rails_simple_auth 1.0.4 → 1.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fd84335df56b3bc4fbb386f841bfb66bc74eadae1dc3864873bcda904a946cd2
-  data.tar.gz: 00d31290be4bdccf36c5f9a326896e9506936f6b122f9298f53fabc0aadcd8a3
+  metadata.gz: 83fb50e708c25bcd5a7115ae8e0935e9921909580aef97ca6ec585100e410e37
+  data.tar.gz: 1b7a3bcef439ad6c38155404562167e487144aeeb292ea4fa9436c5252ad1e9c
 SHA512:
-  metadata.gz: 2c0cf144576a950a1aff4a1958197b9ef93a3edc405bf1de36339f3effed3c09087158b821f6e2c7617af9b9ae9b3ef184783b08c9428da0df65d79ac5a2ba3e
-  data.tar.gz: 0cc8bd3f8ce5094910f25daf12496f1efe6f447d3ee22f3744ad47d7ff4b65ad46209ecd2004fe9024f2fcad85c38efb6478261bd408251f728aad1c2fc89824
+  metadata.gz: df759dcc508dca50b40cd1c85a9c8609a80b2c1a8feb71dfc2ea0a06fe48187bb5c57488a67eecce77eb9e099441bb0609524b48d14b288e318ebcf0e4fec12c
+  data.tar.gz: f035ac8532d07768a6a4dd5ce7df1eab2454bf4fd49c53734732b0979f68d8280d876bd174576434c7daedd9f793f029d81a6cc0b335a0f6c608bd915c71d71d

data/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.5] - 2025-01-19
+
+### Added
+
+- **Secure OmniAuth by default** - Automatically restricts OAuth initiation to POST requests only (prevents CSRF attacks)
+
 ## [1.0.4] - 2025-01-19
 
 ### Added

data/README.md

@@ -206,7 +206,7 @@ end
 
 ```ruby
 class User < ApplicationRecord
-  include RailsSimpleAuth::Models::Concerns::OAuthConnectable
+  authenticates_with :oauth
 
   def assign_oauth_attributes(auth_hash)
     self.name = auth_hash.dig("info", "name")

data/lib/generators/rails_simple_auth/install/install_generator.rb

@@ -40,15 +40,14 @@ module RailsSimpleAuth
         say 'Next steps:'
         say '  1. Review and edit the migration: db/migrate/xxx_add_rails_simple_auth.rb'
         say '  2. Run: rails db:migrate'
-        say "  3. Add concerns to your #{options[:user_model]} model:"
+        say "  3. Add authentication to your #{options[:user_model]} model:"
         say ''
         say "     class #{options[:user_model]} < ApplicationRecord"
-        say '       include RailsSimpleAuth::Models::Concerns::Authenticatable'
-        say '       include RailsSimpleAuth::Models::Concerns::Confirmable      # optional'
-        say '       include RailsSimpleAuth::Models::Concerns::MagicLinkable    # optional'
-        say '       include RailsSimpleAuth::Models::Concerns::OAuthConnectable # optional'
+        say '       authenticates_with :confirmable, :magic_linkable'
         say '     end'
         say ''
+        say '     Available modules: :confirmable, :magic_linkable, :oauth, :temporary'
+        say ''
         say '  4. Add before_action to protect routes:'
         say ''
         say '     class ApplicationController < ActionController::Base'
@@ -56,8 +55,9 @@ module RailsSimpleAuth
         say '     end'
         say ''
         say 'Optional generators:'
-        say '  rails generate rails_simple_auth:views  # Copy views for customization'
-        say '  rails generate rails_simple_auth:css    # Copy CSS for styling'
+        say '  rails generate rails_simple_auth:views           # Copy views for customization'
+        say '  rails generate rails_simple_auth:css             # Copy CSS for styling'
+        say '  rails generate rails_simple_auth:temporary_users # Add guest account support'
         say ''
       end
     end

data/lib/generators/rails_simple_auth/temporary_users/USAGE

@@ -9,8 +9,8 @@ Example:
     This will create:
         db/migrate/YYYYMMDDHHMMSS_add_temporary_to_users.rb
 
-    After running the migration, include the concern in your User model:
-        include RailsSimpleAuth::Models::Concerns::TemporaryUser
+    After running the migration, add :temporary to your User model:
+        authenticates_with :confirmable, :temporary
 
     And enable in your initializer:
         config.temporary_users_enabled = true

data/lib/generators/rails_simple_auth/temporary_users/temporary_users_generator.rb

@@ -28,8 +28,8 @@ module RailsSimpleAuth
         say 'Next steps:', :yellow
         say '  1. Run: bin/rails db:migrate'
         say ''
-        say '  2. Include the concern in your User model:'
-        say '     include RailsSimpleAuth::Models::Concerns::TemporaryUser'
+        say '  2. Add :temporary to your User model:'
+        say '     authenticates_with :confirmable, :temporary'
         say ''
         say '  3. Enable in your initializer:'
         say '     config.temporary_users_enabled = true'

data/lib/rails_simple_auth/engine.rb

@@ -22,5 +22,12 @@ module RailsSimpleAuth
         include RailsSimpleAuth::Model
       end
     end
+
+    # Secure OmniAuth by default - only allow POST to initiate OAuth (prevents CSRF)
+    initializer 'rails_simple_auth.omniauth', after: :load_config_initializers do
+      if defined?(OmniAuth)
+        OmniAuth.config.allowed_request_methods = %i[post]
+      end
+    end
   end
 end

data/lib/rails_simple_auth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsSimpleAuth
-  VERSION = '1.0.4'
+  VERSION = '1.0.5'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_simple_auth
 version: !ruby/object:Gem::Version
-  version: 1.0.4
+  version: 1.0.5
 platform: ruby
 authors:
 - Ivan Kuznetsov