rodauth 2.20.0 → 2.21.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 534a50718fe362e695a9fbd8043d1ce05ca211de2049b1351207bd5d11cbf962
-  data.tar.gz: 9afd5a7d79dde11005b090ca18591661c55c2647387a151b0d732ef97f51f633
+  metadata.gz: bb1777533bb6a941212c0e6d5be00fc393b95c3d22e7af40542d616cdd68d139
+  data.tar.gz: de6a798803940fb94ff1d44bc2d148e45b1adc8e532cb44db4602b974a1b6b19
 SHA512:
-  metadata.gz: f10082d21fad4783ad6193dc7e1dfe55bc5f57c98b33e1b6f6583dbaa0e921f4d40025e935f93aef9706078232956bcde2fec4e8838b1c2ee4f49a8885c22520
-  data.tar.gz: 8ca004055be7ee660a37f2657d6752dbe2318b30100204e8eb68c514229422158db3f513a1d9e90eb532535bdbdf5854f66834212cc43fb81f8f9b8872221af5
+  metadata.gz: 830b574f78cba6d5e103306f3709e2ae92e99af0cb0b02c8276699c048cd799cad58cf28d521980e43c0023aadc8934705ad45ff48819c316b3c6d3b5554f189
+  data.tar.gz: d4127705f604ac89b35f17d795c07bd54bed86b6c9c784e04578f047a3b1d2e34689c0320c35ffe9f7640e7870197c6563c4c57c0867ca5d2d257d23a143ce1a

data/CHANGELOG

@@ -1,3 +1,15 @@
+=== 2.21.0 (2022-02-23)
+
+* Avoid extra bcrypt hashing on account verification when using account_password_hash_column (janko) (#217)
+
+* Make require_account public (janko) (#212)
+
+* Force specific date/time format when displaying webauthn last use time (jeremyevans)
+
+* Automatically clear the session in require_login if users go beyond verify account grace period (janko) (#211)
+
+* Fix typo in default value of global_logout_label in active_sessions plugin (sterlzbd) (#209)
+
 === 2.20.0 (2022-01-24)
 
 * Change the default implementation of webauth_rp_id to not include the port (jeremyevans) (#203)

data/README.rdoc

@@ -990,6 +990,10 @@ require_authentication :: Similar to +require_login+, but also requires
                           two factor authentication.  Redirects the request to
                           the two factor authentication page if logged in but not
                           authenticated via two factors.
+require_account :: Similar to +require_authentication+, but also loads the logged
+                   in account to ensure it exists in the database.  If the account
+                   doesn't exist, or if it exists but isn't verified, the session
+                   is cleared and the request redirected to the login page.
 logged_in? :: Whether the session has been logged in.
 authenticated? :: Similar to +logged_in?+, but if the account has setup two
                   factor authentication, whether the session has authenticated

data/doc/release_notes/2.21.0.txt

@@ -0,0 +1,28 @@
+= Improvements
+
+* When using the verify_account_grace_period feature, if the grace
+  period has expired for currently logged in session, require_login
+  will clear the session and redirect to the login page.  This is
+  implemented by having the unverified_account_session_key store the
+  time of expiration, as an integer.
+
+* The previously private require_account method is now public. The
+  method is used internally by Rodauth to check that not only is the
+  current session logged in, but also that the account related to the
+  currently logged in session still exists in the database.  The only
+  reason you would want to call require_account instead of
+  require_authentication is if you want to handle cases where there
+  can be logged in sessions for accounts that have been deleted.
+
+* Rodauth now avoids an unnecessary bcrypt hash calculation when
+  updating accounts when using the account_password_hash_column
+  configuration method.
+
+* When WebAuthn token last use times are displayed, Rodauth now uses a
+  fixed format of YYYY-MM-DD HH:MM:SS, instead of relying on
+  Time#to_s.  If this presents an problem for your application, please
+  open an issue and we can add a configuration method to control
+  the behavior.
+
+* A typo in the default value of global_logout_label in the
+  active_sessions feature has been fixed.

data/lib/rodauth/features/active_sessions.rb

@@ -13,7 +13,7 @@ module Rodauth
     auth_value_method :active_sessions_last_use_column, :last_use
     auth_value_method :active_sessions_session_id_column, :session_id
     auth_value_method :active_sessions_table, :account_active_session_keys
-    translatable_method :global_logout_label, 'Logout all Logged In Sessons?'
+    translatable_method :global_logout_label, 'Logout all Logged In Sessions?'
     auth_value_method :global_logout_param, 'global_logout'
     auth_value_method :inactive_session_error_status, 401
     auth_value_method :session_inactivity_deadline, 86400

data/lib/rodauth/features/base.rb

@@ -338,6 +338,11 @@ module Rodauth
       require_login
     end
 
+    def require_account
+      require_authentication
+      require_account_session
+    end
+
     def account_initial_status_value
       account_open_status_value
     end
@@ -524,11 +529,6 @@ module Rodauth
       Rack::Utils.secure_compare(provided.ljust(actual.length), actual) && provided.length == actual.length
     end
 
-    def require_account
-      require_authentication
-      require_account_session
-    end
-
     def require_account_session
       unless account_from_session
         clear_session
@@ -756,7 +756,7 @@ module Rodauth
       num = ds.update(values)
       if num == 1
         values.each do |k, v|
-          account[k] = v == Sequel::CURRENT_TIMESTAMP ? Time.now : v
+          account[k] = Sequel::CURRENT_TIMESTAMP == v ? Time.now : v
         end
       end
       num

data/lib/rodauth/features/verify_account_grace_period.rb

@@ -30,10 +30,17 @@ module Rodauth
       false
     end
 
+    def require_login
+      if unverified_grace_period_expired?
+        clear_session
+      end
+      super
+    end
+
     def update_session
       super
       if account_in_unverified_grace_period?
-        set_session_value(unverified_account_session_key, true)
+        set_session_value(unverified_account_session_key, Time.now.to_i + verify_account_grace_period)
       end
     end
 
@@ -78,6 +85,11 @@ module Rodauth
         !verify_account_ds.where(Sequel.date_add(verification_requested_at_column, :seconds=>verify_account_grace_period) > Sequel::CURRENT_TIMESTAMP).empty?
     end
 
+    def unverified_grace_period_expired?
+      return false unless expires_at = session[unverified_account_session_key]
+      expires_at.is_a?(Integer) && Time.now.to_i > expires_at
+    end
+
     def use_date_arithmetic?
       true
     end

data/lib/rodauth/version.rb

@@ -6,7 +6,7 @@ module Rodauth
   MAJOR = 2
 
   # The minor version of Rodauth, updated for new feature releases of Rodauth.
-  MINOR = 20
+  MINOR = 21
 
   # The patch version of Rodauth, updated only for bug fixes from the last
   # feature release.

data/templates/webauthn-remove.str

@@ -4,6 +4,7 @@
   #{rodauth.render('password-field') if rodauth.two_factor_modifications_require_password?}
   <fieldset class="form-group mb-3">
     #{(usage = rodauth.account_webauthn_usage; last_id = usage.keys.last; usage;).map do |id, last_use|
+      last_use = last_use.strftime("%F %T") if last_use.is_a?(Time)
       input = rodauth.input_field_string(rodauth.webauthn_remove_param, "webauthn-remove-#{h id}", :type=>'radio', :class=>"form-check-input", :skip_error_message=>true, :value=>id, :required=>false)
       label = "<label class=\"rodauth-webauthn-id form-check-label\" for=\"webauthn-remove-#{h id}\">Last Use: #{last_use}</label>"
       error = rodauth.formatted_field_error(rodauth.webauthn_remove_param) if id == last_id

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth
 version: !ruby/object:Gem::Version
-  version: 2.20.0
+  version: 2.21.0
 platform: ruby
 authors:
 - Jeremy Evans
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-01-24 00:00:00.000000000 Z
+date: 2022-02-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sequel
@@ -335,6 +335,7 @@ extra_rdoc_files:
 - doc/release_notes/2.19.0.txt
 - doc/release_notes/2.2.0.txt
 - doc/release_notes/2.20.0.txt
+- doc/release_notes/2.21.0.txt
 - doc/release_notes/2.3.0.txt
 - doc/release_notes/2.4.0.txt
 - doc/release_notes/2.5.0.txt
@@ -442,6 +443,7 @@ files:
 - doc/release_notes/2.19.0.txt
 - doc/release_notes/2.2.0.txt
 - doc/release_notes/2.20.0.txt
+- doc/release_notes/2.21.0.txt
 - doc/release_notes/2.3.0.txt
 - doc/release_notes/2.4.0.txt
 - doc/release_notes/2.5.0.txt
@@ -596,7 +598,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.3
+rubygems_version: 3.3.7
 signing_key: 
 specification_version: 4
 summary: Authentication and Account Management Framework for Rack Applications