quo_vadis 2.2.5 → 2.2.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d6a07996a9ca5d95f789060694cf9a1be4d2bc7c8e585f7a60c1e3c883eec1e7
-  data.tar.gz: 350e447a8897c4af8b0bad19971b23bc7d551ca348d4cb1ae0d6ff713f928883
+  metadata.gz: 793c8183dd6e61c69255ca9e13a9726949591cbc4e3dda9890fb213848819dea
+  data.tar.gz: a01e34b058359d91dac594c617a2c55550f16f2e607a9b254f2087eab9eadc10
 SHA512:
-  metadata.gz: 8461e1e31a53a02073b281d99028b0b25839764746d986e7e3325b5c5e8763d4b34cc48b1ae69064405022341fb76101488dc11f3229e8d0d3afcf236beb02fc
-  data.tar.gz: 508ebf170a8abe591c8217a68390b9e11ec0204b86412e87b86ead2e84b3e0fcab2886aa22897a2d4266d43370cc42c25938a4e92c3073bf042d695278dff761
+  metadata.gz: b5c29de9d14f2d2d14e4fcefa04379b0135c5720b27df6d3762c30503e121cb811f1e0248a76d589580931f953367c04f810d286df15204abe2c52b2df1c82cb
+  data.tar.gz: 9afd5eb09d2b91db1a5c3023e2c2b4fccd545231b39188fa95acebab677549dc642a657797b8c2e59b83b00595ce21083ffeadf0be2f4c17aa09e64496a9a672

data/CHANGELOG.md

@@ -4,6 +4,12 @@
 ## HEAD
 
 
+## 2.2.6 (17 November 2025)
+
+* Make permitting of password updates explicit.
+* Feature-detect method rather than module for normalisation.
+
+
 ## 2.2.5 (14 April 2025)
 
 * Normalise identifier value for lookup.

data/README.md

@@ -59,6 +59,8 @@ Finally, copy the example views across:
 rails generate quo_vadis:install
 ```
 
+You may find that you need to eager load your code in development so that your model's / models' `#authenticates` call(s) executes straightaway.  This method registers your model(s) with QuoVadis, which needs to happen before you can do any authentication-related things such as reset your password.
+
 
 ## Usage
 

data/app/models/quo_vadis/password.rb

@@ -7,12 +7,14 @@ module QuoVadis
     has_secure_password
 
     validates_length_of :password, minimum: QuoVadis.password_minimum_length, allow_blank: true
-    validate :password_updated_legitimately, on: :update
+    validate :permitted_update, on: :update
 
     attr_accessor :new_password
 
 
     def change(current_plaintext, new_plaintext, new_plaintext_confirmation)
+      permit_password_update
+
       unless authenticate current_plaintext
         errors.add :password, :incorrect
         return false
@@ -38,6 +40,8 @@ module QuoVadis
 
 
     def reset(new_plaintext, new_plaintext_confirmation)
+      permit_password_update
+
       # has_secure_password ignores empty passwords ("") on update so reject them here.
       if new_plaintext.empty?
         errors.add :password, :blank
@@ -56,18 +60,19 @@ module QuoVadis
 
     private
 
-    def password_updated_legitimately
-      return unless password_digest_changed?
+    def permit_password_update
+      @permit_password_update = true
+    end
 
-      unless change_or_reset_called?
-        errors.add :password, 'must be updated via #change or #reset'
-      end
+    def permit_password_update?
+      @permit_password_update
     end
 
-    def change_or_reset_called?
-      caller_locations.any? { |loc|
-        ['change', 'reset'].include?(loc.label) && Pathname.new(loc.path).basename.to_s == 'password.rb'
-      }
+    def permitted_update
+      return unless password_digest_changed?
+      return if permit_password_update?
+
+      errors.add :password, 'must be updated via #change or #reset'
     end
   end
 end

data/lib/quo_vadis/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module QuoVadis
-  VERSION = '2.2.5'
+  VERSION = '2.2.6'
 end

data/lib/quo_vadis.rb

@@ -53,7 +53,7 @@ module QuoVadis
       identifier = detect_identifier params.keys
       value = params[identifier]
 
-      return value unless defined?(ActiveRecord::Normalization)
+      return value unless ApplicationRecord.respond_to? :normalize_value_for
 
       klass = model_of(identifier.to_sym).constantize
       klass.normalize_value_for(identifier.to_sym, value)

data/test/models/account_test.rb

@@ -17,7 +17,7 @@ class AccountTest < ActiveSupport::TestCase
     p = Person.create! username: 'bob', email: 'bob@example.com', password: 'secretsecret'
     assert_enqueued_email_with QuoVadis::Mailer,
       :identifier_change_notification,
-      args: {email: 'bob@example.com', identifier: 'username', ip: nil, timestamp: Time.now} do
+      params: {email: 'bob@example.com', identifier: 'username', ip: nil, timestamp: Time.now} do
       assert_enqueued_emails 1 do
         p.update username: 'robert@example.com'
       end
@@ -30,7 +30,7 @@ class AccountTest < ActiveSupport::TestCase
     u = User.create! name: 'bob', email: 'bob@example.com', password: '123456789abc'
     assert_enqueued_email_with QuoVadis::Mailer,
       :email_change_notification,
-      args: {email: 'bob@example.com', ip: nil, timestamp: Time.now} do
+      params: {email: 'bob@example.com', ip: nil, timestamp: Time.now} do
       assert_enqueued_emails 1 do
         u.update email: 'robert@example.com'
       end

data/test/models/model_test.rb

@@ -63,7 +63,7 @@ class ModelTest < ActiveSupport::TestCase
     u = User.create! name: 'bob', email: 'bob@example.com', password: '123456789abc'
     assert_enqueued_email_with QuoVadis::Mailer,
       :email_change_notification,
-      args: {email: 'bob@example.com', ip: nil, timestamp: Time.now} do
+      params: {email: 'bob@example.com', ip: nil, timestamp: Time.now} do
       u.update email: 'robert@example.com'
     end
   end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: quo_vadis
 version: !ruby/object:Gem::Version
-  version: 2.2.5
+  version: 2.2.6
 platform: ruby
 authors:
 - Andy Stewart
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-04-14 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -66,7 +65,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
-description:
 email:
 - boss@airbladesoftware.com
 executables: []
@@ -206,7 +204,6 @@ homepage: https://github.com/airblade/quo_vadis
 licenses:
 - MIT
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -221,8 +218,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.11
-signing_key:
+rubygems_version: 3.7.2
 specification_version: 4
 summary: Multifactor authentication for Rails.
 test_files: []