veri 2.0.2 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c9b0db1fbb87c0a3b25d47f2142cab1b9143a0ba7751a05c1676ca6e3b4b6ee3
-  data.tar.gz: 600d600760a3c0af2fddfece43322193be1ae4255eae0dd1c22d4099a083cb7b
+  metadata.gz: 703094a8e90e3fde6888629b9702406548122bed4ab199e1a02eac174c68ee07
+  data.tar.gz: 337701b97ed23c8cffd7b8ffb6d649e3e520c09bc61de6ed69e7c9d8b1905462
 SHA512:
-  metadata.gz: aaf5ec5aced9ddec1c42367df39be9e4322d3b1b3946bb473bfaee3f668d6fea55d78b48f3f1f0fa1acb8ee4588de8039d054730d3b913ab8036def74054d858
-  data.tar.gz: b188516f09afc341584f4460d5caa0e552c94e54dfe3a4bc3fe7a4cddb592acbb8c4957092e4763e88bd1be34ebc122934b40876bd2fc23e87d3b207b5fb2479
+  metadata.gz: e717d0cf3a4a8d9c673919548c739820ed15b42e7ab7140c9a95cd0f4740cd20a1678cf2a9dfbbcbaeb1257b60f9b8b2a28c2030d9b893fbf382a309e90b1445
+  data.tar.gz: 515e5fee62f96f4ddf4982419207565a905faa00246b5d1b483581ba86fd1063e0bbe06eaa253274c6e73d69395b1f8afd296210afd8aed3c067e264d872d7a4

data/CHANGELOG.md

@@ -1,3 +1,30 @@
+## v2.1.0
+
+### Features
+
+- Added `Veri::Session#switch_tenant` method to move a session to another tenant
+- Added `password_set?` method to check whether a user has a password
+
+### Bugs
+
+- Fixed `log_in` using the previous tenant when `current_tenant` changes within the same request
+- Fixed `Veri::Session.in_tenant` raising an error without a message when given an invalid tenant
+
+## v2.0.3
+
+### Bugs
+
+- Fixed authentication raising `NameError` when the configured user model is not named `User`
+- Fixed Rails commands failing when the configured user model class does not exist yet
+- Fixed expired and inactive sessions still appearing as logged in on pages that don't require authentication
+- Fixed locking a user not terminating their sessions until their next request
+- Fixed password verification raising an error for users who have no password set
+- Fixed cross-tenant shapeshifting not working
+
+### Misc
+
+- The hashing algorithm can now be changed without breaking existing passwords
+
 ## v2.0.2
 
 ### Misc

data/README.md

@@ -81,6 +81,8 @@ Veri.configure do |config|
 end
 ```
 
+The hashing algorithm can be changed at any time: existing passwords are verified with the algorithm they were hashed with and are automatically re-hashed with the configured algorithm on the next successful login.
+
 ## Password Management
 
 Your user model is automatically extended with password management methods:
@@ -91,6 +93,9 @@ user.update_password("password")
 
 # Verify a password
 user.verify_password("password")
+
+# Check if a password is set
+user.password_set?
 ```
 Changing a password does not automatically terminate existing sessions. If you want to invalidate the user's sessions after a password change, do so explicitly:
 
@@ -396,6 +401,40 @@ user.sessions.in_tenant(tenant)
 user.sessions.in_tenant(tenant).terminate_all
 ```
 
+### Switching Tenants
+
+A session belongs to one tenant, and a browser holds one session per host. A user is therefore logged in to one tenant at a time, unless your tenants live on separate subdomains, where each subdomain keeps its own session.
+
+To move a user to another tenant, call `switch_tenant` on their session and make `current_tenant` return the new tenant from then on:
+
+```rb
+class ApplicationController < ActionController::Base
+  include Veri::Authentication
+
+  with_authentication
+
+  private
+
+  def current_tenant
+    # This example keeps the tenant in a cookie; your app can keep it anywhere
+    Company.find_by(id: cookies.signed[:company_id])
+  end
+end
+
+class CompaniesController < ApplicationController
+  def switch
+    company = current_user.companies.find(params[:id])
+
+    current_session.switch_tenant(company)
+    cookies.signed[:company_id] = company.id
+
+    redirect_to root_path, notice: "Switched to #{company.name}"
+  end
+end
+```
+
+The user stays logged in and the session keeps its expiration.
+
 ### User Impersonation with Tenants
 
 When using user impersonation in a multi-tenant setup, Veri allows cross-tenant shapeshifting while preserving the original tenant context:
@@ -408,24 +447,20 @@ session.shapeshift(user, tenant: company)
 session.true_tenant
 ```
 
+The `tenant:` argument always becomes the session's tenant: omitting it means no tenant. In a multi-tenant application, always pass it explicitly.
+
 All other session methods work the same way in multi-tenant applications as in single-tenant applications. However, `to_true_identity` will restore both the original user and tenant.
 
 ### Orphaned Sessions
 
 When a tenant object is deleted from your database, its associated sessions become orphaned.
 
-To clean up orphaned sessions, use:
+Ideally, the application should be designed so that this doesn't happen: whenever a tenant object is deleted, its sessions are terminated as part of the same operation. However, if that wasn't done, you can clean up the orphaned sessions as a fallback:
 
 ```rb
 Veri::Session.prune
 ```
 
-Or, for a specific user:
-
-```rb
-user.sessions.prune
-```
-
 ### Tenant Migrations
 
 When you rename or remove models used as tenants, you need to update Veri's stored data accordingly. Use these irreversible data migrations:
@@ -502,24 +537,26 @@ end
 ## Getting Help and Contributing
 
 ### Getting Help
+
 Have a question or need assistance? Open a discussion in the [discussions section](https://github.com/enjaku4/veri/discussions) for:
+
 - Usage questions
 - Implementation guidance
-- Feature suggestions
+- Open-ended ideas or suggestions
+
+### Issues
+
+[Issues](https://github.com/enjaku4/veri/issues) track bugs, planned features, and other work. When reporting a bug, please include:
 
-### Reporting Issues
-Found a bug? Please [create an issue](https://github.com/enjaku4/veri/issues) with:
 - A clear description of the problem
 - Steps to reproduce the issue
-- Your environment details (Rails version, Ruby version, etc.)
+- Your environment details (Rails and Ruby versions, OS, etc.)
 
 ### Contributing Code
-Ready to contribute? You can:
-- Fix bugs by submitting pull requests
-- Improve documentation
-- Add new features (please discuss first in the [discussions section](https://github.com/enjaku4/veri/discussions))
 
-Before contributing, please read the [contributing guidelines](https://github.com/enjaku4/veri/blob/main/CONTRIBUTING.md)
+Any open issue is free to pick up or discuss. Check the [project board](https://github.com/users/enjaku4/projects/13) or [issues tab](https://github.com/enjaku4/veri/issues).
+
+Before contributing, please read the [contributing guidelines](https://github.com/enjaku4/veri/blob/main/CONTRIBUTING.md).
 
 ## License
 
@@ -531,6 +568,6 @@ Everyone interacting in the Veri project is expected to follow the [code of cond
 
 ## Old Versions
 
-Only the latest major version is supported. Older versions are obsolete and not maintained, but their READMEs are available here for reference:
+Only the latest major version is actively maintained. READMEs for older versions are available here for reference:
 
 [v1.x.x](https://github.com/enjaku4/veri/blob/9c188e16a703141b7cd89dd31d5cd49a557f143d/README.md)

data/lib/veri/controllers/concerns/authentication.rb

@@ -1,5 +1,3 @@
-require "zlib"
-
 module Veri
   module Authentication
     extend ActiveSupport::Concern
@@ -29,28 +27,27 @@ module Veri
     end
 
     def current_session
-      token = cookies.encrypted["#{auth_cookie_prefix}_token"]
+      token = cookies.encrypted["veri_token"]
 
-      @current_session ||= Session.lookup(token, resolved_tenant)
+      @current_session ||= Session.find_active(token, resolved_tenant)
     end
 
     def log_in(authenticatable)
-      processed_authenticatable = Veri::Inputs::Authenticatable.new(
-        authenticatable,
-        message: "Expected an instance of #{Veri::Configuration.user_model_name}, got `#{authenticatable.inspect}`"
-      ).process
+      processed_authenticatable = Veri::Inputs::Authenticatable.new(authenticatable).process
 
       return false if processed_authenticatable.locked?
 
       token = Veri::Session.establish(processed_authenticatable, request, resolved_tenant)
 
-      cookies.encrypted.permanent["#{auth_cookie_prefix}_token"] = { value: token, httponly: true }
+      cookies.encrypted.permanent["veri_token"] = { value: token, httponly: true, secure: request.ssl? }
+      reset_memoization
       true
     end
 
     def log_out
       current_session&.terminate
-      cookies.delete("#{auth_cookie_prefix}_token")
+      cookies.delete("veri_token")
+      reset_memoization
     end
 
     def logged_in?
@@ -58,7 +55,7 @@ module Veri
     end
 
     def return_path
-      cookies.signed["#{auth_cookie_prefix}_return_path"]
+      cookies.signed["veri_return_path"]
     end
 
     def shapeshifter?
@@ -68,20 +65,14 @@ module Veri
     private
 
     def with_authentication
-      if logged_in? && current_session.active?
-        if current_user.locked?
-          log_out
-          when_unauthenticated
-        else
-          current_session.update_info(request)
-        end
-
+      if logged_in? && !current_user.locked?
+        current_session.update_info(request)
         return
       end
 
       log_out
 
-      cookies.signed["#{auth_cookie_prefix}_return_path"] = { value: request.fullpath, expires: 15.minutes.from_now } if request.get? && request.format.html?
+      cookies.signed["veri_return_path"] = { value: request.fullpath, expires: 15.minutes.from_now } if request.get? && request.format.html?
 
       when_unauthenticated
     end
@@ -93,15 +84,11 @@ module Veri
     def current_tenant = nil
 
     def resolved_tenant
-      @resolved_tenant ||= Veri::Inputs::Tenant.new(
-        current_tenant,
-        error: Veri::InvalidTenantError,
-        message: "Expected a string, an ActiveRecord model instance, or nil, got `#{current_tenant.inspect}`"
-      ).resolve
+      Veri::Inputs::Tenant.new(current_tenant).resolve
     end
 
-    def auth_cookie_prefix
-      @auth_cookie_prefix ||= "auth_#{Zlib.crc32(Marshal.dump(resolved_tenant))}"
+    def reset_memoization
+      @current_user = @current_session = nil
     end
   end
 end

data/lib/veri/inputs/authenticatable.rb

@@ -3,6 +3,8 @@ module Veri
     class Authenticatable < Veri::Inputs::Base
       private
 
+      def default_message = "Expected an instance of #{Veri::Configuration.user_model_name}, got `#{@value.inspect}`"
+
       def processor = -> { @value.is_a?(Veri::Configuration.user_model) ? @value : raise_error }
     end
   end

data/lib/veri/inputs/base.rb

@@ -1,7 +1,7 @@
 module Veri
   module Inputs
     class Base
-      def initialize(value, optional: false, error: Veri::InvalidArgumentError, message: nil)
+      def initialize(value, optional: false, error: nil, message: nil)
         @value = value
         @optional = optional
         @error = error
@@ -20,8 +20,11 @@ module Veri
         raise NotImplementedError
       end
 
+      def default_error = Veri::InvalidArgumentError
+      def default_message = nil
+
       def raise_error
-        raise @error, @message
+        raise @error || default_error, @message || default_message
       end
     end
   end

data/lib/veri/inputs/non_empty_string.rb

@@ -3,6 +3,8 @@ module Veri
     class NonEmptyString < Veri::Inputs::Base
       private
 
+      def default_message = "Expected a non-empty string, got `#{@value.inspect}`"
+
       def processor = -> { @value.is_a?(String) && !@value.empty? ? @value : raise_error }
     end
   end

data/lib/veri/inputs/tenant.rb

@@ -17,6 +17,9 @@ module Veri
 
       private
 
+      def default_error = Veri::InvalidTenantError
+      def default_message = "Expected a string, an ActiveRecord model instance, or nil, got `#{@value.inspect}`"
+
       def processor
         -> {
           return @value if @value.nil?

data/lib/veri/models/concerns/authenticatable.rb

@@ -16,21 +16,37 @@ module Veri
     def update_password(password)
       update!(
         hashed_password: hasher.create(
-          Veri::Inputs::NonEmptyString.new(password, message: "Expected a non-empty string, got `#{password.inspect}`").process
+          Veri::Inputs::NonEmptyString.new(password).process
         ),
         password_updated_at: Time.current
       )
     end
 
+    def password_set?
+      hashed_password.present?
+    end
+
     def verify_password(password)
-      hasher.verify(
-        Veri::Inputs::NonEmptyString.new(password, message: "Expected a non-empty string, got `#{password.inspect}`").process,
-        hashed_password
-      )
+      processed_password = Veri::Inputs::NonEmptyString.new(password).process
+
+      return false unless password_set?
+
+      stored_hasher = Veri::Configuration::HASHERS.values.find { _1.match?(hashed_password) }
+
+      raise Veri::Error, "Unrecognized password hash format" unless stored_hasher
+
+      return false unless stored_hasher.verify(processed_password, hashed_password)
+
+      update_column(:hashed_password, hasher.create(processed_password)) unless stored_hasher == hasher
+
+      true
     end
 
     def lock!
-      update!(locked: true, locked_at: Time.current)
+      transaction do
+        update!(locked: true, locked_at: Time.current)
+        sessions.terminate_all
+      end
     end
 
     def unlock!

data/lib/veri/models/session.rb

@@ -5,8 +5,6 @@ module Veri
   class Session < ActiveRecord::Base
     self.table_name = "veri_sessions"
 
-    belongs_to :authenticatable, class_name: Veri::Configuration.user_model_name
-    belongs_to :original_authenticatable, class_name: Veri::Configuration.user_model_name, optional: true
     belongs_to :tenant, polymorphic: true, optional: true
     belongs_to :original_tenant, polymorphic: true, optional: true
 
@@ -62,11 +60,7 @@ module Veri
     def shapeshift(user, tenant: nil)
       raise Veri::Error, "Cannot shapeshift from a shapeshifted session" if shapeshifted?
 
-      resolved_tenant = Veri::Inputs::Tenant.new(
-        tenant,
-        error: Veri::InvalidTenantError,
-        message: "Expected a string, an ActiveRecord model instance, or nil, got `#{tenant.inspect}`"
-      ).resolve
+      resolved_tenant = Veri::Inputs::Tenant.new(tenant).resolve
 
       update!(
         shapeshifted_at: Time.current,
@@ -74,10 +68,7 @@ module Veri
         original_tenant_type: tenant_type,
         original_tenant_id: tenant_id,
         **resolved_tenant,
-        authenticatable: Veri::Inputs::Authenticatable.new(
-          user,
-          message: "Expected an instance of #{Veri::Configuration.user_model_name}, got `#{user.inspect}`"
-        ).process
+        authenticatable: Veri::Inputs::Authenticatable.new(user).process
       )
     end
 
@@ -93,6 +84,10 @@ module Veri
       )
     end
 
+    def switch_tenant(tenant)
+      update!(**Veri::Inputs::Tenant.new(tenant).resolve)
+    end
+
     def tenant
       resolve_tenant(tenant_type, tenant_id) { super }
     end
@@ -128,10 +123,12 @@ module Veri
 
       alias terminate_all delete_all
 
-      def lookup(token, resolved_tenant)
+      def find_active(token, resolved_tenant)
         return nil if token.blank?
 
-        find_by(hashed_token: digest_token(token), **resolved_tenant)
+        session = find_by(hashed_token: digest_token(token), **resolved_tenant)
+
+        session&.active? ? session : nil
       end
 
       private

data/lib/veri/password/argon2.rb

@@ -12,6 +12,10 @@ module Veri
       def verify(password, hashed_password)
         ::Argon2::Password.verify_password(password, hashed_password)
       end
+
+      def match?(hashed_password)
+        hashed_password.start_with?("$argon2")
+      end
     end
   end
 end

data/lib/veri/password/bcrypt.rb

@@ -12,6 +12,10 @@ module Veri
       def verify(password, hashed_password)
         ::BCrypt::Password.new(hashed_password) == password
       end
+
+      def match?(hashed_password)
+        hashed_password.start_with?("$2")
+      end
     end
   end
 end

data/lib/veri/password/pbkdf2.rb

@@ -42,6 +42,10 @@ module Veri
 
         OpenSSL.fixed_length_secure_compare(recalculated_hash, hash)
       end
+
+      def match?(hashed_password)
+        hashed_password.start_with?("#{DIGEST}$")
+      end
     end
   end
 end

data/lib/veri/password/scrypt.rb

@@ -12,6 +12,10 @@ module Veri
       def verify(password, hashed_password)
         ::SCrypt::Password.new(hashed_password) == password
       end
+
+      def match?(hashed_password)
+        hashed_password.match?(/\A\h+\$\h+\$\h+\$/)
+      end
     end
   end
 end

data/lib/veri/railtie.rb

@@ -22,8 +22,16 @@ module Veri
           end
         end
 
-        user_model = Veri::Configuration.user_model
-        user_model.include Veri::Authenticatable unless user_model < Veri::Authenticatable
+        begin
+          user_model = Veri::Configuration.user_model
+          user_model.include Veri::Authenticatable unless user_model < Veri::Authenticatable
+        rescue Veri::ConfigurationError
+          raise if Veri::Railtie.server_running?
+        end
+
+        Veri::Session.belongs_to :authenticatable, class_name: Veri::Configuration.user_model_name
+        Veri::Session.belongs_to :original_authenticatable, class_name: Veri::Configuration.user_model_name,
+                                                            optional: true
       end
     end
 

data/lib/veri/version.rb

@@ -1,3 +1,3 @@
 module Veri
-  VERSION = "2.0.2".freeze
+  VERSION = "2.1.0".freeze
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: veri
 version: !ruby/object:Gem::Version
-  version: 2.0.2
+  version: 2.1.0
 platform: ruby
 authors:
 - enjaku4
 bindir: bin
 cert_chain: []
-date: 2026-03-28 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: argon2
@@ -147,7 +147,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Minimal cookie-based authentication library for Ruby on Rails
 test_files: []