{"id":17826434,"url":"https://github.com/sinaptia/active_authentication","last_synced_at":"2025-03-18T23:31:02.206Z","repository":{"id":232656228,"uuid":"784775433","full_name":"sinaptia/active_authentication","owner":"sinaptia","description":"A pure Rails authentication solution","archived":false,"fork":false,"pushed_at":"2024-04-18T02:33:27.000Z","size":87,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-04-19T09:41:47.761Z","etag":null,"topics":["authentication","rails","ruby"],"latest_commit_sha":null,"homepage":"","language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sinaptia.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2024-04-10T14:31:15.000Z","updated_at":"2024-04-20T19:37:44.638Z","dependencies_parsed_at":"2024-04-20T19:49:27.944Z","dependency_job_id":null,"html_url":"https://github.com/sinaptia/active_authentication","commit_stats":null,"previous_names":["sinaptia/active_authentication"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sinaptia%2Factive_authentication","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sinaptia%2Factive_authentication/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sinaptia%2Factive_authentication/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sinaptia%2Factive_authentication/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sinaptia","download_url":"https://codeload.github.com/sinaptia/active_authentication/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243971180,"owners_count":20376784,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authentication","rails","ruby"],"created_at":"2024-10-27T18:47:52.135Z","updated_at":"2025-03-18T23:31:01.744Z","avatar_url":"https://github.com/sinaptia.png","language":"Ruby","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ActiveAuthentication\n\nA pure Rails authentication solution.\n\n## Main features\n\n* Pure Rails implementation, uses [has_secure_password](https://api.rubyonrails.org/classes/ActiveModel/SecurePassword/ClassMethods.html#method-i-has_secure_password), [generates_token_for](https://api.rubyonrails.org/classes/ActiveRecord/TokenFor/ClassMethods.html#method-i-generates_token_for), [find_by_token_for](https://api.rubyonrails.org/classes/ActiveRecord/TokenFor/ClassMethods.html#method-i-find_by_token_for) and [authenticate_by](https://api.rubyonrails.org/classes/ActiveRecord/SecurePassword/ClassMethods.html#method-i-authenticate_by).\n* ActiveAuthentication authenticates users and only users. If you need to authenticate other models you should be asking yourself if you shouldn't handle authorization differently.\n* Turn on/off the features you need by using concerns.\n\n### Concerns\n\n* Authenticatable: provides the standard email/password authentication. It's the only concern that can't be turned off.\n* Confirmable: allows users to confirm their email addresses.\n* Lockable: locks users after a number of failed sign in attempts.\n* MagicLinkable: allows users to sign in with a magic link.\n* Omniauthable: allows users to sign up and sign in using a third party service through Omniauth. Turned off by default.\n* Recoverable: allows users to reset their password.\n* Registerable: allows users to sign up and edit their profile.\n* Timeoutable: expires sessions after a period of inactivity. Turned off by default.\n* Trackable: tracks users sign in count, timestamps and ip addresses.\n\nPlanned concerns:\n\n* Invitable: to allow users to invite other users.\n\n## Installation\n\nAdd this line to your application's Gemfile:\n\n```ruby\ngem \"active_authentication\"\n```\n\nAnd then execute:\n\n```bash\n$ bundle\n```\n\nOr install it yourself as:\n\n```bash\n$ gem install active_authentication\n```\n\n## Usage\n\nAfter installing the gem, you need to generate the `User` model. To generate it, run:\n\n```bash\n$ rails generate active_authentication:install\n```\n\nThis command will generate the `User` model, add the `active_authentication` route, and generate an initializer (`config/initializers/active_authentication.rb`) where you can configure the concerns. By default, this command enables all concerns. If you want to use a subset of the concerns, you can specify them:\n\n```bash\n$ rails generate active_authentication:install confirmable\n```\n\nIn this example, only the confirmable concern will be enabled (along with authenticatable, which can't be turned off).\n\nYou will need to set up the default url options in your `config/environments/development.rb`:\n\n```ruby\nconfig.action_mailer.default_url_options = {host: \"localhost\", port: 3000}\n```\n\nAnd the `root` path in `config/routes.rb`.\n\nFinally, run `rails db:migrate`.\n\n### Concerns\n\nIf you look at the `User` model (in `app/models/user.rb`), you will notice there's only a sentence:\n\n```ruby\nclass User \u003c ApplicationRecord\n  authenticates_with :confirmable, :lockable, :recoverable, :registerable, :timeoutable, :trackable\nend\n```\n\nNotice that `:authenticatable` is not in the list. This is because you cannot turn it off.\n\nBy default, all concerns are turned on except omniauthable. But you can turn it on by adding it to the list, and similarly, you can turn any concern off by just removing them from the list. If you plan to not use any concerns, you can replace `authenticates_with` with `authenticates`.\n\n### Filters and helpers\n\nActiveAuthentication comes with filters and helpers you can use in your controllers and views.\n\nTo protect actions from being accessed by unauthenticated users, use the `authenticate_user!` filter:\n\n```ruby\nbefore_action :authenticate_user!\n```\n\nThen, to verify if there's an authenticated user, you can use the `user_signed_in?` helper.\n\nSimilarly, you can use `current_user` to access the current authenticated user.\n\nIf you want to close your application entirely, you can add the before action to your application controller, in conjunction with `active_authentication_controller?`, like this:\n\n```ruby\nbefore_action :authenticate_user!, unless: :active_authentication_controller?\n```\n\n### Omniauthable\n\nActiveAuthentication's implementation of OmniAuth allows you to sign in and/or sign up with your third party accounts or sign up with ActiveAuthentication and later connect your third party accounts to ActiveAuthentication's User. To accomplish this, ActiveAuthentication relies on an `Authentication` model which can be created with the `active_authentication:omniauthable` generator.\n\nTo set up the omniauthable concern you must configure your OmniAuth providers as you would do with plain OmniAuth. There's no OmniAuth config in ActiveAuthentication. For example, in `config/initializers/omniauth.rb` you would set the middleware:\n\n```ruby\nRails.application.config.middleware.use OmniAuth::Builder do\n  provider :facebook, ENV[\"FACEBOOK_APP_ID\"], ENV[\"FACEBOOK_APP_SECRET\"]\n  provider :google_oauth2, ENV[\"GOOGLE_CLIENT_ID\"], ENV[\"GOOGLE_CLIENT_SECRET\"]\n  # ... and any other omniauth strategies\nend\n```\n\nAnd then you need to run the omniauthable generator to generate the `Authentication` model:\n\n```bash\n$ rails g active_authentication:omniauthable\n```\n\nThe User model has many Authentication models associated, to allow you to connect your user with multiple third party services if required.\n\nBy adding the `:omniauthable` concern to your `User` model, the following routes will be added to your app:\n\n* `/auth/:provider` to redirect your users to the provider consent screen\n* `/auth/:provider/callback` to actually sign in/sign up with the given providers\n\nThe sign in and sign up views will show a link to sign in or sign up with each provider you configured if and only if you set the `ActiveAuthentication.omniauth_providers` setting in your ActiveAuthentication initializer.\n\n## Customization\n\n### Concerns configuration\n\nWhen you run the `active_authentication:install` generator, an initializer will be copied to your app at `config/initializers/active_authentication.rb`. There's a section per concern where you can configure certain aspects of their behavior.\n\n### Customize registration and profile params\n\nIf you add extra fields to your User model, you will likely want to allow users to fill in those fields upon registration or when editing their profile. By default, only email, password and password confirmation are allowed. To change this behavior, just add these lines to your `config/initializers/active_authentication.rb` file:\n\n```ruby\nActiveAuthentication.configure do |config|\n  config.profile_params = -\u003e(controller) {\n    controller.params.require(:user).permit(:first_name, :email, :last_name, :password, :password_confirmation) # first_name and last_name were added in this example\n  }\n  config.registration_params = config.profile_params\nend\n```\n\nWe believe that the configuration of a gem should be placed in just one place. For this gem, it's the initializer. The `profile_params` and `registration_params` take a lambda and that lambda receives a controller. Why a lambda? and why does it take a controller? We could have allowed the params to be just an array of symbols instead of the whole `params.require.permit` call, but in edge cases you might want to post-process the required params, or call tap, or whatever. And to be able to call `params.require.permit`, you need to run this lambda in the context of the registrations controller. That's why the lambda receives the controller.\n\n### Views\n\nThe default views are good enough to get you started, but you'll want to customize them sooner than later. To copy the default views into your app, run the following command:\n\n```bash\n$ rails generate active_authentication:views\n```\n\nIf you're not using all the concerns, you might want to copy only the views you need. To do that, you can use the `--views` (`-v`) option:\n\n```bash\n$ rails generate active_authentication:views -v sessions\n```\n\n### Omniauthable\n\nBy default, ActiveAuthentication stores the `provider`, `uid` and `auth_data` in the `Authentication` model. There are some cases where you want to store, for example, the first name and last name in the `User` model to avoid digging into the `auth_data` hash each time. Or if you have multiple authentications, you might want to pull first and last name on registration and later allow the user to change them. To pull that data from an Authentication object at sign up, you don't really need to change the controller, instead you can add a callback to your Authentication model, like this:\n\n```ruby\nclass Authentication \u003c ApplicationRecord\n  before_validation :update_user_attributes, if: -\u003e(auth) { auth.auth_data.present? \u0026\u0026 auth.user.present? }\n\n  private\n\n  def update_user_attributes\n    first_name, last_name = auth_data.dig(\"info\", \"first_name\"), auth_data.dig(\"info\", \"last_name\")\n\n    user.update first_name: first_name, last_name: last_name\n  end\nend\n```\n\nNote: this example assumes `first_name:string` and `last_name:string` have been added to the User model and are required. Optional first_name and last_name can be handled similarly.\n\n## Contributing\n\nYou can open an issue or a PR in GitHub.\n\n## License\n\nThe gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsinaptia%2Factive_authentication","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsinaptia%2Factive_authentication","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsinaptia%2Factive_authentication/lists"}