rails_simple_auth 1.2.0 → 1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e08c83add50f655ddb8b4a064ea3378fa4f6da3ce0455267e572749221650441
-  data.tar.gz: 4907167244666a084c8afeb159cb7e1af90bce5ec77992eeb22f2b4e1ac1c4a4
+  metadata.gz: 92f4718f32ac9f010bc24be665915952c9dcf5d02340c07e7692b2a053a282ce
+  data.tar.gz: 71ba9817ebe4fcefd815aa47e0f99d02261349d78a0532b0a6f3fca22442d6ab
 SHA512:
-  metadata.gz: fa89e4d892c0abe0a12fd68ea5dfc7e8d9bd064c57857b3d3ec9102efe9e02ec32a05038e1b7d54465260a06f20c6d8898b7ce774199b30e40ffba01d7c17702
-  data.tar.gz: 490267496b49a4a1d118c687e0f2944e5ce4452c5287161b14594d926cc1b41021b09d90a8ea22e322aead5fae2e0cc421187d8f8ee8d74dfa54421477160c04
+  metadata.gz: 97e9c562f6993c03661ef81eee4e534ad25496b3f36f3f46d1b559a860835a8dde49f190eeed0368a5abc7d0d06e11d2a596873d75af7484983f3afe043397d5
+  data.tar.gz: cf069335a5b94f84b163057116730d1feb4d428d43b9c3ccb5da056f73b92a13ef2dbeda7cf8c939c858480243bcf93e47ec7899f63c12864398d21d4fcd43c3

data/CHANGELOG.md

@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.1] - 2026-09-15
+
+### Fixed
+
+- OAuth linking reloads the account under a row lock so concurrent confirmation or pending email changes are preserved; if the matched email changes before linking, sign-in is rejected.
+- Confirm existing accounts when linking by email through a trusted OAuth provider, before calling the host application's `assign_oauth_attributes` hook. Preserve existing confirmation timestamps and pending email changes. Accounts found by provider and UID remain unchanged.
+- Return `nil` when saving an existing OAuth account link fails, preventing authentication with unsaved changes.
+
 ## [1.2.0] - 2026-05-23
 
 ### Changed

data/README.md

@@ -217,6 +217,12 @@ class User < ApplicationRecord
 end
 ```
 
+Email-based account linking is enabled by default (`config.oauth_link_existing_accounts = true`). Only enable it for providers you trust to supply verified email addresses; the gem does not inspect provider-specific verification claims. Set it to `false` to reject linking by email.
+
+New OAuth accounts and existing accounts linked by email are automatically confirmed when they have a `confirmed_at` column. Existing confirmation timestamps and pending email changes are preserved. Confirmation is assigned before `assign_oauth_attributes`, so your hook can use it to update application-specific state. The hook and confirmation changes are saved together; a failed save returns `nil`.
+
+Accounts found by provider and UID return unchanged, including their email and confirmation state. Applications with historical unconfirmed OAuth accounts should handle their backfill separately.
+
 ## Temporary Users (Guest Accounts)
 
 Temporary users allow visitors to try your app without creating an account. They get a real user record with full functionality, then can convert to a permanent account later by providing email and password.

data/lib/rails_simple_auth/models/concerns/oauth_connectable.rb

@@ -41,16 +41,38 @@ module RailsSimpleAuth
             existing_user = find_by_email(email)
             if existing_user
               # Configurable: allow linking OAuth to existing accounts
-              # Default is true - most OAuth providers (Google, GitHub) verify emails
+              # Only enable for providers trusted to supply verified email addresses.
               if RailsSimpleAuth.configuration.oauth_link_existing_accounts
-                Rails.logger.info(
-                  "[RailsSimpleAuth] OAuth linked to existing account: #{email}. " \
-                  "Provider: #{provider}."
-                )
-                # Call hook to store OAuth credentials on existing user
-                existing_user.assign_oauth_attributes(auth_hash) if existing_user.respond_to?(:assign_oauth_attributes)
-                existing_user.save if existing_user.changed?
-                return existing_user
+                matched_email = existing_user.email
+                return existing_user.with_lock do
+                  # Reload under the lock before checking confirmation state.
+                  next nil if existing_user.email != matched_email
+
+                  # Confirm the current email only; OAuth does not verify a pending replacement.
+                  pending_email = existing_user.respond_to?(:unconfirmed_email) &&
+                                  existing_user.unconfirmed_email.present?
+                  if existing_user.respond_to?(:confirmed_at=) && existing_user.confirmed_at.nil? && !pending_email
+                    existing_user.confirmed_at = Time.current
+                  end
+
+                  # Call hook to store OAuth credentials on existing user
+                  if existing_user.respond_to?(:assign_oauth_attributes)
+                    existing_user.assign_oauth_attributes(auth_hash)
+                  end
+                  if existing_user.changed? && !existing_user.save
+                    Rails.logger.error(
+                      "[RailsSimpleAuth] OAuth account linking failed for email: #{email}, " \
+                      "provider: #{provider}, errors: #{existing_user.errors.full_messages.join(', ')}"
+                    )
+                    next nil
+                  end
+
+                  Rails.logger.info(
+                    "[RailsSimpleAuth] OAuth linked to existing account: #{email}. " \
+                    "Provider: #{provider}."
+                  )
+                  existing_user
+                end
               else
                 Rails.logger.warn(
                   "[RailsSimpleAuth] OAuth login rejected for existing email: #{email}. " \

data/lib/rails_simple_auth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsSimpleAuth
-  VERSION = '1.2.0'
+  VERSION = '1.2.1'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails_simple_auth
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.2.1
 platform: ruby
 authors:
 - Ivan Kuznetsov
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-23 00:00:00.000000000 Z
+date: 2026-09-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bcrypt