veri 0.4.0 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 85a6c779bd69de4d11430630c142f8e5e12e3574d7828f740abc19f0e51d291f
-  data.tar.gz: 0def50b534c6d728230ec7543fe6a007a518f9abe47e9c0d93aac45e7eb2f59f
+  metadata.gz: c4434399cb0f0e3081ff2ccb8e72df12623e74f6f2cd43f318d50ae483845be6
+  data.tar.gz: 194dec0866793d8f2bc906d2830f8c9a4fb37e7d8a5c7f5c58bec7d0631abc51
 SHA512:
-  metadata.gz: 714985726d7e5d04f55dbb1b94a73110a64ed1cb2853f565ddefda540cb13393969a1c4c3ec91e7de310822224dd844031d7d6b0cf57bd3b537c36da5bb6d55b
-  data.tar.gz: 7f2070d1f1da0260a8061b8abcff5a625245e4388f593d14a6edbdc8c8b496a3b55b5525bfda7a9abaae6bd91ffb218cb0d707d888f14114981c536d99a85e90
+  metadata.gz: 2e5dbe8a582d077ef157f8c16d3ec5c21ac24b501e323ed4bf11f577fe436900dffdc1a40814011c78f969962c97ca0b931cd5684253578ecb4804b994016dca
+  data.tar.gz: ba78fb8d71fd4dffdb527add9759f56d84ca9772535897d356f4a4a9f1302f149d3533355e8a86a518b09f179c638313dcdf2b9932c82fd7e8a427457a1b3111

data/CHANGELOG.md

@@ -1,3 +1,17 @@
+## v1.0.0
+
+### Breaking
+
+- Dropped support for Rails 7.1
+
+### Features
+
+- Added support for pbkdf2 password hashing algorithm
+
+### Bugs
+
+- Fixed error raised on Rails console commands when the database was not yet set up
+
 ## v0.4.0
 
 ### Breaking

data/README.md

@@ -1,23 +1,20 @@
 # Veri: Minimal Authentication Framework for Rails
 
 [![Gem Version](https://badge.fury.io/rb/veri.svg)](http://badge.fury.io/rb/veri)
-[![Github Actions badge](https://github.com/brownboxdev/veri/actions/workflows/ci.yml/badge.svg)](https://github.com/brownboxdev/veri/actions/workflows/ci.yml)
+[![Github Actions badge](https://github.com/enjaku4/veri/actions/workflows/ci.yml/badge.svg)](https://github.com/enjaku4/veri/actions/workflows/ci.yml)
 
 Veri is a cookie-based authentication library for Ruby on Rails that provides essential authentication building blocks without imposing business logic. Unlike full-featured solutions, Veri gives you complete control over your authentication flow while handling the complex underlying mechanics of secure password storage and session management.
 
 **Key Features:**
 
 - Cookie-based authentication with database-stored sessions
-- Multiple password hashing algorithms (argon2, bcrypt, scrypt)
+- Multiple password hashing algorithms (argon2, bcrypt, pbkdf2, scrypt)
 - Granular session management and control
 - Return path handling
 - User impersonation feature
 - Account lockout functionality
 - Multi-tenancy support
 
-> ⚠️ **Development Notice**<br>
-> Veri is functional but in early development. Breaking changes may occur in minor releases until v1.0!
-
 ## Table of Contents
 
 **Gem Usage:**
@@ -73,7 +70,7 @@ If customization is required, configure Veri in an initializer:
 ```rb
 # These are the default values; you can change them as needed
 Veri.configure do |config|
-  config.hashing_algorithm = :argon2       # Password hashing algorithm (:argon2, :bcrypt, or :scrypt)
+  config.hashing_algorithm = :argon2       # Password hashing algorithm (:argon2, :bcrypt, :pbkdf2, or :scrypt)
   config.inactive_session_lifetime = nil   # Session inactivity timeout (nil means sessions never expire due to inactivity)
   config.total_session_lifetime = 14.days  # Maximum session duration regardless of activity
   config.user_model_name = "User"          # Your user model name
@@ -115,6 +112,22 @@ end
 This is a simplified example of how to use Veri's authentication methods:
 
 ```rb
+class RegistrationsController < ApplicationController
+  skip_authentication
+
+  def create
+    user = User.new(user_params)
+
+    if user.valid?
+      user.update_password(user_params[:password])
+      log_in(user)
+      redirect_to dashboard_path
+    else
+      render :new, status: :unprocessable_content
+    end
+  end
+end
+
 class SessionsController < ApplicationController
   skip_authentication except: [:destroy]
 
@@ -126,7 +139,7 @@ class SessionsController < ApplicationController
       redirect_to return_path || dashboard_path
     else
       flash.now[:alert] = "Invalid credentials"
-      render :new, status: :unprocessable_entity
+      render :new, status: :unprocessable_content
     end
   end
 
@@ -288,8 +301,14 @@ session.terminate
 # Terminate all sessions
 Veri::Session.terminate_all
 
-# Clean up expired/inactive sessions
+# Terminate all sessions for a specific user
+user.sessions.terminate_all
+
+# Clean up expired/inactive sessions, and sessions with deleted tenant
 Veri::Session.prune
+
+# Clean up expired/inactive sessions for a specific user
+user.sessions.prune
 ```
 
 ## Account Lockout
@@ -426,13 +445,13 @@ end
 ## Getting Help and Contributing
 
 ### Getting Help
-Have a question or need assistance? Open a discussion in our [discussions section](https://github.com/brownboxdev/veri/discussions) for:
+Have a question or need assistance? Open a discussion in our [discussions section](https://github.com/enjaku4/veri/discussions) for:
 - Usage questions
 - Implementation guidance
 - Feature suggestions
 
 ### Reporting Issues
-Found a bug? Please [create an issue](https://github.com/brownboxdev/veri/issues) with:
+Found a bug? Please [create an issue](https://github.com/enjaku4/veri/issues) with:
 - A clear description of the problem
 - Steps to reproduce the issue
 - Your environment details (Rails version, Ruby version, etc.)
@@ -441,14 +460,14 @@ Found a bug? Please [create an issue](https://github.com/brownboxdev/veri/issues
 Ready to contribute? You can:
 - Fix bugs by submitting pull requests
 - Improve documentation
-- Add new features (please discuss first in our [discussions section](https://github.com/brownboxdev/veri/discussions))
+- Add new features (please discuss first in our [discussions section](https://github.com/enjaku4/veri/discussions))
 
-Before contributing, please read the [contributing guidelines](https://github.com/brownboxdev/veri/blob/main/CONTRIBUTING.md)
+Before contributing, please read the [contributing guidelines](https://github.com/enjaku4/veri/blob/main/CONTRIBUTING.md)
 
 ## License
 
-The gem is available as open source under the terms of the [MIT License](https://github.com/brownboxdev/veri/blob/main/LICENSE.txt).
+The gem is available as open source under the terms of the [MIT License](https://github.com/enjaku4/veri/blob/main/LICENSE.txt).
 
 ## Code of Conduct
 
-Everyone interacting in the Veri project is expected to follow the [code of conduct](https://github.com/brownboxdev/veri/blob/main/CODE_OF_CONDUCT.md).
+Everyone interacting in the Veri project is expected to follow the [code of conduct](https://github.com/enjaku4/veri/blob/main/CODE_OF_CONDUCT.md).

data/lib/veri/configuration.rb

@@ -52,6 +52,7 @@ module Veri
     HASHERS = {
       argon2: Veri::Password::Argon2,
       bcrypt: Veri::Password::BCrypt,
+      pbkdf2: Veri::Password::Pbkdf2,
       scrypt: Veri::Password::SCrypt
     }.freeze
 

data/lib/veri/inputs/hashing_algorithm.rb

@@ -3,7 +3,7 @@ module Veri
     class HashingAlgorithm < Veri::Inputs::Base
       private
 
-      def type = -> { self.class::Strict::Symbol.enum(:argon2, :bcrypt, :scrypt) }
+      def type = -> { self.class::Strict::Symbol.enum(:argon2, :bcrypt, :pbkdf2, :scrypt) }
     end
   end
 end

data/lib/veri/models/session.rb

@@ -100,23 +100,15 @@ module Veri
       end
 
       def prune
-        expired_scope = where(expires_at: ...Time.current)
+        expired.or(inactive).delete_all
 
-        if Veri::Configuration.inactive_session_lifetime
-          inactive_cutoff = Time.current - Veri::Configuration.inactive_session_lifetime
-          expired_scope = expired_scope.or(where(last_seen_at: ...inactive_cutoff))
-        end
-
-        expired_scope.delete_all
-
-        ids = where.not(tenant_id: nil).includes(:tenant).filter_map do |session|
-          session.tenant
-          nil
+        orphaned_tenant_sessions = where.not(tenant_id: nil).includes(:tenant).filter_map do |session|
+          !session.tenant
         rescue ActiveRecord::RecordNotFound
           session.id
         end
 
-        where(id: ids).delete_all if ids.any?
+        where(id: orphaned_tenant_sessions).delete_all if orphaned_tenant_sessions.any?
       end
 
       alias terminate_all delete_all

data/lib/veri/password/pbkdf2.rb

@@ -0,0 +1,47 @@
+require "openssl"
+require "base64"
+require "securerandom"
+
+module Veri
+  module Password
+    module Pbkdf2
+      module_function
+
+      ITERATIONS = 210_000
+      SALT_BYTES = 64
+      HASH_BYTES = 64
+      DIGEST = "sha512"
+
+      def create(password)
+        salt = SecureRandom.random_bytes(SALT_BYTES)
+        hash = OpenSSL::KDF.pbkdf2_hmac(
+          password,
+          salt:,
+          iterations: ITERATIONS,
+          length: HASH_BYTES,
+          hash: DIGEST
+        )
+
+        "#{DIGEST}$#{ITERATIONS}$#{HASH_BYTES}$#{Base64.strict_encode64(salt)}$#{Base64.strict_encode64(hash)}"
+      end
+
+      def verify(password, hashed_password)
+        parts = hashed_password.split("$")
+        digest, iterations, hash_bytes, encoded_salt, encoded_hash = parts[0], parts[1], parts[2], parts[3], parts[4]
+
+        salt = Base64.strict_decode64(encoded_salt)
+        hash = Base64.strict_decode64(encoded_hash)
+
+        recalculated_hash = OpenSSL::KDF.pbkdf2_hmac(
+          password,
+          salt:,
+          iterations: iterations.to_i,
+          length: hash_bytes.to_i,
+          hash: digest
+        )
+
+        OpenSSL.fixed_length_secure_compare(recalculated_hash, hash)
+      end
+    end
+  end
+end

data/lib/veri/railtie.rb

@@ -2,9 +2,15 @@ require "rails/railtie"
 
 module Veri
   class Railtie < Rails::Railtie
+    def self.table_exists?
+      ActiveRecord::Base.connection.data_source_exists?("veri_sessions")
+    rescue ActiveRecord::NoDatabaseError, ActiveRecord::ConnectionNotEstablished
+      false
+    end
+
     initializer "veri.to_prepare" do |app|
       app.config.to_prepare do
-        if ActiveRecord::Base.connection.data_source_exists?("veri_sessions")
+        if Veri::Railtie.table_exists?
           Veri::Session.where.not(tenant_id: nil).distinct.pluck(:tenant_type).each do |tenant_class|
             tenant_class.constantize
           rescue NameError => e

data/lib/veri/version.rb

@@ -1,3 +1,3 @@
 module Veri
-  VERSION = "0.4.0".freeze
+  VERSION = "1.0.0".freeze
 end

data/lib/veri.rb

@@ -5,6 +5,7 @@ require "active_support"
 
 require_relative "veri/password/argon2"
 require_relative "veri/password/bcrypt"
+require_relative "veri/password/pbkdf2"
 require_relative "veri/password/scrypt"
 
 require_relative "veri/inputs/base"

data/veri.gemspec

@@ -4,7 +4,7 @@ Gem::Specification.new do |spec|
   spec.name = "veri"
   spec.version = Veri::VERSION
   spec.authors = ["enjaku4"]
-  spec.homepage = "https://github.com/brownboxdev/veri"
+  spec.homepage = "https://github.com/enjaku4/veri"
   spec.metadata["homepage_uri"] = spec.homepage
   spec.metadata["source_code_uri"] = spec.homepage
   spec.metadata["changelog_uri"] = "#{spec.homepage}/blob/main/CHANGELOG.md"
@@ -23,7 +23,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency "bcrypt", "~> 3.0"
   spec.add_dependency "dry-configurable", "~> 1.1"
   spec.add_dependency "dry-types", "~> 1.7"
-  spec.add_dependency "rails", ">= 7.1", "< 8.1"
+  spec.add_dependency "rails", ">= 7.2", "< 8.1"
   spec.add_dependency "scrypt", "~> 3.0"
   spec.add_dependency "user_agent_parser", "~> 2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: veri
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 1.0.0
 platform: ruby
 authors:
 - enjaku4
@@ -71,7 +71,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '7.2'
     - - "<"
       - !ruby/object:Gem::Version
         version: '8.1'
@@ -81,7 +81,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '7.2'
     - - "<"
       - !ruby/object:Gem::Version
         version: '8.1'
@@ -137,17 +137,18 @@ files:
 - lib/veri/models/session.rb
 - lib/veri/password/argon2.rb
 - lib/veri/password/bcrypt.rb
+- lib/veri/password/pbkdf2.rb
 - lib/veri/password/scrypt.rb
 - lib/veri/railtie.rb
 - lib/veri/version.rb
 - veri.gemspec
-homepage: https://github.com/brownboxdev/veri
+homepage: https://github.com/enjaku4/veri
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/brownboxdev/veri
-  source_code_uri: https://github.com/brownboxdev/veri
-  changelog_uri: https://github.com/brownboxdev/veri/blob/main/CHANGELOG.md
+  homepage_uri: https://github.com/enjaku4/veri
+  source_code_uri: https://github.com/enjaku4/veri
+  changelog_uri: https://github.com/enjaku4/veri/blob/main/CHANGELOG.md
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
@@ -166,7 +167,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.7
+rubygems_version: 3.7.1
 specification_version: 4
 summary: Minimal cookie-based authentication library for Ruby on Rails
 test_files: []