passwordless 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: d3bdc9fe84110cc587576344e493cbe16a0a9a74
-  data.tar.gz: 1d7558d9be99a4764c21eb6fda029a765a9540bb
+  metadata.gz: b5a2a15ba36dbcd13fb11898d26ed934083be8ba
+  data.tar.gz: e66f31f5dd29b2a6ff0813863a8af864e2db59a1
 SHA512:
-  metadata.gz: 6ec72945db7eec026bd640a3116c82fc9b5eea790cea4405bf9593815ed2e02edc3d91e58c82bdc52122a6190e512eb8013e51ca198d0b47cd961491d5f471aa
-  data.tar.gz: 0ca8c6e2e4d6bed6fab0351200acef5ac9e65a1526c2cd7503d751d967da8fd96d7200d005310600af693af00fde068aee7541b185e8969612342f32155dca4a
+  metadata.gz: 1a1665bf6d15e0b7b8ae88666c8ad6cb50c2032d57ae0aea3a640c32cb5d4c4b9e3e7bc825aaa92c1cda144218ce0c95dd71befb9275b4424ca9bd6cf4ecc636
+  data.tar.gz: 1d65cedeada62b9842afabd70d8bd51e56c30a11039f79c3eda668e1cdf2b330cfc8a6dba012e2cc2439d7423804f9c8fd79e5fdbb62cf75ee1b53b1e35928e1

data/README.md

@@ -1,5 +1,5 @@
 <p align='center'>
-  <img src='https://s3.brnbw.com/Passwordless-title-JO71NQv7Q0.svg' alt='Passwordless' />
+  <img src='https://s3.brnbw.com/Passwordless-title-gaIVkX0sPg.svg' alt='Passwordless' />
   <br />
   <br />
 </p>
@@ -74,6 +74,18 @@ class ApplicationController < ActionController::Base
 end
 ```
 
+Et voilá:
+
+```ruby
+class VerySecretThingsController < ApplicationController
+  before_filter :require_user!
+  
+  def index
+    @things = current_user.very_secret_things
+  end
+end
+```
+
 ## Providing your own templates
 
 Override `passwordless`' bundled views by adding your own. `passwordless` has 2 action views and 1 mailer view:
@@ -91,7 +103,7 @@ See [the bundled views](https://github.com/mikker/passwordless/tree/master/app/v
 
 ## Registering new users
 
-Because your `User` record is just any other record, you just create one like you normally would. Passwordless provides a helper method you can use to sign in the created user after it is saved like so:
+Because your `User` record is like any other record, you create one like you normally would. Passwordless provides a helper method you can use to sign in the created user after it is saved like so:
 
 ```ruby
 class UsersController < ApplicationController
@@ -113,18 +125,18 @@ class UsersController < ApplicationController
 end
 ```
 
-Et voilá:
+## Generating tokens
+
+By default Passwordless generates tokens using Rails' `SecureRandom.urlsafe_base64` but you can change that by setting `Passwordless.token_generator` to something else that responds to `call(session)` eg.:
 
 ```ruby
-class VerySecretThingsController < ApplicationController
-  before_filter :require_user!
-  
-  def index
-    @things = current_user.very_secret_things
-  end
-end
+Passwordless.token_generator = -> (session) {
+  "probably-stupid-token-#{session.user_agent}-#{Time.current}"
+}
 ```
 
+Session is going to keep generating tokens until it finds one that hasn't been used yet. So be sure to use some kind of method where matches are unlikely.
+
 # License
 
 MIT

data/app/controllers/passwordless/sessions_controller.rb

@@ -1,3 +1,5 @@
+require 'bcrypt'
+
 module Passwordless
   class SessionsController < ApplicationController
     include ControllerHelpers
@@ -30,6 +32,9 @@ module Passwordless
     end
 
     def show
+      # Make it "slow" on purpose to make brute-force attacks more of a hassle
+      BCrypt::Password.create(params[:token])
+
       session = Session.valid.find_by!(
         authenticatable_type: authenticatable_classname,
         token: params[:token]

data/app/models/passwordless/session.rb

@@ -22,7 +22,7 @@ module Passwordless
       self.expires_at ||= 1.year.from_now
       self.timeout_at ||= 1.hour.from_now
       self.token ||= loop do
-        token = SecureRandom.urlsafe_base64(32)
+        token = Passwordless.token_generator.call(self)
         break token unless Session.find_by(token: token)
       end
     end

data/lib/passwordless/url_safe_base_64_generator.rb

@@ -0,0 +1,7 @@
+module Passwordless
+  class UrlSafeBase64Generator
+    def call(_session)
+      SecureRandom.urlsafe_base64(32)
+    end
+  end
+end

data/lib/passwordless/version.rb

@@ -1,3 +1,3 @@
 module Passwordless
-  VERSION = '0.2.0'
+  VERSION = '0.3.0'
 end

data/lib/passwordless.rb

@@ -1,5 +1,9 @@
-require "passwordless/engine"
+require 'passwordless/engine'
+require 'passwordless/url_safe_base_64_generator'
 
 module Passwordless
   mattr_accessor(:default_from_address) { 'CHANGE_ME@example.com' }
+  mattr_accessor(:token_generator) do
+    UrlSafeBase64Generator.new
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: passwordless
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Mikkel Malmberg
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-11-06 00:00:00.000000000 Z
+date: 2017-11-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -24,6 +24,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 5.1.4
+- !ruby/object:Gem::Dependency
+  name: bcrypt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.1.11
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.1.11
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
@@ -63,6 +77,7 @@ files:
 - lib/passwordless/engine.rb
 - lib/passwordless/model_helpers.rb
 - lib/passwordless/router_helpers.rb
+- lib/passwordless/url_safe_base_64_generator.rb
 - lib/passwordless/version.rb
 - lib/tasks/passwordless_tasks.rake
 homepage: https://github.com/mikker/passwordless