rodauth-rails 0.10.0 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4cc138f57505a1bbf92267e02b8d9b87f50c0dd9b6c114891f649c0b15878637
-  data.tar.gz: 28fc8264a8629dd186a446a4d067167d572f8ea58b65c742f12f81a5192221db
+  metadata.gz: b8063be8ad00634114f74f0eb549c672e2b62cd1fa81cb7f124cc9cd12505e3f
+  data.tar.gz: 6f466e29420f9e4bacb58c855e942cc20289d2c3fc69a12638b97628d25dbbfb
 SHA512:
-  metadata.gz: 74645990b10677d44503f272a63300465881c6e596b514ce0e1d1607689d8ace60c5e70a79c952256ad73bf704a8d268e27af3da8cdb617c5b381f752b302c4b
-  data.tar.gz: 1525c4a51d4323e348ee2dc117e5ef320214f42f385549f5646af1d8e1792bfeac2be3f220b473873aed8fc72f4448aade9848b82fdd2c348874f8b4950e4631
+  metadata.gz: 8cc0af59c6ce29837fbc8a3401d456fd407ef76b74493b08ee9b4f2dfc8807d4a95c86f9bb0266401013d5162c009d46b7d07e3f741654af2cc267c0ee2c135e
+  data.tar.gz: 78c098dbaed458d5764ca2e7ee61f4710e01b2386d0cc04831b1732b9883d76c4b9f56c35c0a1e557c40951086d72bb0ed264f769313c1b45be30b2dd760024a

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 0.11.0 (2021-05-06)
+
+* Add controller-like logging for requests to Rodauth endpoints (@janko)
+
+* Add `#rails_routes` to Roda and Rodauth instance for accessing Rails route helpers (@janko)
+
+* Add `#rails_request` to Roda and Rodauth instance for retrieving an `ActionDispatch::Request` instance (@janko)
+
 ## 0.10.0 (2021-03-23)
 
 * Add `Rodauth::Rails::Auth` superclass for moving configurations into separate files (@janko)

data/README.md

@@ -2,35 +2,6 @@
 
 Provides Rails integration for the [Rodauth] authentication framework.
 
-## Table of contents
-
-* [Resources](#resources)
-* [Why Rodauth?](#why-rodauth)
-* [Upgrading](#upgrading)
-* [Installation](#installation)
-* [Usage](#usage)
-  - [Routes](#routes)
-  - [Current account](#current-account)
-  - [Requiring authentication](#requiring-authentication)
-  - [Views](#views)
-  - [Mailer](#mailer)
-  - [Migrations](#migrations)
-  - [Multiple configurations](#multiple-configurations)
-  - [Calling controller methods](#calling-controller-methods)
-  - [Rodauth instance](#rodauth-instance)
-* [How it works](#how-it-works)
-  - [Middleware](#middleware)
-  - [App](#app)
-  - [Sequel](#sequel)
-* [JSON API](#json-api)
-* [OmniAuth](#omniauth)
-* [Configuring](#configuring)
-* [Custom extensions](#custom-extensions)
-* [Testing](#testing)
-* [Rodauth defaults](#rodauth-defaults)
-  - [Database functions](#database-functions)
-  - [Account statuses](#account-statuses)
-
 ## Resources
 
 Useful links:
@@ -43,6 +14,7 @@ Articles:
 * [Rodauth: A Refreshing Authentication Solution for Ruby](https://janko.io/rodauth-a-refreshing-authentication-solution-for-ruby/)
 * [Adding Authentication in Rails with Rodauth](https://janko.io/adding-authentication-in-rails-with-rodauth/)
 * [Adding Multifactor Authentication in Rails with Rodauth](https://janko.io/adding-multifactor-authentication-in-rails-with-rodauth/)
+* [How to build an OIDC provider using rodauth-oauth on Rails](https://honeyryderchuck.gitlab.io/httpx/2021/03/15/oidc-provider-on-rails-using-rodauth-oauth.html)
 
 ## Why Rodauth?
 
@@ -61,6 +33,12 @@ of the advantages that stand out for me:
 * consistent before/after hooks around everything
 * dedicated object encapsulating all authentication logic
 
+One commmon concern is the fact that, unlike most other authentication
+frameworks for Rails, Rodauth uses [Sequel] for database interaction instead of
+Active Record. There are good reasons for this, and to make Rodauth work
+smoothly alongside Active Record, rodauth-rails configures Sequel to [reuse
+Active Record's database connection][sequel-activerecord_connection].
+
 ## Upgrading
 
 ### Upgrading to 0.7.0
@@ -271,6 +249,19 @@ These routes are fully functional, feel free to visit them and interact with the
 pages. The templates that ship with Rodauth aim to provide a complete
 authentication experience, and the forms use [Bootstrap] markup.
 
+Inside Rodauth configuration and the `route` block you can access Rails route
+helpers through `#rails_routes`:
+
+```rb
+class RodauthApp < Rodauth::Rails::App
+  configure do
+    # ...
+    login_redirect { rails_routes.activity_path }
+    # ...
+  end
+end
+```
+
 ### Current account
 
 To be able to fetch currently authenticated account, let's define a
@@ -491,7 +482,6 @@ end
 ```rb
 # app/lib/rodauth_app.rb
 class RodauthApp < Rodauth::Rails::App
-  # ...
   configure do
     # ...
     create_reset_password_email do
@@ -521,17 +511,17 @@ class RodauthApp < Rodauth::Rails::App
 end
 ```
 
-The above configuration uses `#deliver_later`, which assumes Active Job is
-configured. It's generally recommended to send emails in a background job,
-for better throughput and ability to retry. However, if you want to send emails
-synchronously, you can modify the code to call `#deliver` instead.
+This configuration calls `#deliver_later`, which uses Active Job to deliver
+emails in a background job. It's generally recommended to send emails
+asynchronously for better request throughput and the ability to retry
+deliveries. However, if you want to send emails synchronously, modify the
+configuration to call `#deliver_now` instead.
 
-The `#send_email` method will receive whatever object is returned by the
-`#create_*_email` methods. But if that doesn't suit you, you can override
-`#send_*_email` methods instead, which are expected to send the email
-immediately. This might work better in scenarios such as using a 3rd-party
-service for transactional emails, where emails are sent via HTTP instead of
-SMTP.
+If you're using a background processing library without an Active Job adapter,
+or a 3rd-party service for sending transactional emails, this two-phase API
+might not be suitable. In this case, instead of overriding `#create_*_email`
+and `#send_email`, override the `#send_*_email` methods instead, which are
+required to send the email immediately.
 
 ### Migrations
 
@@ -586,6 +576,7 @@ class RodauthApp < Rodauth::Rails::App
       r.rodauth(:admin)
       r.pass # allow the Rails app to handle other "/admin/*" requests
     end
+
     # ...
   end
 end
@@ -638,7 +629,7 @@ common settings:
 
 ```rb
 # app/lib/rodauth_base.rb
-class RodauthBase < Rodauth::Rails::App
+class RodauthBase < Rodauth::Rails::Auth
   # common settings that can be shared between multiple configurations
   configure do
     enable :login, :logout
@@ -676,7 +667,7 @@ class RodauthAdmin < Rodauth::Rails::Auth
   end
 
   def superadmin?
-    Role.where(account_id: session_id).any? { |role| role.name == "superadmin" }
+    Role.where(account_id: session_id, type: "superadmin").any?
   end
 end
 ```
@@ -1179,29 +1170,38 @@ end
 ```
 
 If you're delivering emails in the background, make sure to set Active Job
-queue adapter to `:test`:
+queue adapter to `:test` or `:inline`:
 
 ```rb
 # config/environments/test.rb
 Rails.application.configure do |config|
   # ...
-  config.active_job.queue_adapter = :test
+  config.active_job.queue_adapter = :test # or :inline
   # ...
 end
 ```
 
-If you need to create the account manually, you can do it as follows:
+If you need to create an account record with a password directly, you can do it
+as follows:
 
 ```rb
-account_id = DB[:accounts].insert(
-  email: "user@example.com",
-  status: "verified",
-)
-
-DB[:account_password_hashes].insert(
-  account_id: account_id,
-  password_hash: BCrypt::Password.create("secret", cost: BCrpyt::Engine::MIN_COST),
-)
+# app/models/account.rb
+class Account < ApplicationRecord
+  has_one :password_hash, foreign_key: :id
+end
+```
+```rb
+# app/models/account/password_hash.rb
+class Account::PasswordHash < ApplicationRecord
+  belongs_to :account, foreign_key: :id
+end
+```
+```rb
+require "bcrypt"
+
+account = Account.create!(email: "user@example.com", status: "verified")
+password_hash = BCrypt::Password.create("secret", cost: BCrypt::Engine::MIN_COST)
+account.create_password_hash!(id: account.id, password_hash: password_hash)
 ```
 
 ## Rodauth defaults

data/lib/generators/rodauth/templates/app/views/rodauth_mailer/unlock_account.text.erb

@@ -1,4 +1,4 @@
-Someone has requested a that the account with this email be unlocked.
+Someone has requested that the account with this email be unlocked.
 If you did not request the unlocking of this account, please ignore this
 message.  If you requested the unlocking of this account, please go to
 <%%= @email_link %>

data/lib/rodauth/rails/app.rb

@@ -35,6 +35,14 @@ module Rodauth
           env[["rodauth", *name].join(".")] = rodauth(name)
         end
       end
+
+      def rails_routes
+        ::Rails.application.routes.url_helpers
+      end
+
+      def rails_request
+        ActionDispatch::Request.new(env)
+      end
     end
   end
 end

data/lib/rodauth/rails/app/flash.rb

@@ -27,24 +27,18 @@ module Rodauth
           end
 
           def flash
-            rails_request.flash
+            scope.rails_request.flash
           end
 
           if ActionPack.version >= Gem::Version.new("5.0")
             def commit_flash
-              rails_request.commit_flash
+              scope.rails_request.commit_flash
             end
           else
             def commit_flash
               # ActionPack 4.2 automatically commits flash
             end
           end
-
-          private
-
-          def rails_request
-            ActionDispatch::Request.new(env)
-          end
         end
       end
     end

data/lib/rodauth/rails/feature.rb

@@ -63,24 +63,33 @@ module Rodauth
       super.html_safe
     end
 
+    delegate :rails_routes, :rails_request, to: :scope
+
     private
 
     # Runs controller callbacks and rescue handlers around Rodauth actions.
     def _around_rodauth(&block)
       result = nil
 
-      rails_controller_rescue do
-        rails_controller_callbacks do
-          result = catch(:halt) { super(&block) }
+      rails_instrument_request do
+        rails_controller_rescue do
+          rails_controller_callbacks do
+            result = catch(:halt) { super(&block) }
+          end
         end
+
+        result = handle_rails_controller_response(result)
       end
 
+      throw :halt, result if result
+    end
+
+    # Handles controller rendering a response or setting response headers.
+    def handle_rails_controller_response(result)
       if rails_controller_instance.performed?
         rails_controller_response
       elsif result
         result[1].merge!(rails_controller_instance.response.headers)
-        throw :halt, result
-      else
         result
       end
     end
@@ -109,6 +118,20 @@ module Rodauth
       end
     end
 
+    def rails_instrument_request
+      ActiveSupport::Notifications.instrument("start_processing.rodauth", rodauth: self)
+      ActiveSupport::Notifications.instrument("process_request.rodauth", rodauth: self) do |payload|
+        begin
+          status, headers, body = yield
+          payload[:status] = status || 404
+          payload[:headers] = headers
+          payload[:body] = body
+        ensure
+          rails_controller_instance.send(:append_info_to_payload, payload)
+        end
+      end
+    end
+
     # Returns Roda response from controller response if set.
     def rails_controller_response
       controller_response = rails_controller_instance.response
@@ -117,7 +140,7 @@ module Rodauth
       response.headers.merge! controller_response.headers
       response.write controller_response.body
 
-      request.halt
+      response.finish
     end
 
     # Create emails with ActionMailer which uses configured delivery method.
@@ -168,11 +191,8 @@ module Rodauth
 
     # Instances of the configured controller with current request's env hash.
     def _rails_controller_instance
-      controller    = rails_controller.new
-      rails_request = ActionDispatch::Request.new(scope.env)
-
+      controller = rails_controller.new
       prepare_rails_controller(controller, rails_request)
-
       controller
     end
 

data/lib/rodauth/rails/log_subscriber.rb

@@ -0,0 +1,34 @@
+module Rodauth
+  module Rails
+    class LogSubscriber < ActiveSupport::LogSubscriber
+      def start_processing(event)
+        rodauth = event.payload[:rodauth]
+        app_class = rodauth.scope.class.superclass
+        format = rodauth.rails_request.format.ref
+        format = format.to_s.upcase if format.is_a?(Symbol)
+        format = "*/*" if format.nil?
+
+        info "Processing by #{app_class} as #{format}"
+      end
+
+      def process_request(event)
+        status = event.payload[:status]
+
+        additions = ActionController::Base.log_process_action(event.payload)
+        if ::Rails.gem_version >= Gem::Version.new("6.0")
+          additions << "Allocations: #{event.allocations}"
+        end
+
+        message = "Completed #{status} #{Rack::Utils::HTTP_STATUS_CODES[status]} in #{event.duration.round}ms"
+        message << " (#{additions.join(" | ")})"
+        message << "\n\n" if defined?(::Rails.env) && ::Rails.env.development?
+
+        info message
+      end
+
+      def logger
+        ::Rails.logger
+      end
+    end
+  end
+end

data/lib/rodauth/rails/railtie.rb

@@ -1,5 +1,6 @@
 require "rodauth/rails/middleware"
 require "rodauth/rails/controller_methods"
+require "rodauth/rails/log_subscriber"
 
 require "rails"
 
@@ -16,6 +17,10 @@ module Rodauth
         end
       end
 
+      initializer "rodauth.log_subscriber" do
+        Rodauth::Rails::LogSubscriber.attach_to :rodauth
+      end
+
       initializer "rodauth.test" do
         # Rodauth uses RACK_ENV to set the default bcrypt hash cost
         ENV["RACK_ENV"] = "test" if ::Rails.env.test?

data/lib/rodauth/rails/version.rb

@@ -1,5 +1,5 @@
 module Rodauth
   module Rails
-    VERSION = "0.10.0"
+    VERSION = "0.11.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-rails
 version: !ruby/object:Gem::Version
-  version: 0.10.0
+  version: 0.11.0
 platform: ruby
 authors:
 - Janko Marohnić
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-03-23 00:00:00.000000000 Z
+date: 2021-05-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -207,6 +207,7 @@ files:
 - lib/rodauth/rails/auth.rb
 - lib/rodauth/rails/controller_methods.rb
 - lib/rodauth/rails/feature.rb
+- lib/rodauth/rails/log_subscriber.rb
 - lib/rodauth/rails/middleware.rb
 - lib/rodauth/rails/railtie.rb
 - lib/rodauth/rails/tasks.rake