Commit graph

129 commits

Author SHA1 Message Date
325b52eca0
fix(Jwt): Include authentication interaction context when storing tokens. 2024-04-30 10:04:54 +12:00
Martin Schut
8721c01b4c
improvement(OIDC): Adjust dsl of OIDC reflect assent requirements (#538)
The OIDC implementation of assent requires the base_url to be set and ignores the different *_url attributes. At favours the returned configuration from the openid_configuration_uri. To not configure some unused attributes they're removed.
2024-04-12 09:22:58 +12:00
85700b37d8 feat!: Sign in tokens are enabled by default for the password strategy. 2024-04-10 12:08:54 +12:00
03b38bdcb4 feat!: Tokens are now enabled by default. 2024-04-10 12:08:54 +12:00
d697e0313d
fix(Strategy.Password): Reset tokens are single use. (#625)
When a token is successfully used to reset a password then it is immediately revoked so that it cannot be used again.

Closes #624.
2024-04-10 11:26:55 +12:00
59918e49a4
improvement: Use Ash functions instead of generated domain functions. 2024-04-09 15:43:10 +12:00
c22439f48f
fix(Confirmation): Only allow the confirmation token to be used once. (#623)
Fixes a potential issue where the confirmation token can be used multiple times, potentially opening a replay attack.

Closes #618
2024-04-09 09:32:37 +12:00
ea3ff3b00e
fix(Jwt): Ignore pre-release versions verifying token versions. 2024-03-28 15:06:05 +13:00
f0075e2cd3
improvement!: Update to support Ash 3.0. (#599) 2024-03-28 14:44:23 +13:00
Dmitrii Maganov
bb81521d6c improvement: infer api from a resource 2024-03-11 16:07:24 +13:00
Jean-Luc Geering
8163b178f7
docs: better Plug.Router example (#566) 2024-02-22 07:11:32 -05:00
M.Yasoob Ullah Khalid ☺
2dde760d31
improvement: support atom keys for uid in addition to strings (#556) 2024-01-25 10:50:08 -05:00
Zach Daniel
ba44d56820 docs: update ex_doc, overhaul underlying doc structure
docs: make all DSL docs one liners (now required by spark)
2024-01-12 16:30:27 -05:00
Rebecca Le
d360117c2a
docs: Fix broken link to Auth0 quick-start guide 2023-12-06 11:02:04 +08:00
Rebecca Le
739a544651
docs: Add new Testing guide
It's pretty bare-bones at the moment, but does close #476 by mentioning
that `bcrypt_elixir` can be tweaked for faster tests
2023-12-06 10:47:07 +08:00
dependabot[bot]
408a28ccf4
chore(deps): Bump assent from 0.2.7 to 0.2.8 (#506)
* chore(deps): Bump assent from 0.2.7 to 0.2.8

Bumps [assent](https://github.com/pow-auth/assent) from 0.2.7 to 0.2.8.
- [Release notes](https://github.com/pow-auth/assent/releases)
- [Changelog](https://github.com/pow-auth/assent/blob/main/CHANGELOG.md)
- [Commits](https://github.com/pow-auth/assent/compare/v0.2.7...v0.2.8)

---
updated-dependencies:
- dependency-name: assent
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore(OAuth2): Reflect `assent` `site` -> `base_url` change.

I considered just rewriting it behind the scenes, but I think it's probably better in the long run if we just emit a deprecation.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: James Harton <james@harton.nz>
2023-11-22 10:49:07 +13:00
Rebecca Le
199f3d6a83
docs: Add missing ends to examples in OAuth2 module docs
Closes #266
2023-11-13 14:00:46 +08:00
James Harton
0f6e677e4b
docs: fix incorrect username in example. (#496)
Closes #460.
2023-10-30 09:54:33 +13:00
Lars Wikman
a4f68eb9e0
feat: Add Google strategy (#474)
* feat: Add Google strategy

* fix: include Google strategy cheat sheet

* fix: Add documentation grouping for Google strategy

* chore: update formatter.

---------

Co-authored-by: James Harton <james@harton.nz>
2023-10-26 12:44:56 +13:00
Lars Wikman
8a623ff6b0
improvement: Change redirect_uri secret to be more flexible (#473)
Applies to both OAuth2 and OpenID Connect.

With this the developer can provide either the full
URL or the URL up to the AuthPlug path. If the suffix
is already there we won't add it again.

Should make it easier to get it on the first try.
2023-10-26 11:48:23 +13:00
Lars Wikman
5f5e8a6b27
fix: Change overwriting of refresh_token to not overwrite them with nil (#483) 2023-10-26 11:11:38 +13:00
Lars Wikman
625e0e6634
improvement: Add id as an option for sourcing uid for UserIdentity (#481) 2023-10-26 11:09:54 +13:00
Lars Wikman
e122999e53
docs: Fix missing piece of module path in doc example (#471) 2023-10-14 15:59:25 -04:00
Zach Daniel
82c6b6ef15 chore: remove doc_indexes 2023-09-26 23:43:36 -04:00
Zach Daniel
c8b13f8aac docs: update spark/ex_doc for improved docs 2023-09-26 23:26:44 -04:00
Zach Daniel
a6798d56fb fix: ensure we aren't calling Map.take on nil 2023-09-22 07:34:53 -04:00
James Harton
6de08ac9a9
fix(TokenResource): don't silently drop notifications about token removal. (#432)
Closes #420.
2023-09-22 13:48:47 +12:00
7b607896eb
improvement: Allow all token lifetimes to be specified with a time unit.
Now any DSL option which allows the configuring of a token lifetime
can take _either_ a positive integer in it's previous default unit
or a tuple containing a positive integer and a unit.

Closes #376.

Additionally includes switching the resettable entity to being a singleton since that
feature didn't exist when I started.
2023-09-22 12:15:47 +12:00
Tun Cham Roeun
ae2957c024
fix: deprecated mint httpadapter (#425) 2023-09-20 14:10:21 +12:00
Alan Heywood
ee7c0db007
improvement: assign the token record to the connection assigns (#426) 2023-09-20 14:08:57 +12:00
Zach Daniel
62d458f629
fix: only use sign in token expiration for sign in tokens (#424) 2023-09-19 10:16:37 +12:00
Zach Daniel
e9ae747de7
improvement: support generating sign in tokens on register (#421)
* improvement: support generating sign in tokens on register

* chore: run formatter.

* fix: support generating tokens for other strategies.

---------

Co-authored-by: James Harton <james@harton.nz>
2023-09-17 19:36:20 -04:00
Dmitry Maganov
d5b7a42383
fix: correct spec for Jwt.token_for_user (#389) 2023-08-17 09:17:27 +12:00
James Harton
3230c26bd8
fix: ensure that the current_ atom exists at compile time. (#359)
Fixes #358.
2023-07-14 13:50:53 +12:00
James Harton
12d54fa672
docs: Fix double-docs problem on ash-hq (it's actually a code issue). (#353) 2023-07-14 09:07:39 +12:00
Alan Heywood
c0e258b557
fix: fix Logger deprecations for elixir 1.15 (#343)
Use Logger.warning instead of Logger.warn, which is deprecated
2023-06-23 15:11:39 +12:00
James Harton
0f9448c5dc
chore: Add sobelow and mix_audit to CI. (#337) 2023-06-19 10:44:07 +12:00
James Harton
1d1be6ef11
fix(ConfirmationHookChange): use Info.find_strategy/2..3 rather than a hard coded strategy name. (#336)
Changes:

1. Extracted `find_strategy/2..3` from a bunch of places across the codebase and moved into `Info`.
2. Updated `ConfirmationHookChange` to use `find_strategy/2..3`.

Closes #334.
2023-06-19 10:33:45 +12:00
James Harton
2784c52f2d
fix: primary keys are implicitly uniquely constrained. (#333)
Closes #332.
2023-06-15 12:30:26 +12:00
James Harton
39d25cadea
fix(Strategy.Password): Preparations should allow strategy to be passed in. (#314)
Basically a copy-pasta of the `find_strategy/3` function from `HashPasswordChange` to allow for the strategy to be passed in via the context(s) or preparation options.
2023-05-29 10:54:32 +12:00
Thomas Rodriguez
1c011fd762
fix: correct oauth2 and getting started typos (#267) 2023-05-05 09:12:32 +12:00
James Harton
53ff256391
feat: OpenID Connect Strategy (#197)
* feat(AshAuthentication.Strategy.Oidc): Add OpenID Connect strategy.

* chore(CI): disable the workflow on pull request event, since it's covered by push.
2023-05-04 13:15:24 +12:00
Robert Graff
2c4d8b296f
fix: PasswordValidation should associate errors with the field being … (#279) 2023-04-28 15:20:02 -04:00
Zach Daniel
eca8cadea0
improvement: add sign in tokens to password strategy (#252)
* improvement: add sign in tokens to password strategy

* chore: update `.formatter.exs`.

* chore: fix credo warnings.

* improvement: convert `sign_in_with_token` into an action.

---------

Co-authored-by: James Harton <james@harton.nz>
2023-04-06 14:53:44 +12:00
Zach Daniel
e99dc1a950
improvement: use tenant in retrieve_from_session/3 (#229)
* improvement: use tenant in `retrieve_from_session/3`

* chore: cleanup
2023-03-13 10:34:41 +13:00
quartz
f8d6a0d06f
fix: respect identity_relationship_user_id_attribute on Strategy.OAuth2.IdentityChange (#213) 2023-03-07 10:42:32 +13:00
Zach Daniel
7f1c9678e4
feat!: Configure accepted fields on register (#219) 2023-03-04 01:44:34 -05:00
James Harton
1ec7a8f7f0
improvement: allow registration and sign in to be disabled on password strategies. (#218) 2023-03-02 12:33:31 +13:00
Britton Broderick
34f3270707
docs: Updates confirmation docs with sender and identities (#214) 2023-03-01 09:51:43 +13:00
Zach Daniel
3274087429
improvement: support multiple otp apps w/resources (#209) 2023-02-23 02:39:27 -05:00