solrengine-auth 0.1.1 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: df23b01409dffb68f966f67598f23f01099886129e74164346d0c9a7712959d4
-  data.tar.gz: ce7cae7ad431d9aec869847e831a3d4d944cae1269609f69ce8fbb5f583d3ebd
+  metadata.gz: e74477d86c34bcdd7d1e3aec0296d766c1dff71a64aabfabf122e47677a969e9
+  data.tar.gz: 5936982e40d446e51a142c1151346037aa2f26a9750d4c0a0547a3d5350f3a69
 SHA512:
-  metadata.gz: f5b794dd88bad141918294d789283812edb9c44c2ffaa0e3015535c56f52bf3b0c09ba898f6d76bc0844ab766541137e5ee51263f3fdd89b7b9b9f6ae13327ca
-  data.tar.gz: 1d1fe7214949db640fea0608efe85b1a84e92691245ffc2a046c936b958f61a8a9a4f07799558cb223f03a5d218e61893edbd6bf01797f0e86a05877cf1a1a01
+  metadata.gz: 1d69599d414495c813be1eac44eb2b51b102a984081201a7a736e752127a52937cd63284c07d493ef514bf6957f8ad03a637d5b2187831c8d19d892368dfc1d9
+  data.tar.gz: 8c468e7aeaa865762cf973b807597e1f5ea0959ae98410bc121dc8639dc5ae98bbddb8c4e91de8f90a37d088201d65139596c29a9ec9ba4c09fbb257be89bb6b

data/README.md

@@ -94,13 +94,21 @@ verifier = Solrengine::Auth::SiwsVerifier.new(
   wallet_address: "Abc...xyz",
   message: siws_message,
   signature: signature_bytes,
-  domain: "myapp.com"
+  domain: "myapp.com",
+  expected_nonce: user.nonce  # bind to server-issued nonce (recommended)
 )
 
 verifier.verify  # => true/false
 verifier.verify! # => true or raises VerificationError
 ```
 
+**Always pass `expected_nonce:` when verifying a live sign-in.** Without
+it, the verifier accepts any syntactically-valid nonce in the signed
+message, which makes captured `(message, signature)` pairs replayable
+as long as the wallet still has any fresh nonce on the server. The
+bundled `Solrengine::Auth::SessionsController` does this for you; apps
+that build their own controller must do it themselves.
+
 ## License
 
 MIT

data/app/controllers/solrengine/auth/application_controller.rb

@@ -2,7 +2,7 @@
 
 module Solrengine
   module Auth
-    class ApplicationController < ActionController::Base
+    class ApplicationController < ::ApplicationController
     end
   end
 end

data/app/controllers/solrengine/auth/sessions_controller.rb

@@ -3,58 +3,60 @@
 module Solrengine
   module Auth
     class SessionsController < ApplicationController
+      # The gem inherits from the host app's ApplicationController, which
+      # typically installs a before_action :authenticate!. Skip it on the
+      # sign-in flow so /auth/login doesn't redirect-loop.
+      skip_before_action :authenticate!, only: [ :new, :nonce, :create ], raise: false
+
+      # Rate-limits are keyed by wallet_address on #nonce so an attacker
+      # can't churn nonces against a target wallet from rotating IPs, and
+      # by IP on #create since there the wallet is attacker-chosen.
+      rate_limit to: 10, within: 1.minute, only: :nonce,
+        by: -> { params[:wallet_address].to_s.presence || request.remote_ip },
+        with: -> { render json: { error: "Too many requests" }, status: :too_many_requests }
+
+      rate_limit to: 10, within: 1.minute, only: :create,
+        with: -> { render json: { error: "Too many requests" }, status: :too_many_requests }
+
       def new
         # Renders the wallet connect view
       end
 
       def nonce
-        wallet_address = params[:wallet_address]
-
-        unless wallet_address.match?(Concerns::Authenticatable::SOLANA_ADDRESS_FORMAT)
-          return render json: { error: "Invalid wallet address" }, status: :unprocessable_entity
-        end
-
-        user_class = _user_class
-        user = user_class.find_or_initialize_by(wallet_address: wallet_address)
-        user.generate_nonce! if user.persisted?
-        user.save! unless user.persisted?
+        user = _user_class.find_or_create_by!(wallet_address: params[:wallet_address])
+        user.generate_nonce!
 
-        domain = Solrengine::Auth.configuration.domain
         message = SiwsMessageBuilder.new(
-          domain: domain,
-          wallet_address: wallet_address,
+          domain: Solrengine::Auth.configuration.domain,
+          wallet_address: user.wallet_address,
           nonce: user.nonce,
           uri: request.base_url
         ).build
 
         render json: { message: message, nonce: user.nonce }
+      rescue ActiveRecord::RecordInvalid
+        render json: { error: "Invalid wallet address", code: "invalid_wallet_address" },
+               status: :unprocessable_entity
       end
 
       def create
-        wallet_address = params[:wallet_address]
-        message = params[:message]
-        signature = params[:signature]
-
-        user = _user_class.find_by(wallet_address: wallet_address)
+        user = _user_class.find_by(wallet_address: params[:wallet_address])
 
         unless user&.nonce_valid?
-          return render json: { error: "Authentication expired. Please try again." }, status: :unprocessable_entity
+          return render json: { error: "Could not sign in", code: "nonce_expired" },
+                        status: :unprocessable_entity
         end
 
         verifier = SiwsVerifier.new(
-          wallet_address: wallet_address,
-          message: message,
-          signature: signature
+          wallet_address: params[:wallet_address],
+          message: params[:message],
+          signature: params[:signature],
+          expected_nonce: user.nonce
         )
 
         unless verifier.verify
-          return render json: { error: "Signature verification failed" }, status: :unauthorized
-        end
-
-        # Verify the nonce in the signed message matches the database nonce
-        message_nonce = message.match(/Nonce: ([a-f0-9]+)/)&.captures&.first
-        unless message_nonce.present? && ActiveSupport::SecurityUtils.secure_compare(message_nonce, user.nonce)
-          return render json: { error: "Nonce mismatch" }, status: :unauthorized
+          return render json: { error: "Could not sign in", code: "verification_failed" },
+                        status: :unauthorized
         end
 
         user.generate_nonce!
@@ -66,7 +68,10 @@ module Solrengine
 
       def destroy
         reset_session
-        redirect_to Solrengine::Auth.configuration.after_sign_out_path, notice: "Disconnected"
+        respond_to do |format|
+          format.html { redirect_to Solrengine::Auth.configuration.after_sign_out_path, notice: "Disconnected" }
+          format.json { head :no_content }
+        end
       end
 
       private

data/config/routes.rb

@@ -2,7 +2,7 @@
 
 Solrengine::Auth::Engine.routes.draw do
   get  "login",  to: "sessions#new",     as: :login
-  post "nonce",  to: "sessions#nonce",   as: :nonce
+  get  "nonce",  to: "sessions#nonce",   as: :nonce
   post "verify", to: "sessions#create",  as: :verify
   delete "logout", to: "sessions#destroy", as: :logout
 end

data/lib/solrengine/auth/siws_verifier.rb

@@ -2,25 +2,33 @@
 
 require "ed25519"
 require "base58"
+require "active_support/security_utils"
 
 module Solrengine
   module Auth
     # Verifies SIWS (Sign In With Solana) signed messages.
     # Uses Ed25519 signature verification and validates domain
     # to prevent cross-site replay attacks.
+    #
+    # Pass `expected_nonce:` to bind the signed message to a server-issued
+    # nonce. Without that binding, a captured (message, signature) pair can
+    # be replayed as long as the wallet still has any fresh nonce — callers
+    # should always supply it when verifying a live sign-in.
     class SiwsVerifier
       class VerificationError < StandardError; end
 
-      def initialize(wallet_address:, message:, signature:, domain: nil)
+      def initialize(wallet_address:, message:, signature:, domain: nil, expected_nonce: nil)
         @wallet_address = wallet_address
         @message = message
         @signature = signature
         @domain = domain || Solrengine::Auth.configuration.domain
+        @expected_nonce = expected_nonce
       end
 
       def verify!
         verify_message_format!
         verify_domain!
+        verify_nonce! if @expected_nonce
         verify_signature!
         true
       rescue Ed25519::VerifyError
@@ -52,6 +60,13 @@ module Solrengine
         end
       end
 
+      def verify_nonce!
+        actual = extract_nonce.to_s
+        unless ActiveSupport::SecurityUtils.secure_compare(actual, @expected_nonce.to_s)
+          raise VerificationError, "Nonce does not match expected value"
+        end
+      end
+
       def verify_signature!
         pubkey_bytes = Base58.base58_to_binary(@wallet_address, :bitcoin)
         signature_bytes = decode_signature(@signature)
@@ -61,7 +76,7 @@ module Solrengine
       end
 
       def extract_nonce
-        match = @message.match(/Nonce: ([a-f0-9]+)/)
+        match = @message.match(/^Nonce: ([a-f0-9]+)$/)
         match&.captures&.first
       end
 

data/lib/solrengine/auth/version.rb

@@ -2,6 +2,6 @@
 
 module Solrengine
   module Auth
-    VERSION = "0.1.1"
+    VERSION = "0.2.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: solrengine-auth
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.2.0
 platform: ruby
 authors:
 - Jose Ferrer
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-03-23 00:00:00.000000000 Z
+date: 2026-04-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails