passwordless 0.5.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d79c41fb0ddc3797af28166832ab336c3c3c2347c9336be03e04441554347772
-  data.tar.gz: 0f24f481eff8e766e7546e21c53fa196fa61421037a6543c58c7bca81e78899e
+  metadata.gz: 41c7adf049e6fcb2c682c5521f7d07bcbef284e89d4847616aa052bdce5f9bdd
+  data.tar.gz: 1fae62fa2de31fa2567664ca3573cbe4865f6675a8a6fb4b4736db882121c3ad
 SHA512:
-  metadata.gz: c3a7038ffd29a1cb8218905fb974fd3d59b45b11190e3df9e125e8fc5c200638d7f7cf1c954d3a17b256594c4429a144fcd5259a210fa3fed5b13a05551af6c4
-  data.tar.gz: 3a1506b2dfba720a3ca82df7ce992fb74d450691dd31e8b250d961a7c882680fda2fb36674a6d474fa7114dc922839448547ade16b6c1c57348c08b1c9c8de25
+  metadata.gz: 3e590daa07378e8a920f7640d34ee1c9701effece337f883c68bf2fee12a87282abaeb3e9027d0650e884a522cce951857f104a79766cb66f92d1ccaf52f8f6b
+  data.tar.gz: a2687e8571a9ebb65dab493a4b1c7ee2011c1b90edf6be17a34d1b72b948a4ed8a4c94ff12e66a2957f6e099ee790e1139f57372e738ca6a24037c0ad85f6a9a

data/README.md

@@ -20,6 +20,7 @@ Add authentication to your Rails app without all the icky-ness of passwords.
      * [Generating tokens](#generating-tokens)
      * [Redirecting back after sign-in](#redirecting-back-after-sign-in)
      * [URLs and links](#urls-and-links)
+     * [E-mail security](#e-mail-security)
 * [License](#license)
 
 ## Installation
@@ -187,6 +188,14 @@ passwordless_for :users, at: '/', as: :auth
 
 Also be sure to [specify ActionMailer's `default_url_options.host`](http://guides.rubyonrails.org/action_mailer_basics.html#generating-urls-in-action-mailer-views).
 
+### E-mail security
+
+There's no reason that this approach should be less secure than the usual username/password combo. In fact this is most often a more secure option, as users don't get to choose the weak passwords they still use. In a way this is just the same as having each user go through "Forgot password" on every login.
+
+But be aware that when everyone authenticates via emails you send, the way you send those mails becomes a weak spot. Email services usually provide a log of all the mails you send so if your app's account is compromised, every user in the system is as well. (This is the same for "Forgot password".) [Reddit was compromised](https://thenextweb.com/hardfork/2018/01/05/reddit-bitcoin-cash-hack/) using this method.
+
+Ideally you should set up your email provider to not log these mails. And be sure to turn on 2-factor auth if your provider supports it.
+
 # License
 
 MIT

data/app/controllers/passwordless/sessions_controller.rb

@@ -10,8 +10,6 @@ module Passwordless
 
     include ControllerHelpers
 
-    helper_method :authenticatable_resource
-
     # get '/sign_in'
     #   Assigns an email_field and new Session to be used by new view.
     #   renders sessions/new.html.erb.
@@ -87,17 +85,13 @@ module Passwordless
       authenticatable_classname.constantize
     end
 
-    def authenticatable_resource
-      authenticatable.pluralize
-    end
-
     def email_field
       authenticatable_class.passwordless_email_field
     end
 
     def find_authenticatable
       authenticatable_class.where(
-        "lower(#{email_field}) = ?", params[:passwordless][email_field]
+        "lower(#{email_field}) = ?", params[:passwordless][email_field].downcase
       ).first
     end
 

data/app/mailers/passwordless/mailer.rb

@@ -10,10 +10,8 @@ module Passwordless
     def magic_link(session)
       @session = session
 
-      authenticatable_resource_name =
-        @session.authenticatable_type.underscore.pluralize
-      @magic_link =
-        send(authenticatable_resource_name).token_sign_in_url(session.token)
+      @magic_link = send(Passwordless.mounted_as)
+                    .token_sign_in_url(session.token)
 
       email_field = @session.authenticatable.class.passwordless_email_field
       mail(

data/app/views/passwordless/sessions/create.html.erb

@@ -1 +1 @@
-<p><%= I18n.t('passwordless.sessions.success.email_sent_if_record_found') %></p>
+<p><%= I18n.t('passwordless.sessions.create.email_sent_if_record_found') %></p>

data/app/views/passwordless/sessions/new.html.erb

@@ -1,4 +1,4 @@
-<%= form_for @session, url: send(authenticatable_resource).sign_in_path do |f| %>
+<%= form_for @session, url: send(Passwordless.mounted_as).sign_in_path do |f| %>
   <% email_field_name = :"passwordless[#{@email_field}]" %>
   <%= text_field_tag email_field_name, params.fetch(email_field_name, nil) %>
   <%= f.submit I18n.t('passwordless.sessions.new.submit') %>

data/lib/passwordless.rb

@@ -8,4 +8,5 @@ module Passwordless
   mattr_accessor(:default_from_address) { 'CHANGE_ME@example.com' }
   mattr_accessor(:token_generator) { UrlSafeBase64Generator.new }
   mattr_accessor(:redirect_back_after_sign_in) { true }
+  mattr_accessor(:mounted_as) { :configured_when_mounting_passwordless }
 end

data/lib/passwordless/router_helpers.rb

@@ -17,12 +17,14 @@ module Passwordless
     #   <%= link_to 'Sign in', user_session_things.sign_in_path %>).
     #   (Default: resource.to_s)
     def passwordless_for(resource, at: nil, as: nil)
+      mount_at = at || resource.to_s
+      mount_as = as || resource.to_s
       mount(
-        Passwordless::Engine,
-        at: at || resource.to_s,
-        as: as || resource.to_s,
+        Passwordless::Engine, at: mount_at, as: mount_as,
         defaults: { authenticatable: resource.to_s.singularize }
       )
+
+      Passwordless.mounted_as = mount_as
     end
   end
 end

data/lib/passwordless/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Passwordless
-  VERSION = '0.5.0' # :nodoc:
+  VERSION = '0.5.1' # :nodoc:
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: passwordless
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.5.1
 platform: ruby
 authors:
 - Mikkel Malmberg
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-02-26 00:00:00.000000000 Z
+date: 2018-04-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -128,7 +128,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.7.3
+rubygems_version: 2.7.6
 signing_key: 
 specification_version: 4
 summary: Add authentication to your app without all the ickyness of passwords.