passwordless 1.2.0 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b88192b582d0e4f8cb601b00f2cf5d51250dbe9f747d6413728cf2e5da7ddd1b
-  data.tar.gz: 054c733891aa4e4f98a1f684b6d6107414b4214589f76ec5aa20c7337a5b2098
+  metadata.gz: 6dc17e0a0f2696a647ba5f5dffaededf6494a48f4cd3393135e041c91b3955f0
+  data.tar.gz: b27244139169a60b25c1251321aa6576d7fbbe7e9e122cb5886041f7a60a4886
 SHA512:
-  metadata.gz: a760c9c2ade52b80be4a482abb17a2ff9c71579d07bc55eb1268980a39f69540d354bf1988bb4a7ea35d08e801042d9ff266cc2c98913b7ea5c331a1556b882c
-  data.tar.gz: f66c443aa783a9f490dac97e4a9720ce077594e4d170ad10053bd42168033ca5c57e1b4f20288e0b5a7bd63eaac67b90b8cd52ba80ac8b9a290d2de2bfb2078e
+  metadata.gz: 66be83e8a5b1f8cd06d83196d94ce42e9fe25dbbd49a650ca553c8874ac47503758c782b10831187d7005666fbe73e1468fea82a9c6cdad21dae8abe85cfca22
+  data.tar.gz: 266ec15bbc186604c4ab0eda90171499052fa22e11d8eeb0c8f96196fe3363ee45c42d183d76a16dc90670308a1ae9a7bc84bfbb321a8c01fca815ae7e24b6cf

data/README.md

@@ -25,26 +25,21 @@ See [Upgrading to Passwordless 1.0](docs/upgrading_to_1_0.md) for more details.
 
 ## Usage
 
-Passwordless creates a single model called `Passwordless::Session`. It doesn't come with its own `User` model, it expects you to create one:
+Passwordless creates a single model called `Passwordless::Session`, so it doesn't come with its own user model. Instead, it expects you to provide one, with an email field in place. If you don't yet have a user model, check out the wiki on [creating the user model](https://github.com/mikker/passwordless/wiki/Creating-the-user-model).
 
-```sh
-$ bin/rails generate model User email
-```
-
-Then specify which field on your `User` record is the email field with:
+Enable Passwordless on your user model by pointing it to the email field:
 
 ```ruby
 class User < ApplicationRecord
-  validates :email,
-            presence: true,
-            uniqueness: { case_sensitive: false },
-            format: { with: URI::MailTo::EMAIL_REGEXP }
+  # your other code..
+
+  passwordless_with :email # <-- here! this needs to be a column in `users` table
 
-  passwordless_with :email # <-- here!
+  # more of your code..
 end
 ```
 
-Finally, mount the engine in your routes:
+Then mount the engine in your routes:
 
 ```ruby
 Rails.application.routes.draw do
@@ -75,7 +70,7 @@ class ApplicationController < ActionController::Base
   def require_user!
     return if current_user
     save_passwordless_redirect_location!(User) # <-- optional, see below
-    redirect_to root_path, flash: { error: 'You are not worthy!' }
+    redirect_to root_path, alert: "You are not worthy!"
   end
 end
 ```
@@ -163,6 +158,7 @@ The default values are shown below. It's recommended to only include the ones th
 ```ruby
 Passwordless.configure do |config|
   config.default_from_address = "CHANGE_ME@example.com"
+  config.parent_controller = "ApplicationController"
   config.parent_mailer = "ActionMailer::Base"
   config.restrict_token_reuse = false # Can a token/link be used multiple times?
   config.token_generator = Passwordless::ShortTokenGenerator.new # Used to generate magic link tokens.
@@ -175,6 +171,8 @@ Passwordless.configure do |config|
   config.success_redirect_path = '/' # After a user successfully signs in
   config.failure_redirect_path = '/' # After a sign in fails
   config.sign_out_redirect_path = '/' # After a user signs out
+
+  config.paranoid = false # Display email sent notice even when the resource is not found.
 end
 ```
 
@@ -239,7 +237,7 @@ class ApplicationController < ActionController::Base
   def require_user!
     return if current_user
     save_passwordless_redirect_location!(User) # <-- this one!
-    redirect_to root_path, flash: {error: 'You are not worthy!'}
+    redirect_to root_path, alert: "You are not worthy!"
   end
 end
 ```
@@ -260,18 +258,6 @@ class User < ApplicationRecord
 end
 ```
 
-### Claiming tokens
-
-By default, a token/magic link **can** be used more than once.
-
-To change, in `config/initializers/passwordless.rb`:
-
-```ruby
-Passwordless.configure do |config|
-  config.restrict_token_reuse = true
-end
-```
-
 ## Test helpers
 
 To help with testing, a set of test helpers are provided.

data/app/controllers/passwordless/sessions_controller.rb

@@ -4,7 +4,7 @@ require "bcrypt"
 
 module Passwordless
   # Controller for managing Passwordless sessions
-  class SessionsController < ApplicationController
+  class SessionsController < Passwordless.config.parent_controller.constantize
     include ControllerHelpers
 
     helper_method :email_field
@@ -20,21 +20,11 @@ module Passwordless
     #   Creates a new Session record then sends the magic link
     #   redirects to sign in page with generic flash message.
     def create
-      unless @resource = find_authenticatable
-        raise(
-          ActiveRecord::RecordNotFound,
-          "Couldn't find #{authenticatable_type} with email #{passwordless_session_params[email_field]}"
-        )
-      end
-
+      handle_resource_not_found unless @resource = find_authenticatable
       @session = build_passwordless_session(@resource)
 
       if @session.save
-        if Passwordless.config.after_session_save.arity == 2
-          Passwordless.config.after_session_save.call(@session, request)
-        else
-          Passwordless.config.after_session_save.call(@session)
-        end
+        call_after_session_save
 
         redirect_to(
           Passwordless.context.path_for(
@@ -50,6 +40,8 @@ module Passwordless
       end
 
     rescue ActiveRecord::RecordNotFound
+      @session = Session.new
+
       flash[:error] = I18n.t("passwordless.sessions.create.not_found")
       render(:new, status: :not_found)
     end
@@ -113,11 +105,11 @@ module Passwordless
     protected
 
     def passwordless_sign_out_redirect_path
-      Passwordless.config.sign_out_redirect_path
+      call_or_return(Passwordless.config.sign_out_redirect_path)
     end
 
     def passwordless_failure_redirect_path
-      Passwordless.config.failure_redirect_path
+      call_or_return(Passwordless.config.failure_redirect_path)
     end
 
     def passwordless_query_redirect_path
@@ -128,10 +120,14 @@ module Passwordless
     end
 
     def passwordless_success_redirect_path
-      return Passwordless.config.success_redirect_path unless Passwordless.config.redirect_back_after_sign_in
+      success_redirect_path = call_or_return(Passwordless.config.success_redirect_path)
 
-      session_redirect_url = reset_passwordless_redirect_location!(authenticatable_class)
-      passwordless_query_redirect_path || session_redirect_url || Passwordless.config.success_redirect_path
+      if Passwordless.config.redirect_back_after_sign_in
+        session_redirect_url = reset_passwordless_redirect_location!(authenticatable_class)
+        return passwordless_query_redirect_path || session_redirect_url || success_redirect_path
+      end
+
+      success_redirect_path
     end
 
     private
@@ -172,13 +168,41 @@ module Passwordless
       authenticatable_type.constantize
     end
 
-    def find_authenticatable
-      email = passwordless_session_params[email_field].downcase.strip
+    def call_or_return(value)
+      value.respond_to?(:call) ? value.call : value
+    end
 
+    def find_authenticatable
       if authenticatable_class.respond_to?(:fetch_resource_for_passwordless)
-        authenticatable_class.fetch_resource_for_passwordless(email)
+        authenticatable_class.fetch_resource_for_passwordless(normalized_email_param)
+      else
+        authenticatable_class.where("lower(#{email_field}) = ?", normalized_email_param).first
+      end
+    end
+
+    def normalized_email_param
+      passwordless_session_params[email_field].downcase.strip
+    end
+
+    def handle_resource_not_found
+      if Passwordless.config.paranoid
+        @resource = authenticatable_class.new(email: normalized_email_param)
+        @skip_after_session_save_callback = true
+      else
+        raise(
+          ActiveRecord::RecordNotFound,
+          "Couldn't find #{authenticatable_type} with email #{normalized_email_param}"
+        )
+      end
+    end
+
+    def call_after_session_save
+      return if @skip_after_session_save_callback
+
+      if Passwordless.config.after_session_save.arity == 2
+        Passwordless.config.after_session_save.call(@session, request)
       else
-        authenticatable_class.where("lower(#{email_field}) = ?", email).first
+        Passwordless.config.after_session_save.call(@session)
       end
     end
 

data/app/mailers/passwordless/mailer.rb

@@ -3,7 +3,7 @@
 module Passwordless
   # The mailer responsible for sending Passwordless' mails.
   class Mailer < Passwordless.config.parent_mailer.constantize
-    default from: Passwordless.config.default_from_address
+    default(from: Passwordless.config.default_from_address) if Passwordless.config.default_from_address
 
     # Sends a token and a magic link
     #
@@ -17,7 +17,8 @@ module Passwordless
         session,
         action: "confirm",
         id: session.to_param,
-        token: @token
+        token: @token,
+        **default_url_options
       )
 
       email_field = session.authenticatable.class.passwordless_email_field

data/app/views/passwordless/sessions/new.html.erb

@@ -1,12 +1,12 @@
 <%= form_with(model: @session, url: url_for(action: 'new'), data: { turbo: 'false' }) do |f| %>
   <% email_field_name = :"passwordless[#{email_field}]" %>
   <%= f.label email_field_name,
-          t("passwordless.sessions.new.email.label"),
-          for: "passwordless_#{email_field}" %>
+      t("passwordless.sessions.new.email.label"),
+      for: "passwordless_#{email_field}" %>
   <%= email_field_tag email_field_name,
-  params.fetch(email_field_name, nil),
-  required: true,
-  autofocus: true,
-  placeholder: t("passwordless.sessions.new.email.placeholder") %>
+      params.fetch(email_field_name, nil),
+      required: true,
+      autofocus: true,
+      placeholder: t("passwordless.sessions.new.email.placeholder") %>
   <%= f.submit t("passwordless.sessions.new.submit") %>
 <% end %>

data/app/views/passwordless/sessions/show.html.erb

@@ -1,5 +1,8 @@
 <%= form_with(model: @session, url: url_for(action: 'update'), scope: 'passwordless', method: 'patch', data: { turbo: false }) do |f| %>
-  <%= f.label :token, autocomplete: "off" %>
-  <%= f.text_field :token %>
+  <%= f.label :token %>
+  <%= f.text_field :token,
+      required: true,
+      autofocus: true,
+      autocomplete: "one-time-code" %>
   <%= f.submit t(".confirm") %>
 <% end %>

data/lib/passwordless/config.rb

@@ -28,6 +28,7 @@ module Passwordless
     include Options
 
     option :default_from_address, default: "CHANGE_ME@example.com"
+    option :parent_controller, default: "ApplicationController"
     option :parent_mailer, default: "ActionMailer::Base"
     option :restrict_token_reuse, default: true
     option :token_generator, default: ShortTokenGenerator.new
@@ -48,6 +49,8 @@ module Passwordless
       end
     )
 
+    option :paranoid, default: false
+
     def initialize
       set_defaults!
     end

data/lib/passwordless/test_helpers.rb

@@ -43,21 +43,22 @@ module Passwordless
     end
 
     module SystemTestCase
-      def passwordless_sign_out(cls = nil)
+      def passwordless_sign_out(cls = nil, only_path: false)
         cls ||= "User".constantize
         resource = cls.model_name.to_s.tableize
 
-        visit(Passwordless.context.url_for(resource, action: "destroy"))
+        visit(Passwordless.context.url_for(resource, action: "destroy", only_path: only_path))
       end
 
-      def passwordless_sign_in(resource)
+      def passwordless_sign_in(resource, only_path: false)
         session = Passwordless::Session.create!(authenticatable: resource)
 
         magic_link = Passwordless.context.url_for(
           session,
           action: "confirm",
           id: session.to_param,
-          token: session.token
+          token: session.token,
+          only_path: only_path
         )
 
         visit(magic_link)

data/lib/passwordless/version.rb

@@ -2,5 +2,5 @@
 
 module Passwordless
   # :nodoc:
-  VERSION = "1.2.0"
+  VERSION = "1.4.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: passwordless
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.4.0
 platform: ruby
 authors:
 - Mikkel Malmberg
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-12-05 00:00:00.000000000 Z
+date: 2024-01-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -91,7 +91,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.22
+rubygems_version: 3.5.5
 signing_key:
 specification_version: 4
 summary: Add authentication to your app without all the ickyness of passwords.