passwordless 1.7.0 → 1.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7e765c341b12f05bb0156802dae574f7a0db31288181d4f71779a6ca49e48cd6
-  data.tar.gz: 746f09e1aefaea54d0f926c9bff27548ba1f8a4fdeeea0cfbd87ddc4b22ad65f
+  metadata.gz: 971e8f0ab8571c17897b3e299c0733a555135e268537168ede2257162f6e7202
+  data.tar.gz: 2dfc64b642041c81aaad24b07237116c0250a3c5bc1686c4b7eff33cd4b109e8
 SHA512:
-  metadata.gz: 8792ad81a4efbd5a071bb8a119d3e1ad057f2112e2bebbb888bbfdc9a84b95a77e4e2cb68ffb957fecb98f75cf05efb6c17cbd5c97b67a41f1372257eeb1cae9
-  data.tar.gz: 763dbbba33a8568976b5a5df2c28f0d157dcf9fc92504bf9ca016e85f8239c59b1e6ae48f4fa4e2e5ab2391aba9239ce956f7706c5437e168c27756a80fc9f33
+  metadata.gz: 8873bb31b26549582c9297b5ca95d6f1abb0279c2aede005111025bc45b3dcab5619e7f06cc27d5d63ef9e58d166c9c252d3fadc409e4c42e37fc7818a82d395
+  data.tar.gz: acddc79fafb500792d493f1d0ccd1f0ffd4fdda8ee02b279d2132b6a325770fb9ff1ceb36e86eb792c4f19743b9600e3ce515375626aa2daf91dc65e27dd8223

data/README.md

@@ -166,10 +166,34 @@ config.action_mailer.default_url_options = {host: "www.example.com"}
 routes.default_url_options[:host] ||= "www.example.com"
 ```
 
+Note as well that `passwordless_for` accepts a custom controller. One possible application of this
+is to add a `before_action` that redirects authenticated users from the sign-in routes, as in this example:
+
+
+```ruby
+# config/routes.rb
+passwordless_for :users, controller: "sessions"
+```
+
+```ruby
+# app/controllers/sessions_controller.rb
+
+class SessionsController < Passwordless::SessionsController
+  before_action :require_unauth!, only: %i[new show]
+
+  private
+
+  def require_unauth!
+    return unless current_user
+    redirect_to("/", notice: "You are already signed in.")
+  end
+end
+```
+
 ### Route constraints
 
 With [constraints](https://guides.rubyonrails.org/routing.html#request-based-constraints) you can restrict access to certain routes.
-Passwordless provides `Passwordless::Constraint` and it's negative counterpart `Passwordless::NotConstraint` for this purpose.
+Passwordless provides `Passwordless::Constraint` and it's negative counterpart `Passwordless::ConstraintNot` for this purpose.
 
 To limit a route to only authenticated `User`s:
 
@@ -190,7 +214,7 @@ end
 The negated version has the same API but with the opposite result, ie. ensuring authenticated user **don't** have access:
 
 ```ruby
-constraints Passwordless::NotConstraint.new(User) do
+constraints Passwordless::ConstraintNot.new(User) do
   get("/no-users-allowed", to: "secrets#index")
 end
 ```
@@ -219,6 +243,8 @@ Passwordless.configure do |config|
   config.sign_out_redirect_path = '/' # After a user signs out
 
   config.paranoid = false # Display email sent notice even when the resource is not found.
+
+  config.after_session_confirm = ->(request, session) {} # Called after a session is confirmed.
 end
 ```
 
@@ -240,6 +266,22 @@ Passwordless.configure do |config|
 end
 ```
 
+## After Session Confirm Hook
+
+An `after_session_confirm` hook is called after a successful session confirmation – in other words: after a user signs in successfully.
+
+```ruby
+Passwordless.configure do |config|
+  config.after_session_confirm = ->(session, request) {
+    user = session.authenticatable
+    user.update!(
+      email_verified: true,
+      last_login_ip: request.remote_ip
+    )
+  }
+end
+```
+
 ### Token generation
 
 By default Passwordless generates short, 6-digit, alpha numeric tokens. You can change the generator using `Passwordless.config.token_generator` to something else that responds to `call(session)` eg.:

data/Rakefile

@@ -18,12 +18,10 @@ load("rails/tasks/statistics.rake")
 
 require "bundler/gem_tasks"
 
-require "rake/testtask"
-
-Rake::TestTask.new(:test) do |t|
-  t.libs << "test"
-  t.pattern = "test/**/*_test.rb"
-  t.verbose = false
+task(:test) do
+  puts("Use `bin/rails test`")
+  puts("-" * 80)
+  system("bin/rails test")
 end
 
 task(default: :test)

data/app/controllers/passwordless/sessions_controller.rb

@@ -150,6 +150,7 @@ module Passwordless
     def authenticate_and_sign_in(session, token)
       if session.authenticate(token)
         sign_in(session)
+        call_after_session_confirm(session, request)
         redirect_to(
           passwordless_success_redirect_path(session.authenticatable),
           status: :see_other,
@@ -188,6 +189,12 @@ module Passwordless
       end
     end
 
+    def call_after_session_confirm(session, request)
+      return unless Passwordless.config.after_session_confirm.respond_to?(:call)
+
+      Passwordless.config.after_session_confirm.call(session, request)
+    end
+
     def find_authenticatable
       if authenticatable_class.respond_to?(:fetch_resource_for_passwordless)
         authenticatable_class.fetch_resource_for_passwordless(normalized_email_param)

data/app/mailers/passwordless/mailer.rb

@@ -26,7 +26,7 @@ module Passwordless
 
       mail(
         to: session.authenticatable.send(email_field),
-        subject: I18n.t("passwordless.mailer.sign_in.subject")
+        subject: I18n.t("passwordless.mailer.sign_in.subject", token: @token)
       )
     end
   end

data/db/migrate/20171104221735_create_passwordless_sessions.rb

@@ -6,6 +6,7 @@ class CreatePasswordlessSessions < ActiveRecord::Migration[6.0]
       t.belongs_to(
         :authenticatable,
         polymorphic: true,
+        type: :int, # change to e.g. :uuid if your model doesn't use integer IDs
         index: {name: "authenticatable"}
       )
 

data/lib/passwordless/config.rb

@@ -51,6 +51,12 @@ module Passwordless
 
     option :paranoid, default: false
 
+    option(
+      :after_session_confirm,
+      default: lambda do |_session, _request|
+      end
+    )
+
     def initialize
       set_defaults!
     end

data/lib/passwordless/version.rb

@@ -2,5 +2,5 @@
 
 module Passwordless
   # :nodoc:
-  VERSION = "1.7.0"
+  VERSION = "1.8.1"
 end

data/lib/passwordless.rb

@@ -12,8 +12,17 @@ require "passwordless/token_digest"
 module Passwordless
   extend Configurable
 
+  LOCK = Mutex.new
+
   def self.context
-    @context ||= Context.new
+    return @context if @context
+
+    # Routes are lazy loaded in Rails 8 so we need to load them to populate Context#resources.
+    Rails.application.try(:reload_routes_unless_loaded)
+
+    LOCK.synchronize do
+      @context ||= Context.new
+    end
   end
 
   def self.add_resource(resource, controller:, **defaults)

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: passwordless
 version: !ruby/object:Gem::Version
-  version: 1.7.0
+  version: 1.8.1
 platform: ruby
 authors:
 - Mikkel Malmberg
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-05-28 00:00:00.000000000 Z
+date: 2025-03-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -38,7 +37,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 3.1.11
-description:
 email:
 - mikkel@brnbw.com
 executables: []
@@ -77,7 +75,6 @@ homepage: https://github.com/mikker/passwordless
 licenses:
 - MIT
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -92,8 +89,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.10
-signing_key:
+rubygems_version: 3.6.2
 specification_version: 4
 summary: Add authentication to your app without all the ickyness of passwords.
 test_files: []