rails_simple_auth 1.1.0 → 1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ad68672c8d3cb2ae020bb5ca15c50806b64a3593734088c5bae4ed351b1683d1
-  data.tar.gz: 195845cbc41e1163f5212f3dc2448093bb13a278dbf58332189e115983ed90b8
+  metadata.gz: 92f4718f32ac9f010bc24be665915952c9dcf5d02340c07e7692b2a053a282ce
+  data.tar.gz: 71ba9817ebe4fcefd815aa47e0f99d02261349d78a0532b0a6f3fca22442d6ab
 SHA512:
-  metadata.gz: cc42b623955ccdfcc4737eb58c2b70efb0fb93f6c7633791d81d89ed8f0ce396277dddae529a25e38906324ef7256e34bcbcfb0bbe3dc3314a209c0c9e922dab
-  data.tar.gz: b496b38e1c2369759e8dbe21b927f21d43a5cd79da47882290e322444658053b7a415cfe42888a35f3cc5ac1101c4b1a0a7bf91f68fa8859f7d883e0c1594d44
+  metadata.gz: 97e9c562f6993c03661ef81eee4e534ad25496b3f36f3f46d1b559a860835a8dde49f190eeed0368a5abc7d0d06e11d2a596873d75af7484983f3afe043397d5
+  data.tar.gz: cf069335a5b94f84b163057116730d1feb4d428d43b9c3ccb5da056f73b92a13ef2dbeda7cf8c939c858480243bcf93e47ec7899f63c12864398d21d4fcd43c3

data/CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.1] - 2026-09-15
+
+### Fixed
+
+- OAuth linking reloads the account under a row lock so concurrent confirmation or pending email changes are preserved; if the matched email changes before linking, sign-in is rejected.
+- Confirm existing accounts when linking by email through a trusted OAuth provider, before calling the host application's `assign_oauth_attributes` hook. Preserve existing confirmation timestamps and pending email changes. Accounts found by provider and UID remain unchanged.
+- Return `nil` when saving an existing OAuth account link fails, preventing authentication with unsaved changes.
+
+## [1.2.0] - 2026-05-23
+
+### Changed
+
+- **OAuth provider sign-in now honors `session[:return_to]`.** `OmniauthCallbacksController#create` previously hardcoded `after_sign_in_path`, so a user mid-redirect (e.g., a host app that called `store_location_for_redirect` before bouncing to `/sign_in`) landed on the default page after the Google/GitHub round-trip instead of resuming. It now goes through `sign_in_user_and_redirect`, which consumes `session[:return_to]` and falls back to `after_sign_in_path`. **Action:** host apps relying on a hard reset to the configured path post-OAuth should review their flows; the configured path remains the default when nothing was stored.
+- **Confirmation-disabled sign-up now honors `session[:return_to]`.** `RegistrationsController#after_successful_registration`'s no-confirmation branch previously hardcoded `after_sign_up_path`. It now redirects to `stored_location_or_default(:after_sign_up_path)` — same precedence rule, separate config key. The `after_sign_up_callback` execution path is unchanged.
+- **`stored_location_or_default` now accepts an optional fallback config key** (default `:after_sign_in_path`), so callers can pass `:after_sign_up_path` (or any other configured path) without duplicating the lookup logic.
+- **`stored_location_or_default` validates the stored value at read time** as defense-in-depth: a poisoned `session[:return_to]` (non-string, doesn't start with `/`, or starts with `//`) is rejected and the fallback is used instead. The write-side validation in `store_location_for_redirect` remains the primary defense; this read-side check protects host apps that bypass the helper.
+- **Extracted `sign_in_user_and_redirect(user, notice:)` to `SessionManagement` concern.** `SessionsController#sign_in_and_redirect` and `OmniauthCallbacksController#create` now share one definition of the sign-in-and-redirect sequence (`destroy_temporary_user_session` → `create_session_for` → `run_after_sign_in_callback` → `redirect_to stored_location_or_default`). `SessionsController#sign_in_and_redirect`'s external behavior is preserved.
+
 ## [1.1.0] - 2026-01-20
 
 ### Added

data/README.md

@@ -125,12 +125,12 @@ Or edit `rails_simple_auth.css` directly for complete control.
 
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `--rsa-color-primary` | `#3b82f6` | Primary button/link color |
-| `--rsa-color-primary-hover` | `#2563eb` | Primary hover state |
+| `--rsa-color-primary` | `#4f46e5` | Primary button/link color |
+| `--rsa-color-primary-hover` | `#4338ca` | Primary hover state |
 | `--rsa-color-background-form` | `#ffffff` | Form container background |
-| `--rsa-color-text` | `#374151` | Main text color |
-| `--rsa-color-text-muted` | `#6b7280` | Secondary text color |
-| `--rsa-color-border` | `#e5e7eb` | Border color |
+| `--rsa-color-text` | `#475569` | Main text color |
+| `--rsa-color-text-muted` | `#64748b` | Secondary text color |
+| `--rsa-color-border` | `#e2e8f0` | Border color |
 | `--rsa-color-danger` | `#dc2626` | Error message color |
 
 ## View Customization
@@ -217,6 +217,12 @@ class User < ApplicationRecord
 end
 ```
 
+Email-based account linking is enabled by default (`config.oauth_link_existing_accounts = true`). Only enable it for providers you trust to supply verified email addresses; the gem does not inspect provider-specific verification claims. Set it to `false` to reject linking by email.
+
+New OAuth accounts and existing accounts linked by email are automatically confirmed when they have a `confirmed_at` column. Existing confirmation timestamps and pending email changes are preserved. Confirmation is assigned before `assign_oauth_attributes`, so your hook can use it to update application-specific state. The hook and confirmation changes are saved together; a failed save returns `nil`.
+
+Accounts found by provider and UID return unchanged, including their email and confirmation state. Applications with historical unconfirmed OAuth accounts should handle their backfill separately.
+
 ## Temporary Users (Guest Accounts)
 
 Temporary users allow visitors to try your app without creating an account. They get a real user record with full functionality, then can convert to a permanent account later by providing email and password.

data/app/controllers/rails_simple_auth/omniauth_callbacks_controller.rb

@@ -19,11 +19,7 @@ module RailsSimpleAuth
       display_name = RailsSimpleAuth.configuration.oauth_provider_display_name(provider)
 
       if user&.persisted?
-        destroy_temporary_user_session(user)
-        create_session_for(user)
-        run_after_sign_in_callback(user)
-        redirect_to resolve_path(:after_sign_in_path),
-                    notice: "Signed in successfully with #{display_name}."
+        sign_in_user_and_redirect(user, notice: "Signed in successfully with #{display_name}.")
       else
         redirect_to new_session_path, alert: "Could not authenticate with #{display_name}."
       end

data/app/controllers/rails_simple_auth/registrations_controller.rb

@@ -40,7 +40,7 @@ module RailsSimpleAuth
       else
         create_session_for(@user)
         run_after_sign_up_callback(@user)
-        redirect_to resolve_path(:after_sign_up_path), notice: 'Account created successfully!'
+        redirect_to stored_location_or_default(:after_sign_up_path), notice: 'Account created successfully!'
       end
     end
 

data/app/controllers/rails_simple_auth/sessions_controller.rb

@@ -96,10 +96,7 @@ module RailsSimpleAuth
     end
 
     def sign_in_and_redirect(user)
-      destroy_temporary_user_session(user)
-      create_session_for(user)
-      run_after_sign_in_callback(user)
-      redirect_to stored_location_or_default, notice: 'Signed in successfully.'
+      sign_in_user_and_redirect(user)
     end
   end
 end

data/lib/rails_simple_auth/controllers/concerns/authentication.rb

@@ -88,8 +88,26 @@ module RailsSimpleAuth
           end
         end
 
-        def stored_location_or_default
-          session.delete(:return_to) || resolve_path(:after_sign_in_path)
+        # Returns the stored post-auth return path (consuming it from the session) or,
+        # if none was stored or the stored value fails defense-in-depth validation,
+        # the resolved fallback path for the given config key (e.g., :after_sign_in_path,
+        # :after_sign_up_path).
+        #
+        # SECURITY: store_location_for_redirect validates paths at write time, but
+        # nothing prevents host-app code from writing to session[:return_to] directly.
+        # We re-check here so a poisoned value (open-redirect, javascript:, malformed
+        # string) falls back instead of raising UnsafeRedirectError or worse.
+        #
+        # NOTE: mutates the session — calling twice returns the fallback the second time.
+        def stored_location_or_default(fallback_path_config = :after_sign_in_path)
+          stored = session.delete(:return_to)
+          return resolve_path(fallback_path_config) unless safe_stored_location?(stored)
+
+          stored
+        end
+
+        def safe_stored_location?(path)
+          path.is_a?(String) && path.start_with?('/') && !path.start_with?('//')
         end
 
         def redirect_to_sign_in

data/lib/rails_simple_auth/controllers/concerns/session_management.rb

@@ -8,6 +8,19 @@ module RailsSimpleAuth
 
         private
 
+        # Standard sign-in sequence: clean up the temporary user, create the real
+        # session, fire after_sign_in callbacks, then redirect.
+        #
+        # NOTE: order matters — destroy_temporary_user_session must run before
+        # create_session_for, otherwise the new session cookie is wiped when the
+        # temp user is destroyed.
+        def sign_in_user_and_redirect(user, notice: 'Signed in successfully.')
+          destroy_temporary_user_session(user)
+          create_session_for(user)
+          run_after_sign_in_callback(user)
+          redirect_to stored_location_or_default, notice: notice
+        end
+
         # Create a new session for the user and set the cookie
         def create_session_for(user)
           session_record = user.sessions.create!(

data/lib/rails_simple_auth/models/concerns/oauth_connectable.rb

@@ -41,16 +41,38 @@ module RailsSimpleAuth
             existing_user = find_by_email(email)
             if existing_user
               # Configurable: allow linking OAuth to existing accounts
-              # Default is true - most OAuth providers (Google, GitHub) verify emails
+              # Only enable for providers trusted to supply verified email addresses.
               if RailsSimpleAuth.configuration.oauth_link_existing_accounts
-                Rails.logger.info(
-                  "[RailsSimpleAuth] OAuth linked to existing account: #{email}. " \
-                  "Provider: #{provider}."
-                )
-                # Call hook to store OAuth credentials on existing user
-                existing_user.assign_oauth_attributes(auth_hash) if existing_user.respond_to?(:assign_oauth_attributes)
-                existing_user.save if existing_user.changed?
-                return existing_user
+                matched_email = existing_user.email
+                return existing_user.with_lock do
+                  # Reload under the lock before checking confirmation state.
+                  next nil if existing_user.email != matched_email
+
+                  # Confirm the current email only; OAuth does not verify a pending replacement.
+                  pending_email = existing_user.respond_to?(:unconfirmed_email) &&
+                                  existing_user.unconfirmed_email.present?
+                  if existing_user.respond_to?(:confirmed_at=) && existing_user.confirmed_at.nil? && !pending_email
+                    existing_user.confirmed_at = Time.current
+                  end
+
+                  # Call hook to store OAuth credentials on existing user
+                  if existing_user.respond_to?(:assign_oauth_attributes)
+                    existing_user.assign_oauth_attributes(auth_hash)
+                  end
+                  if existing_user.changed? && !existing_user.save
+                    Rails.logger.error(
+                      "[RailsSimpleAuth] OAuth account linking failed for email: #{email}, " \
+                      "provider: #{provider}, errors: #{existing_user.errors.full_messages.join(', ')}"
+                    )
+                    next nil
+                  end
+
+                  Rails.logger.info(
+                    "[RailsSimpleAuth] OAuth linked to existing account: #{email}. " \
+                    "Provider: #{provider}."
+                  )
+                  existing_user
+                end
               else
                 Rails.logger.warn(
                   "[RailsSimpleAuth] OAuth login rejected for existing email: #{email}. " \

data/lib/rails_simple_auth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsSimpleAuth
-  VERSION = '1.1.0'
+  VERSION = '1.2.1'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails_simple_auth
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.2.1
 platform: ruby
 authors:
 - Ivan Kuznetsov
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-01-20 00:00:00.000000000 Z
+date: 2026-09-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bcrypt