rodauth 2.46.0 → 2.47.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5f2f00f0b0ca5043b852e3f544a666c066b5df09445a4d0031351e37d101bdbf
-  data.tar.gz: 387de7af25a3d6f4823cc09818d374ff99f1a35ffe8a0329efe107810667cdd6
+  metadata.gz: 680f1b9dda9f8dd15399a7a7d1a990ea65299b6d9fb1d42646f9d8661a14b927
+  data.tar.gz: e7dd526eb3f3d0cfb1d7b470bd2e9d604e6fe7784657fe6449e1d2b9b128c9f3
 SHA512:
-  metadata.gz: 26088c4dc223cdc9f72a07a0de27bff3a3678b29264a46554733d103106443988ac524553f8afa4cb7a457d0cf51c25646adbdf8bd158a7488db449dfc09f7ee
-  data.tar.gz: da69371a181d62e7ebb74274c56503565e64be26a808dede0df3f7b7c1e230efa5442f35d99609c138439703d2f97335968a0ee720c83c9819ae0de363269046
+  metadata.gz: 79f9aa12624e42d2520e01b3a760d1b7bbda370aa7e11fa8987cd3f67a62d15a160ceda4c997afbb636caabc8282f5dfb36689d538e86dc8aea3a178902fb0b3
+  data.tar.gz: d183b0f9f350b2321c1ee2cb33ad36d789541d77c2a6ba27082f205dd61fabc0566e881a359d9490bfcccfae853d3e2b3acb30eee02884885e3ebe2838fef358

data/lib/rodauth/features/active_sessions.rb

@@ -2,7 +2,7 @@
 
 module Rodauth
   Feature.define(:active_sessions, :ActiveSessions) do
-    depends :logout
+    depends :logout, :require_hmac_secret
 
     error_flash 'This session has been logged out'
     redirect
@@ -235,7 +235,7 @@ module Rodauth
 
     def active_sessions_ds
       db[active_sessions_table].
-        where(active_sessions_account_id_column=>session_value || account_id)
+        where(active_sessions_account_id_column=>account_id_or_session_value)
     end
 
     def use_date_arithmetic?

data/lib/rodauth/features/audit_logging.rb

@@ -30,8 +30,9 @@ module Rodauth
 
     def hook_action(hook_type, action)
       super
+
       # In after_logout, session is already cleared, so use before_logout in that case
-      if (hook_type == :after || action == :logout) && (id = account ? account_id : session_value)
+      if (hook_type == :after || action == :logout) && (id = account_id_or_session_value)
         add_audit_log(id, action)
       end
     end

data/lib/rodauth/features/base.rb

@@ -68,6 +68,7 @@ module Rodauth
     auth_value_method :prefix, ''
     auth_value_method :session_key_prefix, nil
     auth_value_method :require_bcrypt?, true
+    auth_value_method :return_to_path_max_size, 2048
     auth_value_method :mark_input_fields_as_required?, true
     auth_value_method :mark_input_fields_with_autocomplete?, true
     auth_value_method :mark_input_fields_with_inputmode?, true
@@ -101,6 +102,7 @@ module Rodauth
 
     auth_methods(
       :account_id,
+      :account_reload,
       :account_session_value,
       :already_logged_in,
       :authenticated?,
@@ -115,6 +117,7 @@ module Rodauth
       :inputmode_for_field?,
       :logged_in?,
       :login_required,
+      :missing_recommended_configuration,
       :normalize_login,
       :null_byte_parameter_value,
       :open_account?,
@@ -130,7 +133,8 @@ module Rodauth
       :set_error_reason,
       :set_title,
       :translate,
-      :update_session
+      :update_session,
+      :valid_return_to_path?
     )
 
     auth_private_methods(
@@ -164,7 +168,9 @@ module Rodauth
       :@current_route,
       :@field_errors,
       :@password_field_autocomplete_value,
-      :@has_password
+      :@has_password,
+      :@account_retrieval_type,
+      :@existing_password_hash_or_salt
     )
 
     attr_reader :scope
@@ -309,7 +315,7 @@ module Rodauth
     alias logged_in? session_value
 
     def account_from_login(login)
-      @account = _account_from_login(login)
+      set_account(_account_from_login(login), :login)
     end
 
     def open_account?
@@ -337,10 +343,12 @@ module Rodauth
     end
 
     def check_already_logged_in
+      # RODAUTH3: Move to login feature
       already_logged_in if logged_in?
     end
 
     def already_logged_in
+      # RODAUTH3: Move to login feature, halt or redirect by default
       nil
     end
 
@@ -414,15 +422,15 @@ module Rodauth
     end
 
     def account!
-      account || (session_value && account_from_session)
+      @account_retrieval_type ? @account : (session_value && account_from_session)
     end
 
     def account_from_session
-      @account = _account_from_session
+      set_account(_account_from_session, :session)
     end
 
     def account_from_id(id, status_id=nil)
-      @account = _account_from_id(id, status_id)
+      set_account(_account_from_id(id, status_id), :id)
     end
 
     def check_csrf
@@ -486,7 +494,7 @@ module Rodauth
     end
 
     def password_match?(password)
-      if hash = get_password_hash
+      if @existing_password_hash_or_salt = hash = get_password_hash
         if account_password_hash_column || !use_database_authentication_functions?
           password_hash_match?(hash, password)
         else
@@ -579,7 +587,7 @@ module Rodauth
 
     def has_password?
       return @has_password unless @has_password.nil?
-      return false unless account || session_value
+      return false unless account_id_or_session_value
       @has_password = !!get_password_hash
     end
 
@@ -599,6 +607,14 @@ module Rodauth
       s
     end
 
+    def account_id_or_session_value
+      if @account
+        account_id
+      elsif !@account_retrieval_type
+        session_value
+      end
+    end
+
     if Rack.release >= '3'
       def set_response_header(key, value)
         response.headers[key] = value
@@ -627,6 +643,7 @@ module Rodauth
         Content-Type
         Content-Length
         WWW-Authenticate
+        Vary
       END
       mixed_case_headers.freeze
       define_method(:convert_response_header_key) do |key|
@@ -649,6 +666,28 @@ module Rodauth
     end
     # :nocov:
 
+    def missing_recommended_configuration(msg)
+      # RODAUTH3: switch to raise ConfigurationError
+      warn msg
+    end
+
+    def account_reload(current_retrieval_type, new_retrieval_type)
+      return unless @current_route
+
+
+      if current_retrieval_type == new_retrieval_type
+        warn "account retrieved multiple times during rodauth route with retrieval type #{current_retrieval_type}"
+      else
+        raise Error, "account retrieved multiple times during rodauth route, original retrieval type: #{current_retrieval_type}, new retrieval type: #{new_retrieval_type}"
+      end
+    end
+
+    def set_account(account, retrieval_type)
+      account_reload(@account_retrieval_type, retrieval_type) if @account_retrieval_type
+      @account_retrieval_type = retrieval_type
+      @account = account
+    end
+
     def database_function_password_match?(name, hash_id, password, salt)
       db.get(Sequel.function(function_name(name), hash_id, password_hash_using_salt(password, salt)))
     end
@@ -823,7 +862,7 @@ module Rodauth
       if account_password_hash_column
         account[account_password_hash_column] if account!
       elsif use_database_authentication_functions?
-        db.get(Sequel.function(function_name(:rodauth_get_salt), account ? account_id : session_value))
+        db.get(Sequel.function(function_name(:rodauth_get_salt), account_id_or_session_value))
       else
         # :nocov:
         password_hash_ds.get(password_hash_column)
@@ -831,6 +870,10 @@ module Rodauth
       end
     end
 
+    def new_password_matches_current_password?(password)
+      password_match?(password)
+    end
+
     def _account_from_login(login)
       ds = account_table_ds.where(login_column=>login)
       ds = ds.select(*account_select) if account_select
@@ -895,7 +938,7 @@ module Rodauth
     end
 
     def password_hash_ds
-      db[password_hash_table].where(password_hash_id_column=>account ? account_id : session_value)
+      db[password_hash_table].where(password_hash_id_column=>account_id_or_session_value)
     end
 
     # This is needed for jdbc/sqlite, which returns timestamp columns as strings
@@ -968,6 +1011,18 @@ module Rodauth
       false
     end
 
+    def valid_return_to_path?(path)
+      path[0] == "/" &&
+        path[1] != "/" &&
+        path.bytesize <= return_to_path_max_size
+    end
+
+    def set_session_return_to_path(session_key, path=request.fullpath)
+      if request.get? && valid_return_to_path?(path)
+        set_session_value(session_key, path)
+      end
+    end
+
     # :nocov:
     if RUBY_VERSION >= '4.0'
     # :nocov:

data/lib/rodauth/features/change_password.rb

@@ -17,6 +17,7 @@ module Rodauth
 
     translatable_method :new_password_label, 'New Password'
     auth_value_method :new_password_param, 'new-password'
+    translatable_method :concurrent_password_update_message, 'a concurrent password update prevented the password change'
 
     auth_value_methods(
       :change_password_requires_password?,
@@ -38,15 +39,19 @@ module Rodauth
           if change_password_requires_password? && !password_match?(param(password_param))
             throw_error_reason(:invalid_previous_password, invalid_password_error_status, password_param, invalid_previous_password_message)
           end
+          existing_hash = @existing_password_hash_or_salt || get_password_hash
 
           password = param(new_password_param)
           if require_password_confirmation? && password != param(password_confirm_param)
             throw_error_reason(:passwords_do_not_match, unmatched_field_error_status, new_password_param, passwords_do_not_match_message)
           end
 
-          if password_match?(password) 
+          if new_password_matches_current_password?(password) 
             throw_error_reason(:same_as_existing_password, invalid_field_error_status, new_password_param, same_as_existing_password_message)
           end
+          # Don't allow same as existing password check for new password to override
+          # known existing password hash/salt
+          @existing_password_hash_or_salt = existing_hash
 
           unless password_meets_requirements?(password)
             throw_error_status(invalid_field_error_status, new_password_param, password_does_not_meet_requirements_message)
@@ -54,7 +59,11 @@ module Rodauth
 
           transaction do
             before_change_password
-            set_password(password)
+            begin
+              set_password(password)
+            rescue Rodauth::SetPasswordFailure
+              throw_error_reason(:concurrent_password_update, invalid_password_error_status, new_password_param, concurrent_password_update_message)
+            end
             clear_tokens(:change_password)
             after_change_password
           end

data/lib/rodauth/features/confirm_password.rb

@@ -55,7 +55,7 @@ module Rodauth
         set_redirect_error_status(password_authentication_required_error_status)
         set_error_reason :password_authentication_required
         set_redirect_error_flash password_authentication_required_error_flash
-        set_session_value(confirm_password_redirect_session_key, request.fullpath)
+        set_session_return_to_path(confirm_password_redirect_session_key)
         redirect password_authentication_required_redirect
       end
     end

data/lib/rodauth/features/create_account.rb

@@ -94,7 +94,8 @@ module Rodauth
     end
 
     def new_account(login)
-      @account = _new_account(login)
+      @account_retrieval_type = nil
+      set_account(_new_account(login), :new)
     end
 
     def save_account

data/lib/rodauth/features/email_auth.rb

@@ -89,8 +89,17 @@ module Rodauth
       end
 
       r.post do
-        key = session[email_auth_session_key] || param(email_auth_key_param)
-        unless account_from_email_auth_key(key)
+        key = session_param(email_auth_session_key, email_auth_key_param)
+        remove_session_value(email_auth_session_key)
+        select_key_for_update!
+
+        valid = transaction do
+          if key && account_from_email_auth_key(key)
+            remove_email_auth_key == 1
+          end
+        end
+
+        unless valid
           set_redirect_error_status(invalid_key_error_status)
           set_error_reason :invalid_email_auth_key
           set_redirect_error_flash email_auth_error_flash
@@ -131,7 +140,7 @@ module Rodauth
     end
 
     def account_from_email_auth_key(key)
-      @account = _account_from_email_auth_key(key)
+      set_account(_account_from_email_auth_key(key), :email_auth)
     end
 
     def email_auth_email_link
@@ -141,7 +150,7 @@ module Rodauth
     def get_email_auth_key(id)
       ds = email_auth_ds(id)
       ds.where(Sequel::CURRENT_TIMESTAMP > email_auth_deadline_column).delete
-      ds.get(email_auth_key_column)
+      apply_key_for_update(ds).get(email_auth_key_column)
     end
 
     def email_auth_request_form

data/lib/rodauth/features/email_base.rb

@@ -2,6 +2,8 @@
 
 module Rodauth
   Feature.define(:email_base, :EmailBase) do
+    depends :require_domain, :require_hmac_secret
+
     translatable_method :email_subject_prefix, ''
     auth_value_method :require_mail?, true
     auth_value_method :allow_raw_email_token?, false
@@ -9,7 +11,8 @@ module Rodauth
     redirect :default_post_email
 
     auth_value_methods(
-      :email_from
+      :email_from,
+      :allow_param_fallback_for_session_param?
     )
 
     auth_methods(
@@ -18,6 +21,10 @@ module Rodauth
       :send_email
     )
 
+    uses_instance_variables(
+      :@key_for_update
+    )
+
     def post_configure
       super
       require 'mail' if require_mail?
@@ -58,10 +65,38 @@ module Rodauth
       "#{account_id}#{token_separator}#{convert_email_token_key(key)}"
     end
 
+    def session_param(session_key, param_name)
+      unless value = session[session_key]
+        if allow_param_fallback_for_session_param?
+          value = param(param_name)
+        end
+      end
+
+      value
+    end
+
+    def allow_param_fallback_for_session_param?
+      return super if defined?(super)
+      false
+    end
+
     def convert_email_token_key(key)
       convert_token_key(key)
     end
 
+    def select_key_for_update!
+      @key_for_update = true
+    end
+
+    def apply_key_for_update(ds)
+      if @key_for_update
+        @key_for_update = nil
+        ds.for_update
+      else
+        ds
+      end
+    end
+
     def account_from_key(token, status_id=nil)
       id, key = split_token(token)
       return unless key && (id = convert_token_id(id))

data/lib/rodauth/features/internal_request.rb

@@ -120,6 +120,10 @@ module Rodauth
 
     private
 
+    def allow_param_fallback_for_session_param?
+      true
+    end
+
     def internal_request?
       true
     end

data/lib/rodauth/features/json.rb

@@ -8,7 +8,7 @@ module Rodauth
     translatable_method :json_non_post_error_message, 'non-POST method used in JSON API'
     auth_value_method :json_accept_regexp, /(?:(?:\*|\bapplication)\/\*|\bapplication\/(?:vnd\.api\+)?json\b)/i
     auth_value_method :json_check_accept?, true
-    auth_value_method :json_request_content_type_regexp, /\bapplication\/(?:vnd\.api\+)?json\b/i
+    auth_value_method :json_request_content_type_regexp, /\Aapplication\/(?:vnd\.api\+)?json\b/i
     auth_value_method :json_response_content_type, 'application/json'
     auth_value_method :json_response_custom_error_status?, true
     auth_value_method :json_response_error_status, 400
@@ -81,6 +81,10 @@ module Rodauth
       super
     end
 
+    def allow_param_fallback_for_session_param?
+      use_json?
+    end
+
     def _set_otp_unlock_info
       if use_json?
         json_response[:num_successes] = otp_unlock_num_successes

data/lib/rodauth/features/jwt.rb

@@ -145,7 +145,13 @@ module Rodauth
     end
 
     def return_json_response
-      set_jwt
+      case response.status
+      when 405, 406
+        response.headers.delete('authorization')
+      else
+        set_jwt
+      end
+
       super
     end
 

data/lib/rodauth/features/jwt_cors.rb

@@ -8,6 +8,7 @@ module Rodauth
     auth_value_method :jwt_cors_allow_methods, 'POST'
     auth_value_method :jwt_cors_allow_headers, 'Content-Type, Authorization, Accept'
     auth_value_method :jwt_cors_expose_headers, 'Authorization'
+    auth_value_method :jwt_cors_vary_header, 'Origin'
     auth_value_method :jwt_cors_max_age, 86400
 
     auth_methods(:jwt_cors_allow?)
@@ -33,6 +34,7 @@ module Rodauth
 
     def before_rodauth
       if jwt_cors_allow?
+        set_response_header('vary', jwt_cors_vary_header)
         set_response_header('access-control-allow-origin', request.env['HTTP_ORIGIN'])
 
         # Handle CORS preflight request

data/lib/rodauth/features/jwt_refresh.rb

@@ -2,7 +2,7 @@
 
 module Rodauth
   Feature.define(:jwt_refresh, :JwtRefresh) do
-    depends :jwt
+    depends :jwt, :require_hmac_secret
 
     after 'refresh_token'
     before 'refresh_token'
@@ -31,28 +31,34 @@ module Rodauth
       :account_from_refresh_token
     )
 
-    uses_instance_variables(:@jwt_refresh_route)
+    uses_instance_variables(
+      :@jwt_refresh_route,
+      :@jwt_refresh_key_for_update,
+    )
 
     route do |r|
-      @jwt_refresh_route = true
       before_jwt_refresh_route
 
       r.post do
+        @jwt_refresh_route = true
         if !session_value
           response.status ||= jwt_refresh_without_access_token_status
           json_response[json_response_error_key] = jwt_refresh_without_access_token_message
-        elsif (refresh_token = param_or_nil(jwt_refresh_token_key_param)) && account_from_refresh_token(refresh_token)
+        else
+          @jwt_refresh_key_for_update = true
           transaction do
-            before_refresh_token
-            formatted_token = generate_refresh_token
-            remove_jwt_refresh_token_key(refresh_token)
-            set_jwt_refresh_token_hmac_session_key(formatted_token)
-            json_response[jwt_refresh_token_key] = formatted_token
-            json_response[jwt_access_token_key] = session_jwt
-            after_refresh_token
+            if (refresh_token = param_or_nil(jwt_refresh_token_key_param)) && account_from_refresh_token(refresh_token)
+              before_refresh_token
+              formatted_token = generate_refresh_token
+              remove_jwt_refresh_token_key(refresh_token)
+              set_jwt_refresh_token_hmac_session_key(formatted_token)
+              json_response[jwt_refresh_token_key] = formatted_token
+              json_response[jwt_access_token_key] = session_jwt
+              after_refresh_token
+            else
+              json_response[json_response_error_key] = jwt_refresh_invalid_token_message
+            end
           end
-        else
-          json_response[json_response_error_key] = jwt_refresh_invalid_token_message
         end
         _return_json_response
       end
@@ -88,7 +94,7 @@ module Rodauth
     end
 
     def account_from_refresh_token(token)
-      @account = _account_from_refresh_token(token)
+      set_account(_account_from_refresh_token(token), :jwt_refresh)
     end
 
     def clear_tokens(reason)
@@ -142,7 +148,7 @@ module Rodauth
     end
 
     def _jwt_decode_opts
-      if allow_refresh_with_expired_jwt_access_token? && (@jwt_refresh_route || request.path == jwt_refresh_path)
+      if allow_refresh_with_expired_jwt_access_token? && (@jwt_refresh_route || (request.path == jwt_refresh_path && request.request_method == "POST"))
         Hash[super].merge!(:verify_expiration=>false)
       else
         super
@@ -165,8 +171,12 @@ module Rodauth
         where(Sequel::CURRENT_TIMESTAMP > jwt_refresh_token_deadline_column).
         delete
 
-      jwt_refresh_token_account_token_ds(account_id, token_id).
-        get(jwt_refresh_token_key_column)
+      ds = jwt_refresh_token_account_token_ds(account_id, token_id)
+      if @jwt_refresh_key_for_update
+        ds = ds.for_update
+        @jwt_refresh_key_for_update = nil
+      end
+      ds.get(jwt_refresh_token_key_column)
     end
 
     def jwt_refresh_token_account_ds(account_id)
@@ -214,7 +224,12 @@ module Rodauth
         else
           id, token_id, key = _account_refresh_token_split(token)
 
-          if id && token_id && key && (actual = get_active_refresh_token(session_value, token_id)) && timing_safe_eql?(key, convert_token_key(actual))
+          if id &&
+              token_id &&
+              key &&
+              (actual = get_active_refresh_token(session_value, token_id)) &&
+              (timing_safe_eql?(key, convert_token_key(actual)) || 
+                 (hmac_secret_rotation? && timing_safe_eql?(key, compute_old_hmac(actual))))
             jwt_refresh_token_account_token_ds(id, token_id).delete
           end
         end

data/lib/rodauth/features/lockout.rb

@@ -116,16 +116,19 @@ module Rodauth
       end
 
       r.post do
-        key = session[unlock_account_session_key] || param(unlock_account_key_param)
-        unless account_from_unlock_key(key)
-          set_redirect_error_status invalid_key_error_status
-          set_error_reason :invalid_unlock_account_key
-          set_redirect_error_flash no_matching_unlock_account_key_error_flash
-          redirect unlock_account_request_redirect
-        end
+        key = session_param(unlock_account_session_key, unlock_account_key_param)
+        select_key_for_update!
+
+        transaction do
+          unless key && account_from_unlock_key(key)
+            remove_session_value(unlock_account_session_key)
+            set_redirect_error_status invalid_key_error_status
+            set_error_reason :invalid_unlock_account_key
+            set_redirect_error_flash no_matching_unlock_account_key_error_flash
+            redirect unlock_account_request_redirect
+          end
 
-        if !unlock_account_requires_password? || password_match?(param(password_param))
-          transaction do
+          if !unlock_account_requires_password? || password_match?(param(password_param))
             before_unlock_account
             unlock_account
             clear_tokens(:unlock_account)
@@ -133,15 +136,15 @@ module Rodauth
             if unlock_account_autologin?
               autologin_session('unlock_account')
             end
-          end
 
-          remove_session_value(unlock_account_session_key)
-          unlock_account_response
-        else
-          set_response_error_reason_status(:invalid_password, invalid_password_error_status)
-          set_field_error(password_param, invalid_password_message)
-          set_error_flash unlock_account_error_flash
-          unlock_account_view
+            remove_session_value(unlock_account_session_key)
+            unlock_account_response
+          else
+            set_response_error_reason_status(:invalid_password, invalid_password_error_status)
+            set_field_error(password_param, invalid_password_message)
+            set_error_flash unlock_account_error_flash
+            unlock_account_view
+          end
         end
       end
     end
@@ -221,7 +224,7 @@ module Rodauth
     end
 
     def account_from_unlock_key(key)
-      @account = _account_from_unlock_key(key)
+      set_account(_account_from_unlock_key(key), :unlock)
     end
 
     def unlock_account_email_link
@@ -310,7 +313,7 @@ module Rodauth
     end
 
     def _account_from_unlock_key(token)
-      account_from_key(token){|id| account_lockouts_ds(id).get(account_lockouts_key_column)}
+      account_from_key(token){|id| apply_key_for_update(account_lockouts_ds(id)).get(account_lockouts_key_column)}
     end
   end
 end