rodauth 2.46.0 → 2.48.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5f2f00f0b0ca5043b852e3f544a666c066b5df09445a4d0031351e37d101bdbf
-  data.tar.gz: 387de7af25a3d6f4823cc09818d374ff99f1a35ffe8a0329efe107810667cdd6
+  metadata.gz: b9a5a66fe82750a982d493fd5e6558b4fef6f94f1761257b3242ff53014eb81b
+  data.tar.gz: ecd3f766f3b4d96acd2c7e651d71d1ad0cbb4e60e49db3d5e396a304866b733f
 SHA512:
-  metadata.gz: 26088c4dc223cdc9f72a07a0de27bff3a3678b29264a46554733d103106443988ac524553f8afa4cb7a457d0cf51c25646adbdf8bd158a7488db449dfc09f7ee
-  data.tar.gz: da69371a181d62e7ebb74274c56503565e64be26a808dede0df3f7b7c1e230efa5442f35d99609c138439703d2f97335968a0ee720c83c9819ae0de363269046
+  metadata.gz: 4471aa257cc7761633fca706db570b61cf4315f22d512c90a2419666f2c1bfd97647196a71fa8fd0d85f1cf16cede1beb69dce20ba6d98a29c52727aa6342c37
+  data.tar.gz: 0c3ac3e520ab620528ec8dd125cdee8092adea4ad6a2e1c877e30a10598219d0ad8abcb15eb40e1509561587323d8f05f653b68b3d7d112bd2cf44c9a6b8e6e5

data/lib/rodauth/features/active_sessions.rb

@@ -2,7 +2,7 @@
 
 module Rodauth
   Feature.define(:active_sessions, :ActiveSessions) do
-    depends :logout
+    depends :logout, :require_hmac_secret
 
     error_flash 'This session has been logged out'
     redirect
@@ -235,7 +235,7 @@ module Rodauth
 
     def active_sessions_ds
       db[active_sessions_table].
-        where(active_sessions_account_id_column=>session_value || account_id)
+        where(active_sessions_account_id_column=>account_id_or_session_value)
     end
 
     def use_date_arithmetic?

data/lib/rodauth/features/argon2.rb

@@ -2,11 +2,11 @@
 
 require 'argon2'
 
-# :nocov:
+# simplecov:disable
 if !defined?(Argon2::VERSION) || Argon2::VERSION < '2'
   raise LoadError, "argon2 version 1.x not supported as it does not support argon2id hashes"
 end
-# :nocov:
+# simplecov:enable
 
 module Rodauth
   Feature.define(:argon2, :Argon2) do
@@ -36,12 +36,12 @@ module Rodauth
       def argon2_salt_option
         :salt_do_not_supply
       end
-    # :nocov:
+    # simplecov:disable
     else
       def argon2_salt_option
         :salt_for_testing_purposes_only
       end
-    # :nocov:
+    # simplecov:enable
     end
 
     def password_hash_cost
@@ -78,7 +78,7 @@ module Rodauth
         def argon2_hash_cost
           { t_cost: 1, m_cost: 5, p_cost: 1 }
         end
-      # :nocov:
+      # simplecov:disable
       else
         def argon2_hash_cost
           { t_cost: 2, m_cost: 16, p_cost: 1 }
@@ -102,7 +102,7 @@ module Rodauth
         end
       end
     end
-    # :nocov:
+    # simplecov:enable
 
     def argon2_hash_algorithm?(hash)
       hash.start_with?('$argon2id$')

data/lib/rodauth/features/audit_logging.rb

@@ -30,8 +30,9 @@ module Rodauth
 
     def hook_action(hook_type, action)
       super
+
       # In after_logout, session is already cleared, so use before_logout in that case
-      if (hook_type == :after || action == :logout) && (id = account ? account_id : session_value)
+      if (hook_type == :after || action == :logout) && (id = account_id_or_session_value)
         add_audit_log(id, action)
       end
     end
@@ -82,9 +83,9 @@ module Rodauth
 
     def audit_log_ds
       ds = db[audit_logging_table]
-      # :nocov:
+      # simplecov:disable
       if db.database_type == :postgres
-      # :nocov:
+      # simplecov:enable
         # For PostgreSQL, use RETURNING NULL. This allows the feature
         # to be used with INSERT but not SELECT permissions on the
         # table, useful for audit logging where the database user

data/lib/rodauth/features/base.rb

@@ -2,7 +2,7 @@
 
 begin
   require "rack/version"
-# :nocov:
+# simplecov:disable
 rescue LoadError
   require "rack"
 else
@@ -13,7 +13,7 @@ else
     require "rack"
   end
 end
-# :nocov:
+# simplecov:enable
 
 module Rodauth
   Feature.define(:base, :Base) do
@@ -68,6 +68,7 @@ module Rodauth
     auth_value_method :prefix, ''
     auth_value_method :session_key_prefix, nil
     auth_value_method :require_bcrypt?, true
+    auth_value_method :return_to_path_max_size, 2048
     auth_value_method :mark_input_fields_as_required?, true
     auth_value_method :mark_input_fields_with_autocomplete?, true
     auth_value_method :mark_input_fields_with_inputmode?, true
@@ -101,6 +102,7 @@ module Rodauth
 
     auth_methods(
       :account_id,
+      :account_reload,
       :account_session_value,
       :already_logged_in,
       :authenticated?,
@@ -115,6 +117,7 @@ module Rodauth
       :inputmode_for_field?,
       :logged_in?,
       :login_required,
+      :missing_recommended_configuration,
       :normalize_login,
       :null_byte_parameter_value,
       :open_account?,
@@ -130,7 +133,8 @@ module Rodauth
       :set_error_reason,
       :set_title,
       :translate,
-      :update_session
+      :update_session,
+      :valid_return_to_path?
     )
 
     auth_private_methods(
@@ -164,7 +168,9 @@ module Rodauth
       :@current_route,
       :@field_errors,
       :@password_field_autocomplete_value,
-      :@has_password
+      :@has_password,
+      :@account_retrieval_type,
+      :@existing_password_hash_or_salt
     )
 
     attr_reader :scope
@@ -309,7 +315,7 @@ module Rodauth
     alias logged_in? session_value
 
     def account_from_login(login)
-      @account = _account_from_login(login)
+      set_account(_account_from_login(login), :login)
     end
 
     def open_account?
@@ -337,10 +343,12 @@ module Rodauth
     end
 
     def check_already_logged_in
+      # RODAUTH3: Move to login feature
       already_logged_in if logged_in?
     end
 
     def already_logged_in
+      # RODAUTH3: Move to login feature, halt or redirect by default
       nil
     end
 
@@ -414,15 +422,15 @@ module Rodauth
     end
 
     def account!
-      account || (session_value && account_from_session)
+      @account_retrieval_type ? @account : (session_value && account_from_session)
     end
 
     def account_from_session
-      @account = _account_from_session
+      set_account(_account_from_session, :session)
     end
 
     def account_from_id(id, status_id=nil)
-      @account = _account_from_id(id, status_id)
+      set_account(_account_from_id(id, status_id), :id)
     end
 
     def check_csrf
@@ -435,9 +443,9 @@ module Rodauth
       if use_request_specific_csrf_tokens?
         scope.csrf_tag(path)
       else
-        # :nocov:
+        # simplecov:disable
         scope.csrf_tag
-        # :nocov:
+        # simplecov:enable
       end
     end
 
@@ -486,7 +494,7 @@ module Rodauth
     end
 
     def password_match?(password)
-      if hash = get_password_hash
+      if @existing_password_hash_or_salt = hash = get_password_hash
         if account_password_hash_column || !use_database_authentication_functions?
           password_hash_match?(hash, password)
         else
@@ -579,7 +587,7 @@ module Rodauth
 
     def has_password?
       return @has_password unless @has_password.nil?
-      return false unless account || session_value
+      return false unless account_id_or_session_value
       @has_password = !!get_password_hash
     end
 
@@ -599,6 +607,14 @@ module Rodauth
       s
     end
 
+    def account_id_or_session_value
+      if @account
+        account_id
+      elsif !@account_retrieval_type
+        session_value
+      end
+    end
+
     if Rack.release >= '3'
       def set_response_header(key, value)
         response.headers[key] = value
@@ -607,7 +623,7 @@ module Rodauth
       def convert_response_header_key(key)
         key
       end
-    # :nocov:
+    # simplecov:disable
     else
       def set_response_header(key, value)
         response.headers[convert_response_header_key(key)] = value
@@ -627,19 +643,20 @@ module Rodauth
         Content-Type
         Content-Length
         WWW-Authenticate
+        Vary
       END
       mixed_case_headers.freeze
       define_method(:convert_response_header_key) do |key|
         mixed_case_headers.fetch(key, key)
       end
     end
-    # :nocov:
+    # simplecov:enable
 
     if RUBY_VERSION >= '2.1'
       def button_fixed_locals
         '(value:, opts:)'
       end
-    # :nocov:
+    # simplecov:disable
     else
       # Work on Ruby 2.0 when using Tilt 2.6+, as Ruby 2.0 does
       # not support required keyword arguments.
@@ -647,7 +664,28 @@ module Rodauth
         '(value: nil, opts: nil)'
       end
     end
-    # :nocov:
+    # simplecov:enable
+
+    def missing_recommended_configuration(msg)
+      # RODAUTH3: switch to raise ConfigurationError
+      warn msg
+    end
+
+    def account_reload(current_retrieval_type, new_retrieval_type)
+      return unless @current_route
+
+      if current_retrieval_type == new_retrieval_type
+        warn "account retrieved multiple times during rodauth route with retrieval type #{current_retrieval_type}"
+      else
+        raise Error, "account retrieved multiple times during rodauth route, original retrieval type: #{current_retrieval_type}, new retrieval type: #{new_retrieval_type}"
+      end
+    end
+
+    def set_account(account, retrieval_type)
+      account_reload(@account_retrieval_type, retrieval_type) if @account_retrieval_type
+      @account_retrieval_type = retrieval_type
+      @account = account
+    end
 
     def database_function_password_match?(name, hash_id, password, salt)
       db.get(Sequel.function(function_name(name), hash_id, password_hash_using_salt(password, salt)))
@@ -789,9 +827,9 @@ module Rodauth
       when :postgres, :mysql, :mssql
         true
       else
-        # :nocov:
+        # simplecov:disable
         false
-        # :nocov:
+        # simplecov:enable
       end
     end
 
@@ -805,9 +843,9 @@ module Rodauth
 
     def function_name(name)
       if db.database_type == :mssql
-        # :nocov:
+        # simplecov:disable
         "dbo.#{name}"
-        # :nocov:
+        # simplecov:enable
       else
         name
       end
@@ -823,14 +861,18 @@ module Rodauth
       if account_password_hash_column
         account[account_password_hash_column] if account!
       elsif use_database_authentication_functions?
-        db.get(Sequel.function(function_name(:rodauth_get_salt), account ? account_id : session_value))
+        db.get(Sequel.function(function_name(:rodauth_get_salt), account_id_or_session_value))
       else
-        # :nocov:
+        # simplecov:disable
         password_hash_ds.get(password_hash_column)
-        # :nocov:
+        # simplecov:enable
       end
     end
 
+    def new_password_matches_current_password?(password)
+      password_match?(password)
+    end
+
     def _account_from_login(login)
       ds = account_table_ds.where(login_column=>login)
       ds = ds.select(*account_select) if account_select
@@ -895,7 +937,7 @@ module Rodauth
     end
 
     def password_hash_ds
-      db[password_hash_table].where(password_hash_id_column=>account ? account_id : session_value)
+      db[password_hash_table].where(password_hash_id_column=>account_id_or_session_value)
     end
 
     # This is needed for jdbc/sqlite, which returns timestamp columns as strings
@@ -934,9 +976,9 @@ module Rodauth
     # UniqueConstraintViolation.
     def unique_constraint_violation_class
       if db.adapter_scheme == :jdbc && db.database_type == :sqlite
-        # :nocov:
+        # simplecov:disable
         Sequel::ConstraintViolation
-        # :nocov:
+        # simplecov:enable
       else
         Sequel::UniqueConstraintViolation
       end
@@ -952,9 +994,9 @@ module Rodauth
     # CURRENT_TIMESTAMP.
     def set_deadline_value(hash, column, interval)
       if set_deadline_values?
-        # :nocov:
+        # simplecov:disable
         hash[column] = Sequel.date_add(Sequel::CURRENT_TIMESTAMP, interval)
-        # :nocov:
+        # simplecov:enable
       end
     end
 
@@ -968,9 +1010,21 @@ module Rodauth
       false
     end
 
-    # :nocov:
+    def valid_return_to_path?(path)
+      path[0] == "/" &&
+        path[1] != "/" &&
+        path.bytesize <= return_to_path_max_size
+    end
+
+    def set_session_return_to_path(session_key, path=request.fullpath)
+      if request.get? && valid_return_to_path?(path)
+        set_session_value(session_key, path)
+      end
+    end
+
+    # simplecov:disable
     if RUBY_VERSION >= '4.0'
-    # :nocov:
+    # simplecov:enable
       def instance_variables_to_inspect
         instance_variables.reject{|v| instance_variable_get(v).nil?}
       end

data/lib/rodauth/features/change_password.rb

@@ -17,6 +17,7 @@ module Rodauth
 
     translatable_method :new_password_label, 'New Password'
     auth_value_method :new_password_param, 'new-password'
+    translatable_method :concurrent_password_update_message, 'a concurrent password update prevented the password change'
 
     auth_value_methods(
       :change_password_requires_password?,
@@ -38,15 +39,19 @@ module Rodauth
           if change_password_requires_password? && !password_match?(param(password_param))
             throw_error_reason(:invalid_previous_password, invalid_password_error_status, password_param, invalid_previous_password_message)
           end
+          existing_hash = @existing_password_hash_or_salt || get_password_hash
 
           password = param(new_password_param)
           if require_password_confirmation? && password != param(password_confirm_param)
             throw_error_reason(:passwords_do_not_match, unmatched_field_error_status, new_password_param, passwords_do_not_match_message)
           end
 
-          if password_match?(password) 
+          if new_password_matches_current_password?(password) 
             throw_error_reason(:same_as_existing_password, invalid_field_error_status, new_password_param, same_as_existing_password_message)
           end
+          # Don't allow same as existing password check for new password to override
+          # known existing password hash/salt
+          @existing_password_hash_or_salt = existing_hash
 
           unless password_meets_requirements?(password)
             throw_error_status(invalid_field_error_status, new_password_param, password_does_not_meet_requirements_message)
@@ -54,7 +59,11 @@ module Rodauth
 
           transaction do
             before_change_password
-            set_password(password)
+            begin
+              set_password(password)
+            rescue Rodauth::SetPasswordFailure
+              throw_error_reason(:concurrent_password_update, invalid_password_error_status, new_password_param, concurrent_password_update_message)
+            end
             clear_tokens(:change_password)
             after_change_password
           end

data/lib/rodauth/features/confirm_password.rb

@@ -55,7 +55,7 @@ module Rodauth
         set_redirect_error_status(password_authentication_required_error_status)
         set_error_reason :password_authentication_required
         set_redirect_error_flash password_authentication_required_error_flash
-        set_session_value(confirm_password_redirect_session_key, request.fullpath)
+        set_session_return_to_path(confirm_password_redirect_session_key)
         redirect password_authentication_required_redirect
       end
     end

data/lib/rodauth/features/create_account.rb

@@ -94,7 +94,8 @@ module Rodauth
     end
 
     def new_account(login)
-      @account = _new_account(login)
+      @account_retrieval_type = nil
+      set_account(_new_account(login), :new)
     end
 
     def save_account

data/lib/rodauth/features/disallow_password_reuse.rb

@@ -59,11 +59,11 @@ module Rodauth
           database_function_password_match?(:rodauth_previous_password_hash_match, hash_id, password, salt)
         end
       else
-        # :nocov:
+        # simplecov:disable
         previous_password_ds.select_map(previous_password_hash_column).any? do |hash|
           password_hash_match?(hash, password)
         end
-        # :nocov:
+        # simplecov:enable
       end
 
       return true unless match

data/lib/rodauth/features/email_auth.rb

@@ -89,8 +89,17 @@ module Rodauth
       end
 
       r.post do
-        key = session[email_auth_session_key] || param(email_auth_key_param)
-        unless account_from_email_auth_key(key)
+        key = session_param(email_auth_session_key, email_auth_key_param)
+        remove_session_value(email_auth_session_key)
+        select_key_for_update!
+
+        valid = transaction do
+          if key && account_from_email_auth_key(key)
+            remove_email_auth_key == 1
+          end
+        end
+
+        unless valid
           set_redirect_error_status(invalid_key_error_status)
           set_error_reason :invalid_email_auth_key
           set_redirect_error_flash email_auth_error_flash
@@ -131,7 +140,7 @@ module Rodauth
     end
 
     def account_from_email_auth_key(key)
-      @account = _account_from_email_auth_key(key)
+      set_account(_account_from_email_auth_key(key), :email_auth)
     end
 
     def email_auth_email_link
@@ -141,7 +150,7 @@ module Rodauth
     def get_email_auth_key(id)
       ds = email_auth_ds(id)
       ds.where(Sequel::CURRENT_TIMESTAMP > email_auth_deadline_column).delete
-      ds.get(email_auth_key_column)
+      apply_key_for_update(ds).get(email_auth_key_column)
     end
 
     def email_auth_request_form

data/lib/rodauth/features/email_base.rb

@@ -2,6 +2,8 @@
 
 module Rodauth
   Feature.define(:email_base, :EmailBase) do
+    depends :require_domain, :require_hmac_secret
+
     translatable_method :email_subject_prefix, ''
     auth_value_method :require_mail?, true
     auth_value_method :allow_raw_email_token?, false
@@ -9,7 +11,8 @@ module Rodauth
     redirect :default_post_email
 
     auth_value_methods(
-      :email_from
+      :email_from,
+      :allow_param_fallback_for_session_param?
     )
 
     auth_methods(
@@ -18,6 +21,10 @@ module Rodauth
       :send_email
     )
 
+    uses_instance_variables(
+      :@key_for_update
+    )
+
     def post_configure
       super
       require 'mail' if require_mail?
@@ -58,10 +65,38 @@ module Rodauth
       "#{account_id}#{token_separator}#{convert_email_token_key(key)}"
     end
 
+    def session_param(session_key, param_name)
+      unless value = session[session_key]
+        if allow_param_fallback_for_session_param?
+          value = param(param_name)
+        end
+      end
+
+      value
+    end
+
+    def allow_param_fallback_for_session_param?
+      return super if defined?(super)
+      false
+    end
+
     def convert_email_token_key(key)
       convert_token_key(key)
     end
 
+    def select_key_for_update!
+      @key_for_update = true
+    end
+
+    def apply_key_for_update(ds)
+      if @key_for_update
+        @key_for_update = nil
+        ds.for_update
+      else
+        ds
+      end
+    end
+
     def account_from_key(token, status_id=nil)
       id, key = split_token(token)
       return unless key && (id = convert_token_id(id))

data/lib/rodauth/features/http_basic_auth.rb

@@ -4,13 +4,14 @@ module Rodauth
   Feature.define(:http_basic_auth, :HttpBasicAuth) do
     auth_value_method :http_basic_auth_realm, "protected"
     auth_value_method :require_http_basic_auth?, false
+    auth_value_method :logged_in_fallback_to_http_basic_auth?, true # RODAUTH3: false
 
     uses_instance_variables(:@checked_http_basic_auth)
 
     def logged_in?
       ret = super
 
-      if !ret && @checked_http_basic_auth.nil?
+      if !ret && logged_in_fallback_to_http_basic_auth? && @checked_http_basic_auth.nil?
         http_basic_auth
         ret = super
       end
@@ -33,6 +34,10 @@ module Rodauth
       end
     end
 
+    def account_from_session
+      @checked_http_basic_auth ? @account : super
+    end
+
     def http_basic_auth
       unless @checked_http_basic_auth.nil?
         return (@checked_http_basic_auth ? true : nil)

data/lib/rodauth/features/internal_request.rb

@@ -120,6 +120,10 @@ module Rodauth
 
     private
 
+    def allow_param_fallback_for_session_param?
+      true
+    end
+
     def internal_request?
       true
     end

data/lib/rodauth/features/json.rb

@@ -8,7 +8,7 @@ module Rodauth
     translatable_method :json_non_post_error_message, 'non-POST method used in JSON API'
     auth_value_method :json_accept_regexp, /(?:(?:\*|\bapplication)\/\*|\bapplication\/(?:vnd\.api\+)?json\b)/i
     auth_value_method :json_check_accept?, true
-    auth_value_method :json_request_content_type_regexp, /\bapplication\/(?:vnd\.api\+)?json\b/i
+    auth_value_method :json_request_content_type_regexp, /\Aapplication\/(?:vnd\.api\+)?json\b/i
     auth_value_method :json_response_content_type, 'application/json'
     auth_value_method :json_response_custom_error_status?, true
     auth_value_method :json_response_error_status, 400
@@ -81,6 +81,10 @@ module Rodauth
       super
     end
 
+    def allow_param_fallback_for_session_param?
+      use_json?
+    end
+
     def _set_otp_unlock_info
       if use_json?
         json_response[:num_successes] = otp_unlock_num_successes

data/lib/rodauth/features/jwt.rb

@@ -113,12 +113,12 @@ module Rodauth
         secrets.compact!
         secrets
       end
-    # :nocov:
+    # simplecov:disable
     else
       def _jwt_decode_secrets
         jwt_secret
       end
-    # :nocov:
+    # simplecov:enable
     end
 
     def jwt_payload
@@ -145,7 +145,13 @@ module Rodauth
     end
 
     def return_json_response
-      set_jwt
+      case response.status
+      when 405, 406
+        response.headers.delete('authorization')
+      else
+        set_jwt
+      end
+
       super
     end