rails_simple_auth 1.0.9 → 1.0.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c5f9d9b599e334e5a35ceb95fe2bc733593b9329e07d42c06bd306d549280567
-  data.tar.gz: bf8c69961e726a34e0caea4ad1b1d5049d942a7c6f694a2612c198ab8c795d09
+  metadata.gz: 63f51b7959956bc2a4cecb47d58f131fa4e8a54d930d1a3acb29ae9d32602fe9
+  data.tar.gz: '0844c3355030f1515b9d14dd5e4fdcbced5972b019bc90deb14f20c3dd6d686f'
 SHA512:
-  metadata.gz: bb0a48a70365bdbcb733eae1e20126f35c58f8de4cd8458dade299f6f191d819f53acb88da8f3b163447ec2abe5b7efca9e0a5c52a9e85d49863fff0eb4bb36a
-  data.tar.gz: 0d71c70b2daf1e7ae474fe86e17950941a150eecfbddfa838a2fe7110b4e860cf33487b43b7268ca096f4aad00f50f351cfbeab4ac3aa486d08d06f099caad87
+  metadata.gz: d54493c3417312b731eaaf3fda92006be4a63e15b2328468b25094cc701f04d3533dd00d4a41b8f7cf47e85e54293993ceaaee0d28059f8f2521b2477b10df87
+  data.tar.gz: 6d236f2ba54009287afe7d52aa0f374b3d9f9a09a4579bc6607606036a7ea05233db8bcaa7b8a690135bb8be27c320ea2218ead5bf2539b83e26c49fb651e3fb

data/CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.11] - 2026-01-19
+
+### Added
+
+- **OAuth provider display names** - Configure human-readable names for OAuth buttons
+  ```ruby
+  # Hash format with custom display names
+  config.enable_oauth(google_oauth2: "Google", github: "GitHub")
+
+  # Symbol format still works (backward compatible)
+  config.enable_oauth(:google_oauth2, :github)
+  ```
+- `oauth_provider_display_name(provider)` method returns the display name, falling back to titleized provider name with `_oauth2` suffix removed
+
+## [1.0.10] - 2026-01-19
+
+### Fixed
+
+- **OAuth authenticity token error** - Disabled OmniAuth's `AuthenticityTokenProtection` which was blocking OAuth requests even with valid CSRF tokens. POST-only enforcement already prevents CSRF attacks.
+
 ## [1.0.9] - 2026-01-19
 
 ### Added

data/lib/rails_simple_auth/configuration.rb

@@ -2,7 +2,7 @@
 
 module RailsSimpleAuth
   class Configuration
-    attr_accessor :magic_link_enabled, :email_confirmation_enabled, :oauth_enabled, :oauth_providers, :oauth_link_existing_accounts,
+    attr_accessor :magic_link_enabled, :email_confirmation_enabled, :oauth_enabled, :oauth_providers, :oauth_provider_names, :oauth_link_existing_accounts,
                   :magic_link_expiry, :password_reset_expiry, :confirmation_expiry, :session_expiry,
                   :rate_limits,
                   :after_sign_in_path, :after_sign_out_path, :after_sign_up_path, :after_confirmation_path,
@@ -20,6 +20,7 @@ module RailsSimpleAuth
       @email_confirmation_enabled = true
       @oauth_enabled = false
       @oauth_providers = []
+      @oauth_provider_names = {}
       @oauth_link_existing_accounts = true # Allow OAuth to link to existing email accounts
 
       @magic_link_expiry = 15.minutes
@@ -87,15 +88,36 @@ module RailsSimpleAuth
             "Original error: #{e.message}"
     end
 
+    # Enable OAuth providers with optional display names
+    # Usage:
+    #   enable_oauth(:google_oauth2, :github)  # Uses default display names
+    #   enable_oauth(google_oauth2: "Google", github: "GitHub")  # Custom display names
     def enable_oauth(*providers)
       self.oauth_enabled = true
-      self.oauth_providers = providers.map(&:to_sym)
+
+      if providers.length == 1 && providers.first.is_a?(Hash)
+        # Hash format: { google_oauth2: "Google", github: "GitHub" }
+        provider_hash = providers.first
+        self.oauth_providers = provider_hash.keys.map(&:to_sym)
+        self.oauth_provider_names = provider_hash.transform_keys(&:to_sym)
+      else
+        # Symbol format: :google_oauth2, :github (backward compatible)
+        self.oauth_providers = providers.map(&:to_sym)
+        self.oauth_provider_names = {}
+      end
     end
 
     def oauth_provider_enabled?(provider)
       oauth_enabled && oauth_providers.include?(provider.to_sym)
     end
 
+    # Get display name for an OAuth provider
+    # Falls back to titleized provider name if no custom name is configured
+    def oauth_provider_display_name(provider)
+      provider_sym = provider.to_sym
+      oauth_provider_names[provider_sym] || provider.to_s.gsub(/_oauth2$/, "").titleize
+    end
+
     def rate_limit_for(action)
       rate_limits&.dig(action.to_sym)
     end

data/lib/rails_simple_auth/engine.rb

@@ -24,9 +24,12 @@ module RailsSimpleAuth
     end
 
     # Secure OmniAuth by default - only allow POST to initiate OAuth (prevents CSRF)
+    # Disable OmniAuth's authenticity token protection since POST-only already prevents CSRF
+    # and Rails handles CSRF protection at the application level
     initializer 'rails_simple_auth.omniauth', after: :load_config_initializers do
       if defined?(OmniAuth)
         OmniAuth.config.allowed_request_methods = %i[post]
+        OmniAuth.config.request_validation_phase = nil
       end
     end
   end

data/lib/rails_simple_auth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsSimpleAuth
-  VERSION = '1.0.9'
+  VERSION = '1.0.11'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_simple_auth
 version: !ruby/object:Gem::Version
-  version: 1.0.9
+  version: 1.0.11
 platform: ruby
 authors:
 - Ivan Kuznetsov