omniauth-sqrl 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1ec44b285fcb9ae740113490751f7789fa81dd1a20aba653b61f392466900bc8
-  data.tar.gz: 5f30e8e98d099c26991607cf21d59dc329512dc71a8bc96f1d6aa80435ff14a5
+  metadata.gz: f40e7da2aa9850520361ed291193dc0bc7aee5c4a6da9016d2117c0836b4241e
+  data.tar.gz: '0889f5ef8759ffffe77701c64ef6f2ca5b80325c94e2b366ba78f6ea1673cd1d'
 SHA512:
-  metadata.gz: e3ba5f13311c0d5602b0a3391e161c268db1e39c8ee4d18a49472c4096fbc26fda9e544c0afb76b4487db7e79cd786374c56846e6fc62c810349e915593be12b
-  data.tar.gz: ee87c223fd4bb83480f82dfe5bb61d4f3c9f5cbcde40012c994ef7b18853c73170506f9991c1fa78be838d86edc1bc441e6f93aeae9420de111f4f7641789a88
+  metadata.gz: 7123fddf2939344b480691a3afa67955b8c50fc75887c2097e9df5350aa71b84ea23067f1e1107965007d7de8a2faea8404e24407d681fb8158ee929ad179bac
+  data.tar.gz: 637e3c83c88c12cdca6445baebb3549982c527d422ed318c8d0ff4c4a64de61b36aeb44296b0f01e6f674cef975e336a7bbba4ac22c46eb7bd90914d01704538

data/CHANGELOG.md

@@ -1,14 +1,41 @@
 # Changelog
 
-## 0.1.1 — 2026-10-20
+All notable changes to `omniauth-sqrl` are documented in this file.
 
-- No changes. Released with sqrl-core 0.1.1, which fixes the `NoMethodError` on Ruby 3.1
-  and 3.2; every gem in the family shares one version.
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this
+project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Every gem in
+the family shares one version number and is released in lockstep.
 
-## 0.1.0 — 2026-10-20
+## [Unreleased]
+
+## [0.1.2] - 2026-10-21
+
+### Changed
+
+- Requires sqrl-core and sqrl-rack 0.1.2. sqrl-core fixes binary S4 identity files whose
+  last byte is whitespace being truncated on parse and brings the server into line with
+  Steve Gibson's final specification (`suk=` on every command, the post-update TIF after a
+  re-key, `url=` on a CPS `disable`, and more). No code changes in this gem.
+
+### Security
+
+- Through sqrl-rack 0.1.2, a login the SQRL client completed in CPS mode can no longer be
+  completed through the browser's status poll; only the browser holding the one-time
+  `url=` token is signed in, as the specification requires.
+
+## [0.1.1] - 2026-10-20
+
+### Changed
+
+- Requires sqrl-core 0.1.1, which fixes the `NoMethodError` on Ruby 3.1 and 3.2. No other
+  changes.
+
+## [0.1.0] - 2026-10-20
 
 First release.
 
+### Added
+
 - `provider :sqrl`: request phase renders the login page; the strategy serves the SQRL
   endpoint, status poll, script and refresh routes itself; the callback builds an auth hash
   keyed by the identity key with `extra["sqrl"]` facts (created, re-keyed from, options,
@@ -19,3 +46,8 @@ First release.
   testing mode, `poll_requires_ip_match` (off by default).
 - Works with `devise :omniauthable`.
 - Requires Ruby 3.1+, OmniAuth 2.x.
+
+[Unreleased]: https://github.com/danielpclark/sqrl-ruby/compare/v0.1.2...HEAD
+[0.1.2]: https://github.com/danielpclark/sqrl-ruby/compare/v0.1.1...v0.1.2
+[0.1.1]: https://github.com/danielpclark/sqrl-ruby/compare/v0.1.0...v0.1.1
+[0.1.0]: https://github.com/danielpclark/sqrl-ruby/releases/tag/v0.1.0

data/README.md

@@ -24,6 +24,7 @@ end
 | `POST /auth/sqrl/cli` | other phase | the SQRL client's protocol endpoint (`query`, `ident`, `disable`, `enable`, `remove`) |
 | `GET /auth/sqrl/status` | other phase | cookie-bound JSON poll used by `sqrl.js` for logins from another device |
 | `GET /auth/sqrl/sqrl.js` | other phase | the browser script |
+| `GET /auth/sqrl/refresh` | other phase | a fresh login URL for the page when a nut expired (JSON) |
 | `GET /auth/sqrl/callback?t=TOKEN` | callback phase | Client Provided Session landing: the one-time token is claimed and the auth hash is built |
 | `GET /auth/sqrl/callback` | callback phase | completion from the poller (the browser's own pending login) |
 
@@ -72,7 +73,11 @@ foreign, reused or expired token) or `sqrl_disabled`.
 | `title:` / `cancel_url:` | "Sign in with SQRL" / the origin | login page title and cancel link |
 | `info:` | `nil` | callable `(identity) -> Hash` to fill `info` |
 | `ip:` | `Rack::Request#ip` | callable resolving the client IP (trusted proxies) |
-| `cli_path:` / `status_path:` / `script_path:` | under the provider prefix | endpoint paths |
+| `cli_path:` / `status_path:` / `script_path:` / `refresh_path:` | under the provider prefix | endpoint paths |
+| `allowed_hosts:` / `host_cache_limit:` | `nil` / 16 | accepted request hosts when `host:` is derived, and how many distinct ones are kept |
+| `before_issue:` / `before_handle:` | `nil` | hooks that may raise `SQRL::Server::RateLimited` (answered with 429) |
+| `prune_every:` | 1000 | opportunistic `prune!` every N requests (`nil` disables) |
+| `logger:` | `nil` | logger for warnings and protocol traces |
 
 ## Devise
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-sqrl
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Daniel P. Clark
@@ -29,28 +29,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.1
+        version: 0.1.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.1
+        version: 0.1.2
 - !ruby/object:Gem::Dependency
   name: sqrl-rack
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.1
+        version: 0.1.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.1
+        version: 0.1.2
 email:
 - 6ftdan@gmail.com
 executables: []