rodauth 1.3.0 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1ee1b5d6f6b049a4fcd965ce0de9d2c15ce159e5
-  data.tar.gz: 14afd3681ed969ae8eb3edf3f35f66667df22d27
+  metadata.gz: eedc388675de95e1b6d8f6281bc57cefb262eec9
+  data.tar.gz: 725710de442759eba54e3a2245e2ed08af52d479
 SHA512:
-  metadata.gz: b9de71675de5bf39eafd398479d4917bfe342e619f21c9fa3d7c26223c00591541ac8dc22f58358aa579dc02515e1648816153d4c2f5dc6098cbda208c774ae0
-  data.tar.gz: fd038a8458ac8a88f3ca6bec26c4642a10eabf130ba2e14bbefbbc45e5f2136e4edf59452ff8d6deb43ae08ff9e9f05f09ad75a4a73bb6500a88e82bfd0526eb
+  metadata.gz: c354d87afa1dac53d2589b2626a17841e33b3f3041145cf88ccaef9ad4a4041a94b1a5140b88e7fb43af7de8efde7ad26f34fec0a5f79b962617656eccb10a35
+  data.tar.gz: acc6f4b368095dafb9d102642b5da105405475fd73fae8e31c162fe086cb8f7baf849052a9274d6e64f5988b98bf7e4319595c8a746190b1edd6dd529414ded6

data/CHANGELOG

@@ -1,3 +1,7 @@
+=== 1.4.0 (2016-08-18)
+
+* Add update_password_hash feature, for updating the password hash when the hash cost changes (jeremyevans)
+
 === 1.3.0 (2016-07-19)
 
 * Add login_maximum_length, defaulting to 255 (jeremyevans)

data/README.rdoc

@@ -39,6 +39,7 @@ hashes by protecting access via database functions.
 * Session Expiration
 * Single Session (Only one active session per account)
 * JWT (JSON API support for all other features)
+* Update Password Hash (when hash cost changes)
 
 == Resources
 

data/doc/release_notes/1.4.0.txt

@@ -0,0 +1,11 @@
+= New Features
+
+* A update_password_hash feature has been added, which will update
+  the password hash for the account whenever the account's current 
+  password hash has a cost different from the currently configured
+  password hash cost.
+
+  This allows you to increase the password hash cost for all
+  accounts or for certain types of accounts, and have the password
+  hashes automatically updated to use the new cost the next time the
+  correct password is provided for the account.

data/doc/update_password_hash.rdoc

@@ -0,0 +1,7 @@
+= Documentation for Update Password Hash Feature
+
+The update password hash feature updates the hash for the password whenever
+the hash cost changes.  For example, if you have a cost of 8, and later
+increase the cost to 10, anytime the user authenticates correctly with
+their password, their password hash will change from one that uses a cost
+of 8 to one that uses a cost of 10.

data/lib/rodauth/features/base.rb

@@ -246,20 +246,12 @@ module Rodauth
     end
 
     def password_match?(password)
-      if account_password_hash_column
-        BCrypt::Password.new(account[account_password_hash_column]) == password
-      elsif use_database_authentication_functions?
-        id = account_id
-        if salt = db.get(Sequel.function(function_name(:rodauth_get_salt), id))
-          hash = BCrypt::Engine.hash_secret(password, salt)
-          db.get(Sequel.function(function_name(:rodauth_valid_password_hash), id, hash))
-        end
-      else
-        # :nocov:
-        if hash = password_hash_ds.get(password_hash_column)
+      if hash = get_password_hash
+        if account_password_hash_column || !use_database_authentication_functions?
           BCrypt::Password.new(hash) == password
-        end
-        # :nocov:
+        else
+          db.get(Sequel.function(function_name(:rodauth_valid_password_hash), account_id, BCrypt::Engine.hash_secret(password, hash)))
+        end 
       end
     end
 
@@ -358,6 +350,20 @@ module Rodauth
       end
     end
 
+    # Get the password hash for the user.  When using database authentication functions,
+    # note that only the salt is returned.
+    def get_password_hash
+      if account_password_hash_column
+        account[account_password_hash_column]
+      elsif use_database_authentication_functions?
+        db.get(Sequel.function(function_name(:rodauth_get_salt), account_id))
+      else
+        # :nocov:
+        password_hash_ds.get(password_hash_column)
+        # :nocov:
+      end
+    end
+
     def _account_from_login(login)
       ds = db[accounts_table].where(login_column=>login)
       ds = ds.select(*account_select) if account_select

data/lib/rodauth/features/login_password_requirements_base.rb

@@ -56,7 +56,7 @@ module Rodauth
         update_account(account_password_hash_column=>hash)
       elsif password_hash_ds.update(password_hash_column=>hash) == 0
         # This shouldn't raise a uniqueness error, as the update should only fail for a new user,
-        # and an existing user shouldn't always havae a valid password hash row.  If this does
+        # and an existing user should always have a valid password hash row.  If this does
         # fail, retrying it will cause problems, it will override a concurrently running update
         # with potentially a different password.
         db[password_hash_table].insert(password_hash_id_column=>account_id, password_hash_column=>hash)

data/lib/rodauth/features/update_password_hash.rb

@@ -0,0 +1,29 @@
+# frozen-string-literal: true
+
+module Rodauth
+  UpdatePasswordHash = Feature.define(:update_password_hash) do
+    depends :login_password_requirements_base
+
+    def password_match?(password)
+      if (result = super) && update_password_hash?
+        set_password(password)
+      end
+
+      result
+    end
+
+    private
+
+    def update_password_hash?
+      password_hash_cost != @current_password_hash_cost
+    end
+
+    def get_password_hash
+      if hash = super
+        @current_password_hash_cost = hash.split('$')[2].to_i
+      end
+
+      hash
+    end
+  end
+end

data/lib/rodauth/version.rb

@@ -1,7 +1,7 @@
 # frozen-string-literal: true
 
 module Rodauth
-  VERSION = '1.3.0'.freeze
+  VERSION = '1.4.0'.freeze
 
   def self.version
     VERSION

data/spec/update_password_hash_spec.rb

@@ -0,0 +1,40 @@
+require File.expand_path("spec_helper", File.dirname(__FILE__))
+
+describe 'Rodauth update_password feature' do
+  [false, true].each do |ph|
+    it "should support updating passwords for accounts #{'with account_password_hash_column' if ph} if hash cost changes" do
+      cost = BCrypt::Engine::MIN_COST
+      rodauth do
+        enable :login, :logout, :update_password_hash
+        account_password_hash_column :ph if ph
+        password_hash_cost{cost}
+      end
+      roda do |r|
+        r.rodauth
+        next unless session[:account_id]
+        rodauth.account_from_session
+        r.root{rodauth.send(:get_password_hash)}
+      end
+
+      login
+      content = page.html
+
+      logout
+      login
+      page.current_path.must_equal '/'
+      content.must_equal page.html
+
+      cost += 1
+      logout
+      login
+      new_content = page.html
+      page.current_path.must_equal '/'
+      content.wont_equal new_content
+
+      logout
+      login
+      page.current_path.must_equal '/'
+      new_content.must_equal page.html
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.4.0
 platform: ruby
 authors:
 - Jeremy Evans
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-07-19 00:00:00.000000000 Z
+date: 2016-08-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sequel
@@ -224,10 +224,12 @@ extra_rdoc_files:
 - doc/verify_account_grace_period.rdoc
 - doc/confirm_password.rdoc
 - doc/verify_change_login.rdoc
+- doc/update_password_hash.rdoc
 - doc/release_notes/1.0.0.txt
 - doc/release_notes/1.1.0.txt
 - doc/release_notes/1.2.0.txt
 - doc/release_notes/1.3.0.txt
+- doc/release_notes/1.4.0.txt
 files:
 - CHANGELOG
 - MIT-LICENSE
@@ -256,12 +258,14 @@ files:
 - doc/release_notes/1.1.0.txt
 - doc/release_notes/1.2.0.txt
 - doc/release_notes/1.3.0.txt
+- doc/release_notes/1.4.0.txt
 - doc/remember.rdoc
 - doc/reset_password.rdoc
 - doc/session_expiration.rdoc
 - doc/single_session.rdoc
 - doc/sms_codes.rdoc
 - doc/two_factor_base.rdoc
+- doc/update_password_hash.rdoc
 - doc/verify_account.rdoc
 - doc/verify_account_grace_period.rdoc
 - doc/verify_change_login.rdoc
@@ -292,6 +296,7 @@ files:
 - lib/rodauth/features/single_session.rb
 - lib/rodauth/features/sms_codes.rb
 - lib/rodauth/features/two_factor_base.rb
+- lib/rodauth/features/update_password_hash.rb
 - lib/rodauth/features/verify_account.rb
 - lib/rodauth/features/verify_account_grace_period.rb
 - lib/rodauth/features/verify_change_login.rb
@@ -321,6 +326,7 @@ files:
 - spec/single_session_spec.rb
 - spec/spec_helper.rb
 - spec/two_factor_spec.rb
+- spec/update_password_hash_spec.rb
 - spec/verify_account_grace_period_spec.rb
 - spec/verify_account_spec.rb
 - spec/verify_change_login_spec.rb