solrengine-auth 0.2.0 → 0.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e74477d86c34bcdd7d1e3aec0296d766c1dff71a64aabfabf122e47677a969e9
-  data.tar.gz: 5936982e40d446e51a142c1151346037aa2f26a9750d4c0a0547a3d5350f3a69
+  metadata.gz: 6d8f95b7e835cc386f50d7acf2deadea30d8483dfcbd63fda661c16269f423bc
+  data.tar.gz: 97143c16f74468083d1fbb19a857402b54db398f81a703d99b79bf45c1897b58
 SHA512:
-  metadata.gz: 1d69599d414495c813be1eac44eb2b51b102a984081201a7a736e752127a52937cd63284c07d493ef514bf6957f8ad03a637d5b2187831c8d19d892368dfc1d9
-  data.tar.gz: 8c468e7aeaa865762cf973b807597e1f5ea0959ae98410bc121dc8639dc5ae98bbddb8c4e91de8f90a37d088201d65139596c29a9ec9ba4c09fbb257be89bb6b
+  metadata.gz: 967003f7900f46356cc26c1302ffeb26c56d642c87c5617b7ee4edede3122c2f04e0760da9ba66a18c806bda05d3aaa28ff87b80b172fd8a2aa6ca1e8f10d5f6
+  data.tar.gz: 0404ce446e41f45956f48074a59d8138b8d5ade9f4026b743f2db1d763c3f6bcf75abc4e24931a84f2251aa748551ff78f977a7d201efc86e28eb389791843e9

data/README.md

@@ -63,12 +63,17 @@ end
 
 1. User clicks "Connect Wallet" -- Stimulus discovers installed wallets via Wallet Standard
 2. User selects a wallet -- extension popup opens
-3. Rails generates a SIWS message with a nonce (POST `/auth/nonce`)
+3. Rails generates a SIWS message with a nonce (GET `/auth/nonce`)
 4. Wallet signs the message (Ed25519)
 5. Rails verifies the signature, validates the nonce, and creates a session (POST `/auth/verify`)
 
 No passwords. No emails. The wallet is the identity.
 
+The challenge nonce is held in the signed-cookie session, so `POST /auth/nonce`
+performs no database writes — the `User` row is created only after the signature
+is verified in step 5. The `nonce` / `nonce_expires_at` columns are retained for
+backward compatibility but are not used by the bundled controller.
+
 ## Usage in Controllers
 
 ```ruby

data/app/assets/javascripts/solrengine/auth/wallet_controller.js

@@ -165,17 +165,13 @@ export default class extends Controller {
         }
       }
 
-      // Step 2: Request a nonce from the server
+      // Step 2: Request a nonce from the server. GET with a query param, to
+      // match @solrengine/wallet-utils — the controller most host apps actually
+      // register. The challenge is a read from the server's perspective; it
+      // writes only to the signed-cookie session, never the database.
       this.showSigning()
-      const csrfToken = document.querySelector('meta[name="csrf-token"]')?.content
-      const nonceResponse = await fetch(this.nonceUrlValue, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "Accept": "application/json",
-          "X-CSRF-Token": csrfToken
-        },
-        body: JSON.stringify({ wallet_address: publicKey })
+      const nonceResponse = await fetch(`${this.nonceUrlValue}?wallet_address=${publicKey}`, {
+        headers: { "Accept": "application/json" }
       })
 
       if (!nonceResponse.ok) {
@@ -191,6 +187,7 @@ export default class extends Controller {
       // Step 4: Send the signed message to the server for verification
       const signatureString = Array.from(signatureBytes).join(",")
 
+      const csrfToken = document.querySelector('meta[name="csrf-token"]')?.content
       const verifyResponse = await fetch(this.verifyUrlValue, {
         method: "POST",
         headers: {

data/app/controllers/solrengine/auth/sessions_controller.rb

@@ -22,36 +22,46 @@ module Solrengine
         # Renders the wallet connect view
       end
 
+      # Issues a SIWS challenge. The nonce lives in the signed-cookie session,
+      # NOT the database — an unauthenticated request must never write a row.
+      # The user record is created later, in #create, and only after the
+      # wallet proves ownership of the key by signing this nonce.
       def nonce
-        user = _user_class.find_or_create_by!(wallet_address: params[:wallet_address])
-        user.generate_nonce!
+        wallet_address = params[:wallet_address].to_s
+
+        unless wallet_address.match?(Solrengine::Auth::Concerns::Authenticatable::SOLANA_ADDRESS_FORMAT)
+          return render json: { error: "Invalid wallet address", code: "invalid_wallet_address" },
+                        status: :unprocessable_entity
+        end
+
+        nonce = SecureRandom.hex(16)
+        session[:siws_nonce] = nonce
+        session[:siws_wallet] = wallet_address
+        session[:siws_nonce_expires_at] = Solrengine::Auth.configuration.nonce_ttl.from_now.iso8601
 
         message = SiwsMessageBuilder.new(
           domain: Solrengine::Auth.configuration.domain,
-          wallet_address: user.wallet_address,
-          nonce: user.nonce,
+          wallet_address: wallet_address,
+          nonce: nonce,
           uri: request.base_url
         ).build
 
-        render json: { message: message, nonce: user.nonce }
-      rescue ActiveRecord::RecordInvalid
-        render json: { error: "Invalid wallet address", code: "invalid_wallet_address" },
-               status: :unprocessable_entity
+        render json: { message: message, nonce: nonce }
       end
 
       def create
-        user = _user_class.find_by(wallet_address: params[:wallet_address])
+        wallet_address = params[:wallet_address].to_s
 
-        unless user&.nonce_valid?
+        unless session_nonce_valid?(wallet_address)
           return render json: { error: "Could not sign in", code: "nonce_expired" },
                         status: :unprocessable_entity
         end
 
         verifier = SiwsVerifier.new(
-          wallet_address: params[:wallet_address],
+          wallet_address: wallet_address,
           message: params[:message],
           signature: params[:signature],
-          expected_nonce: user.nonce
+          expected_nonce: session[:siws_nonce]
         )
 
         unless verifier.verify
@@ -59,8 +69,11 @@ module Solrengine
                         status: :unauthorized
         end
 
-        user.generate_nonce!
+        # Key ownership proven — only now do we touch the database.
+        user = _user_class.find_or_create_by!(wallet_address: wallet_address)
 
+        # reset_session clears the (now-consumed) nonce, making it single-use,
+        # and rotates the session id to prevent fixation.
         reset_session
         session[:user_id] = user.id
         render json: { success: true, wallet_address: user.wallet_address }
@@ -76,6 +89,19 @@ module Solrengine
 
       private
 
+      # The nonce is only valid for the wallet it was issued to, and only
+      # until it expires. The signature itself is checked separately, against
+      # this nonce, by SiwsVerifier.
+      def session_nonce_valid?(wallet_address)
+        return false if session[:siws_nonce].blank?
+        return false unless session[:siws_wallet].to_s == wallet_address
+
+        expires_at = session[:siws_nonce_expires_at]
+        expires_at.present? && Time.iso8601(expires_at.to_s) > Time.current
+      rescue ArgumentError
+        false
+      end
+
       def _user_class
         Solrengine::Auth.configuration.user_model
       end

data/lib/solrengine/auth/version.rb

@@ -2,6 +2,6 @@
 
 module Solrengine
   module Auth
-    VERSION = "0.2.0"
+    VERSION = "0.2.2"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: solrengine-auth
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.2
 platform: ruby
 authors:
 - Jose Ferrer
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-04-19 00:00:00.000000000 Z
+date: 2026-06-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails