searls-auth 1.0.2 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4314fcd2c4eee5b0f32ace811ceeefaa44728895592fdebd5aa6a696303133e7
-  data.tar.gz: 8d4963fb8be2ecbf4ad13762e8697c2d9d992f9d382dcc0c73b2a38d6daf6041
+  metadata.gz: b89495d0211c7f68d45f32b331fa2aba422d39a829b3ab7569bbe66901c17de3
+  data.tar.gz: 89eb9084ad27d89d1bb4ca328a157ca89578a0bfe57c53359f92b30421a2ec33
 SHA512:
-  metadata.gz: 79c05ebe302bc1846f72ac29ae21a16ee629050a52b31cb4bd9ff4d5ec70bd1737e4cfe7451546cf74dd0aa82781d0952855218f4f47286419049f59265e6982
-  data.tar.gz: a309ca56baf772d1c3eb46adf1897d33af4bb0077d14768e9646b03b402311cb9793082f9f16fdc9ac27286a001561843e338858eda1a99a960e7b331268d85c
+  metadata.gz: a06c5572753eb9718b4da43e297b8fcc19b20d7b3e19bdb8bd13ab400b289179e3b3f1a2e92fca5ce1203064b5445f2a7868cde2a8c3ee42c7c560d301659aaa
+  data.tar.gz: 2b9a204452996e4d25df5abbc1608667f59ab6f791138918ca99c8dd0c24cf09173617fa1d2e3839bc3263b491970a627ac72336d90eca653f18c8b5acc770c0

data/CHANGELOG.md

@@ -1,4 +1,9 @@
-## [Unreleased]
+## [2.0.0] - 2026-01-22
+
+* **BREAKING:** Remove `redirect_subdomain` support in favor of `redirect_host`
+* **BREAKING:** Replace `redirect_host_allowed_predicate`, `cross_domain_sso_token_generator`, and `cross_cookie_domain_predicate` with `sso_token_for_cross_domain_redirects`
+* Security: Sanitize user-controlled `notice` and `alert` query params rendered on the login page to mitigate reflected XSS, while preserving safe formatting tags and links (`<a href=...>` and Turbo data attributes)
+* Behavior: Disallowed tags/attributes/protocols are stripped from login `notice`/`alert` params (e.g. `<script>`, event handler attributes, `javascript:` links)
 
 ## [1.0.2] - 2025-10-13
 

data/README.md

@@ -84,6 +84,15 @@ end
 ```
 As stated in the comment above, you can find each configuration and its default value in the code.
 
+### Customize user lookup
+
+searls-auth uses separate hooks to find users by email for login vs registration:
+
+- `config.user_finder_by_email` is used by login.
+- `config.user_finder_by_email_for_registration` is used by registration to find an existing row to update (e.g., “upgrade” an existing user record).
+
+If `user_finder_by_email_for_registration` returns a persisted user, searls-auth will block the registration attempt unless `config.existing_user_registration_blocked_predicate.call(user, params)` returns `false`.
+
 ### Choose your login methods
 
 By default, users can log in either by clicking a magic link or by entering a 6‑digit code they receive via email. This is controlled by the `auth_methods` configuration:
@@ -264,7 +273,19 @@ end
 | `[:password, :email_link, :email_otp]` | `:optional` | Users can log in with either password or email. Registration logs the user in immediately and also emails a verification link. |
 | `[:password, :email_link]` | `:required` | Registration emails a link and blocks password login until verified. Resend verification is exposed at `searls_auth.resend_email_verification_path`. |
 
-In every case, `redirect_path` values are normalized to on-site URLs, so forwarding someone to login with `redirect_path: some_path` keeps the eventual redirect on your domain (cross-subdomain redirects still work via `redirect_subdomain`).
+In every case, `redirect_path` values are normalized to on-site URLs, so forwarding someone to login with `redirect_path: some_path` keeps the eventual redirect on your domain.
+
+You can optionally pass `redirect_host` to redirect to another host (e.g., an admin subdomain or another app).
+
+When redirecting to another host, you can append an SSO token by setting `config.sso_token_for_cross_domain_redirects` (defaults to `nil`). It is called with `(user, request, target_host)` and should return a token string or `nil`.
+
+### Multi-domain logout bounce
+
+The engine provides `searls_auth.logout_path`, which clears the current session on the current host.
+
+If your app uses multiple cookie domains, the engine cannot clear the other domain’s session cookie. The simplest approach is to implement logout in your host app and “bounce” through the other domain(s), clearing each cookie in turn.
+
+If you mount the engine at `/`, you can shadow its `/logout` route by defining your own `get "/logout"` route before the `mount` line. Your controller can call `Searls::Auth::ResetsSession.new.reset(self, except_for: [...])` and then redirect to your other domain’s logout endpoint with a `return_to` back to your primary domain.
 
 ## Use it
 

data/TODO.md

@@ -0,0 +1,21 @@
+# TODO (bwb-adoption)
+
+This is the remaining `searls-auth` gem work needed for grog/BWB adoption.
+
+- [x] Add **cross-host** redirect support (not just path-only redirects)
+  - [x] Accept a `redirect_host` param (optional), and reject/ignore it by default
+  - [x] Add a config hook to validate hosts (e.g. `redirect_host_allowed_predicate`)
+  - [x] Extend `Searls::Auth::BuildsTargetRedirectUrl` to build absolute URLs using `redirect_host` when allowed
+  - [x] Preserve existing path normalization and avoid open redirects
+- [x] Add **cross-cookie-domain SSO token forwarding** hook
+  - [x] Provide a config hook (e.g. `cross_domain_sso_token_generator`) that can append `sso_token=...` when redirecting to another cookie domain
+  - [x] Make token param name configurable (default `sso_token`)
+  - [x] Provide an overridable way to decide “cross-cookie-domain” (default: registrable domain differs)
+- [x] Add (or document) **logout bounce** support for multi-domain apps
+  - [x] Either: first-class config for “also clear session on another domain”, or explicit docs showing how host apps can implement it
+- [x] Add example app coverage
+  - [x] Add integration/system tests proving `redirect_host` is rejected by default and allowed when configured
+  - [x] Add a test proving SSO token appending works when enabled
+- [x] Update docs
+  - [x] Document `user_finder_by_email_for_registration` and the “upgrade existing non-registered user row” pattern
+  - [x] Document the new cross-domain hooks and security expectations

data/app/controllers/searls/auth/base_controller.rb

@@ -8,7 +8,7 @@ module Searls
       helper_method :forwardable_params
 
       def forwardable_params
-        {redirect_path: params[:redirect_path], redirect_subdomain: params[:redirect_subdomain]}.compact_blank
+        {redirect_path: params[:redirect_path], redirect_host: params[:redirect_host]}.compact_blank
       end
 
       protected
@@ -40,8 +40,8 @@ module Searls
         session[:searls_auth_email_otp_verification_attempts] += 1
       end
 
-      def target_redirect_url
-        Searls::Auth::BuildsTargetRedirectUrl.new.build(request, params)
+      def target_redirect_url(user: nil)
+        Searls::Auth::BuildsTargetRedirectUrl.new.build(request, params, user: user)
       end
 
       def redirect_with_host_awareness(target)
@@ -49,7 +49,7 @@ module Searls
       end
 
       def redirect_after_login(user)
-        if (target = target_redirect_url)
+        if (target = target_redirect_url(user: user))
           redirect_with_host_awareness(target)
         else
           redirect_to Searls::Auth.config.resolve(

data/app/controllers/searls/auth/email_verifications_controller.rb

@@ -22,7 +22,7 @@ module Searls
             searls_auth.pending_email_verification_path({
               email: session[:searls_auth_pending_email],
               redirect_path: session[:searls_auth_pending_redirect_path],
-              redirect_subdomain: session[:searls_auth_pending_redirect_subdomain]
+              redirect_host: session[:searls_auth_pending_redirect_host]
             }.compact_blank)
           else
             searls_auth.login_path

data/app/controllers/searls/auth/logins_controller.rb

@@ -4,6 +4,9 @@ module Searls
       before_action :reset_expired_email_otp
 
       def show
+        sanitizes_flash_html = SanitizesFlashHtml.new
+        flash.now[:notice] ||= sanitizes_flash_html.sanitize(params[:notice]) if params[:notice].present?
+        flash.now[:alert] ||= sanitizes_flash_html.sanitize(params[:alert]) if params[:alert].present?
         render Searls::Auth.config.login_view, layout: Searls::Auth.config.layout
       end
 
@@ -16,9 +19,10 @@ module Searls
       end
 
       def destroy
-        ResetsSession.new.reset(self, except_for: [:has_logged_in_before])
+        ResetsSession.new.reset(self, except_for: Searls::Auth.config.preserve_session_keys_after_logout)
         flash[:notice] = Searls::Auth.config.resolve(:flash_notice_after_logout, params)
-        redirect_to searls_auth.login_path
+        target = Searls::Auth.config.resolve(:redirect_url_after_logout, flash[:notice], params, request, main_app)
+        redirect_to(target.presence || searls_auth.login_path, allow_other_host: true)
       end
 
       private

data/app/controllers/searls/auth/registrations_controller.rb

@@ -36,22 +36,22 @@ module Searls
       end
 
       def handle_password_registration(user)
-        target_path, target_subdomain = registration_redirect_destination(user)
+        target_path, target_host = registration_redirect_destination(user)
         if Searls::Auth.config.email_verification_mode != :none
-          EmailsVerification.new.email(user: user, redirect_path: target_path, redirect_subdomain: target_subdomain)
+          EmailsVerification.new.email(user: user, redirect_path: target_path, redirect_host: target_host)
           session[:searls_auth_pending_email] = user.email
           session[:searls_auth_pending_redirect_path] = target_path
-          session[:searls_auth_pending_redirect_subdomain] = target_subdomain
+          session[:searls_auth_pending_redirect_host] = target_host
         end
 
         if Searls::Auth.config.email_verification_mode == :required
           flash[:notice] = Searls::Auth.config.resolve(:flash_notice_after_registration, user, params)
-          redirect_to searls_auth.pending_email_verification_path({email: user.email, redirect_path: target_path, redirect_subdomain: target_subdomain}.compact_blank)
+          redirect_to searls_auth.pending_email_verification_path({email: user.email, redirect_path: target_path, redirect_host: target_host}.compact_blank)
         else
           session[:user_id] = user.id
           session[:has_logged_in_before] = true
           flash[:notice] = Searls::Auth.config.resolve(:flash_notice_after_login, user, params)
-          if (target = target_redirect_url)
+          if (target = target_redirect_url(user: user))
             redirect_with_host_awareness(target)
           else
             fallback = Searls::Auth.config.resolve(:redirect_path_after_login, user, params, request, main_app)
@@ -62,25 +62,25 @@ module Searls
 
       def handle_email_registration(user)
         return unless email_methods_enabled?
-        target_path, target_subdomain = registration_redirect_destination(user)
-        enqueue_login_verification_email(user, target_path:, target_subdomain:)
+        target_path, target_host = registration_redirect_destination(user)
+        enqueue_login_verification_email(user, target_path:, target_host:)
         flash[:notice] = Searls::Auth.config.resolve(:flash_notice_after_registration, user, params)
         redirect_to searls_auth.verify_path(**forwardable_params)
       end
 
       def registration_redirect_destination(user)
         if redirect_params_supplied?
-          [params[:redirect_path], params[:redirect_subdomain]]
+          [params[:redirect_path], params[:redirect_host]]
         else
           [Searls::Auth.config.resolve(:redirect_path_after_register, user, params, request, main_app), nil]
         end
       end
 
       def redirect_params_supplied?
-        params[:redirect_path].present? || params[:redirect_subdomain].present?
+        params[:redirect_path].present? || params[:redirect_host].present?
       end
 
-      def enqueue_login_verification_email(user, target_path:, target_subdomain:)
+      def enqueue_login_verification_email(user, target_path:, target_host:)
         email_otp = nil
         if Searls::Auth.config.auth_methods.include?(:email_otp)
           attach_email_otp_to_session!(user)
@@ -92,7 +92,7 @@ module Searls
           user: user,
           email_otp: email_otp,
           redirect_path: target_path,
-          redirect_subdomain: target_subdomain
+          redirect_host: target_host
         )
       end
     end

data/app/controllers/searls/auth/requests_password_resets_controller.rb

@@ -16,7 +16,7 @@ module Searls
           Searls::Auth::DeliversPasswordReset.new.deliver(
             user:,
             redirect_path: params[:redirect_path],
-            redirect_subdomain: params[:redirect_subdomain]
+            redirect_host: params[:redirect_host]
           )
         end
 
@@ -24,7 +24,7 @@ module Searls
         redirect_to searls_auth.password_reset_request_path(
           email: email,
           redirect_path: params[:redirect_path],
-          redirect_subdomain: params[:redirect_subdomain]
+          redirect_host: params[:redirect_host]
         )
       end
 
@@ -36,7 +36,7 @@ module Searls
         flash[:alert] = Searls::Auth.config.resolve(:flash_error_after_password_reset_not_enabled, params)
         redirect_to searls_auth.login_path(
           redirect_path: params[:redirect_path],
-          redirect_subdomain: params[:redirect_subdomain]
+          redirect_host: params[:redirect_host]
         )
         nil
       end

data/app/controllers/searls/auth/resets_passwords_controller.rb

@@ -36,7 +36,7 @@ module Searls
         flash[:alert] = Searls::Auth.config.resolve(:flash_error_after_password_reset_not_enabled, params)
         redirect_to searls_auth.login_path(
           redirect_path: params[:redirect_path],
-          redirect_subdomain: params[:redirect_subdomain]
+          redirect_host: params[:redirect_host]
         )
         nil
       end
@@ -49,7 +49,7 @@ module Searls
         flash[:alert] = Searls::Auth.config.resolve(:flash_error_after_password_reset_token_invalid, params)
         redirect_to searls_auth.password_reset_request_path(
           redirect_path: params[:redirect_path],
-          redirect_subdomain: params[:redirect_subdomain]
+          redirect_host: params[:redirect_host]
         )
         nil
       end
@@ -64,7 +64,7 @@ module Searls
         else
           redirect_to searls_auth.login_path(
             redirect_path: params[:redirect_path],
-            redirect_subdomain: params[:redirect_subdomain]
+            redirect_host: params[:redirect_host]
           )
         end
       end

data/app/controllers/searls/auth/settings_controller.rb

@@ -50,7 +50,7 @@ module Searls
 
         redirect_to searls_auth.login_path(
           redirect_path: request.original_fullpath,
-          redirect_subdomain: request.subdomain
+          redirect_host: request.host
         )
         nil
       end
@@ -62,7 +62,7 @@ module Searls
         session.delete(:user_id)
         redirect_to searls_auth.login_path(
           redirect_path: request.original_fullpath,
-          redirect_subdomain: request.subdomain
+          redirect_host: request.host
         )
         nil
       end

data/app/controllers/searls/auth/verifications_controller.rb

@@ -39,7 +39,7 @@ module Searls
           session[:user_id] = result.user.id
           session[:has_logged_in_before] = true
           flash[:notice] = Searls::Auth.config.resolve(:flash_notice_after_login, result.user, params)
-          if (target = target_redirect_url)
+          if (target = target_redirect_url(user: result.user))
             redirect_with_host_awareness(target)
           else
             redirect_to Searls::Auth.config.resolve(:redirect_path_after_login, result.user, params, request, main_app)

data/app/helpers/searls/auth/application_helper.rb

@@ -55,7 +55,7 @@ module Searls
       end
 
       def enable_turbo?
-        params[:redirect_subdomain].blank? || params[:redirect_subdomain] == request.subdomain
+        !redirect_host_crosses_host?
       end
 
       def attr_for(model, field_name)
@@ -78,6 +78,16 @@ module Searls
       def params
         @view_context.params
       end
+
+      def request
+        @view_context.request
+      end
+
+      def redirect_host_crosses_host?
+        host = params[:redirect_host].to_s.strip.downcase
+        return false if host.blank?
+        host != request.host
+      end
     end
 
     module ApplicationHelper

data/app/mailers/searls/auth/email_verification_mailer.rb

@@ -6,7 +6,7 @@ module Searls
         @user = params[:user]
         @token = params[:token]
         @redirect_path = params[:redirect_path]
-        @redirect_subdomain = params[:redirect_subdomain]
+        @redirect_host = params[:redirect_host]
 
         mail(
           to: format_to(@user),

data/app/mailers/searls/auth/login_link_mailer.rb

@@ -6,7 +6,7 @@ module Searls
         @user = params[:user]
         @token = params[:token]
         @redirect_path = params[:redirect_path]
-        @redirect_subdomain = params[:redirect_subdomain]
+        @redirect_host = params[:redirect_host]
         @email_otp = params[:email_otp]
 
         mail(

data/app/mailers/searls/auth/password_reset_mailer.rb

@@ -6,7 +6,7 @@ module Searls
         @user = params[:user]
         @token = params[:token]
         @redirect_path = params[:redirect_path]
-        @redirect_subdomain = params[:redirect_subdomain]
+        @redirect_host = params[:redirect_host]
 
         mail(
           to: format_to(@user),

data/app/views/searls/auth/email_verification_mailer/verification_email.html.erb

@@ -12,7 +12,7 @@
     <%= link_to searls_auth.verify_email_url({
       token: @token,
       redirect_path: @redirect_path,
-      redirect_subdomain: @redirect_subdomain
+      redirect_host: @redirect_host
     }.compact_blank) do %>
       <span style="width: 70%; box-shadow: 0 10px 15px -3px rgba(0, 0, 0, 0.1), 0 4px 6px -2px rgba(0, 0, 0, 0.05); display: inline-block; padding-left: 2rem; padding-right: 2rem; padding-top: 1rem; padding-bottom: 1rem; font-size: 1.5rem; font-weight: 700; border-radius: 0.75rem; background-color: <%= @config.email_button_color %>; color: white;">Verify email address</span>
     <% end %>

data/app/views/searls/auth/email_verification_mailer/verification_email.text.erb

@@ -1,6 +1,6 @@
 Hello<% if (user_name = searls_auth_helper.attr_for(@user, @config.user_name_method)).present? %>, <%= user_name %><% end %>!
 
 Verify your email using this link:
-<%= searls_auth.verify_email_url({ token: @token, redirect_path: @redirect_path, redirect_subdomain: @redirect_subdomain }.compact_blank) %>
+<%= searls_auth.verify_email_url({ token: @token, redirect_path: @redirect_path, redirect_host: @redirect_host }.compact_blank) %>
 
 If you didn't ask for this, you can ignore this email.

data/app/views/searls/auth/login_link_mailer/login_link.html.erb

@@ -13,7 +13,7 @@
       <%= link_to verify_token_url({
         token: @token,
         redirect_path: @redirect_path,
-        redirect_subdomain: @redirect_subdomain
+        redirect_host: @redirect_host
       }.compact_blank) do %>
         <span style="width: 70%; box-shadow: 0 10px 15px -3px rgba(0, 0, 0, 0.1), 0 4px 6px -2px rgba(0, 0, 0, 0.05); display: inline-block; padding-left: 2rem; padding-right: 2rem; padding-top: 1rem; padding-bottom: 1rem; font-size: 1.5rem; font-weight: 700; border-radius: 0.75rem; background-color: <%= @config.email_button_color %>; color: white;">Log in</span>
       <% end %>

data/app/views/searls/auth/login_link_mailer/login_link.text.erb

@@ -10,7 +10,7 @@ You can log in by visiting this URL for your <%= searls_auth_helper.rpad(@config
 <%= searls_auth.verify_token_url({
   token: @token,
   redirect_path: @redirect_path,
-  redirect_subdomain: @redirect_subdomain
+  redirect_host: @redirect_host
 }.compact_blank) %>
 <% end %>
 

data/app/views/searls/auth/logins/show.html.erb

@@ -2,7 +2,7 @@
 
 <%= form_with url: searls_auth.login_path, method: :post, data: {controller: searls_auth_helper.login_stimulus_controller} do |f| %>
   <%= f.hidden_field :redirect_path, value: params[:redirect_path] %>
-  <%= f.hidden_field :redirect_subdomain, value: params[:redirect_subdomain] %>
+  <%= f.hidden_field :redirect_host, value: params[:redirect_host] %>
   <%= render "searls/auth/shared/login_fields", f: f %>
   <div>
     <%= f.submit "Log in" %>

data/app/views/searls/auth/password_reset_mailer/password_reset.html.erb

@@ -12,7 +12,7 @@
     <%= link_to password_reset_edit_url({
       token: @token,
       redirect_path: @redirect_path,
-      redirect_subdomain: @redirect_subdomain
+      redirect_host: @redirect_host
     }.compact_blank) do %>
       <span style="width: 70%; box-shadow: 0 10px 15px -3px rgba(0, 0, 0, 0.1), 0 4px 6px -2px rgba(0, 0, 0, 0.05); display: inline-block; padding-left: 2rem; padding-right: 2rem; padding-top: 1rem; padding-bottom: 1rem; font-size: 1.5rem; font-weight: 700; border-radius: 0.75rem; background-color: <%= @config.email_button_color %>; color: white;">Reset password</span>
     <% end %>

data/app/views/searls/auth/password_reset_mailer/password_reset.text.erb

@@ -1,6 +1,6 @@
 Hello<% if (user_name = searls_auth_helper.attr_for(@user, @config.user_name_method)).present? %>, <%= user_name %><% end %>!
 
 Reset your password using this link:
-<%= password_reset_edit_url({ token: @token, redirect_path: @redirect_path, redirect_subdomain: @redirect_subdomain }.compact_blank) %>
+<%= password_reset_edit_url({ token: @token, redirect_path: @redirect_path, redirect_host: @redirect_host }.compact_blank) %>
 
 If you didn't ask for this, you can ignore this email.

data/app/views/searls/auth/registrations/show.html.erb

@@ -2,7 +2,7 @@
 
 <%= form_with url: searls_auth.register_path, data: {controller: searls_auth_helper.login_stimulus_controller} do |f| %>
   <%= f.hidden_field :redirect_path, value: params[:redirect_path] %>
-  <%= f.hidden_field :redirect_subdomain, value: params[:redirect_subdomain] %>
+  <%= f.hidden_field :redirect_host, value: params[:redirect_host] %>
   <%= render "searls/auth/shared/register_fields", f: f %>
   <%= f.submit "Register" %>
 <% end %>

data/app/views/searls/auth/requests_password_resets/show.html.erb

@@ -2,7 +2,7 @@
 
 <%= form_with url: searls_auth.password_reset_request_path, method: :post, data: {controller: searls_auth_helper.login_stimulus_controller} do |f| %>
   <%= f.hidden_field :redirect_path, value: params[:redirect_path] %>
-  <%= f.hidden_field :redirect_subdomain, value: params[:redirect_subdomain] %>
+  <%= f.hidden_field :redirect_host, value: params[:redirect_host] %>
   <div>
     <%= f.label :email, "Email address" %>
     <%= f.email_field :email, required: true, value: params[:email], autocomplete: "email" %>

data/app/views/searls/auth/resets_passwords/show.html.erb

@@ -3,7 +3,7 @@
 <%= form_with url: searls_auth.password_reset_update_path, method: :patch do |f| %>
   <%= f.hidden_field :token, value: @token %>
   <%= f.hidden_field :redirect_path, value: params[:redirect_path] %>
-  <%= f.hidden_field :redirect_subdomain, value: params[:redirect_subdomain] %>
+  <%= f.hidden_field :redirect_host, value: params[:redirect_host] %>
   <div>
     <%= label_tag :email, "Email address" %>
     <%= email_field_tag :email, @user_email, disabled: true %>

data/app/views/searls/auth/settings/edit.html.erb

@@ -2,7 +2,7 @@
 
 <%= form_with scope: :settings, url: searls_auth.settings_path, method: :patch do |f| %>
   <%= hidden_field_tag :redirect_path, params[:redirect_path] %>
-  <%= hidden_field_tag :redirect_subdomain, params[:redirect_subdomain] %>
+  <%= hidden_field_tag :redirect_host, params[:redirect_host] %>
 
   <fieldset>
     <legend>Password</legend>

data/app/views/searls/auth/verifications/show.html.erb

@@ -7,7 +7,7 @@
 <% if Searls::Auth.config.auth_methods.include?(:email_otp) %>
   <%= form_with(url: searls_auth.verify_path, method: :post, data: { turbo: searls_auth_helper.enable_turbo? }) do |f| %>
     <%= f.hidden_field :redirect_path, value: params[:redirect_path] %>
-    <%= f.hidden_field :redirect_subdomain, value: params[:redirect_subdomain] %>
+    <%= f.hidden_field :redirect_host, value: params[:redirect_host] %>
     <div data-controller="<%= searls_auth_helper.otp_stimulus_controller %>">
       <%= f.label :short_code, "Code" %>
       <%= f.text_field :short_code,

data/lib/searls/auth/builds_target_redirect_url.rb

@@ -1,16 +1,22 @@
 require "uri"
+require "rack/utils"
 
 module Searls
   module Auth
     class BuildsTargetRedirectUrl
-      def build(request, params)
+      def build(request, params, user: nil)
         path = normalize_path(params[:redirect_path])
-        host = resolve_host(request, params[:redirect_subdomain])
+        host = normalize_redirect_host(params[:redirect_host])
 
-        if host == request.host && path.present?
+        if (host.blank? || host == request.host) && path.present?
           path
-        elsif host != request.host
-          absolute_url(request, host, path)
+        elsif host.present? && host != request.host
+          url = absolute_url(request, host, path)
+          if same_cookie_domain?(request, host)
+            url
+          else
+            append_cross_domain_sso_token(url, request, user, host) || path
+          end
         end
       end
 
@@ -23,32 +29,12 @@ module Searls
         end
       end
 
-      def resolve_host(request, subdomain)
-        s = normalize_subdomain(subdomain)
-        cur = request.subdomain.presence
-        return request.host if s.nil? || s == cur || (s == "" && cur.nil?)
-        return root_host(request) || request.host if s == "" && cur
-        base = root_host(request) || request.host
-        "#{s}.#{base}"
-      end
+      def normalize_redirect_host(raw)
+        v = raw.to_s.strip.downcase
+        return if v.blank?
 
-      def normalize_subdomain(raw)
-        return "" if raw.is_a?(String) && raw.strip.empty?
-        if (v = raw.to_s.downcase).present?
-          v if /\A[a-z0-9-]+\z/.match?(v)
-        end
-      end
-
-      def root_host(request)
-        request.domain.presence || begin
-          host = URI.parse(request.base_url).host
-          sub = request.subdomain.to_s
-          if sub.empty?
-            host
-          else
-            pref = "#{sub}."
-            host.start_with?(pref) ? host.delete_prefix(pref) : host
-          end
+        if /\A[a-z0-9.-]+\z/.match?(v)
+          v
         end
       end
 
@@ -67,6 +53,29 @@ module Searls
         end
         uri.to_s
       end
+
+      def append_cross_domain_sso_token(url, request, user, host)
+        return if user.blank?
+
+        token = begin
+          provider = Searls::Auth.config.sso_token_for_cross_domain_redirects
+          provider&.call(user, request, host)
+        end
+        return if token.blank?
+
+        uri = URI.parse(url)
+        query = Rack::Utils.parse_nested_query(uri.query)
+        query["sso_token"] = token
+        uri.query = Rack::Utils.build_nested_query(query)
+        uri.to_s
+      end
+
+      def same_cookie_domain?(request, host)
+        domain = request.domain
+        return false if domain.blank?
+
+        host == domain || host.end_with?(".#{domain}")
+      end
     end
   end
 end

data/lib/searls/auth/config.rb

@@ -9,9 +9,11 @@ module Searls
     # Core hooks that must always be callable
     HOOK_FIELDS = [
       :user_finder_by_email,
+      :user_finder_by_email_for_registration,
       :user_finder_by_id,
       :user_finder_by_token,
       :user_initializer,
+      :existing_user_registration_blocked_predicate,
       :token_generator,
       :email_verified_predicate,
       :email_verified_setter,
@@ -23,9 +25,11 @@ module Searls
       :email_verification_mode, # :none, :optional, :required
       # Data setup
       :user_finder_by_email, # proc(email)
+      :user_finder_by_email_for_registration, # proc(email)
       :user_finder_by_id, # proc(id)
       :user_finder_by_token, # proc(token)
       :user_initializer, # proc(params)
+      :existing_user_registration_blocked_predicate, # proc(user, params)
       :user_name_method, # string
       :token_generator, # proc()
       :password_verifier, # proc(user, password)
@@ -60,12 +64,15 @@ module Searls
       :redirect_path_after_register, # string or proc(user, params, request, routes), all new registrations redirect here
       :redirect_path_after_login, # string or proc(user, params, request, routes), only redirected here if redirect_path param not set
       :redirect_path_after_settings_change, # string or proc(user, params, request, routes), post-settings updates redirect here
+      :redirect_url_after_logout, # string or proc(notice, params, request, routes)
+      :sso_token_for_cross_domain_redirects, # proc(user, request, target_host)
       # Hook setup
       :validate_registration, # proc(user, params, errors = []), must return an array of error messages where empty means valid
       :after_login_success, # proc(user)
       # Branding setup
       :app_name, # string
       :app_url, # string
+      :support_email_address, # string
       :email_banner_image_path, # string
       :email_background_color, # string
       :email_button_color, # string
@@ -108,6 +115,14 @@ module Searls
         auth_methods.include?(:password) && password_reset_enabled
       end
 
+      def default_redirect_path_after_login
+        redirect_path_after_login
+      end
+
+      def default_redirect_path_after_login=(value)
+        self.redirect_path_after_login = value
+      end
+
       def password_present?(user)
         predicate = password_present_predicate
         return false if predicate.nil?
@@ -120,6 +135,7 @@ module Searls
         validate_email_verification_mode!
         validate_numeric_options!
         validate_core_hooks!
+        ensure_callable_optional!(:sso_token_for_cross_domain_redirects)
         validate_password_settings!
         validate_default_user_hooks!
       rescue => e
@@ -224,6 +240,7 @@ module Searls
       def validate_default_user_hooks!
         hooks_pointing_at_user = [
           :user_finder_by_email,
+          :user_finder_by_email_for_registration,
           :user_finder_by_id,
           :user_finder_by_token,
           :user_initializer,
@@ -263,6 +280,17 @@ module Searls
           end
         end
 
+        if public_send(:user_finder_by_email_for_registration).equal?(Searls::Auth::DEFAULT_CONFIG[:user_finder_by_email_for_registration])
+          unless ::User.respond_to?(:find_by)
+            raise Searls::Auth::Error, "Default :user_finder_by_email_for_registration expects User.find_by(email: ...) to exist."
+          end
+          has_email_method = ::User.method_defined?(:email)
+          has_email_column = ::User.respond_to?(:column_names) && ::User.column_names.include?("email")
+          unless schema_checks_blocked? || has_email_method || has_email_column
+            raise Searls::Auth::Error, "Default :user_finder_by_email_for_registration expects a `users.email` attribute."
+          end
+        end
+
         if public_send(:user_finder_by_token).equal?(Searls::Auth::DEFAULT_CONFIG[:user_finder_by_token])
           unless ::User.respond_to?(:find_by_token_for)
             raise Searls::Auth::Error, "Default :user_finder_by_token expects User.find_by_token_for(:email_auth, token) (Rails signed_id API)."

data/lib/searls/auth/creates_user.rb

@@ -7,10 +7,10 @@ module Searls
       Result = Struct.new(:user, :success?, :error_messages)
 
       def call(params)
-        user = Searls::Auth.config.user_finder_by_email.call(params[:email]) ||
-          Searls::Auth.config.user_initializer.call(params)
+        found = Searls::Auth.config.user_finder_by_email_for_registration.call(params[:email])
+        user = found || Searls::Auth.config.user_initializer.call(params)
 
-        if user.persisted?
+        if user.persisted? && Searls::Auth.config.existing_user_registration_blocked_predicate.call(user, params)
           Result.new(nil, false, ["An account already exists for that email address. <a href=\"#{login_path(**forwardable_params(params))}\">Log in</a> instead?"])
         elsif (errors = Searls::Auth.config.validate_registration.call(user, params, [])).any?
           Result.new(nil, false, errors)
@@ -32,13 +32,13 @@ module Searls
       private
 
       def forwardable_params(params)
-        params.permit(:redirect_path, :redirect_subdomain, :email)
+        params.permit(:redirect_path, :redirect_host, :email)
       end
 
       def simplified_error_messages(model)
         model.errors.details.keys.map { |attr|
           model.errors.full_messages_for(attr).first
-        }.join
+        }.compact
       end
     end
   end

data/lib/searls/auth/delivers_password_reset.rb

@@ -3,13 +3,13 @@ module Searls
     class DeliversPasswordReset
       Result = Struct.new(:success?, keyword_init: true)
 
-      def deliver(user:, redirect_path: nil, redirect_subdomain: nil)
+      def deliver(user:, redirect_path: nil, redirect_host: nil)
         token = Searls::Auth.config.password_reset_token_generator.call(user)
         PasswordResetMailer.with(
           user:,
           token:,
           redirect_path:,
-          redirect_subdomain:
+          redirect_host:
         ).password_reset.deliver_later
         Result.new(success?: true)
       end

data/lib/searls/auth/emails_link.rb

@@ -1,13 +1,13 @@
 module Searls
   module Auth
     class EmailsLink
-      def email(user:, email_otp:, redirect_path: nil, redirect_subdomain: nil)
+      def email(user:, email_otp:, redirect_path: nil, redirect_host: nil)
         LoginLinkMailer.with(
           user:,
           token: (Searls::Auth.config.auth_methods.include?(:email_link) ? generate_token!(user) : nil),
           email_otp: (Searls::Auth.config.auth_methods.include?(:email_otp) ? email_otp : nil),
           redirect_path:,
-          redirect_subdomain:
+          redirect_host:
         ).login_link.deliver_later
       end
 

data/lib/searls/auth/emails_verification.rb

@@ -1,12 +1,12 @@
 module Searls
   module Auth
     class EmailsVerification
-      def email(user:, redirect_path: nil, redirect_subdomain: nil)
+      def email(user:, redirect_path: nil, redirect_host: nil)
         EmailVerificationMailer.with(
           user:,
           token: generate_token!(user),
           redirect_path:,
-          redirect_subdomain:
+          redirect_host:
         ).verification_email.deliver_later
       end
 

data/lib/searls/auth/sanitizes_flash_html.rb

@@ -0,0 +1,18 @@
+module Searls
+  module Auth
+    class SanitizesFlashHtml
+      def initialize
+        require "rails-html-sanitizer"
+        @safe_list_sanitizer = Rails::HTML::SafeListSanitizer.new
+      end
+
+      def sanitize(html)
+        @safe_list_sanitizer.sanitize(
+          html,
+          tags: %w[a b br code em i li ol p strong u ul],
+          attributes: %w[data-turbo-confirm data-turbo-method href rel target title]
+        )
+      end
+    end
+  end
+end

data/lib/searls/auth/version.rb

@@ -1,5 +1,5 @@
 module Searls
   module Auth
-    VERSION = "1.0.2"
+    VERSION = "2.0.0"
   end
 end

data/lib/searls/auth.rb

@@ -3,6 +3,7 @@ require_relative "auth/parses_time_safely"
 require_relative "auth/config"
 require_relative "auth/builds_target_redirect_url" if defined?(Rails)
 require_relative "auth/creates_user" if defined?(Rails)
+require_relative "auth/sanitizes_flash_html" if defined?(Rails)
 require_relative "auth/emails_link"
 require_relative "auth/emails_verification"
 require_relative "auth/engine" if defined?(Rails)
@@ -22,9 +23,11 @@ module Searls
       email_verification_mode: :none,
       # Data setup
       user_finder_by_email: ->(email) { User.find_by(email:) },
+      user_finder_by_email_for_registration: ->(email) { User.find_by(email:) },
       user_finder_by_id: ->(id) { User.find_by(id:) },
       user_finder_by_token: ->(token) { User.find_by_token_for(:email_auth, token) },
       user_initializer: ->(params) { User.new(email: params[:email]) },
+      existing_user_registration_blocked_predicate: ->(_user, _params) { true },
       user_name_method: "name",
       token_generator: ->(user) { user.generate_token_for(:email_auth) },
       email_otp_expiry_minutes: 30,
@@ -67,6 +70,7 @@ module Searls
       redirect_path_after_settings_change: ->(user, params, request, routes) {
         routes.respond_to?(:edit_settings_path) ? routes.edit_settings_path : "/settings"
       },
+      sso_token_for_cross_domain_redirects: nil,
       # Hook setup
       validate_registration: ->(user, params, errors) { errors },
       after_login_success: ->(user) {},

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: searls-auth
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 2.0.0
 platform: ruby
 authors:
 - Justin Searls
@@ -34,6 +34,7 @@ files:
 - LICENSE.txt
 - README.md
 - Rakefile
+- TODO.md
 - app/controllers/searls/auth/base_controller.rb
 - app/controllers/searls/auth/email_verifications_controller.rb
 - app/controllers/searls/auth/logins_controller.rb
@@ -80,6 +81,7 @@ files:
 - lib/searls/auth/railtie.rb
 - lib/searls/auth/resets_password.rb
 - lib/searls/auth/resets_session.rb
+- lib/searls/auth/sanitizes_flash_html.rb
 - lib/searls/auth/updates_settings.rb
 - lib/searls/auth/version.rb
 - script/setup