rodauth 2.45.0 → 2.47.0

data/lib/rodauth/features/verify_login_change.rb

@@ -74,15 +74,18 @@ module Rodauth
       end
 
       r.post do
-        key = session[verify_login_change_session_key] || param(verify_login_change_key_param)
-        unless account_from_verify_login_change_key(key)
-          set_redirect_error_status(invalid_key_error_status)
-          set_error_reason :invalid_verify_login_change_key
-          set_redirect_error_flash verify_login_change_error_flash
-          redirect verify_login_change_redirect
-        end
+        key = session_param(verify_login_change_session_key, verify_login_change_key_param)
+        remove_session_value(verify_login_change_session_key)
+        select_key_for_update!
 
         transaction do
+          unless key && account_from_verify_login_change_key(key)
+            set_redirect_error_status(invalid_key_error_status)
+            set_error_reason :invalid_verify_login_change_key
+            set_redirect_error_flash verify_login_change_error_flash
+            redirect verify_login_change_redirect
+          end
+
           before_verify_login_change
           unless verify_login_change
             set_redirect_error_status(invalid_key_error_status)
@@ -98,7 +101,6 @@ module Rodauth
           autologin_session('verify_login_change')
         end
 
-        remove_session_value(verify_login_change_session_key)
         verify_login_change_response
       end
     end
@@ -120,7 +122,7 @@ module Rodauth
     end
 
     def account_from_verify_login_change_key(key)
-      @account = _account_from_verify_login_change_key(key)
+      set_account(_account_from_verify_login_change_key(key), :verify_login_change)
     end
 
     def send_verify_login_change_email(login)
@@ -132,7 +134,9 @@ module Rodauth
     end
 
     def get_verify_login_change_login_and_key(id)
-      verify_login_change_ds(id).get([verify_login_change_login_column, verify_login_change_key_column])
+      ds = verify_login_change_ds(id)
+      ds.where(Sequel::CURRENT_TIMESTAMP > verify_login_change_deadline_column).delete
+      apply_key_for_update(ds).get([verify_login_change_login_column, verify_login_change_key_column])
     end
 
     def change_login_notice_flash
@@ -210,10 +214,14 @@ module Rodauth
     end
 
     def _account_from_verify_login_change_key(token)
-      account_from_key(token) do |id|
+      account_from_key(token, verify_login_change_account_status_value) do |id|
         @verify_login_change_new_login, key = get_verify_login_change_login_and_key(id)
         key
       end
     end
+
+    def verify_login_change_account_status_value
+      account_open_status_value
+    end
   end
 end

data/lib/rodauth/features/webauthn.rb

@@ -4,7 +4,7 @@ require 'webauthn'
 
 module Rodauth
   Feature.define(:webauthn, :Webauthn) do
-    depends :two_factor_base
+    depends :two_factor_base, :require_domain, :require_hmac_secret
 
     loaded_templates %w'webauthn-setup webauthn-auth webauthn-remove'
 
@@ -164,7 +164,7 @@ module Rodauth
     end
     
     route(:webauthn_setup) do |r|
-      require_authentication unless two_factor_login_type_match?('webauthn')
+      require_authentication unless webauthn_modification_authenticated?
       require_account_session
       before_webauthn_setup_route
 
@@ -185,7 +185,7 @@ module Rodauth
               raise Sequel::Rollback
             end
 
-            unless two_factor_authenticated?
+            if !two_factor_authenticated? && !authenticated_by.include?('webauthn')
               webauthn_update_session(webauthn_credential.id)
               two_factor_update_session('webauthn')
             end
@@ -205,7 +205,7 @@ module Rodauth
     end
 
     route(:webauthn_remove) do |r|
-      require_authentication unless two_factor_login_type_match?('webauthn')
+      require_authentication unless webauthn_modification_authenticated?
       require_account_session
       require_webauthn_setup
       before_webauthn_remove_route
@@ -469,6 +469,11 @@ module Rodauth
     # :nocov:
     end
 
+    def webauthn_modification_authenticated?
+      two_factor_login_type_match?('webauthn') &&
+        (!uses_two_factor_authentication? || two_factor_modifications_require_password?)
+    end
+
     def _two_factor_auth_links
       links = super
       links << [10, webauthn_auth_path, webauthn_auth_link_text] if webauthn_setup? && !two_factor_login_type_match?('webauthn')
@@ -501,7 +506,7 @@ module Rodauth
     end
 
     def webauthn_account_id
-      session_value
+      account_id_or_session_value
     end
 
     def webauthn_user_ids_ds

data/lib/rodauth/features/webauthn_login.rb

@@ -76,7 +76,7 @@ module Rodauth
     end
 
     def account_from_webauthn_login
-      account_from_login(login_param_value)
+      @account_retrieval_type == :login ? @account : account_from_login(login_param_value)
     end
 
     def webauthn_login_options?
@@ -91,9 +91,5 @@ module Rodauth
       end
       forms
     end
-
-    def webauthn_account_id
-      super || account_id
-    end
   end
 end

data/lib/rodauth/features/webauthn_verify_account.rb

@@ -40,9 +40,5 @@ module Rodauth
       @webauthn_credential = webauthn_setup_credential_from_form_submission
       add_webauthn_credential(@webauthn_credential)
     end
-
-    def webauthn_account_id
-      super || account_id
-    end
   end
 end

data/lib/rodauth/version.rb

@@ -6,7 +6,7 @@ module Rodauth
   MAJOR = 2
 
   # The minor version of Rodauth, updated for new feature releases of Rodauth.
-  MINOR = 45
+  MINOR = 47
 
   # The patch version of Rodauth, updated only for bug fixes from the last
   # feature release.

data/lib/rodauth.rb

@@ -7,6 +7,8 @@ module Rodauth
   SCOPE_INSTANCE_VARIABLES = [:@_rodauths, :@_rodauth].freeze
 
   class ConfigurationError < StandardError; end
+  class Error < StandardError; end
+  class SetPasswordFailure < Error; end
 
   def self.lib(opts=OPTS, &block) 
     require 'roda'

data/templates/close-account-email.str

@@ -0,0 +1,2 @@
+Someone (hopefully you) has closed the account associated to this
+email address.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rodauth
 version: !ruby/object:Gem::Version
-  version: 2.45.0
+  version: 2.47.0
 platform: ruby
 authors:
 - Jeremy Evans
@@ -265,6 +265,7 @@ files:
 - lib/rodauth/features/change_password.rb
 - lib/rodauth/features/change_password_notify.rb
 - lib/rodauth/features/close_account.rb
+- lib/rodauth/features/close_account_email.rb
 - lib/rodauth/features/confirm_password.rb
 - lib/rodauth/features/create_account.rb
 - lib/rodauth/features/disallow_common_passwords.rb
@@ -292,6 +293,8 @@ files:
 - lib/rodauth/features/path_class_methods.rb
 - lib/rodauth/features/recovery_codes.rb
 - lib/rodauth/features/remember.rb
+- lib/rodauth/features/require_domain.rb
+- lib/rodauth/features/require_hmac_secret.rb
 - lib/rodauth/features/reset_password.rb
 - lib/rodauth/features/reset_password_notify.rb
 - lib/rodauth/features/reset_password_verifies_account.rb
@@ -314,6 +317,7 @@ files:
 - templates/button.str
 - templates/change-login.str
 - templates/change-password.str
+- templates/close-account-email.str
 - templates/close-account.str
 - templates/confirm-password.str
 - templates/create-account.str
@@ -403,7 +407,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Authentication and Account Management Framework for Rack Applications
 test_files: []