rodauth 2.37.0 → 2.39.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8c4f8a9edcebe8714dfa15132986c74e12e1823837ab71230008c42df9c2432d
-  data.tar.gz: f5cb984675323f2c2b83bd1d7be0626f511381b69e090c1d39bfb7b31d09321d
+  metadata.gz: 3b8c2b404f5a8fad1607ba2bfd64ec4e03579a909ea324a0c9cda7705d9e79f7
+  data.tar.gz: bb2e8dcf2c4afa1d855379b69845c6d5efff8e097b5e95b38a11948c8d381d5d
 SHA512:
-  metadata.gz: 3cdaaafebe4a7dba8b985dd1fbf39087a95fb3a49150e67487024e9374c50da6eced618ef702bfb70fbc483f83f9c29dba873d07bac2b4c1ec442007f3556f61
-  data.tar.gz: 8774b5ae4c7e430f76705857bd0e80a59a0171c60b9693581ee7eae7c07a1c300b89c38c7d7f660cf01e48e6c2190597449eec4cadf57cd38c08cbe8a2783886
+  metadata.gz: 4316cb199e760aaa144e7c1b154f974f514abdea83b5a18d4f85dd01ff64a9d8c030fd028cee8c27c00d3402a951571b3ae1379ca7ef8653c991df47035ef5c7
+  data.tar.gz: 0f1fa083577edf23a8db579ab5df5c9ef0d6087c97a7d2cea2c1ef7071049e495d3f374f5657194db4d6feef2252bb708f85af3a1a66e7f116185406db488984

data/lib/rodauth/features/base.rb

@@ -67,6 +67,7 @@ module Rodauth
     auth_value_method :unopen_account_error_status, 403
     translatable_method :unverified_account_message, "unverified account, please verify account before logging in"
     auth_value_method :default_field_attributes, ''
+    auth_value_method :use_template_fixed_locals?, true
 
     redirect(:require_login){"#{prefix}/login"}
 
@@ -409,6 +410,7 @@ module Rodauth
 
     def button_opts(value, opts)
       opts = Hash[template_opts].merge!(opts)
+      _merge_fixed_locals_opts(opts, button_fixed_locals)
       opts[:locals] = {:value=>value, :opts=>opts}
       opts[:cache] = cache_templates
       opts[:cache_key] = :rodauth_button
@@ -542,6 +544,12 @@ module Rodauth
       has_password? ? ['password'] : []
     end
 
+    def has_password?
+      return @has_password if defined?(@has_password)
+      return false unless account || session_value
+      @has_password = !!get_password_hash
+    end
+
     private
 
     def _around_rodauth
@@ -555,6 +563,56 @@ module Rodauth
       s
     end
 
+    if Rack.release >= '3'
+      def set_response_header(key, value)
+        response.headers[key] = value
+      end
+
+      def convert_response_header_key(key)
+        key
+      end
+    # :nocov:
+    else
+      def set_response_header(key, value)
+        response.headers[convert_response_header_key(key)] = value
+      end
+
+      # Attempt backwards compatibility on Rack < 3 by changing
+      # known cases from lower case to mixed case.
+      mixed_case_headers = {}
+      (<<-END).split.each { |k| mixed_case_headers[k.downcase.freeze] = k.freeze }
+        Access-Control-Allow-Headers
+        Access-Control-Allow-Methods
+        Access-Control-Allow-Origin
+        Access-Control-Expose-Headers
+        Access-Control-Max-Age
+        Allow
+        Authorization
+        Content-Type
+        Content-Length
+        WWW-Authenticate
+      END
+      mixed_case_headers.freeze
+      define_method(:convert_response_header_key) do |key|
+        mixed_case_headers.fetch(key, key)
+      end
+    end
+    # :nocov:
+
+    if RUBY_VERSION >= '2.1'
+      def button_fixed_locals
+        '(value:, opts:)'
+      end
+    # :nocov:
+    else
+      # Work on Ruby 2.0 when using Tilt 2.6+, as Ruby 2.0 does
+      # not support required keyword arguments.
+      def button_fixed_locals
+        '(value: nil, opts: nil)'
+      end
+    end
+    # :nocov:
+
     def database_function_password_match?(name, hash_id, password, salt)
       db.get(Sequel.function(function_name(name), hash_id, password_hash_using_salt(password, salt)))
     end
@@ -718,12 +776,6 @@ module Rodauth
       end
     end
 
-    def has_password?
-      return @has_password if defined?(@has_password)
-      return false unless account || session_value
-      @has_password = !!get_password_hash
-    end
-
     def password_hash_using_salt(password, salt)
       BCrypt::Engine.hash_secret(password, salt)
     end
@@ -766,7 +818,7 @@ module Rodauth
     end
 
     def compute_raw_hmac(data)
-      raise ArgumentError, "hmac_secret not set" unless hmac_secret
+      raise ConfigurationError, "hmac_secret not set" unless hmac_secret
       compute_raw_hmac_with_secret(data, hmac_secret)
     end
 
@@ -885,7 +937,7 @@ module Rodauth
 
     def require_response(meth)
       send(meth)
-      raise RuntimeError, "#{meth.to_s.sub(/\A_/, '')} overridden without returning a response (should use redirect or request.halt). This is a bug in your Rodauth configuration, not a bug in Rodauth itself."
+      raise ConfigurationError, "#{meth.to_s.sub(/\A_/, '')} overridden without returning a response (should use redirect or request.halt)."
     end
 
     def set_session_value(key, value)
@@ -912,6 +964,7 @@ module Rodauth
 
     def _view_opts(page)
       opts = template_opts.dup
+      _merge_fixed_locals_opts(opts, '(rodauth: self.rodauth)')
       opts[:locals] = opts[:locals] ? opts[:locals].dup : {}
       opts[:locals][:rodauth] = self
       opts[:cache] = cache_templates
@@ -919,6 +972,14 @@ module Rodauth
       _template_opts(opts, page)
     end
 
+    def _merge_fixed_locals_opts(opts, fixed_locals)
+      if use_template_fixed_locals? && !opts[:locals]
+        fixed_locals_opts = {default_fixed_locals: fixed_locals}
+        fixed_locals_opts.merge!(opts[:template_opts]) if opts[:template_opts]
+        opts[:template_opts] = fixed_locals_opts
+      end
+    end
+
     # Set the template path only if there isn't an overridden template in the application.
     # Result should replace existing template opts.
     def _template_opts(opts, page)
@@ -930,6 +991,10 @@ module Rodauth
     end
 
     def _view(meth, page)
+      unless scope.respond_to?(meth)
+        raise ConfigurationError, "attempted to render a built-in view/email template (#{page.inspect}), but rendering is disabled"
+      end
+
       scope.send(meth, _view_opts(page))
     end
   end

data/lib/rodauth/features/email_auth.rb

@@ -163,6 +163,10 @@ module Rodauth
       methods
     end
 
+    def email_auth_email_recently_sent?
+      (email_last_sent = get_email_auth_email_last_sent) && (Time.now - email_last_sent < email_auth_skip_resend_email_within)
+    end
+
     private
 
     def _multi_phase_login_forms
@@ -171,10 +175,6 @@ module Rodauth
       forms
     end
 
-    def email_auth_email_recently_sent?
-      (email_last_sent = get_email_auth_email_last_sent) && (Time.now - email_last_sent < email_auth_skip_resend_email_within)
-    end
-
     def _email_auth_request
       if email_auth_email_recently_sent?
         set_redirect_error_flash email_auth_email_recently_sent_error_flash

data/lib/rodauth/features/http_basic_auth.rb

@@ -73,7 +73,7 @@ module Rodauth
 
     def set_http_basic_auth_error_response
       response.status = 401
-      response.headers["WWW-Authenticate"] = "Basic realm=\"#{http_basic_auth_realm}\""
+      set_response_header("www-authenticate", "Basic realm=\"#{http_basic_auth_realm}\"")
     end
 
     def throw_basic_auth_error(*args)

data/lib/rodauth/features/json.rb

@@ -186,7 +186,7 @@ module Rodauth
 
         unless request.post?
           response.status = 405
-          response.headers['Allow'] = 'POST'
+          set_response_header('allow', 'POST')
           json_response[json_response_error_key] = json_non_post_error_message
           return_json_response
         end
@@ -209,7 +209,7 @@ module Rodauth
 
     def _return_json_response
       response.status ||= json_response_error_status if json_response_error?
-      response['Content-Type'] ||= json_response_content_type
+      response.headers[convert_response_header_key('content-type')] ||= json_response_content_type
       return_response _json_response_body(json_response)
     end
 

data/lib/rodauth/features/jwt.rb

@@ -47,7 +47,7 @@ module Rodauth
 
         if session_data
           if jwt_symbolize_deeply?
-            s = JSON.parse(JSON.fast_generate(session_data), :symbolize_names=>true)
+            s = JSON.parse(JSON.generate(session_data), :symbolize_names=>true)
           elsif scope.opts[:sessions_convert_symbols]
             s = session_data
           else
@@ -64,7 +64,7 @@ module Rodauth
     end
 
     def jwt_secret
-      raise ArgumentError, "jwt_secret not set"
+      raise ConfigurationError, "jwt_secret not set"
     end
 
     def jwt_session_hash
@@ -84,7 +84,7 @@ module Rodauth
     end
 
     def set_jwt_token(token)
-      response.headers['Authorization'] = token
+      set_response_header('authorization', token)
     end
 
     def use_jwt?
@@ -105,7 +105,7 @@ module Rodauth
       jwt_decode_opts
     end
 
-    if JWT::VERSION::MAJOR > 2 || (JWT::VERSION::MAJOR == 2 && JWT::VERSION::MINOR >= 4)
+    if JWT.gem_version >= Gem::Version.new("2.4")
       def _jwt_decode_secrets
         secrets = [jwt_secret, jwt_old_secret]
         secrets.compact!

data/lib/rodauth/features/jwt_cors.rb

@@ -33,18 +33,18 @@ module Rodauth
 
     def before_rodauth
       if jwt_cors_allow?
-        response['Access-Control-Allow-Origin'] = request.env['HTTP_ORIGIN']
+        set_response_header('access-control-allow-origin', request.env['HTTP_ORIGIN'])
 
         # Handle CORS preflight request
         if request.request_method == 'OPTIONS'
-          response['Access-Control-Allow-Methods'] = jwt_cors_allow_methods
-          response['Access-Control-Allow-Headers'] = jwt_cors_allow_headers
-          response['Access-Control-Max-Age'] = jwt_cors_max_age.to_s
+          set_response_header('access-control-allow-methods', jwt_cors_allow_methods)
+          set_response_header('access-control-allow-headers', jwt_cors_allow_headers)
+          set_response_header('access-control-max-age', jwt_cors_max_age.to_s)
           response.status = 204
           return_response
         end
 
-        response['Access-Control-Expose-Headers'] = jwt_cors_expose_headers
+        set_response_header('access-control-expose-headers', jwt_cors_expose_headers)
       end
 
       super

data/lib/rodauth/features/lockout.rb

@@ -237,6 +237,10 @@ module Rodauth
       account_lockouts_ds.update(account_lockouts_email_last_sent_column=>Sequel::CURRENT_TIMESTAMP) if account_lockouts_email_last_sent_column
     end
 
+    def unlock_account_email_recently_sent?
+      (email_last_sent = get_unlock_account_email_last_sent) && (Time.now - email_last_sent < unlock_account_skip_resend_email_within)
+    end
+
     private
 
     attr_reader :unlock_account_key_value
@@ -278,10 +282,6 @@ module Rodauth
       return_response unlock_account_request_view
     end
 
-    def unlock_account_email_recently_sent?
-      (email_last_sent = get_unlock_account_email_last_sent) && (Time.now - email_last_sent < unlock_account_skip_resend_email_within)
-    end
-
     def use_date_arithmetic?
       super || db.database_type == :mysql
     end

data/lib/rodauth/features/login.rb

@@ -15,6 +15,7 @@ module Rodauth
     auth_value_method :login_error_status, 401
     translatable_method :login_form_footer_links_heading, '<h2 class="rodauth-login-form-footer-links-heading">Other Options</h2>'
     auth_value_method :login_return_to_requested_location?, false
+    auth_value_method :login_return_to_requested_location_max_path_size, 2048
     auth_value_method :use_multi_phase_login?, false
 
     session_key :login_redirect_session_key, :login_redirect
@@ -95,7 +96,7 @@ module Rodauth
     end
 
     def login_required
-      if login_return_to_requested_location? && (path = login_return_to_requested_location_path)
+      if login_return_to_requested_location? && (path = login_return_to_requested_location_path) && path.bytesize <= login_return_to_requested_location_max_path_size
         set_session_value(login_redirect_session_key, path)
       end
       super

data/lib/rodauth/features/reset_password.rb

@@ -204,16 +204,16 @@ module Rodauth
       end
     end
 
+    def reset_password_email_recently_sent?
+      (email_last_sent = get_reset_password_email_last_sent) && (Time.now - email_last_sent < reset_password_skip_resend_email_within)
+    end
+
     private
 
     def _login_form_footer_links
       super << [20, reset_password_request_path, reset_password_request_link_text]
     end
 
-    def reset_password_email_recently_sent?
-      (email_last_sent = get_reset_password_email_last_sent) && (Time.now - email_last_sent < reset_password_skip_resend_email_within)
-    end
-
     attr_reader :reset_password_key_value
 
     def after_login_failure

data/lib/rodauth/features/sms_codes.rb

@@ -514,7 +514,7 @@ module Rodauth
     end
 
     def sms_send(phone, message)
-      raise NotImplementedError, "sms_send needs to be defined in the Rodauth configuration for SMS sending to work"
+      raise ConfigurationError, "sms_send needs to be defined in the Rodauth configuration for SMS sending to work"
     end
 
     def update_sms(values)

data/lib/rodauth/features/verify_account.rb

@@ -240,6 +240,10 @@ module Rodauth
       send_verify_account_email
     end
 
+    def verify_account_email_recently_sent?
+      account && (email_last_sent = get_verify_account_email_last_sent) && (Time.now - email_last_sent < verify_account_skip_resend_email_within)
+    end
+
     private
 
     def _login_form_footer_links
@@ -250,10 +254,6 @@ module Rodauth
       links
     end
 
-    def verify_account_email_recently_sent?
-      (email_last_sent = get_verify_account_email_last_sent) && (Time.now - email_last_sent < verify_account_skip_resend_email_within)
-    end
-
     attr_reader :verify_account_key_value
 
     def before_login_attempt

data/lib/rodauth/features/webauthn.rb

@@ -123,7 +123,7 @@ module Rodauth
     route(:webauthn_auth_js) do |r|
       before_webauthn_auth_js_route
       r.get do
-        response['Content-Type'] = 'text/javascript'
+        set_response_header('content-type', 'text/javascript')
         webauthn_auth_js
       end
     end
@@ -158,7 +158,7 @@ module Rodauth
     route(:webauthn_setup_js) do |r|
       before_webauthn_setup_js_route
       r.get do
-        response['Content-Type'] = 'text/javascript'
+        set_response_header('content-type', 'text/javascript')
         webauthn_setup_js
       end
     end
@@ -410,13 +410,25 @@ module Rodauth
     private
 
     if WebAuthn::VERSION >= '3'
-      def webauthn_relying_party
-        # No need to memoize, only called once per request
-        WebAuthn::RelyingParty.new(
-          origin: webauthn_origin,
-          id: webauthn_rp_id,
-          name: webauthn_rp_name,
-        )
+      if WebAuthn::RelyingParty.instance_method(:initialize).parameters.include?([:key, :allowed_origins])
+        def webauthn_relying_party
+          # No need to memoize, only called once per request
+          WebAuthn::RelyingParty.new(
+            allowed_origins: [webauthn_origin],
+            id: webauthn_rp_id,
+            name: webauthn_rp_name,
+          )
+        end
+      # :nocov:
+      else
+        def webauthn_relying_party
+          WebAuthn::RelyingParty.new(
+            origin: webauthn_origin,
+            id: webauthn_rp_id,
+            name: webauthn_rp_name,
+          )
+        end
+      # :nocov:
       end
 
       def webauthn_create_relying_party_opts

data/lib/rodauth/features/webauthn_autofill.rb

@@ -12,7 +12,7 @@ module Rodauth
     route(:webauthn_autofill_js) do |r|
       before_webauthn_autofill_js_route
       r.get do
-        response['Content-Type'] = 'text/javascript'
+        set_response_header('content-type', 'text/javascript')
         webauthn_autofill_js
       end
     end

data/lib/rodauth/version.rb

@@ -6,7 +6,7 @@ module Rodauth
   MAJOR = 2
 
   # The minor version of Rodauth, updated for new feature releases of Rodauth.
-  MINOR = 37
+  MINOR = 39
 
   # The patch version of Rodauth, updated only for bug fixes from the last
   # feature release.

data/lib/rodauth.rb

@@ -3,6 +3,8 @@
 require 'securerandom'
 
 module Rodauth
+  class ConfigurationError < StandardError; end
+
   def self.lib(opts={}, &block) 
     require 'roda'
     c = Class.new(Roda)

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: rodauth
 version: !ruby/object:Gem::Version
-  version: 2.37.0
+  version: 2.39.0
 platform: ruby
 authors:
 - Jeremy Evans
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-11-19 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sequel
@@ -382,7 +381,6 @@ metadata:
   documentation_uri: https://rodauth.jeremyevans.net/documentation.html
   mailing_list_uri: https://github.com/jeremyevans/rodauth/discussions
   source_code_uri: https://github.com/jeremyevans/rodauth
-post_install_message:
 rdoc_options:
 - "--quiet"
 - "--line-numbers"
@@ -404,8 +402,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.22
-signing_key:
+rubygems_version: 3.6.7
 specification_version: 4
 summary: Authentication and Account Management Framework for Rack Applications
 test_files: []