rodauth 2.46.0 → 2.48.0

data/lib/rodauth/features/sms_codes.rb

@@ -2,7 +2,7 @@
 
 module Rodauth
   Feature.define(:sms_codes, :SmsCodes) do
-    depends :two_factor_base
+    depends :two_factor_base, :require_domain
 
     additional_form_tags 'sms_auth'
     additional_form_tags 'sms_confirm'
@@ -176,6 +176,9 @@ module Rodauth
 
       r.post do
         transaction do
+          @sms = sms_ds.for_update.first
+          require_sms_available
+
           if sms_code_match?(param(sms_code_param))
             before_sms_auth
             sms_remove_failures

data/lib/rodauth/features/two_factor_base.rb

@@ -158,7 +158,7 @@ module Rodauth
     def require_two_factor_authenticated
       unless two_factor_authenticated?
         if two_factor_auth_return_to_requested_location?
-          set_session_value(two_factor_auth_redirect_session_key, request.fullpath)
+          set_session_return_to_path(two_factor_auth_redirect_session_key)
         end
         set_redirect_error_status(two_factor_need_authentication_error_status)
         set_error_reason :two_factor_need_authentication
@@ -262,6 +262,7 @@ module Rodauth
     end
 
     def two_factor_update_session(auth_type)
+      raise Error, "attempt to have two factor authentication using same factor" if authenticated_by.include?(auth_type)
       authenticated_by << auth_type
       set_session_value(two_factor_setup_session_key, true)
     end

data/lib/rodauth/features/update_password_hash.rb

@@ -9,7 +9,11 @@ module Rodauth
     def password_match?(password)
       if (result = super) && update_password_hash?
         @update_password_hash = false
-        set_password(password)
+        begin
+          set_password(password)
+        rescue Rodauth::SetPasswordFailure
+          return false
+        end
       end
 
       result

data/lib/rodauth/features/verify_account.rb

@@ -114,30 +114,30 @@ module Rodauth
       end
 
       r.post do
-        key = session[verify_account_session_key] || param(verify_account_key_param)
-        unless account_from_verify_account_key(key)
-          set_redirect_error_status(invalid_key_error_status)
-          set_error_reason :invalid_verify_account_key
-          set_redirect_error_flash verify_account_error_flash
-          redirect verify_account_redirect
-        end
+        key = session_param(verify_account_session_key, verify_account_key_param)
+        select_key_for_update!
 
         catch_error do
-          if verify_account_set_password?
-            password = param(password_param)
+          transaction do
+            handle_invalid_verify_account_key unless key && account_from_verify_account_key(key)
 
-            if require_password_confirmation? && password != param(password_confirm_param)
-              throw_error_reason(:passwords_do_not_match, unmatched_field_error_status, password_param, passwords_do_not_match_message)
-            end
+            if verify_account_set_password?
+              password = param(password_param)
+
+              if require_password_confirmation? && password != param(password_confirm_param)
+                throw_error_reason(:passwords_do_not_match, unmatched_field_error_status, password_param, passwords_do_not_match_message)
+              end
 
-            unless password_meets_requirements?(password)
-              throw_error_status(invalid_field_error_status, password_param, password_does_not_meet_requirements_message)
+              unless password_meets_requirements?(password)
+                throw_error_status(invalid_field_error_status, password_param, password_does_not_meet_requirements_message)
+              end
             end
-          end
 
-          transaction do
             before_verify_account
-            verify_account
+            unless verify_account
+              remove_verify_account_key
+              handle_invalid_verify_account_key
+            end
             if verify_account_set_password?
               set_password(password)
             end
@@ -171,7 +171,8 @@ module Rodauth
     end
 
     def verify_account
-      update_account(account_status_column=>account_open_status_value) == 1
+      ds = account_ds.where(account_status_column=>account_unverified_status_value)
+      update_account({account_status_column=>account_open_status_value}, ds) == 1
     end
 
     def verify_account_email_resend
@@ -196,7 +197,7 @@ module Rodauth
     end
 
     def account_from_verify_account_key(key)
-      @account = _account_from_verify_account_key(key)
+      set_account(_account_from_verify_account_key(key), :verify_account)
     end
 
     def account_initial_status_value
@@ -208,7 +209,7 @@ module Rodauth
     end
 
     def get_verify_account_key(id)
-      verify_account_ds(id).get(verify_account_key_column)
+      apply_key_for_update(verify_account_ds(id)).get(verify_account_key_column)
     end
 
     def skip_status_checks?
@@ -318,5 +319,13 @@ module Rodauth
     def _account_from_verify_account_key(token)
       account_from_key(token, account_unverified_status_value){|id| get_verify_account_key(id)}
     end
+
+    def handle_invalid_verify_account_key
+      remove_session_value(verify_account_session_key)
+      set_redirect_error_status(invalid_key_error_status)
+      set_error_reason :invalid_verify_account_key
+      set_redirect_error_flash verify_account_error_flash
+      redirect verify_account_redirect
+    end
   end
 end

data/lib/rodauth/features/verify_login_change.rb

@@ -74,15 +74,18 @@ module Rodauth
       end
 
       r.post do
-        key = session[verify_login_change_session_key] || param(verify_login_change_key_param)
-        unless account_from_verify_login_change_key(key)
-          set_redirect_error_status(invalid_key_error_status)
-          set_error_reason :invalid_verify_login_change_key
-          set_redirect_error_flash verify_login_change_error_flash
-          redirect verify_login_change_redirect
-        end
+        key = session_param(verify_login_change_session_key, verify_login_change_key_param)
+        remove_session_value(verify_login_change_session_key)
+        select_key_for_update!
 
         transaction do
+          unless key && account_from_verify_login_change_key(key)
+            set_redirect_error_status(invalid_key_error_status)
+            set_error_reason :invalid_verify_login_change_key
+            set_redirect_error_flash verify_login_change_error_flash
+            redirect verify_login_change_redirect
+          end
+
           before_verify_login_change
           unless verify_login_change
             set_redirect_error_status(invalid_key_error_status)
@@ -98,7 +101,6 @@ module Rodauth
           autologin_session('verify_login_change')
         end
 
-        remove_session_value(verify_login_change_session_key)
         verify_login_change_response
       end
     end
@@ -120,7 +122,7 @@ module Rodauth
     end
 
     def account_from_verify_login_change_key(key)
-      @account = _account_from_verify_login_change_key(key)
+      set_account(_account_from_verify_login_change_key(key), :verify_login_change)
     end
 
     def send_verify_login_change_email(login)
@@ -132,7 +134,9 @@ module Rodauth
     end
 
     def get_verify_login_change_login_and_key(id)
-      verify_login_change_ds(id).get([verify_login_change_login_column, verify_login_change_key_column])
+      ds = verify_login_change_ds(id)
+      ds.where(Sequel::CURRENT_TIMESTAMP > verify_login_change_deadline_column).delete
+      apply_key_for_update(ds).get([verify_login_change_login_column, verify_login_change_key_column])
     end
 
     def change_login_notice_flash
@@ -210,10 +214,14 @@ module Rodauth
     end
 
     def _account_from_verify_login_change_key(token)
-      account_from_key(token) do |id|
+      account_from_key(token, verify_login_change_account_status_value) do |id|
         @verify_login_change_new_login, key = get_verify_login_change_login_and_key(id)
         key
       end
     end
+
+    def verify_login_change_account_status_value
+      account_open_status_value
+    end
   end
 end

data/lib/rodauth/features/webauthn.rb

@@ -4,7 +4,7 @@ require 'webauthn'
 
 module Rodauth
   Feature.define(:webauthn, :Webauthn) do
-    depends :two_factor_base
+    depends :two_factor_base, :require_domain, :require_hmac_secret
 
     loaded_templates %w'webauthn-setup webauthn-auth webauthn-remove'
 
@@ -164,7 +164,7 @@ module Rodauth
     end
     
     route(:webauthn_setup) do |r|
-      require_authentication unless two_factor_login_type_match?('webauthn')
+      require_authentication unless webauthn_modification_authenticated?
       require_account_session
       before_webauthn_setup_route
 
@@ -185,7 +185,7 @@ module Rodauth
               raise Sequel::Rollback
             end
 
-            unless two_factor_authenticated?
+            if !two_factor_authenticated? && !authenticated_by.include?('webauthn')
               webauthn_update_session(webauthn_credential.id)
               two_factor_update_session('webauthn')
             end
@@ -205,7 +205,7 @@ module Rodauth
     end
 
     route(:webauthn_remove) do |r|
-      require_authentication unless two_factor_login_type_match?('webauthn')
+      require_authentication unless webauthn_modification_authenticated?
       require_account_session
       require_webauthn_setup
       before_webauthn_remove_route
@@ -290,9 +290,9 @@ module Rodauth
           # it is safe for the second one to use the webauthn user id inserted by the other request.
           # If there is still no webauthn user id at this point, then we'll just reraise the
           # exception.
-          # :nocov:
+          # simplecov:disable
           raise e unless webauthn_id = webauthn_user_ids_ds.get(webauthn_user_ids_webauthn_id_column)
-          # :nocov:
+          # simplecov:enable
         end
       end
 
@@ -419,7 +419,7 @@ module Rodauth
             name: webauthn_rp_name,
           )
         end
-      # :nocov:
+      # simplecov:disable
       else
         def webauthn_relying_party
           WebAuthn::RelyingParty.new(
@@ -428,7 +428,7 @@ module Rodauth
             name: webauthn_rp_name,
           )
         end
-      # :nocov:
+      # simplecov:enable
       end
 
       def webauthn_create_relying_party_opts
@@ -443,7 +443,7 @@ module Rodauth
       def _override_webauthn_credential_response_verify(webauthn_credential)
         # no need to override
       end
-    # :nocov:
+    # simplecov:disable
     else
       def webauthn_create_relying_party_opts
         {:rp => {:name=>webauthn_rp_name, :id=>webauthn_rp_id}}
@@ -466,7 +466,12 @@ module Rodauth
           super(expected_challenge, expected_origin || origin, **kw)
         end
       end
-    # :nocov:
+    # simplecov:enable
+    end
+
+    def webauthn_modification_authenticated?
+      two_factor_login_type_match?('webauthn') &&
+        (!uses_two_factor_authentication? || two_factor_modifications_require_password?)
     end
 
     def _two_factor_auth_links
@@ -501,7 +506,7 @@ module Rodauth
     end
 
     def webauthn_account_id
-      session_value
+      account_id_or_session_value
     end
 
     def webauthn_user_ids_ds

data/lib/rodauth/features/webauthn_login.rb

@@ -76,7 +76,7 @@ module Rodauth
     end
 
     def account_from_webauthn_login
-      account_from_login(login_param_value)
+      @account_retrieval_type == :login ? @account : account_from_login(login_param_value)
     end
 
     def webauthn_login_options?
@@ -91,14 +91,5 @@ module Rodauth
       end
       forms
     end
-
-    def webauthn_account_id
-      case @current_route
-      when :login, :webauthn_login, nil # nil for internal request
-        account_id
-      else
-        super
-      end
-    end
   end
 end

data/lib/rodauth/features/webauthn_verify_account.rb

@@ -40,9 +40,5 @@ module Rodauth
       @webauthn_credential = webauthn_setup_credential_from_form_submission
       add_webauthn_credential(@webauthn_credential)
     end
-
-    def webauthn_account_id
-      super || account_id
-    end
   end
 end

data/lib/rodauth/version.rb

@@ -6,7 +6,7 @@ module Rodauth
   MAJOR = 2
 
   # The minor version of Rodauth, updated for new feature releases of Rodauth.
-  MINOR = 46
+  MINOR = 48
 
   # The patch version of Rodauth, updated only for bug fixes from the last
   # feature release.

data/lib/rodauth.rb

@@ -7,6 +7,8 @@ module Rodauth
   SCOPE_INSTANCE_VARIABLES = [:@_rodauths, :@_rodauth].freeze
 
   class ConfigurationError < StandardError; end
+  class Error < StandardError; end
+  class SetPasswordFailure < Error; end
 
   def self.lib(opts=OPTS, &block) 
     require 'roda'
@@ -36,9 +38,9 @@ module Rodauth
       when false
         # nothing
       when :rack_csrf
-        # :nocov:
+        # simplecov:disable
         app.plugin :csrf
-        # :nocov:
+        # simplecov:enable
       else
         app.plugin :route_csrf
       end
@@ -184,9 +186,9 @@ module Rodauth
       feature.module_eval(&block)
       configuration.def_configuration_methods(feature)
 
-      # :nocov:
+      # simplecov:disable
       if constant
-      # :nocov:
+      # simplecov:enable
         Rodauth.const_set(constant, feature)
         Rodauth::FeatureConfiguration.const_set(constant, configuration)
       end
@@ -209,9 +211,9 @@ module Rodauth
     if RUBY_VERSION >= '2.5'
       DEPRECATED_ARGS = [{:uplevel=>1}]
     else
-      # :nocov:
+      # simplecov:disable
       DEPRECATED_ARGS = []
-      # :nocov:
+      # simplecov:enable
     end
     def def_deprecated_alias(new, old)
       configuration_module_eval do
@@ -346,7 +348,7 @@ module Rodauth
       auth_private_methods(meth)
     end
 
-    # :nocov:
+    # simplecov:disable
     def auth_cached_method(meth, iv=:"@#{meth}") # :nodoc:
       # Non-shape friendly historical method.
       # RODAUTH3: Remove
@@ -361,7 +363,7 @@ module Rodauth
       alias_method(meth, meth)
       auth_private_methods(meth)
     end
-    # :nocov:
+    # simplecov:enable
 
     [:notice_flash, :error_flash, :button].each do |meth|
       define_method(meth) do |v, name=feature_name|
@@ -375,11 +377,11 @@ module Rodauth
 
     def initialize(auth, &block)
       @auth = auth
-      # :nocov:
+      # simplecov:disable
       # Only for backwards compatibility
       # RODAUTH3: Remove
       apply(&block) if block
-      # :nocov:
+      # simplecov:enable
     end
 
     def apply(&block)
@@ -469,12 +471,12 @@ module Rodauth
 
           ivs
         end
-      # :nocov:
+      # simplecov:disable
       else
         def make_shape_friendly # :nodoc:
         end
       end
-      # :nocov:
+      # simplecov:enable
     end
 
     def self.inherited(subclass)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rodauth
 version: !ruby/object:Gem::Version
-  version: 2.46.0
+  version: 2.48.0
 platform: ruby
 authors:
 - Jeremy Evans
@@ -293,6 +293,8 @@ files:
 - lib/rodauth/features/path_class_methods.rb
 - lib/rodauth/features/recovery_codes.rb
 - lib/rodauth/features/remember.rb
+- lib/rodauth/features/require_domain.rb
+- lib/rodauth/features/require_hmac_secret.rb
 - lib/rodauth/features/reset_password.rb
 - lib/rodauth/features/reset_password_notify.rb
 - lib/rodauth/features/reset_password_verifies_account.rb
@@ -405,7 +407,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Authentication and Account Management Framework for Rack Applications
 test_files: []