passwordless 1.6.0 → 1.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 44758dfedcb5f0b737a6892abdb754751f14d4da6d0c4e7e3ae9fa41d1b544ee
-  data.tar.gz: 01e6534d9d3f8e11ff1f13e908c62a096fc32129a1f34df5a75defa97b7a0b31
+  metadata.gz: b0e00cb666dc0018cb5789bf9f3b9186e7d107631365847374aa718d547f872e
+  data.tar.gz: dd7cf0cd6c95151f3987e827693f3bb78811b6eba50661a6c822a54e0788b908
 SHA512:
-  metadata.gz: 29e04ae936111350bf9673b2fd38f88e47006b72bcdd4aac5a38595623ab93558ab03e0a62677197d21f56e5370f38cc9fa5b5cc44bd8d8bdecf43e5ee66932d
-  data.tar.gz: 0701f4569d5e37ca19d42eb1afe00bd4b99fb68a1e2951ff9ec419221d32fb559e012cbc80115013b94cb316b5b98c70f32e862ce448cc2985464a39f73d9e4a
+  metadata.gz: 664906f92b865e89863f5a886bacc119a1ccc1970eead36d7496a12545a8ce022553f30982bc4b8b852fee9b6cdb4580ae01e4c37d56e59ae52b026c836bbebc
+  data.tar.gz: b02a2dd05dae19dd283a455da70690c8086bfd6958f78986b7b8ac6442fa31bdc627362e12a59f19c9e51f1fa15a7e47fced64c09529ed3c2aa0454cd33bb84a

data/README.md

@@ -8,7 +8,24 @@
 
 Add authentication to your Rails app without all the icky-ness of passwords. _Magic link_ authentication, if you will. We call it _passwordless_.
 
----
+- [Installation](#installation)
+  - [Upgrading](#upgrading)
+- [Usage](#usage)
+  - [Getting the current user, restricting access, the usual](#getting-the-current-user-restricting-access-the-usual)
+  - [Providing your own templates](#providing-your-own-templates)
+  - [Registering new users](#registering-new-users)
+  - [URLs and links](#urls-and-links)
+  - [Route constraints](#route-constraints)
+- [Configuration](#configuration)
+  - [Delivery method](#delivery-method)
+  - [Token generation](#token-generation)
+  - [Timeout and Expiry](#timeout-and-expiry)
+  - [Redirection after sign-in](#redirection-after-sign-in)
+  - [Looking up the user](#looking-up-the-user)
+- [Test helpers](#test-helpers)
+- [Security considerations](#security-considerations)
+- [Alternatives](#alternatives)
+- [License](#license)
 
 ## Installation
 
@@ -149,6 +166,59 @@ config.action_mailer.default_url_options = {host: "www.example.com"}
 routes.default_url_options[:host] ||= "www.example.com"
 ```
 
+Note as well that `passwordless_for` accepts a custom controller. One possible application of this
+is to add a `before_action` that redirects authenticated users from the sign-in routes, as in this example:
+
+
+```ruby
+# config/routes.rb
+passwordless_for :users, controller: "sessions"
+```
+
+```ruby
+# app/controllers/sessions_controller.rb
+
+class SessionsController < Passwordless::SessionsController
+  before_action :require_unauth!, only: %i[new show]
+
+  private
+
+  def require_unauth!
+    return unless current_user
+    redirect_to("/", notice: "You are already signed in.")
+  end
+end
+```
+
+### Route constraints
+
+With [constraints](https://guides.rubyonrails.org/routing.html#request-based-constraints) you can restrict access to certain routes.
+Passwordless provides `Passwordless::Constraint` and it's negative counterpart `Passwordless::ConstraintNot` for this purpose.
+
+To limit a route to only authenticated `User`s:
+
+```ruby
+constraints Passwordless::Constraint.new(User) do
+  # ...
+end
+```
+
+The constraint takes a second `if:` argument, that expects a block and is passed the `authenticatable` record, (ie. `User`):
+
+```ruby
+constraints Passwordless::Constraint.new(User, if: -> (user) { user.email.include?("john") }) do
+  # ...
+end
+```
+
+The negated version has the same API but with the opposite result, ie. ensuring authenticated user **don't** have access:
+
+```ruby
+constraints Passwordless::ConstraintNot.new(User) do
+  get("/no-users-allowed", to: "secrets#index")
+end
+```
+
 ## Configuration
 
 To customize Passwordless, create a file `config/initializers/passwordless.rb`.
@@ -160,7 +230,7 @@ Passwordless.configure do |config|
   config.default_from_address = "CHANGE_ME@example.com"
   config.parent_controller = "ApplicationController"
   config.parent_mailer = "ActionMailer::Base"
-  config.restrict_token_reuse = false # Can a token/link be used multiple times?
+  config.restrict_token_reuse = true # Can a token/link be used multiple times?
   config.token_generator = Passwordless::ShortTokenGenerator.new # Used to generate magic link tokens.
 
   config.expires_at = lambda { 1.year.from_now } # How long until a signed in session expires.
@@ -173,6 +243,8 @@ Passwordless.configure do |config|
   config.sign_out_redirect_path = '/' # After a user signs out
 
   config.paranoid = false # Display email sent notice even when the resource is not found.
+
+  config.after_session_confirm = ->(request, session) {} # Called after a session is confirmed.
 end
 ```
 
@@ -194,6 +266,20 @@ Passwordless.configure do |config|
 end
 ```
 
+## After Session Confirm Hook
+
+An `after_session_confirm` hook is called after a successful session confirmation – in other words: after a user signs in successfully.
+
+```ruby
+Passwordless.configure do |config|
+  config.after_session_confirm = ->(session, request) {
+    user = session.authenticatable
+    user.update!(
+      email_verified: true.
+      last_login_ip: request.remote_ip
+    )
+  }
+end
 ### Token generation
 
 By default Passwordless generates short, 6-digit, alpha numeric tokens. You can change the generator using `Passwordless.config.token_generator` to something else that responds to `call(session)` eg.:

data/app/controllers/passwordless/sessions_controller.rb

@@ -150,6 +150,7 @@ module Passwordless
     def authenticate_and_sign_in(session, token)
       if session.authenticate(token)
         sign_in(session)
+        call_after_session_confirm(session, request)
         redirect_to(
           passwordless_success_redirect_path(session.authenticatable),
           status: :see_other,
@@ -188,6 +189,12 @@ module Passwordless
       end
     end
 
+    def call_after_session_confirm(session, request)
+      return unless Passwordless.config.after_session_confirm.respond_to?(:call)
+
+      Passwordless.config.after_session_confirm.call(session, request)
+    end
+
     def find_authenticatable
       if authenticatable_class.respond_to?(:fetch_resource_for_passwordless)
         authenticatable_class.fetch_resource_for_passwordless(normalized_email_param)

data/app/mailers/passwordless/mailer.rb

@@ -26,7 +26,7 @@ module Passwordless
 
       mail(
         to: session.authenticatable.send(email_field),
-        subject: I18n.t("passwordless.mailer.sign_in.subject")
+        subject: I18n.t("passwordless.mailer.sign_in.subject", token: @token)
       )
     end
   end

data/db/migrate/20171104221735_create_passwordless_sessions.rb

@@ -6,6 +6,7 @@ class CreatePasswordlessSessions < ActiveRecord::Migration[6.0]
       t.belongs_to(
         :authenticatable,
         polymorphic: true,
+        type: :int, # change to e.g. :uuid if your model doesn't use integer IDs
         index: {name: "authenticatable"}
       )
 

data/lib/passwordless/config.rb

@@ -51,6 +51,12 @@ module Passwordless
 
     option :paranoid, default: false
 
+    option(
+      :after_session_confirm,
+      default: lambda do |_session, _request|
+      end
+    )
+
     def initialize
       set_defaults!
     end

data/lib/passwordless/constraint.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require "passwordless/controller_helpers"
+
+module Passwordless
+  # A class the constraint routes to authenticated records
+  class Constraint
+    include ControllerHelpers
+
+    attr_reader :authenticatable_type, :predicate, :session
+
+    # @param [Class] authenticatable_type Authenticatable class
+    # @option options [Proc] :if A lambda that takes an authenticatable and returns a boolean
+    def initialize(authenticatable_type, **options)
+      @authenticatable_type = authenticatable_type
+      # `if' is a keyword but so we do this instead of keyword arguments
+      @predicate = options.fetch(:if) { -> (_) { true } }
+    end
+
+    def matches?(request)
+      # used in authenticate_by_session
+      @session = request.session
+      authenticatable = authenticate_by_session(authenticatable_type)
+      !!(authenticatable && predicate.call(authenticatable))
+    end
+  end
+
+  # A class the constraint routes to NOT authenticated records
+  class ConstraintNot < Constraint
+    # @param [Class] authenticatable_type Authenticatable class
+    # @option options [Proc] :if A lambda that takes an authenticatable and returns a boolean
+    def initialize(authenticatable_type, **options)
+      super
+    end
+
+    def matches?(request)
+      !super
+    end
+  end
+end

data/lib/passwordless/controller_helpers.rb

@@ -54,7 +54,7 @@ module Passwordless
     end
 
     # Signs in session
-    # @param authenticatable [Passwordless::Session] Instance of {Passwordless::Session}
+    # @param passwordless_session [Passwordless::Session] Instance of {Passwordless::Session}
     # to sign in
     # @return [ActiveRecord::Base] the record that is passed in.
     def sign_in(passwordless_session)

data/lib/passwordless/engine.rb

@@ -11,9 +11,5 @@ module Passwordless
       ActionDispatch::Routing::Mapper.include RouterHelpers
       ActiveRecord::Base.extend ModelHelpers
     end
-
-    config.before_initialize do |app|
-      app.config.i18n.load_path += Dir[Engine.root.join("config", "locales", "*.yml")]
-    end
   end
 end

data/lib/passwordless/version.rb

@@ -2,5 +2,5 @@
 
 module Passwordless
   # :nodoc:
-  VERSION = "1.6.0"
+  VERSION = "1.8.0"
 end

data/lib/passwordless.rb

@@ -3,6 +3,7 @@
 require "active_support"
 require "passwordless/config"
 require "passwordless/context"
+require "passwordless/constraint"
 require "passwordless/errors"
 require "passwordless/engine"
 require "passwordless/token_digest"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: passwordless
 version: !ruby/object:Gem::Version
-  version: 1.6.0
+  version: 1.8.0
 platform: ruby
 authors:
 - Mikkel Malmberg
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-04-25 00:00:00.000000000 Z
+date: 2024-10-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -62,6 +62,7 @@ files:
 - lib/generators/passwordless/views_generator.rb
 - lib/passwordless.rb
 - lib/passwordless/config.rb
+- lib/passwordless/constraint.rb
 - lib/passwordless/context.rb
 - lib/passwordless/controller_helpers.rb
 - lib/passwordless/engine.rb
@@ -91,7 +92,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.9
+rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
 summary: Add authentication to your app without all the ickyness of passwords.