passkeys-rails 0.1.5 → 0.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c1967aeb595e4864973402bf8108fe5a56b668678b8ed56aafbc403b164c628d
-  data.tar.gz: c96c2cd39bedbc138c1cd35248432d9cf7626c5a96007b91981741eb6f56e478
+  metadata.gz: c1c218e160d157a8ddcf931fae3a053fb6e130130b61a8e03f5a9a2bcade07b1
+  data.tar.gz: 42fb39898dd79867bd8d18fb95b39ac335a47ed5a06d3ccb13b5f3fc2b64b6af
 SHA512:
-  metadata.gz: 3eb9182122196e3c94b5ebb78b0984785c39fb194b6d7f5f95432eb63e53482be0190fe24bc2af914a38377ee1a82df80932b11c16f918d155fdbaa731b5a052
-  data.tar.gz: e16475967c805796248fb3188667456e31fd833f841b98d16c28a6b5964e59170d349a018580a5e1ab312f18f7a9f7f16693b612d70d97f6ce91a5a77a9e5db4
+  metadata.gz: 85c226aabf90e17b56744947b37eab49f98c4cbacc42a4963316ea60a68fa6c49b40ea81297d2786a16151361fa6e0f637a5af18d147db12894f5288ef260558
+  data.tar.gz: 9a26aa0b7c5e907b954f2564244ab222205775da8087c0c9b17cde3e00706aace1b21b4c3c57d728b91472ed035eeb3f4c87d2ecc4ccecb1e41c5f767d548ccc

data/README.md

@@ -3,11 +3,39 @@
 [![codecov](https://codecov.io/gh/alliedcode/passkeys-rails/branch/main/graph/badge.svg?token=UHSNJDUL21)](https://codecov.io/gh/alliedcode/passkeys-rails)
 
 # PasskeysRails
-Devise is awesome, but we don't need all that UI/UX for PassKeys.  This gem is to make it easy to provide a back end that authenticates a mobile front end with PassKeys.
+Devise is awesome, but we don't need all that UI/UX for PassKeys.  This gem is to make
+it easy to provide a back end that authenticates a mobile front end with PassKeys.
 
 ## Usage
 rails passkeys-rails::install
-PasskeysRails maintains an Agent model and related Passeys.  If you have a user model, add `include PasskeysRails::Authenticatable` to your model and include the name of that class (e.g. "User") in the authenticatable_class param when calling the register API.
+PasskeysRails maintains an Agent model and related Passeys.  If you have a user model,
+add `include PasskeysRails::Authenticatable` to your model and include the name of that
+class (e.g. "User") in the authenticatable_class param when calling the register API.
+
+### Optionally providing a "user" model during registration
+PasskeysRails does not require that you supply your own model, but it's often useful to do so.  For example,
+if you have a User model that you would like to have created at registration, you can supply the model name
+in the finishRegistration API call.
+
+PasskeysRails supports multiple "user" models.  Whatever model name you supply in the finishRegiration call will
+be created and provided an opportunity to do any required initialization at that time.
+
+There are two PasskeysRails configuration options related to this.
+
+default_class and class_whitelist
+
+#### default_class
+
+Configure default_class in passkeys_rails.rb.  Its value will be used during registration if none
+is provided in the API call.  It is "User" by default.  Since it's just a default, it can be overridden
+in the API call for any other model.  If no model is to be used, change it to nil.
+
+#### class_whitelist
+
+Configure class_whitelist in passkeys_rails.rb.  It is nil by default.  When nil, no whitelist will be applied.
+If it is non-nil, it should be an array of class names that are allowed during registration.  Supply an empty
+array to prevent PasskeysRails from attempting to create anything other than its own PasskeysRails::Agent during
+registration.
 
 ## Installation
 Add this line to your application's Gemfile:

data/app/interactors/passkeys_rails/finish_registration.rb

@@ -40,25 +40,42 @@ module PasskeysRails
           context.fail! code: :passkey_error, message: e.message
         end
 
-        create_authenticatable! if authenticatable_class.present?
+        create_authenticatable! if aux_class_name.present?
       end
     end
 
-    def create_authenticatable!
-      klass = begin
-        authenticatable_class.constantize
+    def aux_class_name
+      @aux_class_name ||= authenticatable_class || PasskeysRails.default_class
+    end
+
+    def aux_class
+      whitelist = PasskeysRails.class_whitelist
+
+      @aux_class ||= begin
+        case whitelist
+        when Array
+          unless whitelist.include?(aux_class_name)
+            context.fail!(code: :invalid_authenticatable_class, message: "authenticatable_class (#{aux_class_name}) is not in the whitelist")
+          end
+        when present?
+          context.fail!(code: :invalid_class_whitelist,
+                        message: "class_whitelist is invalid.  It should be nil or an array of zero or more class names.")
+        end
+
+        aux_class_name.constantize
       rescue StandardError
-        context.fail!(code: :invalid_authenticatable_class, message: "authenticatable_class (#{authenticatable_class}) is not defined")
+        context.fail!(code: :invalid_authenticatable_class, message: "authenticatable_class (#{aux_class_name}) is not defined")
       end
+    end
 
-      begin
-        authenticatable = klass.create! do |obj|
-          obj.registering_with(agent) if obj.respond_to?(:registering_with)
-        end
-        agent.update!(authenticatable:)
-      rescue ActiveRecord::RecordInvalid => e
-        context.fail!(code: :record_invalid, message: e.message)
+    def create_authenticatable!
+      authenticatable = aux_class.create! do |obj|
+        obj.registering_with(agent) if obj.respond_to?(:registering_with)
       end
+
+      agent.update!(authenticatable:)
+    rescue ActiveRecord::RecordInvalid => e
+      context.fail!(code: :record_invalid, message: e.message)
     end
 
     def webauthn_credential

data/lib/generators/passkeys_rails/templates/passkeys_rails_config.rb

@@ -21,4 +21,28 @@ PasskeysRails.config do |c|
   # Default is 30 days
   #
   # c.auth_token_expires_in = 30.days
+
+  # Model to use when creating or authenticating a passkey.
+  # This can be overridden when calling the API, but if no
+  # value is supplied when calling the API, this value is used.
+  #
+  # If nil, there is no default, and if none is supplied when
+  # calling the API, no resource is created other than
+  # a PaskeysRails::Agent that is used to track the passkey.
+  #
+  # This library doesn't assume that there will only be one
+  # model, but it is a common use case, so setting the
+  # default_class simplifies the use of the API in that case.
+  #
+  # c.default_class = "User"
+
+  # By providing a class_whitelist, the API will require that
+  # any supplied class is in the whitelist.  If it is not, the
+  # auth API will return an error.  This prevents a caller from
+  # attempting to create an unintended records on registration.
+  # If nil, any model will be allowed.
+  # This should be an array of symbols or strings,
+  # for example: %w[User AdminUser]
+  #
+  # c.class_whitelist = nil
 end

data/lib/passkeys-rails.rb

@@ -19,6 +19,28 @@ module PasskeysRails
   # Set it to 0 for no expiration (not recommended in production).
   mattr_accessor :auth_token_expires_in, default: 30.days
 
+  # Model to use when creating or authenticating a passkey.
+  # This can be overridden when calling the API, but if no
+  # value is supplied when calling the API, this value is used.
+  # If nil, there is no default, and if none is supplied when
+  # calling the API, no resource is created other than
+  # a PaskeysRails::Agent that is used to track the passkey.
+  #
+  # This library doesn't assume that there will only be one
+  # model, but it is a common use case, so setting the
+  # default_class simplifies the use of the API in that case.
+  mattr_accessor :default_class, default: "User"
+
+  # By providing a class_whitelist, the API will require that
+  # any supplied class is in the whitelist.  If it is not, the
+  # auth API will return an error.  This prevents a caller from
+  # attempting to create an unintended record on registration.
+  # If nil, any model will be allowed.
+  # If [], no model will be allowed.
+  # This should be an array of symbols or strings,
+  # for example: %w[User AdminUser]
+  mattr_accessor :class_whitelist, default: nil
+
   class << self
     def config
       yield self

data/lib/passkeys_rails/version.rb

@@ -1,3 +1,3 @@
 module PasskeysRails
-  VERSION = "0.1.5".freeze
+  VERSION = "0.1.6".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: passkeys-rails
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.1.6
 platform: ruby
 authors:
 - Troy Anderson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-07-24 00:00:00.000000000 Z
+date: 2023-07-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails