passwordless 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 482e11575373d9175f46bb4ad1d70bbad5297de2b9e732a84db9051a5ea493b9
-  data.tar.gz: 578348c9d8ea9dcac2eba8576ee0f110f698c519247882c39abe1e7c420a41a6
+  metadata.gz: d79c41fb0ddc3797af28166832ab336c3c3c2347c9336be03e04441554347772
+  data.tar.gz: 0f24f481eff8e766e7546e21c53fa196fa61421037a6543c58c7bca81e78899e
 SHA512:
-  metadata.gz: e82a891d207b39e8b6dd3641f9091a7f16c082947ebb787b25bcd126135cade72f6a098405dc424c73e16431a6ded7f97f55ef2298a870bdcf01698f97083347
-  data.tar.gz: 01d409c746efa765165947fd7bf83dd15371ac55559fa881535242fcab12b333bb9d7bce1a50c3d6eb2ef0fac3bd8e3d52dbf9a9d3719ca22bf6ff4dc0cb14a7
+  metadata.gz: c3a7038ffd29a1cb8218905fb974fd3d59b45b11190e3df9e125e8fc5c200638d7f7cf1c954d3a17b256594c4429a144fcd5259a210fa3fed5b13a05551af6c4
+  data.tar.gz: 3a1506b2dfba720a3ca82df7ce992fb74d450691dd31e8b250d961a7c882680fda2fb36674a6d474fa7114dc922839448547ade16b6c1c57348c08b1c9c8de25

data/README.md

@@ -4,7 +4,7 @@
   <br />
 </p>
 
-<img src='https://travis-ci.org/mikker/passwordless.svg?branch=master' alt='Build status' /> <img src='https://img.shields.io/gem/v/passwordless.svg' alt='Gem version' />
+[![Travis](https://travis-ci.org/mikker/passwordless.svg?branch=master)](https://travis-ci.org/mikker/passwordless) [![Rubygems](https://img.shields.io/gem/v/passwordless.svg)](https://rubygems.org/gems/passwordless) [![codecov](https://codecov.io/gh/mikker/passwordless/branch/master/graph/badge.svg)](https://codecov.io/gh/mikker/passwordless)
 
 Add authentication to your Rails app without all the icky-ness of passwords.
 
@@ -19,6 +19,7 @@ Add authentication to your Rails app without all the icky-ness of passwords.
      * [Registering new users](#registering-new-users)
      * [Generating tokens](#generating-tokens)
      * [Redirecting back after sign-in](#redirecting-back-after-sign-in)
+     * [URLs and links](#urls-and-links)
 * [License](#license)
 
 ## Installation
@@ -48,7 +49,9 @@ Then specify which field on your `User` record is the email field with:
 
 ```ruby
 class User < ApplicationRecord
-  passwordless_with :email
+  validates :email, presence: true, uniqueness: { case_sensitive: false }
+  
+  passwordless_with :email # <-- here!
 end
 ```
 
@@ -87,11 +90,11 @@ class ApplicationController < ActionController::Base
 end
 ```
 
-Et voilá:
+Et voilà:
 
 ```ruby
 class VerySecretThingsController < ApplicationController
-  before_filter :require_user!
+  before_action :require_user!
   
   def index
     @things = current_user.very_secret_things
@@ -162,7 +165,7 @@ class ApplicationController < ActionController::Base
   
   def require_user!
     return if current_user
-    save_passwordless_redirect_location! # <-- here we go!
+    save_passwordless_redirect_location!(User) # <-- here we go!
     redirect_to root_path, flash: {error: 'You are not worthy!'}
   end
 end
@@ -170,6 +173,20 @@ end
 
 This can be turned off with `Passwordless.redirect_back_after_sign_in = false` but if you just don't save the previous destination, you'll be fine.
 
+### URLs and links
+
+By default, Passwordless uses the resource name given to `passwordless_for` to generate its routes and helpers.
+
+```ruby
+passwordless_for :users
+  # <%= users.sign_in_path %> # => /users/sign_in
+  
+passwordless_for :users, at: '/', as: :auth
+  # <%= auth.sign_in_path %> # => /sign_in
+```
+
+Also be sure to [specify ActionMailer's `default_url_options.host`](http://guides.rubyonrails.org/action_mailer_basics.html#generating-urls-in-action-mailer-views).
+
 # License
 
 MIT

data/Rakefile

@@ -1,22 +1,17 @@
+# frozen_string_literal: true
+
 begin
   require 'bundler/setup'
 rescue LoadError
   puts 'You must `gem install bundler` and `bundle install` to run rake tasks'
 end
 
-require 'rdoc/task'
-
-RDoc::Task.new(:rdoc) do |rdoc|
-  rdoc.rdoc_dir = 'rdoc'
-  rdoc.title    = 'Passwordless'
-  rdoc.options << '--line-numbers'
-  rdoc.rdoc_files.include('README.md')
-  rdoc.rdoc_files.include('lib/**/*.rb')
-end
+require 'yard'
+YARD::Rake::YardocTask.new
+task docs: :yard
 
-APP_RAKEFILE = File.expand_path("../test/dummy/Rakefile", __FILE__)
+APP_RAKEFILE = File.expand_path('../test/dummy/Rakefile', __FILE__)
 load 'rails/tasks/engine.rake'
-
 load 'rails/tasks/statistics.rake'
 
 require 'bundler/gem_tasks'

data/app/controllers/passwordless/application_controller.rb

@@ -1,5 +1,11 @@
+# frozen_string_literal: true
+
 module Passwordless
+  # Base for Passwordless controllers
   class ApplicationController < ::ApplicationController
+    # Always returns true. Use to check if <Some>Controller inherits
+    # from ApplicationController.
+    # @return [boolean]
     def passwordless_controller?
       true
     end

data/app/controllers/passwordless/sessions_controller.rb

@@ -1,28 +1,31 @@
+# frozen_string_literal: true
+
 require 'bcrypt'
 
 module Passwordless
+  # Controller for managing Passwordless sessions
   class SessionsController < ApplicationController
+    # Raise this exception when a session is expired.
+    class ExpiredSessionError < StandardError; end
+
     include ControllerHelpers
 
     helper_method :authenticatable_resource
 
+    # get '/sign_in'
+    #   Assigns an email_field and new Session to be used by new view.
+    #   renders sessions/new.html.erb.
     def new
-      @email_field = authenticatable_class.passwordless_email_field
-
+      @email_field = email_field
       @session = Session.new
     end
 
+    # post '/sign_in'
+    #   Creates a new Session record then sends the magic link
+    #   renders sessions/create.html.erb.
+    # @see Mailer#magic_link Mailer#magic_link
     def create
-      email_field = authenticatable_class.passwordless_email_field
-      authenticatable = authenticatable_class.where(
-        "lower(#{email_field}) = ?", params[:passwordless][email_field]
-      ).first
-
-      session = Session.new.tap do |us|
-        us.remote_addr = request.remote_addr
-        us.user_agent = request.env['HTTP_USER_AGENT']
-        us.authenticatable = authenticatable
-      end
+      session = build_passwordless_session(find_authenticatable)
 
       if session.save
         Mailer.magic_link(session).deliver_now
@@ -31,27 +34,40 @@ module Passwordless
       render
     end
 
+    # rubocop:disable Metrics/MethodLength, Metrics/AbcSize
+
+    # get '/sign_in/:token'
+    #   Looks up session record by provided token. Signs in user if a match
+    #   is found. Redirects to either the user's original destination
+    #   or _root_path_
+    # @see ControllerHelpers#sign_in
+    # @see ControllerHelpers#save_passwordless_redirect_location!
     def show
       # Make it "slow" on purpose to make brute-force attacks more of a hassle
       BCrypt::Password.create(params[:token])
 
-      session = Session.valid.find_by!(
-        authenticatable_type: authenticatable_classname,
-        token: params[:token]
-      )
+      session = find_session
+      raise ExpiredSessionError if session.expired?
 
       sign_in session.authenticatable
 
-      enabled = Passwordless.redirect_back_after_sign_in
-      destination = dest = reset_passwordless_redirect_location!
+      redirect_enabled = Passwordless.redirect_back_after_sign_in
+      destination = reset_passwordless_redirect_location!(User)
 
-      if enabled && destination
-        redirect_to dest
+      if redirect_enabled && destination
+        redirect_to destination
       else
         redirect_to main_app.root_path
       end
+    rescue ExpiredSessionError
+      flash[:error] = I18n.t('.passwordless.sessions.create.session_expired')
+      redirect_to main_app.root_path
     end
+    # rubocop:enable Metrics/MethodLength, Metrics/AbcSize
 
+    # match '/sign_out', via: %i[get delete].
+    #   Signs user out. Redirects to root_path
+    # @see ControllerHelpers#sign_out
     def destroy
       sign_out authenticatable_class
       redirect_to main_app.root_path
@@ -74,5 +90,22 @@ module Passwordless
     def authenticatable_resource
       authenticatable.pluralize
     end
+
+    def email_field
+      authenticatable_class.passwordless_email_field
+    end
+
+    def find_authenticatable
+      authenticatable_class.where(
+        "lower(#{email_field}) = ?", params[:passwordless][email_field]
+      ).first
+    end
+
+    def find_session
+      Session.valid.find_by!(
+        authenticatable_type: authenticatable_classname,
+        token: params[:token]
+      )
+    end
   end
 end

data/app/mailers/passwordless/mailer.rb

@@ -1,7 +1,12 @@
+# frozen_string_literal: true
+
 module Passwordless
+  # The mailer responsible for sending Passwordless' mails.
   class Mailer < ActionMailer::Base
     default from: Passwordless.default_from_address
 
+    # Sends a magic link (secret token) email.
+    # @param session [Session] A Passwordless Session
     def magic_link(session)
       @session = session
 
@@ -11,7 +16,10 @@ module Passwordless
         send(authenticatable_resource_name).token_sign_in_url(session.token)
 
       email_field = @session.authenticatable.class.passwordless_email_field
-      mail to: @session.authenticatable.send(email_field), subject: "Your magic link ✨"
+      mail(
+        to: @session.authenticatable.send(email_field),
+        subject: I18n.t('passwordless.mailer.subject')
+      )
     end
   end
 end

data/app/models/passwordless/application_record.rb

@@ -1,4 +1,7 @@
+# frozen_string_literal: true
+
 module Passwordless
+  # Base record for Passordless' models
   class ApplicationRecord < ActiveRecord::Base
     self.abstract_class = true
   end

data/app/models/passwordless/session.rb

@@ -1,6 +1,11 @@
+# frozen_string_literal: true
+
 module Passwordless
+  # The session responsible for holding the connection between the record
+  # trying to log in and the unique tokens.
   class Session < ApplicationRecord
-    belongs_to :authenticatable, polymorphic: true
+    belongs_to :authenticatable,
+      polymorphic: true, inverse_of: :passwordless_sessions
 
     validates \
       :timeout_at,
@@ -13,9 +18,13 @@ module Passwordless
     before_validation :set_defaults
 
     scope :valid, lambda {
-      where('timeout_at > ? AND expires_at > ?', Time.current, Time.current)
+      where('timeout_at > ?', Time.current)
     }
 
+    def expired?
+      expires_at <= Time.current
+    end
+
     private
 
     def set_defaults

data/app/views/passwordless/mailer/magic_link.text.erb

@@ -1,2 +1 @@
-Here's your link:
-<%= @magic_link %>
+<%= I18n.t('passwordless.mailer.magic_link', link: @magic_link) %>

data/app/views/passwordless/sessions/create.html.erb

@@ -1 +1 @@
-<p>If we found you in the system, we've sent you an email.</p>
+<p><%= I18n.t('passwordless.sessions.success.email_sent_if_record_found') %></p>

data/app/views/passwordless/sessions/new.html.erb

@@ -1,5 +1,5 @@
 <%= form_for @session, url: send(authenticatable_resource).sign_in_path do |f| %>
   <% email_field_name = :"passwordless[#{@email_field}]" %>
   <%= text_field_tag email_field_name, params.fetch(email_field_name, nil) %>
-  <%= f.submit 'Send magic link' %>
+  <%= f.submit I18n.t('passwordless.sessions.new.submit') %>
 <% end %>

data/config/locales/en.yml

@@ -0,0 +1,12 @@
+---
+en:
+  passwordless:
+    sessions:
+      create:
+        session_expired: 'Your session has expired, please sign in again.'
+        email_sent_if_record_found: "If we found you in the system, we've sent you an email."
+      new:
+        submit: 'Send magic link'
+    mailer:
+      subject: "Your magic link ✨'"
+      magic_link: "Here's your link: %{link}"

data/config/routes.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 Passwordless::Engine.routes.draw do
   get '/sign_in', to: 'sessions#new', as: :sign_in
   post '/sign_in', to: 'sessions#create'

data/db/migrate/20171104221735_create_passwordless_sessions.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class CreatePasswordlessSessions < ActiveRecord::Migration[5.1]
   def change
     create_table :passwordless_sessions do |t|

data/lib/passwordless/controller_helpers.rb

@@ -1,5 +1,29 @@
+# frozen_string_literal: true
+
 module Passwordless
+  # Helpers to work with Passwordless sessions from controllers
   module ControllerHelpers
+    # Build a new Passwordless::Session from an _authenticatable_ record.
+    # Set's `user_agent` and `remote_addr` from Rails' `request`.
+    # @param authenticatable [ActiveRecord::Base] Instance of an
+    #   authenticatable Rails model
+    # @return [Session] the new Session object
+    # @see ModelHelpers#passwordless_with
+    def build_passwordless_session(authenticatable)
+      Session.new.tap do |us|
+        us.remote_addr = request.remote_addr
+        us.user_agent = request.env['HTTP_USER_AGENT']
+        us.authenticatable = authenticatable
+      end
+    end
+
+    # Authenticate a record using cookies. Looks for a cookie corresponding to
+    # the _authenticatable_class_. If found try to find it in the database.
+    # @param authenticatable_class [ActiveRecord::Base] any Model connected to
+    #   passwordless. (e.g - _User_ or _Admin_).
+    # @return [ActiveRecord::Base|nil] an instance of Model found by id stored
+    #   in cookies.encrypted or nil if nothing is found.
+    # @see ModelHelpers#passwordless_with
     def authenticate_by_cookie(authenticatable_class)
       key = cookie_name(authenticatable_class)
       authenticatable_id = cookies.encrypted[key]
@@ -8,28 +32,49 @@ module Passwordless
       authenticatable_class.find_by(id: authenticatable_id)
     end
 
+    # Signs in user by assigning their id to a permanent cookie.
+    # @param authenticatable [ActiveRecord::Base] Instance of Model to sign in
+    #   (e.g - @user when @user = User.find(id: some_id)).
+    # @return [ActiveRecord::Base] the record that is passed in.
     def sign_in(authenticatable)
       key = cookie_name(authenticatable.class)
       cookies.encrypted.permanent[key] = { value: authenticatable.id }
       authenticatable
     end
 
+    # Signs out user by deleting their encrypted cookie.
+    # @param (see #authenticate_by_cookie)
+    # @return [boolean] Always true
     def sign_out(authenticatable_class)
       key = cookie_name(authenticatable_class)
       cookies.encrypted.permanent[key] = { value: nil }
       cookies.delete(key)
+      true
     end
 
-    def save_passwordless_redirect_location!
-      session[:destination_when_rejected] = request.original_url
+    # Saves request.original_url as the redirect location for a
+    # passwordless Model.
+    # @param (see #authenticate_by_cookie)
+    # @return [String] the redirect url that was just saved.
+    def save_passwordless_redirect_location!(authenticatable_class)
+      session[session_key(authenticatable_class)] = request.original_url
     end
 
-    def reset_passwordless_redirect_location!
-      session.delete :destination_when_rejected
+    # Resets the redirect_location to root_path by deleting the redirect_url
+    # from session.
+    # @param (see #authenticate_by_cookie)
+    # @return [String, nil] the redirect url that was just deleted,
+    #   or nil if no url found for given Model.
+    def reset_passwordless_redirect_location!(authenticatable_class)
+      session.delete session_key(authenticatable_class)
     end
 
     private
 
+    def session_key(authenticatable_class)
+      :"passwordless_prev_location--#{authenticatable_class}"
+    end
+
     def cookie_name(authenticatable_class)
       :"#{authenticatable_class.to_s.underscore}_id"
     end

data/lib/passwordless/engine.rb

@@ -1,4 +1,7 @@
+# frozen_string_literal: true
+
 module Passwordless
+  # Engine that runs the passwordless gem.
   class Engine < ::Rails::Engine
     isolate_namespace Passwordless
 
@@ -9,5 +12,10 @@ module Passwordless
       ActiveRecord::Base.extend ModelHelpers
       require 'passwordless/controller_helpers'
     end
+
+    config.before_initialize do |app|
+      app.config.i18n.load_path +=
+        Dir[Engine.root.join('config', 'locales', '*.yml')]
+    end
   end
 end

data/lib/passwordless/model_helpers.rb

@@ -1,6 +1,14 @@
+# frozen_string_literal: true
+
 module Passwordless
+  # Some helpers for models that can sign in passswordlessly.
   module ModelHelpers
+    # Creates relationship - has_many :passwordless_sessions
+    # Defines a method `Class.passwordless_email_field` returning its email
+    #   field name (e.g. `:email`)
+    # @param field [string] email submitted by user.
     def passwordless_with(field)
+      has_many :passwordless_sessions, class_name: 'Passwordless::Session'
       define_singleton_method(:passwordless_email_field) { field }
     end
   end

data/lib/passwordless/router_helpers.rb

@@ -1,5 +1,21 @@
+# frozen_string_literal: true
+
 module Passwordless
+  # Helpers for generating passwordless routes.
   module RouterHelpers
+    # Generates passwordless routes for a given Model
+    #   Example usage:
+    #     passwordless_for :users
+    #     # or with options ...
+    #     passwordless_for :users, at: 'session_stuff', as: :user_session_things
+    # @param resource [Symbol] the pluralized symbol of a Model (e.g - :users).
+    # @param at [String] Optional - provide custom path for the passwordless
+    #   engine to get mounted at (using the above example your URLs end
+    #   up like: /session_stuff/sign_in). (Default: resource.to_s)
+    # @param as [Symbol] Optional - provide custom scope for url
+    #   helpers (using the above example in a view:
+    #   <%= link_to 'Sign in', user_session_things.sign_in_path %>).
+    #   (Default: resource.to_s)
     def passwordless_for(resource, at: nil, as: nil)
       mount(
         Passwordless::Engine,

data/lib/passwordless/url_safe_base_64_generator.rb

@@ -1,5 +1,13 @@
+# frozen_string_literal: true
+
 module Passwordless
+  # Generates random numbers for Session records
   class UrlSafeBase64Generator
+    # Passwordless' default random string strategy. Generates a url safe
+    # base64 random string.
+    # @param _session [Session] Optional - Passwordless passes the sesion Record
+    # to generators so you can (optionally) use it for generating your tokens.
+    # @return [String] 32 byte base64 string
     def call(_session)
       SecureRandom.urlsafe_base64(32)
     end

data/lib/passwordless/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Passwordless
-  VERSION = '0.4.0'
+  VERSION = '0.5.0' # :nodoc:
 end

data/lib/passwordless.rb

@@ -1,10 +1,11 @@
+# frozen_string_literal: true
+
 require 'passwordless/engine'
 require 'passwordless/url_safe_base_64_generator'
 
+# The main Passwordless module
 module Passwordless
   mattr_accessor(:default_from_address) { 'CHANGE_ME@example.com' }
-  mattr_accessor(:token_generator) do
-    UrlSafeBase64Generator.new
-  end
+  mattr_accessor(:token_generator) { UrlSafeBase64Generator.new }
   mattr_accessor(:redirect_back_after_sign_in) { true }
 end

metadata

@@ -1,27 +1,27 @@
 --- !ruby/object:Gem::Specification
 name: passwordless
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Mikkel Malmberg
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-11-27 00:00:00.000000000 Z
+date: 2018-02-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 5.1.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 5.1.4
 - !ruby/object:Gem::Dependency
@@ -52,7 +52,35 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: Description of Passwordless.
+- !ruby/object:Gem::Dependency
+  name: yard
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: 
 email:
 - mikkel@brnbw.com
 executables: []
@@ -70,6 +98,7 @@ files:
 - app/views/passwordless/mailer/magic_link.text.erb
 - app/views/passwordless/sessions/create.html.erb
 - app/views/passwordless/sessions/new.html.erb
+- config/locales/en.yml
 - config/routes.rb
 - db/migrate/20171104221735_create_passwordless_sessions.rb
 - lib/passwordless.rb
@@ -79,7 +108,6 @@ files:
 - lib/passwordless/router_helpers.rb
 - lib/passwordless/url_safe_base_64_generator.rb
 - lib/passwordless/version.rb
-- lib/tasks/passwordless_tasks.rake
 homepage: https://github.com/mikker/passwordless
 licenses:
 - MIT
@@ -100,8 +128,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.7.2
+rubygems_version: 2.7.3
 signing_key: 
 specification_version: 4
-summary: Summary of Passwordless.
+summary: Add authentication to your app without all the ickyness of passwords.
 test_files: []

data/lib/tasks/passwordless_tasks.rake

@@ -1,4 +0,0 @@
-# desc "Explaining what the task does"
-# task :passwordless do
-#   # Task goes here
-# end