veri 2.0.1 → 2.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1d4ce50f8dee062c8b115095760ba5c2ef1e4f6a75db253a12fbb872583b5491
-  data.tar.gz: 20948f1a5cfbfb8054b2fb66491d9babae554197487b1369f99f7b5e5d8a213c
+  metadata.gz: 90c72152f71aea2555de8f7788b356e8b957d94df73a0bfc826ee79b1087fed7
+  data.tar.gz: f552a61efc8b704a9065bca3d785dcb8cd4046299ee94e05dc0cb08b381511e4
 SHA512:
-  metadata.gz: f49a78fc5ccba47ece10a67a2b651173ea28000a9aa43b886c514d74334c1273e59b77d07893590014b639b42f324636c025288f5e4a6657c932f222140fb258
-  data.tar.gz: 8a3ab38f067b650708e4c0a13af58dbac9ac60fcca30b038c4fbd8a12c6851d55502a5f9033d886d9a345cbe7f06e34bced6160f4d812b8b9bef7792de707e75
+  metadata.gz: 1947901336055c81c82f36c18c6abdeadc76d6d1ce47564de69bd83cb98a75d14e433276df5be08c24506277571121d81eaf6c3c0805c5d1041f8d9272821d31
+  data.tar.gz: eb186110a8816965a3ae0c7f396fdd8b0fd212ce281602139268e55cf466e3ad7589e0838383840e629c2b6259ab027c1beb343b5f4338b778717a3b5670eaae

data/CHANGELOG.md

@@ -1,3 +1,24 @@
+## v2.0.3
+
+### Bugs
+
+- Fixed authentication raising `NameError` when the configured user model is not named `User`
+- Fixed Rails commands failing when the configured user model class does not exist yet
+- Fixed expired and inactive sessions still appearing as logged in on pages that don't require authentication
+- Fixed locking a user not terminating their sessions until their next request
+- Fixed password verification raising an error for users who have no password set
+- Fixed cross-tenant shapeshifting not working
+
+### Misc
+
+- The hashing algorithm can now be changed without breaking existing passwords
+
+## v2.0.2
+
+### Misc
+
+- Clarified error message for non-existent user model
+
 ## v2.0.1
 
 ### Misc

data/README.md

@@ -70,13 +70,19 @@ Configure Veri in an initializer if customization is needed:
 ```rb
 # These are the default values; you can change them as needed
 Veri.configure do |config|
-  config.hashing_algorithm = :argon2       # Password hashing algorithm (:argon2, :bcrypt, :pbkdf2, or :scrypt)
-  config.inactive_session_lifetime = nil   # Session inactivity timeout (nil means sessions never expire due to inactivity)
-  config.total_session_lifetime = 14.days  # Maximum session duration regardless of activity
-  config.user_model_name = "User"          # Your user model name
+  # Password hashing algorithm (:argon2, :bcrypt, :pbkdf2, or :scrypt)
+  config.hashing_algorithm = :argon2
+  # Session inactivity timeout (nil means sessions never expire due to inactivity)
+  config.inactive_session_lifetime = nil
+  # Maximum session duration regardless of activity
+  config.total_session_lifetime = 14.days
+  # Your user model name
+  config.user_model_name = "User"
 end
 ```
 
+The hashing algorithm can be changed at any time: existing passwords are verified with the algorithm they were hashed with and are automatically re-hashed with the configured algorithm on the next successful login.
+
 ## Password Management
 
 Your user model is automatically extended with password management methods:
@@ -88,6 +94,12 @@ user.update_password("password")
 # Verify a password
 user.verify_password("password")
 ```
+Changing a password does not automatically terminate existing sessions. If you want to invalidate the user's sessions after a password change, do so explicitly:
+
+```rb
+user.update_password(new_password)
+user.sessions.terminate_all
+```
 
 ## Controller Integration
 
@@ -99,11 +111,13 @@ Include the authentication module in your controllers and configure protection:
 class ApplicationController < ActionController::Base
   include Veri::Authentication
 
-  with_authentication # Require authentication by default
+  # Require authentication by default
+  with_authentication
 end
 
 class PicturesController < ApplicationController
-  skip_authentication only: [:index, :show] # Allow public access to index and show actions
+  # Allow public access to index and show actions
+  skip_authentication only: [:index, :show]
 end
 ```
 
@@ -161,7 +175,7 @@ current_user
 # Returns true if user is authenticated
 logged_in?
 
-# Authenticates user and creates session, returns true on success or false if account is locked
+# Authenticates user, returns true on success or false if account is locked
 log_in(user)
 
 # Terminates current session
@@ -396,6 +410,8 @@ session.shapeshift(user, tenant: company)
 session.true_tenant
 ```
 
+The `tenant:` argument always becomes the session's tenant: omitting it means no tenant. In a multi-tenant application, always pass it explicitly.
+
 All other session methods work the same way in multi-tenant applications as in single-tenant applications. However, `to_true_identity` will restore both the original user and tenant.
 
 ### Orphaned Sessions
@@ -408,6 +424,12 @@ To clean up orphaned sessions, use:
 Veri::Session.prune
 ```
 
+Or, for a specific user:
+
+```rb
+user.sessions.prune
+```
+
 ### Tenant Migrations
 
 When you rename or remove models used as tenants, you need to update Veri's stored data accordingly. Use these irreversible data migrations:
@@ -484,24 +506,26 @@ end
 ## Getting Help and Contributing
 
 ### Getting Help
-Have a question or need assistance? Open a discussion in our [discussions section](https://github.com/enjaku4/veri/discussions) for:
+
+Have a question or need assistance? Open a discussion in the [discussions section](https://github.com/enjaku4/veri/discussions) for:
+
 - Usage questions
 - Implementation guidance
-- Feature suggestions
+- Open-ended ideas or suggestions
+
+### Issues
+
+[Issues](https://github.com/enjaku4/veri/issues) track bugs, planned features, and other work. When reporting a bug, please include:
 
-### Reporting Issues
-Found a bug? Please [create an issue](https://github.com/enjaku4/veri/issues) with:
 - A clear description of the problem
 - Steps to reproduce the issue
-- Your environment details (Rails version, Ruby version, etc.)
+- Your environment details (Rails and Ruby versions, OS, etc.)
 
 ### Contributing Code
-Ready to contribute? You can:
-- Fix bugs by submitting pull requests
-- Improve documentation
-- Add new features (please discuss first in our [discussions section](https://github.com/enjaku4/veri/discussions))
 
-Before contributing, please read the [contributing guidelines](https://github.com/enjaku4/veri/blob/main/CONTRIBUTING.md)
+Any open issue is free to pick up or discuss. Check the [project board](https://github.com/users/enjaku4/projects/13) or [issues tab](https://github.com/enjaku4/veri/issues).
+
+Before contributing, please read the [contributing guidelines](https://github.com/enjaku4/veri/blob/main/CONTRIBUTING.md).
 
 ## License
 
@@ -513,6 +537,6 @@ Everyone interacting in the Veri project is expected to follow the [code of cond
 
 ## Old Versions
 
-Only the latest major version is supported. Older versions are obsolete and not maintained, but their READMEs are available here for reference:
+Only the latest major version is actively maintained. READMEs for older versions are available here for reference:
 
 [v1.x.x](https://github.com/enjaku4/veri/blob/9c188e16a703141b7cd89dd31d5cd49a557f143d/README.md)

data/lib/veri/configuration.rb

@@ -66,7 +66,7 @@ module Veri
       Veri::Inputs::Model.new(
         user_model_name,
         error: Veri::ConfigurationError,
-        message: "Invalid user model name `#{user_model_name}`, expected an ActiveRecord model name as a string"
+        message: "Invalid user model name `#{user_model_name}`, model does not exist"
       ).process
     end
 

data/lib/veri/controllers/concerns/authentication.rb

@@ -1,5 +1,3 @@
-require "zlib"
-
 module Veri
   module Authentication
     extend ActiveSupport::Concern
@@ -29,9 +27,9 @@ module Veri
     end
 
     def current_session
-      token = cookies.encrypted["#{auth_cookie_prefix}_token"]
+      token = cookies.encrypted["veri_token"]
 
-      @current_session ||= Session.lookup(token, resolved_tenant)
+      @current_session ||= Session.find_active(token, resolved_tenant)
     end
 
     def log_in(authenticatable)
@@ -44,13 +42,15 @@ module Veri
 
       token = Veri::Session.establish(processed_authenticatable, request, resolved_tenant)
 
-      cookies.encrypted.permanent["#{auth_cookie_prefix}_token"] = { value: token, httponly: true }
+      cookies.encrypted.permanent["veri_token"] = { value: token, httponly: true, secure: request.ssl? }
+      reset_memoization
       true
     end
 
     def log_out
       current_session&.terminate
-      cookies.delete("#{auth_cookie_prefix}_token")
+      cookies.delete("veri_token")
+      reset_memoization
     end
 
     def logged_in?
@@ -58,7 +58,7 @@ module Veri
     end
 
     def return_path
-      cookies.signed["#{auth_cookie_prefix}_return_path"]
+      cookies.signed["veri_return_path"]
     end
 
     def shapeshifter?
@@ -68,20 +68,14 @@ module Veri
     private
 
     def with_authentication
-      if logged_in? && current_session.active?
-        if current_user.locked?
-          log_out
-          when_unauthenticated
-        else
-          current_session.update_info(request)
-        end
-
+      if logged_in? && !current_user.locked?
+        current_session.update_info(request)
         return
       end
 
       log_out
 
-      cookies.signed["#{auth_cookie_prefix}_return_path"] = { value: request.fullpath, expires: 15.minutes.from_now } if request.get? && request.format.html?
+      cookies.signed["veri_return_path"] = { value: request.fullpath, expires: 15.minutes.from_now } if request.get? && request.format.html?
 
       when_unauthenticated
     end
@@ -100,8 +94,8 @@ module Veri
       ).resolve
     end
 
-    def auth_cookie_prefix
-      @auth_cookie_prefix ||= "auth_#{Zlib.crc32(Marshal.dump(resolved_tenant))}"
+    def reset_memoization
+      @current_user = @current_session = nil
     end
   end
 end

data/lib/veri/models/concerns/authenticatable.rb

@@ -23,14 +23,26 @@ module Veri
     end
 
     def verify_password(password)
-      hasher.verify(
-        Veri::Inputs::NonEmptyString.new(password, message: "Expected a non-empty string, got `#{password.inspect}`").process,
-        hashed_password
-      )
+      processed_password = Veri::Inputs::NonEmptyString.new(password, message: "Expected a non-empty string, got `#{password.inspect}`").process
+
+      return false if hashed_password.blank?
+
+      stored_hasher = Veri::Configuration::HASHERS.values.find { _1.match?(hashed_password) }
+
+      raise Veri::Error, "Unrecognized password hash format" unless stored_hasher
+
+      return false unless stored_hasher.verify(processed_password, hashed_password)
+
+      update_column(:hashed_password, hasher.create(processed_password)) unless stored_hasher == hasher
+
+      true
     end
 
     def lock!
-      update!(locked: true, locked_at: Time.current)
+      transaction do
+        update!(locked: true, locked_at: Time.current)
+        sessions.terminate_all
+      end
     end
 
     def unlock!

data/lib/veri/models/session.rb

@@ -5,8 +5,6 @@ module Veri
   class Session < ActiveRecord::Base
     self.table_name = "veri_sessions"
 
-    belongs_to :authenticatable, class_name: Veri::Configuration.user_model_name
-    belongs_to :original_authenticatable, class_name: Veri::Configuration.user_model_name, optional: true
     belongs_to :tenant, polymorphic: true, optional: true
     belongs_to :original_tenant, polymorphic: true, optional: true
 
@@ -128,10 +126,12 @@ module Veri
 
       alias terminate_all delete_all
 
-      def lookup(token, resolved_tenant)
+      def find_active(token, resolved_tenant)
         return nil if token.blank?
 
-        find_by(hashed_token: digest_token(token), **resolved_tenant)
+        session = find_by(hashed_token: digest_token(token), **resolved_tenant)
+
+        session&.active? ? session : nil
       end
 
       private

data/lib/veri/password/argon2.rb

@@ -12,6 +12,10 @@ module Veri
       def verify(password, hashed_password)
         ::Argon2::Password.verify_password(password, hashed_password)
       end
+
+      def match?(hashed_password)
+        hashed_password.start_with?("$argon2")
+      end
     end
   end
 end

data/lib/veri/password/bcrypt.rb

@@ -12,6 +12,10 @@ module Veri
       def verify(password, hashed_password)
         ::BCrypt::Password.new(hashed_password) == password
       end
+
+      def match?(hashed_password)
+        hashed_password.start_with?("$2")
+      end
     end
   end
 end

data/lib/veri/password/pbkdf2.rb

@@ -42,6 +42,10 @@ module Veri
 
         OpenSSL.fixed_length_secure_compare(recalculated_hash, hash)
       end
+
+      def match?(hashed_password)
+        hashed_password.start_with?("#{DIGEST}$")
+      end
     end
   end
 end

data/lib/veri/password/scrypt.rb

@@ -12,6 +12,10 @@ module Veri
       def verify(password, hashed_password)
         ::SCrypt::Password.new(hashed_password) == password
       end
+
+      def match?(hashed_password)
+        hashed_password.match?(/\A\h+\$\h+\$\h+\$/)
+      end
     end
   end
 end

data/lib/veri/railtie.rb

@@ -22,8 +22,16 @@ module Veri
           end
         end
 
-        user_model = Veri::Configuration.user_model
-        user_model.include Veri::Authenticatable unless user_model < Veri::Authenticatable
+        begin
+          user_model = Veri::Configuration.user_model
+          user_model.include Veri::Authenticatable unless user_model < Veri::Authenticatable
+        rescue Veri::ConfigurationError
+          raise if Veri::Railtie.server_running?
+        end
+
+        Veri::Session.belongs_to :authenticatable, class_name: Veri::Configuration.user_model_name
+        Veri::Session.belongs_to :original_authenticatable, class_name: Veri::Configuration.user_model_name,
+                                                            optional: true
       end
     end
 

data/lib/veri/version.rb

@@ -1,3 +1,3 @@
 module Veri
-  VERSION = "2.0.1".freeze
+  VERSION = "2.0.3".freeze
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: veri
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 2.0.3
 platform: ruby
 authors:
 - enjaku4
 bindir: bin
 cert_chain: []
-date: 2026-02-04 00:00:00.000000000 Z
+date: 2026-07-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: argon2
@@ -147,7 +147,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.3
 specification_version: 4
 summary: Minimal cookie-based authentication library for Ruby on Rails
 test_files: []