…mpat * feat: Support Traceable Sessions * refactor: address PR devise-security#442 review feedback - Extract side effects from allow_limitable_authentication? into evict_oldest_session! (pure boolean method now) - Remove session_traceable_adapter indirection, use ActiveRecord associations directly (session_histories.find_by, .where, etc.) - Replace Timecop with ActiveSupport::Testing::TimeHelpers (travel_to, freeze_time) - Remove mocha dependency, use minitest stub - Add presence guard to update_traceable_token! (returns nil if token not found) - Rename update_traceable_token → update_traceable_token! and expire_session_token → expire_session_token! (bang for mutations) - Improve YARD documentation on all public methods - Use efficient SQL queries instead of loading all records into memory for deactivate_expired_sessions! Original PR by itsmechlark, review feedback from dillonwelch. Authored by: Aaron Lippold<lippold@gmail.com> * fix: sqlite3 compat, Devise 5 i18n, sign_out mapping, constantize bug - Gemfile: sqlite3 ~> 1.4 (Rails 7.0 compat, was ~> 2.8) - Regenerate Gemfile.lock for arm64-darwin platform - Fix double constantize in log_traceable_session! (class already resolved) - Fix captcha tests: Devise 5 lowercased authentication_keys in messages - Fix session_limitable sign_out test: pass user arg for scope resolution - Fix traceable workflow: use regex match for i18n message flexibility All 191 tests pass, 0 failures, 0 errors. Authored by: Aaron Lippold<lippold@gmail.com> * fix: use env-based skip for session_limitable and session_traceable hooks Align with Devise's canonical pattern (env['devise.skip_<module>']) instead of session-stored flags. This allows controllers and ActionCable connections to skip session checks by setting request env vars. Fixes devise-security#421, addresses devise-security#375. - session_limitable login hook: check env['devise.skip_session_limitable'] - session_limitable fetch hook: replace session-stored flag with env check - session_traceable login hook: check env['devise.skip_session_traceable'] - Remove dead options[:skip_session_limitable] code path - Add 4 integration tests for env-based skip behavior Authored by: Aaron Lippold<lippold@gmail.com> * fix: update updated_at when setting unique_session_id update_unique_session_id! now touches updated_at alongside the session id using update_all, still skipping validations and callbacks. Fixes devise-security#350. Authored by: Aaron Lippold<lippold@gmail.com> * docs: add YARD documentation to hooks and SessionHistory models - hooks/session_limitable.rb: module-level docs, per-hook block docs - hooks/session_traceable.rb: module-level docs, per-hook block docs - models/active_record/session_history.rb: class-level docs with fields - models/mongoid/session_history.rb: class-level docs with fields Authored by: Aaron Lippold<lippold@gmail.com> * feat: add per-module migration generators for all modules Implements devise-security#295. Each module that needs DB changes now has its own generator invocable as: rails generate devise_security:<module> [MODEL] Generators: - session_limitable — adds unique_session_id to users - session_traceable — creates session_histories table - password_expirable — adds password_changed_at to users - expirable — adds last_activity_at, expired_at to users - paranoid_verification — adds verification columns to users - password_archivable — creates old_passwords table - security_questionable — adds question columns + creates security_questions DRY design: ModuleMigrationGenerator base class with declarative columns/tables/indexes class methods. One shared add_columns.rb.erb template renders all "add column" migrations. MODEL argument defaults to 'user', supports custom models (e.g., admin). 13 tests covering all generators including idempotency and custom models. Authored by: Aaron Lippold<lippold@gmail.com> * chore: update Ruby 3.2.6 to 3.4.8, update Gemfile.lock Authored by: Aaron Lippold<lippold@gmail.com> * refactor: DRY and document all Warden hooks - Add YARD documentation to all hook files - Consistent guard clause patterns across hooks - Document env-based skip mechanism Authored by: Aaron Lippold<lippold@gmail.com> * feat: make configs dynamic in all modules (devise-security#357) Add instance-level accessors that delegate to class config for: - Expirable: expire_after, delete_expired_after - ParanoidVerification: paranoid_code_regenerate_after_attempt, verification_code_generator - PasswordExpirable: expire_password_after Enables per-record config overrides (e.g., admin? ? 5.days : 90.days). Adds 19 tests covering delegation and dynamic override behavior. Authored by: Aaron Lippold<lippold@gmail.com> * docs: YARD documentation for all model modules Add @param, @return, @see, @deprecated tags to: - compatibility.rb - database_authenticatable_patch.rb - security_questionable.rb Authored by: Aaron Lippold<lippold@gmail.com> * fix: upstream issues devise-security#351, devise-security#449, devise-security#453 - devise-security#351: Guard nil login_attribute in secure_validatable. Handle both Array and Hash authentication_keys (matching Devise core pattern). Raise clear error on empty keys. Extract secondary_authentication_keys helper. (3 tests) - devise-security#449: Fix expired_for scope to include inactivity-expired users. Previously only matched manually expired (expired_at set). Now also matches users whose last_activity_at exceeds expire_after + time. (6 tests) - devise-security#453: Support Proc values for deny_old_passwords and password_archiving_count. Procs resolved via instance_exec for per-record logic (e.g., role-based archiving). (8 tests) - Fix test isolation bug: test_password_archivable.rb permanently reopened ::User to define archive_count without cleanup, causing intermittent failures in other test files. Authored by: Aaron Lippold<lippold@gmail.com> * fix: expose @minimum_password_length for secure_validatable (devise-security#290) Patch DeviseController#set_minimum_password_length to also check secure_validatable? and set @minimum_password_length and @minimum_password_complexity for views. 4 tests. Authored by: Aaron Lippold<lippold@gmail.com> * feat: throttle update_last_activity! to reduce DB writes (devise-security#494) Add last_activity_update_interval config to skip redundant writes when timestamp is recent enough. Default nil (no throttling) for backward compatibility. Supports Proc for per-record intervals. 10 tests. Authored by: Aaron Lippold<lippold@gmail.com> * docs: document email validation + clear error message (devise-security#339) Rewrite README email validation section with working examples. Add RuntimeError with actionable message when EmailValidator class is missing (replaces cryptic NameError). 3 tests. Authored by: Aaron Lippold<lippold@gmail.com> * fix: detect scoped uniqueness validators in secure_validatable (devise-security#448) Initialize already_validated_email based on existing validators so pre-existing scoped uniqueness validations (e.g., scope: :project_id) are respected and not duplicated. 4 tests. Authored by: Aaron Lippold<lippold@gmail.com> * fix: restore validators_on(:password) discoverability (devise-security#441) Replace validate-do blocks with class-level EachValidator wrappers (PasswordLengthValidator, PasswordComplexityDelegator) that register on :password attribute while preserving per-record dynamic config. 7 tests. Authored by: Aaron Lippold<lippold@gmail.com> * feat: require current password for email change (devise-security#359) Add require_password_on_email_change config to SecureValidatable. When enabled, email changes require current_password verification. Supports Proc for per-record resolution. Default false. 8 tests. Authored by: Aaron Lippold<lippold@gmail.com> * feat: time-based password archive denial (devise-security#141) Add deny_old_passwords_period config for time-based password reuse prevention (e.g., 3.months). Takes precedence over count-based deny_old_passwords when set. Supports Proc. Default nil. 8 tests. Authored by: Aaron Lippold<lippold@gmail.com> * refactor: add missing instance methods + Proc support Add timeout_in instance method to SessionLimitable. Add Proc support via instance_exec to max_active_sessions, reject_sessions, timeout_in. Replace delegate calls in SecureValidatable with explicit methods supporting Proc. Add require_password_on_email_change instance method. Authored by: Aaron Lippold<lippold@gmail.com> * refactor: standardize hook guards + extract test helpers Standardize all Warden hooks to use devise_modules.include? as primary guard (matching session_traceable/limitable). Extract clear_devise_class_vars and set_password helpers to test_helper.rb, removing 17+ duplicate calls. Authored by: Aaron Lippold<lippold@gmail.com> * docs: YARD documentation for controllers, routes, patches, configs Document all public methods in controllers/helpers.rb, routes.rb, patches.rb, controller_security_question.rb. Convert 22 mattr_accessor inline comments to @!attribute YARD format. Document Engine class and expand security_questionable module docs. Authored by: Aaron Lippold<lippold@gmail.com> * chore: migrate test suite to FactoryBot (devise-security#445) Add factory_bot dependency, create factories for all 7 user model variants with sequences for unique emails/usernames. Migrate ~80 direct User.create/User.new calls to FactoryBot create/build syntax. Update helpers to delegate to FactoryBot. Mongoid support TODO. Authored by: Aaron Lippold<lippold@gmail.com> * ci: add RuboCop and Brakeman workflows (devise-security#336, devise-security#335) Add GitHub Actions workflows for RuboCop (with --format github for inline PR annotations) and Brakeman (with SARIF upload to Code Scanning). Replaces CodeClimate dependency. Authored by: Aaron Lippold<lippold@gmail.com> * ci: split ruby-head/rails-head to nightly workflow (devise-security#346, devise-security#330, devise-security#347) Remove ruby head from main test matrix so experimental failures don't block PRs. Create nightly workflow with ruby-head, rails-head (from git main), and mongoid+ruby-head (continue-on-error for investigation). Add rails_main.gemfile for Rails head testing. Authored by: Aaron Lippold<lippold@gmail.com> * style: rubocop autocorrect + config for CI-clean runs - Run rubocop --autocorrect-all across entire codebase - Update .rubocop.yml with sensible exclusions for upstream code: - Disable ClassAndModuleChildren (breaks constant resolution) - Disable ClassVars (Mongoid pattern) - Exclude test files from metrics/naming cops - Raise ABC/complexity thresholds to match existing code - Add workflow_dispatch trigger to all CI workflows - 0 offenses, 295 tests passing, 98.95% coverage Authored by: Aaron Lippold<lippold@gmail.com> * fix: add x86_64-linux platform to Gemfile.lock for CI Authored by: Aaron Lippold<lippold@gmail.com> * fix: install libmagickwand-dev in RuboCop and Brakeman CI workflows rmagick gem requires ImageMagick native libraries to compile. Authored by: Aaron Lippold<lippold@gmail.com> * fix: add protect_from_forgery to test dummy ApplicationController Resolves Brakeman CSRF warning in CI. Authored by: Aaron Lippold<lippold@gmail.com> * fix: guard AR-only test code for Mongoid compatibility - test_email_validation_error: guard self.table_name with ORM check - test_secure_validatable_scoped_uniqueness: wrap in AR-only guard (scoped uniqueness with SQL columns is AR-specific) Authored by: Aaron Lippold<lippold@gmail.com> * fix: use ApplicationUserRecord for ORM-agnostic test models Replace ApplicationRecord with ApplicationUserRecord in test files so they work under both ActiveRecord and Mongoid ORMs. ApplicationUserRecord handles table_name/collection mapping per ORM. Authored by: Aaron Lippold<lippold@gmail.com> * fix: Mongoid compatibility for password_archivable, session_traceable, session_limitable Production code: - password_archivable: use range syntax (.where(created_at: period.ago..)) instead of AR-only SQL string (.where('created_at > ?', ...)) - session_traceable: use .where(...).first instead of find_by (which raises DocumentNotFound on Mongoid instead of returning nil) - session_traceable: rescue Mongoid::Errors::MongoidError in addition to ActiveRecord::ActiveRecordError for duplicate token handling - session_limitable: use .each instead of .find_each (Mongoid Criteria does not support find_each) Test code: - test_expired_for_scope: use ORM-agnostic update helper (update_columns for AR, set for Mongoid) - test_secure_validatable_hash_auth_keys: wrap in AR-only guard (uses anonymous Class.new(ApplicationRecord) with table_name) Authored by: Aaron Lippold<lippold@gmail.com> * fix: Mongoid compatibility for expirable expired_for scope - expirable.rb: use ORM-conditional query — AR uses raw SQL with named params, Mongoid uses any_of with hash criteria - test_dynamic_configs: fix assert_nil deprecation warnings Authored by: Aaron Lippold<lippold@gmail.com> * fix: verify_code always returned truthy, masking failed verifications verify_code used update_without_password which returns truthy regardless of whether the code was correct. The controller's failure branch was unreachable. Now returns explicit true/false and adds an error on the resource so respond_with renders :show instead of redirecting. Added missing 'incorrect' i18n key to all 20 locale files. Authored by: Aaron Lippold<lippold@gmail.com> * refactor: remove dead code for Rails < 5.1 and Rails < 7.1 Removed AR < 5.1 compat methods from active_record_patch.rb (gem requires Rails 7.0+). Removed Rails < 5 engine branch from rails.rb. Removed Rails < 7.1 migration API branch from test helper. Simplified password_expirable to use only will_save_change_to_ API. Authored by: Aaron Lippold<lippold@gmail.com> * test: add 19 tests, improve coverage from 98.8% to 99.72% - expirable: expire!, inactive_message, mark_expired (7 tests) - paranoid_verification: verify_code return values (3 tests) - password_archivable: max_old_passwords, archive destroy_all (3 tests) - paranoid_verification_code_controller: wrong code path (1 test) - captcha/security_question controller helpers (4 tests) - secure_validatable: validate_email_uniqueness? default (1 test) - Removed unused helpers: valid_new_attributes, clear_cached_variables Authored by: Aaron Lippold<lippold@gmail.com> * docs: update README and initializer for session_traceable + new configs - Module count 7 to 8, added session_traceable to devise example - Per-module migration generators section with model argument - session_traceable schema (session_histories table) - 5 new config options in README and initializer template: max_active_sessions, session_ip_verification, last_activity_update_interval, deny_old_passwords_period, require_password_on_email_change - Dynamic per-record configuration section with example Authored by: Aaron Lippold<lippold@gmail.com> * ci: consolidate workflows with fail-fast lint gate Merged rubocop.yml + brakeman.yml + test_suite.yml into single ci.yml. Tests now depend on lint jobs (needs: [rubocop, brakeman]) so 31 matrix jobs don't run if linting fails. Consolidated 3 copy-pasted nightly jobs into one with explicit matrix. Updated CodeQL actions from v2/v3 to v3/v4. Updated Coveralls to v2. Authored by: Aaron Lippold<lippold@gmail.com> * docs: add CHANGELOG.md with Keep a Changelog format and release automation - CHANGELOG.md with all Unreleased changes documented - Changelog enforcer in CI: PRs must update CHANGELOG.md (skips dependabot) - Release workflow: on tag push, extracts changelog entry for GitHub Release body, then auto-commits the version header update back to main - Updated gemspec changelog_uri to point to CHANGELOG.md Authored by: Aaron Lippold<lippold@gmail.com> * fix: install libmagickwand-dev before bundler-cache in lint jobs rmagick (via easy_captcha) needs ImageMagick headers at bundle install time. Also updated CodeQL actions from v3 to v4 (v3 deprecated Dec 2026) and Brakeman SARIF upload to v4. Authored by: Aaron Lippold<lippold@gmail.com> * fix: resolve RuboCop offenses in test files Replace OpenStruct with Struct in captcha controller tests (Style/OpenStructUse). Use assert_predicate in paranoid verification controller test (Minitest/AssertPredicate). Authored by: Aaron Lippold<lippold@gmail.com> * style: migrate RuboCop config from require to plugins rubocop-rails and rubocop-minitest now support the plugins API. Eliminates deprecation warnings on every RuboCop run. Authored by: Aaron Lippold<lippold@gmail.com> * chore: add Lefthook git hooks and EditorConfig Lefthook pre-commit: RuboCop on staged files, YAML syntax validation, changelog format check. Pre-push: Brakeman + full test suite. EditorConfig: 2-space indent, UTF-8, LF, trim trailing whitespace. Authored by: Aaron Lippold<lippold@gmail.com> * docs: add CONTRIBUTING.md, SECURITY.md, update gemspec CONTRIBUTING.md: setup, Lefthook, testing, PR checklist, changelog format, release process. SECURITY.md: vulnerability reporting via GitHub Security Advisories, response timeline, coordinated disclosure. Gemspec updated to include CHANGELOG.md, CONTRIBUTING.md in gem files. Authored by: Aaron Lippold<lippold@gmail.com> --------- Co-authored-by: Clark Sumatra <clark@sumatra.com.ph>

Uh oh!

Add configuration to require any changes to email to require knowing the current password #359

Description

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions