veri 2.0.2 → 2.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c9b0db1fbb87c0a3b25d47f2142cab1b9143a0ba7751a05c1676ca6e3b4b6ee3
-  data.tar.gz: 600d600760a3c0af2fddfece43322193be1ae4255eae0dd1c22d4099a083cb7b
+  metadata.gz: 90c72152f71aea2555de8f7788b356e8b957d94df73a0bfc826ee79b1087fed7
+  data.tar.gz: f552a61efc8b704a9065bca3d785dcb8cd4046299ee94e05dc0cb08b381511e4
 SHA512:
-  metadata.gz: aaf5ec5aced9ddec1c42367df39be9e4322d3b1b3946bb473bfaee3f668d6fea55d78b48f3f1f0fa1acb8ee4588de8039d054730d3b913ab8036def74054d858
-  data.tar.gz: b188516f09afc341584f4460d5caa0e552c94e54dfe3a4bc3fe7a4cddb592acbb8c4957092e4763e88bd1be34ebc122934b40876bd2fc23e87d3b207b5fb2479
+  metadata.gz: 1947901336055c81c82f36c18c6abdeadc76d6d1ce47564de69bd83cb98a75d14e433276df5be08c24506277571121d81eaf6c3c0805c5d1041f8d9272821d31
+  data.tar.gz: eb186110a8816965a3ae0c7f396fdd8b0fd212ce281602139268e55cf466e3ad7589e0838383840e629c2b6259ab027c1beb343b5f4338b778717a3b5670eaae

data/CHANGELOG.md

@@ -1,3 +1,18 @@
+## v2.0.3
+
+### Bugs
+
+- Fixed authentication raising `NameError` when the configured user model is not named `User`
+- Fixed Rails commands failing when the configured user model class does not exist yet
+- Fixed expired and inactive sessions still appearing as logged in on pages that don't require authentication
+- Fixed locking a user not terminating their sessions until their next request
+- Fixed password verification raising an error for users who have no password set
+- Fixed cross-tenant shapeshifting not working
+
+### Misc
+
+- The hashing algorithm can now be changed without breaking existing passwords
+
 ## v2.0.2
 
 ### Misc

data/README.md

@@ -81,6 +81,8 @@ Veri.configure do |config|
 end
 ```
 
+The hashing algorithm can be changed at any time: existing passwords are verified with the algorithm they were hashed with and are automatically re-hashed with the configured algorithm on the next successful login.
+
 ## Password Management
 
 Your user model is automatically extended with password management methods:
@@ -408,6 +410,8 @@ session.shapeshift(user, tenant: company)
 session.true_tenant
 ```
 
+The `tenant:` argument always becomes the session's tenant: omitting it means no tenant. In a multi-tenant application, always pass it explicitly.
+
 All other session methods work the same way in multi-tenant applications as in single-tenant applications. However, `to_true_identity` will restore both the original user and tenant.
 
 ### Orphaned Sessions
@@ -502,24 +506,26 @@ end
 ## Getting Help and Contributing
 
 ### Getting Help
+
 Have a question or need assistance? Open a discussion in the [discussions section](https://github.com/enjaku4/veri/discussions) for:
+
 - Usage questions
 - Implementation guidance
-- Feature suggestions
+- Open-ended ideas or suggestions
+
+### Issues
+
+[Issues](https://github.com/enjaku4/veri/issues) track bugs, planned features, and other work. When reporting a bug, please include:
 
-### Reporting Issues
-Found a bug? Please [create an issue](https://github.com/enjaku4/veri/issues) with:
 - A clear description of the problem
 - Steps to reproduce the issue
-- Your environment details (Rails version, Ruby version, etc.)
+- Your environment details (Rails and Ruby versions, OS, etc.)
 
 ### Contributing Code
-Ready to contribute? You can:
-- Fix bugs by submitting pull requests
-- Improve documentation
-- Add new features (please discuss first in the [discussions section](https://github.com/enjaku4/veri/discussions))
 
-Before contributing, please read the [contributing guidelines](https://github.com/enjaku4/veri/blob/main/CONTRIBUTING.md)
+Any open issue is free to pick up or discuss. Check the [project board](https://github.com/users/enjaku4/projects/13) or [issues tab](https://github.com/enjaku4/veri/issues).
+
+Before contributing, please read the [contributing guidelines](https://github.com/enjaku4/veri/blob/main/CONTRIBUTING.md).
 
 ## License
 
@@ -531,6 +537,6 @@ Everyone interacting in the Veri project is expected to follow the [code of cond
 
 ## Old Versions
 
-Only the latest major version is supported. Older versions are obsolete and not maintained, but their READMEs are available here for reference:
+Only the latest major version is actively maintained. READMEs for older versions are available here for reference:
 
 [v1.x.x](https://github.com/enjaku4/veri/blob/9c188e16a703141b7cd89dd31d5cd49a557f143d/README.md)

data/lib/veri/controllers/concerns/authentication.rb

@@ -1,5 +1,3 @@
-require "zlib"
-
 module Veri
   module Authentication
     extend ActiveSupport::Concern
@@ -29,9 +27,9 @@ module Veri
     end
 
     def current_session
-      token = cookies.encrypted["#{auth_cookie_prefix}_token"]
+      token = cookies.encrypted["veri_token"]
 
-      @current_session ||= Session.lookup(token, resolved_tenant)
+      @current_session ||= Session.find_active(token, resolved_tenant)
     end
 
     def log_in(authenticatable)
@@ -44,13 +42,15 @@ module Veri
 
       token = Veri::Session.establish(processed_authenticatable, request, resolved_tenant)
 
-      cookies.encrypted.permanent["#{auth_cookie_prefix}_token"] = { value: token, httponly: true }
+      cookies.encrypted.permanent["veri_token"] = { value: token, httponly: true, secure: request.ssl? }
+      reset_memoization
       true
     end
 
     def log_out
       current_session&.terminate
-      cookies.delete("#{auth_cookie_prefix}_token")
+      cookies.delete("veri_token")
+      reset_memoization
     end
 
     def logged_in?
@@ -58,7 +58,7 @@ module Veri
     end
 
     def return_path
-      cookies.signed["#{auth_cookie_prefix}_return_path"]
+      cookies.signed["veri_return_path"]
     end
 
     def shapeshifter?
@@ -68,20 +68,14 @@ module Veri
     private
 
     def with_authentication
-      if logged_in? && current_session.active?
-        if current_user.locked?
-          log_out
-          when_unauthenticated
-        else
-          current_session.update_info(request)
-        end
-
+      if logged_in? && !current_user.locked?
+        current_session.update_info(request)
         return
       end
 
       log_out
 
-      cookies.signed["#{auth_cookie_prefix}_return_path"] = { value: request.fullpath, expires: 15.minutes.from_now } if request.get? && request.format.html?
+      cookies.signed["veri_return_path"] = { value: request.fullpath, expires: 15.minutes.from_now } if request.get? && request.format.html?
 
       when_unauthenticated
     end
@@ -100,8 +94,8 @@ module Veri
       ).resolve
     end
 
-    def auth_cookie_prefix
-      @auth_cookie_prefix ||= "auth_#{Zlib.crc32(Marshal.dump(resolved_tenant))}"
+    def reset_memoization
+      @current_user = @current_session = nil
     end
   end
 end

data/lib/veri/models/concerns/authenticatable.rb

@@ -23,14 +23,26 @@ module Veri
     end
 
     def verify_password(password)
-      hasher.verify(
-        Veri::Inputs::NonEmptyString.new(password, message: "Expected a non-empty string, got `#{password.inspect}`").process,
-        hashed_password
-      )
+      processed_password = Veri::Inputs::NonEmptyString.new(password, message: "Expected a non-empty string, got `#{password.inspect}`").process
+
+      return false if hashed_password.blank?
+
+      stored_hasher = Veri::Configuration::HASHERS.values.find { _1.match?(hashed_password) }
+
+      raise Veri::Error, "Unrecognized password hash format" unless stored_hasher
+
+      return false unless stored_hasher.verify(processed_password, hashed_password)
+
+      update_column(:hashed_password, hasher.create(processed_password)) unless stored_hasher == hasher
+
+      true
     end
 
     def lock!
-      update!(locked: true, locked_at: Time.current)
+      transaction do
+        update!(locked: true, locked_at: Time.current)
+        sessions.terminate_all
+      end
     end
 
     def unlock!

data/lib/veri/models/session.rb

@@ -5,8 +5,6 @@ module Veri
   class Session < ActiveRecord::Base
     self.table_name = "veri_sessions"
 
-    belongs_to :authenticatable, class_name: Veri::Configuration.user_model_name
-    belongs_to :original_authenticatable, class_name: Veri::Configuration.user_model_name, optional: true
     belongs_to :tenant, polymorphic: true, optional: true
     belongs_to :original_tenant, polymorphic: true, optional: true
 
@@ -128,10 +126,12 @@ module Veri
 
       alias terminate_all delete_all
 
-      def lookup(token, resolved_tenant)
+      def find_active(token, resolved_tenant)
         return nil if token.blank?
 
-        find_by(hashed_token: digest_token(token), **resolved_tenant)
+        session = find_by(hashed_token: digest_token(token), **resolved_tenant)
+
+        session&.active? ? session : nil
       end
 
       private

data/lib/veri/password/argon2.rb

@@ -12,6 +12,10 @@ module Veri
       def verify(password, hashed_password)
         ::Argon2::Password.verify_password(password, hashed_password)
       end
+
+      def match?(hashed_password)
+        hashed_password.start_with?("$argon2")
+      end
     end
   end
 end

data/lib/veri/password/bcrypt.rb

@@ -12,6 +12,10 @@ module Veri
       def verify(password, hashed_password)
         ::BCrypt::Password.new(hashed_password) == password
       end
+
+      def match?(hashed_password)
+        hashed_password.start_with?("$2")
+      end
     end
   end
 end

data/lib/veri/password/pbkdf2.rb

@@ -42,6 +42,10 @@ module Veri
 
         OpenSSL.fixed_length_secure_compare(recalculated_hash, hash)
       end
+
+      def match?(hashed_password)
+        hashed_password.start_with?("#{DIGEST}$")
+      end
     end
   end
 end

data/lib/veri/password/scrypt.rb

@@ -12,6 +12,10 @@ module Veri
       def verify(password, hashed_password)
         ::SCrypt::Password.new(hashed_password) == password
       end
+
+      def match?(hashed_password)
+        hashed_password.match?(/\A\h+\$\h+\$\h+\$/)
+      end
     end
   end
 end

data/lib/veri/railtie.rb

@@ -22,8 +22,16 @@ module Veri
           end
         end
 
-        user_model = Veri::Configuration.user_model
-        user_model.include Veri::Authenticatable unless user_model < Veri::Authenticatable
+        begin
+          user_model = Veri::Configuration.user_model
+          user_model.include Veri::Authenticatable unless user_model < Veri::Authenticatable
+        rescue Veri::ConfigurationError
+          raise if Veri::Railtie.server_running?
+        end
+
+        Veri::Session.belongs_to :authenticatable, class_name: Veri::Configuration.user_model_name
+        Veri::Session.belongs_to :original_authenticatable, class_name: Veri::Configuration.user_model_name,
+                                                            optional: true
       end
     end
 

data/lib/veri/version.rb

@@ -1,3 +1,3 @@
 module Veri
-  VERSION = "2.0.2".freeze
+  VERSION = "2.0.3".freeze
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: veri
 version: !ruby/object:Gem::Version
-  version: 2.0.2
+  version: 2.0.3
 platform: ruby
 authors:
 - enjaku4
 bindir: bin
 cert_chain: []
-date: 2026-03-28 00:00:00.000000000 Z
+date: 2026-07-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: argon2