rodauth 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 9f7b621217958c77c148ee85c271e7e39548b02f
-  data.tar.gz: f4fa75ad99266693763134533d5f7f0dc90de8ba
+  metadata.gz: 6ff15843042dfd35b89e9e6c76a54b571941248b
+  data.tar.gz: 04df40188862b7547b0f0ae7eb1cfb55aacbfd1a
 SHA512:
-  metadata.gz: 9ce46e8a0b1d1b5f5a2994d4ab3d70503fd5da9f968fa0dc1cbd938cd9ce2d327c8dd427fd09a4c8242b2dbdb8be4f428c40277008352021c91b97ad438689fb
-  data.tar.gz: 6535d95d9d3573f5c7190b990d448f983757d674a4df73662de2567ca197fcc63867773a86a4f3617edc26c4a2cd54f3bb741ba3153f503a8f69094c8a89a3d3
+  metadata.gz: ec10b0e76411b3512ca463700e29659a5fb258e13ecde5be57d906e133e40cb9a2760e9d4ffca1e3fe0ed6a1911336449373abfcb58200d112ff341aa3372185
+  data.tar.gz: 05327fbf88823044fa475f3cfe48ec417532882f02fd320533ecdaac548a65ca7544db8e6f0298218e2f8ffbd53d1291e7fb386f01adbf6de0cb82da2cd467d7

data/CHANGELOG

@@ -1,4 +1,8 @@
-=== HEAD
+=== 1.1.0 (2016-05-13)
+
+* Support :csrf=>false and :flash=>false plugin options (jeremyevans)
+
+=== 1.0.0 (2016-04-15)
 
 * Remove invalid remember cookies to prevent unnecessary future database checks (jeremyevans)
 

data/README.rdoc

@@ -645,6 +645,63 @@ inside a matching routing tree branch:
     # ...
   end
 
+=== +rodauth+ Methods
+
+Most of Rodauth's functionality is exposed via +r.rodauth+, which allows
+Rodauth to handle routes for the features you have enabled (such as +/login+
+for login).  However, as you have seen above, you may want to call methods on
+the +rodauth+ object, such as for checking if the current request has been
+authenticated.
+
+Here are methods designed to be callable on the +rodauth+ object outside
++r.rodauth+:
+
+require_login :: Require the session be logged in, redirecting the request to the
+                 login page if the request has not been logged in.
+require_authentication :: Similar to +require_login+, but also requires
+                          two factor authentication if the account has setup
+                          two factor authentication.  Redirects the request to
+                          the two factor authentication page if logged in but not
+                          authenticated via two factors.
+logged_in? :: Whether the session has been logged in.
+authenticated? :: Similar to +logged_in?+, but if the account has setup two
+                  factor authentication, whether the session has authenticated
+                  via two factors.
+require_two_factor_setup :: (two_factor_base feature) Require the session to have
+                            setup two factor authentication, redirecting the
+                            request to the two factor authentication setup page
+                            if not.
+uses_two_factor_authentication? :: (two_factor_base feature) Whether the account
+                                   for the current session has setup two factor
+                                   authentication.
+update_last_activity :: (account_expiration feature) Update the last activity
+                        time for the current account.  Only makes sense to use
+                        this if you are expiring accounts based on last activity.
+require_current_password :: (password_expiration feature) Require a current
+                            password, redirecting the request to the change
+                            password page if the password for the account has
+                            expired.
+load_memory :: (remember feature) If the session has not been authenticated, look
+               for the remember cookie.  If present and valid, automatically
+               log the session in, but mark that it was logged in via a remember
+               key.
+logged_in_via_remember_key? :: (remember feature) Whether the current session has
+                               been logged in via a remember key.  For security
+                               sensitive actions where you want to require the user
+                               to reenter the password, you can use the
+                               confirm_password feature.
+check_session_expiration :: (session_expiration feature) Check whether the current
+                            session has expired, automatically logging the session
+                            out if so.
+check_single_session :: (single_session expiration) Check whether the current
+                        session is still the only valid session, automatically logging
+                        the session out if not.
+verified_account? :: (verify_grace_period extension) Whether the account is currently
+                     verified.  If false, it is because the account is allowed to
+                     login as they are in the grace period.
+locked_out? :: (lockout feature) Whether the account for the current session has been
+               locked out.
+
 === With Multiple Configurations
 
 Rodauth supports using multiple rodauth configurations in the same
@@ -757,8 +814,8 @@ Rodauth:
 
     route do |r|
       r.rodauth
-      env['rodauth'] = rodauth
       rodauth.require_authentication
+      env['rodauth'] = rodauth
     end
   end
 
@@ -779,6 +836,11 @@ For an example of integrating Rodauth into a real application that
 doesn't use Roda, see
 {this example integrating Rodauth into Ginatra, a Sinatra-based git repository viewer}[https://github.com/jeremyevans/ginatra/commit/28108ebec96e8d42596ee55b01c3f7b50c155dd1].
 
+To see an example of integrating Rodauth into a Rails application, see
+{this example porting Rodauth's demo site to Rails}[https://github.com/jeremyevans/rodauth-demo-rails].
+This uses the {roda-rails gem}[https://github.com/jeremyevans/roda-rails]
+so that Rodauth uses Rails' CSRF and flash support.
+
 === Using 2 Factor Authentication
 
 Rodauth ships with 2 factor authentication support via TOTP (Time-Based

data/doc/release_notes/1.1.0.txt

@@ -0,0 +1,8 @@
+= New Features
+
+* The rodauth plugin now supports :csrf=>false and :flash=>false
+  options. This will make it so it no longer depends on the csrf
+  or flash plugins, which is useful when the csrf and flash
+  functionality is provided via a different approach, such as
+  when rodauth is being used inside middleware in a Rails
+  application with the roda-rails library.

data/lib/rodauth.rb

@@ -12,8 +12,8 @@ module Rodauth
     unless opts[:json] == :only
       require 'tilt/string'
       app.plugin :render
-      app.plugin :csrf
-      app.plugin :flash
+      app.plugin :csrf unless opts[:csrf] == false
+      app.plugin :flash unless opts[:flash] == false
       app.plugin :h
     end
   end

data/lib/rodauth/version.rb

@@ -1,7 +1,7 @@
 # frozen-string-literal: true
 
 module Rodauth
-  VERSION = '1.0.0'.freeze
+  VERSION = '1.1.0'.freeze
 
   def self.version
     VERSION

data/spec/rodauth_spec.rb

@@ -188,4 +188,11 @@ describe 'Rodauth' do
     login
     page.body.must_equal 'email id'
   end
+
+  it "should support :csrf=>false and :flash=>false plugin options" do
+    rodauth{}
+    roda(:csrf=>false, :flash=>false){}
+    app.instance_variable_get(:@middleware).length.must_equal 1
+    app.ancestors.map(&:to_s).wont_include 'Roda::RodaPlugins::Flash::InstanceMethods'
+  end
 end

data/spec/spec_helper.rb

@@ -89,7 +89,7 @@ class Minitest::HooksSpec
     jwt = type == :jwt
     app = Class.new(jwt ? JsonBase : Base)
     rodauth_block = @rodauth_block
-    opts = {}
+    opts = type.is_a?(Hash) ? type : {}
     opts[:json] = :only if jwt
     app.plugin(:rodauth, opts) do
       title_instance_variable :@title

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Jeremy Evans
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-04-15 00:00:00.000000000 Z
+date: 2016-05-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sequel
@@ -225,6 +225,7 @@ extra_rdoc_files:
 - doc/confirm_password.rdoc
 - doc/verify_change_login.rdoc
 - doc/release_notes/1.0.0.txt
+- doc/release_notes/1.1.0.txt
 files:
 - CHANGELOG
 - MIT-LICENSE
@@ -250,6 +251,7 @@ files:
 - doc/password_grace_period.rdoc
 - doc/recovery_codes.rdoc
 - doc/release_notes/1.0.0.txt
+- doc/release_notes/1.1.0.txt
 - doc/remember.rdoc
 - doc/reset_password.rdoc
 - doc/session_expiration.rdoc