:nocov:
Methods
Public Class
- configure
- create_database_authentication_functions
- create_database_previous_password_check_functions
- drop_database_authentication_functions
- drop_database_previous_password_check_functions
- lib
- load_dependencies
- new
- version
Public Instance
- _account_from_email_auth_key
- _account_from_login
- _account_from_refresh_token
- _account_from_reset_password_key
- _account_from_session
- _account_from_unlock_key
- _account_from_verify_account_key
- _account_from_verify_login_change_key
- _account_refresh_token_split
- _around_rodauth
- _email_auth_request
- _email_auth_request_and_redirect
- _field_attributes
- _field_error_attributes
- _formatted_field_error
- _get_remember_cookie
- _json_response_body
- _jwt_decode_opts
- _login
- _login_form_footer
- _login_form_footer_links
- _multi_phase_login_forms
- _new_account
- _otp
- _otp_add_key
- _otp_key
- _otp_tmp_key
- _recovery_codes
- _return_json_response
- _setup_account_lockouts_hash
- _sms
- _two_factor_auth_links
- _two_factor_remove_all_from_session
- _two_factor_remove_links
- _two_factor_setup_links
- _update_login
- _view
- _view_opts
- account_activity_ds
- account_ds
- account_expired?
- account_expired_at
- account_from_email_auth_key
- account_from_key
- account_from_login
- account_from_refresh_token
- account_from_reset_password_key
- account_from_session
- account_from_unlock_key
- account_from_verify_account_key
- account_from_verify_login_change_key
- account_id
- account_in_unverified_grace_period?
- account_initial_status_value
- account_lockouts_ds
- account_login_failures_ds
- account_password_hash_column
- account_session_status_filter
- account_webauthn_ids
- account_webauthn_usage
- account_webauthn_user_id
- active_remember_key_ds
- active_sessions_ds
- active_sessions_insert_hash
- active_sessions_update_hash
- add_active_session
- add_audit_log
- add_field_error_class
- add_previous_password_hash
- add_recovery_code
- add_recovery_codes
- add_remember_key
- add_webauthn_credential
- after_change_password
- after_close_account
- after_create_account
- after_login
- after_login_entered_during_multi_phase_login
- after_login_failure
- after_logout
- after_otp_disable
- after_refresh_token
- after_reset_password
- after_sms_disable
- after_webauthn_remove
- allow_email_auth?
- allow_resending_verify_account_email?
- already_logged_in
- argon2_hash_algorithm?
- argon2_hash_cost
- argon2_password_hash_match?
- argon2_salt_option
- audit_log_ds
- audit_log_insert_hash
- audit_log_message
- audit_log_message_default
- audit_log_metadata
- auth_class_eval
- authenticated?
- authenticated_by
- authenticated_webauthn_id
- auto_add_missing_recovery_codes
- auto_remove_recovery_codes
- autocomplete_for_field?
- autologin_session
- autologin_type
- base32_encode
- base_url
- before_change_login_route
- before_change_password_route
- before_create_account_route
- before_login_attempt
- before_logout
- before_otp_setup_route
- before_reset_password
- before_reset_password_request
- before_rodauth
- before_two_factor_auth_route
- before_two_factor_manage_route
- before_unlock_account
- before_unlock_account_request
- before_verify_account
- before_verify_account_route
- before_view_recovery_codes
- before_webauthn_auth_route
- before_webauthn_login_route
- before_webauthn_remove_route
- before_webauthn_setup_route
- button
- button_opts
- can_add_recovery_codes?
- catch_error
- change_login
- change_login_notice_flash
- change_login_requires_password?
- change_password_requires_password?
- check_account_expiration
- check_active_session
- check_already_logged_in
- check_csrf
- check_csrf?
- check_password_change_allowed
- check_session_expiration
- check_single_session
- clear_cached_otp
- clear_invalid_login_attempts
- clear_session
- close_account
- close_account_requires_password?
- compute_hmac
- compute_raw_hmac
- confirm_password
- confirm_password_redirect
- convert_email_token_key
- convert_session_key
- convert_timestamp
- convert_token_key
- create_account_autologin?
- create_account_notice_flash
- create_account_set_password?
- create_email
- create_email_auth_key
- create_email_to
- create_reset_password_key
- create_verify_account_key
- create_verify_login_change_email
- create_verify_login_change_key
- csrf_tag
- currently_active_session?
- database_function_password_match?
- db
- delete_account
- delete_account_on_close?
- disable_remember_login
- domain
- email_auth_ds
- email_auth_email_link
- email_auth_email_recently_sent?
- email_auth_key_insert_hash
- email_auth_request_form
- email_from
- email_to
- expire_session
- extract_password_hash_cost
- features
- field_attributes
- field_error
- field_error_attributes
- flash
- forget_login
- formatted_field_error
- function_name
- generate_active_sessions_key
- generate_email_auth_key_value
- generate_refresh_token
- generate_remember_key_value
- generate_reset_password_key_value
- generate_unlock_account_key
- generate_verify_account_key_value
- generate_verify_login_change_key_value
- get_active_refresh_token
- get_activity_timestamp
- get_email_auth_email_last_sent
- get_email_auth_key
- get_password_changed_at
- get_password_hash
- get_password_reset_key
- get_remember_key
- get_reset_password_email_last_sent
- get_unlock_account_email_last_sent
- get_unlock_account_key
- get_verify_account_email_last_sent
- get_verify_account_key
- get_verify_login_change_login_and_key
- handle_duplicate_active_session_id
- handle_webauthn_sign_count_verification_error
- has_password?
- hook_action
- http_basic_auth
- inactive_session_cond
- include_success_messages?
- input_field_string
- inputmode_for_field?
- internal_request?
- internal_request_configuration
- invalid_login_attempted
- invalid_previous_password_message
- json_request?
- json_response
- jwt_cors_allow?
- jwt_payload
- jwt_refresh_token_account_ds
- jwt_refresh_token_account_token_ds
- jwt_refresh_token_ds
- jwt_refresh_token_insert_hash
- jwt_refresh_token_match?
- jwt_secret
- jwt_session_hash
- jwt_token
- last_account_activity_at
- last_account_login_at
- load_memory
- loaded_templates
- locked_out?
- logged_in_via_remember_key?
- login
- login_confirm_label
- login_does_not_meet_requirements_message
- login_failed_reset_password_request_form
- login_hidden_field
- login_input_type
- login_meets_email_requirements?
- login_meets_length_requirements?
- login_meets_requirements?
- login_required
- login_return_to_requested_location_path
- login_session
- login_too_long_message
- login_too_many_bytes_message
- login_too_short_message
- login_uses_email?
- login_valid_email?
- logout
- logout_additional_form_tags
- modifications_require_password?
- new_account
- new_recovery_code
- new_webauthn_credential
- no_longer_active_session
- null_byte_parameter_value
- only_json?
- open_account?
- otp_add_key
- otp_available?
- otp_exists?
- otp_hmac_secret
- otp_issuer
- otp_key_ds
- otp_keys_use_hmac?
- otp_last_use
- otp_locked_out?
- otp_new_secret
- otp_provisioning_name
- otp_provisioning_uri
- otp_qr_code
- otp_record_authentication_failure
- otp_remove
- otp_remove_auth_failures
- otp_tmp_key
- otp_update_last_use
- otp_user_key
- otp_valid_code?
- otp_valid_key?
- param
- param_or_nil
- password_confirm_label
- password_does_not_contain_null_byte?
- password_does_not_meet_requirements_message
- password_doesnt_match_previous_password?
- password_expiration_ds
- password_expired?
- password_field_autocomplete_value
- password_has_enough_character_groups?
- password_has_no_invalid_pattern?
- password_hash
- password_hash_cost
- password_hash_ds
- password_hash_match?
- password_hash_using_salt
- password_match?
- password_meets_length_requirements?
- password_meets_requirements?
- password_not_in_dictionary?
- password_not_one_of_the_most_common?
- password_not_too_many_repeating_characters?
- password_one_of_most_common?
- password_recently_entered?
- password_reset_ds
- password_too_long_message
- password_too_many_bytes_message
- password_too_short_message
- possible_authentication_methods
- post_configure
- previous_password_ds
- raises_uniqueness_violation?
- random_key
- raw_param
- recovery_code_match?
- recovery_codes_available?
- recovery_codes_ds
- recovery_codes_primary?
- recovery_codes_remove
- redirect
- redirect_two_factor_authenticated
- remember_key_ds
- remember_login
- remembered_session_id
- remove_all_active_sessions
- remove_all_webauthn_keys_and_user_ids
- remove_current_session
- remove_email_auth_key
- remove_inactive_sessions
- remove_jwt_refresh_token_key
- remove_lockout_metadata
- remove_remember_key
- remove_reset_password_key
- remove_session_value
- remove_verify_account_key
- remove_verify_login_change_key
- remove_webauthn_key
- render
- render_multi_phase_login_forms
- request
- require_account
- require_account_session
- require_authentication
- require_current_password
- require_http_basic_auth
- require_login
- require_login_confirmation?
- require_otp_setup
- require_password_authentication
- require_password_authentication?
- require_sms_available
- require_sms_not_setup
- require_sms_setup
- require_two_factor_authenticated
- require_two_factor_not_authenticated
- require_two_factor_setup
- require_webauthn_setup
- rescue_jwt_payload
- reset_password_email_link
- reset_password_email_recently_sent?
- reset_password_key_insert_hash
- reset_single_session_key
- response
- retry_on_uniqueness_violation
- return_json_response
- return_response
- route!
- route_path
- route_url
- save_account
- send_email
- send_verify_login_change_email
- serialize_audit_log_metadata
- session
- session_inactivity_deadline_condition
- session_jwt
- session_lifetime_deadline_condition
- session_value
- set_deadline_value
- set_deadline_values?
- set_email_auth_email_last_sent
- set_error_flash
- set_error_reason
- set_expired
- set_field_error
- set_http_basic_auth_error_response
- set_jwt
- set_jwt_refresh_token_hmac_session_key
- set_jwt_token
- set_last_password_entry
- set_login_requirement_error_message
- set_new_account_password
- set_notice_flash
- set_notice_now_flash
- set_password
- set_password_requirement_error_message
- set_redirect_error_flash
- set_redirect_error_status
- set_reset_password_email_last_sent
- set_response_error_reason_status
- set_response_error_status
- set_session_value
- set_single_session_key
- set_title
- set_unlock_account_email_last_sent
- set_verify_account_email_last_sent
- setup_account_verification
- show_lockout_page
- single_session_ds
- skip_login_field_on_login?
- skip_password_field_on_login?
- skip_status_checks?
- sms_auth_message
- sms_available?
- sms_code
- sms_code_issued_at
- sms_code_match?
- sms_codes_primary?
- sms_confirm
- sms_confirm_failure
- sms_confirm_message
- sms_confirmation_match?
- sms_current_auth?
- sms_disable
- sms_ds
- sms_failures
- sms_locked_out?
- sms_needs_confirmation?
- sms_new_auth_code
- sms_new_confirm_code
- sms_normalize_phone
- sms_phone
- sms_record_failure
- sms_remove_failures
- sms_send
- sms_send_auth_code
- sms_send_confirm_code
- sms_set_code
- sms_setup
- sms_setup?
- sms_valid_phone?
- split_token
- template_path
- throw_basic_auth_error
- throw_error
- throw_error_reason
- throw_error_status
- timing_safe_eql?
- token_link
- token_param_value
- transaction
- translate
- two_factor_authenticate
- two_factor_authenticated?
- two_factor_authentication_setup?
- two_factor_login_type_match?
- two_factor_modifications_require_password?
- two_factor_password_match?
- two_factor_remove
- two_factor_remove_auth_failures
- two_factor_remove_session
- two_factor_update_session
- unique_constraint_violation_class
- unlock_account
- unlock_account_email_link
- unlock_account_email_recently_sent?
- unverified_grace_period_expired?
- update_account
- update_activity
- update_current_session?
- update_hash_ds
- update_last_activity
- update_last_login
- update_login
- update_password_changed_at
- update_password_hash?
- update_session
- update_single_session_key
- update_sms
- use_database_authentication_functions?
- use_date_arithmetic?
- use_json?
- use_jwt?
- use_multi_phase_login?
- use_request_specific_csrf_tokens?
- uses_two_factor_authentication?
- valid_jwt?
- valid_login_entered?
- valid_new_webauthn_credential?
- valid_webauthn_credential_auth?
- verified_account?
- verify_account
- verify_account_check_already_logged_in
- verify_account_ds
- verify_account_email_link
- verify_account_email_recently_sent?
- verify_account_email_resend
- verify_account_key_insert_hash
- verify_account_set_password?
- verify_account_view
- verify_login_change
- verify_login_change_ds
- verify_login_change_email_body
- verify_login_change_email_link
- verify_login_change_key_insert_hash
- verify_login_change_old_login
- view
- webauth_credential_options_for_get
- webauthn_account_id
- webauthn_auth_additional_form_tags
- webauthn_auth_credential_from_form_submission
- webauthn_auth_form_path
- webauthn_authenticator_selection
- webauthn_extensions
- webauthn_keys_ds
- webauthn_origin
- webauthn_remove_authenticated_session
- webauthn_rp_id
- webauthn_rp_name
- webauthn_setup?
- webauthn_setup_credential_from_form_submission
- webauthn_update_session
- webauthn_user_ids_ds
- webauthn_user_name
Classes and Modules
Constants
FEATURES | = | {} | ||
INVALID_DOMAIN | = | "invalidurl @@.com" | ||
MAJOR | = | 2 |
The major version of |
|
MINOR | = | 25 |
The minor version of |
|
TINY | = | 0 |
The patch version of |
|
VERSION | = | "#{MAJOR}.#{MINOR}.#{TINY}".freeze |
The full version of |
|
VERSION_NUMBER | = | MAJOR*10000 + MINOR*100 + TINY |
Public Instance Aliases
account_session_value | -> | account_id | |
ignore_uniqueness_violation | -> | raises_uniqueness_violation? |
If you just want to ignore uniqueness violations, this alias makes more sense. |
logged_in? | -> | session_value | |
raised_uniqueness_violation | -> | raises_uniqueness_violation? |
If you would like to operate/reraise the exception, this alias makes more sense. |
Public Class methods
# File lib/rodauth.rb 44 def self.configure(app, opts={}, &block) 45 json_opt = app.opts[:rodauth_json] = opts.fetch(:json, app.opts[:rodauth_json]) 46 csrf = app.opts[:rodauth_csrf] = opts.fetch(:csrf, app.opts[:rodauth_csrf]) 47 app.opts[:rodauth_route_csrf] = case csrf 48 when false, :rack_csrf 49 false 50 else 51 json_opt != :only 52 end 53 auth_class = (app.opts[:rodauths] ||= {})[opts[:name]] ||= opts[:auth_class] || Class.new(Auth) 54 if !auth_class.roda_class 55 auth_class.roda_class = app 56 elsif auth_class.roda_class != app 57 auth_class = app.opts[:rodauths][opts[:name]] = Class.new(auth_class) 58 auth_class.roda_class = app 59 end 60 auth_class.class_eval{@configuration_name = opts[:name] unless defined?(@configuration_name)} 61 auth_class.configure(&block) if block 62 auth_class.allocate.post_configure if auth_class.method_defined?(:post_configure) 63 end
# File lib/rodauth/migrations.rb 4 def self.create_database_authentication_functions(db, opts={}) 5 table_name = opts[:table_name] || :account_password_hashes 6 get_salt_name = opts[:get_salt_name] || :rodauth_get_salt 7 valid_hash_name = opts[:valid_hash_name] || :rodauth_valid_password_hash 8 argon2 = opts[:argon2] 9 10 case db.database_type 11 when :postgres 12 search_path = opts[:search_path] || 'public, pg_temp' 13 primary_key_type = 14 case db.schema(table_name).find { |row| row.first == :id }[1][:db_type] 15 when 'uuid' then :uuid 16 else :int8 17 end 18 table_name = db.literal(table_name) unless table_name.is_a?(String) 19 20 argon_sql = <<END 21 CASE 22 WHEN password_hash ~ '^\\$argon2id' 23 THEN substring(password_hash from '\\$argon2id\\$v=\\d+\\$m=\\d+,t=\\d+,p=\\d+\\$.+\\$') 24 ELSE substr(password_hash, 0, 30) 25 END INTO salt 26 END 27 db.run <<END 28 CREATE OR REPLACE FUNCTION #{get_salt_name}(acct_id #{primary_key_type}) RETURNS text AS $$ 29 DECLARE salt text; 30 BEGIN 31 SELECT 32 #{argon2 ? argon_sql : "substr(password_hash, 0, 30) INTO salt"} 33 FROM #{table_name} 34 WHERE acct_id = id; 35 RETURN salt; 36 END; 37 $$ LANGUAGE plpgsql 38 SECURITY DEFINER 39 SET search_path = #{search_path}; 40 END 41 42 db.run <<END 43 CREATE OR REPLACE FUNCTION #{valid_hash_name}(acct_id #{primary_key_type}, hash text) RETURNS boolean AS $$ 44 DECLARE valid boolean; 45 BEGIN 46 SELECT password_hash = hash INTO valid 47 FROM #{table_name} 48 WHERE acct_id = id; 49 RETURN valid; 50 END; 51 $$ LANGUAGE plpgsql 52 SECURITY DEFINER 53 SET search_path = #{search_path}; 54 END 55 when :mysql 56 argon_sql = <<END 57 CASE 58 WHEN password_hash REGEXP '^.argon2id' 59 THEN left(password_hash, CHAR_LENGTH(password_hash) - INSTR(REVERSE(password_hash), '$')) 60 ELSE substr(password_hash, 1, 30) 61 END 62 END 63 db.run <<END 64 CREATE FUNCTION #{get_salt_name}(acct_id int8) RETURNS varchar(255) 65 SQL SECURITY DEFINER 66 READS SQL DATA 67 BEGIN 68 RETURN (SELECT 69 #{argon2 ? argon_sql : "substr(password_hash, 1, 30)"} 70 FROM #{table_name} 71 WHERE acct_id = id); 72 END; 73 END 74 75 db.run <<END 76 CREATE FUNCTION #{valid_hash_name}(acct_id int8, hash varchar(255)) RETURNS tinyint(1) 77 SQL SECURITY DEFINER 78 READS SQL DATA 79 BEGIN 80 DECLARE valid tinyint(1); 81 DECLARE csr CURSOR FOR 82 SELECT password_hash = hash 83 FROM #{table_name} 84 WHERE acct_id = id; 85 OPEN csr; 86 FETCH csr INTO valid; 87 CLOSE csr; 88 RETURN valid; 89 END; 90 END 91 when :mssql 92 argon_sql = <<END 93 CASE 94 WHEN password_hash LIKE '[$]argon2id%' 95 THEN left(password_hash, len(password_hash) - charindex('$', reverse(password_hash))) 96 ELSE substring(password_hash, 0, 30) 97 END 98 END 99 db.run <<END 100 CREATE FUNCTION #{get_salt_name}(@account_id bigint) RETURNS nvarchar(255) 101 WITH EXECUTE AS OWNER 102 AS 103 BEGIN 104 DECLARE @salt nvarchar(255); 105 SELECT @salt = 106 #{argon2 ? argon_sql : "substring(password_hash, 0, 30)"} 107 FROM #{table_name} 108 WHERE id = @account_id; 109 RETURN @salt; 110 END; 111 END 112 113 db.run <<END 114 CREATE FUNCTION #{valid_hash_name}(@account_id bigint, @hash nvarchar(255)) RETURNS bit 115 WITH EXECUTE AS OWNER 116 AS 117 BEGIN 118 DECLARE @valid bit; 119 DECLARE @ph nvarchar(255); 120 SELECT @ph = password_hash 121 FROM #{table_name} 122 WHERE id = @account_id; 123 IF(@hash = @ph) 124 SET @valid = 1; 125 ELSE 126 SET @valid = 0 127 RETURN @valid; 128 END; 129 END 130 end 131 end
# File lib/rodauth/migrations.rb 153 def self.create_database_previous_password_check_functions(db, opts={}) 154 create_database_authentication_functions(db, {:table_name=>:account_previous_password_hashes, :get_salt_name=>:rodauth_get_previous_salt, :valid_hash_name=>:rodauth_previous_password_hash_match}.merge(opts)) 155 end
# File lib/rodauth/migrations.rb 133 def self.drop_database_authentication_functions(db, opts={}) 134 table_name = opts[:table_name] || :account_password_hashes 135 get_salt_name = opts[:get_salt_name] || :rodauth_get_salt 136 valid_hash_name = opts[:valid_hash_name] || :rodauth_valid_password_hash 137 138 case db.database_type 139 when :postgres 140 primary_key_type = 141 case db.schema(table_name).find { |row| row.first == :id }[1][:db_type] 142 when 'uuid' then :uuid 143 else :int8 144 end 145 db.run "DROP FUNCTION #{get_salt_name}(#{primary_key_type})" 146 db.run "DROP FUNCTION #{valid_hash_name}(#{primary_key_type}, text)" 147 when :mysql, :mssql 148 db.run "DROP FUNCTION #{get_salt_name}" 149 db.run "DROP FUNCTION #{valid_hash_name}" 150 end 151 end
# File lib/rodauth/migrations.rb 157 def self.drop_database_previous_password_check_functions(db, opts={}) 158 drop_database_authentication_functions(db, {:table_name=>:account_previous_password_hashes, :get_salt_name=>:rodauth_get_previous_salt, :valid_hash_name=>:rodauth_previous_password_hash_match}.merge(opts)) 159 end
# File lib/rodauth.rb 6 def self.lib(opts={}, &block) 7 require 'roda' 8 c = Class.new(Roda) 9 c.plugin(:rodauth, opts) do 10 enable :internal_request 11 instance_exec(&block) 12 end 13 c.freeze 14 c.rodauth 15 end
# File lib/rodauth.rb 17 def self.load_dependencies(app, opts={}) 18 json_opt = opts.fetch(:json, app.opts[:rodauth_json]) 19 if json_opt 20 app.plugin :json 21 app.plugin :json_parser 22 end 23 24 unless json_opt == :only 25 require 'tilt/string' 26 app.plugin :render 27 28 case opts.fetch(:csrf, app.opts[:rodauth_csrf]) 29 when false 30 # nothing 31 when :rack_csrf 32 # :nocov: 33 app.plugin :csrf 34 # :nocov: 35 else 36 app.plugin :route_csrf 37 end 38 39 app.plugin :flash unless opts[:flash] == false 40 app.plugin :h 41 end 42 end
# File lib/rodauth/features/base.rb 135 def initialize(scope) 136 @scope = scope 137 end
Public Instance methods
# File lib/rodauth/features/email_auth.rb 243 def _account_from_email_auth_key(token) 244 account_from_key(token, account_open_status_value){|id| get_email_auth_key(id)} 245 end
# File lib/rodauth/features/base.rb 656 def _account_from_login(login) 657 ds = db[accounts_table].where(login_column=>login) 658 ds = ds.select(*account_select) if account_select 659 ds = ds.where(account_status_column=>[account_unverified_status_value, account_open_status_value]) unless skip_status_checks? 660 ds.first 661 end
# File lib/rodauth/features/jwt_refresh.rb 111 def _account_from_refresh_token(token) 112 id, token_id, key = _account_refresh_token_split(token) 113 114 unless key && 115 (id == session_value.to_s) && 116 (actual = get_active_refresh_token(id, token_id)) && 117 timing_safe_eql?(key, convert_token_key(actual)) && 118 jwt_refresh_token_match?(key) 119 return 120 end 121 122 ds = account_ds(id) 123 ds = ds.where(account_session_status_filter) unless skip_status_checks? 124 ds.first 125 end
# File lib/rodauth/features/reset_password.rb 255 def _account_from_reset_password_key(token) 256 account_from_key(token, account_open_status_value){|id| get_password_reset_key(id)} 257 end
# File lib/rodauth/features/base.rb 663 def _account_from_session 664 ds = account_ds(session_value) 665 ds = ds.where(account_session_status_filter) unless skip_status_checks? 666 ds.first 667 end
# File lib/rodauth/features/lockout.rb 299 def _account_from_unlock_key(token) 300 account_from_key(token){|id| account_lockouts_ds(id).get(account_lockouts_key_column)} 301 end
# File lib/rodauth/features/verify_account.rb 309 def _account_from_verify_account_key(token) 310 account_from_key(token, account_unverified_status_value){|id| get_verify_account_key(id)} 311 end
# File lib/rodauth/features/verify_login_change.rb 212 def _account_from_verify_login_change_key(token) 213 account_from_key(token) do |id| 214 @verify_login_change_new_login, key = get_verify_login_change_login_and_key(id) 215 key 216 end 217 end
# File lib/rodauth/features/jwt_refresh.rb 127 def _account_refresh_token_split(token) 128 id, token = split_token(token) 129 return unless id && token 130 131 token_id, key = split_token(token) 132 return unless token_id && key 133 134 [id, token_id, key] 135 end
# File lib/rodauth/features/base.rb 492 def _around_rodauth 493 yield 494 end
# File lib/rodauth/features/email_auth.rb 185 def _email_auth_request 186 if email_auth_email_recently_sent? 187 set_redirect_error_flash email_auth_email_recently_sent_error_flash 188 redirect email_auth_email_recently_sent_redirect 189 end 190 191 generate_email_auth_key_value 192 transaction do 193 before_email_auth_request 194 create_email_auth_key 195 send_email_auth_email 196 after_email_auth_request 197 end 198 199 set_notice_flash email_auth_email_sent_notice_flash 200 end
# File lib/rodauth/features/email_auth.rb 180 def _email_auth_request_and_redirect 181 _email_auth_request 182 redirect email_auth_email_sent_redirect 183 end
# File lib/rodauth/features/base.rb 673 def _field_attributes(field) 674 nil 675 end
# File lib/rodauth/features/base.rb 677 def _field_error_attributes(field) 678 " aria-invalid=\"true\" aria-describedby=\"#{field}_error_message\" " 679 end
# File lib/rodauth/features/base.rb 681 def _formatted_field_error(field, error) 682 "<span class=\"#{input_field_error_message_class}\" id=\"#{field}_error_message\">#{error}</span>" 683 end
# File lib/rodauth/features/remember.rb 194 def _get_remember_cookie 195 request.cookies[remember_cookie_key] 196 end
# File lib/rodauth/features/json.rb 184 def _json_response_body(hash) 185 request.send(:convert_to_json, hash) 186 end
# File lib/rodauth/features/jwt.rb 110 def _jwt_decode_opts 111 jwt_decode_opts 112 end
# File lib/rodauth/features/login.rb 149 def _login(auth_type) 150 warn("Deprecated #_login method called, use #login instead.") 151 login(auth_type) 152 end
# File lib/rodauth/features/email_auth.rb 170 def _multi_phase_login_forms 171 forms = super 172 forms << [30, email_auth_request_form, :_email_auth_request_and_redirect] if valid_login_entered? && allow_email_auth? 173 forms 174 end
# File lib/rodauth/features/create_account.rb 121 def _new_account(login) 122 acc = {login_column=>login} 123 unless skip_status_checks? 124 acc[account_status_column] = account_initial_status_value 125 end 126 acc 127 end
# File lib/rodauth/features/otp.rb 414 def _otp 415 otp_class.new(otp_user_key, :issuer=>otp_issuer, :digits=>otp_digits, :interval=>otp_interval) 416 end
# File lib/rodauth/features/otp.rb 403 def _otp_add_key(secret) 404 # Uniqueness errors can't be handled here, as we can't be sure the secret provided 405 # is the same as the current secret. 406 otp_key_ds.insert(otp_keys_id_column=>session_value, otp_keys_column=>secret) 407 end
# File lib/rodauth/features/otp.rb 409 def _otp_key 410 @otp_user_key = nil 411 otp_key_ds.get(otp_keys_column) 412 end
# File lib/rodauth/features/otp.rb 397 def _otp_tmp_key(secret) 398 @otp_tmp_key = true 399 @otp_user_key = nil 400 @otp_key = secret 401 end
# File lib/rodauth/features/recovery_codes.rb 260 def _recovery_codes 261 recovery_codes_ds.select_map(recovery_codes_column) 262 end
# File lib/rodauth/features/json.rb 174 def _return_json_response 175 response.status ||= json_response_error_status if json_response[json_response_error_key] 176 response['Content-Type'] ||= json_response_content_type 177 return_response _json_response_body(json_response) 178 end
# File lib/rodauth/features/lockout.rb 171 def _setup_account_lockouts_hash(account_id, key) 172 hash = {account_lockouts_id_column=>account_id, account_lockouts_key_column=>key} 173 set_deadline_value(hash, account_lockouts_deadline_column, account_lockouts_deadline_interval) 174 hash 175 end
# File lib/rodauth/features/confirm_password.rb 79 def _two_factor_auth_links 80 links = (super if defined?(super)) || [] 81 if authenticated_by.length == 1 && !authenticated_by.include?('password') && has_password? 82 links << [5, confirm_password_path, confirm_password_link_text] 83 end 84 links 85 end
# File lib/rodauth/features/otp.rb 353 def _two_factor_remove_all_from_session 354 two_factor_remove_session('totp') 355 super 356 end
# File lib/rodauth/features/otp.rb 347 def _two_factor_remove_links 348 links = super 349 links << [20, otp_disable_path, otp_disable_link_text] if otp_exists? 350 links 351 end
# File lib/rodauth/features/otp.rb 341 def _two_factor_setup_links 342 links = super 343 links << [20, otp_setup_path, otp_setup_link_text] unless otp_exists? 344 links 345 end
# File lib/rodauth/features/change_login.rb 83 def _update_login(login) 84 updated = nil 85 raised = raises_uniqueness_violation?{updated = update_account({login_column=>login}, account_ds.exclude(login_column=>login)) == 1} 86 if raised 87 set_login_requirement_error_message(:already_an_account_with_this_login, already_an_account_with_this_login_message) 88 end 89 updated && !raised 90 end
# File lib/rodauth/features/base.rb 805 def _view(meth, page) 806 scope.send(meth, _view_opts(page)) 807 end
# File lib/rodauth/features/base.rb 790 def _view_opts(page) 791 opts = template_opts.dup 792 opts[:locals] = opts[:locals] ? opts[:locals].dup : {} 793 opts[:locals][:rodauth] = self 794 opts[:cache] = cache_templates 795 opts[:cache_key] = :"rodauth_#{page}" 796 797 opts = scope.send(:find_template, scope.send(:parse_template_opts, page, opts)) 798 unless File.file?(scope.send(:template_path, opts)) 799 opts[:path] = template_path(page) 800 end 801 802 opts 803 end
# File lib/rodauth/features/account_expiration.rb 104 def account_activity_ds(account_id) 105 db[account_activity_table]. 106 where(account_activity_id_column=>account_id) 107 end
# File lib/rodauth/features/base.rb 693 def account_ds(id=account_id) 694 raise ArgumentError, "invalid account id passed to account_ds" unless id 695 ds = db[accounts_table].where(account_id_column=>id) 696 ds = ds.select(*account_select) if account_select 697 ds 698 end
# File lib/rodauth/features/account_expiration.rb 54 def account_expired? 55 columns = [account_activity_last_activity_column, account_activity_last_login_column, account_activity_expired_column] 56 last_activity, last_login, expired = account_activity_ds(account_id).get(columns) 57 return true if expired 58 timestamp = convert_timestamp(expire_account_on_last_activity? ? last_activity : last_login) 59 return false unless timestamp 60 timestamp < Time.now - expire_account_after 61 end
# File lib/rodauth/features/account_expiration.rb 35 def account_expired_at 36 get_activity_timestamp(account_id, account_activity_expired_column) 37 end
# File lib/rodauth/features/email_auth.rb 133 def account_from_email_auth_key(key) 134 @account = _account_from_email_auth_key(key) 135 end
# File lib/rodauth/features/email_base.rb 65 def account_from_key(token, status_id=nil) 66 id, key = split_token(token) 67 return unless id && key 68 69 return unless actual = yield(id) 70 71 unless timing_safe_eql?(key, convert_email_token_key(actual)) 72 if hmac_secret && allow_raw_email_token? 73 return unless timing_safe_eql?(key, actual) 74 else 75 return 76 end 77 end 78 ds = account_ds(id) 79 ds = ds.where(account_status_column=>status_id) if status_id && !skip_status_checks? 80 ds.first 81 end
# File lib/rodauth/features/base.rb 256 def account_from_login(login) 257 @account = _account_from_login(login) 258 end
# File lib/rodauth/features/jwt_refresh.rb 88 def account_from_refresh_token(token) 89 @account = _account_from_refresh_token(token) 90 end
# File lib/rodauth/features/password_expiration.rb 45 def account_from_reset_password_key(key) 46 if a = super 47 check_password_change_allowed 48 end 49 a 50 end
# File lib/rodauth/features/base.rb 354 def account_from_session 355 @account = _account_from_session 356 end
# File lib/rodauth/features/lockout.rb 222 def account_from_unlock_key(key) 223 @account = _account_from_unlock_key(key) 224 end
# File lib/rodauth/features/verify_account.rb 203 def account_from_verify_account_key(key) 204 @account = _account_from_verify_account_key(key) 205 end
# File lib/rodauth/features/verify_login_change.rb 122 def account_from_verify_login_change_key(key) 123 @account = _account_from_verify_login_change_key(key) 124 end
# File lib/rodauth/features/base.rb 246 def account_id 247 account[account_id_column] 248 end
# File lib/rodauth/features/verify_account_grace_period.rb 81 def account_in_unverified_grace_period? 82 return false unless account || (session_value && account_from_session) 83 account[account_status_column] == account_unverified_status_value && 84 verify_account_grace_period && 85 !verify_account_ds.where(Sequel.date_add(verification_requested_at_column, :seconds=>verify_account_grace_period) > Sequel::CURRENT_TIMESTAMP).empty? 86 end
# File lib/rodauth/features/base.rb 350 def account_initial_status_value 351 account_open_status_value 352 end
# File lib/rodauth/features/lockout.rb 295 def account_lockouts_ds(id=account_id) 296 db[account_lockouts_table].where(account_lockouts_id_column=>id) 297 end
# File lib/rodauth/features/lockout.rb 291 def account_login_failures_ds 292 db[account_login_failures_table].where(account_login_failures_id_column=>account_id) 293 end
If the account_password_hash_column
is set, the password hash is verified in ruby, it will not use a database function to do so, it will check the password hash using bcrypt.
# File lib/rodauth/features/base.rb 276 def account_password_hash_column 277 nil 278 end
# File lib/rodauth/features/base.rb 685 def account_session_status_filter 686 {account_status_column=>account_open_status_value} 687 end
# File lib/rodauth/features/webauthn.rb 262 def account_webauthn_ids 263 webauthn_keys_ds.select_map(webauthn_keys_webauthn_id_column) 264 end
# File lib/rodauth/features/webauthn.rb 266 def account_webauthn_usage 267 webauthn_keys_ds.select_hash(webauthn_keys_webauthn_id_column, webauthn_keys_last_use_column) 268 end
# File lib/rodauth/features/webauthn.rb 270 def account_webauthn_user_id 271 unless webauthn_id = webauthn_user_ids_ds.get(webauthn_user_ids_webauthn_id_column) 272 webauthn_id = WebAuthn.generate_user_id 273 if e = raised_uniqueness_violation do 274 webauthn_user_ids_ds.insert( 275 webauthn_user_ids_account_id_column => webauthn_account_id, 276 webauthn_user_ids_webauthn_id_column => webauthn_id 277 ) 278 end 279 # If two requests to create a webauthn user id are sent at the same time and an insert 280 # is attempted for both, one will fail with a unique constraint violation. In that case 281 # it is safe for the second one to use the webauthn user id inserted by the other request. 282 # If there is still no webauthn user id at this point, then we'll just reraise the 283 # exception. 284 # :nocov: 285 raise e unless webauthn_id = webauthn_user_ids_ds.get(webauthn_user_ids_webauthn_id_column) 286 # :nocov: 287 end 288 end 289 290 webauthn_id 291 end
# File lib/rodauth/features/remember.rb 222 def active_remember_key_ds(id=account_id) 223 remember_key_ds(id).where(Sequel.expr(remember_deadline_column) > Sequel::CURRENT_TIMESTAMP) 224 end
# File lib/rodauth/features/active_sessions.rb 173 def active_sessions_ds 174 db[active_sessions_table]. 175 where(active_sessions_account_id_column=>session_value) 176 end
# File lib/rodauth/features/active_sessions.rb 142 def active_sessions_insert_hash 143 {active_sessions_account_id_column => session_value, active_sessions_session_id_column => compute_hmac(active_sessions_key)} 144 end
# File lib/rodauth/features/active_sessions.rb 146 def active_sessions_update_hash 147 {active_sessions_last_use_column => Sequel::CURRENT_TIMESTAMP} 148 end
# File lib/rodauth/features/active_sessions.rb 65 def add_active_session 66 key = generate_active_sessions_key 67 set_session_value(session_id_session_key, key) 68 if e = raises_uniqueness_violation?{active_sessions_ds.insert(active_sessions_insert_hash)} 69 handle_duplicate_active_session_id(e) 70 end 71 nil 72 end
# File lib/rodauth/features/audit_logging.rb 39 def add_audit_log(account_id, action) 40 if hash = audit_log_insert_hash(account_id, action) 41 audit_log_ds.insert(hash) 42 end 43 end
# File lib/rodauth/features/base.rb 176 def add_field_error_class(field) 177 if field_error(field) 178 " #{input_field_error_class}" 179 end 180 end
# File lib/rodauth/features/disallow_password_reuse.rb 25 def add_previous_password_hash(hash) 26 ds = previous_password_ds 27 28 unless @dont_check_previous_password 29 keep_before = ds.reverse(previous_password_id_column). 30 limit(nil, previous_passwords_to_check). 31 get(previous_password_id_column) 32 33 if keep_before 34 ds.where(Sequel.expr(previous_password_id_column) <= keep_before). 35 delete 36 end 37 end 38 39 # This should never raise uniqueness violations, as it uses a serial primary key 40 ds.insert(previous_password_account_id_column=>account_id, previous_password_hash_column=>hash) 41 end
# File lib/rodauth/features/recovery_codes.rb 187 def add_recovery_code 188 # This should never raise uniqueness violations unless the recovery code is the same, and the odds of that 189 # are 1/256**32 assuming a good random number generator. Still, attempt to handle that case by retrying 190 # on such a uniqueness violation. 191 retry_on_uniqueness_violation do 192 recovery_codes_ds.insert(recovery_codes_id_column=>session_value, recovery_codes_column=>new_recovery_code) 193 end 194 end
# File lib/rodauth/features/recovery_codes.rb 177 def add_recovery_codes(number) 178 return if number <= 0 179 transaction do 180 number.times do 181 add_recovery_code 182 end 183 end 184 remove_instance_variable(:@recovery_codes) 185 end
# File lib/rodauth/features/remember.rb 173 def add_remember_key 174 hash = {remember_id_column=>account_id, remember_key_column=>remember_key_value} 175 set_deadline_value(hash, remember_deadline_column, remember_deadline_interval) 176 177 if e = raised_uniqueness_violation{remember_key_ds.insert(hash)} 178 # If inserting into the remember key table causes a violation, we can pull the 179 # existing row from the table. If there is no invalid row, we can then reraise. 180 raise e unless @remember_key_value = active_remember_key_ds.get(remember_key_column) 181 end 182 end
# File lib/rodauth/features/recovery_codes.rb 151 def add_webauthn_credential(_) 152 super if defined?(super) 153 auto_add_missing_recovery_codes 154 end
# File lib/rodauth/features/change_password_notify.rb 11 def after_change_password 12 super 13 send_password_changed_email 14 end
# File lib/rodauth/features/account_expiration.rb 99 def after_close_account 100 super if defined?(super) 101 account_activity_ds(account_id).delete 102 end
# File lib/rodauth/features/disallow_password_reuse.rb 87 def after_create_account 88 if account_password_hash_column && !(respond_to?(:verify_account_set_password?) && verify_account_set_password?) 89 add_previous_password_hash(password_hash(param(password_param))) 90 end 91 super if defined?(super) 92 end
# File lib/rodauth/features/email_auth.rb 208 def after_login 209 # Remove the email auth key after any login, even if 210 # it is a password login. This is done to invalidate 211 # the email login when a user has a password and requests 212 # email authentication, but then remembers their password 213 # and doesn't need the link. At that point, the link 214 # that allows login access to the account becomes a 215 # security liability, and it is best to remove it. 216 remove_email_auth_key 217 super 218 end
# File lib/rodauth/features/email_auth.rb 151 def after_login_entered_during_multi_phase_login 152 # If forcing email auth, just send the email link. 153 _email_auth_request_and_redirect if force_email_auth? 154 155 super 156 end
# File lib/rodauth/features/lockout.rb 258 def after_login_failure 259 invalid_login_attempted 260 super 261 end
# File lib/rodauth/features/remember.rb 198 def after_logout 199 forget_login 200 super if defined?(super) 201 end
# File lib/rodauth/features/recovery_codes.rb 225 def after_otp_disable 226 super if defined?(super) 227 auto_remove_recovery_codes 228 end
# File lib/rodauth/features/active_sessions.rb 110 def after_refresh_token 111 super if defined?(super) 112 if prev_key = session[session_id_session_key] 113 key = generate_active_sessions_key 114 set_session_value(session_id_session_key, key) 115 active_sessions_ds. 116 where(active_sessions_session_id_column => compute_hmac(prev_key)). 117 update(active_sessions_session_id_column => compute_hmac(key)) 118 end 119 end
# File lib/rodauth/features/password_grace_period.rb 39 def after_reset_password 40 super if defined?(super) 41 @last_password_entry = Time.now.to_i 42 end
# File lib/rodauth/features/recovery_codes.rb 230 def after_sms_disable 231 super if defined?(super) 232 auto_remove_recovery_codes 233 end
# File lib/rodauth/features/recovery_codes.rb 235 def after_webauthn_remove 236 super if defined?(super) 237 auto_remove_recovery_codes 238 end
# File lib/rodauth/features/email_auth.rb 204 def allow_email_auth? 205 defined?(super) ? super : true 206 end
# File lib/rodauth/features/verify_account.rb 170 def allow_resending_verify_account_email? 171 account[account_status_column] == account_unverified_status_value 172 end
# File lib/rodauth/features/base.rb 284 def already_logged_in 285 nil 286 end
:nocov:
# File lib/rodauth/features/argon2.rb 73 def argon2_hash_algorithm?(hash) 74 hash.start_with?('$argon2id$') 75 end
# File lib/rodauth/features/argon2.rb 62 def argon2_hash_cost 63 {t_cost: 1, m_cost: 3} 64 end
# File lib/rodauth/features/argon2.rb 77 def argon2_password_hash_match?(hash, password) 78 ::Argon2::Password.verify_password(password, hash) 79 end
# File lib/rodauth/features/argon2.rb 20 def argon2_salt_option 21 :salt_do_not_supply 22 end
# File lib/rodauth/features/audit_logging.rb 83 def audit_log_ds 84 ds = db[audit_logging_table] 85 # :nocov: 86 if db.database_type == :postgres 87 # :nocov: 88 # For PostgreSQL, use RETURNING NULL. This allows the feature 89 # to be used with INSERT but not SELECT permissions on the 90 # table, useful for audit logging where the database user 91 # the application is running as should not need to read the 92 # logs. 93 ds = ds.returning(nil) 94 end 95 ds 96 end
# File lib/rodauth/features/audit_logging.rb 45 def audit_log_insert_hash(account_id, action) 46 if message = audit_log_message(action) 47 { 48 audit_logging_account_id_column => account_id, 49 audit_logging_message_column => message, 50 audit_logging_metadata_column => serialize_audit_log_metadata(audit_log_metadata(action)) 51 } 52 end 53 end
# File lib/rodauth/features/audit_logging.rb 63 def audit_log_message(action) 64 meth = :"audit_log_message_for_#{action}" 65 if respond_to?(meth, true) 66 send(meth) 67 else 68 audit_log_message_default(action) 69 end 70 end
# File lib/rodauth/features/audit_logging.rb 59 def audit_log_message_default(action) 60 action.to_s 61 end
# File lib/rodauth/features/audit_logging.rb 72 def audit_log_metadata(action) 73 meth = :"audit_log_metadata_for_#{action}" 74 if respond_to?(meth, true) 75 send(meth) 76 else 77 audit_log_metadata_default 78 end 79 end
# File lib/rodauth/features/base.rb 127 def auth_class_eval(&block) 128 auth.class_eval(&block) 129 end
# File lib/rodauth/features/base.rb 337 def authenticated? 338 logged_in? 339 end
# File lib/rodauth/features/base.rb 428 def authenticated_by 429 session[authenticated_by_session_key] 430 end
# File lib/rodauth/features/webauthn.rb 242 def authenticated_webauthn_id 243 session[authenticated_webauthn_id_session_key] 244 end
# File lib/rodauth/features/recovery_codes.rb 248 def auto_add_missing_recovery_codes 249 if auto_add_recovery_codes? 250 add_recovery_codes(recovery_codes_limit - recovery_codes.length) 251 end 252 end
# File lib/rodauth/features/recovery_codes.rb 254 def auto_remove_recovery_codes 255 if auto_remove_recovery_codes? && (%w'totp webauthn sms_code' & possible_authentication_methods).empty? 256 recovery_codes_remove 257 end 258 end
# File lib/rodauth/features/base.rb 206 def autocomplete_for_field?(_param) 207 mark_input_fields_with_autocomplete? 208 end
# File lib/rodauth/features/base.rb 441 def autologin_session(autologin_type) 442 login_session('autologin') 443 set_session_value(autologin_type_session_key, autologin_type) 444 end
# File lib/rodauth/features/base.rb 437 def autologin_type 438 session[autologin_type_session_key] 439 end
# File lib/rodauth/features/otp.rb 392 def base32_encode(data, length) 393 chars = 'abcdefghijklmnopqrstuvwxyz234567' 394 length.times.map{|i|chars[data[i].ord % 32]}.join 395 end
# File lib/rodauth/features/base.rb 472 def base_url 473 url = String.new("#{request.scheme}://#{domain}") 474 url << ":#{request.port}" if request.port != Rack::Request::DEFAULT_PORTS[request.scheme] 475 url 476 end
# File lib/rodauth/features/verify_account_grace_period.rb 54 def before_change_login_route 55 unless verified_account? 56 set_redirect_error_flash unverified_change_login_error_flash 57 redirect unverified_change_login_redirect 58 end 59 super if defined?(super) 60 end
# File lib/rodauth/features/password_expiration.rb 90 def before_change_password_route 91 check_password_change_allowed 92 super 93 end
# File lib/rodauth/features/disallow_password_reuse.rb 77 def before_create_account_route 78 super if defined?(super) 79 @dont_check_previous_password = true 80 end
# File lib/rodauth/features/lockout.rb 246 def before_login_attempt 247 if locked_out? 248 show_lockout_page 249 end 250 super 251 end
# File lib/rodauth/features/active_sessions.rb 126 def before_logout 127 if param_or_nil(global_logout_param) 128 remove_remember_key(session_value) if respond_to?(:remove_remember_key) 129 remove_all_active_sessions 130 else 131 remove_current_session 132 end 133 super 134 end
# File lib/rodauth/features/json.rb 134 def before_otp_setup_route 135 super if defined?(super) 136 if use_json? && otp_keys_use_hmac? && !param_or_nil(otp_setup_raw_param) 137 _otp_tmp_key(otp_new_secret) 138 json_response[otp_setup_param] = otp_user_key 139 json_response[otp_setup_raw_param] = otp_key 140 end 141 end
# File lib/rodauth/features/account_expiration.rb 79 def before_reset_password 80 check_account_expiration 81 super if defined?(super) 82 end
# File lib/rodauth/features/account_expiration.rb 84 def before_reset_password_request 85 check_account_expiration 86 super if defined?(super) 87 end
# File lib/rodauth/features/json.rb 143 def before_rodauth 144 if json_request? 145 if json_check_accept? && (accept = request.env['HTTP_ACCEPT']) && accept !~ json_accept_regexp 146 response.status = 406 147 json_response[json_response_error_key] = json_not_accepted_error_message 148 _return_json_response 149 end 150 151 unless request.post? 152 response.status = 405 153 response.headers['Allow'] = 'POST' 154 json_response[json_response_error_key] = json_non_post_error_message 155 return_json_response 156 end 157 elsif only_json? 158 response.status = json_response_error_status 159 return_response non_json_request_error_message 160 end 161 162 super 163 end
# File lib/rodauth/features/json.rb 80 def before_two_factor_auth_route 81 super if defined?(super) 82 if use_json? 83 json_response[:auth_links] = two_factor_auth_links.sort.map{|_,link| link} 84 json_response[json_response_success_key] ||= "" if include_success_messages? 85 return_json_response 86 end 87 end
# File lib/rodauth/features/json.rb 70 def before_two_factor_manage_route 71 super if defined?(super) 72 if use_json? 73 json_response[:setup_links] = two_factor_setup_links.sort.map{|_,link| link} 74 json_response[:remove_links] = two_factor_remove_links.sort.map{|_,link| link} 75 json_response[json_response_success_key] ||= "" if include_success_messages? 76 return_json_response 77 end 78 end
# File lib/rodauth/features/account_expiration.rb 89 def before_unlock_account 90 check_account_expiration 91 super if defined?(super) 92 end
# File lib/rodauth/features/account_expiration.rb 94 def before_unlock_account_request 95 check_account_expiration 96 super if defined?(super) 97 end
# File lib/rodauth/features/webauthn_verify_account.rb 30 def before_verify_account 31 super 32 if features.include?(:json) && use_json? && !param_or_nil(webauthn_setup_param) 33 cred = new_webauthn_credential 34 json_response[webauthn_setup_param] = cred.as_json 35 json_response[webauthn_setup_challenge_param] = cred.challenge 36 json_response[webauthn_setup_challenge_hmac_param] = compute_hmac(cred.challenge) 37 end 38 @webauthn_credential = webauthn_setup_credential_from_form_submission 39 add_webauthn_credential(@webauthn_credential) 40 end
# File lib/rodauth/features/disallow_password_reuse.rb 82 def before_verify_account_route 83 super if defined?(super) 84 @dont_check_previous_password = true 85 end
# File lib/rodauth/features/json.rb 89 def before_view_recovery_codes 90 super if defined?(super) 91 if use_json? 92 json_response[:codes] = recovery_codes 93 json_response[json_response_success_key] ||= "" if include_success_messages? 94 end 95 end
# File lib/rodauth/features/json.rb 107 def before_webauthn_auth_route 108 super if defined?(super) 109 if use_json? && !param_or_nil(webauthn_auth_param) 110 cred = webauth_credential_options_for_get 111 json_response[webauthn_auth_param] = cred.as_json 112 json_response[webauthn_auth_challenge_param] = cred.challenge 113 json_response[webauthn_auth_challenge_hmac_param] = compute_hmac(cred.challenge) 114 end 115 end
# File lib/rodauth/features/json.rb 117 def before_webauthn_login_route 118 super if defined?(super) 119 if use_json? && !param_or_nil(webauthn_auth_param) && account_from_login(param(login_param)) 120 cred = webauth_credential_options_for_get 121 json_response[webauthn_auth_param] = cred.as_json 122 json_response[webauthn_auth_challenge_param] = cred.challenge 123 json_response[webauthn_auth_challenge_hmac_param] = compute_hmac(cred.challenge) 124 end 125 end
# File lib/rodauth/features/json.rb 127 def before_webauthn_remove_route 128 super if defined?(super) 129 if use_json? && !param_or_nil(webauthn_remove_param) 130 json_response[webauthn_remove_param] = account_webauthn_usage 131 end 132 end
# File lib/rodauth/features/json.rb 97 def before_webauthn_setup_route 98 super if defined?(super) 99 if use_json? && !param_or_nil(webauthn_setup_param) 100 cred = new_webauthn_credential 101 json_response[webauthn_setup_param] = cred.as_json 102 json_response[webauthn_setup_challenge_param] = cred.challenge 103 json_response[webauthn_setup_challenge_hmac_param] = compute_hmac(cred.challenge) 104 end 105 end
# File lib/rodauth/features/base.rb 383 def button(value, opts={}) 384 scope.render(button_opts(value, opts)) 385 end
# File lib/rodauth/features/base.rb 374 def button_opts(value, opts) 375 opts = Hash[template_opts].merge!(opts) 376 opts[:locals] = {:value=>value, :opts=>opts} 377 opts[:path] = template_path('button') 378 opts[:cache] = cache_templates 379 opts[:cache_key] = :rodauth_button 380 opts 381 end
# File lib/rodauth/features/recovery_codes.rb 173 def can_add_recovery_codes? 174 recovery_codes.length < recovery_codes_limit 175 end
# File lib/rodauth/features/base.rb 560 def catch_error(&block) 561 catch(:rodauth_error, &block) 562 end
# File lib/rodauth/features/change_login.rb 68 def change_login(login) 69 if account_ds.get(login_column).downcase == login.downcase 70 set_login_requirement_error_message(:same_as_current_login, same_as_current_login_message) 71 return false 72 end 73 74 update_login(login) 75 end
# File lib/rodauth/features/verify_login_change.rb 138 def change_login_notice_flash 139 change_login_needs_verification_notice_flash 140 end
# File lib/rodauth/features/change_login.rb 64 def change_login_requires_password? 65 modifications_require_password? 66 end
# File lib/rodauth/features/change_password.rb 68 def change_password_requires_password? 69 modifications_require_password? 70 end
# File lib/rodauth/features/account_expiration.rb 63 def check_account_expiration 64 if account_expired? 65 set_expired unless account_expired_at 66 set_redirect_error_flash account_expiration_error_flash 67 redirect account_expiration_redirect 68 end 69 update_last_login 70 end
# File lib/rodauth/features/active_sessions.rb 51 def check_active_session 52 if logged_in? && !currently_active_session? 53 no_longer_active_session 54 end 55 end
# File lib/rodauth/features/base.rb 280 def check_already_logged_in 281 already_logged_in if logged_in? 282 end
# File lib/rodauth/features/base.rb 358 def check_csrf 359 scope.check_csrf!(check_csrf_opts, &check_csrf_block) 360 end
# File lib/rodauth/features/base.rb 618 def check_csrf? 619 scope.opts[:rodauth_route_csrf] 620 end
# File lib/rodauth/features/password_expiration.rb 30 def check_password_change_allowed 31 if password_changed_at = get_password_changed_at 32 if password_changed_at > Time.now - allow_password_change_after 33 set_redirect_error_flash password_not_changeable_yet_error_flash 34 redirect password_not_changeable_yet_redirect 35 end 36 end 37 end
# File lib/rodauth/features/session_expiration.rb 15 def check_session_expiration 16 return unless logged_in? 17 18 unless session.has_key?(session_last_activity_session_key) && session.has_key?(session_created_session_key) 19 if session_expiration_default 20 expire_session 21 end 22 23 return 24 end 25 26 time = Time.now.to_i 27 28 if session[session_last_activity_session_key] + session_inactivity_timeout < time 29 expire_session 30 end 31 set_session_value(session_last_activity_session_key, time) 32 33 if session[session_created_session_key] + max_session_lifetime < time 34 expire_session 35 end 36 end
# File lib/rodauth/features/single_session.rb 51 def check_single_session 52 if logged_in? && !currently_active_session? 53 no_longer_active_session 54 end 55 end
# File lib/rodauth/features/otp.rb 358 def clear_cached_otp 359 remove_instance_variable(:@otp) if defined?(@otp) 360 end
# File lib/rodauth/features/lockout.rb 167 def clear_invalid_login_attempts 168 unlock_account 169 end
# File lib/rodauth/features/base.rb 296 def clear_session 297 if scope.respond_to?(:clear_session) 298 scope.clear_session 299 else 300 session.clear 301 end 302 end
# File lib/rodauth/features/close_account.rb 66 def close_account 67 unless skip_status_checks? 68 update_account(account_status_column=>account_closed_status_value) 69 end 70 71 unless account_password_hash_column 72 password_hash_ds.delete 73 end 74 end
# File lib/rodauth/features/close_account.rb 62 def close_account_requires_password? 63 modifications_require_password? 64 end
Return urlsafe base64 HMAC for data, assumes hmac_secret is set.
# File lib/rodauth/features/base.rb 240 def compute_hmac(data) 241 s = [compute_raw_hmac(data)].pack('m').chomp!("=\n") 242 s.tr!('+/', '-_') 243 s 244 end
# File lib/rodauth/features/base.rb 669 def compute_raw_hmac(data) 670 OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, hmac_secret, data) 671 end
# File lib/rodauth/features/confirm_password.rb 63 def confirm_password 64 authenticated_by.delete('autologin') 65 authenticated_by.delete('remember') 66 authenticated_by.delete('email_auth') 67 authenticated_by.delete('password') 68 authenticated_by.unshift("password") 69 remove_session_value(autologin_type_session_key) 70 nil 71 end
# File lib/rodauth/features/confirm_password.rb 73 def confirm_password_redirect 74 remove_session_value(confirm_password_redirect_session_key) || default_redirect 75 end
# File lib/rodauth/features/email_base.rb 61 def convert_email_token_key(key) 62 convert_token_key(key) 63 end
# File lib/rodauth/features/base.rb 543 def convert_session_key(key) 544 key = "#{session_key_prefix}#{key}".to_sym if session_key_prefix 545 scope.opts[:sessions_convert_symbols] ? key.to_s : key 546 end
This is needed for jdbc/sqlite, which returns timestamp columns as strings
# File lib/rodauth/features/base.rb 705 def convert_timestamp(timestamp) 706 timestamp = db.to_application_timestamp(timestamp) if timestamp.is_a?(String) 707 timestamp 708 end
# File lib/rodauth/features/base.rb 504 def convert_token_key(key) 505 if key && hmac_secret 506 compute_hmac(key) 507 else 508 key 509 end 510 end
# File lib/rodauth/features/verify_account.rb 223 def create_account_autologin? 224 false 225 end
# File lib/rodauth/features/verify_account.rb 190 def create_account_notice_flash 191 verify_account_email_sent_notice_flash 192 end
# File lib/rodauth/features/verify_account.rb 227 def create_account_set_password? 228 return false if verify_account_set_password? 229 super 230 end
# File lib/rodauth/features/email_base.rb 32 def create_email(subject, body) 33 create_email_to(email_to, subject, body) 34 end
# File lib/rodauth/features/email_auth.rb 104 def create_email_auth_key 105 transaction do 106 if email_auth_key_value = get_email_auth_key(account_id) 107 set_email_auth_email_last_sent 108 @email_auth_key_value = email_auth_key_value 109 elsif e = raised_uniqueness_violation{email_auth_ds.insert(email_auth_key_insert_hash)} 110 # If inserting into the email auth table causes a violation, we can pull the 111 # existing email auth key from the table, or reraise. 112 raise e unless @email_auth_key_value = get_email_auth_key(account_id) 113 end 114 end 115 end
# File lib/rodauth/features/email_base.rb 36 def create_email_to(to, subject, body) 37 m = Mail.new 38 m.from = email_from 39 m.to = to 40 m.subject = "#{email_subject_prefix}#{subject}" 41 m.body = body 42 m 43 end
# File lib/rodauth/features/reset_password.rb 166 def create_reset_password_key 167 transaction do 168 if reset_password_key_value = get_password_reset_key(account_id) 169 set_reset_password_email_last_sent 170 @reset_password_key_value = reset_password_key_value 171 elsif e = raised_uniqueness_violation{password_reset_ds.insert(reset_password_key_insert_hash)} 172 # If inserting into the reset password table causes a violation, we can pull the 173 # existing reset password key from the table, or reraise. 174 raise e unless @reset_password_key_value = get_password_reset_key(account_id) 175 end 176 end 177 end
# File lib/rodauth/features/verify_account.rb 288 def create_verify_account_key 289 ds = verify_account_ds 290 transaction do 291 if ds.empty? 292 if e = raised_uniqueness_violation{ds.insert(verify_account_key_insert_hash)} 293 # If inserting into the verify account table causes a violation, we can pull the 294 # key from the verify account table, or reraise. 295 raise e unless @verify_account_key_value = get_verify_account_key(account_id) 296 end 297 end 298 end 299 end
# File lib/rodauth/features/verify_login_change.rb 200 def create_verify_login_change_email(login) 201 create_email_to(login, verify_login_change_email_subject, verify_login_change_email_body) 202 end
# File lib/rodauth/features/verify_login_change.rb 178 def create_verify_login_change_key(login) 179 ds = verify_login_change_ds 180 transaction do 181 ds.where((Sequel::CURRENT_TIMESTAMP > verify_login_change_deadline_column) | ~Sequel.expr(verify_login_change_login_column=>login)).delete 182 if e = raised_uniqueness_violation{ds.insert(verify_login_change_key_insert_hash(login))} 183 old_login, key = get_verify_login_change_login_and_key(account_id) 184 # If inserting into the verify login change table causes a violation, we can pull the 185 # key from the verify login change table if the logins match, or reraise. 186 @verify_login_change_key_value = if old_login.downcase == login.downcase 187 key 188 end 189 raise e unless @verify_login_change_key_value 190 end 191 end 192 end
# File lib/rodauth/features/base.rb 362 def csrf_tag(path=request.path) 363 return unless scope.respond_to?(:csrf_tag) 364 365 if use_request_specific_csrf_tokens? 366 scope.csrf_tag(path) 367 else 368 # :nocov: 369 scope.csrf_tag 370 # :nocov: 371 end 372 end
# File lib/rodauth/features/active_sessions.rb 37 def currently_active_session? 38 return false unless session_id = session[session_id_session_key] 39 40 remove_inactive_sessions 41 ds = active_sessions_ds. 42 where(active_sessions_session_id_column => compute_hmac(session_id)) 43 44 if update_current_session? 45 ds.update(active_sessions_update_hash) == 1 46 else 47 ds.count == 1 48 end 49 end
# File lib/rodauth/features/base.rb 496 def database_function_password_match?(name, hash_id, password, salt) 497 db.get(Sequel.function(function_name(name), hash_id, password_hash_using_salt(password, salt))) 498 end
# File lib/rodauth/features/base.rb 264 def db 265 Sequel::DATABASES.first 266 end
# File lib/rodauth/features/close_account.rb 76 def delete_account 77 account_ds.delete 78 end
# File lib/rodauth/features/close_account.rb 80 def delete_account_on_close? 81 skip_status_checks? 82 end
# File lib/rodauth/features/remember.rb 169 def disable_remember_login 170 remove_remember_key 171 end
# File lib/rodauth/features/email_auth.rb 239 def email_auth_ds(id=account_id) 240 db[email_auth_table].where(email_auth_id_column=>id) 241 end
# File lib/rodauth/features/email_auth.rb 137 def email_auth_email_link 138 token_link(email_auth_route, email_auth_key_param, email_auth_key_value) 139 end
# File lib/rodauth/features/email_auth.rb 176 def email_auth_email_recently_sent? 177 (email_last_sent = get_email_auth_email_last_sent) && (Time.now - email_last_sent < email_auth_skip_resend_email_within) 178 end
# File lib/rodauth/features/email_auth.rb 233 def email_auth_key_insert_hash 234 hash = {email_auth_id_column=>account_id, email_auth_key_column=>email_auth_key_value} 235 set_deadline_value(hash, email_auth_deadline_column, email_auth_deadline_interval) 236 hash 237 end
# File lib/rodauth/features/email_auth.rb 147 def email_auth_request_form 148 render('email-auth-request-form') 149 end
# File lib/rodauth/features/email_base.rb 45 def email_from 46 "webmaster@#{domain}" 47 end
# File lib/rodauth/features/email_base.rb 49 def email_to 50 account[login_column] 51 end
# File lib/rodauth/features/session_expiration.rb 38 def expire_session 39 clear_session 40 set_redirect_error_status session_expiration_error_status 41 set_error_reason :session_expired 42 set_redirect_error_flash session_expiration_error_flash 43 redirect session_expiration_redirect 44 end
# File lib/rodauth/features/argon2.rb 54 def extract_password_hash_cost(hash) 55 return super unless argon2_hash_algorithm?(hash ) 56 57 /\A\$argon2id\$v=\d+\$m=(\d+),t=(\d+)/ =~ hash 58 { t_cost: $2.to_i, m_cost: Math.log2($1.to_i).to_i } 59 end
# File lib/rodauth/features/base.rb 139 def features 140 self.class.features 141 end
# File lib/rodauth/features/base.rb 214 def field_attributes(field) 215 _field_attributes(field) || default_field_attributes 216 end
# File lib/rodauth/features/base.rb 171 def field_error(field) 172 return nil unless @field_errors 173 @field_errors[field] 174 end
# File lib/rodauth/features/base.rb 218 def field_error_attributes(field) 219 if field_error(field) 220 _field_error_attributes(field) 221 end 222 end
# File lib/rodauth/features/remember.rb 152 def forget_login 153 opts = Hash[remember_cookie_options] 154 opts[:path] = "/" unless opts.key?(:path) 155 ::Rack::Utils.delete_cookie_header!(response.headers, remember_cookie_key, opts) 156 end
# File lib/rodauth/features/base.rb 224 def formatted_field_error(field) 225 if error = field_error(field) 226 _formatted_field_error(field, error) 227 end 228 end
# File lib/rodauth/features/base.rb 622 def function_name(name) 623 if db.database_type == :mssql 624 # :nocov: 625 "dbo.#{name}" 626 # :nocov: 627 else 628 name 629 end 630 end
# File lib/rodauth/features/active_sessions.rb 138 def generate_active_sessions_key 139 @active_sessions_key = random_key 140 end
# File lib/rodauth/features/email_auth.rb 225 def generate_email_auth_key_value 226 @email_auth_key_value = random_key 227 end
# File lib/rodauth/features/jwt_refresh.rb 181 def generate_refresh_token 182 hash = jwt_refresh_token_insert_hash 183 [account_id, jwt_refresh_token_ds.insert(hash), convert_token_key(hash[jwt_refresh_token_key_column])].join(token_separator) 184 end
# File lib/rodauth/features/remember.rb 210 def generate_remember_key_value 211 @remember_key_value = random_key 212 end
# File lib/rodauth/features/reset_password.rb 233 def generate_reset_password_key_value 234 @reset_password_key_value = random_key 235 end
# File lib/rodauth/features/lockout.rb 268 def generate_unlock_account_key 269 random_key 270 end
# File lib/rodauth/features/verify_account.rb 284 def generate_verify_account_key_value 285 @verify_account_key_value = random_key 286 end
# File lib/rodauth/features/verify_login_change.rb 174 def generate_verify_login_change_key_value 175 @verify_login_change_key_value = random_key 176 end
# File lib/rodauth/features/jwt_refresh.rb 154 def get_active_refresh_token(account_id, token_id) 155 jwt_refresh_token_account_ds(account_id). 156 where(Sequel::CURRENT_TIMESTAMP > jwt_refresh_token_deadline_column). 157 delete 158 159 jwt_refresh_token_account_token_ds(account_id, token_id). 160 get(jwt_refresh_token_key_column) 161 end
# File lib/rodauth/features/account_expiration.rb 109 def get_activity_timestamp(account_id, column) 110 convert_timestamp(account_activity_ds(account_id).get(column)) 111 end
# File lib/rodauth/features/email_auth.rb 121 def get_email_auth_email_last_sent 122 if column = email_auth_email_last_sent_column 123 if ts = email_auth_ds.get(column) 124 convert_timestamp(ts) 125 end 126 end 127 end
# File lib/rodauth/features/email_auth.rb 141 def get_email_auth_key(id) 142 ds = email_auth_ds(id) 143 ds.where(Sequel::CURRENT_TIMESTAMP > email_auth_deadline_column).delete 144 ds.get(email_auth_key_column) 145 end
# File lib/rodauth/features/password_expiration.rb 26 def get_password_changed_at 27 convert_timestamp(password_expiration_ds.get(password_expiration_changed_at_column)) 28 end
Get the password hash for the user. When using database authentication functions, note that only the salt is returned.
# File lib/rodauth/features/base.rb 644 def get_password_hash 645 if account_password_hash_column 646 (account || account_from_session)[account_password_hash_column] 647 elsif use_database_authentication_functions? 648 db.get(Sequel.function(function_name(:rodauth_get_salt), account ? account_id : session_value)) 649 else 650 # :nocov: 651 password_hash_ds.get(password_hash_column) 652 # :nocov: 653 end 654 end
# File lib/rodauth/features/reset_password.rb 191 def get_password_reset_key(id) 192 ds = password_reset_ds(id) 193 ds.where(Sequel::CURRENT_TIMESTAMP > reset_password_deadline_column).delete 194 ds.get(reset_password_key_column) 195 end
# File lib/rodauth/features/remember.rb 158 def get_remember_key 159 unless @remember_key_value = active_remember_key_ds.get(remember_key_column) 160 generate_remember_key_value 161 transaction do 162 remove_remember_key 163 add_remember_key 164 end 165 end 166 nil 167 end
# File lib/rodauth/features/reset_password.rb 201 def get_reset_password_email_last_sent 202 if column = reset_password_email_last_sent_column 203 if ts = password_reset_ds.get(column) 204 convert_timestamp(ts) 205 end 206 end 207 end
# File lib/rodauth/features/lockout.rb 230 def get_unlock_account_email_last_sent 231 if column = account_lockouts_email_last_sent_column 232 if ts = account_lockouts_ds.get(column) 233 convert_timestamp(ts) 234 end 235 end 236 end
# File lib/rodauth/features/lockout.rb 218 def get_unlock_account_key 219 account_lockouts_ds.get(account_lockouts_key_column) 220 end
# File lib/rodauth/features/verify_account.rb 236 def get_verify_account_email_last_sent 237 if column = verify_account_email_last_sent_column 238 if ts = verify_account_ds.get(column) 239 convert_timestamp(ts) 240 end 241 end 242 end
# File lib/rodauth/features/verify_account.rb 215 def get_verify_account_key(id) 216 verify_account_ds(id).get(verify_account_key_column) 217 end
# File lib/rodauth/features/verify_login_change.rb 134 def get_verify_login_change_login_and_key(id) 135 verify_login_change_ds(id).get([verify_login_change_login_column, verify_login_change_key_column]) 136 end
# File lib/rodauth/features/active_sessions.rb 74 def handle_duplicate_active_session_id(_e) 75 # Do nothing by default as session is already tracked. This will result in 76 # the current session and the existing session with the same id 77 # being tracked together, so that a logout of one will logout 78 # the other, and updating the last use on one will update the other, 79 # but this should be acceptable. However, this can be overridden if different 80 # behavior is desired. 81 end
# File lib/rodauth/features/webauthn.rb 344 def handle_webauthn_sign_count_verification_error 345 throw_error_reason(:invalid_webauthn_sign_count, invalid_field_error_status, webauthn_auth_param, webauthn_invalid_sign_count_message) 346 end
# File lib/rodauth/features/base.rb 632 def has_password? 633 return @has_password if defined?(@has_password) 634 return false unless account || session_value 635 @has_password = !!get_password_hash 636 end
# File lib/rodauth/features/audit_logging.rb 31 def hook_action(hook_type, action) 32 super 33 # In after_logout, session is already cleared, so use before_logout in that case 34 if (hook_type == :after || action == :logout) && (id = account ? account_id : session_value) 35 add_audit_log(id, action) 36 end 37 end
# File lib/rodauth/features/http_basic_auth.rb 34 def http_basic_auth 35 return @checked_http_basic_auth if defined?(@checked_http_basic_auth) 36 37 @checked_http_basic_auth = nil 38 return unless token = ((v = request.env['HTTP_AUTHORIZATION']) && v[/\A *Basic (.*)\Z/, 1]) 39 40 username, password = token.unpack("m*").first.split(/:/, 2) 41 return unless username && password 42 43 catch_error do 44 unless account_from_login(username) 45 throw_basic_auth_error(login_param, no_matching_login_message) 46 end 47 48 before_login_attempt 49 50 unless open_account? 51 throw_basic_auth_error(login_param, no_matching_login_message) 52 end 53 54 unless password_match?(password) 55 after_login_failure 56 throw_basic_auth_error(password_param, invalid_password_message) 57 end 58 59 transaction do 60 before_login 61 login_session('password') 62 after_login 63 end 64 65 @checked_http_basic_auth = true 66 return true 67 end 68 69 nil 70 end
# File lib/rodauth/features/active_sessions.rb 162 def inactive_session_cond 163 cond = session_inactivity_deadline_condition 164 cond2 = session_lifetime_deadline_condition 165 return false unless cond || cond2 166 Sequel.|(*[cond, cond2].compact) 167 end
# File lib/rodauth/features/json.rb 180 def include_success_messages? 181 !json_response_success_key.nil? 182 end
# File lib/rodauth/features/base.rb 182 def input_field_string(param, id, opts={}) 183 type = opts.fetch(:type, "text") 184 185 unless type == "password" 186 value = opts.fetch(:value){scope.h param(param)} 187 end 188 189 field_class = opts.fetch(:class, "form-control") 190 191 if autocomplete_for_field?(param) && opts[:autocomplete] 192 autocomplete = "autocomplete=\"#{opts[:autocomplete]}\"" 193 end 194 195 if inputmode_for_field?(param) && opts[:inputmode] 196 inputmode = "inputmode=\"#{opts[:inputmode]}\"" 197 end 198 199 if mark_input_fields_as_required? && opts[:required] != false 200 required = "required=\"required\"" 201 end 202 203 "<input #{opts[:attr]} #{autocomplete} #{inputmode} #{required} #{field_attributes(param)} #{field_error_attributes(param)} type=\"#{type}\" class=\"#{field_class}#{add_field_error_class(param)}\" name=\"#{param}\" id=\"#{id}\" value=\"#{value}\"/> #{formatted_field_error(param) unless opts[:skip_error_message]}" 204 end
# File lib/rodauth/features/base.rb 210 def inputmode_for_field?(_param) 211 mark_input_fields_with_inputmode? 212 end
# File lib/rodauth/features/base.rb 764 def internal_request? 765 false 766 end
# File lib/rodauth/features/internal_request.rb 329 def internal_request_configuration(&block) 330 @auth.instance_exec do 331 (@internal_request_configuration_blocks ||= []) << block 332 end 333 end
# File lib/rodauth/features/lockout.rb 177 def invalid_login_attempted 178 ds = account_login_failures_ds. 179 where(account_login_failures_id_column=>account_id) 180 181 number = if db.database_type == :postgres 182 ds.returning(account_login_failures_number_column). 183 with_sql(:update_sql, account_login_failures_number_column=>Sequel.expr(account_login_failures_number_column)+1). 184 single_value 185 else 186 # :nocov: 187 if ds.update(account_login_failures_number_column=>Sequel.expr(account_login_failures_number_column)+1) > 0 188 ds.get(account_login_failures_number_column) 189 end 190 # :nocov: 191 end 192 193 unless number 194 # Ignoring the violation is safe here. It may allow slightly more than max_invalid_logins invalid logins before 195 # lockout, but allowing a few extra is OK if the race is lost. 196 ignore_uniqueness_violation{account_login_failures_ds.insert(account_login_failures_id_column=>account_id)} 197 number = 1 198 end 199 200 if number >= max_invalid_logins 201 @unlock_account_key_value = generate_unlock_account_key 202 hash = _setup_account_lockouts_hash(account_id, unlock_account_key_value) 203 204 if e = raised_uniqueness_violation{account_lockouts_ds.insert(hash)} 205 # If inserting into the lockout table raises a violation, we should just be able to pull the already inserted 206 # key out of it. If that doesn't return a valid key, we should reraise the error. 207 raise e unless @unlock_account_key_value = account_lockouts_ds.get(account_lockouts_key_column) 208 209 after_account_lockout 210 show_lockout_page 211 else 212 after_account_lockout 213 e 214 end 215 end 216 end
# File lib/rodauth/features/change_password.rb 72 def invalid_previous_password_message 73 invalid_password_message 74 end
# File lib/rodauth/features/json.rb 54 def json_request? 55 return @json_request if defined?(@json_request) 56 @json_request = request.content_type =~ json_request_content_type_regexp 57 end
# File lib/rodauth/features/json.rb 188 def json_response 189 @json_response ||= {} 190 end
# File lib/rodauth/features/jwt_cors.rb 15 def jwt_cors_allow? 16 return false unless origin = request.env['HTTP_ORIGIN'] 17 18 case allowed = jwt_cors_allow_origin 19 when String 20 timing_safe_eql?(origin, allowed) 21 when Array 22 allowed.any?{|s| timing_safe_eql?(origin, s)} 23 when Regexp 24 allowed =~ origin 25 when true 26 true 27 else 28 false 29 end 30 end
# File lib/rodauth/features/jwt.rb 114 def jwt_payload 115 return @jwt_payload if defined?(@jwt_payload) 116 @jwt_payload = JWT.decode(jwt_token, jwt_secret, true, _jwt_decode_opts.merge(:algorithm=>jwt_algorithm))[0] 117 rescue JWT::DecodeError => e 118 rescue_jwt_payload(e) 119 end
# File lib/rodauth/features/jwt_refresh.rb 163 def jwt_refresh_token_account_ds(account_id) 164 jwt_refresh_token_ds.where(jwt_refresh_token_account_id_column => account_id) 165 end
# File lib/rodauth/features/jwt_refresh.rb 167 def jwt_refresh_token_account_token_ds(account_id, token_id) 168 jwt_refresh_token_account_ds(account_id). 169 where(jwt_refresh_token_id_column=>token_id) 170 end
# File lib/rodauth/features/jwt_refresh.rb 172 def jwt_refresh_token_ds 173 db[jwt_refresh_token_table] 174 end
# File lib/rodauth/features/jwt_refresh.rb 186 def jwt_refresh_token_insert_hash 187 hash = {jwt_refresh_token_account_id_column => account_id, jwt_refresh_token_key_column => random_key} 188 set_deadline_value(hash, jwt_refresh_token_deadline_column, jwt_refresh_token_deadline_interval) 189 hash 190 end
# File lib/rodauth/features/jwt_refresh.rb 145 def jwt_refresh_token_match?(key) 146 # We don't need to match tokens if we are requiring a valid current access token 147 return true unless allow_refresh_with_expired_jwt_access_token? 148 149 # If allowing with expired jwt access token, check the expired session contains 150 # hmac matching submitted and active refresh token. 151 timing_safe_eql?(compute_hmac(session[jwt_refresh_token_data_session_key].to_s + key), session[jwt_refresh_token_hmac_session_key].to_s) 152 end
# File lib/rodauth/features/jwt.rb 67 def jwt_secret 68 raise ArgumentError, "jwt_secret not set" 69 end
# File lib/rodauth/features/jwt.rb 71 def jwt_session_hash 72 jwt_session_key ? {jwt_session_key=>session} : session 73 end
# File lib/rodauth/features/jwt.rb 79 def jwt_token 80 return @jwt_token if defined?(@jwt_token) 81 82 if (v = request.env['HTTP_AUTHORIZATION']) && v !~ jwt_authorization_ignore 83 @jwt_token = v.sub(jwt_authorization_remove, '') 84 end 85 end
# File lib/rodauth/features/account_expiration.rb 27 def last_account_activity_at 28 get_activity_timestamp(session_value, account_activity_last_activity_column) 29 end
# File lib/rodauth/features/account_expiration.rb 31 def last_account_login_at 32 get_activity_timestamp(session_value, account_activity_last_login_column) 33 end
# File lib/rodauth/features/remember.rb 112 def load_memory 113 return if session[session_key] 114 115 unless id = remembered_session_id 116 # Only set expired cookie if there is already a cookie set. 117 forget_login if _get_remember_cookie 118 return 119 end 120 121 set_session_value(session_key, id) 122 account = account_from_session 123 remove_session_value(session_key) 124 125 unless account 126 remove_remember_key(id) 127 forget_login 128 return 129 end 130 131 before_load_memory 132 login_session('remember') 133 134 if extend_remember_deadline? 135 active_remember_key_ds(id).update(remember_deadline_column=>Sequel.date_add(Sequel::CURRENT_TIMESTAMP, remember_period)) 136 remember_login 137 end 138 after_load_memory 139 end
# File lib/rodauth/features/base.rb 710 def loaded_templates 711 [] 712 end
# File lib/rodauth/features/lockout.rb 148 def locked_out? 149 if t = convert_timestamp(account_lockouts_ds.get(account_lockouts_deadline_column)) 150 if Time.now < t 151 true 152 else 153 unlock_account 154 false 155 end 156 else 157 false 158 end 159 end
# File lib/rodauth/features/remember.rb 188 def logged_in_via_remember_key? 189 authenticated_by.include?('remember') 190 end
# File lib/rodauth/features/login.rb 80 def login(auth_type) 81 saved_login_redirect = remove_session_value(login_redirect_session_key) 82 transaction do 83 before_login 84 login_session(auth_type) 85 yield if block_given? 86 after_login 87 end 88 set_notice_flash login_notice_flash 89 redirect(saved_login_redirect || login_redirect) 90 end
# File lib/rodauth/features/login_password_requirements_base.rb 46 def login_confirm_label 47 "Confirm #{login_label}" 48 end
# File lib/rodauth/features/login_password_requirements_base.rb 104 def login_does_not_meet_requirements_message 105 "invalid login#{", #{login_requirement_message}" if login_requirement_message}" 106 end
# File lib/rodauth/features/reset_password.rb 237 def login_failed_reset_password_request_form 238 render("reset-password-request") 239 end
# File lib/rodauth/features/base.rb 288 def login_input_type 289 login_uses_email? ? 'email' : 'text' 290 end
# File lib/rodauth/features/login_password_requirements_base.rb 140 def login_meets_email_requirements?(login) 141 return true unless require_email_address_logins? 142 return true if login_valid_email?(login) 143 set_login_requirement_error_message(:login_not_valid_email, login_not_valid_email_message) 144 return false 145 end
# File lib/rodauth/features/login_password_requirements_base.rb 125 def login_meets_length_requirements?(login) 126 if login_minimum_length > login.length 127 set_login_requirement_error_message(:login_too_short, login_too_short_message) 128 false 129 elsif login_maximum_length < login.length 130 set_login_requirement_error_message(:login_too_long, login_too_long_message) 131 false 132 elsif login_maximum_bytes < login.bytesize 133 set_login_requirement_error_message(:login_too_many_bytes, login_too_many_bytes_message) 134 false 135 else 136 true 137 end 138 end
# File lib/rodauth/features/login_password_requirements_base.rb 54 def login_meets_requirements?(login) 55 login_meets_length_requirements?(login) && \ 56 login_meets_email_requirements?(login) 57 end
# File lib/rodauth/features/base.rb 304 def login_required 305 set_redirect_error_status(login_required_error_status) 306 set_error_reason :login_required 307 set_redirect_error_flash require_login_error_flash 308 redirect require_login_redirect 309 end
# File lib/rodauth/features/login.rb 99 def login_return_to_requested_location_path 100 request.fullpath if request.get? 101 end
# File lib/rodauth/features/base.rb 432 def login_session(auth_type) 433 update_session 434 set_session_value(authenticated_by_session_key, [auth_type]) 435 end
# File lib/rodauth/features/login_password_requirements_base.rb 108 def login_too_long_message 109 "maximum #{login_maximum_length} characters" 110 end
# File lib/rodauth/features/login_password_requirements_base.rb 112 def login_too_many_bytes_message 113 "maximum #{login_maximum_bytes} bytes" 114 end
# File lib/rodauth/features/login_password_requirements_base.rb 116 def login_too_short_message 117 "minimum #{login_minimum_length} characters" 118 end
# File lib/rodauth/features/base.rb 292 def login_uses_email? 293 login_column == :email 294 end
# File lib/rodauth/features/login_password_requirements_base.rb 147 def login_valid_email?(login) 148 login =~ login_email_regexp 149 end
# File lib/rodauth/features/active_sessions.rb 99 def logout_additional_form_tags 100 super.to_s + render('global-logout-field') 101 end
# File lib/rodauth/features/base.rb 482 def modifications_require_password? 483 has_password? 484 end
# File lib/rodauth/features/create_account.rb 96 def new_account(login) 97 @account = _new_account(login) 98 end
# File lib/rodauth/features/recovery_codes.rb 240 def new_recovery_code 241 random_key 242 end
# File lib/rodauth/features/webauthn.rb 293 def new_webauthn_credential 294 WebAuthn::Credential.options_for_create( 295 :timeout => webauthn_setup_timeout, 296 :rp => {:name=>webauthn_rp_name, :id=>webauthn_rp_id}, 297 :user => {:id=>account_webauthn_user_id, :name=>webauthn_user_name}, 298 :authenticator_selection => webauthn_authenticator_selection, 299 :attestation => webauthn_attestation, 300 :extensions => webauthn_extensions, 301 :exclude => account_webauthn_ids, 302 ) 303 end
# File lib/rodauth/features/active_sessions.rb 57 def no_longer_active_session 58 clear_session 59 set_redirect_error_status inactive_session_error_status 60 set_error_reason :inactive_session 61 set_redirect_error_flash active_sessions_error_flash 62 redirect active_sessions_redirect 63 end
Return nil by default for values with null bytes
# File lib/rodauth/features/base.rb 464 def null_byte_parameter_value(key, value) 465 nil 466 end
# File lib/rodauth/features/base.rb 396 def only_json? 397 scope.class.opts[:rodauth_json] == :only 398 end
# File lib/rodauth/features/base.rb 260 def open_account? 261 skip_status_checks? || account[account_status_column] == account_open_status_value 262 end
# File lib/rodauth/features/otp.rb 271 def otp_add_key 272 _otp_add_key(otp_key) 273 super if defined?(super) 274 end
# File lib/rodauth/features/otp.rb 242 def otp_available? 243 otp_exists? && !otp_locked_out? 244 end
# File lib/rodauth/features/otp.rb 246 def otp_exists? 247 !otp_key.nil? 248 end
# File lib/rodauth/features/otp.rb 367 def otp_hmac_secret(key) 368 base32_encode(compute_raw_hmac(ROTP::Base32.decode(key)), key.bytesize) 369 end
# File lib/rodauth/features/otp.rb 418 def otp_key_ds 419 db[otp_keys_table].where(otp_keys_id_column=>session_value) 420 end
# File lib/rodauth/features/otp.rb 323 def otp_keys_use_hmac? 324 !!hmac_secret 325 end
# File lib/rodauth/features/otp.rb 282 def otp_last_use 283 convert_timestamp(otp_key_ds.get(otp_keys_last_use_column)) 284 end
# File lib/rodauth/features/otp.rb 294 def otp_locked_out? 295 otp_key_ds.get(otp_keys_failures_column) >= otp_auth_failures_limit 296 end
# File lib/rodauth/features/otp.rb 381 def otp_new_secret 382 ROTP::Base32.random_base32.downcase 383 end
# File lib/rodauth/features/otp.rb 306 def otp_provisioning_name 307 account[login_column] 308 end
# File lib/rodauth/features/otp.rb 298 def otp_provisioning_uri 299 otp.provisioning_uri(otp_provisioning_name) 300 end
# File lib/rodauth/features/otp.rb 310 def otp_qr_code 311 svg = RQRCode::QRCode.new(otp_provisioning_uri).as_svg(:module_size=>8, :viewbox=>true, :use_path=>true) 312 svg.sub(/\A<\?xml version="1\.0" standalone="yes"\?>/, '') 313 end
# File lib/rodauth/features/otp.rb 286 def otp_record_authentication_failure 287 otp_key_ds.update(otp_keys_failures_column=>Sequel.identifier(otp_keys_failures_column) + 1) 288 end
# File lib/rodauth/features/otp.rb 266 def otp_remove 267 otp_key_ds.delete 268 @otp_key = nil 269 end
# File lib/rodauth/features/otp.rb 290 def otp_remove_auth_failures 291 otp_key_ds.update(otp_keys_failures_column=>0) 292 end
# File lib/rodauth/features/otp.rb 362 def otp_tmp_key(secret) 363 _otp_tmp_key(secret) 364 clear_cached_otp 365 end
# File lib/rodauth/features/otp.rb 276 def otp_update_last_use 277 otp_key_ds. 278 where(Sequel.date_add(otp_keys_last_use_column, :seconds=>(otp_interval||30)) < Sequel::CURRENT_TIMESTAMP). 279 update(otp_keys_last_use_column=>Sequel::CURRENT_TIMESTAMP) == 1 280 end
# File lib/rodauth/features/otp.rb 315 def otp_user_key 316 @otp_user_key ||= if otp_keys_use_hmac? 317 otp_hmac_secret(otp_key) 318 else 319 otp_key 320 end 321 end
# File lib/rodauth/features/otp.rb 250 def otp_valid_code?(ot_pass) 251 return false unless otp_exists? 252 ot_pass = ot_pass.gsub(/\s+/, '') 253 if drift = otp_drift 254 if otp.respond_to?(:verify_with_drift) 255 # :nocov: 256 otp.verify_with_drift(ot_pass, drift) 257 # :nocov: 258 else 259 otp.verify(ot_pass, :drift_behind=>drift, :drift_ahead=>drift) 260 end 261 else 262 otp.verify(ot_pass) 263 end 264 end
# File lib/rodauth/features/otp.rb 371 def otp_valid_key?(secret) 372 return false unless secret =~ /\A([a-z2-7]{16}|[a-z2-7]{32})\z/ 373 if otp_keys_use_hmac? 374 timing_safe_eql?(otp_hmac_secret(param(otp_setup_raw_param)), secret) 375 else 376 true 377 end 378 end
Return a string for the parameter name. This will be an empty string if the parameter doesn’t exist.
# File lib/rodauth/features/base.rb 448 def param(key) 449 param_or_nil(key).to_s 450 end
Return a string for the parameter name, or nil if there is no parameter with that name.
# File lib/rodauth/features/base.rb 454 def param_or_nil(key) 455 value = raw_param(key) 456 unless value.nil? 457 value = value.to_s 458 value = null_byte_parameter_value(key, value) if value.include?("\0") 459 end 460 value 461 end
# File lib/rodauth/features/login_password_requirements_base.rb 50 def password_confirm_label 51 "Confirm #{password_label}" 52 end
# File lib/rodauth/features/login_password_requirements_base.rb 166 def password_does_not_contain_null_byte?(password) 167 return true unless password.include?("\0") 168 set_password_requirement_error_message(:password_contains_null_byte, contains_null_byte_message) 169 false 170 end
# File lib/rodauth/features/login_password_requirements_base.rb 83 def password_does_not_meet_requirements_message 84 "invalid password, does not meet requirements#{" (#{password_requirement_message})" if password_requirement_message}" 85 end
# File lib/rodauth/features/disallow_password_reuse.rb 50 def password_doesnt_match_previous_password?(password) 51 match = if use_database_authentication_functions? 52 salts = previous_password_ds. 53 select_map([previous_password_id_column, Sequel.function(function_name(:rodauth_get_previous_salt), previous_password_id_column).as(:salt)]) 54 return true if salts.empty? 55 56 salts.any? do |hash_id, salt| 57 database_function_password_match?(:rodauth_previous_password_hash_match, hash_id, password, salt) 58 end 59 else 60 # :nocov: 61 previous_password_ds.select_map(previous_password_hash_column).any? do |hash| 62 password_hash_match?(hash, password) 63 end 64 # :nocov: 65 end 66 67 return true unless match 68 set_password_requirement_error_message(:password_same_as_previous_password, password_same_as_previous_password_message) 69 false 70 end
# File lib/rodauth/features/password_expiration.rb 107 def password_expiration_ds 108 db[password_expiration_table].where(password_expiration_id_column=>account_id) 109 end
# File lib/rodauth/features/password_expiration.rb 68 def password_expired? 69 if password_changed_at = session[password_changed_at_session_key] 70 return password_changed_at + require_password_change_after < Time.now.to_i 71 end 72 73 account_from_session 74 if password_changed_at = get_password_changed_at 75 set_session_value(password_changed_at_session_key, password_changed_at.to_i) 76 password_changed_at + require_password_change_after < Time.now 77 else 78 set_session_value(password_changed_at_session_key, password_expiration_default ? 0 : 2147483647) 79 password_expiration_default 80 end 81 end
# File lib/rodauth/features/base.rb 268 def password_field_autocomplete_value 269 @password_field_autocomplete_value || 'current-password' 270 end
# File lib/rodauth/features/password_complexity.rb 54 def password_has_enough_character_groups?(password) 55 return true if password.length > password_max_length_for_groups_check 56 return true if password_character_groups.select{|re| password =~ re}.length >= password_min_groups 57 set_password_requirement_error_message(:not_enough_character_groups_in_password, password_not_enough_character_groups_message) 58 false 59 end
# File lib/rodauth/features/password_complexity.rb 61 def password_has_no_invalid_pattern?(password) 62 return true unless password_invalid_pattern 63 return true if password !~ password_invalid_pattern 64 set_password_requirement_error_message(:invalid_password_pattern, password_invalid_pattern_message) 65 false 66 end
# File lib/rodauth/features/argon2.rb 36 def password_hash(password) 37 return super unless use_argon2? 38 ::Argon2::Password.new(password_hash_cost).create(password) 39 end
# File lib/rodauth/features/argon2.rb 31 def password_hash_cost 32 return super unless use_argon2? 33 argon2_hash_cost 34 end
# File lib/rodauth/features/base.rb 700 def password_hash_ds 701 db[password_hash_table].where(password_hash_id_column=>account ? account_id : session_value) 702 end
# File lib/rodauth/features/argon2.rb 41 def password_hash_match?(hash, password) 42 return super unless argon2_hash_algorithm?(hash) 43 argon2_password_hash_match?(hash, password) 44 end
# File lib/rodauth/features/argon2.rb 46 def password_hash_using_salt(password, salt) 47 return super unless argon2_hash_algorithm?(salt) 48 49 argon2_params = Hash[extract_password_hash_cost(salt)] 50 argon2_params[argon2_salt_option] = Base64.decode64(salt.split('$').last) 51 ::Argon2::Password.new(argon2_params).create(password) 52 end
# File lib/rodauth/features/base.rb 413 def password_match?(password) 414 if hash = get_password_hash 415 if account_password_hash_column || !use_database_authentication_functions? 416 password_hash_match?(hash, password) 417 else 418 database_function_password_match?(:rodauth_valid_password_hash, account_id, password, hash) 419 end 420 end 421 end
# File lib/rodauth/features/login_password_requirements_base.rb 151 def password_meets_length_requirements?(password) 152 if password_minimum_length > password.length 153 set_password_requirement_error_message(:password_too_short, password_too_short_message) 154 false 155 elsif password_maximum_length && password_maximum_length < password.length 156 set_password_requirement_error_message(:password_too_long, password_too_long_message) 157 false 158 elsif password_maximum_bytes && password_maximum_bytes < password.bytesize 159 set_password_requirement_error_message(:password_too_many_bytes, password_too_many_bytes_message) 160 false 161 else 162 true 163 end 164 end
# File lib/rodauth/features/disallow_common_passwords.rb 13 def password_meets_requirements?(password) 14 super && password_not_one_of_the_most_common?(password) 15 end
# File lib/rodauth/features/password_complexity.rb 75 def password_not_in_dictionary?(password) 76 return true unless dict = password_dictionary 77 return true unless password =~ /\A(?:\d*)([A-Za-z!@$+|][A-Za-z!@$+|0134578]+[A-Za-z!@$+|])(?:\d*)\z/ 78 word = $1.downcase.tr('!@$+|0134578', 'iastloleastb') 79 return true if !dict.include?(word) 80 set_password_requirement_error_message(:password_in_dictionary, password_in_dictionary_message) 81 false 82 end
# File lib/rodauth/features/disallow_common_passwords.rb 33 def password_not_one_of_the_most_common?(password) 34 return true unless password_one_of_most_common?(password) 35 set_password_requirement_error_message(:password_is_one_of_the_most_common, password_is_one_of_the_most_common_message) 36 false 37 end
# File lib/rodauth/features/password_complexity.rb 68 def password_not_too_many_repeating_characters?(password) 69 return true if password_max_repeating_characters < 2 70 return true if password !~ /(.)(\1){#{password_max_repeating_characters-1}}/ 71 set_password_requirement_error_message(:too_many_repeating_characters_in_password, password_too_many_repeating_characters_message) 72 false 73 end
# File lib/rodauth/features/disallow_common_passwords.rb 27 def password_one_of_most_common?(password) 28 most_common_passwords.include?(password) 29 end
# File lib/rodauth/features/password_grace_period.rb 22 def password_recently_entered? 23 return false unless last_password_entry = session[last_password_entry_session_key] 24 last_password_entry + password_grace_period > Time.now.to_i 25 end
# File lib/rodauth/features/reset_password.rb 251 def password_reset_ds(id=account_id) 252 db[reset_password_table].where(reset_password_id_column=>id) 253 end
# File lib/rodauth/features/login_password_requirements_base.rb 87 def password_too_long_message 88 "maximum #{password_maximum_length} characters" 89 end
# File lib/rodauth/features/login_password_requirements_base.rb 91 def password_too_many_bytes_message 92 "maximum #{password_maximum_bytes} bytes" 93 end
# File lib/rodauth/features/login_password_requirements_base.rb 95 def password_too_short_message 96 "minimum #{password_minimum_length} characters" 97 end
# File lib/rodauth/features/base.rb 486 def possible_authentication_methods 487 has_password? ? ['password'] : [] 488 end
# File lib/rodauth/features/base.rb 400 def post_configure 401 require 'bcrypt' if require_bcrypt? 402 db.extension :date_arithmetic if use_date_arithmetic? 403 route_hash= {} 404 self.class.routes.each do |meth| 405 route_meth = "#{meth.to_s.sub(/\Ahandle_/, '')}_route" 406 if route = send(route_meth) 407 route_hash["/#{route}"] = meth 408 end 409 end 410 self.class.route_hash = route_hash.freeze 411 end
# File lib/rodauth/features/disallow_password_reuse.rb 94 def previous_password_ds 95 db[previous_password_hash_table].where(previous_password_account_id_column=>account_id) 96 end
In cases where retrying on uniqueness violations cannot work, this will detect whether a uniqueness violation is raised by the block and return the exception if so. This method should be used if you don’t care about the exception itself.
# File lib/rodauth/features/base.rb 729 def raises_uniqueness_violation?(&block) 730 transaction(:savepoint=>:only, &block) 731 false 732 rescue unique_constraint_violation_class => e 733 e 734 end
# File lib/rodauth/features/base.rb 539 def random_key 540 SecureRandom.urlsafe_base64(32) 541 end
# File lib/rodauth/features/base.rb 468 def raw_param(key) 469 request.params[key] 470 end
# File lib/rodauth/features/recovery_codes.rb 160 def recovery_code_match?(code) 161 recovery_codes.each do |s| 162 if timing_safe_eql?(code, s) 163 recovery_codes_ds.where(recovery_codes_column=>code).delete 164 if recovery_codes_primary? 165 add_recovery_code 166 end 167 return true 168 end 169 end 170 false 171 end
# File lib/rodauth/features/recovery_codes.rb 196 def recovery_codes_available? 197 !recovery_codes_ds.empty? 198 end
# File lib/rodauth/features/recovery_codes.rb 264 def recovery_codes_ds 265 db[recovery_codes_table].where(recovery_codes_id_column=>session_value) 266 end
# File lib/rodauth/features/recovery_codes.rb 244 def recovery_codes_primary? 245 (features & [:otp, :sms_codes, :webauthn]).empty? 246 end
# File lib/rodauth/features/recovery_codes.rb 156 def recovery_codes_remove 157 recovery_codes_ds.delete 158 end
# File lib/rodauth/features/base.rb 516 def redirect(path) 517 request.redirect(path) 518 end
# File lib/rodauth/features/two_factor_base.rb 240 def redirect_two_factor_authenticated 241 saved_two_factor_auth_redirect = remove_session_value(two_factor_auth_redirect_session_key) 242 redirect saved_two_factor_auth_redirect || two_factor_auth_redirect 243 end
# File lib/rodauth/features/remember.rb 218 def remember_key_ds(id=account_id) 219 db[remember_table].where(remember_id_column=>id) 220 end
# File lib/rodauth/features/remember.rb 141 def remember_login 142 get_remember_key 143 opts = Hash[remember_cookie_options] 144 opts[:value] = "#{account_id}_#{convert_token_key(remember_key_value)}" 145 opts[:expires] = convert_timestamp(active_remember_key_ds.get(remember_deadline_column)) 146 opts[:path] = "/" unless opts.key?(:path) 147 opts[:httponly] = true unless opts.key?(:httponly) || opts.key?(:http_only) 148 opts[:secure] = true unless opts.key?(:secure) || !request.ssl? 149 ::Rack::Utils.set_cookie_header!(response.headers, remember_cookie_key, opts) 150 end
# File lib/rodauth/features/remember.rb 89 def remembered_session_id 90 return unless cookie = _get_remember_cookie 91 id, key = cookie.split('_', 2) 92 return unless id && key 93 94 actual, deadline = active_remember_key_ds(id).get([remember_key_column, remember_deadline_column]) 95 return unless actual 96 97 if hmac_secret 98 unless valid = timing_safe_eql?(key, compute_hmac(actual)) 99 unless raw_remember_token_deadline && raw_remember_token_deadline > convert_timestamp(deadline) 100 return 101 end 102 end 103 end 104 105 unless valid || timing_safe_eql?(key, actual) 106 return 107 end 108 109 id 110 end
# File lib/rodauth/features/active_sessions.rb 89 def remove_all_active_sessions 90 active_sessions_ds.delete 91 end
# File lib/rodauth/features/webauthn.rb 383 def remove_all_webauthn_keys_and_user_ids 384 webauthn_user_ids_ds.delete 385 webauthn_keys_ds.delete 386 end
# File lib/rodauth/features/active_sessions.rb 83 def remove_current_session 84 if session_id = session[session_id_session_key] 85 active_sessions_ds.where(active_sessions_session_id_column=>compute_hmac(session_id)).delete 86 end 87 end
# File lib/rodauth/features/email_auth.rb 129 def remove_email_auth_key 130 email_auth_ds.delete 131 end
# File lib/rodauth/features/active_sessions.rb 93 def remove_inactive_sessions 94 if cond = inactive_session_cond 95 active_sessions_ds.where(cond).delete 96 end 97 end
# File lib/rodauth/features/jwt_refresh.rb 176 def remove_jwt_refresh_token_key(token) 177 account_id, token_id, _ = _account_refresh_token_split(token) 178 jwt_refresh_token_account_token_ds(account_id, token_id).delete 179 end
# File lib/rodauth/features/lockout.rb 272 def remove_lockout_metadata 273 account_login_failures_ds.delete 274 account_lockouts_ds.delete 275 end
# File lib/rodauth/features/remember.rb 184 def remove_remember_key(id=account_id) 185 remember_key_ds(id).delete 186 end
# File lib/rodauth/features/reset_password.rb 179 def remove_reset_password_key 180 password_reset_ds.delete 181 end
# File lib/rodauth/features/base.rb 772 def remove_session_value(key) 773 session.delete(key) 774 end
# File lib/rodauth/features/verify_account.rb 174 def remove_verify_account_key 175 verify_account_ds.delete 176 end
# File lib/rodauth/features/verify_login_change.rb 110 def remove_verify_login_change_key 111 verify_login_change_ds.delete 112 end
# File lib/rodauth/features/webauthn.rb 379 def remove_webauthn_key(webauthn_id) 380 webauthn_keys_ds.where(webauthn_keys_webauthn_id_column=>webauthn_id).delete == 1 381 end
# File lib/rodauth/features/base.rb 392 def render(page) 393 _view(:render, page) 394 end
# File lib/rodauth/features/login.rb 128 def render_multi_phase_login_forms 129 multi_phase_login_forms.sort.map{|_, form, _| form}.join("\n") 130 end
# File lib/rodauth/features/base.rb 143 def request 144 scope.request 145 end
# File lib/rodauth/features/base.rb 345 def require_account 346 require_authentication 347 require_account_session 348 end
# File lib/rodauth/features/base.rb 553 def require_account_session 554 unless account_from_session 555 clear_session 556 login_required 557 end 558 end
# File lib/rodauth/features/base.rb 341 def require_authentication 342 require_login 343 end
# File lib/rodauth/features/password_expiration.rb 61 def require_current_password 62 if authenticated? && password_expired? && password_change_needed_redirect != request.path_info 63 set_redirect_error_flash password_expiration_error_flash 64 redirect password_change_needed_redirect 65 end 66 end
# File lib/rodauth/features/http_basic_auth.rb 27 def require_http_basic_auth 28 unless http_basic_auth 29 set_http_basic_auth_error_response 30 return_response 31 end 32 end
# File lib/rodauth/features/base.rb 333 def require_login 334 login_required unless logged_in? 335 end
# File lib/rodauth/features/verify_account.rb 166 def require_login_confirmation? 167 false 168 end
# File lib/rodauth/features/otp.rb 233 def require_otp_setup 234 unless otp_exists? 235 set_redirect_error_status(two_factor_not_setup_error_status) 236 set_error_reason :two_factor_not_setup 237 set_redirect_error_flash two_factor_not_setup_error_flash 238 redirect two_factor_need_setup_redirect 239 end 240 end
# File lib/rodauth/features/confirm_password.rb 51 def require_password_authentication 52 require_login 53 54 if require_password_authentication? && has_password? 55 set_redirect_error_status(password_authentication_required_error_status) 56 set_error_reason :password_authentication_required 57 set_redirect_error_flash password_authentication_required_error_flash 58 set_session_value(confirm_password_redirect_session_key, request.fullpath) 59 redirect password_authentication_required_redirect 60 end 61 end
# File lib/rodauth/features/confirm_password.rb 87 def require_password_authentication? 88 return true if defined?(super) && super 89 !authenticated_by.include?('password') 90 end
# File lib/rodauth/features/sms_codes.rb 329 def require_sms_available 330 require_sms_setup 331 332 if sms_locked_out? 333 set_redirect_error_status(lockout_error_status) 334 set_error_reason :sms_locked_out 335 set_redirect_error_flash sms_lockout_error_flash 336 redirect sms_lockout_redirect 337 end 338 end
# File lib/rodauth/features/sms_codes.rb 320 def require_sms_not_setup 321 if sms_setup? 322 set_redirect_error_status(sms_already_setup_error_status) 323 set_error_reason :sms_already_setup 324 set_redirect_error_flash sms_already_setup_error_flash 325 redirect sms_already_setup_redirect 326 end 327 end
# File lib/rodauth/features/sms_codes.rb 311 def require_sms_setup 312 unless sms_setup? 313 set_redirect_error_status(two_factor_not_setup_error_status) 314 set_error_reason :sms_not_setup 315 set_redirect_error_flash sms_not_setup_error_flash 316 redirect sms_needs_setup_redirect 317 end 318 end
# File lib/rodauth/features/two_factor_base.rb 163 def require_two_factor_authenticated 164 unless two_factor_authenticated? 165 if two_factor_auth_return_to_requested_location? 166 set_session_value(two_factor_auth_redirect_session_key, request.fullpath) 167 end 168 set_redirect_error_status(two_factor_need_authentication_error_status) 169 set_error_reason :two_factor_need_authentication 170 set_redirect_error_flash two_factor_need_authentication_error_flash 171 redirect two_factor_auth_required_redirect 172 end 173 end
# File lib/rodauth/features/two_factor_base.rb 154 def require_two_factor_not_authenticated(auth_type = nil) 155 if two_factor_authenticated? || (auth_type && two_factor_login_type_match?(auth_type)) 156 set_redirect_error_status(two_factor_already_authenticated_error_status) 157 set_error_reason :two_factor_already_authenticated 158 set_redirect_error_flash two_factor_already_authenticated_error_flash 159 redirect two_factor_already_authenticated_redirect 160 end 161 end
# File lib/rodauth/features/two_factor_base.rb 142 def require_two_factor_setup 143 # Avoid database query if already authenticated via 2nd factor 144 return if two_factor_authenticated? 145 146 return if uses_two_factor_authentication? 147 148 set_redirect_error_status(two_factor_not_setup_error_status) 149 set_error_reason :two_factor_not_setup 150 set_redirect_error_flash two_factor_not_setup_error_flash 151 redirect two_factor_need_setup_redirect 152 end
# File lib/rodauth/features/webauthn.rb 392 def require_webauthn_setup 393 unless webauthn_setup? 394 set_redirect_error_status(webauthn_not_setup_error_status) 395 set_error_reason :webauthn_not_setup 396 set_redirect_error_flash webauthn_not_setup_error_flash 397 redirect two_factor_need_setup_redirect 398 end 399 end
# File lib/rodauth/features/jwt.rb 121 def rescue_jwt_payload(_) 122 @jwt_payload = false 123 end
# File lib/rodauth/features/reset_password.rb 187 def reset_password_email_link 188 token_link(reset_password_route, reset_password_key_param, reset_password_key_value) 189 end
# File lib/rodauth/features/reset_password.rb 215 def reset_password_email_recently_sent? 216 (email_last_sent = get_reset_password_email_last_sent) && (Time.now - email_last_sent < reset_password_skip_resend_email_within) 217 end
# File lib/rodauth/features/reset_password.rb 245 def reset_password_key_insert_hash 246 hash = {reset_password_id_column=>account_id, reset_password_key_column=>reset_password_key_value} 247 set_deadline_value(hash, reset_password_deadline_column, reset_password_deadline_interval) 248 hash 249 end
# File lib/rodauth/features/single_session.rb 22 def reset_single_session_key 23 if logged_in? 24 single_session_ds.update(single_session_key_column=>random_key) 25 end 26 end
# File lib/rodauth/features/base.rb 147 def response 148 scope.response 149 end
This is used to avoid race conditions when using the pattern of inserting when an update affects no rows. In such cases, if a row is inserted between the update and the insert, the insert will fail with a uniqueness error, but retrying will work. It is possible for it to fail again, but only if the row is deleted before the update and readded before the insert, which is very unlikely to happen. In such cases, raising an exception is acceptable.
# File lib/rodauth/features/base.rb 720 def retry_on_uniqueness_violation(&block) 721 if raises_uniqueness_violation?(&block) 722 yield 723 end 724 end
# File lib/rodauth/features/json.rb 170 def return_json_response 171 _return_json_response 172 end
# File lib/rodauth/features/base.rb 520 def return_response(body=nil) 521 response.write(body) if body 522 request.halt 523 end
# File lib/rodauth/features/base.rb 159 def route! 160 if meth = self.class.route_hash[request.remaining_path] 161 send(meth) 162 end 163 164 nil 165 end
# File lib/rodauth/features/base.rb 525 def route_path(route, opts={}) 526 path = "#{prefix}/#{route}" 527 path += "?#{Rack::Utils.build_nested_query(opts)}" unless opts.empty? 528 path 529 end
# File lib/rodauth/features/base.rb 531 def route_url(route, opts={}) 532 "#{base_url}#{route_path(route, opts)}" 533 end
# File lib/rodauth/features/create_account.rb 100 def save_account 101 id = nil 102 raised = raises_uniqueness_violation?{id = db[accounts_table].insert(account)} 103 104 if raised 105 set_login_requirement_error_message(:already_an_account_with_this_login, already_an_account_with_this_login_message) 106 end 107 108 if id 109 account[account_id_column] = id 110 end 111 112 id && !raised 113 end
# File lib/rodauth/features/email_base.rb 28 def send_email(email) 29 email.deliver! 30 end
# File lib/rodauth/features/verify_login_change.rb 126 def send_verify_login_change_email(login) 127 send_email(create_verify_login_change_email(login)) 128 end
# File lib/rodauth/features/audit_logging.rb 55 def serialize_audit_log_metadata(metadata) 56 metadata.to_json unless metadata.nil? 57 end
# File lib/rodauth/features/base.rb 151 def session 152 scope.session 153 end
# File lib/rodauth/features/active_sessions.rb 150 def session_inactivity_deadline_condition 151 if deadline = session_inactivity_deadline 152 Sequel[active_sessions_last_use_column] < Sequel.date_sub(Sequel::CURRENT_TIMESTAMP, seconds: deadline) 153 end 154 end
# File lib/rodauth/features/jwt.rb 75 def session_jwt 76 JWT.encode(jwt_session_hash, jwt_secret, jwt_algorithm) 77 end
# File lib/rodauth/features/active_sessions.rb 156 def session_lifetime_deadline_condition 157 if deadline = session_lifetime_deadline 158 Sequel[active_sessions_created_at_column] < Sequel.date_sub(Sequel::CURRENT_TIMESTAMP, seconds: deadline) 159 end 160 end
# File lib/rodauth/features/base.rb 251 def session_value 252 session[session_key] 253 end
This is needed on MySQL, which doesn’t support non constant defaults other than CURRENT_TIMESTAMP.
# File lib/rodauth/features/base.rb 756 def set_deadline_value(hash, column, interval) 757 if set_deadline_values? 758 # :nocov: 759 hash[column] = Sequel.date_add(Sequel::CURRENT_TIMESTAMP, interval) 760 # :nocov: 761 end 762 end
# File lib/rodauth/features/base.rb 599 def set_deadline_values? 600 db.database_type == :mysql 601 end
# File lib/rodauth/features/email_auth.rb 117 def set_email_auth_email_last_sent 118 email_auth_ds.update(email_auth_email_last_sent_column=>Sequel::CURRENT_TIMESTAMP) if email_auth_email_last_sent_column 119 end
# File lib/rodauth/features/base.rb 317 def set_error_flash(message) 318 flash.now[flash_error_key] = message 319 end
# File lib/rodauth/features/base.rb 587 def set_error_reason(reason) 588 end
# File lib/rodauth/features/account_expiration.rb 49 def set_expired 50 update_activity(account_id, account_activity_expired_column) 51 after_account_expiration 52 end
# File lib/rodauth/features/base.rb 167 def set_field_error(field, error) 168 (@field_errors ||= {})[field] = error 169 end
# File lib/rodauth/features/http_basic_auth.rb 74 def set_http_basic_auth_error_response 75 response.status = 401 76 response.headers["WWW-Authenticate"] = "Basic realm=\"#{http_basic_auth_realm}\"" 77 end
# File lib/rodauth/features/jwt.rb 142 def set_jwt 143 set_jwt_token(session_jwt) 144 end
# File lib/rodauth/features/jwt_refresh.rb 192 def set_jwt_refresh_token_hmac_session_key(token) 193 if allow_refresh_with_expired_jwt_access_token? 194 key = _account_refresh_token_split(token).last 195 data = random_key 196 set_session_value(jwt_refresh_token_data_session_key, data) 197 set_session_value(jwt_refresh_token_hmac_session_key, compute_hmac(data + key)) 198 end 199 end
# File lib/rodauth/features/jwt.rb 87 def set_jwt_token(token) 88 response.headers['Authorization'] = token 89 end
# File lib/rodauth/features/password_grace_period.rb 44 def set_last_password_entry 45 set_session_value(last_password_entry_session_key, Time.now.to_i) 46 end
# File lib/rodauth/features/login_password_requirements_base.rb 120 def set_login_requirement_error_message(reason, message) 121 set_error_reason(reason) 122 @login_requirement_message = message 123 end
# File lib/rodauth/features/create_account.rb 92 def set_new_account_password(password) 93 account[account_password_hash_column] = password_hash(password) 94 end
# File lib/rodauth/features/base.rb 325 def set_notice_flash(message) 326 flash[flash_notice_key] = message 327 end
# File lib/rodauth/features/base.rb 329 def set_notice_now_flash(message) 330 flash.now[flash_notice_key] = message 331 end
# File lib/rodauth/features/disallow_password_reuse.rb 19 def set_password(password) 20 hash = super 21 add_previous_password_hash(hash) 22 hash 23 end
# File lib/rodauth/features/login_password_requirements_base.rb 99 def set_password_requirement_error_message(reason, message) 100 set_error_reason(reason) 101 @password_requirement_message = message 102 end
# File lib/rodauth/features/base.rb 321 def set_redirect_error_flash(message) 322 flash[flash_error_key] = message 323 end
Don’t set an error status when redirecting in an error case, as a redirect status is needed.
# File lib/rodauth/features/base.rb 565 def set_redirect_error_status(status) 566 end
# File lib/rodauth/features/reset_password.rb 197 def set_reset_password_email_last_sent 198 password_reset_ds.update(reset_password_email_last_sent_column=>Sequel::CURRENT_TIMESTAMP) if reset_password_email_last_sent_column 199 end
# File lib/rodauth/features/base.rb 572 def set_response_error_reason_status(reason, status) 573 set_error_reason(reason) 574 set_response_error_status(status) 575 end
# File lib/rodauth/features/base.rb 568 def set_response_error_status(status) 569 response.status = status 570 end
# File lib/rodauth/features/base.rb 768 def set_session_value(key, value) 769 session[key] = value 770 end
# File lib/rodauth/features/single_session.rb 93 def set_single_session_key(data) 94 data = compute_hmac(data) if hmac_secret 95 set_session_value(single_session_session_key, data) 96 end
# File lib/rodauth/features/base.rb 311 def set_title(title) 312 if title_instance_variable 313 scope.instance_variable_set(title_instance_variable, title) 314 end 315 end
# File lib/rodauth/features/lockout.rb 238 def set_unlock_account_email_last_sent 239 account_lockouts_ds.update(account_lockouts_email_last_sent_column=>Sequel::CURRENT_TIMESTAMP) if account_lockouts_email_last_sent_column 240 end
# File lib/rodauth/features/verify_account.rb 232 def set_verify_account_email_last_sent 233 verify_account_ds.update(verify_account_email_last_sent_column=>Sequel::CURRENT_TIMESTAMP) if verify_account_email_last_sent_column 234 end
# File lib/rodauth/features/verify_account.rb 244 def setup_account_verification 245 generate_verify_account_key_value 246 create_verify_account_key 247 send_verify_account_email 248 end
# File lib/rodauth/features/lockout.rb 277 def show_lockout_page 278 set_response_error_reason_status(:account_locked_out, lockout_error_status) 279 set_error_flash login_lockout_error_flash 280 return_response unlock_account_request_view 281 end
# File lib/rodauth/features/single_session.rb 98 def single_session_ds 99 db[single_session_table]. 100 where(single_session_id_column=>session_value) 101 end
# File lib/rodauth/features/login.rb 110 def skip_login_field_on_login? 111 return false unless use_multi_phase_login? 112 valid_login_entered? 113 end
# File lib/rodauth/features/login.rb 115 def skip_password_field_on_login? 116 return false unless use_multi_phase_login? 117 !valid_login_entered? 118 end
# File lib/rodauth/features/close_account.rb 84 def skip_status_checks? 85 false 86 end
# File lib/rodauth/features/sms_codes.rb 390 def sms_auth_message(code) 391 "SMS authentication code for #{domain} is #{code}" 392 end
# File lib/rodauth/features/sms_codes.rb 432 def sms_available? 433 sms_setup? && !sms_locked_out? 434 end
# File lib/rodauth/features/sms_codes.rb 411 def sms_code 412 sms[sms_code_column] 413 end
# File lib/rodauth/features/sms_codes.rb 415 def sms_code_issued_at 416 convert_timestamp(sms[sms_issued_at_column]) 417 end
# File lib/rodauth/features/sms_codes.rb 340 def sms_code_match?(code) 341 return false unless sms_current_auth? 342 timing_safe_eql?(code, sms_code) 343 end
# File lib/rodauth/features/sms_codes.rb 475 def sms_codes_primary? 476 (features & [:otp, :webauthn]).empty? 477 end
# File lib/rodauth/features/recovery_codes.rb 146 def sms_confirm 147 super if defined?(super) 148 auto_add_missing_recovery_codes 149 end
# File lib/rodauth/features/sms_codes.rb 354 def sms_confirm_failure 355 sms_ds.delete 356 end
# File lib/rodauth/features/sms_codes.rb 394 def sms_confirm_message(code) 395 "SMS confirmation code for #{domain} is #{code}" 396 end
# File lib/rodauth/features/sms_codes.rb 345 def sms_confirmation_match?(code) 346 sms_needs_confirmation? && sms_code_match?(code) 347 end
# File lib/rodauth/features/sms_codes.rb 440 def sms_current_auth? 441 sms_code && sms_code_issued_at + sms_code_allowed_seconds > Time.now 442 end
# File lib/rodauth/features/sms_codes.rb 349 def sms_disable 350 sms_ds.delete 351 @sms = nil 352 end
# File lib/rodauth/features/sms_codes.rb 503 def sms_ds 504 db[sms_codes_table].where(sms_id_column=>session_value) 505 end
# File lib/rodauth/features/sms_codes.rb 419 def sms_failures 420 sms[sms_failures_column] 421 end
# File lib/rodauth/features/sms_codes.rb 436 def sms_locked_out? 437 sms_failures >= sms_failure_limit 438 end
# File lib/rodauth/features/sms_codes.rb 428 def sms_needs_confirmation? 429 sms && sms_failures.nil? 430 end
# File lib/rodauth/features/sms_codes.rb 483 def sms_new_auth_code 484 SecureRandom.random_number(10**sms_auth_code_length).to_s.rjust(sms_auth_code_length, "0") 485 end
# File lib/rodauth/features/sms_codes.rb 487 def sms_new_confirm_code 488 SecureRandom.random_number(10**sms_confirm_code_length).to_s.rjust(sms_confirm_code_length, "0") 489 end
# File lib/rodauth/features/sms_codes.rb 479 def sms_normalize_phone(phone) 480 phone.to_s.gsub(/\D+/, '') 481 end
# File lib/rodauth/features/sms_codes.rb 407 def sms_phone 408 sms[sms_phone_column] 409 end
# File lib/rodauth/features/sms_codes.rb 402 def sms_record_failure 403 update_sms(sms_failures_column=>Sequel.expr(sms_failures_column)+1) 404 sms[sms_failures_column] = sms_ds.get(sms_failures_column) 405 end
# File lib/rodauth/features/sms_codes.rb 365 def sms_remove_failures 366 update_sms(sms_failures_column => 0, sms_code_column => nil) 367 end
# File lib/rodauth/features/sms_codes.rb 491 def sms_send(phone, message) 492 raise NotImplementedError, "sms_send needs to be defined in the Rodauth configuration for SMS sending to work" 493 end
# File lib/rodauth/features/sms_codes.rb 374 def sms_send_auth_code 375 code = sms_new_auth_code 376 sms_set_code(code) 377 sms_send(sms_phone, sms_auth_message(code)) 378 end
# File lib/rodauth/features/sms_codes.rb 380 def sms_send_confirm_code 381 code = sms_new_confirm_code 382 sms_set_code(code) 383 sms_send(sms_phone, sms_confirm_message(code)) 384 end
# File lib/rodauth/features/sms_codes.rb 398 def sms_set_code(code) 399 update_sms(sms_code_column=>code, sms_issued_at_column=>Sequel::CURRENT_TIMESTAMP) 400 end
# File lib/rodauth/features/sms_codes.rb 358 def sms_setup(phone_number) 359 # Cannot handle uniqueness violation here, as the phone number given may not match the 360 # one in the table. 361 sms_ds.insert(sms_id_column=>session_value, sms_phone_column=>phone_number) 362 remove_instance_variable(:@sms) if instance_variable_defined?(:@sms) 363 end
# File lib/rodauth/features/sms_codes.rb 423 def sms_setup? 424 return false unless sms 425 !sms_needs_confirmation? 426 end
# File lib/rodauth/features/sms_codes.rb 386 def sms_valid_phone?(phone) 387 phone.length >= sms_phone_min_length 388 end
# File lib/rodauth/features/base.rb 512 def split_token(token) 513 token.split(token_separator, 2) 514 end
# File lib/rodauth/features/base.rb 689 def template_path(page) 690 File.join(File.dirname(__FILE__), '../../../templates', "#{page}.str") 691 end
# File lib/rodauth/features/http_basic_auth.rb 79 def throw_basic_auth_error(*args) 80 set_http_basic_auth_error_response 81 throw_error(*args) 82 end
# File lib/rodauth/features/base.rb 577 def throw_error(field, error) 578 set_field_error(field, error) 579 throw :rodauth_error 580 end
# File lib/rodauth/features/base.rb 590 def throw_error_reason(reason, status, field, message) 591 set_error_reason(reason) 592 throw_error_status(status, field, message) 593 end
# File lib/rodauth/features/base.rb 582 def throw_error_status(status, field, error) 583 set_response_error_status(status) 584 throw_error(field, error) 585 end
# File lib/rodauth/features/base.rb 548 def timing_safe_eql?(provided, actual) 549 provided = provided.to_s 550 Rack::Utils.secure_compare(provided.ljust(actual.length), actual) && provided.length == actual.length 551 end
# File lib/rodauth/features/email_base.rb 53 def token_link(route, param, key) 54 route_url(route, param => token_param_value(key)) 55 end
# File lib/rodauth/features/email_base.rb 57 def token_param_value(key) 58 "#{account_id}#{token_separator}#{convert_email_token_key(key)}" 59 end
# File lib/rodauth/features/base.rb 535 def transaction(opts={}, &block) 536 db.transaction(opts, &block) 537 end
# File lib/rodauth/features/base.rb 234 def translate(_key, default) 235 # do not attempt to translate by default 236 default 237 end
# File lib/rodauth/features/two_factor_base.rb 232 def two_factor_authenticate(type) 233 two_factor_update_session(type) 234 two_factor_remove_auth_failures 235 after_two_factor_authentication 236 set_notice_flash two_factor_auth_notice_flash 237 redirect_two_factor_authenticated 238 end
# File lib/rodauth/features/two_factor_base.rb 187 def two_factor_authenticated? 188 authenticated_by && authenticated_by.length >= 2 189 end
# File lib/rodauth/features/two_factor_base.rb 191 def two_factor_authentication_setup? 192 possible_authentication_methods.length >= 2 193 end
# File lib/rodauth/features/two_factor_base.rb 201 def two_factor_login_type_match?(type) 202 authenticated_by && authenticated_by.include?(type) 203 end
# File lib/rodauth/features/two_factor_base.rb 118 def two_factor_modifications_require_password? 119 modifications_require_password? 120 end
# File lib/rodauth/features/two_factor_base.rb 179 def two_factor_password_match?(password) 180 if two_factor_modifications_require_password? 181 password_match?(password) 182 else 183 true 184 end 185 end
# File lib/rodauth/features/otp.rb 223 def two_factor_remove 224 super 225 otp_remove 226 end
# File lib/rodauth/features/otp.rb 228 def two_factor_remove_auth_failures 229 super 230 otp_remove_auth_failures 231 end
# File lib/rodauth/features/two_factor_base.rb 245 def two_factor_remove_session(type) 246 authenticated_by.delete(type) 247 remove_session_value(two_factor_setup_session_key) 248 if authenticated_by.empty? 249 clear_session 250 end 251 end
# File lib/rodauth/features/two_factor_base.rb 253 def two_factor_update_session(auth_type) 254 authenticated_by << auth_type 255 set_session_value(two_factor_setup_session_key, true) 256 end
Work around jdbc/sqlite issue where it only raises ConstraintViolation and not UniqueConstraintViolation.
# File lib/rodauth/features/base.rb 738 def unique_constraint_violation_class 739 if db.adapter_scheme == :jdbc && db.database_type == :sqlite 740 # :nocov: 741 Sequel::ConstraintViolation 742 # :nocov: 743 else 744 Sequel::UniqueConstraintViolation 745 end 746 end
# File lib/rodauth/features/lockout.rb 161 def unlock_account 162 transaction do 163 remove_lockout_metadata 164 end 165 end
# File lib/rodauth/features/lockout.rb 226 def unlock_account_email_link 227 token_link(unlock_account_route, unlock_account_key_param, unlock_account_key_value) 228 end
# File lib/rodauth/features/lockout.rb 283 def unlock_account_email_recently_sent? 284 (email_last_sent = get_unlock_account_email_last_sent) && (Time.now - email_last_sent < unlock_account_skip_resend_email_within) 285 end
# File lib/rodauth/features/verify_account_grace_period.rb 88 def unverified_grace_period_expired? 89 return false unless expires_at = session[unverified_account_session_key] 90 expires_at.is_a?(Integer) && Time.now.to_i > expires_at 91 end
# File lib/rodauth/features/base.rb 786 def update_account(values, ds=account_ds) 787 update_hash_ds(account, ds, values) 788 end
# File lib/rodauth/features/account_expiration.rb 113 def update_activity(account_id, *columns) 114 ds = account_activity_ds(account_id) 115 hash = {} 116 columns.each do |c| 117 hash[c] = Sequel::CURRENT_TIMESTAMP 118 end 119 if ds.update(hash) == 0 120 hash[account_activity_id_column] = account_id 121 hash[account_activity_last_activity_column] ||= Sequel::CURRENT_TIMESTAMP 122 hash[account_activity_last_login_column] ||= Sequel::CURRENT_TIMESTAMP 123 # It is safe to ignore uniqueness violations here, as a concurrent insert would also use current timestamps. 124 ignore_uniqueness_violation{ds.insert(hash)} 125 end 126 end
# File lib/rodauth/features/active_sessions.rb 169 def update_current_session? 170 !!session_inactivity_deadline 171 end
# File lib/rodauth/features/base.rb 776 def update_hash_ds(hash, ds, values) 777 num = ds.update(values) 778 if num == 1 779 values.each do |k, v| 780 hash[k] = Sequel::CURRENT_TIMESTAMP == v ? Time.now : v 781 end 782 end 783 num 784 end
# File lib/rodauth/features/account_expiration.rb 43 def update_last_activity 44 if session_value 45 update_activity(session_value, account_activity_last_activity_column) 46 end 47 end
# File lib/rodauth/features/account_expiration.rb 39 def update_last_login 40 update_activity(account_id, account_activity_last_login_column, account_activity_last_activity_column) 41 end
# File lib/rodauth/features/change_login.rb 79 def update_login(login) 80 _update_login(login) 81 end
# File lib/rodauth/features/password_expiration.rb 52 def update_password_changed_at 53 ds = password_expiration_ds 54 if ds.update(password_expiration_changed_at_column=>Sequel::CURRENT_TIMESTAMP) == 0 55 # Ignoring the violation is safe here, since a concurrent insert would also set it to the 56 # current timestamp. 57 ignore_uniqueness_violation{ds.insert(password_expiration_id_column=>account_id)} 58 end 59 end
# File lib/rodauth/features/update_password_hash.rb 17 def update_password_hash? 18 password_hash_cost != @current_password_hash_cost 19 end
# File lib/rodauth/features/account_expiration.rb 72 def update_session 73 check_account_expiration 74 super 75 end
# File lib/rodauth/features/single_session.rb 65 def update_single_session_key 66 key = random_key 67 set_single_session_key(key) 68 if single_session_ds.update(single_session_key_column=>key) == 0 69 # Don't handle uniqueness violations here. While we could get the stored key from the 70 # database, it could lead to two sessions sharing the same key, which this feature is 71 # designed to prevent. 72 single_session_ds.insert(single_session_id_column=>session_value, single_session_key_column=>key) 73 end 74 end
# File lib/rodauth/features/sms_codes.rb 495 def update_sms(values) 496 update_hash_ds(sms, sms_ds, values) 497 end
# File lib/rodauth/features/base.rb 603 def use_database_authentication_functions? 604 case db.database_type 605 when :postgres, :mysql, :mssql 606 true 607 else 608 # :nocov: 609 false 610 # :nocov: 611 end 612 end
# File lib/rodauth/features/active_sessions.rb 178 def use_date_arithmetic? 179 true 180 end
# File lib/rodauth/features/json.rb 59 def use_json? 60 json_request? || only_json? 61 end
# File lib/rodauth/features/email_auth.rb 158 def use_multi_phase_login? 159 true 160 end
# File lib/rodauth/features/base.rb 614 def use_request_specific_csrf_tokens? 615 scope.opts[:rodauth_route_csrf] && scope.use_request_specific_csrf_tokens? 616 end
# File lib/rodauth/features/two_factor_base.rb 195 def uses_two_factor_authentication? 196 return false unless logged_in? 197 set_session_value(two_factor_setup_session_key, two_factor_authentication_setup?) unless session.has_key?(two_factor_setup_session_key) 198 session[two_factor_setup_session_key] 199 end
# File lib/rodauth/features/jwt.rb 99 def valid_jwt? 100 !!(jwt_token && jwt_payload) 101 end
# File lib/rodauth/features/login.rb 120 def valid_login_entered? 121 @valid_login_entered 122 end
# File lib/rodauth/features/webauthn.rb 305 def valid_new_webauthn_credential?(webauthn_credential) 306 # Hack around inability to override expected_origin 307 origin = webauthn_origin 308 webauthn_credential.response.define_singleton_method(:verify) do |expected_challenge, expected_origin = nil, **kw| 309 super(expected_challenge, expected_origin || origin, **kw) 310 end 311 312 (challenge = param_or_nil(webauthn_setup_challenge_param)) && 313 (hmac = param_or_nil(webauthn_setup_challenge_hmac_param)) && 314 timing_safe_eql?(compute_hmac(challenge), hmac) && 315 webauthn_credential.verify(challenge) 316 end
# File lib/rodauth/features/webauthn.rb 359 def valid_webauthn_credential_auth?(webauthn_credential) 360 ds = webauthn_keys_ds.where(webauthn_keys_webauthn_id_column => webauthn_credential.id) 361 pub_key, sign_count = ds.get([webauthn_keys_public_key_column, webauthn_keys_sign_count_column]) 362 363 # Hack around inability to override expected_origin 364 origin = webauthn_origin 365 webauthn_credential.response.define_singleton_method(:verify) do |expected_challenge, expected_origin = nil, **kw| 366 super(expected_challenge, expected_origin || origin, **kw) 367 end 368 369 (challenge = param_or_nil(webauthn_auth_challenge_param)) && 370 (hmac = param_or_nil(webauthn_auth_challenge_hmac_param)) && 371 timing_safe_eql?(compute_hmac(challenge), hmac) && 372 webauthn_credential.verify(challenge, public_key: pub_key, sign_count: sign_count) && 373 ds.update( 374 webauthn_keys_sign_count_column => Integer(webauthn_credential.sign_count), 375 webauthn_keys_last_use_column => Sequel::CURRENT_TIMESTAMP 376 ) == 1 377 end
# File lib/rodauth/features/verify_account_grace_period.rb 17 def verified_account? 18 logged_in? && !session[unverified_account_session_key] 19 end
# File lib/rodauth/features/verify_account.rb 178 def verify_account 179 update_account(account_status_column=>account_open_status_value) == 1 180 end
# File lib/rodauth/features/verify_account.rb 280 def verify_account_check_already_logged_in 281 check_already_logged_in 282 end
# File lib/rodauth/features/verify_account.rb 305 def verify_account_ds(id=account_id) 306 db[verify_account_table].where(verify_account_id_column=>id) 307 end
# File lib/rodauth/features/verify_account.rb 211 def verify_account_email_link 212 token_link(verify_account_route, verify_account_key_param, verify_account_key_value) 213 end
# File lib/rodauth/features/verify_account.rb 260 def verify_account_email_recently_sent? 261 (email_last_sent = get_verify_account_email_last_sent) && (Time.now - email_last_sent < verify_account_skip_resend_email_within) 262 end
# File lib/rodauth/features/verify_account.rb 182 def verify_account_email_resend 183 if @verify_account_key_value = get_verify_account_key(account_id) 184 set_verify_account_email_last_sent 185 send_verify_account_email 186 true 187 end 188 end
# File lib/rodauth/features/verify_account.rb 301 def verify_account_key_insert_hash 302 {verify_account_id_column=>account_id, verify_account_key_column=>verify_account_key_value} 303 end
# File lib/rodauth/features/verify_account_grace_period.rb 29 def verify_account_set_password? 30 false 31 end
# File lib/rodauth/features/webauthn_verify_account.rb 7 def verify_account_view 8 webauthn_setup_view 9 end
# File lib/rodauth/features/verify_login_change.rb 114 def verify_login_change 115 unless res = _update_login(verify_login_change_new_login) 116 remove_verify_login_change_key 117 end 118 119 res 120 end
# File lib/rodauth/features/verify_login_change.rb 208 def verify_login_change_ds(id=account_id) 209 db[verify_login_change_table].where(verify_login_change_id_column=>id) 210 end
# File lib/rodauth/features/verify_login_change.rb 204 def verify_login_change_email_body 205 render('verify-login-change-email') 206 end
# File lib/rodauth/features/verify_login_change.rb 130 def verify_login_change_email_link 131 token_link(verify_login_change_route, verify_login_change_key_param, verify_login_change_key_value) 132 end
# File lib/rodauth/features/verify_login_change.rb 194 def verify_login_change_key_insert_hash(login) 195 hash = {verify_login_change_id_column=>account_id, verify_login_change_key_column=>verify_login_change_key_value, verify_login_change_login_column=>login} 196 set_deadline_value(hash, verify_login_change_deadline_column, verify_login_change_deadline_interval) 197 hash 198 end
# File lib/rodauth/features/verify_login_change.rb 142 def verify_login_change_old_login 143 account_ds.get(login_column) 144 end
# File lib/rodauth/features/base.rb 387 def view(page, title) 388 set_title(title) 389 _view(:view, page) 390 end
# File lib/rodauth/features/webauthn.rb 318 def webauth_credential_options_for_get 319 WebAuthn::Credential.options_for_get( 320 :allow => account_webauthn_ids, 321 :timeout => webauthn_auth_timeout, 322 :rp_id => webauthn_rp_id, 323 :user_verification => webauthn_user_verification, 324 :extensions => webauthn_extensions, 325 ) 326 end
# File lib/rodauth/features/webauthn.rb 436 def webauthn_account_id 437 session_value 438 end
# File lib/rodauth/features/webauthn_login.rb 35 def webauthn_auth_additional_form_tags 36 if @webauthn_login 37 super.to_s + login_hidden_field 38 else 39 super 40 end 41 end
# File lib/rodauth/features/webauthn.rb 448 def webauthn_auth_credential_from_form_submission 449 case auth_data = raw_param(webauthn_auth_param) 450 when String 451 begin 452 auth_data = JSON.parse(auth_data) 453 rescue 454 throw_error_reason(:invalid_webauthn_auth_param, invalid_field_error_status, webauthn_auth_param, webauthn_invalid_auth_param_message) 455 end 456 when Hash 457 # nothing 458 else 459 throw_error_reason(:invalid_webauthn_auth_param, invalid_field_error_status, webauthn_auth_param, webauthn_invalid_auth_param_message) 460 end 461 462 begin 463 webauthn_credential = WebAuthn::Credential.from_get(auth_data) 464 unless valid_webauthn_credential_auth?(webauthn_credential) 465 throw_error_reason(:invalid_webauthn_auth_param, invalid_key_error_status, webauthn_auth_param, webauthn_invalid_auth_param_message) 466 end 467 rescue WebAuthn::SignCountVerificationError 468 handle_webauthn_sign_count_verification_error 469 rescue WebAuthn::Error, RuntimeError, NoMethodError 470 throw_error_reason(:invalid_webauthn_auth_param, invalid_field_error_status, webauthn_auth_param, webauthn_invalid_auth_param_message) 471 end 472 473 webauthn_credential 474 end
# File lib/rodauth/features/webauthn.rb 238 def webauthn_auth_form_path 239 webauthn_auth_path 240 end
# File lib/rodauth/features/webauthn.rb 254 def webauthn_authenticator_selection 255 {'requireResidentKey' => false, 'userVerification' => webauthn_user_verification} 256 end
# File lib/rodauth/features/webauthn.rb 258 def webauthn_extensions 259 {} 260 end
# File lib/rodauth/features/webauthn.rb 444 def webauthn_keys_ds 445 db[webauthn_keys_table].where(webauthn_keys_account_id_column => webauthn_account_id) 446 end
# File lib/rodauth/features/webauthn.rb 332 def webauthn_origin 333 base_url 334 end
# File lib/rodauth/features/webauthn.rb 246 def webauthn_remove_authenticated_session 247 remove_session_value(authenticated_webauthn_id_session_key) 248 end
# File lib/rodauth/features/webauthn.rb 336 def webauthn_rp_id 337 webauthn_origin.sub(/\Ahttps?:\/\//, '').sub(/:\d+\z/, '') 338 end
# File lib/rodauth/features/webauthn.rb 340 def webauthn_rp_name 341 webauthn_rp_id 342 end
# File lib/rodauth/features/webauthn.rb 388 def webauthn_setup? 389 !webauthn_keys_ds.empty? 390 end
# File lib/rodauth/features/webauthn.rb 476 def webauthn_setup_credential_from_form_submission 477 case setup_data = raw_param(webauthn_setup_param) 478 when String 479 begin 480 setup_data = JSON.parse(setup_data) 481 rescue 482 throw_error_reason(:invalid_webauthn_setup_param, invalid_field_error_status, webauthn_setup_param, webauthn_invalid_setup_param_message) 483 end 484 when Hash 485 # nothing 486 else 487 throw_error_reason(:invalid_webauthn_setup_param, invalid_field_error_status, webauthn_setup_param, webauthn_invalid_setup_param_message) 488 end 489 490 unless two_factor_password_match?(param(password_param)) 491 throw_error_reason(:invalid_password, invalid_password_error_status, password_param, invalid_password_message) 492 end 493 494 begin 495 webauthn_credential = WebAuthn::Credential.from_create(setup_data) 496 unless valid_new_webauthn_credential?(webauthn_credential) 497 throw_error_reason(:invalid_webauthn_setup_param, invalid_field_error_status, webauthn_setup_param, webauthn_invalid_setup_param_message) 498 end 499 rescue WebAuthn::Error, RuntimeError, NoMethodError 500 throw_error_reason(:invalid_webauthn_setup_param, invalid_field_error_status, webauthn_setup_param, webauthn_invalid_setup_param_message) 501 end 502 503 webauthn_credential 504 end
# File lib/rodauth/features/webauthn.rb 250 def webauthn_update_session(webauthn_id) 251 set_session_value(authenticated_webauthn_id_session_key, webauthn_id) 252 end
# File lib/rodauth/features/webauthn.rb 440 def webauthn_user_ids_ds 441 db[webauthn_user_ids_table].where(webauthn_user_ids_account_id_column => webauthn_account_id) 442 end
# File lib/rodauth/features/webauthn.rb 328 def webauthn_user_name 329 (account || account_from_session)[login_column] 330 end