.yml

@@ -14,6 +14,8 @@ en:
       title: Email Update
     update:
       notice: Email successfully updated
+  limit_creations:
+    alert: Please try again later.
   minimalist_authentication_mailer:
     update_password:
       opening: Please click the link below to update your password.
@@ -26,7 +28,7 @@ en:
     new:
       email:
         placeholder: Enter your email address
-      instructions: Enter your verified email address, and we'll send you a link to reset your password.
+      instructions: Enter your account email address to receive a password reset link.
       submit: Send Reset Link
       title: Reset Your Password
     create:

data/lib/minimalist_authentication/controller.rb

@@ -17,6 +17,18 @@ module MinimalistAuthentication
       helper_method :authorized?, :current_user, :logged_in?, :login_redirect_to
     end
 
+    module ClassMethods
+      def limit_creations(**)
+        rate_limit(
+          to:     10,
+          within: 3.minutes,
+          only:   :create,
+          with:   -> { redirect_to new_session_path, alert: t("limit_creations.alert") },
+          **
+        )
+      end
+    end
+
     # Returns true if the user is logged in
     # Override this method in your controller to customize authorization
     def authorized?(_action = action_name, _resource = controller_name)

data/lib/minimalist_authentication/sessions.rb

@@ -10,6 +10,10 @@ module MinimalistAuthentication
 
       skip_before_action  :authorization_required,    only: %i[new create]
       before_action       :redirect_logged_in_users,  only: :new
+
+      # Limit create requests by ip address and user identifier
+      limit_creations(to: 50)
+      limit_creations(by: -> { identifier&.downcase })
     end
 
     def new
@@ -80,7 +84,7 @@ module MinimalistAuthentication
     end
 
     def identifier
-      user_params.values_at(*MinimalistAuthentication::Authenticator::LOGIN_FIELDS).compact.first
+      user_params[:email] || user_params[:username]
     end
 
     def logout_redirect_to

data/lib/minimalist_authentication/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module MinimalistAuthentication
-  VERSION = "3.3.0"
+  VERSION = "3.4.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: minimalist_authentication
 version: !ruby/object:Gem::Version
-  version: 3.3.0
+  version: 3.4.1
 platform: ruby
 authors:
 - Aaron Baldwin