rodauth 1.18.0 → 1.19.0

data/doc/reset_password.rdoc

@@ -8,73 +8,53 @@ the login feature.
 
 == Auth Value Methods
 
-no_matching_reset_password_key_message :: The flash error message to show if attempting
-                                          to access the reset password form with an
-                                          invalid key.
-reset_password_additional_form_tags :: HTML fragment containing additional form
-                                       tags to use on the reset password form.
-reset_password_autologin? :: Whether to autologin the user after successfully
-                             resetting a password.
+no_matching_reset_password_key_message :: The flash error message to show if attempting to access the reset password form with an invalid key.
+reset_password_additional_form_tags :: HTML fragment containing additional form tags to use on the reset password form.
+reset_password_autologin? :: Whether to autologin the user after successfully resetting a password.
 reset_password_button :: The text to use for the reset password button.
-reset_password_deadline_column :: The column name in the reset password keys table storing
-                                  the deadline after which the token will be ignored.
-reset_password_deadline_interval :: The amount of time for which to allow users to
-                                    reset their passwords, 1 day by default. Only used if
-                                    set_deadline_values? is true.
-reset_password_email_sent_notice_flash :: The flash notice to show after a reset
-                                          password email has been sent.
-reset_password_email_sent_redirect :: Where to redirect after sending a reset
-                                      password email.
+reset_password_deadline_column :: The column name in the reset password keys table storing the deadline after which the token will be ignored.
+reset_password_deadline_interval :: The amount of time for which to allow users to reset their passwords, 1 day by default. Only used if set_deadline_values? is true.
+reset_password_email_recently_sent_error_flash :: The flash error to show if not sending reset password email because one has been sent recently.
+reset_password_email_recently_sent_redirect :: Where to redirect if not sending reset password email because one has been sent recently.
+reset_password_email_sent_notice_flash :: The flash notice to show after a reset password email has been sent.
+reset_password_email_sent_redirect :: Where to redirect after sending a reset password email.
 reset_password_email_subject :: The subject to use for reset password emails.
 reset_password_error_flash :: The flash error to show after resetting a password.
-reset_password_id_column :: The id column in the reset password keys table, should
-                            be a foreign key referencing the accounts table.
-reset_password_key_column :: The reset password key/token column in the reset
-                             password keys table.
+reset_password_email_last_sent_column :: The email last sent column in the reset password keys table.  nil by default, so a reset password email is always sent when requested by default.
+reset_password_id_column :: The id column in the reset password keys table, should be a foreign key referencing the accounts table.
+reset_password_key_column :: The reset password key/token column in the reset password keys table.
 reset_password_key_param :: The parameter name to use for the reset password key.
 reset_password_redirect :: Where to redirect after resetting a password.
-reset_password_request_additional_form_tags :: HTML fragment containing additional form
-                                               tags to use on the reset password request
-                                               form.
+reset_password_request_additional_form_tags :: HTML fragment containing additional form tags to use on the reset password request form.
 reset_password_request_button :: The text to use for the reset password request button.
-reset_password_request_error_flash :: The flash error to show if not able to send a reset
-                                      password email.
-reset_password_request_link :: The HTML to use for a link to the page to request a password
-                               reset.
-reset_password_request_route :: The route to the reset password request action.
-                                Defaults to +reset-password-request+.
-reset_password_route :: The route to the reset password action. Defaults to
-                        +reset-password+.
+reset_password_request_error_flash :: The flash error to show if not able to send a reset password email.
+reset_password_request_link :: The HTML to use for a link to the page to request a password reset.
+reset_password_request_route :: The route to the reset password request action.  Defaults to +reset-password-request+.
+reset_password_route :: The route to the reset password action. Defaults to +reset-password+.
 reset_password_session_key :: The key in the session to hold the reset password key temporarily.
+reset_password_skip_resend_email_within :: The number of seconds before sending another reset password email, if +reset_password_email_last_sent_column+ is set.
 reset_password_table :: The name of the reset password keys table.
 
 == Auth Methods
 
-account_from_reset_password_key(key) :: Retrieve the account using the given reset
-                                        password key, or return nil if no account
-                                        matches.
+account_from_reset_password_key(key) :: Retrieve the account using the given reset password key, or return nil if no account matches.
 after_reset_password :: Run arbitrary code after successfully resetting a password.
-after_reset_password_request :: Run arbitrary code after sending the reset password
-                                email.
+after_reset_password_request :: Run arbitrary code after sending the reset password email.
 before_reset_password :: Run arbitrary code before resetting a password.
-before_reset_password_request :: Run arbitrary code before sending the reset password
-                                 email.
+before_reset_password_request :: Run arbitrary code before sending the reset password email.
+before_reset_password_request_route :: Run arbitrary code before handling a reset password request route.
 before_reset_password_route :: Run arbitrary code before handling a reset password route.
 create_reset_password_key :: Add the reset password key data to the database.
 create_reset_password_email :: A Mail::Message for the reset password email.
-get_reset_password_key(id) :: Get the password reset key for the given account id
-                              from the database.
-login_failed_reset_password_request_form :: The HTML to use for a form to request a password
-                                            reset, shown on the login page after the user
-                                            tries to login with an invalid password.
-remove_reset_password_key :: Remove the reset password key for the current account,
-                             run after successful password reset.
+get_reset_password_email_last_sent :: Get the last time a reset password email is sent, or nil if there is no last sent time.
+get_reset_password_key(id) :: Get the password reset key for the given account id from the database.
+login_failed_reset_password_request_form :: The HTML to use for a form to request a password reset, shown on the login page after the user tries to login with an invalid password.
+remove_reset_password_key :: Remove the reset password key for the current account, run after successful password reset.
 reset_password_email_body :: The body to use for the reset password email.
-reset_password_email_link :: The link to the reset password form in the reset
-                             password email.
-reset_password_key_insert_hash :: The hash to insert into the reset password keys
-                                  table.
+reset_password_email_link :: The link to the reset password form in the reset password email.
+reset_password_key_insert_hash :: The hash to insert into the reset password keys table.
 reset_password_key_value :: The reset password key for the current account.
 reset_password_request_view :: The HTML to use for the reset password request form.
 reset_password_view :: The HTML to use for the reset password form.
 send_reset_password_email :: Send the reset password email.
+set_reset_password_email_last_sent :: Set the last time a reset password email is sent.

data/doc/verify_account.rdoc

@@ -7,76 +7,56 @@ after verifying the account. Depends on the login and create account features.
 
 == Auth Value Methods
 
-attempt_to_create_unverified_account_notice_message :: Message displayed when attempting to
-                                                       create an account awaiting verification.
-attempt_to_login_to_unverified_account_notice_message :: Message displayed when attempting to
-                                                         login to an account awaiting verification.
-no_matching_verify_account_key_message :: The flash error message to show when
-                                          an invalid verify account key is used.
-verify_account_additional_form_tags :: HTML fragment containing additional form
-                                       tags to use on the verify account form.
-verify_account_autologin? :: Whether to autologin the user after successful
-                             account verification, true by default.
+attempt_to_create_unverified_account_notice_message :: Message displayed when attempting to create an account awaiting verification.
+attempt_to_login_to_unverified_account_notice_message :: Message displayed when attempting to login to an account awaiting verification.
+no_matching_verify_account_key_message :: The flash error message to show when an invalid verify account key is used.
+verify_account_additional_form_tags :: HTML fragment containing additional form tags to use on the verify account form.
+verify_account_autologin? :: Whether to autologin the user after successful account verification, true by default.
 verify_account_button :: The text to use for the verify account button.
+verify_account_email_recently_sent_error_flash :: The flash error to show if not sending verify account email because one has been sent recently.
+verify_account_email_recently_sent_redirect :: Where to redirect if not sending verify account email because one has been sent recently.
 verify_account_email_subject :: The subject to use for the verify account email.
-verify_account_email_sent_redirect :: Where to redirect after sending the verify
-                                      account email.
-verify_account_email_sent_notice_flash :: The flash notice to set after sending
-                                          the verify account email.
-verify_account_error_flash :: The flash error to show if no matching key is submitted
-                              when verifying an account.
-verify_account_id_column :: The id column in the verify account keys table, should
-                            be a foreign key referencing the accounts table.
-verify_account_key_column :: The verify account key/token column in the verify
-                             account keys table.
+verify_account_email_sent_redirect :: Where to redirect after sending the verify account email.
+verify_account_email_sent_notice_flash :: The flash notice to set after sending the verify account email.
+verify_account_email_last_sent_column :: The email last sent column in the verify account keys table.  nil by default, so a verify account email is always sent when requested by default.
+verify_account_error_flash :: The flash error to show if no matching key is submitted when verifying an account.
+verify_account_id_column :: The id column in the verify account keys table, should be a foreign key referencing the accounts table.
+verify_account_key_column :: The verify account key/token column in the verify account keys table.
 verify_account_key_param :: The parameter name to use for the verify account key.
 verify_account_notice_flash :: The flash notice to show after verifying the account.
-verify_account_resend_additional_form_tags :: HTML fragment containing additional form
-                                              tags to use on the page requesting
-                                              resending the verify account email.
+verify_account_resend_additional_form_tags :: HTML fragment containing additional form tags to use on the page requesting resending the verify account email.
 verify_account_resend_button :: The text to use for the verify account resend button.
 verify_account_redirect :: Where to redirect after verifying the account.
-verify_account_resend_error_flash :: The flash error to show if unable to resend a
-                                     verify account email.
-verify_account_resend_link :: The HTML to use for a link to the page to request
-                              the account verification email be resent.
-verify_account_resend_route :: The route to the verify account resend action.
-                               Defaults to +verify-account-resend+.
-verify_account_route :: The route to the verify account action. Defaults to
-                        +verify-account+.
+verify_account_resend_error_flash :: The flash error to show if unable to resend a verify account email.
+verify_account_resend_link :: The HTML to use for a link to the page to request the account verification email be resent.
+verify_account_resend_route :: The route to the verify account resend action.  Defaults to +verify-account-resend+.
+verify_account_route :: The route to the verify account action. Defaults to +verify-account+.
 verify_account_session_key :: The key in the session to hold the verify account key temporarily.
-verify_account_set_password? :: Whether to ask for a password to be set on the verify account
-                                form.  Defaults to false.  If set to true, will automatically
-                                stop asking for passwords to be set on the create account form.
+verify_account_set_password? :: Whether to ask for a password to be set on the verify account form.  Defaults to false.  If set to true, will automatically stop asking for passwords to be set on the create account form.
+verify_account_skip_resend_email_within :: The number of seconds before sending another verify account email, if +verify_account_email_last_sent_column+ is set.
 verify_account_table :: The name of the verify account keys table.
 
 == Auth Methods
 
-account_from_verify_account_key(key) :: Retrieve the account using the given verify
-                                        account key, or return nil if no account
-                                        matches.
+account_from_verify_account_key(key) :: Retrieve the account using the given verify account key, or return nil if no account matches.
 after_verify_account :: Run arbitrary code after verifying the account.
 after_verify_account_resend :: Run arbitrary code after resending a verify account email.
-allow_resending_verify_account_email? :: Whether to allow sending the verify account email
-                                         for the account, true by default only if the
-                                         account has not been verified.
+allow_resending_verify_account_email? :: Whether to allow sending the verify account email for the account, true by default only if the account has not been verified.
 before_verify_account :: Run arbitrary code before verifying the account.
 before_verify_account_resend :: Run arbitrary code before resending a verify account email.
+before_verify_account_resend_route :: Run arbitrary code before handling a verify account resend route.
 before_verify_account_route :: Run arbitrary code before handling a verify account route.
 create_verify_account_key :: Add the verify account key data to the database.
 create_verify_account_email :: A Mail::Message for the verify account email.
-get_verify_account_key(id) :: Get the verify account key for the given account id
-                              from the database.
-remove_verify_account_key :: Remove the verify account key for the current account,
-                             run after successful account verification.
-resend_verify_account_view :: The HTML to use for page requesting resending the
-                              verify account email.
+get_verify_account_email_last_sent :: Get the last time a verify account email is sent, or nil if there is no last sent time.
+get_verify_account_key(id) :: Get the verify account key for the given account id from the database.
+remove_verify_account_key :: Remove the verify account key for the current account, run after successful account verification.
+resend_verify_account_view :: The HTML to use for page requesting resending the verify account email.
 send_verify_account_email :: Send the verify account email.
+set_verify_account_email_last_sent :: Set the last time a verify account email is sent.
 verify_account :: Verify the account by changing the status from unverified to open.
 verify_account_email_body :: The body to use for the verify account email.
-verify_account_email_link :: The link to the verify account form in the verify
-                             account email.
-verify_account_key_insert_hash :: The hash to insert into the verify account keys
-                                  table.
+verify_account_email_link :: The link to the verify account form in the verify account email.
+verify_account_key_insert_hash :: The hash to insert into the verify account keys table.
 verify_account_key_value :: The value of the verify account key.
 verify_account_view :: The HTML to use for the verify account form.

data/doc/verify_login_change.rdoc

@@ -19,6 +19,8 @@ verify_login_change_autologin? :: Whether to autologin the user after successful
 verify_login_change_button :: The text to use for the verify login change button.
 verify_login_change_deadline_column :: The column name in the verify login change keys table storing the deadline after which the token will be ignored.
 verify_login_change_deadline_interval :: The amount of time for which to allow users to verify login changes, 1 day by default.
+verify_login_change_duplicate_account_error_flash :: The flash error message to show when attempting to verify a login change when the login is already taken.
+verify_login_change_duplicate_account_redirect :: Where to redirect if not changing a login during verification because the new login is already taken.
 verify_login_change_email_subject :: The subject to use for the verify login change email.
 verify_login_change_error_flash :: The flash error to show if no matching key is submitted when verifying login change.
 verify_login_change_id_column :: The id column in the verify login change keys table, should be a foreign key referencing the accounts table.
@@ -35,7 +37,9 @@ verify_login_change_table :: The name of the verify login change keys table.
 
 account_from_verify_login_change_key(key) :: Retrieve the account using the given verify account key, or return nil if no account matches.  Should also override verify_login_change_new_login if overriding this method.
 after_verify_login_change :: Run arbitrary code after verifying the login change.
+after_verify_login_change_email :: Run arbitrary code after sending verify login change email.
 before_verify_login_change :: Run arbitrary code before verifying the login change.
+before_verify_login_change_email :: Run arbitrary code before sending verify login change email.
 before_verify_login_change_route :: Run arbitrary code before handling a verify login change route.
 create_verify_login_change_email(login) :: A Mail::Message for the verify login change email.
 create_verify_login_change_key(login) :: Add the verify login change key data to the database.

data/lib/rodauth/features/base.rb

@@ -52,7 +52,6 @@ module Rodauth
 
     auth_value_methods(
       :db,
-      :require_login_redirect,
       :set_deadline_values?,
       :use_date_arithmetic?,
       :use_database_authentication_functions?,

data/lib/rodauth/features/change_login.rb

@@ -74,6 +74,10 @@ module Rodauth
     private
 
     def update_login(login)
+      _update_login(login)
+    end
+
+    def _update_login(login)
       updated = nil
       raised = raises_uniqueness_violation?{updated = update_account({login_column=>login}, account_ds.exclude(login_column=>login)) == 1}
       if raised

data/lib/rodauth/features/disallow_common_passwords.rb

@@ -4,7 +4,7 @@ module Rodauth
   Feature.define(:disallow_common_passwords, :DisallowCommonPasswords) do
     depends :login_password_requirements_base
 
-    auth_value_method :most_common_passwords_file, File.join(File.dirname(File.dirname(File.dirname(File.dirname(File.expand_path(__FILE__))))), 'dict', 'top-10_000-passwords.txt')
+    auth_value_method :most_common_passwords_file, File.expand_path('../../../../dict/top-10_000-passwords.txt', __FILE__)
     auth_value_method :password_is_one_of_the_most_common_message, "is one of the most common passwords"
     auth_value_method :most_common_passwords, nil
 

data/lib/rodauth/features/email_auth.rb

@@ -0,0 +1,253 @@
+# frozen-string-literal: true
+
+module Rodauth
+  Feature.define(:email_auth, :EmailAuth) do
+    depends :login, :email_base
+
+    notice_flash "An email has been sent to you with a link to login to your account", 'email_auth_email_sent'
+    error_flash "There was an error logging you in"
+    error_flash "There was an error requesting an email link to authenticate", 'email_auth_request'
+    error_flash "An email has recently been sent to you with a link to login", 'email_auth_email_recently_sent'
+    loaded_templates %w'email-auth email-auth-request-form email-auth-email'
+
+    view 'email-auth', 'Login'
+    additional_form_tags
+    additional_form_tags 'email_auth_request'
+    before 'email_auth_request'
+    after 'email_auth_request'
+    button 'Send Login Link Via Email', 'email_auth_request'
+    redirect(:email_auth_email_sent){default_post_email_redirect}
+    redirect(:email_auth_email_recently_sent){default_post_email_redirect}
+    
+    auth_value_method :email_auth_deadline_column, :deadline
+    auth_value_method :email_auth_deadline_interval, {:days=>1}
+    auth_value_method :email_auth_email_subject, 'Login Link'
+    auth_value_method :email_auth_id_column, :id
+    auth_value_method :email_auth_key_column, :key
+    auth_value_method :email_auth_key_param, 'key'
+    auth_value_method :email_auth_email_last_sent_column, :email_last_sent
+    auth_value_method :email_auth_skip_resend_email_within, 300
+    auth_value_method :email_auth_table, :account_email_auth_keys
+    auth_value_method :no_matching_email_auth_key_message, "invalid email authentication key"
+    session_key :email_auth_session_key, :email_auth_key
+
+    auth_value_methods :force_email_auth?
+    
+    auth_methods(
+      :create_email_auth_email,
+      :create_email_auth_key,
+      :email_auth_email_body,
+      :email_auth_email_link,
+      :email_auth_key_insert_hash,
+      :email_auth_key_value,
+      :email_auth_request_form,
+      :get_email_auth_key,
+      :get_email_auth_email_last_sent,
+      :remove_email_auth_key,
+      :send_email_auth_email,
+      :set_email_auth_email_last_sent
+    )
+
+    auth_private_methods :account_from_email_auth_key
+
+    route(:email_auth_request) do |r|
+      check_already_logged_in
+      before_email_auth_request_route
+
+      r.post do
+        if account_from_login(param(login_param)) && open_account?
+          _email_auth_request
+        else
+          set_redirect_error_status(no_matching_login_error_status)
+          set_redirect_error_flash email_auth_request_error_flash
+        end
+
+        redirect email_auth_email_sent_redirect
+      end
+    end
+
+    route do |r|
+      check_already_logged_in
+      before_email_auth_route
+
+      r.get do
+        if key = param_or_nil(email_auth_key_param)
+          session[email_auth_session_key] = key
+          redirect(r.path)
+        end
+
+        if key = session[email_auth_session_key]
+          if account_from_email_auth_key(key)
+            email_auth_view
+          else
+            session[email_auth_session_key] = nil
+            set_redirect_error_flash no_matching_email_auth_key_message
+            redirect require_login_redirect
+          end
+        end
+      end
+
+      r.post do
+        key = session[email_auth_session_key] || param(email_auth_key_param)
+        unless account_from_email_auth_key(key)
+          set_redirect_error_status(invalid_key_error_status)
+          set_redirect_error_flash email_auth_error_flash
+          redirect email_auth_email_sent_redirect
+        end
+
+        _login
+      end
+    end
+
+    def create_email_auth_key
+      transaction do
+        if email_auth_key_value = get_email_auth_key(account_id)
+          set_email_auth_email_last_sent
+          @email_auth_key_value = email_auth_key_value
+        elsif e = raised_uniqueness_violation{email_auth_ds.insert(email_auth_key_insert_hash)}
+          # If inserting into the email auth table causes a violation, we can pull the 
+          # existing email auth key from the table, or reraise.
+          raise e unless @email_auth_key_value = get_email_auth_key(account_id)
+        end
+      end
+    end
+
+    def set_email_auth_email_last_sent
+       email_auth_ds.update(email_auth_email_last_sent_column=>Sequel::CURRENT_TIMESTAMP) if email_auth_email_last_sent_column
+    end
+
+    def get_email_auth_email_last_sent
+      if column = email_auth_email_last_sent_column
+        if ts = email_auth_ds.get(column)
+          convert_timestamp(ts)
+        end
+      end
+    end
+
+    def remove_email_auth_key
+      email_auth_ds.delete
+    end
+
+    def account_from_email_auth_key(key)
+      @account = _account_from_email_auth_key(key)
+    end
+
+    def send_email_auth_email
+      create_email_auth_email.deliver!
+    end
+
+    def email_auth_email_link
+      token_link(email_auth_route, email_auth_key_param, email_auth_key_value)
+    end
+
+    def get_email_auth_key(id)
+      ds = email_auth_ds(id)
+      ds.where(Sequel::CURRENT_TIMESTAMP > email_auth_deadline_column).delete
+      ds.get(email_auth_key_column)
+    end
+
+    def login_form_footer
+      footer = super
+      footer += @email_auth_request_form if @email_auth_request_form
+      footer
+    end
+
+    def email_auth_request_form
+      render('email-auth-request-form')
+    end
+
+    def after_login_entered_during_multi_phase_login
+      if force_email_auth?
+        # If the account does not have a password hash, just send the
+        # email link.
+        _email_auth_request
+        redirect email_auth_email_sent_redirect
+      else
+        # If the account has a password hash, allow password login, but
+        # show form below to also login via email link.
+        super
+        @email_auth_request_form = email_auth_request_form
+      end
+    end
+
+    def use_multi_phase_login?
+      true
+    end
+
+    def force_email_auth?
+      get_password_hash.nil?
+    end
+
+    private
+
+    def email_auth_email_recently_sent?
+      (email_last_sent = get_email_auth_email_last_sent) && (Time.now - email_last_sent < email_auth_skip_resend_email_within)
+    end
+
+    def _email_auth_request
+      if email_auth_email_recently_sent?
+        set_redirect_error_flash email_auth_email_recently_sent_error_flash
+        redirect email_auth_email_recently_sent_redirect
+      end
+
+      generate_email_auth_key_value
+      transaction do
+        before_email_auth_request
+        create_email_auth_key
+        send_email_auth_email
+        after_email_auth_request
+      end
+
+      set_notice_flash email_auth_email_sent_notice_flash
+    end
+
+    attr_reader :email_auth_key_value
+
+    def after_login
+      # Remove the email auth key after any login, even if
+      # it is a password login.  This is done to invalidate
+      # the email login when a user has a password and requests
+      # email authentication, but then remembers their password
+      # and doesn't need the link.  At that point, the link
+      # that allows login access to the account becomes a
+      # security liability, and it is best to remove it.
+      remove_email_auth_key
+      super if defined?(super)
+    end
+
+    def after_close_account
+      remove_email_auth_key
+      super if defined?(super)
+    end
+
+    def generate_email_auth_key_value
+      @email_auth_key_value = random_key
+    end
+
+    def create_email_auth_email
+      create_email(email_auth_email_subject, email_auth_email_body)
+    end
+
+    def email_auth_email_body
+      render('email-auth-email')
+    end
+
+    def use_date_arithmetic?
+      super || db.database_type == :mysql
+    end
+
+    def email_auth_key_insert_hash
+      hash = {email_auth_id_column=>account_id, email_auth_key_column=>email_auth_key_value}
+      set_deadline_value(hash, email_auth_deadline_column, email_auth_deadline_interval)
+      hash
+    end
+
+    def email_auth_ds(id=account_id)
+      db[email_auth_table].where(email_auth_id_column=>id)
+    end
+
+    def _account_from_email_auth_key(token)
+      account_from_key(token, account_open_status_value){|id| get_email_auth_key(id)}
+    end
+  end
+end