sorcery 0.17.0 → 0.18.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f0d32dda46271c863af12b7e00fd451bf10017f3976c863c628c35e92694ba11
-  data.tar.gz: c10900d15fd8ab8277be5bc9f6402e5fa8a60ea30141212b4f05f354768cb06f
+  metadata.gz: e7509bf9580f3d4e579673961938754bac00a886623769bc36256ceae03afaf1
+  data.tar.gz: 0d3c7604e272b2e1adc7b30f5baa6ddcedd8b164d711e2b673a2b62810e054a5
 SHA512:
-  metadata.gz: c86b28d8be6ffff0d2ea865cf18af4dc432fc046f8b1d0fe57091529d5f936d2b2cb54692110675f91e1126d9ae8987b24e423b2aacc8f2205d511e7a8ae8a90
-  data.tar.gz: d37df5136edd49c75f8f28aae3f8a5a007dbc42ae3aefea7c270b2fb561ca73e628d478d5d4fab073a8546c4f1103af44969cfe0ad8b897579e72c01e02253d8
+  metadata.gz: c9a62852a6395dc2460fe1262752cd3a9d1934964b4e2dc5e8422bd39431515f7d21b7b0f2bb3cf9d1f1aace5c20b19897b54d56c229acf38193842127312f95
+  data.tar.gz: 4410f00144bfba291b84225f9c7f81e5e7d518b27b5c460558f94c4434c5263e8e1c2ad0004f811e0d295f7d580a0cc3e4344490fe59efdd2eb795389faa3d31

data/CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
-## HEAD
+
+**Note: As of version 0.17.0, we no longer maintain this CHANGELOG.md file manually. For the latest changes and release notes, please refer to [GitHub Releases](https://github.com/Sorcery/sorcery/releases).**
+
+This file contains historical changelog entries for reference. New releases and their changes are documented in GitHub Releases.
 
 ## 0.17.0
 

data/README.md

@@ -55,6 +55,7 @@ explaining and the rest are commented:
 ```ruby
 require_login # This is a before action
 login(email, password, remember_me = false)
+login!(email, password, remember_me = false) # Raises a `Sorcery::InvalidCredentials` exception on failure
 auto_login(user) # Login without credentials
 logout
 logged_in? # Available in views
@@ -235,14 +236,16 @@ Feel free to ask questions using these contact details:
 
 **Current Maintainers:**
 
-- Josh Buker ([@joshbuker](https://github.com/joshbuker)) | [Email](mailto:crypto+sorcery@joshbuker.com?subject=Sorcery)
+- Shinichi Maeshima ([@willnet](https://github.com/willnet)) | [Email](mailto:netwillnet+sorcery@gmail.com?subject=Sorcery)
+- Brendon Muir ([@brendon](https://github.com/brendon)) | [Email](mailto:brendon+sorcery@spike.net.nz?subject=Sorcery)
 
 **Past Maintainers:**
 
-- Noam Ben-Ari ([@NoamB](https://github.com/NoamB)) | [Email](mailto:nbenari@gmail.com) | [Twitter](https://twitter.com/nbenari)
-- Kir Shatrov ([@kirs](https://github.com/kirs)) | [Email](mailto:shatrov@me.com) | [Twitter](https://twitter.com/Kiiiir)
-- Grzegorz Witek ([@arnvald](https://github.com/arnvald)) | [Email](mailto:arnvald.to@gmail.com) | [Twitter](https://twitter.com/arnvald)
-- Chase Gilliam ([@Ch4s3](https://github.com/Ch4s3)) | [Email](mailto:chase.gilliam@gmail.com)
+- Josh Buker ([@joshbuker](https://github.com/joshbuker)) | [Email](mailto:github-profile+sorcery@joshbuker.com?subject=Sorcery)
+- Noam Ben-Ari ([@NoamB](https://github.com/NoamB)) | [Email](mailto:nbenari+sorcery@gmail.com?subject=Sorcery) | [Twitter](https://twitter.com/nbenari)
+- Kir Shatrov ([@kirs](https://github.com/kirs)) | [Email](mailto:shatrov+sorcery@me.com?subject=Sorcery) | [Twitter](https://twitter.com/Kiiiir)
+- Grzegorz Witek ([@arnvald](https://github.com/arnvald)) | [Email](mailto:arnvald.to+sorcery@gmail.com?subject=Sorcery) | [Twitter](https://twitter.com/arnvald)
+- Chase Gilliam ([@Ch4s3](https://github.com/Ch4s3)) | [Email](mailto:chase.gilliam+sorcery@gmail.com?subject=Sorcery)
 
 ## License
 

data/lib/generators/sorcery/helpers.rb

@@ -13,7 +13,7 @@ module Sorcery
       end
 
       def tableized_model_class
-        options[:model] ? options[:model].gsub(/::/, '').tableize : 'users'
+        options[:model] ? options[:model].gsub('::', '').tableize : 'users'
       end
 
       def model_path

data/lib/generators/sorcery/install_generator.rb

@@ -4,6 +4,7 @@ require 'generators/sorcery/helpers'
 module Sorcery
   module Generators
     class InstallGenerator < Rails::Generators::Base
+      EXCLUDED_SUBMODULES = %w[http_basic_auth session_timeout core].freeze
       include Rails::Generators::Migration
       include Sorcery::Generators::Helpers
 
@@ -35,7 +36,7 @@ module Sorcery
         # Add submodules to the initializer file.
         return unless submodules
 
-        submodule_names = submodules.collect { |submodule| ':' + submodule }
+        submodule_names = submodules.collect { |submodule| ":#{submodule}" }
 
         gsub_file sorcery_config_path, /submodules = \[.*\]/ do |str|
           current_submodule_names = (str =~ /\[(.*)\]/ ? Regexp.last_match(1) : '').delete(' ').split(',')
@@ -61,12 +62,14 @@ module Sorcery
         # Copy core migration file in all cases except when you pass --only-submodules.
         return unless defined?(ActiveRecord)
 
-        migration_template 'migration/core.rb', 'db/migrate/sorcery_core.rb', migration_class_name: migration_class_name unless only_submodules?
+        unless only_submodules?
+          migration_template 'migration/core.rb', 'db/migrate/sorcery_core.rb', migration_class_name: migration_class_name
+        end
 
         return unless submodules
 
         submodules.each do |submodule|
-          unless %w[http_basic_auth session_timeout core].include?(submodule)
+          unless EXCLUDED_SUBMODULES.include?(submodule)
             migration_template "migration/#{submodule}.rb", "db/migrate/sorcery_#{submodule}.rb", migration_class_name: migration_class_name
           end
         end
@@ -74,34 +77,22 @@ module Sorcery
 
       # Define the next_migration_number method (necessary for the migration_template method to work)
       def self.next_migration_number(dirname)
-        if timestamped_migrations?
+        if ActiveRecord.timestamped_migrations
           sleep 1 # make sure each time we get a different timestamp
           Time.new.utc.strftime('%Y%m%d%H%M%S')
         else
-          format('%.3d', (current_migration_number(dirname) + 1))
+          format('%.3d', current_migration_number(dirname) + 1)
         end
       end
 
       private
 
-      def self.timestamped_migrations?
-        if Rails::VERSION::MAJOR >= 7
-          ActiveRecord.timestamped_migrations
-        else
-          ActiveRecord::Base.timestamped_migrations
-        end
-      end
-
       def only_submodules?
         options[:migrations] || options[:only_submodules]
       end
 
       def migration_class_name
-        if Rails::VERSION::MAJOR >= 5
-          "ActiveRecord::Migration[#{Rails::VERSION::MAJOR}.#{Rails::VERSION::MINOR}]"
-        else
-          'ActiveRecord::Migration'
-        end
+        "ActiveRecord::Migration[#{Rails::VERSION::MAJOR}.#{Rails::VERSION::MINOR}]"
       end
     end
   end

data/lib/generators/sorcery/templates/initializer.rb

@@ -16,11 +16,20 @@ Rails.application.config.sorcery.configure do |config|
   # config.not_authenticated_action =
 
   # When a non logged-in user tries to enter a page that requires login, save
-  # the URL he wants to reach, and send him there after login, using 'redirect_back_or_to'.
+  # the URL he wants to reach, and send him there after login, using 'redirect_to_before_login_path'.
   # Default: `true`
   #
   # config.save_return_to_url =
 
+  # Set whether to use 'redirect_back_or_to' defined in Rails 7.
+  # Rails 7 released a new method called 'redirect_back_or_to' as a replacement for 'redirect_back'.
+  # That may conflict with the method by the same name defined by Sorcery.
+  # If you set this option to true, Sorcery's 'redirect_back_or_to' calls 'super' to use
+  # the method of the same name defined in Rails 7.
+  # Default: `false`
+  #
+  # config.use_redirect_back_or_to_by_rails =
+
   # Set domain option for cookies; Useful for remember_me submodule.
   # Default: `nil`
   #
@@ -31,12 +40,6 @@ Rails.application.config.sorcery.configure do |config|
   #
   # config.remember_me_httponly =
 
-  # Set token randomness. (e.g. user activation tokens)
-  # The length of the result string is about 4/3 of `token_randomness`.
-  # Default: `15`
-  #
-  # config.token_randomness =
-
   # -- session timeout --
   # How long in seconds to keep the session alive.
   # Default: `3600`
@@ -75,6 +78,11 @@ Rails.application.config.sorcery.configure do |config|
   #
   # config.register_last_activity_time =
 
+  # Will register the source ip address of last user login, every login.
+  # Default: `true`
+  #
+  # config.register_last_ip_address =
+
   # -- external --
   # What providers are supported by this app
   # i.e. [:twitter, :facebook, :github, :linkedin, :xing, :google, :liveid, :salesforce, :slack, :line].
@@ -226,7 +234,7 @@ Rails.application.config.sorcery.configure do |config|
   # config.line.bot_prompt = "normal"
   # config.line.user_info_mapping = {name: 'displayName'}
 
-  
+
   # For information about Discord API
   # https://discordapp.com/developers/docs/topics/oauth2
   # config.discord.key = "xxxxxx"
@@ -284,6 +292,12 @@ Rails.application.config.sorcery.configure do |config|
     #
     user.stretches = 1 if Rails.env.test?
 
+    # Set token randomness. (e.g. user activation tokens)
+    # The length of the result string is about 4/3 of `token_randomness`.
+    # Default: `15`
+    #
+    # user.token_randomness =
+
     # Encryption key used to encrypt reversible encryptions such as AES256.
     # WARNING: If used for users' passwords, changing this key will leave passwords undecryptable!
     # Default: `nil`
@@ -362,8 +376,8 @@ Rails.application.config.sorcery.configure do |config|
     # user.activation_mailer_disabled =
 
     # Method to send email related
-    # options: `:deliver_later`, `:deliver_now`, `:deliver`
-    # Default: :deliver (Rails version < 4.2) or :deliver_now (Rails version 4.2+)
+    # options: `:deliver_later`, `:deliver_now`
+    # Default: :deliver_now
     #
     # user.email_delivery_method =
 

data/lib/sorcery/adapters/active_record_adapter.rb

@@ -1,12 +1,12 @@
 module Sorcery
   module Adapters
     class ActiveRecordAdapter < BaseAdapter
-      def update_attributes(attrs)
+      def update_attributes(attrs) # rubocop:disable Naming/PredicateMethod
         attrs.each do |name, value|
           @model.send(:"#{name}=", value)
         end
         primary_key = @model.class.primary_key
-        updated_count = @model.class.where(:"#{primary_key}" => @model.send(:"#{primary_key}")).update_all(attrs)
+        updated_count = @model.class.where("#{primary_key}": @model.send(:"#{primary_key}")).update_all(attrs)
         updated_count == 1
       end
 
@@ -23,7 +23,7 @@ module Sorcery
         @user_config ||= ::Sorcery::Controller::Config.user_class.to_s.constantize.sorcery_config
         conditions = {
           @user_config.provider_uid_attribute_name => uid,
-          @user_config.provider_attribute_name     => provider
+          @user_config.provider_attribute_name => provider
         }
 
         @model.public_send(relation_name).where(conditions).first
@@ -42,7 +42,7 @@ module Sorcery
           @user_config ||= ::Sorcery::Controller::Config.user_class.to_s.constantize.sorcery_config
           conditions = {
             @user_config.provider_uid_attribute_name => uid,
-            @user_config.provider_attribute_name     => provider
+            @user_config.provider_attribute_name => provider
           }
 
           @klass.where(conditions).first
@@ -56,11 +56,11 @@ module Sorcery
           relation = nil
 
           @klass.sorcery_config.username_attribute_names.each do |attribute|
-            if @klass.sorcery_config.downcase_username_before_authenticating
-              condition = @klass.arel_table[attribute].lower.eq(@klass.arel_table.lower(credentials[0]))
-            else
-              condition = @klass.arel_table[attribute].eq(credentials[0])
-            end
+            condition = if @klass.sorcery_config.downcase_username_before_authenticating
+                          @klass.arel_table[attribute].lower.eq(@klass.arel_table.lower(credentials[0]))
+                        else
+                          @klass.arel_table[attribute].eq(credentials[0])
+                        end
 
             relation = if relation.nil?
                          condition
@@ -88,9 +88,7 @@ module Sorcery
 
         def find_by_username(username)
           @klass.sorcery_config.username_attribute_names.each do |attribute|
-            if @klass.sorcery_config.downcase_username_before_authenticating
-              username = username.downcase
-            end
+            username = username.downcase if @klass.sorcery_config.downcase_username_before_authenticating
 
             result = @klass.where(attribute => username).first
             return result if result
@@ -101,8 +99,8 @@ module Sorcery
           @klass.where(@klass.sorcery_config.email_attribute_name => email).first
         end
 
-        def transaction(&blk)
-          @klass.tap(&blk)
+        def transaction(&)
+          @klass.tap(&)
         end
       end
     end

data/lib/sorcery/adapters/mongoid_adapter.rb

@@ -2,7 +2,7 @@ module Sorcery
   module Adapters
     class MongoidAdapter < BaseAdapter
       def increment(attr)
-        mongoid_4? ? @model.inc(attr => 1) : @model.inc(attr, 1)
+        @model.inc(attr => 1)
       end
 
       def update_attributes(attrs)
@@ -22,10 +22,6 @@ module Sorcery
         @model.send(mthd, options)
       end
 
-      def mongoid_4?
-        Gem::Version.new(::Mongoid::VERSION) >= Gem::Version.new('4.0.0.alpha')
-      end
-
       class << self
         def define_field(name, type, options = {})
           @klass.field name, options.slice(:default).merge(type: type)
@@ -44,7 +40,9 @@ module Sorcery
         end
 
         def credential_regex(credential)
-          return { :$regex => /^#{Regexp.escape(credential)}$/i } if @klass.sorcery_config.downcase_username_before_authenticating
+          if @klass.sorcery_config.downcase_username_before_authenticating
+            return { :$regex => /^#{Regexp.escape(credential)}$/i }
+          end
 
           credential
         end
@@ -70,8 +68,8 @@ module Sorcery
           @klass.where(@klass.sorcery_config.remember_me_token_attribute_name => token).first
         end
 
-        def transaction(&blk)
-          tap(&blk)
+        def transaction(&)
+          tap(&)
         end
 
         def find_by_id(id)

data/lib/sorcery/controller/config.rb

@@ -2,37 +2,35 @@ module Sorcery
   module Controller
     module Config
       class << self
-        attr_accessor :submodules
-        # what class to use as the user class.
-        attr_accessor :user_class
-        # what controller action to call for non-authenticated users.
-        attr_accessor :not_authenticated_action
-        # when a non logged in user tries to enter a page that requires login,
-        # save the URL he wanted to reach, and send him there after login.
-        attr_accessor :save_return_to_url
-        # set domain option for cookies
-        attr_accessor :cookie_domain
-
-        attr_accessor :login_sources
-        attr_accessor :after_login
-        attr_accessor :after_failed_login
-        attr_accessor :before_logout
-        attr_accessor :after_logout
-        attr_accessor :after_remember_me
+        attr_accessor :submodules,
+                      :user_class, # what class to use as the user class.
+                      :not_authenticated_action, # what controller action to call for non-authenticated users.
+                      :save_return_to_url, # when a non logged in user tries to enter a page that requires login, save the URL he wanted to reach, and send him there after login.
+                      :cookie_domain, # set domain option for cookies
+                      :login_sources,
+                      :after_login,
+                      :after_failed_login,
+                      :before_logout,
+                      :after_logout,
+                      :after_remember_me,
+                      :use_redirect_back_or_to_by_rails, # set whether to use 'redirect_back_or_to' defined in Rails 7.
+                      :after_login_lock
 
         def init!
           @defaults = {
-            :@user_class                           => nil,
-            :@submodules                           => [],
-            :@not_authenticated_action             => :not_authenticated,
-            :@login_sources                        => Set.new,
-            :@after_login                          => Set.new,
-            :@after_failed_login                   => Set.new,
-            :@before_logout                        => Set.new,
-            :@after_logout                         => Set.new,
-            :@after_remember_me                    => Set.new,
-            :@save_return_to_url                   => true,
-            :@cookie_domain                        => nil
+            :@user_class => nil,
+            :@submodules => [],
+            :@not_authenticated_action => :not_authenticated,
+            :@login_sources => Set.new,
+            :@after_login => Set.new,
+            :@after_failed_login => Set.new,
+            :@before_logout => Set.new,
+            :@after_logout => Set.new,
+            :@after_remember_me => Set.new,
+            :@save_return_to_url => true,
+            :@cookie_domain => nil,
+            :@use_redirect_back_or_to_by_rails => false,
+            :@after_login_lock => Set.new
           }
         end
 
@@ -58,7 +56,7 @@ module Sorcery
         end
 
         def configure!
-          @configure_blk.call(self) if @configure_blk
+          @configure_blk&.call(self)
         end
       end
 

data/lib/sorcery/controller/submodules/activity_logging.rb

@@ -16,16 +16,13 @@ module Sorcery
           base.send(:include, InstanceMethods)
           Config.module_eval do
             class << self
-              attr_accessor :register_login_time
-              attr_accessor :register_logout_time
-              attr_accessor :register_last_activity_time
-              attr_accessor :register_last_ip_address
+              attr_accessor :register_login_time, :register_logout_time, :register_last_activity_time, :register_last_ip_address
 
               def merge_activity_logging_defaults!
-                @defaults.merge!(:@register_login_time         => true,
-                                 :@register_logout_time        => true,
+                @defaults.merge!(:@register_login_time => true,
+                                 :@register_logout_time => true,
                                  :@register_last_activity_time => true,
-                                 :@register_last_ip_address    => true)
+                                 :@register_last_ip_address => true)
               end
             end
             merge_activity_logging_defaults!

data/lib/sorcery/controller/submodules/brute_force_protection.rb

@@ -22,7 +22,10 @@ module Sorcery
           # Runs as a hook after a failed login.
           def update_failed_logins_count!(credentials)
             user = user_class.sorcery_adapter.find_by_credentials(credentials)
-            user.register_failed_login! if user
+            return unless user && !user.login_locked?
+
+            user.register_failed_login!
+            after_login_lock!(credentials) if user.login_locked?
           end
 
           # Resets the failed logins counter.

data/lib/sorcery/controller/submodules/external.rb

@@ -39,9 +39,9 @@ module Sorcery
 
                 providers.each do |name|
                   class_eval <<-RUBY, __FILE__, __LINE__ + 1
-                    def self.#{name}
-                      @#{name} ||= Sorcery::Providers.const_get('#{name}'.to_s.camelcase).new
-                    end
+                    def self.#{name}                                                          # def self.github
+                      @#{name} ||= Sorcery::Providers.const_get('#{name}'.camelcase).new      #   @github ||= Sorcery::Providers.const_get('github'.camelcase).new
+                    end                                                                       # end
                   RUBY
                 end
               end
@@ -186,21 +186,21 @@ module Sorcery
           #
           #   create_from(provider) {|user| user.some_check }
           #
-          def create_from(provider_name, &block)
+          def create_from(provider_name, &)
             sorcery_fetch_user_hash provider_name
             # config = user_class.sorcery_config # TODO: Unused, remove?
 
             attrs = user_attrs(@provider.user_info_mapping, @user_hash)
-            @user = user_class.create_from_provider(provider_name, @user_hash[:uid], attrs, &block)
+            @user = user_class.create_from_provider(provider_name, @user_hash[:uid], attrs, &)
           end
 
           # follows the same patterns as create_from, but builds the user instead of creating
-          def build_from(provider_name, &block)
+          def build_from(provider_name, &)
             sorcery_fetch_user_hash provider_name
             # config = user_class.sorcery_config # TODO: Unused, remove?
 
             attrs = user_attrs(@provider.user_info_mapping, @user_hash)
-            @user = user_class.build_from_provider(attrs, &block)
+            @user = user_class.build_from_provider(attrs, &)
           end
 
           def user_attrs(user_info_mapping, user_hash)
@@ -208,10 +208,10 @@ module Sorcery
             user_info_mapping.each do |k, v|
               if (varr = v.split('/')).size > 1
                 attribute_value = begin
-                                    varr.inject(user_hash[:user_info]) { |hash, value| hash[value] }
-                                  rescue StandardError
-                                    nil
-                                  end
+                  varr.inject(user_hash[:user_info]) { |hash, value| hash[value] }
+                rescue StandardError
+                  nil
+                end
                 attribute_value.nil? ? attrs : attrs.merge!(k => attribute_value)
               else
                 attrs.merge!(k => user_hash[:user_info][v])

data/lib/sorcery/controller/submodules/http_basic_auth.rb

@@ -37,7 +37,10 @@ module Sorcery
           # To overcome this, we set a session when requesting the password, which logout will
           # reset, and that's how we know if we need to request for HTTP auth again.
           def require_login_from_http_basic
-            (request_http_basic_authentication(realm_name_by_controller) && (session[:http_authentication_used] = true) && return) if request.authorization.nil? || session[:http_authentication_used].nil?
+            if request.authorization.nil? || session[:http_authentication_used].nil?
+              request_http_basic_authentication(realm_name_by_controller) && (session[:http_authentication_used] = true) && return
+            end
+
             require_login
             session[:http_authentication_used] = nil unless logged_in?
           end
@@ -45,7 +48,9 @@ module Sorcery
           # given to main controller module as a login source callback
           def login_from_basic_auth
             authenticate_with_http_basic do |username, password|
-              @current_user = (user_class.authenticate(username, password) if session[:http_authentication_used]) || false
+              @current_user = (if session[:http_authentication_used]
+                                 user_class.authenticate(username, password)
+                               end) || false
               auto_login(@current_user) if @current_user
               @current_user
             end

data/lib/sorcery/controller/submodules/remember_me.rb

@@ -11,6 +11,7 @@ module Sorcery
           Config.module_eval do
             class << self
               attr_accessor :remember_me_httponly
+
               def merge_remember_me_defaults!
                 @defaults.merge!(:@remember_me_httponly => true)
               end
@@ -56,7 +57,7 @@ module Sorcery
           # Runs as a login source. See 'current_user' method for how it is used.
           def login_from_cookie
             user = cookies.signed[:remember_me_token] && user_class.sorcery_adapter.find_by_remember_me_token(cookies.signed[:remember_me_token]) if defined? cookies
-            if user && user.has_remember_me_token?
+            if user&.has_remember_me_token?
               set_remember_me_cookie!(user)
               session[:user_id] = user.id.to_s
               after_remember_me!(user)

data/lib/sorcery/controller/submodules/session_timeout.rb

@@ -16,8 +16,8 @@ module Sorcery
               attr_accessor :session_timeout_invalidate_active_sessions_enabled
 
               def merge_session_timeout_defaults!
-                @defaults.merge!(:@session_timeout                                    => 3600, # 1.hour
-                                 :@session_timeout_from_last_action                   => false,
+                @defaults.merge!(:@session_timeout => 3600, # 1.hour
+                                 :@session_timeout_from_last_action => false,
                                  :@session_timeout_invalidate_active_sessions_enabled => false)
               end
             end

data/lib/sorcery/controller.rb

@@ -3,22 +3,17 @@ module Sorcery
     def self.included(klass)
       klass.class_eval do
         include InstanceMethods
+
         Config.submodules.each do |mod|
-          # FIXME: Is there a cleaner way to handle missing submodules?
-          # rubocop:disable Lint/HandleExceptions
-          begin
-            include Submodules.const_get(mod.to_s.split('_').map(&:capitalize).join)
-          rescue NameError
-            # don't stop on a missing submodule.
-          end
-          # rubocop:enable Lint/HandleExceptions
+          submodule_name = mod.to_s.split('_').map(&:capitalize).join
+          include Submodules.const_get(submodule_name) if Submodules.const_defined?(submodule_name, false)
         end
       end
       Config.update!
       Config.configure!
     end
 
-    module InstanceMethods
+    module InstanceMethods # rubocop:disable Metrics/ModuleLength
       # To be used as before_action.
       # Will trigger auto-login attempts via the call to logged_in?
       # If all attempts to auto-login fail, the failure callback will be called.
@@ -54,7 +49,6 @@ module Sorcery
           old_session.each_pair do |k, v|
             session[k.to_sym] = v
           end
-          form_authenticity_token
 
           auto_login(user, credentials[2])
           after_login!(user, credentials)
@@ -63,6 +57,14 @@ module Sorcery
         end
       end
 
+      def login!(...)
+        user = login(...)
+
+        raise Sorcery::InvalidCredentials if user.nil?
+
+        user
+      end
+
       def reset_sorcery_session
         reset_session # protect from session fixation attacks
       end
@@ -85,9 +87,7 @@ module Sorcery
       # attempts to auto-login from the sources defined (session, basic_auth, cookie, etc.)
       # returns the logged in user if found, nil if not
       def current_user
-        unless defined?(@current_user)
-          @current_user = login_from_session || login_from_other_sources || nil
-        end
+        @current_user = login_from_session || login_from_other_sources || nil unless defined?(@current_user)
         @current_user
       end
 
@@ -97,8 +97,24 @@ module Sorcery
 
       # used when a user tries to access a page while logged out, is asked to login,
       # and we want to return him back to the page he originally wanted.
-      def redirect_back_or_to(url, flash_hash = {})
-        redirect_to(session[:return_to_url] || url, flash: flash_hash)
+      def redirect_back_or_to(...)
+        if Config.use_redirect_back_or_to_by_rails
+          super
+        else
+          Sorcery.deprecator.warn(
+            '`redirect_back_or_to` overrides the method of the same name defined in Rails 7. ' \
+            'To avoid overriding, set `config.use_redirect_back_or_to_by_rails = true` and use `redirect_to_before_login_path`. ' \
+            'In a future release, `config.use_redirect_back_or_to_by_rails = true` will become the default.'
+          )
+          redirect_to_before_login_path(...)
+        end
+      end
+
+      def redirect_to_before_login_path(url, **options)
+        allow_other_host = options[:allow_other_host].nil? ? _allow_other_host : options[:allow_other_host]
+        flash = options.except(:allow_other_host)
+
+        redirect_to(session[:return_to_url] || url, flash:, allow_other_host:)
         session[:return_to_url] = nil
       end
 
@@ -137,9 +153,7 @@ module Sorcery
       end
 
       def login_from_session
-        @current_user = if session[:user_id]
-                          user_class.sorcery_adapter.find_by_id(session[:user_id])
-                        end
+        @current_user = (user_class.sorcery_adapter.find_by_id(session[:user_id]) if session[:user_id])
       end
 
       def after_login!(user, credentials = [])
@@ -162,6 +176,10 @@ module Sorcery
         Config.after_remember_me.each { |c| send(c, user) }
       end
 
+      def after_login_lock!(credentials)
+        Config.after_login_lock.each { |c| send(c, credentials) }
+      end
+
       def user_class
         @user_class ||= Config.user_class.to_s.constantize
       rescue NameError