rodauth-tools 0.3.1 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d6b7dce9af93d884748ed19771aff8061295da616488cde6b1d8cd22025f2165
-  data.tar.gz: b57d1b4d34dc706eb55e2184fee7fced8e7f789037527a5952ce22bfffc3b1ab
+  metadata.gz: 39d6a88fc0c69fd330a7ad5fbcce20eef2d1069fc317f9e21d28ef286cbea4d8
+  data.tar.gz: 30511219eb536cb7d135706866ba497c5f66b89c124baeeab9f2726021c8eeb1
 SHA512:
-  metadata.gz: 9988d318c4ef84a8f350e81ab831ebbeac83072e15a3f76d4bd63a0a297e37ca45af73bfcb65efaab5a1220b719e9fc52e03ca27df4d92f32ede407a87a7c023
-  data.tar.gz: 45c670a15937b958cdb4c39b50672f6b5de179405777a288fb4893f1f987ad8baee54f88e5ef833541b11d83139bf6230a39aaa2a1afffe951fb29512e311020
+  metadata.gz: f33049dc3a878378dc0752173c4bbbf3ce66e278947d5e809a86eff788b78b1f58f556d8a77bb1d90c0395557d43bb8b9fdf2c739ab6e4acd906df523dbc1076
+  data.tar.gz: 7a7cff39a3a3ca2eed50a16e5daad470d1e39425f1214d81270fe308a253b24e0e15a1b31c7e1a08f84aab38df3c2a049f3a3480e5040353adc83e0cf72fbf78

data/.rubocop.yml

@@ -11,6 +11,10 @@ AllCops:
   NewCops: enable
   SuggestExtensions: false
 
+Style/OneClassPerFile:
+  Exclude:
+    - 'examples/**/*'
+
 Style/StringLiterals:
   EnforcedStyle: single_quotes
 

data/.rubocop_todo.yml

@@ -49,7 +49,7 @@ Metrics/AbcSize:
 # Configuration parameters: CountComments, CountAsOne, AllowedMethods, AllowedPatterns, inherit_mode.
 # AllowedMethods: refine
 Metrics/BlockLength:
-  Max: 509
+  Max: 532
 
 # Offense count: 1
 # Configuration parameters: CountComments, CountAsOne.
@@ -64,12 +64,12 @@ Metrics/CyclomaticComplexity:
 # Offense count: 41
 # Configuration parameters: CountComments, CountAsOne, AllowedMethods, AllowedPatterns.
 Metrics/MethodLength:
-  Max: 64
+  Max: 69
 
 # Offense count: 3
 # Configuration parameters: CountComments, CountAsOne.
 Metrics/ModuleLength:
-  Max: 511
+  Max: 534
 
 # Offense count: 10
 # Configuration parameters: AllowedMethods, AllowedPatterns.
@@ -108,6 +108,8 @@ RSpec/DescribeClass:
     - '**/spec/views/**/*'
     - 'spec/rodauth/features/external_identity/external_identity_spec.rb'
     - 'spec/rodauth/features/external_identity_autocreate_integration_spec.rb'
+    - 'spec/rodauth/features/secret_guard_combined_spec.rb'
+    - 'spec/rodauth/features/table_guard/table_guard_destructive_modes_spec.rb'
     - 'spec/rodauth/features/table_guard/table_guard_integration_spec.rb'
     - 'spec/rodauth/features/table_guard/table_guard_simple_spec.rb'
     - 'spec/rodauth/features/table_guard/table_guard_spec.rb'
@@ -154,6 +156,7 @@ Style/Documentation:
   Exclude:
     - 'spec/**/*'
     - 'test/**/*'
+    - 'lib/rodauth/features/account_id_obfuscation.rb'
     - 'lib/rodauth/features/external_identity.rb'
     - 'lib/rodauth/features/hmac_secret_guard.rb'
     - 'lib/rodauth/features/jwt_secret_guard.rb'
@@ -204,6 +207,8 @@ Style/SafeNavigation:
     - 'spec/rodauth/features/external_identity_autocreate_integration_spec.rb'
     - 'spec/rodauth/features/hmac_secret_guard/hmac_secret_guard_spec.rb'
     - 'spec/rodauth/features/jwt_secret_guard/jwt_secret_guard_spec.rb'
+    - 'spec/rodauth/features/secret_guard_combined_spec.rb'
+    - 'spec/rodauth/features/table_guard/table_guard_destructive_modes_spec.rb'
     - 'spec/rodauth/features/table_guard/table_guard_simple_spec.rb'
 
 # Offense count: 1
@@ -231,6 +236,8 @@ Style/SymbolProc:
     - 'spec/rodauth/features/external_identity_autocreate_integration_spec.rb'
     - 'spec/rodauth/features/hmac_secret_guard/hmac_secret_guard_spec.rb'
     - 'spec/rodauth/features/jwt_secret_guard/jwt_secret_guard_spec.rb'
+    - 'spec/rodauth/features/secret_guard_combined_spec.rb'
+    - 'spec/rodauth/features/table_guard/table_guard_destructive_modes_spec.rb'
     - 'spec/rodauth/features/table_guard/table_guard_integration_spec.rb'
     - 'spec/rodauth/features/table_guard/table_guard_simple_spec.rb'
     - 'try/features/external_identity_try.rb'

data/AGENTS.md

@@ -0,0 +1,317 @@
+# AGENTS.md
+
+This file provides guidance to coding agents working in this repository.
+
+## Project Purpose
+
+Framework-agnostic utilities for Rodauth authentication:
+
+1. **External Rodauth Features** - `table_guard` for database validation, `external_identity` for external service IDs, `hmac_secret_guard` for HMAC secret validation, `jwt_secret_guard` for JWT secret validation, `account_id_obfuscation` for hiding numeric account ids in email links and cookies
+2. **Sequel Migration Generator** - Generate migrations for 19 Rodauth features
+
+**Not a framework adapter.** For Rails integration, use rodauth-rails. This project demonstrates Rodauth's extensibility and provides reference implementations.
+
+**Status:** Experimental. The gemspec says it plainly — "experimental stuff that may come and go" — so treat the API as unstable. It *is* published to RubyGems (`rodauth-tools`), and at least one production app depends on it, so a breaking change is a real cost to someone: bump the version and write the CHANGELOG entry.
+
+**Namespace history (2025-10):** Namespace changed from `Rodauth::Rack::Generators::Migration` to `Rodauth::Tools::Migration`. This reflects the project's evolution away from being a Rack adapter toward being a collection of framework-agnostic utilities. The migration generator is now deprecated in favor of the `table_guard` feature with `sequel_mode`.
+
+## Development Commands
+
+```bash
+# Run all tests
+bundle exec rspec        # or: bundle exec rake
+
+# Tryouts suite (documentation-style tests; auto-discovers try/, NOT run by CI)
+bundle exec try
+
+# Lint (config in .rubocop.yml, with .rubocop_todo.yml exclusions)
+bundle exec rubocop lib/ spec/
+
+# Interactive console with helpers
+bin/console
+```
+
+## Architecture Overview
+
+### Core Components
+
+**lib/rodauth/features/table_guard.rb** - External Rodauth feature
+
+- Uses `Rodauth::Feature.define(:table_guard, :TableGuard)` pattern
+- Validates database tables exist for enabled features at `post_configure` time
+- Provides introspection methods: `missing_tables`, `table_status`, `list_all_required_tables`
+- Configurable modes: `:warn`, `:error`, `:silent`, or custom block handler
+- Demonstrates proper feature lifecycle hooks and configuration DSL
+
+**lib/rodauth/features/external_identity.rb** - External Rodauth feature
+
+- Uses `Rodauth::Feature.define(:external_identity, :ExternalIdentity)` pattern
+- Declares `accounts` columns holding IDs from external services (`external_identity_column :stripe_customer_id`) and generates a reader per column
+- Layer 1 is the bare column plus conflict policy (`external_identity_on_conflict`: `:error`, `:warn`, `:skip`) and column presence checking (`external_identity_check_columns`: `true`, `false`, `:autocreate`)
+- Layer 2 hangs lifecycle callables off the same declaration: `before_create_account`, `formatter`, `validator`, `verifier`, `handshake`
+- Introspection: `external_identity_column_list`, `external_identity_column_config`, `external_identity_status`
+
+**lib/rodauth/features/hmac_secret_guard.rb** - External Rodauth feature
+
+- Uses `Rodauth::Feature.define(:hmac_secret_guard, :HmacSecretGuard)` pattern
+- Automatically loads HMAC secret from environment variable (defaults to `HMAC_SECRET`)
+- Validates secret is configured at application startup via `post_configure` hook
+- Production mode: Raises `ConfigurationError` if secret missing, blank, or (when `minimum_secret_length` is set) too short
+- Development mode: Logs warning and uses a fallback secret (random per-process by default)
+- Deletes secret from ENV after loading for security (strips whitespace; blank values treated as absent)
+- Provides `production?`, `validate_hmac_secret!`, and (aliased) `validate_secrets!` public methods
+
+**lib/rodauth/features/jwt_secret_guard.rb** - External Rodauth feature
+
+- Uses `Rodauth::Feature.define(:jwt_secret_guard, :JwtSecretGuard)` pattern
+- Automatically loads JWT secret from environment variable (defaults to `JWT_SECRET`)
+- Validates secret is configured at application startup via `post_configure` hook
+- Production mode: Raises `ConfigurationError` if secret missing, blank, or (when `minimum_secret_length` is set) too short
+- Development mode: Logs warning and uses a fallback secret (random per-process by default)
+- Deletes secret from ENV after loading for security (strips whitespace; blank values treated as absent)
+- Provides `production?`, `validate_jwt_secret!`, and (aliased) `validate_secrets!` public methods
+- Defines `jwt_secret` configuration method for standalone use
+
+**lib/rodauth/features/account_id_obfuscation.rb** - External Rodauth feature
+
+- Uses `Rodauth::Feature.define(:account_id_obfuscation, :AccountIdObfuscation)` pattern
+- Obfuscates `account_id` in email-link tokens and the remember cookie via scoped `token_param_value`/`account_from_key` (and conditional `_set_/_get_remember_cookie`) overrides
+- Never touches the global `split_token`/`convert_token_id`, so `jwt_refresh` and other token consumers are unaffected
+- Loads a dedicated `ACCOUNT_ID_SECRET` like the secret guards; `production?`/`validate_secrets!` lifecycle
+- Non-digit version tag makes legacy-vs-obfuscated deterministic and drives config-driven secret rotation
+- Delegates the crypto to the standalone `Rodauth::Tools::AccountIdCipher`
+
+**lib/rodauth/tools/account_id_cipher.rb** - Framework-agnostic utility
+
+- Keyed format-preserving obfuscation of a 64-bit integer id (4-round Feistel network, HMAC-SHA256 round function)
+- Pure `Integer <-> 13-char Crockford Base32` bijection; stdlib `openssl` only, independently testable
+- `decode` returns `nil` on malformed input so callers can pass legacy/foreign values through
+
+**lib/rodauth/secret_guard.rb** - Shared support module (`Rodauth::SecretGuard`)
+
+- Kind-parameterized (`:hmac`/`:jwt`) logic behind both secret-guard features
+- Plain module functions taking the Rodauth instance explicitly — no mixed-in
+  method names, so both guards can be enabled together without one shadowing the
+  other (each feature's `post_configure` validates its own secret via `kind`)
+- Handles ENV loading (`load_from_env!`), validation (`validate!`), blank/whitespace
+  detection, production detection, and minimum-length enforcement
+
+**lib/rodauth/table_inspector.rb** - Shared support module (`Rodauth::TableInspector`)
+
+- Discovers the tables an enabled feature set requires by inspecting a live Rodauth instance, rather than from a static table
+- `discover_tables(rodauth)` returns `{ accounts_table: "accounts", ... }`; `table_information(rodauth)` adds the owning feature and column list per table
+- This is what backs `table_guard`'s `_table_configuration`, so it is the source of the `*_table` method enumeration described under Hidden Tables below
+
+**lib/rodauth/tools/migration.rb** - Sequel migration generator
+
+- Generates database migrations for 19 Rodauth features
+- Uses ERB templates in `lib/rodauth/tools/migration/sequel/`
+- Provides `generate()` for migration content and `migration_name()` for filename
+- Uses dry-inflector gem for robust table name pluralization
+- Mock database adapter pattern when no real DB connection provided
+- Deprecated in favor of table_guard feature with sequel_mode
+
+### How Rodauth Features Work
+
+Rodauth features are modules that mix into `Rodauth::Auth` instances:
+
+```ruby
+Feature.define(:feature_name, :FeatureName) do
+  # Configuration methods (overridable by users)
+  auth_value_method :setting_name, 'default_value'
+
+  # Public methods (overridable by users)
+  auth_methods :public_method
+
+  # Private methods (not overridable)
+  auth_private_methods :internal_helper
+
+  # Lifecycle hook - runs after configuration
+  def post_configure
+    super if defined?(super)
+    # Initialization code
+  end
+end
+```
+
+**Key Pattern:** Methods defined in features become part of the Rodauth instance. Users override them in configuration blocks:
+
+```ruby
+plugin :rodauth do
+  enable :feature_name
+
+  setting_name 'custom_value'  # Override auth_value_method
+
+  public_method do             # Override auth_methods
+    # Custom implementation
+  end
+end
+```
+
+### Table Guard Implementation Details
+
+**Existence Checks (no logger suppression):** The `table_exists?` method matches names against the database's table/view list (`db.tables` + `db.views`) rather than probing each table with a SELECT. An earlier implementation used Sequel's `table_exists?` probe and suppressed the logger around it (clearing/restoring the shared `db.loggers` array) to hide the "no such table" ERROR that Sequel logs before catching internally — but that mutation of shared connection state was not thread-safe. Listing names avoids the failed probe entirely, so no logger suppression (and no shared-state mutation) is needed. Schema-qualified identifiers (a `Sequel::SQL::QualifiedIdentifier` or a `:schema__table` Symbol) are not present in the unqualified list, so they take a separate schema-aware `db.table_exists?` probe path.
+
+**Cached-Method Backing Visibility:** `auth_cached_method :foo` registers `foo` via `auth_private_methods`, so the backing `_foo` must be defined **private**. Rodauth 2.45.0 audits this at feature-definition time with `private_method_defined?` and warns (`RODAUTH3: raise instead of warn`) when it isn't — a publicly-defined `_foo` trips the audit even though it exists. `_table_configuration` and `_column_requirements` therefore live below the feature's `private` keyword, alongside the equivalent backing methods in `account_id_obfuscation` and `external_identity`.
+
+`spec/rodauth/feature_configuration_spec.rb` holds the line. Two things about it are load-bearing, so preserve them when editing:
+
+- It **derives** its feature list from `lib/rodauth/features/*.rb` and requires each file. A hardcoded list would leave a new feature silently uncovered — and the require is what makes the audit run at all, since rodauth audits inside `Feature.define` and never sees a feature nothing loaded.
+- Per feature it **re-runs rodauth's own** `def_configuration_methods` with stderr captured and asserts silence, as well as mirroring what that method checks. The re-run cannot drift as upstream tightens the audit and honours `allowed_undefined_configuration_methods` (rodauth's opt-out) for free; the mirrored checks are what name the offending method when it fails.
+
+**Configuration Storage:** Uses instance variables set by `auth_value_method`:
+
+- Block configs stored as Procs in `@table_guard_mode`
+- Symbol configs stored directly as `:warn`, `:error`, `:silent`
+
+**Check Strategy:**
+
+1. `should_check_tables?` examines `@table_guard_mode` to decide if checking is needed
+2. Returns `true` if mode is a Proc (block), enabling custom handlers
+3. Returns `true` if mode is `:warn` or `:error`, `false` for `:silent`
+
+**Execution Flow:**
+
+1. `post_configure` hook calls `check_required_tables!` if `should_check_tables?` returns true
+2. `check_required_tables!` gets missing tables via `missing_tables`
+3. For symbol modes (`:warn`, `:error`), handles directly
+4. For block modes, calls block with missing tables, handles return value (`:error`, `:continue`, String)
+
+**Introspection Methods:**
+
+- `all_table_methods` - Finds all methods ending in `_table` using Ruby reflection
+- `missing_tables` - Checks each required table against the existing table/view name set (fetched once per pass to avoid an N+1 of catalog queries)
+- `table_status` - Returns array of hashes with method, table name, and existence status
+
+### Migration Generator Architecture
+
+**Note:** The Migration class is deprecated. For new code, use the `table_guard` feature with `sequel_mode` instead.
+
+**Template System:**
+
+- Each feature has ERB template in `lib/rodauth/tools/migration/sequel/`
+- Templates use binding from Migration instance for variables like `table_prefix`
+- `generate()` loads, evaluates, and concatenates all feature templates
+
+**Pluralization:**
+
+- Uses `dry-inflector` gem for intelligent pluralization (e.g., "status" → "statuses")
+- Helper method `pluralize(str)` available in templates via ERB binding
+- Removed Rails/ActiveRecord dependencies (68 lines of cruft eliminated)
+
+**Database Adapter Pattern:**
+
+- `MockSequelDatabase` simulates database when no real connection provided
+- Allows template generation without active database
+- Real `Sequel::Database` object can be passed for actual migrations
+- Supports PostgreSQL, MySQL, and SQLite database types
+
+### Hidden Tables Architecture
+
+**Problem:** Some tables are created in ERB templates without corresponding `*_table` methods in Rodauth features.
+
+**Example from base.erb:**
+
+```ruby
+# base.erb creates THREE tables:
+create_table(:account_statuses)        # NO METHOD - Hidden!
+create_table(:account_password_hashes) # NO METHOD - Hidden!
+create_table(:accounts)                # Has accounts_table method ✓
+```
+
+**Why This Happens:**
+
+- `account_statuses` - Lookup table for status values (Unverified=1, Verified=2, Closed=3). No method because users configure status IDs directly via `account_open_status_value`, etc.
+- `account_password_hashes` - Separate table for security. Method is `account_password_hash_table` (singular), but ERB uses pluralized form based on `table_prefix`.
+
+#### Solution: TemplateInspector Module
+
+`lib/rodauth/template_inspector.rb` extracts table names directly from ERB templates by:
+
+1. Creating minimal binding context with `table_prefix`, `pluralize`, and mock `db`
+2. Evaluating ERB templates to render actual Ruby code
+3. Parsing rendered code for `create_table()` calls using regex
+4. Returning complete list of tables, including hidden ones
+
+**Usage:**
+
+```ruby
+# Extract all tables for a feature
+tables = TemplateInspector.extract_tables_from_template(
+  :base,
+  table_prefix: 'account'
+)
+# => [:account_statuses, :account_password_hashes, :accounts]
+
+# Get tables for multiple features
+all_tables = TemplateInspector.all_tables_for_features(
+  [:base, :verify_account, :lockout],
+  table_prefix: 'account'
+)
+```
+
+**Impact on DROP Operations:**
+
+Before TemplateInspector, `generate_drop_statements` only dropped dynamically discovered tables, missing hidden ones. Now it extracts the complete table list from ERB templates, ensuring all tables are properly dropped in correct dependency order.
+
+**Key Insight:** ERB templates are the single source of truth for table schemas. By extracting information FROM templates instead of duplicating it in Ruby constants, we maintain consistency and eliminate hardcoded mappings.
+
+## Testing Patterns
+
+**RSpec Structure:**
+
+- `spec/spec_helper.rb` - Minimal configuration; requires `rodauth/tools` and `rack/test`. It does **not** require `hmac_secret_guard` or `jwt_secret_guard` — those feature files are not loaded by `rodauth/tools`, so a spec that needs them must require them itself
+- Feature specs test both behavior and configuration
+- Migration generator specs verify template output and configuration
+- `spec/rodauth/feature_configuration_spec.rb` - Guards every feature against rodauth's definition-time audit (see Cached-Method Backing Visibility above)
+
+**Tryouts:** `try/features/*_try.rb` holds documentation-style tests, run separately from RSpec (`bundle exec try`). Only `external_identity` has one today. CI runs `bundle exec rake`, whose default task is `spec` alone — so **tryouts is not gated**, and it has drifted red: 5 of 50 fail as of 0.4.1. Don't read a red tryouts run as damage you just caused; check against the base branch first.
+
+**Console Helpers:**
+
+- `setup_test_db` - Creates in-memory SQLite database with tables
+- `create_app(db, features: [...])` - Creates Roda app with Rodauth configured
+- Useful for interactive testing of table_guard and migration generator
+
+## Documentation Reference
+
+**docs/rodauth-features-api.md** - Complete reference for feature development DSL methods
+
+**docs/rodauth-integration.md** - Integrating Rodauth into a Rack app, and where this library fits
+
+**docs/sequel-migrations.md** - Migration generator usage
+
+**docs/rodauth-mail.md** - Email/SMTP configuration patterns
+
+**docs/unresolved-bugs.md** - Known defects with analysis, not yet fixed. Read before "fixing" something surprising — it may already be written up here, with the reasoning for why it was left alone
+
+**docs/features/** and **docs/examples/** - Per-feature documentation and runnable examples
+
+Rodauth's own object model (`Rodauth::Auth`, `Rodauth::Configuration`, `Rodauth::Feature`, `Rodauth::FeatureConfiguration`) is documented upstream in `doc/guides/internals.rdoc` in the rodauth gem.
+
+## Integration Pattern
+
+Rodauth integrates with any Rack app via Roda middleware (NOT via this library):
+
+```ruby
+# Create Roda app with Rodauth
+class RodauthApp < Roda
+  plugin :middleware
+  plugin :rodauth do
+    enable :login, :logout
+    enable :table_guard  # ← Feature from this library
+    db DB
+  end
+
+  route do |r|
+    r.rodauth
+    env['rodauth'] = rodauth
+  end
+end
+
+# Mount as Rack middleware
+use RodauthApp
+run MyApp
+```
+
+Access in your app: `request.env['rodauth']` provides all authentication methods.

data/CHANGELOG.md

@@ -5,6 +5,59 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.1] - 2026-08-10
+
+### Fixed
+
+- **`table_guard`: silence rodauth 2.45.0 feature-definition warnings.**
+  `_table_configuration` and `_column_requirements` — the backing methods behind
+  the `table_configuration` / `column_requirements` `auth_cached_method`
+  declarations — were defined publicly. Rodauth registers those via
+  `auth_private_methods` and, as of 2.45.0, audits each backing method with
+  `private_method_defined?` at feature-definition time, so loading the feature
+  printed two `"Bug in Rodauth table_guard feature definition..."` warnings on
+  stderr. Both methods moved into the feature's `private` section (matching
+  `account_id_obfuscation` and `external_identity`). Upstream marks the warning
+  `RODAUTH3: raise instead of warn`, so this would have become a load-time error.
+  Added `spec/rodauth/feature_configuration_spec.rb`, which mirrors rodauth's
+  audit across all five features so a regression fails the suite.
+
+### Added
+
+- **Feature-definition audit coverage** (`spec/rodauth/feature_configuration_spec.rb`).
+  The feature list is derived from `lib/rodauth/features/*.rb` rather than
+  hand-maintained, so a newly added feature is covered as soon as its file lands
+  — and requiring those files is what makes the audit run at all, since rodauth
+  audits inside `Feature.define` and never sees a feature nothing requires.
+  Alongside the mirrored checks, each feature re-runs rodauth's own
+  `def_configuration_methods` with stderr captured and asserts it is silent, so
+  the coverage cannot drift as upstream tightens the audit and honours
+  `allowed_undefined_configuration_methods` (2.45.0's opt-out) without
+  reimplementing it.
+
+## [0.4.0] - 2026-07-05
+
+### Added
+
+- **Account ID Obfuscation feature** (`account_id_obfuscation`) - Keyed, reversible
+  obfuscation of the numeric `account_id` that leaks into email-link tokens (e.g.
+  `/verify-account?key=2_...`) and the remember-me cookie, with no database schema
+  change. Wraps the two `email_base` chokepoints (`token_param_value` /
+  `account_from_key`), so a single `enable` covers verify_account, reset_password,
+  email_auth, verify_login_change and lockout/unlock; also obfuscates the remember
+  cookie when `remember` is enabled. Loads a dedicated `ACCOUNT_ID_SECRET` following
+  the `hmac_secret_guard` pattern. Backward compatible with in-flight numeric links
+  and legacy cookies, with config-driven secret rotation via a version tag.
+- **`Rodauth::Tools::AccountIdCipher`** - Framework-agnostic 4-round Feistel
+  format-preserving encryption utility (stdlib `openssl` only, no new dependencies).
+
+## [0.3.1] - 2026-01-13
+
+### Changed
+
+- Dependency and development-tooling maintenance (bundled `rodauth`, `sequel`,
+  `rubocop`, and related updates).
+
 ## [0.3.0] - 2025-11-25
 
 ### Added
@@ -76,6 +129,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Namespace changed from `Rodauth::Rack::Generators::Migration` to `Rodauth::Tools::Migration`
 - Evolution from Rack adapter to framework-agnostic utilities
 
+[0.4.1]: https://github.com/delano/rodauth-tools/compare/v0.4.0...v0.4.1
+[0.4.0]: https://github.com/delano/rodauth-tools/compare/v0.3.1...v0.4.0
+[0.3.1]: https://github.com/delano/rodauth-tools/compare/v0.3.0...v0.3.1
 [0.3.0]: https://github.com/delano/rodauth-tools/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/delano/rodauth-tools/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/delano/rodauth-tools/releases/tag/v0.1.0

data/Gemfile

@@ -8,12 +8,12 @@ gemspec
 
 gem 'dry-inflector'
 gem 'irb'
-gem 'rake', '~> 13.3'
+gem 'rake', '~> 13.4'
 
 group :development do
   gem 'bundler-audit'
   gem 'rspec', '~> 3.0'
-  gem 'rubocop', '~> 1.81'
+  gem 'rubocop', '~> 1.88'
   gem 'rubocop-rake'
   gem 'rubocop-rspec'
 end
@@ -21,14 +21,14 @@ end
 group :test do
   gem 'bcrypt', '~> 3.1'
   gem 'capybara'
-  gem 'jwt', '~> 3.1'
+  gem 'jwt', '~> 3.2'
   gem 'rack-test', '~> 2.1'
   gem 'rails', '>= 6.0'
   gem 'rotp'
   gem 'rqrcode'
   gem 'sequel-activerecord_connection', '~> 2.0'
-  gem 'sqlite3', '~> 2.8'
-  gem 'tilt', '~> 2.4'
+  gem 'sqlite3', '~> 2.9'
+  gem 'tilt', '~> 2.8'
   gem 'tryouts', '~> 3.0'
   gem 'warning'
   gem 'webauthn' unless RUBY_ENGINE == 'jruby'