rodauth-rails 2.2.2 → 2.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cdc58b295a3bfe903d3b1f964a6f69ab6c407e798b237017d75a2a37556666b1
-  data.tar.gz: ce57a3dfcb02692b2c7e3b1257c74fc511097ab949913cc1447a7768e53635f3
+  metadata.gz: 1ee1baf96e7272819b654ff2ef0153dfc5ff8c8c09547e9b1db848f7daec7949
+  data.tar.gz: 58d00e15bde03f30862186d242f9928d17082bf800abf28528782ce492d6081c
 SHA512:
-  metadata.gz: 1e02cb7e4e3a4b206d2daccc16fa5ed390b6e9af4960eba745407483fa3d4b934ca291500e6c99aae35de628686c9704f97f0e24466530d0d2edd91f669441d7
-  data.tar.gz: c1cda4cb3be9fdaccea28f1a9b203b3197623f5744b9bfb9a0b806ecde0940adfe838ae4ae49c90f3fbb35821f0605aa0114cb17ec94709c07183e542d69fb6d
+  metadata.gz: 634d5ba134c9c0c5757ede2aa25a9700252e8026201be0a6694df46d74430b793b4e5272fe835a3ec07291b0ef61860f106f1738e40c6fec7e2552ea82d48dc8
+  data.tar.gz: 11d06b4d5564ccdb5b4016b5bb329e92b67877bab59f1ec541303ec31e79d5017780672c3269f0f314a761b6c47e38add64977556bbf4187baac152c80008f97

data/lib/generators/rodauth/templates/app/misc/rodauth_main.rb.tt

@@ -104,7 +104,7 @@ class RodauthMain < Rodauth::Rails::Auth
     # delete_account_on_close? true
 
     # Redirect to the app from login and registration pages if already logged in.
-    # already_logged_in { redirect login_redirect }
+    already_logged_in { redirect login_redirect }
 
 <% if defined?(ActionMailer) -%>
     # ==> Emails

data/lib/rodauth/rails/app.rb

@@ -5,6 +5,9 @@ module Rodauth
   module Rails
     # The superclass for creating a Rodauth middleware.
     class App < Roda
+      # matches Rodauth's default json_request_content_type_regexp
+      JSON_CONTENT_TYPE_REGEXP = /\Aapplication\/(?:vnd\.api\+)?json\b/i
+
       plugin :middleware, forward_response_headers: true, next_if_not_found: true
       plugin :hooks
       plugin :pass
@@ -20,6 +23,9 @@ module Rodauth
         # we'll render Rodauth's built-in view templates within Rails layouts
         plugin :render, layout: false unless render == false
 
+        # configure JSON parser before Rodauth loads it, to avoid Roda's warning
+        plugin :json_parser, content_type_regexp: JSON_CONTENT_TYPE_REGEXP if options.fetch(:json, true)
+
         plugin :rodauth, auth_class: auth_class, name: name, csrf: false, json: true, render: render, **options, &block
 
         # we need to do it after request methods from rodauth have been included
@@ -81,7 +87,7 @@ module Rodauth
         # The Rack input might not be rewindable, so ensure we parse the JSON
         # request body in Rails, and avoid parsing it again in Roda.
         def POST
-          if content_type =~ /json/
+          if content_type =~ JSON_CONTENT_TYPE_REGEXP
             env["roda.json_params"] = scope.rails_request.POST.to_hash
           end
           super

data/lib/rodauth/rails/feature/csrf.rb

@@ -51,6 +51,12 @@ module Rodauth
         # Calls the controller to verify the authenticity token.
         def rails_check_csrf!
           rails_controller_instance.send(:verify_authenticity_token)
+
+          # On Rails 8.2+, verify_authenticity_token only marks that forgery
+          # protection is enabled, while the actual check is performed here.
+          if rails_controller_instance.respond_to?(:verify_request_for_forgery_protection, true)
+            rails_controller_instance.send(:verify_request_for_forgery_protection)
+          end
         end
 
         # Hidden tag with Rails CSRF token inserted into Rodauth templates.

data/lib/rodauth/rails/version.rb

@@ -1,5 +1,5 @@
 module Rodauth
   module Rails
-    VERSION = "2.2.2"
+    VERSION = "2.2.3"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-rails
 version: !ruby/object:Gem::Version
-  version: 2.2.2
+  version: 2.2.3
 platform: ruby
 authors:
 - Janko Marohnić