rodauth-rails 0.9.0 → 0.13.0

data/lib/generators/rodauth/install_generator.rb

@@ -10,6 +10,15 @@ module Rodauth
         include ::ActiveRecord::Generators::Migration
         include MigrationHelpers
 
+        MAILER_VIEWS = %w[
+          email_auth
+          password_changed
+          reset_password
+          unlock_account
+          verify_account
+          verify_login_change
+        ]
+
         source_root "#{__dir__}/templates"
         namespace "rodauth:install"
 
@@ -47,6 +56,14 @@ module Rodauth
           template "app/models/account.rb"
         end
 
+        def create_mailer
+          template "app/mailers/rodauth_mailer.rb"
+
+          MAILER_VIEWS.each do |view|
+            template "app/views/rodauth_mailer/#{view}.text.erb"
+          end
+        end
+
         private
 
         def sequel_uri_scheme

data/lib/generators/rodauth/migration/base.erb

@@ -5,11 +5,11 @@ enable_extension "citext"
 create_table :accounts<%= primary_key_type %> do |t|
 <% case activerecord_adapter -%>
 <% when "postgresql" -%>
-  t.citext :email, null: false, index: { unique: true, where: "status IN ('verified', 'unverified')" }
+  t.citext :email, null: false, index: { unique: true, where: "status IN ('unverified', 'verified')" }
 <% else -%>
   t.string :email, null: false, index: { unique: true }
 <% end -%>
-  t.string :status, null: false, default: "verified"
+  t.string :status, null: false, default: "unverified"
 end
 
 # Used if storing password hashes in a separate table (default)

data/lib/generators/rodauth/templates/app/lib/rodauth_app.rb

@@ -2,10 +2,10 @@ class RodauthApp < Rodauth::Rails::App
   configure do
     # List of authentication features that are loaded.
     enable :create_account, :verify_account, :verify_account_grace_period,
-      :login, :logout<%= ", :remember" unless jwt? %>,
+      :login, :logout<%= ", :remember" unless jwt? %><%= ", :json" if json? %><%= ", :jwt" if jwt? %>,
       :reset_password, :change_password, :change_password_notify,
       :change_login, :verify_login_change,
-      :close_account<%= ", :json" if json? %><%= ", :jwt" if jwt? %>
+      :close_account
 
     # See the Rodauth documentation for the list of available config options:
     # http://rodauth.jeremyevans.net/documentation.html
@@ -23,6 +23,10 @@ class RodauthApp < Rodauth::Rails::App
 
     # Accept only JSON requests.
     only_json? true
+
+    # Handle login and password confirmation fields on the client side.
+    # require_password_confirmation? false
+    # require_login_confirmation? false
 <% end -%>
 
     # Specify the controller used for view rendering and CSRF verification.
@@ -54,35 +58,29 @@ class RodauthApp < Rodauth::Rails::App
     # already_logged_in { redirect login_redirect }
 
     # ==> Emails
-    # Uncomment the lines below once you've imported mailer views.
-    # create_reset_password_email do
-    #   RodauthMailer.reset_password(email_to, reset_password_email_link)
-    # end
-    # create_verify_account_email do
-    #   RodauthMailer.verify_account(email_to, verify_account_email_link)
-    # end
-    # create_verify_login_change_email do |login|
-    #   RodauthMailer.verify_login_change(login, verify_login_change_old_login, verify_login_change_new_login, verify_login_change_email_link)
-    # end
-    # create_password_changed_email do
-    #   RodauthMailer.password_changed(email_to)
+    # Use a custom mailer for delivering authentication emails.
+    create_reset_password_email do
+      RodauthMailer.reset_password(email_to, reset_password_email_link)
+    end
+    create_verify_account_email do
+      RodauthMailer.verify_account(email_to, verify_account_email_link)
+    end
+    create_verify_login_change_email do |login|
+      RodauthMailer.verify_login_change(login, verify_login_change_old_login, verify_login_change_new_login, verify_login_change_email_link)
+    end
+    create_password_changed_email do
+      RodauthMailer.password_changed(email_to)
+    end
+    # create_email_auth_email do
+    #   RodauthMailer.email_auth(email_to, email_auth_email_link)
     # end
-    # # create_email_auth_email do
-    # #   RodauthMailer.email_auth(email_to, email_auth_email_link)
-    # # end
-    # # create_unlock_account_email do
-    # #   RodauthMailer.unlock_account(email_to, unlock_account_email_link)
-    # # end
-    # send_email do |email|
-    #   # queue email delivery on the mailer after the transaction commits
-    #   db.after_commit { email.deliver_later }
+    # create_unlock_account_email do
+    #   RodauthMailer.unlock_account(email_to, unlock_account_email_link)
     # end
-
-    # In the meantime, you can tweak settings for emails created by Rodauth.
-    # email_subject_prefix "[MyApp] "
-    # email_from "noreply@myapp.com"
-    # send_email(&:deliver_later)
-    # reset_password_email_body { "Click here to reset your password: #{reset_password_email_link}" }
+    send_email do |email|
+      # queue email delivery on the mailer after the transaction commits
+      db.after_commit { email.deliver_later }
+    end
 
     # ==> Flash
 <% unless json? || jwt? -%>
@@ -151,7 +149,9 @@ class RodauthApp < Rodauth::Rails::App
     # verify_account_grace_period 3.days
     # reset_password_deadline_interval Hash[hours: 6]
     # verify_login_change_deadline_interval Hash[days: 2]
+<% unless jwt? -%>
     # remember_deadline_interval Hash[days: 30]
+<% end -%>
   end
 
   # ==> Multiple configurations
@@ -187,6 +187,8 @@ class RodauthApp < Rodauth::Rails::App
     #   unless rodauth(:admin).logged_in?
     #     rodauth(:admin).require_http_basic_auth
     #   end
+    #
+    #   r.pass # allow the Rails app to handle other "/admin/*" requests
     # end
   end
 end

data/lib/generators/rodauth/templates/app/mailers/rodauth_mailer.rb

@@ -1,4 +1,4 @@
-class <%= options[:name].camelize %>Mailer < ApplicationMailer
+class RodauthMailer < ApplicationMailer
   def verify_account(recipient, email_link)
     @email_link = email_link
 
@@ -25,13 +25,13 @@ class <%= options[:name].camelize %>Mailer < ApplicationMailer
 
   # def email_auth(recipient, email_link)
   #   @email_link = email_link
-
+  #
   #   mail to: recipient
   # end
 
   # def unlock_account(recipient, email_link)
   #   @email_link = email_link
-
+  #
   #   mail to: recipient
   # end
 end

data/lib/generators/rodauth/templates/app/views/rodauth/_global_logout_field.html.erb

@@ -1,4 +1,4 @@
-<div class="form-group">
+<div class="form-group mb-3">
   <div class="form-check">
     <%%= check_box_tag rodauth.global_logout_param, "t", false, id: "global-logout", class: "form-check-input" %>
     <%%= label_tag "global-logout", "Logout all Logged In Sessons?", class: "form-check-label" %>

data/lib/generators/rodauth/templates/app/views/rodauth/_login_confirm_field.html.erb

@@ -1,4 +1,4 @@
-<div class="form-group">
-  <%%= label_tag "login-confirm", "Confirm Login" %>
+<div class="form-group mb-3">
+  <%%= label_tag "login-confirm", "Confirm Login", class: "form-label" %>
   <%%= render "field", name: rodauth.login_confirm_param, id: "login-confirm", type: :email, autocomplete: "email" %>
 </div>

data/lib/generators/rodauth/templates/app/views/rodauth/_login_display.html.erb

@@ -1,4 +1,4 @@
-<div class="form-group">
-  <%%= label_tag "login", "Login" %>
+<div class="form-group mb-3">
+  <%%= label_tag "login", "Login", class: "form-label" %>
   <%%= email_field_tag rodauth.login_param, params[rodauth.login_param], id: "login", readonly: true, class: "form-control-plaintext" %>
 </div>

data/lib/generators/rodauth/templates/app/views/rodauth/_login_field.html.erb

@@ -1,4 +1,4 @@
-<div class="form-group">
-  <%%= label_tag "login", "Login" %>
+<div class="form-group mb-3">
+  <%%= label_tag "login", "Login", class: "form-label" %>
   <%%= render "field", name: rodauth.login_param, id: "login", type: :email, autocomplete: "email" %>
 </div>

data/lib/generators/rodauth/templates/app/views/rodauth/_new_password_field.html.erb

@@ -1,4 +1,4 @@
-<div class="form-group">
-  <%%= label_tag "new-password", "New Password" %>
+<div class="form-group mb-3">
+  <%%= label_tag "new-password", "New Password", class: "form-label" %>
   <%%= render "field", name: rodauth.new_password_param, id: "new-password", type: "password", value: "", autocomplete: "new-password" %>
 </div>

data/lib/generators/rodauth/templates/app/views/rodauth/_otp_auth_code_field.html.erb

@@ -1,5 +1,5 @@
-<div class="form-group">
-  <%%= label_tag "otp-auth-code", "Authentication Code" %>
+<div class="form-group mb-3">
+  <%%= label_tag "otp-auth-code", "Authentication Code", class: "form-label" %>
   <div class="row">
     <div class="col-sm-3">
       <%%= render "field", name: rodauth.otp_auth_param, id: "otp-auth-code", value: "", autocomplete: "off", inputmode: "numeric" %>

data/lib/generators/rodauth/templates/app/views/rodauth/_password_confirm_field.html.erb

@@ -1,4 +1,4 @@
-<div class="form-group">
-  <%%= label_tag "password-confirm", "Confirm Password" %>
+<div class="form-group mb-3">
+  <%%= label_tag "password-confirm", "Confirm Password", class: "form-label" %>
   <%%= render "field", name: rodauth.password_confirm_param, id: "password-confirm", type: :password, value: "", autocomplete: "new-password" %>
 </div>

data/lib/generators/rodauth/templates/app/views/rodauth/_password_field.html.erb

@@ -1,4 +1,4 @@
-<div class="form-group">
-  <%%= label_tag "password", "Password" %>
+<div class="form-group mb-3">
+  <%%= label_tag "password", "Password", class: "form-label" %>
   <%%= render "field", name: rodauth.password_param, id: "password", type: :password, value: "", autocomplete: rodauth.password_field_autocomplete_value %>
 </div>

data/lib/generators/rodauth/templates/app/views/rodauth/_recovery_code_field.html.erb

@@ -1,4 +1,4 @@
-<div class="form-group">
-  <%%= label_tag "recovery_code", "Recovery Code" %>
+<div class="form-group mb-3">
+  <%%= label_tag "recovery_code", "Recovery Code", class: "form-label" %>
   <%%= render "field", name: rodauth.recovery_codes_param, id: "recovery_code", value: "", autocomplete: "off" %>
 </div>

data/lib/generators/rodauth/templates/app/views/rodauth/_sms_code_field.html.erb

@@ -1,5 +1,5 @@
-<div class="form-group">
-  <%%= label_tag "sms-code", "SMS Code" %>
+<div class="form-group mb-3">
+  <%%= label_tag "sms-code", "SMS Code", class: "form-label" %>
   <div class="row">
     <div class="col-sm-3">
       <%%= render "field", name: rodauth.sms_code_param, id: "sms-code", value: "", autocomplete: "one-time-code", inputmode: "numeric" %>

data/lib/generators/rodauth/templates/app/views/rodauth/_sms_phone_field.html.erb

@@ -1,5 +1,5 @@
-<div class="form-group">
-  <%%= label_tag "sms-phone", "Phone Number" %>
+<div class="form-group mb-3">
+  <%%= label_tag "sms-phone", "Phone Number", class: "form-label" %>
   <div class="row">
     <div class="col-sm-3">
       <%%= render "field", name: rodauth.sms_phone_param, id: "sms-phone", type: :tel, autocomplete: "tel" %>

data/lib/generators/rodauth/templates/app/views/rodauth/_submit.html.erb

@@ -1,3 +1,3 @@
-<div class="form-group">
+<div class="form-group mb-3">
   <%%= submit_tag local_assigns[:value], name: local_assigns[:name], class: local_assigns[:class] || "btn btn-primary" %>
 </div>

data/lib/generators/rodauth/templates/app/views/rodauth/otp_setup.html.erb

@@ -2,14 +2,14 @@
   <%%= hidden_field_tag rodauth.otp_setup_param, rodauth.otp_user_key, id: "otp-key" %>
   <%%= hidden_field_tag rodauth.otp_setup_raw_param, rodauth.otp_key, id: "otp-hmac-secret" if rodauth.otp_keys_use_hmac? %>
 
-  <div class="form-group">
+  <div class="form-group mb-3">
     <p>Secret: <%%= rodauth.otp_user_key %></p>
     <p>Provisioning URL: <%%= rodauth.otp_provisioning_uri %></p>
   </div>
 
   <div class="row">
     <div class="col-lg-6 col-lg">
-      <div class="form-group">
+      <div class="form-group mb-3">
         <p><%%= rodauth.otp_qr_code.html_safe %></p>
       </div>
     </div>

data/lib/generators/rodauth/templates/app/views/rodauth/remember.html.erb

@@ -1,5 +1,5 @@
 <%%= form_tag rodauth.remember_path, method: :post do %>
-  <fieldset class="form-group">
+  <fieldset class="form-group mb-3">
     <div class="form-check">
       <%%= radio_button_tag rodauth.remember_param, rodauth.remember_remember_param_value, false, id: "remember-remember", class: "form-check-input" %>
       <%%= label_tag "remember-remember", "Remember Me", class: "form-check-label" %>

data/lib/generators/rodauth/templates/app/views/rodauth/webauthn_remove.html.erb

@@ -1,6 +1,6 @@
 <%%= form_tag rodauth.webauthn_remove_path, method: :post, id: "webauthn-remove-form" do %>
   <%%= render "password_field" if rodauth.two_factor_modifications_require_password? %>
-  <fieldset class="form-group">
+  <fieldset class="form-group mb-3">
     <%% (usage = rodauth.account_webauthn_usage).each do |id, last_use| %>
       <div class="form-check">
         <%%= render "field", name: rodauth.webauthn_remove_param, id: "webauthn-remove-#{id}", type: :radio, class: "form-check-input", skip_error_message: true, value: id, required: false %>

data/lib/generators/rodauth/templates/app/views/rodauth_mailer/unlock_account.text.erb

@@ -1,4 +1,4 @@
-Someone has requested a that the account with this email be unlocked.
+Someone has requested that the account with this email be unlocked.
 If you did not request the unlocking of this account, please ignore this
 message.  If you requested the unlocking of this account, please go to
 <%%= @email_link %>

data/lib/rodauth/rails.rb

@@ -1,6 +1,9 @@
 require "rodauth/rails/version"
 require "rodauth/rails/railtie"
 
+require "rack/utils"
+require "stringio"
+
 module Rodauth
   module Rails
     class Error < StandardError
@@ -8,12 +11,13 @@ module Rodauth
 
     # This allows the developer to avoid loading Rodauth at boot time.
     autoload :App, "rodauth/rails/app"
+    autoload :Auth, "rodauth/rails/auth"
 
     @app = nil
     @middleware = true
 
     class << self
-      def rodauth(name = nil)
+      def rodauth(name = nil, query: {}, form: {}, session: {}, account: nil, env: {})
         url_options = ActionMailer::Base.default_url_options
 
         scheme   = url_options[:protocol] || "http"
@@ -22,14 +26,38 @@ module Rodauth
         host     = url_options[:host]
         host    += ":#{port}" if port
 
+        content_type = "application/x-www-form-urlencoded" if form.any?
+
         rack_env = {
+          "QUERY_STRING"    => Rack::Utils.build_nested_query(query),
+          "rack.input"      => StringIO.new(Rack::Utils.build_nested_query(form)),
+          "CONTENT_TYPE"    => content_type,
+          "rack.session"    => {},
           "HTTP_HOST"       => host,
           "rack.url_scheme" => scheme,
-        }
+        }.merge(env)
+
+        scope    = app.new(rack_env)
+        instance = scope.rodauth(name)
+
+        # update session hash here to make it work with JWT session
+        instance.session.merge!(session)
 
-        scope = app.new(rack_env)
+        if account
+          instance.instance_variable_set(:@account, account.attributes.symbolize_keys)
+          instance.session[instance.session_key] = instance.account_session_value
+        end
+
+        instance
+      end
 
-        scope.rodauth(name)
+      # routing constraint that requires authentication
+      def authenticated(name = nil, &condition)
+        lambda do |request|
+          rodauth = request.env.fetch ["rodauth", *name].join(".")
+          rodauth.require_authentication
+          rodauth.authenticated? && (condition.nil? || condition.call(rodauth))
+        end
       end
 
       if ::Rails.gem_version >= Gem::Version.new("5.2")

data/lib/rodauth/rails/app.rb

@@ -1,6 +1,5 @@
 require "roda"
-require "rodauth"
-require "rodauth/rails/feature"
+require "rodauth/rails/auth"
 
 module Rodauth
   module Rails
@@ -11,40 +10,39 @@ module Rodauth
 
       plugin :hooks
       plugin :render, layout: false
+      plugin :pass
 
-      if defined?(ActionDispatch::Flash) # not in API-only mode
+      unless Rodauth::Rails.api_only?
         require "rodauth/rails/app/flash"
         plugin Flash
       end
 
-      def self.configure(name = nil, **options, &block)
-        plugin :rodauth, name: name, csrf: false, flash: false, json: true, **options do
-          # load the Rails integration
-          enable :rails
+      def self.configure(*args, **options, &block)
+        auth_class = args.shift if args[0].is_a?(Class)
+        name       = args.shift if args[0].is_a?(Symbol)
 
-          # database functions are more complex to set up, so disable them by default
-          use_database_authentication_functions? false
+        fail ArgumentError, "need to pass optional Rodauth::Auth subclass and optional configuration name" if args.any?
 
-          # avoid having to set deadline values in column default values
-          set_deadline_values? true
+        auth_class ||= Class.new(Rodauth::Rails::Auth)
 
-          # use HMACs for additional security
-          hmac_secret { Rodauth::Rails.secret_key_base }
-
-          # evaluate user configuration
-          instance_exec(&block)
+        plugin :rodauth, auth_class: auth_class, name: name, csrf: false, flash: false, json: true, **options do
+          instance_exec(&block) if block
         end
       end
 
       before do
-        (opts[:rodauths] || {}).each do |name, _|
-          if name
-            env["rodauth.#{name}"] = rodauth(name)
-          else
-            env["rodauth"] = rodauth
-          end
+        opts[:rodauths]&.each_key do |name|
+          env[["rodauth", *name].join(".")] = rodauth(name)
         end
       end
+
+      def rails_routes
+        ::Rails.application.routes.url_helpers
+      end
+
+      def rails_request
+        ActionDispatch::Request.new(env)
+      end
     end
   end
 end

data/lib/rodauth/rails/app/flash.rb

@@ -27,24 +27,18 @@ module Rodauth
           end
 
           def flash
-            rails_request.flash
+            scope.rails_request.flash
           end
 
           if ActionPack.version >= Gem::Version.new("5.0")
             def commit_flash
-              rails_request.commit_flash
+              scope.rails_request.commit_flash
             end
           else
             def commit_flash
               # ActionPack 4.2 automatically commits flash
             end
           end
-
-          private
-
-          def rails_request
-            ActionDispatch::Request.new(env)
-          end
         end
       end
     end