rodauth 2.43.0 → 2.45.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ebccee76adf022cf82eca6e36c69f5846353b4499021aec5f410dc7e3b04c65f
-  data.tar.gz: b9fb907c3430c9b043c8cc361877c191ed8f4ed99388d410d0eb84b66cb57ab5
+  metadata.gz: 5dea248f50448b260c6d0007d8bc4054f17794270e857a6310b969ba58105fbf
+  data.tar.gz: 875dbda4ddd85b04041a8e854e0adb09b466269ecef74dd1a73f384519d54553
 SHA512:
-  metadata.gz: c38cbd45e2ef7a29c4de7c2e9450979a2739bae690af5dd34288684f8c6289423334033e26ecd96fca758cae0ef7f1a6c6af69de36d95651a6c577206721fde5
-  data.tar.gz: 2c69a447d7d465e76b29f1746dc3f886881f39bb20af47d292093333104ab2e88edf74d4d6262f96f38492d69d284e23719e8cf29823b2a117fd52967c7b79b1
+  metadata.gz: dbf7c82f8b1c93496c59225891c1d747f317eaf46d8283f9c6f2d0562a48aaaec4d6491ed7567011356914fb4498e0f86576c230e183cf53c0ac7a7c5f27d99a
+  data.tar.gz: c8c2a228ce0395e4e14dbd1a69b01f7038b2ac94267b33bc5695d11b3eae6a278846be5100714dc18b0a65010db1693c0621f9ec1f2d0ba0793e92b61a698bf9

data/lib/rodauth/features/active_sessions.rb

@@ -37,6 +37,8 @@ module Rodauth
       :remove_inactive_sessions,
     )
 
+    uses_instance_variables(:@active_sessions_key, :@clear_active_sessions_after_two_factor_setup)
+
     def currently_active_session?
       return false unless session_id = session[session_id_session_key]
 
@@ -148,6 +150,21 @@ module Rodauth
       remove_all_active_sessions
     end
 
+    def after_otp_setup
+      super if defined?(super)
+      remove_all_active_sessions_except_current if @clear_active_sessions_after_two_factor_setup
+    end
+
+    def after_sms_confirm
+      super if defined?(super)
+      remove_all_active_sessions_except_current if @clear_active_sessions_after_two_factor_setup
+    end
+
+    def after_webauthn_setup
+      super if defined?(super)
+      remove_all_active_sessions_except_current if @clear_active_sessions_after_two_factor_setup
+    end
+
     def before_logout
       if param_or_nil(global_logout_param)
         remove_remember_key(session_value) if respond_to?(:remove_remember_key)
@@ -158,6 +175,21 @@ module Rodauth
       super
     end
 
+    def before_otp_setup
+      @clear_active_sessions_after_two_factor_setup = !two_factor_authentication_setup?
+      super if defined?(super)
+    end
+
+    def before_sms_confirm
+      @clear_active_sessions_after_two_factor_setup = !two_factor_authentication_setup?
+      super if defined?(super)
+    end
+
+    def before_webauthn_setup
+      @clear_active_sessions_after_two_factor_setup = !two_factor_authentication_setup?
+      super if defined?(super)
+    end
+
     attr_reader :active_sessions_key
 
     def generate_active_sessions_key

data/lib/rodauth/features/argon2.rb

@@ -16,6 +16,8 @@ module Rodauth
     auth_value_method :argon2_secret, nil
     auth_value_method :use_argon2?, true
 
+    uses_instance_variables(:@update_password_hash)
+
     def password_hash(password)
       return super unless use_argon2?
 

data/lib/rodauth/features/base.rb

@@ -1,11 +1,24 @@
 # frozen-string-literal: true
 
-require 'rack/request'
-require 'rack/utils'
+begin
+  require "rack/version"
+# :nocov:
+rescue LoadError
+  require "rack"
+else
+  if Rack.release >= '3'
+    require "rack/request"
+    require "rack/utils"
+  else
+    require "rack"
+  end
+end
+# :nocov:
 
 module Rodauth
   Feature.define(:base, :Base) do
     after 'login'
+    after 'no_matching_login'
     after 'login_failure'
     before 'login'
     before 'login_attempt'
@@ -22,7 +35,7 @@ module Rodauth
     auth_value_method :accounts_table, :accounts
     auth_value_method :cache_templates, true
     auth_value_method :check_csrf_block, nil
-    auth_value_method :check_csrf_opts, {}.freeze
+    auth_value_method :check_csrf_opts, OPTS
     auth_value_method :default_redirect, '/'
     auth_value_method :convert_token_id_to_integer?, nil
     flash_key :flash_error_key, :error
@@ -60,9 +73,10 @@ module Rodauth
     auth_value_method :mark_input_fields_with_inputmode?, true
     auth_value_method :skip_status_checks?, true
     translatable_method :strftime_format, '%F %T'
-    auth_value_method :template_opts, {}.freeze
+    auth_value_method :template_opts, OPTS
     auth_value_method :title_instance_variable, nil 
     auth_value_method :token_separator, "_"
+    auth_value_method :transaction_opts, OPTS
     auth_value_method :unmatched_field_error_status, 422
     auth_value_method :unopen_account_error_status, 403
     translatable_method :unverified_account_message, "unverified account, please verify account before logging in"
@@ -94,6 +108,7 @@ module Rodauth
       :check_csrf,
       :clear_session,
       :clear_tokens,
+      :convert_token_id,
       :csrf_tag,
       :function_name,
       :hook_action,
@@ -122,7 +137,6 @@ module Rodauth
       :account_from_id,
       :account_from_login,
       :account_from_session,
-      :convert_token_id,
       :field_attributes,
       :field_error_attributes,
       :formatted_field_error,
@@ -137,14 +151,29 @@ module Rodauth
       def auth_class_eval(&block)
         auth.class_eval(&block)
       end
+
+      def uses_instance_variables(*ivs)
+        auth.define_singleton_method(:instance_variables_used) do
+          super() + ivs
+        end
+      end
     end
 
+    uses_instance_variables(
+      :@account,
+      :@current_route,
+      :@field_errors,
+      :@password_field_autocomplete_value,
+      :@has_password
+    )
+
     attr_reader :scope
     attr_reader :account
     attr_reader :current_route
 
     def initialize(scope)
       @scope = scope
+      _initialize_instance_variables
     end
 
     def features
@@ -190,7 +219,7 @@ module Rodauth
       end
     end
 
-    def input_field_string(param, id, opts={})
+    def input_field_string(param, id, opts=OPTS)
       type = opts.fetch(:type, "text")
 
       unless type == "password"
@@ -421,7 +450,7 @@ module Rodauth
       _template_opts(opts, 'button')
     end
 
-    def button(value, opts={})
+    def button(value, opts=OPTS)
       scope.render(button_opts(value, opts))
     end
 
@@ -549,13 +578,16 @@ module Rodauth
     end
 
     def has_password?
-      return @has_password if defined?(@has_password)
+      return @has_password unless @has_password.nil?
       return false unless account || session_value
       @has_password = !!get_password_hash
     end
 
     private
 
+    def _initialize_instance_variables
+    end
+
     def _around_rodauth
       yield
     end
@@ -665,17 +697,18 @@ module Rodauth
       request.halt
     end
 
-    def route_path(route, opts={})
+    def route_path(route, opts=OPTS)
       path  = "#{prefix}/#{route}"
       path += "?#{Rack::Utils.build_nested_query(opts)}" unless opts.empty?
       path
     end
 
-    def route_url(route, opts={})
+    def route_url(route, opts=OPTS)
       "#{base_url}#{route_path(route, opts)}"
     end
 
-    def transaction(opts={}, &block)
+    def transaction(opts=OPTS, &block)
+      opts = opts.empty? ? transaction_opts : transaction_opts.merge(opts)
       db.transaction(opts, &block)
     end
 
@@ -935,6 +968,14 @@ module Rodauth
       false
     end
 
+    # :nocov:
+    if RUBY_VERSION >= '4.0'
+    # :nocov:
+      def instance_variables_to_inspect
+        instance_variables.reject{|v| instance_variable_get(v).nil?}
+      end
+    end
+
     def use_scope_clear_session?
       scope.respond_to?(:clear_session)
     end

data/lib/rodauth/features/disallow_password_reuse.rb

@@ -16,6 +16,8 @@ module Rodauth
       :password_doesnt_match_previous_password?
     )
 
+    uses_instance_variables(:@dont_check_previous_password)
+
     def set_password(password)
       hash = super
       add_previous_password_hash(hash)

data/lib/rodauth/features/email_auth.rb

@@ -47,6 +47,8 @@ module Rodauth
 
     auth_private_methods :account_from_email_auth_key
 
+    uses_instance_variables(:@email_auth_key_value)
+
     internal_request_method
     internal_request_method :email_auth_request
     internal_request_method :valid_email_auth?

data/lib/rodauth/features/http_basic_auth.rb

@@ -5,10 +5,12 @@ module Rodauth
     auth_value_method :http_basic_auth_realm, "protected"
     auth_value_method :require_http_basic_auth?, false
 
+    uses_instance_variables(:@checked_http_basic_auth)
+
     def logged_in?
       ret = super
 
-      if !ret && !defined?(@checked_http_basic_auth)
+      if !ret && @checked_http_basic_auth.nil?
         http_basic_auth
         ret = super
       end
@@ -32,9 +34,11 @@ module Rodauth
     end
 
     def http_basic_auth
-      return @checked_http_basic_auth if defined?(@checked_http_basic_auth)
+      unless @checked_http_basic_auth.nil?
+        return (@checked_http_basic_auth ? true : nil)
+      end
 
-      @checked_http_basic_auth = nil
+      @checked_http_basic_auth = false
       return unless token = ((v = request.env['HTTP_AUTHORIZATION']) && v[/\A *Basic (.*)\Z/, 1])
 
       username, password = token.unpack("m*").first.split(/:/, 2)
@@ -42,6 +46,7 @@ module Rodauth
 
       catch_error do
         unless account_from_login(username)
+          after_no_matching_login
           throw_basic_auth_error(login_param, no_matching_login_message)
         end
 

data/lib/rodauth/features/internal_request.rb

@@ -187,6 +187,7 @@ module Rodauth
     end
 
     def _set_internal_request_return_value(value)
+      @internal_request_return_value_set = true
       @internal_request_return_value = value
     end
 
@@ -219,7 +220,7 @@ module Rodauth
 
     def _handle_internal_request_eval(_)
       v = instance_eval(&internal_request_block)
-      _set_internal_request_return_value(v) unless defined?(@internal_request_return_value)
+      _set_internal_request_return_value(v) unless @internal_request_return_value_set
     end
 
     def _handle_account_id_for_login(_)
@@ -304,7 +305,20 @@ module Rodauth
   end
 
   module InternalRequestClassMethods
-    def internal_request(route, opts={}, &block)
+    def instance_variables_used
+      super + [
+        :@session,
+        :@params,
+        :@flash,
+        :@internal_request_block,
+        :@internal_request_return_value,
+        :@internal_request_return_value_set,
+        :@error_reason,
+        :@return_false_on_error
+      ]
+    end
+
+    def internal_request(route, opts=OPTS, &block)
       opts = opts.dup
       
       env = {
@@ -404,13 +418,14 @@ module Rodauth
 
       internal_class.send(:extend, InternalRequestClassMethods)
       internal_class.send(:include, InternalRequestMethods)
+      internal_class.send(:make_shape_friendly)
       internal_class.allocate.post_configure
 
       ([:base] + internal_class.features).each do |feature_name|
         feature = FEATURES[feature_name]
         if meths = feature.internal_request_methods
           meths.each do |name|
-            klass.define_singleton_method(name){|opts={}, &block| internal_class.internal_request(name, opts, &block)}
+            klass.define_singleton_method(name){|opts=OPTS, &block| internal_class.internal_request(name, opts, &block)}
           end
         end
       end

data/lib/rodauth/features/json.rb

@@ -2,6 +2,8 @@
 
 module Rodauth
   Feature.define(:json, :Json) do
+    self.allowed_undefined_configuration_methods = [:only_json?].freeze
+
     translatable_method :json_not_accepted_error_message, 'Unsupported Accept header. Must accept "application/json" or compatible content type'
     translatable_method :json_non_post_error_message, 'non-POST method used in JSON API'
     auth_value_method :json_accept_regexp, /(?:(?:\*|\bapplication)\/\*|\bapplication\/(?:vnd\.api\+)?json\b)/i
@@ -27,6 +29,8 @@ module Rodauth
 
     auth_private_methods :json_response_body
 
+    uses_instance_variables(:@json_request)
+
     def set_field_error(field, message)
       return super unless use_json?
       json_response[json_response_field_error_key] = [field, message]
@@ -53,8 +57,8 @@ module Rodauth
     end
 
     def json_request?
-      return @json_request if defined?(@json_request)
-      @json_request = request.content_type =~ json_request_content_type_regexp
+      return @json_request unless @json_request.nil?
+      @json_request = !(request.content_type !~ json_request_content_type_regexp)
     end
 
     def use_json?

data/lib/rodauth/features/jwt.rb

@@ -11,7 +11,7 @@ module Rodauth
     auth_value_method :jwt_algorithm, "HS256"
     auth_value_method :jwt_authorization_ignore, /\A(?:Basic|Digest) /
     auth_value_method :jwt_authorization_remove, /\ABearer:?\s+/
-    auth_value_method :jwt_decode_opts, {}.freeze
+    auth_value_method :jwt_decode_opts, OPTS
     auth_value_method :jwt_old_secret, nil
     auth_value_method :jwt_session_key, nil
     auth_value_method :jwt_symbolize_deeply?, false
@@ -30,8 +30,10 @@ module Rodauth
 
     def_deprecated_alias :json_check_accept?, :jwt_check_accept?
 
+    uses_instance_variables(:@session, :@jwt_token, :@jwt_payload)
+
     def session
-      return @session if defined?(@session)
+      return @session if @session
       return super unless use_jwt?
 
       s = {}
@@ -76,7 +78,7 @@ module Rodauth
     end
 
     def jwt_token
-      return @jwt_token if defined?(@jwt_token)
+      return @jwt_token if @jwt_token
 
       if (v = request.env['HTTP_AUTHORIZATION']) && v !~ jwt_authorization_ignore
         @jwt_token = v.sub(jwt_authorization_remove, '')
@@ -120,7 +122,7 @@ module Rodauth
     end
 
     def jwt_payload
-      return @jwt_payload if defined?(@jwt_payload)
+      return @jwt_payload unless @jwt_payload.nil?
       @jwt_payload = JWT.decode(jwt_token, _jwt_decode_secrets, true, _jwt_decode_opts.merge(:algorithm=>jwt_algorithm))[0]
     rescue JWT::DecodeError => e
       rescue_jwt_payload(e)

data/lib/rodauth/features/jwt_refresh.rb

@@ -31,6 +31,8 @@ module Rodauth
       :account_from_refresh_token
     )
 
+    uses_instance_variables(:@jwt_refresh_route)
+
     route do |r|
       @jwt_refresh_route = true
       before_jwt_refresh_route

data/lib/rodauth/features/lockout.rb

@@ -61,6 +61,8 @@ module Rodauth
     )
     auth_private_methods :account_from_unlock_key
 
+    uses_instance_variables(:@unlock_account_key_value)
+
     internal_request_method(:lock_account)
     internal_request_method(:unlock_account_request)
     internal_request_method(:unlock_account)
@@ -249,7 +251,14 @@ module Rodauth
 
     private
 
-    attr_reader :unlock_account_key_value
+    def unlock_account_key
+      @unlock_account_key_value
+    end
+
+    def unlock_account_key_value
+      # RODAUTH3: call unlock_account_key directly
+      unlock_account_key
+    end
 
     def before_login_attempt
       if locked_out?

data/lib/rodauth/features/login.rb

@@ -20,8 +20,8 @@ module Rodauth
 
     session_key :login_redirect_session_key, :login_redirect
 
-    auth_cached_method :multi_phase_login_forms
-    auth_cached_method :login_form_footer
+    cached_auth_method :multi_phase_login_forms
+    cached_auth_method :login_form_footer
 
     auth_value_methods :login_return_to_requested_location_path
 
@@ -30,6 +30,15 @@ module Rodauth
       :login_response
     )
 
+    uses_instance_variables(
+      :@login_form_footer,
+      :@login_form_footer_links,
+      :@login_form_header,
+      :@multi_phase_login_forms,
+      :@saved_login_redirect,
+      :@valid_login_entered
+    )
+
     internal_request_method
     internal_request_method :valid_login_and_password?
 
@@ -47,6 +56,7 @@ module Rodauth
 
         catch_error do
           unless account_from_login(login_param_value)
+            after_no_matching_login
             throw_error_reason(:no_matching_login, no_matching_login_error_status, login_param, no_matching_login_message)
           end
 

data/lib/rodauth/features/login_password_requirements_base.rb

@@ -44,6 +44,8 @@ module Rodauth
       :set_password
     )
 
+    uses_instance_variables(:@password_requirement_message, :@login_requirement_message)
+
     def login_confirm_label
       "Confirm #{login_label}"
     end

data/lib/rodauth/features/otp.rb

@@ -68,8 +68,8 @@ module Rodauth
     auth_value_method :otp_setup_raw_param, 'otp_raw_secret'
     translatable_method :otp_auth_form_footer, ''
 
-    auth_cached_method :otp_key
-    auth_cached_method :otp
+    cached_auth_method :otp_key
+    cached_auth_method :otp
     private :otp
 
     auth_value_methods(
@@ -100,6 +100,8 @@ module Rodauth
       :otp_valid_code_for_old_secret
     )
 
+    uses_instance_variables(:@otp, :@otp_key, :@otp_user_key, :@otp_tmp_key)
+
     internal_request_method :otp_setup_params
     internal_request_method :otp_setup
     internal_request_method :otp_auth
@@ -245,7 +247,7 @@ module Rodauth
     end
 
     def otp_exists?
-      !otp_key.nil?
+      !!otp_key
     end
 
     def otp_valid_code?(ot_pass)
@@ -277,7 +279,7 @@ module Rodauth
 
     def otp_remove
       otp_key_ds.delete
-      @otp_key = nil
+      @otp_key = false
     end
 
     def otp_add_key
@@ -368,7 +370,7 @@ module Rodauth
     end
 
     def clear_cached_otp
-      remove_instance_variable(:@otp) if defined?(@otp)
+      @otp = nil
     end
 
     def otp_tmp_key(secret)
@@ -436,7 +438,7 @@ module Rodauth
 
     def _otp_key
       @otp_user_key = nil
-      otp_key_ds.get(otp_keys_column)
+      otp_key_ds.get(otp_keys_column) || false
     end
 
     def _otp_for_key(key)

data/lib/rodauth/features/otp_unlock.rb

@@ -56,6 +56,8 @@ module Rodauth
       :otp_unlock_refresh_tag,
     )
 
+    uses_instance_variables(:@otp_unlock_data)
+
     route(:otp_unlock) do |r|
       require_login
       require_account_session

data/lib/rodauth/features/password_grace_period.rb

@@ -7,6 +7,8 @@ module Rodauth
 
     auth_methods :password_recently_entered?
 
+    uses_instance_variables(:@last_password_entry)
+
     def modifications_require_password?
       return false unless super
       !password_recently_entered?
@@ -26,7 +28,7 @@ module Rodauth
 
     def update_session
       super
-      set_session_value(last_password_entry_session_key, @last_password_entry) if defined?(@last_password_entry)
+      set_session_value(last_password_entry_session_key, @last_password_entry) if @last_password_entry
     end
 
     private

data/lib/rodauth/features/password_pepper.rb

@@ -8,6 +8,8 @@ module Rodauth
     auth_value_method :previous_password_peppers, [""]
     auth_value_method :password_pepper_update?, true
 
+    uses_instance_variables(:@previous_pepper_matched)
+
     def password_match?(password)
       if (result = super) && @previous_pepper_matched && password_pepper_update?
         set_password(password)

data/lib/rodauth/features/path_class_methods.rb

@@ -13,8 +13,8 @@ module Rodauth
           path_meth = :"#{route}_path"
           url_meth = :"#{route}_url"
           instance = klass.allocate.freeze
-          klass.define_singleton_method(path_meth){|opts={}| instance.send(path_meth, opts)}
-          klass.define_singleton_method(url_meth){|opts={}| instance.send(url_meth, opts)}
+          klass.define_singleton_method(path_meth){|opts=OPTS| instance.send(path_meth, opts)}
+          klass.define_singleton_method(url_meth){|opts=OPTS| instance.send(url_meth, opts)}
         end
       end
     end

data/lib/rodauth/features/recovery_codes.rb

@@ -46,7 +46,7 @@ module Rodauth
     translatable_method :recovery_auth_link_text, "Authenticate Using Recovery Code"
     translatable_method :recovery_codes_link_text, "View Authentication Recovery Codes"
 
-    auth_cached_method :recovery_codes
+    cached_auth_method :recovery_codes
 
     auth_value_methods(
       :recovery_codes_primary?
@@ -60,6 +60,8 @@ module Rodauth
       :recovery_codes_available?,
     )
 
+    uses_instance_variables(:@recovery_codes, :@recovery_codes_button)
+
     internal_request_method :recovery_codes
     internal_request_method :recovery_auth
     internal_request_method :valid_recovery_auth?
@@ -181,7 +183,7 @@ module Rodauth
           add_recovery_code
         end
       end
-      remove_instance_variable(:@recovery_codes)
+      @recovery_codes = nil
     end
 
     def add_recovery_code

data/lib/rodauth/features/remember.rb

@@ -16,7 +16,7 @@ module Rodauth
     response
 
     auth_value_method :raw_remember_token_deadline, nil
-    auth_value_method :remember_cookie_options, {}.freeze
+    auth_value_method :remember_cookie_options, OPTS
     auth_value_method :extend_remember_deadline?, false
     auth_value_method :extend_remember_deadline_period, 3600
     auth_value_method :remember_period, {:days=>14}.freeze
@@ -49,6 +49,8 @@ module Rodauth
       :remove_remember_key
     )
 
+    uses_instance_variables(:@remember_key_value)
+
     internal_request_method :remember_setup
     internal_request_method :remember_disable
     internal_request_method :account_id_for_remember_key

data/lib/rodauth/features/reset_password.rb

@@ -57,6 +57,8 @@ module Rodauth
       :account_from_reset_password_key
     )
 
+    uses_instance_variables(:@reset_password_key_value)
+
     internal_request_method(:reset_password_request)
     internal_request_method
 
@@ -190,6 +192,11 @@ module Rodauth
     end
 
     def get_password_reset_key(id)
+      # RODAUTH3: Remove method and call get_reset_password_key directly
+      get_reset_password_key(id)
+    end
+
+    def get_reset_password_key(id)
       ds = password_reset_ds(id)
       ds.where(Sequel::CURRENT_TIMESTAMP > reset_password_deadline_column).delete
       ds.get(reset_password_key_column)

data/lib/rodauth/features/sms_codes.rb

@@ -89,15 +89,13 @@ module Rodauth
     auth_value_method :sms_phone_min_length, 7
     auth_value_method :sms_phone_param, 'sms-phone'
 
-    auth_cached_method :sms
-
     auth_value_methods(
       :sms_codes_primary?,
       :sms_needs_confirmation_notice_flash,
-      :sms_request_response
     )
 
     auth_methods(
+      :sms,
       :sms_auth_message,
       :sms_available?,
       :sms_code_issued_at,
@@ -121,6 +119,9 @@ module Rodauth
       :sms_setup?,
       :sms_valid_phone?
     )
+    auth_private_methods :sms_request_response
+
+    uses_instance_variables(:@sms)
 
     internal_request_method :sms_setup
     internal_request_method :sms_confirm
@@ -356,7 +357,7 @@ module Rodauth
 
     def sms_disable
       sms_ds.delete
-      @sms = nil
+      @sms = false
     end
 
     def sms_confirm_failure
@@ -367,7 +368,7 @@ module Rodauth
       # Cannot handle uniqueness violation here, as the phone number given may not match the
       # one in the table.
       sms_ds.insert(sms_id_column=>session_value, sms_phone_column=>phone_number, sms_failures_column => nil)
-      remove_instance_variable(:@sms) if instance_variable_defined?(:@sms)
+      @sms = nil
     end
 
     def sms_remove_failures
@@ -521,8 +522,15 @@ module Rodauth
       update_hash_ds(sms, sms_ds, values)
     end
 
-    def _sms
-      sms_ds.first
+    def sms
+      case @sms
+      when nil
+        (@sms = sms_ds.first || false) || nil
+      when false
+        nil
+      else
+        @sms
+      end
     end
 
     def sms_ds

data/lib/rodauth/features/two_factor_base.rb

@@ -62,6 +62,8 @@ module Rodauth
       :two_factor_remove_links
     )
 
+    uses_instance_variables(:@two_factor_auth_links, :@two_factor_setup_links, :@two_factor_remove_links)
+
     internal_request_method :two_factor_disable
 
     route(:two_factor_manage, 'multifactor-manage') do |r|

data/lib/rodauth/features/update_password_hash.rb

@@ -4,6 +4,8 @@ module Rodauth
   Feature.define(:update_password_hash, :UpdatePasswordHash) do
     depends :login_password_requirements_base
 
+    uses_instance_variables(:@current_password_hash_cost, :@update_password_hash)
+
     def password_match?(password)
       if (result = super) && update_password_hash?
         @update_password_hash = false

data/lib/rodauth/features/verify_account.rb

@@ -59,6 +59,8 @@ module Rodauth
       :account_from_verify_account_key
     )
 
+    uses_instance_variables(:@verify_account_key_value)
+
     internal_request_method(:verify_account_resend)
     internal_request_method
 

data/lib/rodauth/features/verify_login_change.rb

@@ -51,6 +51,8 @@ module Rodauth
       :account_from_verify_login_change_key
     )
 
+    uses_instance_variables(:@verify_login_change_key_value, :@verify_login_change_new_login)
+
     internal_request_method
 
     route do |r|

data/lib/rodauth/features/webauthn_login.rb

@@ -12,6 +12,8 @@ module Rodauth
 
     auth_value_method :webauthn_login_user_verification_additional_factor?, false
 
+    uses_instance_variables(:@webauthn_login)
+
     internal_request_method :webauthn_login_params
     internal_request_method :webauthn_login
 

data/lib/rodauth/features/webauthn_verify_account.rb

@@ -4,6 +4,8 @@ module Rodauth
   Feature.define(:webauthn_verify_account, :WebauthnVerifyAccount) do
     depends :verify_account, :webauthn
 
+    uses_instance_variables(:@webauthn_credential)
+
     def verify_account_view
       webauthn_setup_view
     end

data/lib/rodauth/version.rb

@@ -6,7 +6,7 @@ module Rodauth
   MAJOR = 2
 
   # The minor version of Rodauth, updated for new feature releases of Rodauth.
-  MINOR = 43
+  MINOR = 45
 
   # The patch version of Rodauth, updated only for bug fixes from the last
   # feature release.

data/lib/rodauth.rb

@@ -3,9 +3,12 @@
 require 'securerandom'
 
 module Rodauth
+  OPTS = {}.freeze
+  SCOPE_INSTANCE_VARIABLES = [:@_rodauths, :@_rodauth].freeze
+
   class ConfigurationError < StandardError; end
 
-  def self.lib(opts={}, &block) 
+  def self.lib(opts=OPTS, &block) 
     require 'roda'
     c = Class.new(Roda)
     c.plugin(:rodauth, opts) do
@@ -16,7 +19,7 @@ module Rodauth
     c.rodauth
   end
 
-  def self.load_dependencies(app, opts={}, &_)
+  def self.load_dependencies(app, opts=OPTS, &_)
     json_opt = opts.fetch(:json, app.opts[:rodauth_json])
     if json_opt
       app.plugin :json
@@ -45,7 +48,7 @@ module Rodauth
     end
   end
 
-  def self.configure(app, opts={}, &block)
+  def self.configure(app, opts=OPTS, &block)
     json_opt = app.opts[:rodauth_json] = opts.fetch(:json, app.opts[:rodauth_json])
     csrf = app.opts[:rodauth_csrf] = opts.fetch(:csrf, app.opts[:rodauth_csrf])
     app.opts[:rodauth_route_csrf] = case csrf
@@ -63,6 +66,7 @@ module Rodauth
     end
     auth_class.class_eval{@configuration_name = opts[:name] unless defined?(@configuration_name)}
     auth_class.configure(&block) if block
+    auth_class.send(:make_shape_friendly)
     auth_class.allocate.post_configure if auth_class.method_defined?(:post_configure)
   end
 
@@ -70,15 +74,32 @@ module Rodauth
 
   class FeatureConfiguration < Module
     def def_configuration_methods(feature)
-      private_methods = feature.private_instance_methods.map(&:to_sym)
+      private_methods = feature.private_instance_methods
       priv = proc{|m| private_methods.include?(m)}
-      feature.auth_methods.each{|m| def_auth_method(m, priv[m])}
-      feature.auth_value_methods.each{|m| def_auth_value_method(m, priv[m])}
-      feature.auth_private_methods.each{|m| def_auth_private_method(m)}
+      feature.auth_methods.each do |m|
+        _check_method_defined(feature, m, priv[m])
+        def_auth_method(m, priv[m])
+      end
+      feature.auth_value_methods.each do |m|
+        _check_method_defined(feature, m, priv[m])
+        def_auth_value_method(m, priv[m])
+      end
+      feature.auth_private_methods.each do |m|
+        _check_method_defined(feature, :"_#{m}", true)
+        def_auth_private_method(m)
+      end
     end
 
     private
 
+    def _check_method_defined(feature, meth, priv)
+      if !feature.send(priv ? :private_method_defined? : :method_defined?, meth) &&
+          (!(allowed = feature.allowed_undefined_configuration_methods) || !allowed.include?(meth))
+        # RODAUTH3: raise instead of warn
+        warn "Bug in Rodauth #{feature.feature_name} feature definition, configuration method added for #{meth}, but the feature doesn't define the method"
+      end
+    end
+
     def def_auth_method(meth, priv)
       define_method(meth) do |&block|
         @auth.send(:define_method, meth, &block)
@@ -124,14 +145,16 @@ module Rodauth
     attr_accessor :dependencies
     attr_accessor :routes
     attr_accessor :configuration
+    attr_accessor :allowed_undefined_configuration_methods
     attr_reader :internal_request_methods
+    attr_reader :instance_variables_used
 
     def route(name=feature_name, default=name.to_s.tr('_', '-'), &block)
       route_meth = :"#{name}_route"
       auth_value_method route_meth, default
 
-      define_method(:"#{name}_path"){|opts={}| route_path(send(route_meth), opts) if send(route_meth)}
-      define_method(:"#{name}_url"){|opts={}| route_url(send(route_meth), opts) if send(route_meth)}
+      define_method(:"#{name}_path"){|opts=OPTS| route_path(send(route_meth), opts) if send(route_meth)}
+      define_method(:"#{name}_url"){|opts=OPTS| route_url(send(route_meth), opts) if send(route_meth)}
 
       handle_meth = :"handle_#{name}"
       internal_handle_meth = :"_#{handle_meth}"
@@ -175,6 +198,10 @@ module Rodauth
       (@internal_request_methods ||= []) << name
     end
 
+    def uses_instance_variables(*ivs)
+      @instance_variables_used = ivs.freeze
+    end
+
     def configuration_module_eval(&block)
       configuration.module_eval(&block)
     end
@@ -254,7 +281,7 @@ module Rodauth
       end
     end
 
-    def email(type, subject, opts = {})
+    def email(type, subject, opts = OPTS)
       subject_method = :"#{type}_email_subject"
       body_method = :"#{type}_email_body"
       create_method = :"create_#{type}_email"
@@ -305,7 +332,24 @@ module Rodauth
       auth_value_methods(meth)
     end
 
-    def auth_cached_method(meth, iv=:"@#{meth}")
+    # Auth caching method that treats a nil instance variable as
+    # not being cached. If nil is a valid value for the instance
+    # variable, do not use this method, use a regular auth_method
+    # and handle caching manually.
+    def cached_auth_method(meth, iv=:"@#{meth}")
+      umeth = :"_#{meth}"
+      define_method(meth) do
+        v = instance_variable_get(iv)
+        v.nil? ? instance_variable_set(iv, send(umeth)) : v
+      end
+      alias_method(meth, meth)
+      auth_private_methods(meth)
+    end
+
+    # :nocov:
+    def auth_cached_method(meth, iv=:"@#{meth}") # :nodoc:
+      # Non-shape friendly historical method.
+      # RODAUTH3: Remove
       umeth = :"_#{meth}"
       define_method(meth) do
         if instance_variable_defined?(iv)
@@ -317,6 +361,7 @@ module Rodauth
       alias_method(meth, meth)
       auth_private_methods(meth)
     end
+    # :nocov:
 
     [:notice_flash, :error_flash, :button].each do |meth|
       define_method(meth) do |v, name=feature_name|
@@ -376,6 +421,60 @@ module Rodauth
       attr_accessor :route_hash
       attr_reader :configuration_name
       attr_reader :configuration
+
+      private
+
+      if RUBY_VERSION >= "3.2" && defined?(RubyVM::YJIT.enable)
+        # Use a shape-friendly object on Ruby 3.2 if YJIT is available
+        # with the assumption that it will be enabled later in any situation
+        # desiring high performance.
+        def make_shape_friendly
+          ivs = instance_variables_used
+
+          unless ivs.empty?
+            ivs.uniq!
+            ivs = ivs.reverse.join(" = ")
+            method_content = "#{ivs} = nil"
+            class_eval(<<-RUBY, __FILE__, __LINE__+1)
+              private def _initialize_instance_variables
+                #{method_content}
+              end
+              alias _initialize_instance_variables _initialize_instance_variables
+            RUBY
+          end
+
+          nil
+        end
+
+        def instance_variables_used
+          ivs = []
+          features = []
+
+          # Try to ensure that instance variable order follows feature enablement order
+          ancestors.each do |mod|
+            features << mod if mod.is_a?(Feature)
+          end
+
+          features.reverse_each do |mod|
+            if (feature_ivs = mod.instance_variables_used)
+              feature_ivs.each do |iv|
+                unless iv.match?(/\A@[a-z_][a-z0-9_]*\z/)
+                  raise ConfigurationError, "invalid model instance variable used"
+                end
+
+                ivs << iv
+              end
+            end
+          end
+
+          ivs
+        end
+      # :nocov:
+      else
+        def make_shape_friendly # :nodoc:
+        end
+      end
+      # :nocov:
     end
 
     def self.inherited(subclass)
@@ -429,7 +528,7 @@ module Rodauth
       view_opts = rodauth.send(:loaded_templates).map do |page|
         rodauth.send(:_view_opts, page)
       end
-      view_opts << rodauth.send(:button_opts, '', {})
+      view_opts << rodauth.send(:button_opts, '', OPTS)
 
       view_opts.each do |opts|
         instance.send(:retrieve_template, opts).send(:compiled_method, opts[:locals].keys.sort_by(&:to_s))

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rodauth
 version: !ruby/object:Gem::Version
-  version: 2.43.0
+  version: 2.45.0
 platform: ruby
 authors:
 - Jeremy Evans
@@ -403,7 +403,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Authentication and Account Management Framework for Rack Applications
 test_files: []