rodauth-rails 2.2.1 → 2.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6ff5f59365d2d0268c0508d9e2d29a47f872746d65c7114d287b753ef36a1cbe
-  data.tar.gz: 1a6b7ed15c17b5c4e91ab73b0efb191bca57b027b14ab1fde43dc7af8c83aa2a
+  metadata.gz: 1ee1baf96e7272819b654ff2ef0153dfc5ff8c8c09547e9b1db848f7daec7949
+  data.tar.gz: 58d00e15bde03f30862186d242f9928d17082bf800abf28528782ce492d6081c
 SHA512:
-  metadata.gz: b35dce74ceed469ed3015931d026313ed34900ad6d726308f1c80efad6dcf4c3da2fc91024eafcdb3b38b44dd7d23f2e4b7639c7e77411f54aa6c4b5d3f10e7d
-  data.tar.gz: b3669e57b2f863c6ef0771fe9c157f9b4a19fa8840ed8001e06338017a156b896422702079a18795b06c3ea257a736534be1070b3d66f9506d120304318c886c
+  metadata.gz: 634d5ba134c9c0c5757ede2aa25a9700252e8026201be0a6694df46d74430b793b4e5272fe835a3ec07291b0ef61860f106f1738e40c6fec7e2552ea82d48dc8
+  data.tar.gz: 11d06b4d5564ccdb5b4016b5bb329e92b67877bab59f1ec541303ec31e79d5017780672c3269f0f314a761b6c47e38add64977556bbf4187baac152c80008f97

data/lib/generators/rodauth/templates/app/misc/rodauth_main.rb.tt

@@ -104,7 +104,7 @@ class RodauthMain < Rodauth::Rails::Auth
     # delete_account_on_close? true
 
     # Redirect to the app from login and registration pages if already logged in.
-    # already_logged_in { redirect login_redirect }
+    already_logged_in { redirect login_redirect }
 
 <% if defined?(ActionMailer) -%>
     # ==> Emails

data/lib/rodauth/rails/app.rb

@@ -5,6 +5,9 @@ module Rodauth
   module Rails
     # The superclass for creating a Rodauth middleware.
     class App < Roda
+      # matches Rodauth's default json_request_content_type_regexp
+      JSON_CONTENT_TYPE_REGEXP = /\Aapplication\/(?:vnd\.api\+)?json\b/i
+
       plugin :middleware, forward_response_headers: true, next_if_not_found: true
       plugin :hooks
       plugin :pass
@@ -20,6 +23,9 @@ module Rodauth
         # we'll render Rodauth's built-in view templates within Rails layouts
         plugin :render, layout: false unless render == false
 
+        # configure JSON parser before Rodauth loads it, to avoid Roda's warning
+        plugin :json_parser, content_type_regexp: JSON_CONTENT_TYPE_REGEXP if options.fetch(:json, true)
+
         plugin :rodauth, auth_class: auth_class, name: name, csrf: false, json: true, render: render, **options, &block
 
         # we need to do it after request methods from rodauth have been included
@@ -32,7 +38,7 @@ module Rodauth
         end
       end
 
-      after do
+      after do |_res|
         rails_request.commit_flash
       end
 
@@ -81,7 +87,7 @@ module Rodauth
         # The Rack input might not be rewindable, so ensure we parse the JSON
         # request body in Rails, and avoid parsing it again in Roda.
         def POST
-          if content_type =~ /json/
+          if content_type =~ JSON_CONTENT_TYPE_REGEXP
             env["roda.json_params"] = scope.rails_request.POST.to_hash
           end
           super

data/lib/rodauth/rails/feature/csrf.rb

@@ -51,6 +51,12 @@ module Rodauth
         # Calls the controller to verify the authenticity token.
         def rails_check_csrf!
           rails_controller_instance.send(:verify_authenticity_token)
+
+          # On Rails 8.2+, verify_authenticity_token only marks that forgery
+          # protection is enabled, while the actual check is performed here.
+          if rails_controller_instance.respond_to?(:verify_request_for_forgery_protection, true)
+            rails_controller_instance.send(:verify_request_for_forgery_protection)
+          end
         end
 
         # Hidden tag with Rails CSRF token inserted into Rodauth templates.

data/lib/rodauth/rails/version.rb

@@ -1,5 +1,5 @@
 module Rodauth
   module Rails
-    VERSION = "2.2.1"
+    VERSION = "2.2.3"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-rails
 version: !ruby/object:Gem::Version
-  version: 2.2.1
+  version: 2.2.3
 platform: ruby
 authors:
 - Janko Marohnić