veri 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6119b194fd813a1aad85a20b8513a15fe30143f601e1f2ce6cefa5d46085af70
-  data.tar.gz: c05d56946b5a010977bee885a807f2986e6d811eb3e9cc96cc0cc44ffe98b9f2
+  metadata.gz: 02bcadafc5e2561e169ce65e920a7009f7549a0dfc1b5199cd471c01a8deac6f
+  data.tar.gz: 9e8b74e83ea6882c5289f6109c9b4f2e8c492874f4ff9794315be7602410ea4a
 SHA512:
-  metadata.gz: eb7c6dfd8fe97b4c7a29b11cb06d01f29dc1ee86cf962512a6db239fcc2f3be1f0ebabc9875c4122843970daab8250d75cde8f4c63016f4580cae1169a41c3c7
-  data.tar.gz: a96429440653c18be22e9f425ef3dac167fc773666b0f99fb1ab0a08df747c8f27aa4f7d812d76f420a2974a48b46b916a14795f0445307dd0d73cc0f21e2f8b
+  metadata.gz: d7dedc00870041d1271c9c680226533030672546666bfac8a4fc0f5c7d26b4ff0eacd138b9edcb4418e017fd09e642e011b1dd06bb68ec69e2e3a4b96fc9805d
+  data.tar.gz: 492b0c906f34d2f091030c1d3425d21fbc5442c18080107deafe1397079f8b060609be0fd224324987ff502f1f55dcf0a9be08434f387dca2579e148ce478966

data/CHANGELOG.md

@@ -1,3 +1,15 @@
+## v0.3.0
+
+### Breaking
+
+- Added account lockout feature
+
+## v0.2.2
+
+### Bugs
+
+- Fixed class resolution in `current_user` method
+
 ## v0.2.1
 
 ### Misc

data/README.md

@@ -8,10 +8,11 @@ Veri is a cookie-based authentication library for Ruby on Rails that provides es
 **Key Features:**
 
 - Cookie-based authentication with database-stored sessions
-- Supports multiple password hashing algorithms (argon2, bcrypt, scrypt)
+- Multiple password hashing algorithms (argon2, bcrypt, scrypt)
 - Granular session management and control
-- Built-in return path handling
+- Return path handling
 - User impersonation feature
+- Account lockout functionality
 
 > ⚠️ **Development Notice**<br>
 > Veri is functional but in early development. Breaking changes may occur in minor releases until v1.0!
@@ -24,11 +25,12 @@ Veri is a cookie-based authentication library for Ruby on Rails that provides es
   - [Password Management](#password-management)
   - [Controller Integration](#controller-integration)
   - [Authentication Sessions](#authentication-sessions)
+  - [Account Lockout](#account-lockout)
   - [View Helpers](#view-helpers)
   - [Testing](#testing)
 
 **Community Resources:**
-  - [Contributing](#contributing)
+  - [Getting Help and Contributing](#getting-help-and-contributing)
   - [License](#license)
   - [Code of Conduct](#code-of-conduct)
 
@@ -108,7 +110,7 @@ end
 
 ### Authentication Methods
 
-This is a simplified example of how to use Veri's authentication methods in your controllers:
+This is a simplified example of how to use Veri's authentication methods:
 
 ```rb
 class SessionsController < ApplicationController
@@ -137,7 +139,7 @@ Available methods:
 
 - `current_user` - Returns authenticated user or `nil`
 - `logged_in?` - Returns `true` if user is authenticated
-- `log_in(user)` - Authenticates user and creates session
+- `log_in(user)` - Authenticates user and creates session, returns `true` on success or `false` if account is locked
 - `log_out` - Terminates current session
 - `return_path` - Returns path user was accessing before authentication
 - `current_session` - Returns current authentication session
@@ -249,6 +251,23 @@ Veri::Session.prune           # All sessions
 Veri::Session.prune(user)     # Specific user's sessions
 ```
 
+## Account Lockout
+
+Veri provides account lockout functionality to temporarily disable user accounts (for example, after too many failed login attempts or for security reasons).
+
+```rb
+# Lock a user account
+user.lock!
+
+# Unlock a user account
+user.unlock!
+
+# Check if account is locked
+user.locked?
+```
+
+When an account is locked, users cannot log in. If they're already logged in, their sessions will be terminated and they'll be treated as unauthenticated users.
+
 ## View Helpers
 
 Access authentication state in your views:
@@ -310,7 +329,7 @@ RSpec.configure do |config|
 end
 ```
 
-## Contributing
+## Getting Help and Contributing
 
 ### Getting Help
 Have a question or need assistance? Open a discussion in our [discussions section](https://github.com/brownboxdev/veri/discussions) for:
@@ -330,7 +349,7 @@ Ready to contribute? You can:
 - Improve documentation
 - Add new features (please discuss first in our [discussions section](https://github.com/brownboxdev/veri/discussions))
 
-Before contributing, please read the [contributing guidelines](https://github.com/brownboxdev/veri/blob/master/CONTRIBUTING.md)
+Before contributing, please read the [contributing guidelines](https://github.com/brownboxdev/veri/blob/main/CONTRIBUTING.md)
 
 ## License
 

data/lib/generators/veri/templates/add_veri_authentication.rb.erb

@@ -2,6 +2,8 @@ class AddVeriAuthentication < ActiveRecord::Migration[<%= ActiveRecord::Migratio
   def change
     add_column <%= table_name.to_sym.inspect %>, :hashed_password, :text
     add_column <%= table_name.to_sym.inspect %>, :password_updated_at, :datetime
+    add_column <%= table_name.to_sym.inspect %>, :locked, :boolean, default: false, null: false
+    add_column <%= table_name.to_sym.inspect %>, :locked_at, :datetime
 
     create_table :veri_sessions<%= ", id: :uuid" if options[:uuid] %> do |t|
       t.string :hashed_token, null: false, index: { unique: true }

data/lib/veri/controllers/concerns/authentication.rb

@@ -23,7 +23,9 @@ module Veri
     end
 
     def current_user
-      @current_user ||= current_session&.identity
+      user_model = Veri::Configuration.user_model
+      primary_key = user_model.primary_key
+      @current_user ||= current_session ? user_model.find_by(primary_key => current_session.authenticatable_id) : nil
     end
 
     def current_session
@@ -37,8 +39,12 @@ module Veri
         as: :authenticatable,
         message: "Expected an instance of #{Veri::Configuration.user_model_name}, got `#{authenticatable.inspect}`"
       )
+
+      return false if processed_authenticatable.locked?
+
       token = Veri::Session.establish(processed_authenticatable, request)
       cookies.encrypted.permanent[:veri_token] = { value: token, httponly: true }
+      true
     end
 
     def log_out
@@ -61,9 +67,18 @@ module Veri
     private
 
     def with_authentication
-      current_session.update_info(request) and return if logged_in? && current_session.active?
+      if logged_in? && current_session.active?
+        if current_user.locked?
+          log_out
+          when_unauthenticated
+        else
+          current_session.update_info(request)
+        end
+
+        return
+      end
 
-      current_session&.terminate
+      log_out
 
       cookies.signed[:veri_return_path] = { value: request.fullpath, expires: 15.minutes.from_now } if request.get? && request.format.html?
 

data/lib/veri/models/concerns/authenticatable.rb

@@ -34,6 +34,14 @@ module Veri
       )
     end
 
+    def lock!
+      update!(locked: true, locked_at: Time.current)
+    end
+
+    def unlock!
+      update!(locked: false, locked_at: nil)
+    end
+
     private
 
     def hasher

data/lib/veri/version.rb

@@ -1,3 +1,3 @@
 module Veri
-  VERSION = "0.2.1".freeze
+  VERSION = "0.3.0".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: veri
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - enjaku4