rails_simple_auth 1.1.0 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ad68672c8d3cb2ae020bb5ca15c50806b64a3593734088c5bae4ed351b1683d1
-  data.tar.gz: 195845cbc41e1163f5212f3dc2448093bb13a278dbf58332189e115983ed90b8
+  metadata.gz: e08c83add50f655ddb8b4a064ea3378fa4f6da3ce0455267e572749221650441
+  data.tar.gz: 4907167244666a084c8afeb159cb7e1af90bce5ec77992eeb22f2b4e1ac1c4a4
 SHA512:
-  metadata.gz: cc42b623955ccdfcc4737eb58c2b70efb0fb93f6c7633791d81d89ed8f0ce396277dddae529a25e38906324ef7256e34bcbcfb0bbe3dc3314a209c0c9e922dab
-  data.tar.gz: b496b38e1c2369759e8dbe21b927f21d43a5cd79da47882290e322444658053b7a415cfe42888a35f3cc5ac1101c4b1a0a7bf91f68fa8859f7d883e0c1594d44
+  metadata.gz: fa89e4d892c0abe0a12fd68ea5dfc7e8d9bd064c57857b3d3ec9102efe9e02ec32a05038e1b7d54465260a06f20c6d8898b7ce774199b30e40ffba01d7c17702
+  data.tar.gz: 490267496b49a4a1d118c687e0f2944e5ce4452c5287161b14594d926cc1b41021b09d90a8ea22e322aead5fae2e0cc421187d8f8ee8d74dfa54421477160c04

data/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.0] - 2026-05-23
+
+### Changed
+
+- **OAuth provider sign-in now honors `session[:return_to]`.** `OmniauthCallbacksController#create` previously hardcoded `after_sign_in_path`, so a user mid-redirect (e.g., a host app that called `store_location_for_redirect` before bouncing to `/sign_in`) landed on the default page after the Google/GitHub round-trip instead of resuming. It now goes through `sign_in_user_and_redirect`, which consumes `session[:return_to]` and falls back to `after_sign_in_path`. **Action:** host apps relying on a hard reset to the configured path post-OAuth should review their flows; the configured path remains the default when nothing was stored.
+- **Confirmation-disabled sign-up now honors `session[:return_to]`.** `RegistrationsController#after_successful_registration`'s no-confirmation branch previously hardcoded `after_sign_up_path`. It now redirects to `stored_location_or_default(:after_sign_up_path)` — same precedence rule, separate config key. The `after_sign_up_callback` execution path is unchanged.
+- **`stored_location_or_default` now accepts an optional fallback config key** (default `:after_sign_in_path`), so callers can pass `:after_sign_up_path` (or any other configured path) without duplicating the lookup logic.
+- **`stored_location_or_default` validates the stored value at read time** as defense-in-depth: a poisoned `session[:return_to]` (non-string, doesn't start with `/`, or starts with `//`) is rejected and the fallback is used instead. The write-side validation in `store_location_for_redirect` remains the primary defense; this read-side check protects host apps that bypass the helper.
+- **Extracted `sign_in_user_and_redirect(user, notice:)` to `SessionManagement` concern.** `SessionsController#sign_in_and_redirect` and `OmniauthCallbacksController#create` now share one definition of the sign-in-and-redirect sequence (`destroy_temporary_user_session` → `create_session_for` → `run_after_sign_in_callback` → `redirect_to stored_location_or_default`). `SessionsController#sign_in_and_redirect`'s external behavior is preserved.
+
 ## [1.1.0] - 2026-01-20
 
 ### Added

data/README.md

@@ -125,12 +125,12 @@ Or edit `rails_simple_auth.css` directly for complete control.
 
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `--rsa-color-primary` | `#3b82f6` | Primary button/link color |
-| `--rsa-color-primary-hover` | `#2563eb` | Primary hover state |
+| `--rsa-color-primary` | `#4f46e5` | Primary button/link color |
+| `--rsa-color-primary-hover` | `#4338ca` | Primary hover state |
 | `--rsa-color-background-form` | `#ffffff` | Form container background |
-| `--rsa-color-text` | `#374151` | Main text color |
-| `--rsa-color-text-muted` | `#6b7280` | Secondary text color |
-| `--rsa-color-border` | `#e5e7eb` | Border color |
+| `--rsa-color-text` | `#475569` | Main text color |
+| `--rsa-color-text-muted` | `#64748b` | Secondary text color |
+| `--rsa-color-border` | `#e2e8f0` | Border color |
 | `--rsa-color-danger` | `#dc2626` | Error message color |
 
 ## View Customization

data/app/controllers/rails_simple_auth/omniauth_callbacks_controller.rb

@@ -19,11 +19,7 @@ module RailsSimpleAuth
       display_name = RailsSimpleAuth.configuration.oauth_provider_display_name(provider)
 
       if user&.persisted?
-        destroy_temporary_user_session(user)
-        create_session_for(user)
-        run_after_sign_in_callback(user)
-        redirect_to resolve_path(:after_sign_in_path),
-                    notice: "Signed in successfully with #{display_name}."
+        sign_in_user_and_redirect(user, notice: "Signed in successfully with #{display_name}.")
       else
         redirect_to new_session_path, alert: "Could not authenticate with #{display_name}."
       end

data/app/controllers/rails_simple_auth/registrations_controller.rb

@@ -40,7 +40,7 @@ module RailsSimpleAuth
       else
         create_session_for(@user)
         run_after_sign_up_callback(@user)
-        redirect_to resolve_path(:after_sign_up_path), notice: 'Account created successfully!'
+        redirect_to stored_location_or_default(:after_sign_up_path), notice: 'Account created successfully!'
       end
     end
 

data/app/controllers/rails_simple_auth/sessions_controller.rb

@@ -96,10 +96,7 @@ module RailsSimpleAuth
     end
 
     def sign_in_and_redirect(user)
-      destroy_temporary_user_session(user)
-      create_session_for(user)
-      run_after_sign_in_callback(user)
-      redirect_to stored_location_or_default, notice: 'Signed in successfully.'
+      sign_in_user_and_redirect(user)
     end
   end
 end

data/lib/rails_simple_auth/controllers/concerns/authentication.rb

@@ -88,8 +88,26 @@ module RailsSimpleAuth
           end
         end
 
-        def stored_location_or_default
-          session.delete(:return_to) || resolve_path(:after_sign_in_path)
+        # Returns the stored post-auth return path (consuming it from the session) or,
+        # if none was stored or the stored value fails defense-in-depth validation,
+        # the resolved fallback path for the given config key (e.g., :after_sign_in_path,
+        # :after_sign_up_path).
+        #
+        # SECURITY: store_location_for_redirect validates paths at write time, but
+        # nothing prevents host-app code from writing to session[:return_to] directly.
+        # We re-check here so a poisoned value (open-redirect, javascript:, malformed
+        # string) falls back instead of raising UnsafeRedirectError or worse.
+        #
+        # NOTE: mutates the session — calling twice returns the fallback the second time.
+        def stored_location_or_default(fallback_path_config = :after_sign_in_path)
+          stored = session.delete(:return_to)
+          return resolve_path(fallback_path_config) unless safe_stored_location?(stored)
+
+          stored
+        end
+
+        def safe_stored_location?(path)
+          path.is_a?(String) && path.start_with?('/') && !path.start_with?('//')
         end
 
         def redirect_to_sign_in

data/lib/rails_simple_auth/controllers/concerns/session_management.rb

@@ -8,6 +8,19 @@ module RailsSimpleAuth
 
         private
 
+        # Standard sign-in sequence: clean up the temporary user, create the real
+        # session, fire after_sign_in callbacks, then redirect.
+        #
+        # NOTE: order matters — destroy_temporary_user_session must run before
+        # create_session_for, otherwise the new session cookie is wiped when the
+        # temp user is destroyed.
+        def sign_in_user_and_redirect(user, notice: 'Signed in successfully.')
+          destroy_temporary_user_session(user)
+          create_session_for(user)
+          run_after_sign_in_callback(user)
+          redirect_to stored_location_or_default, notice: notice
+        end
+
         # Create a new session for the user and set the cookie
         def create_session_for(user)
           session_record = user.sessions.create!(

data/lib/rails_simple_auth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsSimpleAuth
-  VERSION = '1.1.0'
+  VERSION = '1.2.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails_simple_auth
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.2.0
 platform: ruby
 authors:
 - Ivan Kuznetsov
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-01-20 00:00:00.000000000 Z
+date: 2026-05-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bcrypt