prefixed_ids 1.2.2 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 38b6a59341fa7c4d02fdaba7f6eb738cdb5730a9aa6caca89ffb89bfa9dc4740
-  data.tar.gz: ae7de74cf643796ce5fdafe5e0b7d0db98cf60b761a52a960ad1122c14028b0a
+  metadata.gz: b5a5f802c0838ffb2538b43212061d569d0920356aed91e313865799c570d573
+  data.tar.gz: 6488ec773ddb3f15dfb48a9bc07ce4d39262feabb89eb8d3a5168e5ffdf52017
 SHA512:
-  metadata.gz: 428331d371bbcc87c9d092297b315476ccd9e62548ff59efef59cb7a3574b256247f4dacf6c1edc3c2f72e553a742033493f51587af264707a77ca3d797cea9e
-  data.tar.gz: af9b8a1f596b9b6d1720e8ec71b267421d6c0df5fd661e0b3b76765d8606bb929e5bf2a2bbe81a9fd853290e4e1a844ca7d3a63ad25001da9d9eb9beb3a98c0b
+  metadata.gz: 8b62b64c158bd670e814fbe92b7306a046b9f4e7933f494e5312ddb44f7a068fe9baaa579a11ad45b635aed0ec1dc83bec5b1699471ad550ed5e846a9125e446
+  data.tar.gz: a5233cee0e3fb432b1ff4e01bc60f6c33cc670df756bb09e315f26fd5d22c6b7325bc2fde0eb1369be21196d4b23e65850dadf10f0fc2ee927aa636b8067670b

data/README.md

@@ -13,6 +13,8 @@ user_12345abcd
 acct_23lksjdg3
 ```
 
+This gem works by hashing the record's original `:id` attribute using [`Hashids`](https://hashids.org/ruby/), which transforms numbers like 347 into a string like yr8. It uses the table's name and an optional additional salt to hash values, returning a string like `tablename_hashedvalue`.
+
 Inspired by [Stripe's prefixed IDs](https://stripe.com/docs/api) in their API.
 
 ## 🚀 Installation
@@ -34,13 +36,32 @@ end
 
 This will generate a value like `user_1234abcd`.
 
-To query using the prefixed ID, simply you can use either `find` or `find_by_prefixed_id`:
+##### Prefix ID Param
+
+To retrieve the prefix ID, simply call:
+
+```ruby
+User.to_param
+```
+
+If `to_param` override is disabled:
+
+```ruby
+User.prefix_id
+```
+
+##### Query by Prefixed ID
+
+To query using the prefixed ID, you can use either `find`, `find_by_prefix_id`, or `find_by_prefix_id!`:
 
 ```ruby
 User.find("user_5vJjbzXq9KrLEMm32iAnOP0xGDYk6dpe")
 User.find_by_prefix_id("user_5vJjbzXq9KrLEMm32iAnOP0xGDYk6dpe")
 ```
 
+⚠️ Note that `find` still finds records by the primary key. Eg. `localhost/users/1` still works. 
+If you're targeting security issues by masking the ID, make sure to use `find_by_prefix_id` and [add a salt](#salt).
+
 We also override `to_param` by default so it'll be used in URLs automatically.
 
 To disable find and to_param overrides, simply pass in the options:
@@ -51,7 +72,26 @@ class User < ApplicationRecord
 end
 ```
 
-### Generic lookup
+##### Salt
+
+A salt is a secret value that makes it impossible to reverse engineer IDs. We recommend adding a salt to make your Prefix IDs unguessable.
+
+###### Global Salt
+
+```ruby
+# config/initializers/prefixed_ids.rb
+PrefixedIds.salt = "salt"
+```
+
+###### Per Model Salt
+
+```ruby
+class User
+  has_prefix_id :user, salt: "usersalt"
+end
+```
+
+### Generic Lookup By Prefix ID
 
 Imagine you have a prefixed ID but you don't know which model it belongs to.
 
@@ -62,13 +102,13 @@ PrefixedIds.find("acct_2iAnOP0xGDYk6dpe")
 #=> #<Account>
 ```
 
-### Customizing
+### Customizing Prefix IDs
 
 You can customize the prefix, length, and attribute name for PrefixedIds.
 
 ```ruby
 class Account < ApplicationRecord
-  has_prefix_id :acct, minimum_length: 32, override_find: false, to_param: false
+  has_prefix_id :acct, minimum_length: 32, override_find: false, override_param: false, salt: ""
 end
 ```
 

data/lib/prefixed_ids/prefix_id.rb

@@ -4,10 +4,10 @@ module PrefixedIds
 
     TOKEN = 123
 
-    def initialize(model, prefix, minimum_length: PrefixedIds.minimum_length, alphabet: PrefixedIds.alphabet, delimiter: PrefixedIds.delimiter, **options)
+    def initialize(model, prefix, salt: PrefixedIds.salt, minimum_length: PrefixedIds.minimum_length, alphabet: PrefixedIds.alphabet, delimiter: PrefixedIds.delimiter, **options)
       @prefix = prefix.to_s
       @delimiter = delimiter.to_s
-      @hashids = Hashids.new(model.table_name, minimum_length, alphabet)
+      @hashids = Hashids.new("#{model.table_name}#{salt}", minimum_length, alphabet)
     end
 
     def encode(id)

data/lib/prefixed_ids/version.rb

@@ -1,3 +1,3 @@
 module PrefixedIds
-  VERSION = "1.2.2"
+  VERSION = "1.4.0"
 end

data/lib/prefixed_ids.rb

@@ -11,6 +11,7 @@ module PrefixedIds
   mattr_accessor :delimiter, default: "_"
   mattr_accessor :alphabet, default: "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890"
   mattr_accessor :minimum_length, default: 24
+  mattr_accessor :salt, default: ""
 
   mattr_accessor :models, default: {}
 
@@ -60,6 +61,14 @@ module PrefixedIds
       def find_by_prefix_id!(id)
         find_by!(id: _prefix_id.decode(id))
       end
+
+      def decode_prefix_id(id)
+        _prefix_id.decode(id)
+      end
+
+      def decode_prefix_ids(ids)
+        ids.map { |id| decode_prefix_id(id) }
+      end
     end
 
     def prefix_id

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: prefixed_ids
 version: !ruby/object:Gem::Version
-  version: 1.2.2
+  version: 1.4.0
 platform: ruby
 authors:
 - Chris Oliver
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-05-03 00:00:00.000000000 Z
+date: 2023-03-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -45,7 +45,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 2.0.0
 - !ruby/object:Gem::Dependency
-  name: standardrb
+  name: standard
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -86,7 +86,6 @@ files:
 - lib/prefixed_ids/engine.rb
 - lib/prefixed_ids/prefix_id.rb
 - lib/prefixed_ids/version.rb
-- lib/tasks/prefixed_ids_tasks.rake
 homepage: https://github.com/excid3/prefixed_ids
 licenses:
 - MIT
@@ -109,7 +108,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.3
+rubygems_version: 3.4.7
 signing_key:
 specification_version: 4
 summary: Prefixed IDs generates IDs with friendly prefixes for your models

data/lib/tasks/prefixed_ids_tasks.rake

@@ -1,4 +0,0 @@
-# desc "Explaining what the task does"
-# task :prefixed_ids do
-#   # Task goes here
-# end