quo_vadis 2.2.0 → 2.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5e9808f4e29d96b1c9deac895bb45ebacbeb046928f22851fe618593abb49fa4
-  data.tar.gz: 38980863633e441f4c5d28c2fe03e5d8e6357afc4f4ddd4546f4492205aee48c
+  metadata.gz: f55b91cf69117006b0dce03a6b0d38423b587bf460c05e24984735de6a4cf8a3
+  data.tar.gz: 6a309a19fd35aaacbf1ec8ff5df7544ab980cecfad30664f6f0abb3778eb1d37
 SHA512:
-  metadata.gz: cb68d8909ca3343ed508dbe5c0510860a358cb39398d2bb5b91f999c6a74935e8bb09d41a27de5bcdc1a3061cb280865ce146fa168fa88690fc37f030cd83a78
-  data.tar.gz: 6b5e022eab6f659dd4620117595c9ff9b9527f532d6963b732d149db4316f833626cca40f5e89cd7b8071ebea7e87ff64462c71c8104628b033447debec7a2a2
+  metadata.gz: 70bb7a3fc80f540889eb0aff8416d75759e4b2564d17d8605ad368ea8eb53e803bda66b91dd8ba0192ee061148a62fe034d164becfd4b41876100c740edfe008
+  data.tar.gz: cfaa08ccde542121a46a361dbdbff4a56fd6d77b4295cc1f5e0232b7c94e1514a7a422a7138add4d9e8f964a451e0038fa065f8e49a8d79a5594e180c0bb63a2

data/CHANGELOG.md

@@ -4,6 +4,13 @@
 ## HEAD
 
 
+## 2.2.1 (1 August 2023)
+
+* Do not clear application session data on logout.
+* Use 'email' type for email input fields.
+* Document how to log out.
+
+
 ## 2.2.0 (17 April 2023)
 
 * Improve the readme with internal links and more section headings.

data/README.md

@@ -171,7 +171,7 @@ Your new user sign-up form ([example](https://github.com/airblade/quo_vadis/blob
 - a field for their identifier;
 - an `:email` field if the identifier is not their email.
 
-In your controller, use the [`#login`](#loginmodel-browser_session-%3D-true) method to log in your new user.  The optional second argument specifies for how long the user should be logged in, and any metadata you supply is logged in the audit log.
+In your controller, use the [`#login`](#loginmodel-browser_session--true-metadata-) method to log in your new user.  The optional second argument specifies for how long the user should be logged in, and any metadata you supply is logged in the audit log.
 
 After logging in the user, redirect them wherever you like.  You can use `qv.path_after_signup` which resolves to the first of these routes that exists: `:after_signup`, `:after_login`, the root route.
 
@@ -238,6 +238,40 @@ After authenticating the user will be redirected to the first of these that exis
 - your root route.
 
 
+### Logout
+
+Send a DELETE request to `quo_vadis.logout_path`.  For example:
+
+```ruby
+button_to 'Log out', quo_vadis.logout_path, method: :delete
+```
+
+Note you are responsible for removing any application session data you want removed.  To do so, subclass `QuoVadis::SessionsController` and override the `destroy` method:
+
+````ruby
+# app/controllers/custom_sessions_controller.rb
+class CustomSessionsController < QuoVadis::SessionsController
+  def destroy
+    reset_session
+    super
+  end
+end
+```
+
+Add a route:
+
+```ruby
+# config/routes.rb
+delete 'logout', to: 'custom_sessions#destroy'
+```
+
+And then point your log out button at your custom action:
+
+```ruby
+button_to 'Log out', main_app.logout_path, method: :delete
+```
+
+
 ### Two-factor authentication (2FA) or Two-step verification (2SV)
 
 If you do not want 2FA at all, set `QuoVadis.two_factor_authentication_mandatory false` in your configuration and skip the rest of this section.
@@ -490,6 +524,6 @@ If you don't want a specific flash message at all, give the key an empty value i
 
 ## Intellectual Property
 
-Copyright 2011-2022 Andrew Stewart (boss@airbladesoftware.com).
+Copyright Andrew Stewart (boss@airbladesoftware.com).
 
 Released under the MIT licence.

data/app/views/quo_vadis/password_resets/new.html.erb

@@ -3,7 +3,7 @@
 <%= form_with url: password_reset_path, method: :post do |f| %>
   <p>
     <%= f.label :email %>
-    <%= f.text_field :email, inputmode: 'email', autocomplete: 'email' %>
+    <%= f.text_field :email, type: 'email', inputmode: 'email', autocomplete: 'email' %>
   </p>
 
   <p>

data/app/views/quo_vadis/sessions/new.html.erb

@@ -3,7 +3,7 @@
 <%= form_with url: login_path, method: :post do |f| %>
   <p>
     <%= f.label :email %>
-    <%= f.text_field :email, inputmode: 'email', autocomplete: 'email' %>
+    <%= f.text_field :email, type: 'email', inputmode: 'email', autocomplete: 'email' %>
   </p>
 
   <p>

data/lib/quo_vadis/controller.rb

@@ -190,7 +190,7 @@ module QuoVadis
       def logout
         session&.destroy
         clear_session_id
-        reset_session
+        prevent_rails_session_fixation
         controller.instance_variable_set :@authenticated_model, nil
       end
 

data/lib/quo_vadis/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module QuoVadis
-  VERSION = '2.2.0'
+  VERSION = '2.2.1'
 end

data/test/README.md

@@ -0,0 +1,6 @@
+# Testing
+
+Run tests with:
+
+    bundle exec rails test
+

data/test/dummy/app/controllers/articles_controller.rb

@@ -6,6 +6,7 @@ class ArticlesController < ApplicationController
   end
 
   def secret
+    session[:foo] = 'bar'
   end
 
   def also_secret

data/test/integration/sessions_test.rb

@@ -69,6 +69,22 @@ class SessionsTest < IntegrationTest
   end
 
 
+  test 'non-authentication session data is not removed on logout' do
+    desktop = login
+    session_id = desktop.session.id
+
+    desktop.get secret_articles_path
+    assert_equal 'bar', desktop.session[:foo]
+
+    desktop.delete quo_vadis.logout_path
+    refute desktop.controller.logged_in?
+
+    desktop.get articles_path
+    assert_equal 'bar', desktop.session[:foo]
+    refute_equal session_id, desktop.session.id
+  end
+
+
   private
 
   # starts a new rails session and logs in

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: quo_vadis
 version: !ruby/object:Gem::Version
-  version: 2.2.0
+  version: 2.2.1
 platform: ruby
 authors:
 - Andy Stewart
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-04-17 00:00:00.000000000 Z
+date: 2023-08-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -136,6 +136,7 @@ files:
 - lib/quo_vadis/model.rb
 - lib/quo_vadis/version.rb
 - quo_vadis.gemspec
+- test/README.md
 - test/dummy/README.markdown
 - test/dummy/Rakefile
 - test/dummy/app/controllers/application_controller.rb
@@ -218,7 +219,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.33
+rubygems_version: 3.4.10
 signing_key:
 specification_version: 4
 summary: Multifactor authentication for Rails 6 and 7.