rodauth-rails 0.17.0 → 0.17.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1539e5f70a8cefa3c40e06b5b177152e4772f099deb11a077f07f59529622a62
-  data.tar.gz: 67c9a6829f8a9c45708cb1ab0781a2eebe1998d5f31f66b26d5c7f58cb37cdf8
+  metadata.gz: 458a4a5552c124a1e7587837bbd57eed020857ae691bcc4b1f2e2639df774bb8
+  data.tar.gz: b19da17830585641950d026dff75ebd32ded19ad16dd5fb5c3b8a33c34b0a8f6
 SHA512:
-  metadata.gz: bf1f132504de2266dc4ef7f71ffdd630e348119f6681f84288aeb6ba24481336948c78183d4fa7e90100dedc85e04c4bb98f915de3ecf156630d523d91d74c00
-  data.tar.gz: e1858507c3ee9a2855e04fa67957859f41347adbf448793b8cebe263a0bd95517ef913b4132470a31609be9741ff73e4769309df5924f19b0db0503a1a25fa2a
+  metadata.gz: 01d5c774269d260e2805e0a2e4a509d9db81a3a966e94176cd6c5df6d808356feee48c5009b9692e0647034ae1c4d6ea3dc29627fa2000d05821a4402080601a
+  data.tar.gz: 1dde8d0ffb4605d3abf7893628a804eca7c0fbc94f2418176651dce81fac14eb4dfe1d165e315288a2a46373b818c795e15e9d58b5ad77f15b1fb5c3d9efc4be

data/CHANGELOG.md

@@ -1,3 +1,21 @@
+## 0.17.1 (2021-10-20)
+
+* Skip checking CSRF when request forgery protection wasn't loaded on the controller (@janko)
+
+* Create partial unique index for `accounts.email` column when using `sqlite3` adapter (@janko)
+
+* Revert setting `delete_account_on_close?` to `true` in generated `rodauth_app.rb` (@janko)
+
+* Disable Turbo in `_recovery_codes_form.html.erb`, since viewing recovery codes isn't Turbo-compatible (@janko)
+
+* Generate JSON configuration on `rodauth:install` for API-only with sessions enabled (@janko)
+
+* Generate JWT configuration on `rodauth:install` only for API-only apps without sessions enabled (@janko)
+
+* Don't generate JWT configuration when `rodauth:install --json` was run in API-only app (@janko)
+
+* Use `config.action_mailer.default_url_options` in path_class_methods feature (@janko)
+
 ## 0.17.0 (2021-10-05)
 
 * Set `delete_account_on_close?` to `true` in generated `rodauth_app.rb` (@janko)

data/lib/generators/rodauth/install_generator.rb

@@ -95,11 +95,11 @@ module Rodauth
         end
 
         def json?
-          options[:json]
+          options[:json] || api_only? && session_store? && !options[:jwt]
         end
 
         def jwt?
-          options[:jwt] || Rodauth::Rails.api_only?
+          options[:jwt] || api_only? && !session_store? && !options[:json]
         end
 
         def migration_features
@@ -107,6 +107,14 @@ module Rodauth
           features << :remember unless jwt?
           features
         end
+
+        def session_store?
+          !!::Rails.application.config.session_store
+        end
+
+        def api_only?
+          Rodauth::Rails.api_only?
+        end
       end
     end
   end

data/lib/generators/rodauth/migration/base.erb

@@ -5,11 +5,17 @@ enable_extension "citext"
 create_table :accounts<%= primary_key_type %> do |t|
 <% case activerecord_adapter -%>
 <% when "postgresql" -%>
-  t.citext :email, null: false, index: { unique: true, where: "status IN ('unverified', 'verified')" }
+  t.citext :email, null: false
 <% else -%>
-  t.string :email, null: false, index: { unique: true }
+  t.string :email, null: false
 <% end -%>
   t.string :status, null: false, default: "unverified"
+<% case activerecord_adapter -%>
+<% when "postgresql", "sqlite3" -%>
+  t.index :email, unique: true, where: "status IN ('unverified', 'verified')"
+<% else -%>
+  t.index :email, unique: true
+<% end -%>
 end
 
 # Used if storing password hashes in a separate table (default)

data/lib/generators/rodauth/templates/app/lib/rodauth_app.rb

@@ -52,7 +52,7 @@ class RodauthApp < Rodauth::Rails::App
     # reset_password_autologin? true
 
     # Delete the account record when the user has closed their account.
-    delete_account_on_close? true
+    # delete_account_on_close? true
 
     # Redirect to the app from login and registration pages if already logged in.
     # already_logged_in { redirect login_redirect }

data/lib/generators/rodauth/templates/app/views/rodauth/_recovery_codes_form.html.erb

@@ -1,4 +1,4 @@
-<%%= form_tag <%= rodauth %>.recovery_codes_path, method: :post do %>
+<%%= form_tag <%= rodauth %>.recovery_codes_path, method: :post, data: { turbo: false } do %>
   <%%= render "password_field" if <%= rodauth %>.two_factor_modifications_require_password? %>
   <%%= render "submit",
     value: <%= rodauth %>.recovery_codes_button || "View Authentication Recovery Codes",

data/lib/rodauth/rails/feature/csrf.rb

@@ -13,23 +13,23 @@ module Rodauth
 
         # Render Rails CSRF tags in Rodauth templates.
         def csrf_tag(*)
-          rails_csrf_tag
+          rails_csrf_tag if rails_controller_csrf?
         end
 
         # Verify Rails' authenticity token.
         def check_csrf
-          rails_check_csrf!
+          rails_check_csrf! if rails_controller_csrf?
         end
 
         # Have Rodauth call #check_csrf automatically.
         def check_csrf?
-          true
+          rails_check_csrf? if rails_controller_csrf?
         end
 
         private
 
         def rails_controller_callbacks
-          return super if rails_api_controller?
+          return super unless rails_controller_csrf?
 
           # don't verify CSRF token as part of callbacks, Rodauth will do that
           rails_controller_instance.allow_forgery_protection = false
@@ -40,6 +40,12 @@ module Rodauth
           end
         end
 
+        # Checks whether ActionController::RequestForgeryProtection is included
+        # and that protect_from_forgery was called.
+        def rails_check_csrf?
+          !!rails_controller_instance.forgery_protection_strategy
+        end
+
         # Calls the controller to verify the authenticity token.
         def rails_check_csrf!
           rails_controller_instance.send(:verify_authenticity_token)
@@ -59,6 +65,11 @@ module Rodauth
         def rails_csrf_token
           rails_controller_instance.send(:form_authenticity_token)
         end
+
+        # Checks whether ActionController::RequestForgeryProtection is included.
+        def rails_controller_csrf?
+          rails_controller.respond_to?(:protect_from_forgery)
+        end
       end
     end
   end

data/lib/rodauth/rails/feature/internal_request.rb

@@ -2,30 +2,20 @@ module Rodauth
   module Rails
     module Feature
       module InternalRequest
-        def post_configure
-          super
-          return unless internal_request?
-
-          self.class.define_singleton_method(:internal_request) do |route, opts = {}, &blk|
-            url_options = ::Rails.application.config.action_mailer.default_url_options || {}
+        def domain
+          return super unless missing_host?
 
-            scheme = url_options[:protocol]
-            port = url_options[:port]
-            port||= Rack::Request::DEFAULT_PORTS[scheme] if Rack.release < "2"
-            host = url_options[:host]
-            host_with_port = host && port ? "#{host}:#{port}" : host
+          Rodauth::Rails.url_options[:host]
+        end
 
-            env = {
-              "HTTP_HOST" => host_with_port,
-              "rack.url_scheme" => scheme,
-              "SERVER_NAME" => host,
-              "SERVER_PORT" => port,
-            }.compact
+        def base_url
+          return super unless missing_host? && domain
 
-            opts = opts.merge(env: env) { |k, v1, v2| v2.merge(v1) }
+          url_options = Rodauth::Rails.url_options
 
-            super(route, opts, &blk)
-          end
+          url = "#{url_options[:protocol]}://#{domain}"
+          url << ":#{url_options[:port]}" if url_options[:port]
+          url
         end
 
         private
@@ -44,6 +34,12 @@ module Rodauth
           return yield if internal_request?
           super
         end
+
+        # Checks whether we're in an internal request and host was not set,
+        # or the request doesn't exist such as with path_class_methods feature.
+        def missing_host?
+          internal_request? && request.host == INVALID_DOMAIN || scope.nil?
+        end
       end
     end
   end

data/lib/rodauth/rails/version.rb

@@ -1,5 +1,5 @@
 module Rodauth
   module Rails
-    VERSION = "0.17.0"
+    VERSION = "0.17.1"
   end
 end

data/lib/rodauth/rails.rb

@@ -79,6 +79,12 @@ module Rodauth
         end
       end
 
+      def url_options
+        options = ::Rails.application.config.action_mailer.default_url_options || {}
+        options[:protocol] ||= "http"
+        options
+      end
+
       def configure
         yield self
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-rails
 version: !ruby/object:Gem::Version
-  version: 0.17.0
+  version: 0.17.1
 platform: ruby
 authors:
 - Janko Marohnić
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-10-05 00:00:00.000000000 Z
+date: 2021-10-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties