ombu_labs-auth 0.1.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 41111c90c5534ea459e316cb3aa05922216d164d85c9726ff1f9deec1d87fdc9
-  data.tar.gz: 6deac429d78449c2387338ae00fc1001404806b9fa7eede8183c1200258aa844
+  metadata.gz: f475eb31d8305111c07630031e435409835177779d2cfeb40a244a665e9feae4
+  data.tar.gz: 21b5bafd7beabb29937dd2b022b57bb1b48aca24302150530877f62bea54f3cd
 SHA512:
-  metadata.gz: f50cf42b5d6eeeb19a990c24e0285cf6c43c1aa9a98b4c05edc54c6052e443b97a32bd0527a53cff1a0fde886425e4a71c5d7e854f30271cafdbdb55f6980538
-  data.tar.gz: 8354b5a402310f61029233b32810f3635771ff541247386a47a7b399b857b39e7ee2e743411b0fb7f84b3537357ce1bd6de8ebd9bf1203d410d4709e7498eee0
+  metadata.gz: 65e0aa64ce69a6bebd5574eb988a960e14b071bb777a9ea0567e2d0d7afc802a3e60dea11e9fc11a25b9fd4ec525740de95b66002c2ce360e5c934cfa190b3b7
+  data.tar.gz: ae733534269f220dad12f00df00bd9b801212a2c9b087ddfe291cea0b0241c1a215b4b3764329d42871e95986a131d6b4a5fb944e324f3ae2192bac1ef24c613

data/README.md

@@ -5,6 +5,9 @@ This gem provides an easy way to generate new (Devise) sessions for members of a
 If a user is signing in with GitHub and they are a (public) member of the configured GitHub organization, they will be allowed in.
 
 ## Environment Variables
+
+### GitHub Login
+
 Make sure you configure your ENV variables to use Github authentication.
 
 ```
@@ -33,16 +36,39 @@ Once you create the app and generate credentials for it, make sure you add them
 GITHUB_APP_ID=xxxxxxxxxxxxxxxxxxxx
 GITHUB_APP_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 ```
+
+### Developer Login
+
+To avoid the need of a GitHub application setup (useful for local development or Heroku Review Apps), the `developer` strategy can be enabled using setting a `SHOW_DEVELOPER_AUTH` variable with any non-blank value (`SHOW_DEVELOPER_AUTH=1` or `SHOW_DEVELOPER_AUTH=true` for example).
+
 ## Getting Started
 
-- Add these lines to your application's Gemfile:
+### Requirements
+
+A `User`-like model that will be used for the authentication (`User`, `Admin`, `Client`, etc).
+
+The database table for that model must have, at least, these fields:
+
+```rb
+create_table :clients do |t|
+  t.string :email, unique: true
+  t.string :provider
+  t.string :uid, unique: true
+  t.string :name
+  t.string :encrypted_password
+end
+```
+
+### Installation
+
+- Add this line to your application's Gemfile:
 
 ```ruby
 gem 'ombu_labs-auth'
-gem 'omniauth-github', '~> 2.0.0'
 ```
 
 - And then execute:
+
 ```bash
 $ bundle
 ```
@@ -62,12 +88,67 @@ mount OmbuLabs::Auth::Engine, at: '/', as: 'ombu_labs_auth'
 </div>
 ```
 
+> This will default to a basic HTML page included in this gem. To customize this view, check [this section](#customizing-sign-in-page)
+
 - Add the Devise authentication helper to your private objects controllers
 
-```
+```rb
 before_action :authenticate_user!
 ```
 
+- Include the `OmbuLabsAuthenticable` concern in the authenticable model
+
+```rb
+class Admin < ApplicationRecord
+  include OmbuLabsAuthenticable
+  ...
+end
+```
+
+- Tell `OmbuLabs::Auth` the user class name and table for the authenticable model
+
+```rb
+# config/initializers/ombu_labs-auth.rb
+OmbuLabs::Auth.user_class_name = "Admin" # defaults to "User" if not set
+OmbuLabs::Auth.users_table_name = :admins # defaults to :users if not set
+```
+
+> You can skip this step if the table is called `users` and the model is called `User`
+
+- Log Out action
+
+A link to `ombu_labs_auth.destroy_user_session_path` with method `DELETE` can be used. If rails-ujs is not available, a `button_to` can be used.
+
+```
+<%= link_to "Sign out", ombu_labs_auth.destroy_user_session_path, method: :delete, class: "button magenta" %>
+```
+
+### TODO: create a rails template to do all the previous steps automatically
+
+## Customizing sign in page
+
+The gem provides a basic html template to select the authentication method. To customize it, create a view at `views/devise/session/new.html.erb` and a layout at `views/layouts/devise.html.erb`.
+
+Include this snippet in the `new` view:
+
+```
+<%- Devise.omniauth_providers.each do |provider| %>
+  <%= button_to "Sign in with #{OmniAuth::Utils.camelize(provider)}", omniauth_authorize_path(OmbuLabs::Auth.user_class, provider), method: :post %><br />
+<% end -%>
+```
+
+To use a `link_to` helper instead of a `button_to` helper to, rails-ujs is needed to support making a `POST` request with link tags. Then, replace with:
+
+```
+<%= link_to "Sign in with #{OmniAuth::Utils.camelize(provider)}", omniauth_authorize_path(OmbuLabs::Auth.user_class, provider), method: :post, data: { 'turbo-method' => :post } %><br />
+```
+
+> If this intermediate page is not needed, the button/link to `omniauth_authorize_path` can be used directly.
+
+## Running tests
+
+Run `rake app:test:all` to run all tests and `rake app:test` to skip system tests.
+
 ## Caveats
 
 Please be aware this gem is a mountable engine which depends on Devise, and it's not possible to mount it multiple times. Refer to their Wiki for more on the issue - https://github.com/heartcombo/devise/wiki/How-To:-Use-devise-inside-a-mountable-engine
@@ -78,5 +159,22 @@ Have a fix for a problem you've been running into or an idea for a new feature y
 
 Take a look at the [Contributing document](https://github.com/fastruby/ombu_labs-auth/blob/main/CONTRIBUTING.md) for instructions to set up the repo on your machine and create a good Pull Request.
 
+## Release
+
+If you are looking to contribute in the gem you need to be aware that we are using the [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/#summary) specification to release versions in this gem.
+
+which means, when doing a contribution your commit message must have the following structure
+
+```git
+<type>[optional scope]: <description>
+
+[optional body]
+
+[optional footer(s)]
+```
+
+[here](https://www.conventionalcommits.org/en/v1.0.0/#examples) you can find some commit's examples.
+
 ## License
+
 The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/Rakefile

@@ -6,3 +6,12 @@ load "rails/tasks/engine.rake"
 load "rails/tasks/statistics.rake"
 
 require "bundler/gem_tasks"
+
+require 'rake/testtask'
+
+Rake::TestTask.new(:test) do |t|
+  t.libs << 'test'
+  t.pattern = 'test/**/*_test.rb'
+end
+
+task default: :test

data/app/controllers/ombu_labs/auth/callbacks_controller.rb

@@ -12,7 +12,7 @@ module OmbuLabs
         member_logins = organization_members.map { |member| member["login"] }
 
         if username.in?(member_logins)
-          @user = User.from_omniauth(request.env["omniauth.auth"])
+          @user = OmbuLabs::Auth.user_class.from_omniauth(request.env["omniauth.auth"])
           sign_in_and_redirect @user
         else
           flash[:error] = "This application is only available to members of #{organization_name}."
@@ -21,7 +21,7 @@ module OmbuLabs
       end
 
       def developer
-        @user = User.from_omniauth(request.env["omniauth.auth"])
+        @user = OmbuLabs::Auth.user_class.from_omniauth(request.env["omniauth.auth"])
         sign_in_and_redirect @user
       end
 

data/app/models/concerns/ombu_labs_authenticable.rb

@@ -0,0 +1,22 @@
+require "active_support/concern"
+
+module OmbuLabsAuthenticable
+  extend ActiveSupport::Concern
+  
+  included do
+    # Include default devise modules. Others available are:
+    # :confirmable, :lockable, :timeoutable
+    devise :database_authenticatable, :omniauthable
+  end
+
+  class_methods do    
+    def from_omniauth(auth)
+      user_attributes = {
+        email: auth["info"]["email"],
+        name: auth["info"]["name"],
+        password: Devise.friendly_token[0, 20]
+      }
+      where(provider: auth["provider"], uid: auth["uid"]).first_or_create.tap { |user| user.update(user_attributes) }
+    end
+  end
+end

data/app/views/devise/sessions/new.html.erb

@@ -1,14 +1,8 @@
-<div class="fluid-container center floor signin">
 <h2 class="new-edit-title">Sign in</h2>
 
 <% if flash[:error] %>
   <div class="alert alert-danger" role="alert"><%= flash[:error] %></div>
 <% end %>
-
-<%- if devise_mapping.omniauthable? %>
-  <%- resource_class.omniauth_providers.each do |provider| %>
-    <%= link_to "Sign in with #{OmniAuth::Utils.camelize(provider)}", omniauth_authorize_path(resource_name, provider), class: "button", id:"back", method: :post, data: { 'turbo-method' => :post } %><br />
-    <%= button_to "Sign in with #{OmniAuth::Utils.camelize(provider)}", omniauth_authorize_path(resource_name, provider), class: "button", method: :post %><br />
-  <% end -%>
+<%- Devise.omniauth_providers.each do |provider| %>
+  <%= button_to "Sign in with #{OmniAuth::Utils.camelize(provider)}", omniauth_authorize_path(OmbuLabs::Auth.user_class, provider), method: :post %><br />
 <% end -%>
-</div>

data/config/initializers/devise.rb

@@ -1,311 +1,16 @@
 # frozen_string_literal: true
-
-# Assuming you have not yet modified this file, each configuration option below
-# is set to its default value. Note that some are commented out while others
-# are not: uncommented lines are intended to protect your configuration from
-# breaking changes in upgrades (i.e., in the event that future versions of
-# Devise change the default values for those options).
-#
-# Use this hook to configure devise mailer, warden hooks and so forth.
-# Many of these configuration options can be set straight in your model.
 Devise.setup do |config|
-  # The secret key used by Devise. Devise uses this key to generate
-  # random tokens. Changing this key will render invalid all existing
-  # confirmation, reset password and unlock tokens in the database.
-  # Devise will use the `secret_key_base` as its `secret_key`
-  # by default. You can change it below and use your own secret key.
-  # config.secret_key = '4de034614c8dc2c925a677c848c46cefe588af1a7d1516a4f25feb985eb9959d529d2863e5dd379e17999583fc1b3e96e458cff41012c3643f0b7e47a7a66939'
-
-  # ==> Controller configuration
-  # Configure the parent class to the devise controllers.
   config.parent_controller = 'OmbuLabs::Auth::ApplicationController'
 
-  # ==> Mailer Configuration
-  # Configure the e-mail address which will be shown in Devise::Mailer,
-  # note that it will be overwritten if you use your own mailer class
-  # with default "from" parameter.
-  config.mailer_sender = 'please-change-me-at-config-initializers-devise@example.com'
-
-  # Configure the class responsible to send e-mails.
-  # config.mailer = 'Devise::Mailer'
-
-  # Configure the parent class responsible to send e-mails.
-  # config.parent_mailer = 'ActionMailer::Base'
-
-  # ==> ORM configuration
-  # Load and configure the ORM. Supports :active_record (default) and
-  # :mongoid (bson_ext recommended) by default. Other ORMs may be
-  # available as additional gems.
-  require 'devise/orm/active_record'
-
-  # ==> Configuration for any authentication mechanism
-  # Configure which keys are used when authenticating a user. The default is
-  # just :email. You can configure it to use [:username, :subdomain], so for
-  # authenticating a user, both parameters are required. Remember that those
-  # parameters are used only when authenticating and not when retrieving from
-  # session. If you need permissions, you should implement that in a before filter.
-  # You can also supply a hash where the value is a boolean determining whether
-  # or not authentication should be aborted when the value is not present.
-  # config.authentication_keys = [:email]
-
-  # Configure parameters from the request object used for authentication. Each entry
-  # given should be a request method and it will automatically be passed to the
-  # find_for_authentication method and considered in your model lookup. For instance,
-  # if you set :request_keys to [:subdomain], :subdomain will be used on authentication.
-  # The same considerations mentioned for authentication_keys also apply to request_keys.
-  # config.request_keys = []
-
-  # Configure which authentication keys should be case-insensitive.
-  # These keys will be downcased upon creating or modifying a user and when used
-  # to authenticate or find a user. Default is :email.
-  config.case_insensitive_keys = [:email]
-
-  # Configure which authentication keys should have whitespace stripped.
-  # These keys will have whitespace before and after removed upon creating or
-  # modifying a user and when used to authenticate or find a user. Default is :email.
-  config.strip_whitespace_keys = [:email]
-
-  # Tell if authentication through request.params is enabled. True by default.
-  # It can be set to an array that will enable params authentication only for the
-  # given strategies, for example, `config.params_authenticatable = [:database]` will
-  # enable it only for database (email + password) authentication.
-  # config.params_authenticatable = true
-
-  # Tell if authentication through HTTP Auth is enabled. False by default.
-  # It can be set to an array that will enable http authentication only for the
-  # given strategies, for example, `config.http_authenticatable = [:database]` will
-  # enable it only for database authentication.
-  # For API-only applications to support authentication "out-of-the-box", you will likely want to
-  # enable this with :database unless you are using a custom strategy.
-  # The supported strategies are:
-  # :database      = Support basic authentication with authentication key + password
-  # config.http_authenticatable = false
-
-  # If 401 status code should be returned for AJAX requests. True by default.
-  # config.http_authenticatable_on_xhr = true
-
-  # The realm used in Http Basic Authentication. 'Application' by default.
-  # config.http_authentication_realm = 'Application'
-
-  # It will change confirmation, password recovery and other workflows
-  # to behave the same regardless if the e-mail provided was right or wrong.
-  # Does not affect registerable.
-  # config.paranoid = true
-
-  # By default Devise will store the user in session. You can skip storage for
-  # particular strategies by setting this option.
-  # Notice that if you are skipping storage for all authentication paths, you
-  # may want to disable generating routes to Devise's sessions controller by
-  # passing skip: :sessions to `devise_for` in your config/routes.rb
-  config.skip_session_storage = [:http_auth]
-
-  # By default, Devise cleans up the CSRF token on authentication to
-  # avoid CSRF token fixation attacks. This means that, when using AJAX
-  # requests for sign in and sign up, you need to get a new CSRF token
-  # from the server. You can disable this option at your own risk.
-  # config.clean_up_csrf_token_on_authentication = true
-
-  # When false, Devise will not attempt to reload routes on eager load.
-  # This can reduce the time taken to boot the app but if your application
-  # requires the Devise mappings to be loaded during boot time the application
-  # won't boot properly.
-  # config.reload_routes = true
-
-  # ==> Configuration for :database_authenticatable
-  # For bcrypt, this is the cost for hashing the password and defaults to 12. If
-  # using other algorithms, it sets how many times you want the password to be hashed.
-  # The number of stretches used for generating the hashed password are stored
-  # with the hashed password. This allows you to change the stretches without
-  # invalidating existing passwords.
-  #
-  # Limiting the stretches to just one in testing will increase the performance of
-  # your test suite dramatically. However, it is STRONGLY RECOMMENDED to not use
-  # a value less than 10 in other environments. Note that, for bcrypt (the default
-  # algorithm), the cost increases exponentially with the number of stretches (e.g.
-  # a value of 20 is already extremely slow: approx. 60 seconds for 1 calculation).
-  config.stretches = Rails.env.test? ? 1 : 12
-
-  # Set up a pepper to generate the hashed password.
-  # config.pepper = '7fe15ab9313b3144e5cfc0d754b334b1e1351590a0213d1e27da4ee982a9e56a39f5eb4799119bee7c47fae463ce7c510221042dbbde9ee93e1a9ab1354a9aeb'
-
-  # Send a notification to the original email when the user's email is changed.
-  # config.send_email_changed_notification = false
-
-  # Send a notification email when the user's password is changed.
-  # config.send_password_change_notification = false
-
-  # ==> Configuration for :confirmable
-  # A period that the user is allowed to access the website even without
-  # confirming their account. For instance, if set to 2.days, the user will be
-  # able to access the website for two days without confirming their account,
-  # access will be blocked just in the third day.
-  # You can also set it to nil, which will allow the user to access the website
-  # without confirming their account.
-  # Default is 0.days, meaning the user cannot access the website without
-  # confirming their account.
-  # config.allow_unconfirmed_access_for = 2.days
-
-  # A period that the user is allowed to confirm their account before their
-  # token becomes invalid. For example, if set to 3.days, the user can confirm
-  # their account within 3 days after the mail was sent, but on the fourth day
-  # their account can't be confirmed with the token any more.
-  # Default is nil, meaning there is no restriction on how long a user can take
-  # before confirming their account.
-  # config.confirm_within = 3.days
-
-  # If true, requires any email changes to be confirmed (exactly the same way as
-  # initial account confirmation) to be applied. Requires additional unconfirmed_email
-  # db field (see migrations). Until confirmed, new email is stored in
-  # unconfirmed_email column, and copied to email column on successful confirmation.
-  config.reconfirmable = true
-
-  # Defines which key will be used when confirming an account
-  # config.confirmation_keys = [:email]
+  if ENV["GITHUB_APP_ID"].present? && ENV["GITHUB_APP_SECRET"]
+    config.omniauth :github, ENV["GITHUB_APP_ID"], ENV["GITHUB_APP_SECRET"], scope: "user:email"
+  end
 
-  # ==> Configuration for :rememberable
-  # The time the user will be remembered without asking for credentials again.
-  # config.remember_for = 2.weeks
+  if ENV["SHOW_DEVELOPER_AUTH"].present?
+    config.omniauth :developer, scope: "user:email"
+  end
 
-  # Invalidates all the remember me tokens when the user signs out.
-  config.expire_all_remember_me_on_sign_out = true
-
-  # If true, extends the user's remember period when remembered via cookie.
-  # config.extend_remember_period = false
-
-  # Options to be passed to the created cookie. For instance, you can set
-  # secure: true in order to force SSL only cookies.
-  # config.rememberable_options = {}
-
-  # ==> Configuration for :validatable
-  # Range for password length.
-  config.password_length = 6..128
-
-  # Email regex used to validate email formats. It simply asserts that
-  # one (and only one) @ exists in the given string. This is mainly
-  # to give user feedback and not to assert the e-mail validity.
-  config.email_regexp = /\A[^@\s]+@[^@\s]+\z/
-
-  # ==> Configuration for :timeoutable
-  # The time you want to timeout the user session without activity. After this
-  # time the user will be asked for credentials again. Default is 30 minutes.
-  # config.timeout_in = 30.minutes
-
-  # ==> Configuration for :lockable
-  # Defines which strategy will be used to lock an account.
-  # :failed_attempts = Locks an account after a number of failed attempts to sign in.
-  # :none            = No lock strategy. You should handle locking by yourself.
-  # config.lock_strategy = :failed_attempts
-
-  # Defines which key will be used when locking and unlocking an account
-  # config.unlock_keys = [:email]
-
-  # Defines which strategy will be used to unlock an account.
-  # :email = Sends an unlock link to the user email
-  # :time  = Re-enables login after a certain amount of time (see :unlock_in below)
-  # :both  = Enables both strategies
-  # :none  = No unlock strategy. You should handle unlocking by yourself.
-  # config.unlock_strategy = :both
-
-  # Number of authentication tries before locking an account if lock_strategy
-  # is failed attempts.
-  # config.maximum_attempts = 20
-
-  # Time interval to unlock the account if :time is enabled as unlock_strategy.
-  # config.unlock_in = 1.hour
-
-  # Warn on the last attempt before the account is locked.
-  # config.last_attempt_warning = true
-
-  # ==> Configuration for :recoverable
-  #
-  # Defines which key will be used when recovering the password for an account
-  # config.reset_password_keys = [:email]
-
-  # Time interval you can reset your password with a reset password key.
-  # Don't put a too small interval or your users won't have the time to
-  # change their passwords.
-  config.reset_password_within = 6.hours
-
-  # When set to false, does not sign a user in automatically after their password is
-  # reset. Defaults to true, so a user is signed in automatically after a reset.
-  # config.sign_in_after_reset_password = true
-
-  # ==> Configuration for :encryptable
-  # Allow you to use another hashing or encryption algorithm besides bcrypt (default).
-  # You can use :sha1, :sha512 or algorithms from others authentication tools as
-  # :clearance_sha1, :authlogic_sha512 (then you should set stretches above to 20
-  # for default behavior) and :restful_authentication_sha1 (then you should set
-  # stretches to 10, and copy REST_AUTH_SITE_KEY to pepper).
-  #
-  # Require the `devise-encryptable` gem when using anything other than bcrypt
-  # config.encryptor = :sha512
-
-  # ==> Scopes configuration
-  # Turn scoped views on. Before rendering "sessions/new", it will first check for
-  # "users/sessions/new". It's turned off by default because it's slower if you
-  # are using only default views.
-  # config.scoped_views = false
-
-  # Configure the default scope given to Warden. By default it's the first
-  # devise role declared in your routes (usually :user).
-  # config.default_scope = :user
-
-  # Set this configuration to false if you want /users/sign_out to sign out
-  # only the current scope. By default, Devise signs out all scopes.
-  # config.sign_out_all_scopes = true
-
-  # ==> Navigation configuration
-  # Lists the formats that should be treated as navigational. Formats like
-  # :html, should redirect to the sign in page when the user does not have
-  # access, but formats like :xml or :json, should return 401.
-  #
-  # If you have any extra navigational formats, like :iphone or :mobile, you
-  # should add them to the navigational formats lists.
-  #
-  # The "*/*" below is required to match Internet Explorer requests.
-  # config.navigational_formats = ['*/*', :html]
-
-  # The default HTTP method used to sign out a resource. Default is :delete.
-  config.sign_out_via = :delete
-
-  # ==> OmniAuth
-  # Add a new OmniAuth provider. Check the wiki for more information on setting
-  # up on your models and hooks.
-  config.omniauth :github, ENV["GITHUB_APP_ID"], ENV["GITHUB_APP_SECRET"], scope: "user:email"
-
-  # ==> Warden configuration
-  # If you want to use other strategies, that are not supported by Devise, or
-  # change the failure app, you can configure them inside the config.warden block.
-  #
-  # config.warden do |manager|
-  #   manager.intercept_401 = false
-  #   manager.default_strategies(scope: :user).unshift :some_external_strategy
-  # end
-
-  # ==> Mountable engine configurations
-  # When using Devise inside an engine, let's call it `MyEngine`, and this engine
-  # is mountable, there are some extra configurations to be taken into account.
-  # The following options are available, assuming the engine is mounted as:
-  #
-  #     mount MyEngine, at: '/my_engine'
-  #
-  # The router that invoked `devise_for`, in the example above, would be:
   config.router_name = :ombu_labs_auth
-  #
-  # When using OmniAuth, Devise cannot automatically set OmniAuth path,
-  # so you need to do it manually. For the users scope, it would be:
-  # config.omniauth_path_prefix = '/my_engine/users/auth'
-
-  # ==> Turbolinks configuration
-  # If your app is using Turbolinks, Turbolinks::Controller needs to be included to make redirection work correctly:
-  #
-  # ActiveSupport.on_load(:devise_failure_app) do
-  #   include Turbolinks::Controller
-  # end
-
-  # ==> Configuration for :registerable
 
-  # When set to false, does not sign a user in automatically after their password is
-  # changed. Defaults to true, so a user is signed in automatically after changing a password.
-  # config.sign_in_after_change_password = true
+  require "devise/orm/active_record"
 end

data/config/routes.rb

@@ -1,3 +1,3 @@
 OmbuLabs::Auth::Engine.routes.draw do
-  devise_for :users, class_name: OmbuLabs::Auth::User, module: :devise, controllers: { omniauth_callbacks: 'ombu_labs/auth/callbacks' }
+  devise_for OmbuLabs::Auth.users_table_name, class_name: OmbuLabs::Auth.user_class_name, module: :devise, controllers: { omniauth_callbacks: 'ombu_labs/auth/callbacks' }
 end

data/lib/ombu_labs/auth/version.rb

@@ -1,5 +1,5 @@
 module OmbuLabs
   module Auth
-    VERSION = "0.1.0"
+    VERSION = "1.1.0"
   end
 end

data/lib/ombu_labs/auth.rb

@@ -1,9 +1,25 @@
+# due to boot time configs, these need to be required BEFORE the engine
 require "devise"
-require "ombu_labs/auth/version"
+require "omniauth-github"
 require "ombu_labs/auth/engine"
+require "ombu_labs/auth/version"
+require "omniauth/rails_csrf_protection"
 
 module OmbuLabs
   module Auth
-    # Your code goes here...
+    mattr_accessor :user_class_name
+    mattr_accessor :users_table_name
+
+    def self.user_class_name
+      @@user_class_name || 'User'
+    end
+
+    def self.user_class
+      @@user_class ||= user_class_name.constantize
+    end
+
+    def self.users_table_name
+      @@users_table_name || :users
+    end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ombu_labs-auth
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 1.1.0
 platform: ruby
 authors:
-- Ombulabs
+- OmbuLabs
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-10-20 00:00:00.000000000 Z
+date: 2025-04-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -17,6 +17,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '6.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '8.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -24,20 +27,23 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '6.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '8.1'
 - !ruby/object:Gem::Dependency
   name: devise
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.8.1
+        version: '4.9'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.8.1
+        version: '4.9'
 - !ruby/object:Gem::Dependency
   name: omniauth
   requirement: !ruby/object:Gem::Requirement
@@ -66,6 +72,62 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 2.0.0
+- !ruby/object:Gem::Dependency
+  name: omniauth-rails_csrf_protection
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: capybara
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: webdrivers
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: puma
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Helps us authenticate teammates using GitHub Oauth and Devise
 email:
 - tiago@ombulabs.com
@@ -77,23 +139,13 @@ files:
 - MIT-LICENSE
 - README.md
 - Rakefile
-- app/assets/config/ombu_labs_auth_manifest.js
-- app/assets/stylesheets/ombu_labs/auth/application.css
 - app/controllers/ombu_labs/auth/application_controller.rb
 - app/controllers/ombu_labs/auth/callbacks_controller.rb
-- app/helpers/ombu_labs/auth/application_helper.rb
-- app/jobs/ombu_labs/auth/application_job.rb
-- app/mailers/ombu_labs/auth/application_mailer.rb
-- app/models/ombu_labs/auth/application_record.rb
-- app/models/ombu_labs/auth/user.rb
+- app/models/concerns/ombu_labs_authenticable.rb
 - app/views/devise/sessions/new.html.erb
-- app/views/devise/shared/_links.html.erb
-- app/views/layouts/ombu_labs/auth/application.html.erb
-- config/environments/development.rb
 - config/initializers/devise.rb
 - config/locales/devise.en.yml
 - config/routes.rb
-- db/migrate/20221014183623_devise_create_ombu_labs_auth_users.rb
 - lib/ombu_labs/auth.rb
 - lib/ombu_labs/auth/engine.rb
 - lib/ombu_labs/auth/version.rb
@@ -120,8 +172,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
+rubygems_version: 3.0.3.1
 signing_key:
 specification_version: 4
-summary: Ombulabs internal authentication gem
+summary: OmbuLabs internal authentication gem
 test_files: []

data/app/assets/config/ombu_labs_auth_manifest.js

@@ -1 +0,0 @@
-//= link_directory ../stylesheets/ombu_labs/auth .css

data/app/assets/stylesheets/ombu_labs/auth/application.css

@@ -1,15 +0,0 @@
-/*
- * This is a manifest file that'll be compiled into application.css, which will include all the files
- * listed below.
- *
- * Any CSS and SCSS file within this directory, lib/assets/stylesheets, vendor/assets/stylesheets,
- * or any plugin's vendor/assets/stylesheets directory can be referenced here using a relative path.
- *
- * You're free to add application-wide styles to this file and they'll appear at the bottom of the
- * compiled file so the styles you add here take precedence over styles defined in any other CSS/SCSS
- * files in this directory. Styles in this file should be added after the last require_* statement.
- * It is generally better to create a new file per style scope.
- *
- *= require_tree .
- *= require_self
- */

data/app/helpers/ombu_labs/auth/application_helper.rb

@@ -1,6 +0,0 @@
-module OmbuLabs
-  module Auth
-    module ApplicationHelper
-    end
-  end
-end

data/app/jobs/ombu_labs/auth/application_job.rb

@@ -1,6 +0,0 @@
-module OmbuLabs
-  module Auth
-    class ApplicationJob < ActiveJob::Base
-    end
-  end
-end

data/app/mailers/ombu_labs/auth/application_mailer.rb

@@ -1,8 +0,0 @@
-module OmbuLabs
-  module Auth
-    class ApplicationMailer < ActionMailer::Base
-      default from: "from@example.com"
-      layout "mailer"
-    end
-  end
-end

data/app/models/ombu_labs/auth/application_record.rb

@@ -1,7 +0,0 @@
-module OmbuLabs
-  module Auth
-    class ApplicationRecord < ActiveRecord::Base
-      self.abstract_class = true
-    end
-  end
-end

data/app/models/ombu_labs/auth/user.rb

@@ -1,20 +0,0 @@
-module OmbuLabs::Auth
-  class User < ApplicationRecord
-    self.table_name = "users"
-
-    # Include default devise modules. Others available are:
-    # :confirmable, :lockable, :timeoutable
-    devise :database_authenticatable, :registerable,
-            :recoverable, :rememberable, :trackable,
-            :validatable, :omniauthable
-    
-    def self.from_omniauth(auth)
-      user_attributes = {
-        email: auth.info.email,
-        name: auth.info.name,
-        password: Devise.friendly_token[0, 20]
-      }
-      where(provider: auth.provider, uid: auth.uid).first_or_create.tap { |user| user.update(user_attributes) }
-    end
-  end
-end

data/app/views/devise/shared/_links.html.erb

@@ -1,5 +0,0 @@
-<%- if devise_mapping.omniauthable? %>
-  <%- resource_class.omniauth_providers.each do |provider| %>
-    <%= link_to "Sign in with #{OmniAuth::Utils.camelize(provider)}", omniauth_authorize_path(resource_name, provider), class: "button", id:"back" %><br />
-  <% end -%>
-<% end -%>

data/app/views/layouts/ombu_labs/auth/application.html.erb

@@ -1,17 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>Ombu labs auth</title>
-  <%= csrf_meta_tags %>
-  <%= csp_meta_tag %>
-
-  <%= stylesheet_link_tag    "ombu_labs/auth/application", media: "all" %>
-</head>
-<body>
-
-<p class="notice"><%= notice %></p>
-<p class="alert"><%= alert %></p>
-<%= yield %>
-
-</body>
-</html>

data/config/environments/development.rb

@@ -1,5 +0,0 @@
-require "active_support/core_ext/integer/time"
-
-Rails.application.configure do
-  config.action_mailer.default_url_options = { host: 'localhost', port: 3000 }
-end

data/db/migrate/20221014183623_devise_create_ombu_labs_auth_users.rb

@@ -1,44 +0,0 @@
-# frozen_string_literal: true
-
-class DeviseCreateOmbuLabsAuthUsers < ActiveRecord::Migration[7.0]
-  def change
-    create_table :users do |t|
-      ## Database authenticatable
-      t.string :email,              null: false, default: ""
-      t.string :encrypted_password, null: false, default: ""
-
-      ## Recoverable
-      t.string   :reset_password_token
-      t.datetime :reset_password_sent_at
-
-      ## Rememberable
-      t.datetime :remember_created_at
-
-      ## Trackable
-      t.integer  :sign_in_count, default: 0, null: false
-      t.datetime :current_sign_in_at
-      t.datetime :last_sign_in_at
-      t.string   :current_sign_in_ip
-      t.string   :last_sign_in_ip
-
-      ## Confirmable
-      # t.string   :confirmation_token
-      # t.datetime :confirmed_at
-      # t.datetime :confirmation_sent_at
-      # t.string   :unconfirmed_email # Only if using reconfirmable
-
-      ## Lockable
-      # t.integer  :failed_attempts, default: 0, null: false # Only if lock strategy is :failed_attempts
-      # t.string   :unlock_token # Only if unlock strategy is :email or :both
-      # t.datetime :locked_at
-
-
-      t.timestamps null: false
-    end
-
-    add_index :users, :email,                unique: true
-    add_index :users, :reset_password_token, unique: true
-    # add_index :users, :confirmation_token,   unique: true
-    # add_index :users, :unlock_token,         unique: true
-  end
-end