rsb-admin 0.9.1 → 0.9.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3071fe9fb7627de15eb032d8ae6c15059f3131b3f1b659621a39e642a6222bdc
-  data.tar.gz: 9a80f870291efcc587c5c065e8daad3435e07ef3cf2fede88b2a5146f6a7fe91
+  metadata.gz: e13a1c64353fc1ee84f05959fe7232035f3907adc5beb9c27292bc633451b707
+  data.tar.gz: b6f5678d1c5aea17aef9f06ee8bea21fe689a9c76afc43d7f69bac7e23cbfbb4
 SHA512:
-  metadata.gz: 04bcb5b79f9670a8037d46ad7de412c4c2dea86419ae707a51504971e6e70cede74005ee6db11d20d8339055cd1b03a022fe964b869e166420c5a0a2197caf95
-  data.tar.gz: be1e160d6579cfd6cb1c1a08e0ccb9d5adc30bc39cd16ca1a09df3b255896ed98d77caa1a97377b932ab9e6d49a82b29509622a680fc825d4b4068c8de13c125
+  metadata.gz: 942ffa094ab1f97f40ee7883c9737e22ca667e233aaad62c4a58709e5c7f81a49ae42a6c26efde39f846b719e19c3a9159ff96d3b0b9995d3478e93b55398d74
+  data.tar.gz: e01b91a34eef78872df23d9b93aece5a132603e38c39b2f89612f10053a52eac430978961f70b5fd5ae0ba26144e5ef78447d2b533a9777b3a636858e43ba145

data/app/controllers/rsb/admin/admin_controller.rb

@@ -24,6 +24,7 @@ module RSB
       before_action :set_seo_context
       before_action :check_admin_enabled
       before_action :require_admin_authentication
+      before_action :check_session_idle_timeout
       before_action :enforce_two_factor_enrollment
       before_action :build_breadcrumbs
       before_action :track_session_activity
@@ -48,6 +49,21 @@ module RSB
         redirect_to rsb_admin.login_path, alert: 'Please sign in.'
       end
 
+      # Checks if the current admin session has been idle longer than the configured timeout.
+      def check_session_idle_timeout
+        timeout = RSB::Settings.get('admin.session_idle_timeout').to_i
+        return if timeout <= 0
+        return unless current_admin_session
+
+        if current_admin_session.last_active_at < timeout.seconds.ago
+          current_admin_session.destroy
+          session.delete(:rsb_admin_session_token)
+          @current_admin_user = nil
+          @current_admin_session = nil
+          redirect_to rsb_admin.login_path, alert: 'Session expired due to inactivity.'
+        end
+      end
+
       def enforce_two_factor_enrollment
         return unless current_admin_user
         return unless ActiveModel::Type::Boolean.new.cast(RSB::Settings.get('admin.require_two_factor'))

data/app/views/rsb/admin/shared/forbidden.html.erb

@@ -1,6 +1,6 @@
 <div class="flex items-center justify-center min-h-[60vh]">
   <div class="bg-rsb-card border border-rsb-border rounded-rsb-lg shadow-rsb-sm p-8 max-w-md w-full text-center">
-    <div class="mb-4 text-rsb-muted">
+    <div class="mb-4 text-rsb-muted flex justify-center">
       <%= rsb_admin_icon("lock", size: 48) %>
     </div>
     <h1 class="text-2xl font-bold mb-2"><%= rsb_admin_t("shared.access_denied") %></h1>
@@ -12,11 +12,10 @@
           <%= rsb_admin_t("shared.go_to_dashboard") %>
         </a>
       <% end %>
-      <a href="<%= rsb_admin.logout_path %>"
-         class="text-sm text-rsb-muted hover:text-rsb-text"
-         data-turbo-method="delete">
+      <%= button_to rsb_admin.logout_path, method: :delete,
+            class: "text-sm text-rsb-muted hover:text-rsb-text" do %>
         <%= rsb_admin_t("shared.sign_out_and_try") %>
-      </a>
+      <% end %>
     </div>
   </div>
 </div>

data/db/migrate/{20260208000003_create_rsb_admin_tables.rb → 20260216300001_create_rsb_admin_tables.rb}

@@ -1,11 +1,12 @@
 # frozen_string_literal: true
 
-class CreateRSBAdminTables < ActiveRecord::Migration[8.0]
+class CreateRSBAdminTables < ActiveRecord::Migration[8.1]
   def change
     create_table :rsb_admin_roles do |t|
       t.string :name, null: false
       t.json :permissions, null: false, default: {}
       t.boolean :built_in, default: false
+
       t.timestamps
     end
 
@@ -20,6 +21,10 @@ class CreateRSBAdminTables < ActiveRecord::Migration[8.0]
       t.string :pending_email
       t.string :email_verification_token
       t.datetime :email_verification_sent_at
+      t.string :otp_secret
+      t.boolean :otp_required, null: false, default: false
+      t.text :otp_backup_codes
+
       t.timestamps
     end
 
@@ -35,6 +40,7 @@ class CreateRSBAdminTables < ActiveRecord::Migration[8.0]
       t.string :os
       t.string :device_type
       t.datetime :last_active_at, null: false
+
       t.timestamps
     end
 

data/lib/rsb/admin/settings_schema.rb

@@ -53,6 +53,12 @@ module RSB
                   default: false,
                   group: 'Security',
                   description: 'Require all admin users to enable two-factor authentication'
+
+          setting :session_idle_timeout,
+                  type: :integer,
+                  default: 0,
+                  group: 'Security',
+                  description: 'Admin session idle timeout in seconds. When greater than 0, admin sessions inactive for this duration are expired. 0 = no idle timeout (default).'
         end
       end
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rsb-admin
 version: !ruby/object:Gem::Version
-  version: 0.9.1
+  version: 0.9.2
 platform: ruby
 authors:
 - Aleksandr Marchenko
@@ -71,14 +71,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.9.1
+        version: 0.9.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.9.1
+        version: 0.9.2
 description: Registrable admin panel with dynamic RBAC, settings page, and a test
   kit for extension developers. Simpler than ActiveAdmin — designed for extensibility.
 email:
@@ -172,8 +172,7 @@ files:
 - config/locales/en.yml
 - config/locales/seo.en.yml
 - config/routes.rb
-- db/migrate/20260208000003_create_rsb_admin_tables.rb
-- db/migrate/20260214000001_add_otp_fields_to_rsb_admin_admin_users.rb
+- db/migrate/20260216300001_create_rsb_admin_tables.rb
 - lib/generators/rsb/admin/install/install_generator.rb
 - lib/generators/rsb/admin/install/templates/rsb_admin_seeds.rb
 - lib/generators/rsb/admin/theme/templates/theme.css.tt

data/db/migrate/20260214000001_add_otp_fields_to_rsb_admin_admin_users.rb

@@ -1,9 +0,0 @@
-# frozen_string_literal: true
-
-class AddOtpFieldsToRSBAdminAdminUsers < ActiveRecord::Migration[8.0]
-  def change
-    add_column :rsb_admin_admin_users, :otp_secret, :string
-    add_column :rsb_admin_admin_users, :otp_required, :boolean, null: false, default: false
-    add_column :rsb_admin_admin_users, :otp_backup_codes, :text
-  end
-end