rodauth 2.27.0 → 2.28.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eeb08d35b1a9cf7c0a5393bbcf831d41fa0ff1a9d822761ef63c149723d79db2
-  data.tar.gz: 8a890d1659b1a0634960420ab0546db1e76363dad7c43dc01a0b05dfe4cc85e3
+  metadata.gz: 15ed571757453e13ded3557bd2736779546b2c759230f8ee9070976a0207899e
+  data.tar.gz: 9aa5adf648fa1449a75a03d62ae4907f71d41adc49e81fde8da52097042c986c
 SHA512:
-  metadata.gz: 1e27b99b1fa245aab6c600257fc82fcae6789d31105047d06d39eae185064d08917359ba8eb631b94dcfa7aa6a05be77e700a8935070b8467bcac25bbd3e2cb1
-  data.tar.gz: 71bfbebd641cc594889fa4d82086a17b250388796990d24b8240acb6e668fe41b52f9b1727b4b8b49846cc13574b398da0ae7c4f092436d027a4719df96f0e75
+  metadata.gz: bdae4bbe3d9c471f967a8b24741504494a4003edce0c265dba9026694d64c08f61bd74cdbf80bded79e3b2c163fe7d273fcf72741f986711891fea5e481c501f
+  data.tar.gz: 5c6352c91b52012c6869a149e61887a1a6e0ace76557f2c4922eb699dc4da7f08a1265c5548bff25a3f617fa0a3b565b6d00f3472822d32812ae6261a4bcc95c

data/CHANGELOG

@@ -1,3 +1,13 @@
+=== 2.28.0 (2023-02-22)
+
+* Skip rendering reset password request form on invalid internal request logins (janko) (#303)
+
+* Make logged_in? return false if using verify_account_grace_period feature and grace_period has expired (janko) (#300)
+
+* Make password_hash method public (janko) (#299)
+
+* Add webauthn_key_insert_hash auth method to webauthn feature to control inserts into webauthn keys table (janko) (#298)
+
 === 2.27.0 (2023-01-24)
 
 * Rename webauth_credentials_for_get to webauthn_credentials_for_get for consistency (janko) (#295)

data/doc/guides/password_requirements.rdoc

@@ -1,13 +1,16 @@
 = Customize password requirements
 
 By default, Rodauth requires passwords to have at least 6 characters. You can
-modify the minimum length:
+modify the minimum and maximum length:
 
   plugin :rodauth do
     enable :login, :logout, :create_account
 
     # Require passwords to have at least 8 characters
     password_minimum_length 8
+
+    # Don't allow passwords to be too long, to prevent long password DoS attacks
+    password_maximum_length 64
   end
 
 You can use the {disallow common passwords feature}[rdoc-ref:doc/disallow_common_passwords.rdoc]
@@ -25,6 +28,16 @@ can use the <tt>password_meets_requirements?</tt> configuration method.
     enable :login, :logout, :create_account
 
     password_meets_requirements? do |password|
-      #true if password meets requirements, false otherwise
+      super(password) && password_complex_enough?(password)
+    end
+
+    auth_class_eval do
+      # If password doesn't pass custom validation, add field error with error
+      # reason, and return false.
+      def password_complex_enough?(password)
+        return true if password.match?(/\d/) && password.match?(/[^a-zA-Z\d]/)
+        set_password_requirement_error_message(:password_simple, "requires one number and one special character")
+        false
+      end
     end
   end

data/doc/json.rdoc

@@ -15,6 +15,14 @@ an array containing the field name and the error message for that field.
 Successful requests by default store a +success+ entry with a success
 message, though that can be disabled.
 
+The JSON response can be modified at any point by modifying the `json_response`
+hash. The following example adds an {error reason}[rdoc-ref:doc/error_reasons.rdoc]
+to the JSON response:
+
+  set_error_reason do |reason|
+    json_response[:error_reason] = reason
+  end
+
 The session state is managed in the rack session, so make sure that
 CSRF protection is enabled. This will be the case when passing the
 <tt>json: true</tt> option when loading the rodauth plugin. If you

data/doc/release_notes/2.28.0.txt

@@ -0,0 +1,16 @@
+= New Features
+
+* A webauthn_key_insert_hash configuration method has been added when
+  using the webauthn feature, making it easier to add new columns to
+  the webauthn key data, such as a custom name for the authenticator.
+
+= Other Improvements
+
+* When using the verify_account_grace_period feature, logged_in? now
+  returns false for sessions where the grace period has expired.
+
+* When using the internal_request and reset_password features,
+  submitting an internal request for an invalid login no longer tries
+  to render a reset password request form.
+
+* The password_hash method is now public.

data/doc/webauthn.rdoc

@@ -104,9 +104,10 @@ remove_all_webauthn_keys_and_user_ids :: Remove all WebAuthn credentials and the
 remove_webauthn_key(webauthn_id) :: Remove the WebAuthn credential with the given WebAuthn ID from the current account.
 valid_new_webauthn_credential?(webauthn_credential) :: Check wheck the WebAuthn credential provided by the client during registration is valid.
 valid_webauthn_credential_auth?(webauthn_credential) :: Check wheck the WebAuthn credential provided by the client during authentication is valid.
-webauthn_credential_options_for_get :: WebAuthn credential options to provide to the client during WebAuthn authentication.
 webauthn_auth_js_path :: The path to the WebAuthn authentication javascript.
 webauthn_auth_view :: The HTML to use for the page for authenticating via WebAuthn.
+webauthn_credential_options_for_get :: WebAuthn credential options to provide to the client during WebAuthn authentication.
+webauthn_key_insert_hash(webauthn_credential) :: The hash to insert into the +webauthn_keys_table+.
 webauthn_remove_authenticated_session :: Remove the authenticated WebAuthn ID, used when removing the WebAuthn credential with the ID after authenticating with it.
 webauthn_remove_view :: The HTML to use for the page for removing an existing WebAuthn authenticator.
 webauthn_setup_js_path :: The path to the WebAuthn registration javascript.

data/lib/rodauth/features/argon2.rb

@@ -15,6 +15,18 @@ module Rodauth
     auth_value_method :argon2_secret, nil
     auth_value_method :use_argon2?, true
 
+    def password_hash(password)
+      return super unless use_argon2?
+
+      if secret = argon2_secret
+        argon2_params = Hash[password_hash_cost]
+        argon2_params[:secret] = secret
+      else
+        argon2_params = password_hash_cost
+      end
+      ::Argon2::Password.new(argon2_params).create(password)
+    end
+
     private
 
     if Argon2::VERSION != '2.1.0'
@@ -34,18 +46,6 @@ module Rodauth
       argon2_hash_cost 
     end
 
-    def password_hash(password)
-      return super unless use_argon2?
-
-      if secret = argon2_secret
-        argon2_params = Hash[password_hash_cost]
-        argon2_params[:secret] = secret
-      else
-        argon2_params = password_hash_cost
-      end
-      ::Argon2::Password.new(argon2_params).create(password)
-    end
-
     def password_hash_match?(hash, password)
       return super unless argon2_hash_algorithm?(hash)
       argon2_password_hash_match?(hash, password)

data/lib/rodauth/features/login_password_requirements_base.rb

@@ -75,6 +75,10 @@ module Rodauth
       hash
     end
 
+    def password_hash(password)
+      BCrypt::Password.create(password, :cost=>password_hash_cost)
+    end
+
     private
     
     attr_reader :login_requirement_message
@@ -184,9 +188,5 @@ module Rodauth
     def extract_password_hash_cost(hash)
       hash[4, 2].to_i
     end
-    
-    def password_hash(password)
-      BCrypt::Password.create(password, :cost=>password_hash_cost)
-    end
   end
 end

data/lib/rodauth/features/password_pepper.rb

@@ -16,12 +16,12 @@ module Rodauth
       result
     end
 
-    private
-
     def password_hash(password)
       super(password + password_pepper.to_s)
     end
 
+    private
+
     def password_hash_match?(hash, password)
       return super if password_pepper.nil?
 

data/lib/rodauth/features/reset_password.rb

@@ -219,7 +219,7 @@ module Rodauth
     attr_reader :reset_password_key_value
 
     def after_login_failure
-      unless only_json?
+      unless only_json? || internal_request?
         @login_form_header = login_failed_reset_password_request_form
       end
       super

data/lib/rodauth/features/verify_account_grace_period.rb

@@ -30,6 +30,10 @@ module Rodauth
       false
     end
 
+    def logged_in?
+      super && !unverified_grace_period_expired?
+    end
+
     def require_login
       if unverified_grace_period_expired?
         clear_session

data/lib/rodauth/features/webauthn.rb

@@ -103,6 +103,7 @@ module Rodauth
       :valid_webauthn_credential_auth?,
       :webauthn_auth_js_path,
       :webauthn_credential_options_for_get,
+      :webauthn_key_insert_hash,
       :webauthn_remove_authenticated_session,
       :webauthn_setup_js_path,
       :webauthn_update_session,
@@ -348,12 +349,7 @@ module Rodauth
     end
 
     def add_webauthn_credential(webauthn_credential)
-      webauthn_keys_ds.insert(
-        webauthn_keys_account_id_column => webauthn_account_id,
-        webauthn_keys_webauthn_id_column => webauthn_credential.id,
-        webauthn_keys_public_key_column => webauthn_credential.public_key,
-        webauthn_keys_sign_count_column => Integer(webauthn_credential.sign_count)
-      )
+      webauthn_keys_ds.insert(webauthn_key_insert_hash(webauthn_credential))
       super if defined?(super)
       nil
     end
@@ -435,6 +431,15 @@ module Rodauth
       super
     end
 
+    def webauthn_key_insert_hash(webauthn_credential)
+      {
+        webauthn_keys_account_id_column => webauthn_account_id,
+        webauthn_keys_webauthn_id_column => webauthn_credential.id,
+        webauthn_keys_public_key_column => webauthn_credential.public_key,
+        webauthn_keys_sign_count_column => Integer(webauthn_credential.sign_count)
+      }
+    end
+
     def webauthn_account_id
       session_value
     end

data/lib/rodauth/version.rb

@@ -6,7 +6,7 @@ module Rodauth
   MAJOR = 2
 
   # The minor version of Rodauth, updated for new feature releases of Rodauth.
-  MINOR = 27
+  MINOR = 28
 
   # The patch version of Rodauth, updated only for bug fixes from the last
   # feature release.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth
 version: !ruby/object:Gem::Version
-  version: 2.27.0
+  version: 2.28.0
 platform: ruby
 authors:
 - Jeremy Evans
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-01-24 00:00:00.000000000 Z
+date: 2023-02-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sequel
@@ -343,6 +343,7 @@ extra_rdoc_files:
 - doc/release_notes/2.25.0.txt
 - doc/release_notes/2.26.0.txt
 - doc/release_notes/2.27.0.txt
+- doc/release_notes/2.28.0.txt
 - doc/release_notes/2.3.0.txt
 - doc/release_notes/2.4.0.txt
 - doc/release_notes/2.5.0.txt
@@ -457,6 +458,7 @@ files:
 - doc/release_notes/2.25.0.txt
 - doc/release_notes/2.26.0.txt
 - doc/release_notes/2.27.0.txt
+- doc/release_notes/2.28.0.txt
 - doc/release_notes/2.3.0.txt
 - doc/release_notes/2.4.0.txt
 - doc/release_notes/2.5.0.txt
@@ -614,7 +616,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.1
+rubygems_version: 3.4.6
 signing_key:
 specification_version: 4
 summary: Authentication and Account Management Framework for Rack Applications