rails_simple_auth 1.0.6 → 1.0.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4d04d803a06cf6538074412280d1b8b526b227f62433c6e9431adfb52c0a040d
-  data.tar.gz: 86f0719d9a2422895271a8c143856e4fd530f0bb93d2bd6d3f037e22808722a2
+  metadata.gz: c725500a464716b536ca185da3cb3c5cd4fafc0f4953336e67b1cbaa51fad2ee
+  data.tar.gz: aba285ded6dfdbfd51385f0d82ae5c61e1862d957c57a1ee38a481d15f4b57f9
 SHA512:
-  metadata.gz: 02af0cb35354280587ad5ada2e4ffd9d59ba9ce193b28f56120bb61de550a116a0643a0d61b0d10e870db1da5ff6b2a18fee96431e650d52ef5824d7a2dabaa1
-  data.tar.gz: ef261bb888584b7ad366b0bea4ae253c2d86fd81ae09072b0a39d0d1e4e52492eedf1d1fdd6a8c366500ec3ae7d101d0b452c1965509a7b6bffe236831f972e2
+  metadata.gz: ee180cbc6a661d5dc4e7bc8ff77f33fad7907a4e0ae7dd94382e110e3855306e8eedadfef4d0013fa2296c9011c3a4b43abdb9072eb62de8d364ffa0c2e9824b
+  data.tar.gz: 2c87bee543511aa70ce9cf0186dafe97d7baa5d1afc56bbc5cebba8be9da197d85e51b61a3cd9e1dee588f11b10693d9029dfb53d989df86c6bb3bd3a27ae910

data/CHANGELOG.md

@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.8] - 2026-01-19
+
+### Fixed
+
+- **OAuth buttons use button_to instead of link_to** - `link_to` with `method: :post` doesn't work in Rails 8 without rails-ujs. Changed OAuth buttons in sessions and registrations views to use `button_to` which properly creates POST forms.
+
+## [1.0.7] - 2026-01-19
+
+### Fixed
+
+- **Temporary users can now access sign-in page** - Previously, temporary users clicking "Sign in" were redirected away because `user_signed_in?` returned true. Now checks `permanent_user_signed_in?` instead, allowing temporary users to sign in with a real account.
+
+### Added
+
+- **Referrer-based redirect after sign-in** - When users voluntarily click "Sign in" (not forced by `require_authentication`), their referring page is stored so they're redirected back after signing in. Security: only stores referrer from same origin.
+- `permanent_user_signed_in?` helper method - Returns true only if user is signed in AND permanent (or doesn't respond to `permanent?`)
+
 ## [1.0.6] - 2025-01-19
 
 ### Added

data/app/controllers/rails_simple_auth/sessions_controller.rb

@@ -22,7 +22,9 @@ module RailsSimpleAuth
     end
 
     def new
-      redirect_to resolve_path(:after_sign_in_path) if user_signed_in?
+      return redirect_to resolve_path(:after_sign_in_path) if permanent_user_signed_in?
+
+      store_referrer_for_redirect
     end
 
     def create
@@ -52,7 +54,9 @@ module RailsSimpleAuth
     end
 
     def magic_link_form
-      redirect_to resolve_path(:after_sign_in_path) if user_signed_in?
+      return redirect_to resolve_path(:after_sign_in_path) if permanent_user_signed_in?
+
+      store_referrer_for_redirect
     end
 
     def request_magic_link

data/app/views/rails_simple_auth/registrations/new.html.erb

@@ -36,9 +36,8 @@
       <div class="rsa-auth-form__oauth">
         <div class="rsa-auth-form__oauth-buttons">
           <% RailsSimpleAuth.configuration.oauth_providers.each do |provider| %>
-            <%= link_to "/auth/#{provider}",
+            <%= button_to "/auth/#{provider}",
                   class: "rsa-auth-form__oauth-button rsa-auth-form__oauth-button--#{provider}",
-                  method: :post,
                   data: { turbo: false } do %>
               <span class="rsa-auth-form__oauth-icon rsa-auth-form__oauth-icon--<%= provider %>"></span>
               Continue with <%= provider.to_s.titleize %>

data/app/views/rails_simple_auth/sessions/new.html.erb

@@ -39,9 +39,8 @@
       <div class="rsa-auth-form__oauth">
         <div class="rsa-auth-form__oauth-buttons">
           <% RailsSimpleAuth.configuration.oauth_providers.each do |provider| %>
-            <%= link_to "/auth/#{provider}",
+            <%= button_to "/auth/#{provider}",
                   class: "rsa-auth-form__oauth-button rsa-auth-form__oauth-button--#{provider}",
-                  method: :post,
                   data: { turbo: false } do %>
               <span class="rsa-auth-form__oauth-icon rsa-auth-form__oauth-icon--<%= provider %>"></span>
               Continue with <%= provider.to_s.titleize %>

data/lib/rails_simple_auth/controllers/concerns/authentication.rb

@@ -44,6 +44,10 @@ module RailsSimpleAuth
           current_user.present?
         end
 
+        def permanent_user_signed_in?
+          user_signed_in? && (!current_user.respond_to?(:permanent?) || current_user.permanent?)
+        end
+
         def store_location_for_redirect
           return unless request.get?
 
@@ -57,6 +61,33 @@ module RailsSimpleAuth
           session[:return_to] = path
         end
 
+        def store_referrer_for_redirect
+          # Don't overwrite existing stored location (e.g., from require_authentication)
+          return if session[:return_to].present?
+
+          referrer = request.referer
+          return if referrer.blank?
+
+          # SECURITY: Only store referrer if it's from the same origin
+          begin
+            referrer_uri = URI.parse(referrer)
+            request_uri = URI.parse(request.url)
+
+            return unless referrer_uri.host == request_uri.host
+
+            path = referrer_uri.path
+            path += "?#{referrer_uri.query}" if referrer_uri.query.present?
+
+            # SECURITY: Validate path to prevent open redirect attacks
+            return unless path.start_with?('/')
+            return if path.start_with?('//')
+
+            session[:return_to] = path
+          rescue URI::InvalidURIError
+            # Invalid referrer, ignore
+          end
+        end
+
         def stored_location_or_default
           session.delete(:return_to) || resolve_path(:after_sign_in_path)
         end

data/lib/rails_simple_auth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsSimpleAuth
-  VERSION = '1.0.6'
+  VERSION = '1.0.8'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_simple_auth
 version: !ruby/object:Gem::Version
-  version: 1.0.6
+  version: 1.0.8
 platform: ruby
 authors:
 - Ivan Kuznetsov