passwordless 1.7.0 → 1.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7e765c341b12f05bb0156802dae574f7a0db31288181d4f71779a6ca49e48cd6
-  data.tar.gz: 746f09e1aefaea54d0f926c9bff27548ba1f8a4fdeeea0cfbd87ddc4b22ad65f
+  metadata.gz: b0e00cb666dc0018cb5789bf9f3b9186e7d107631365847374aa718d547f872e
+  data.tar.gz: dd7cf0cd6c95151f3987e827693f3bb78811b6eba50661a6c822a54e0788b908
 SHA512:
-  metadata.gz: 8792ad81a4efbd5a071bb8a119d3e1ad057f2112e2bebbb888bbfdc9a84b95a77e4e2cb68ffb957fecb98f75cf05efb6c17cbd5c97b67a41f1372257eeb1cae9
-  data.tar.gz: 763dbbba33a8568976b5a5df2c28f0d157dcf9fc92504bf9ca016e85f8239c59b1e6ae48f4fa4e2e5ab2391aba9239ce956f7706c5437e168c27756a80fc9f33
+  metadata.gz: 664906f92b865e89863f5a886bacc119a1ccc1970eead36d7496a12545a8ce022553f30982bc4b8b852fee9b6cdb4580ae01e4c37d56e59ae52b026c836bbebc
+  data.tar.gz: b02a2dd05dae19dd283a455da70690c8086bfd6958f78986b7b8ac6442fa31bdc627362e12a59f19c9e51f1fa15a7e47fced64c09529ed3c2aa0454cd33bb84a

data/README.md

@@ -166,10 +166,34 @@ config.action_mailer.default_url_options = {host: "www.example.com"}
 routes.default_url_options[:host] ||= "www.example.com"
 ```
 
+Note as well that `passwordless_for` accepts a custom controller. One possible application of this
+is to add a `before_action` that redirects authenticated users from the sign-in routes, as in this example:
+
+
+```ruby
+# config/routes.rb
+passwordless_for :users, controller: "sessions"
+```
+
+```ruby
+# app/controllers/sessions_controller.rb
+
+class SessionsController < Passwordless::SessionsController
+  before_action :require_unauth!, only: %i[new show]
+
+  private
+
+  def require_unauth!
+    return unless current_user
+    redirect_to("/", notice: "You are already signed in.")
+  end
+end
+```
+
 ### Route constraints
 
 With [constraints](https://guides.rubyonrails.org/routing.html#request-based-constraints) you can restrict access to certain routes.
-Passwordless provides `Passwordless::Constraint` and it's negative counterpart `Passwordless::NotConstraint` for this purpose.
+Passwordless provides `Passwordless::Constraint` and it's negative counterpart `Passwordless::ConstraintNot` for this purpose.
 
 To limit a route to only authenticated `User`s:
 
@@ -190,7 +214,7 @@ end
 The negated version has the same API but with the opposite result, ie. ensuring authenticated user **don't** have access:
 
 ```ruby
-constraints Passwordless::NotConstraint.new(User) do
+constraints Passwordless::ConstraintNot.new(User) do
   get("/no-users-allowed", to: "secrets#index")
 end
 ```
@@ -219,6 +243,8 @@ Passwordless.configure do |config|
   config.sign_out_redirect_path = '/' # After a user signs out
 
   config.paranoid = false # Display email sent notice even when the resource is not found.
+
+  config.after_session_confirm = ->(request, session) {} # Called after a session is confirmed.
 end
 ```
 
@@ -240,6 +266,20 @@ Passwordless.configure do |config|
 end
 ```
 
+## After Session Confirm Hook
+
+An `after_session_confirm` hook is called after a successful session confirmation – in other words: after a user signs in successfully.
+
+```ruby
+Passwordless.configure do |config|
+  config.after_session_confirm = ->(session, request) {
+    user = session.authenticatable
+    user.update!(
+      email_verified: true.
+      last_login_ip: request.remote_ip
+    )
+  }
+end
 ### Token generation
 
 By default Passwordless generates short, 6-digit, alpha numeric tokens. You can change the generator using `Passwordless.config.token_generator` to something else that responds to `call(session)` eg.:

data/app/controllers/passwordless/sessions_controller.rb

@@ -150,6 +150,7 @@ module Passwordless
     def authenticate_and_sign_in(session, token)
       if session.authenticate(token)
         sign_in(session)
+        call_after_session_confirm(session, request)
         redirect_to(
           passwordless_success_redirect_path(session.authenticatable),
           status: :see_other,
@@ -188,6 +189,12 @@ module Passwordless
       end
     end
 
+    def call_after_session_confirm(session, request)
+      return unless Passwordless.config.after_session_confirm.respond_to?(:call)
+
+      Passwordless.config.after_session_confirm.call(session, request)
+    end
+
     def find_authenticatable
       if authenticatable_class.respond_to?(:fetch_resource_for_passwordless)
         authenticatable_class.fetch_resource_for_passwordless(normalized_email_param)

data/app/mailers/passwordless/mailer.rb

@@ -26,7 +26,7 @@ module Passwordless
 
       mail(
         to: session.authenticatable.send(email_field),
-        subject: I18n.t("passwordless.mailer.sign_in.subject")
+        subject: I18n.t("passwordless.mailer.sign_in.subject", token: @token)
       )
     end
   end

data/db/migrate/20171104221735_create_passwordless_sessions.rb

@@ -6,6 +6,7 @@ class CreatePasswordlessSessions < ActiveRecord::Migration[6.0]
       t.belongs_to(
         :authenticatable,
         polymorphic: true,
+        type: :int, # change to e.g. :uuid if your model doesn't use integer IDs
         index: {name: "authenticatable"}
       )
 

data/lib/passwordless/config.rb

@@ -51,6 +51,12 @@ module Passwordless
 
     option :paranoid, default: false
 
+    option(
+      :after_session_confirm,
+      default: lambda do |_session, _request|
+      end
+    )
+
     def initialize
       set_defaults!
     end

data/lib/passwordless/version.rb

@@ -2,5 +2,5 @@
 
 module Passwordless
   # :nodoc:
-  VERSION = "1.7.0"
+  VERSION = "1.8.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: passwordless
 version: !ruby/object:Gem::Version
-  version: 1.7.0
+  version: 1.8.0
 platform: ruby
 authors:
 - Mikkel Malmberg
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-05-28 00:00:00.000000000 Z
+date: 2024-10-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -92,7 +92,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.10
+rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
 summary: Add authentication to your app without all the ickyness of passwords.