rails_simple_auth 1.0.1 → 1.0.2

data/lib/generators/rails_simple_auth/install/install_generator.rb

@@ -1,64 +1,64 @@
 # frozen_string_literal: true
 
-require "rails/generators"
-require "rails/generators/active_record"
+require 'rails/generators'
+require 'rails/generators/active_record'
 
 module RailsSimpleAuth
   module Generators
     class InstallGenerator < Rails::Generators::Base
       include Rails::Generators::Migration
 
-      source_root File.expand_path("templates", __dir__)
+      source_root File.expand_path('templates', __dir__)
 
-      class_option :user_model, type: :string, default: "User",
-                   desc: "Name of your User model"
+      class_option :user_model, type: :string, default: 'User',
+                                desc: 'Name of your User model'
       class_option :skip_migration, type: :boolean, default: false,
-                   desc: "Skip generating migration"
+                                    desc: 'Skip generating migration'
 
       def self.next_migration_number(dirname)
         ActiveRecord::Generators::Base.next_migration_number(dirname)
       end
 
       def create_initializer
-        template "initializer.rb", "config/initializers/rails_simple_auth.rb"
+        template 'initializer.rb', 'config/initializers/rails_simple_auth.rb'
       end
 
       def create_migration
         return if options[:skip_migration]
 
-        migration_template "migration.rb", "db/migrate/add_rails_simple_auth.rb"
+        migration_template 'migration.rb', 'db/migrate/add_rails_simple_auth.rb'
       end
 
       def add_routes
-        route "rails_simple_auth_routes"
+        route 'rails_simple_auth_routes'
       end
 
       def show_instructions
-        say ""
-        say "RailsSimpleAuth installed successfully!", :green
-        say ""
-        say "Next steps:"
-        say "  1. Review and edit the migration: db/migrate/xxx_add_rails_simple_auth.rb"
-        say "  2. Run: rails db:migrate"
+        say ''
+        say 'RailsSimpleAuth installed successfully!', :green
+        say ''
+        say 'Next steps:'
+        say '  1. Review and edit the migration: db/migrate/xxx_add_rails_simple_auth.rb'
+        say '  2. Run: rails db:migrate'
         say "  3. Add concerns to your #{options[:user_model]} model:"
-        say ""
+        say ''
         say "     class #{options[:user_model]} < ApplicationRecord"
-        say "       include RailsSimpleAuth::Models::Concerns::Authenticatable"
-        say "       include RailsSimpleAuth::Models::Concerns::Confirmable      # optional"
-        say "       include RailsSimpleAuth::Models::Concerns::MagicLinkable    # optional"
-        say "       include RailsSimpleAuth::Models::Concerns::OAuthConnectable # optional"
-        say "     end"
-        say ""
-        say "  4. Add before_action to protect routes:"
-        say ""
-        say "     class ApplicationController < ActionController::Base"
-        say "       before_action :require_authentication"
-        say "     end"
-        say ""
-        say "Optional generators:"
-        say "  rails generate rails_simple_auth:views  # Copy views for customization"
-        say "  rails generate rails_simple_auth:css    # Copy CSS for styling"
-        say ""
+        say '       include RailsSimpleAuth::Models::Concerns::Authenticatable'
+        say '       include RailsSimpleAuth::Models::Concerns::Confirmable      # optional'
+        say '       include RailsSimpleAuth::Models::Concerns::MagicLinkable    # optional'
+        say '       include RailsSimpleAuth::Models::Concerns::OAuthConnectable # optional'
+        say '     end'
+        say ''
+        say '  4. Add before_action to protect routes:'
+        say ''
+        say '     class ApplicationController < ActionController::Base'
+        say '       before_action :require_authentication'
+        say '     end'
+        say ''
+        say 'Optional generators:'
+        say '  rails generate rails_simple_auth:views  # Copy views for customization'
+        say '  rails generate rails_simple_auth:css    # Copy CSS for styling'
+        say ''
       end
     end
   end

data/lib/generators/rails_simple_auth/install/templates/initializer.rb

@@ -58,14 +58,14 @@ RailsSimpleAuth.configure do |config|
   # ============================================================================
 
   # Layout to use for auth pages (default: "application")
-  config.layout = "application"
+  config.layout = 'application'
 
   # ============================================================================
   # Mailer
   # ============================================================================
 
   # From address for auth emails
-  config.mailer_sender = ENV.fetch("MAILER_FROM", "noreply@example.com")
+  config.mailer_sender = ENV.fetch('MAILER_FROM', 'noreply@example.com')
 
   # Custom mailer class (must implement confirmation, magic_link, password_reset methods)
   # config.mailer_class = "RailsSimpleAuth::AuthMailer"
@@ -75,7 +75,7 @@ RailsSimpleAuth.configure do |config|
   # ============================================================================
 
   # Your user model class name
-  config.user_class_name = "<%= options[:user_model] %>"
+  config.user_class_name = '<%= options[:user_model] %>'
 
   # Custom session model (if you want to use your own)
   # config.session_class_name = "RailsSimpleAuth::Session"

data/lib/generators/rails_simple_auth/install/templates/migration.rb

@@ -11,7 +11,7 @@ class AddRailsSimpleAuth < ActiveRecord::Migration[8.0]
     # Uncomment and modify as needed:
 
     # Required fields for authentication
-    # add_column :users, :email_address, :string, null: false
+    # add_column :users, :email, :string, null: false
     # add_column :users, :password_digest, :string, null: false
 
     # Email confirmation (optional - if using Confirmable concern)
@@ -22,7 +22,7 @@ class AddRailsSimpleAuth < ActiveRecord::Migration[8.0]
     # add_column :users, :admin, :boolean, default: false
 
     # Indexes
-    # add_index :users, :email_address, unique: true
+    # add_index :users, :email, unique: true
     # add_index :users, :confirmed_at
 
     # ============================================================================

data/lib/generators/rails_simple_auth/temporary_users/USAGE

@@ -0,0 +1,21 @@
+Description:
+    Creates a migration to add temporary user support to your User model.
+    Temporary users allow guest/demo user flows where visitors can try
+    your app without signing up, then convert to permanent accounts.
+
+Example:
+    bin/rails generate rails_simple_auth:temporary_users
+
+    This will create:
+        db/migrate/YYYYMMDDHHMMSS_add_temporary_to_users.rb
+
+    After running the migration, include the concern in your User model:
+        include RailsSimpleAuth::Models::Concerns::TemporaryUser
+
+    And enable in your initializer:
+        config.temporary_users_enabled = true
+
+    The concern provides:
+        - temporary? / permanent? methods
+        - temporary / permanent / temporary_expired scopes
+        - convert_to_permanent!(email:, password:) for account conversion

data/lib/generators/rails_simple_auth/temporary_users/templates/add_temporary_to_users.rb.erb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+class AddTemporaryToUsers < ActiveRecord::Migration[<%= Rails::VERSION::MAJOR %>.<%= Rails::VERSION::MINOR %>]
+  def change
+    add_column :users, :temporary, :boolean, default: false, null: false
+    add_index :users, [:temporary, :created_at], name: "index_users_on_temporary_and_created_at"
+  end
+end

data/lib/generators/rails_simple_auth/temporary_users/temporary_users_generator.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require 'rails/generators'
+require 'rails/generators/active_record'
+
+module RailsSimpleAuth
+  module Generators
+    class TemporaryUsersGenerator < Rails::Generators::Base
+      include Rails::Generators::Migration
+
+      source_root File.expand_path('templates', __dir__)
+
+      desc 'Creates a migration to add temporary user support to your User model'
+
+      def self.next_migration_number(dirname)
+        ActiveRecord::Generators::Base.next_migration_number(dirname)
+      end
+
+      def create_migration_file
+        migration_template 'add_temporary_to_users.rb.erb',
+                           'db/migrate/add_temporary_to_users.rb'
+      end
+
+      def show_instructions
+        say ''
+        say 'Temporary users migration created!', :green
+        say ''
+        say 'Next steps:', :yellow
+        say '  1. Run: bin/rails db:migrate'
+        say ''
+        say '  2. Include the concern in your User model:'
+        say '     include RailsSimpleAuth::Models::Concerns::TemporaryUser'
+        say ''
+        say '  3. Enable in your initializer:'
+        say '     config.temporary_users_enabled = true'
+        say ''
+      end
+    end
+  end
+end

data/lib/generators/rails_simple_auth/views/views_generator.rb

@@ -1,26 +1,26 @@
 # frozen_string_literal: true
 
-require "rails/generators"
+require 'rails/generators'
 
 module RailsSimpleAuth
   module Generators
     class ViewsGenerator < Rails::Generators::Base
-      source_root File.expand_path("../../../../app/views/rails_simple_auth", __dir__)
+      source_root File.expand_path('../../../../app/views/rails_simple_auth', __dir__)
 
       class_option :only, type: :array, default: [],
-                   desc: "Only copy specific view directories (sessions, registrations, passwords, confirmations, mailers)"
+                          desc: 'Only copy specific view directories (sessions, registrations, passwords, confirmations, mailers)'
 
       def copy_views
         view_directories.each do |dir|
           directory dir, "app/views/rails_simple_auth/#{dir}"
         end
 
-        say ""
-        say "Views copied to app/views/rails_simple_auth/", :green
-        say ""
-        say "You can now customize these views. Rails will use your local copies"
+        say ''
+        say 'Views copied to app/views/rails_simple_auth/', :green
+        say ''
+        say 'You can now customize these views. Rails will use your local copies'
         say "instead of the gem's views."
-        say ""
+        say ''
       end
 
       private

data/lib/rails_simple_auth/configuration.rb

@@ -10,14 +10,17 @@ module RailsSimpleAuth
                   :mailer_sender, :mailer_class,
                   :user_class_name, :session_class_name,
                   :password_minimum_length,
-                  :after_sign_in_callback, :after_sign_out_callback, :after_sign_up_callback, :after_confirmation_callback
+                  :after_sign_in_callback, :after_sign_out_callback, :after_sign_up_callback, :after_confirmation_callback,
+                  :temporary_users_enabled
+
+    attr_reader :temporary_user_cleanup_days
 
     def initialize
       @magic_link_enabled = true
       @email_confirmation_enabled = true
       @oauth_enabled = false
       @oauth_providers = []
-      @oauth_link_existing_accounts = true  # Allow OAuth to link to existing email accounts
+      @oauth_link_existing_accounts = true # Allow OAuth to link to existing email accounts
 
       @magic_link_expiry = 15.minutes
       @password_reset_expiry = 15.minutes
@@ -37,14 +40,14 @@ module RailsSimpleAuth
       @after_sign_up_path = :root_path
       @after_confirmation_path = :new_session_path
 
-      @layout = "rails_simple_auth"
+      @layout = 'rails_simple_auth'
       @app_name = nil
 
-      @mailer_sender = "noreply@example.com"
-      @mailer_class = "RailsSimpleAuth::AuthMailer"
+      @mailer_sender = 'noreply@example.com'
+      @mailer_class = 'RailsSimpleAuth::AuthMailer'
 
-      @user_class_name = "User"
-      @session_class_name = "RailsSimpleAuth::Session"
+      @user_class_name = 'User'
+      @session_class_name = 'RailsSimpleAuth::Session'
 
       @password_minimum_length = 8
 
@@ -52,6 +55,9 @@ module RailsSimpleAuth
       @after_sign_out_callback = nil
       @after_sign_up_callback = nil
       @after_confirmation_callback = nil
+
+      @temporary_users_enabled = false
+      @temporary_user_cleanup_days = 7
     end
 
     def user_class
@@ -93,5 +99,13 @@ module RailsSimpleAuth
     def rate_limit_for(action)
       rate_limits&.dig(action.to_sym)
     end
+
+    def temporary_user_cleanup_days=(value)
+      unless value.is_a?(Integer) && value.positive?
+        raise ConfigurationError, 'temporary_user_cleanup_days must be a positive integer'
+      end
+
+      @temporary_user_cleanup_days = value
+    end
   end
 end

data/lib/rails_simple_auth/controllers/concerns/authentication.rb

@@ -17,9 +17,9 @@ module RailsSimpleAuth
           return unless (session_token = cookies.signed.permanent[:session_token])
 
           session_record = RailsSimpleAuth.configuration.session_class
-                             .includes(:user)
-                             .active
-                             .find_by(id: session_token)
+                                          .includes(:user)
+                                          .active
+                                          .find_by(id: session_token)
 
           if session_record
             RailsSimpleAuth::Current.user = session_record.user
@@ -51,8 +51,8 @@ module RailsSimpleAuth
 
           # SECURITY: Validate path to prevent open redirect attacks
           # Only store relative paths that start with / but not //
-          return unless path.start_with?("/")
-          return if path.start_with?("//")
+          return unless path.start_with?('/')
+          return if path.start_with?('//')
 
           session[:return_to] = path
         end
@@ -63,34 +63,33 @@ module RailsSimpleAuth
 
         def redirect_to_sign_in
           respond_to do |format|
-            format.html { redirect_to new_session_path, alert: "Please sign in to continue." }
-            format.json { render json: { error: "Authentication required" }, status: :unauthorized }
-            format.turbo_stream { redirect_to new_session_path, alert: "Please sign in to continue." }
+            format.html { redirect_to new_session_path, alert: 'Please sign in to continue.' }
+            format.json { render json: { error: 'Authentication required' }, status: :unauthorized }
+            format.turbo_stream { redirect_to new_session_path, alert: 'Please sign in to continue.' }
           end
         end
 
         def client_ip
-          request.headers["CF-Connecting-IP"] ||
-            request.headers["X-Forwarded-For"]&.split(",")&.first&.strip ||
+          request.headers['CF-Connecting-IP'] ||
+            request.headers['X-Forwarded-For']&.split(',')&.first&.strip ||
             request.remote_ip
         end
 
         def resolve_path(config_key)
           path_config = RailsSimpleAuth.configuration.public_send(config_key)
 
-          result = case path_config
+          case path_config
           when Symbol then send(path_config)
           when Proc then path_config.call(self)
           when String then path_config
           else
-                     Rails.logger.warn(
-                       "[RailsSimpleAuth] Invalid path configuration for #{config_key}: " \
-                       "expected Symbol, Proc, or String, got #{path_config.class.name}. " \
-                       "Falling back to root_path."
-                     )
-                     root_path
+            Rails.logger.warn(
+              "[RailsSimpleAuth] Invalid path configuration for #{config_key}: " \
+              "expected Symbol, Proc, or String, got #{path_config.class.name}. " \
+              'Falling back to root_path.'
+            )
+            root_path
           end
-          result
         rescue NoMethodError => e
           Rails.logger.error(
             "[RailsSimpleAuth] Path helper '#{path_config}' not found for #{config_key}. " \

data/lib/rails_simple_auth/controllers/concerns/session_management.rb

@@ -39,6 +39,30 @@ module RailsSimpleAuth
           RailsSimpleAuth::Current.session = nil
         end
 
+        # Destroy temporary user session when signing in with a different account
+        # This cleans up guest/demo users when they sign in or register
+        # @param signing_in_user [User, nil] The user being signed in (to avoid self-destruction)
+        def destroy_temporary_user_session(signing_in_user = nil)
+          return unless RailsSimpleAuth.configuration.temporary_users_enabled
+          return unless RailsSimpleAuth::Current.user&.temporary?
+
+          temp_user = RailsSimpleAuth::Current.user
+
+          # Don't destroy if the user is re-authenticating as themselves
+          return if signing_in_user && temp_user.id == signing_in_user.id
+
+          temp_user_id = temp_user.id
+
+          temp_user.transaction do
+            destroy_current_session
+            temp_user.destroy!
+          end
+
+          Rails.logger.info("[RailsSimpleAuth] Destroyed temporary user #{temp_user_id} on sign in")
+        rescue ActiveRecord::RecordNotDestroyed => e
+          Rails.logger.error("[RailsSimpleAuth] Failed to destroy temporary user #{temp_user_id}: #{e.message}")
+        end
+
         # Run after sign in callback if configured
         def run_after_sign_in_callback(user)
           run_callback(:after_sign_in_callback, user)

data/lib/rails_simple_auth/engine.rb

@@ -8,7 +8,7 @@ module RailsSimpleAuth
       g.test_framework :minitest
     end
 
-    initializer "rails_simple_auth.helpers" do
+    initializer 'rails_simple_auth.helpers' do
       ActiveSupport.on_load(:action_controller_base) do
         include RailsSimpleAuth::Controllers::Concerns::Authentication
         include RailsSimpleAuth::Controllers::Concerns::SessionManagement

data/lib/rails_simple_auth/models/concerns/authenticatable.rb

@@ -10,25 +10,26 @@ module RailsSimpleAuth
           has_secure_password
 
           has_many :sessions,
-                   class_name: "RailsSimpleAuth::Session",
+                   class_name: RailsSimpleAuth.configuration.session_class_name,
                    dependent: :destroy,
                    inverse_of: :user
 
-          validates :email_address,
+          validates :email,
                     presence: true,
                     uniqueness: { case_sensitive: false },
-                    format: { with: URI::MailTo::EMAIL_REGEXP }
+                    format: { with: URI::MailTo::EMAIL_REGEXP },
+                    unless: :temporary?
 
           validate :password_meets_minimum_length, if: :password_required?
 
-          normalizes :email_address, with: ->(email) { email.strip.downcase }
+          normalizes :email, with: ->(email) { email.strip.downcase }
         end
 
         class_methods do
           def find_by_email(email)
             return nil if email.blank?
 
-            find_by(email_address: email.to_s.strip.downcase)
+            find_by(email: email.to_s.strip.downcase)
           end
         end
 
@@ -47,9 +48,16 @@ module RailsSimpleAuth
           count
         end
 
+        # Returns false by default. Override in TemporaryUser concern.
+        def temporary?
+          false
+        end
+
         private
 
         def password_required?
+          return false if temporary?
+
           password_digest.blank? || password.present?
         end
 

data/lib/rails_simple_auth/models/concerns/confirmable.rb

@@ -8,6 +8,7 @@ module RailsSimpleAuth
 
         included do
           # Requires `confirmed_at` datetime column
+          # Optional `unconfirmed_email` string column for reconfirmation
           scope :confirmed, -> { where.not(confirmed_at: nil) }
           scope :unconfirmed, -> { where(confirmed_at: nil) }
         end
@@ -22,17 +23,51 @@ module RailsSimpleAuth
           !confirmed?
         end
 
+        # Check if user is changing their email (reconfirmation)
+        def reconfirming?
+          respond_to?(:unconfirmed_email) && unconfirmed_email.present?
+        end
+
+        # Check if user needs confirmation (either unconfirmed or reconfirming)
+        def unconfirmed_or_reconfirming?
+          unconfirmed? || reconfirming?
+        end
+
+        # Get the email that needs confirmation
+        def confirmable_email
+          reconfirming? ? unconfirmed_email : email
+        end
+
         # Confirm the user's email
+        # Handles both initial confirmation and reconfirmation (email change)
+        # Also sets temporary: false if TemporaryUser concern is included
+        # Returns true on success, false on failure (with errors populated)
         def confirm!
-          return true if confirmed?
+          attrs = { confirmed_at: Time.current }
+          attrs[:temporary] = false if respond_to?(:temporary?)
 
-          update!(confirmed_at: Time.current)
+          if reconfirming?
+            # Email change confirmation - check email uniqueness first
+            if self.class.where.not(id: id).exists?(email: unconfirmed_email)
+              errors.add(:email, 'is already taken by another user')
+              return false
+            end
+            attrs[:email] = unconfirmed_email
+            attrs[:unconfirmed_email] = nil
+            update(attrs)
+          elsif unconfirmed?
+            # Initial confirmation
+            update(attrs)
+          else
+            # Already confirmed and not reconfirming
+            true
+          end
         end
 
         # Generate email confirmation token using Rails signed_id
         def generate_confirmation_token
           signed_id(
-            purpose: :email_confirmation,
+            purpose: :confirm_email,
             expires_in: RailsSimpleAuth.configuration.confirmation_expiry
           )
         end

data/lib/rails_simple_auth/models/concerns/oauth_connectable.rb

@@ -18,13 +18,13 @@ module RailsSimpleAuth
           # - true (default): Links OAuth to existing email accounts (safe for providers that verify emails)
           # - false: Only allows OAuth for accounts created via OAuth with same provider+uid
           def from_oauth(auth_hash)
-            email = auth_hash.dig("info", "email")
-            provider = auth_hash["provider"]
-            uid = auth_hash["uid"]
+            email = auth_hash.dig('info', 'email')
+            provider = auth_hash['provider']
+            uid = auth_hash['uid']
 
             if email.blank?
               Rails.logger.warn(
-                "[RailsSimpleAuth] OAuth auth_hash missing email. " \
+                '[RailsSimpleAuth] OAuth auth_hash missing email. ' \
                 "Provider: #{provider}, UID: #{uid}. Ensure email scope is requested."
               )
               return nil
@@ -62,7 +62,7 @@ module RailsSimpleAuth
 
             # Create new user for new OAuth signups
             user = new(
-              email_address: email,
+              email: email,
               password: SecureRandom.hex(32) # Random password for OAuth users
             )