class Authenticate::Configuration
Attributes
Controls whether the “sign up” route, allowing creation of users, is enabled.
Defaults to `true`.
Set to `false` to disable user creation routes. The setting is ignored if routes are disabled.
@return [Boolean]
Strategy for authentication.
Available strategies:
-
:email - requires user have attribute :email
-
:username - requires user have attribute :username
Defaults to :email. To set to :username:
Configuration.configure do |config| config.authentication_strategy = :username end
Authenticate
is designed to authenticate via :email. Some support for username is included. Username still requires an :email attribute on your User
model.
Alternatively, you can plug in your own authentication class:
Configuration.configure do |config| config.authentication_strategy = MyFunkyAuthClass end
@return [Symbol or Class]
Time period to lock an account for if the user exceeds max_consecutive_bad_logins_allowed.
If set to nil, account is locked out indefinitely.
@return [ActiveSupport::CoreExtensions::Numeric::Time]
Determines what crypto is used when authenticating and setting passwords.
Defaults to {Authenticate::Model::BCrypt}.
At the moment Bcrypt is the only option offered.
Crypto
implementations must implement:
* match?(secret, encrypted) * encrypt(secret)
@return [Module match? encrypt]
Enable debugging messages. @private @return [Boolean]
Controls the 'from' address for Authenticate
emails. Set this to a value appropriate to your application.
Defaults to reply@example.com.
@return [String]
Number of consecutive bad login attempts allowed. Commonly called “brute force protection”. The user's consecutive bad logins will be tracked, and if they exceed the allowed maximum, the user's account will be locked. The length of the lockout is determined by [#bad_login_lockout_period].
Default is nil, which disables this feature.
Authenticate.configure
do |config|
config.max_consecutive_bad_logins_allowed = 4 config.bad_login_lockout_period = 10.minutes
end
@return [Integer]
Allow a session to 'live' for no more than the given elapsed time, e.g. 8.hours.
Defaults to nil, or no max session time.
If set, a user session will expire once it has been active for max_session_lifetime. The user session is invalidated and the next access will will prompt the user for authentication.
Authenticate.configure
do |config|
config.max_session_lifetime = 8.hours
end
@return [ActiveSupport::CoreExtensions::Numeric::Time]
An array of additional modules to load into the User
module.
Defaults to an empty array.
@return [Array]
Range requirement for password length.
Defaults to `8..128`.
@return [Range]
The default path Authenticate
will redirect signed in users to.
Defaults to `“/”`.
This can also be overridden for specific scenarios by overriding controller methods that rely on it. @return [String]
The time period within which the password must be reset or the token expires. If set to nil, the password reset token does not expire.
Defaults to `2.days`.
@return [ActiveSupport::CoreExtensions::Numeric::Time]
Rotate CSRF token on sign in if true.
Defaults to false, but will default to true in 1.0.
@return [Boolean]
Enable or disable Authenticate's built-in routes.
Defaults to 'true'.
If you disable the routes, your application is responsible for all routes.
You can deploy a copy of Authenticate's routes with `rails generate authenticate:routes`, which will also set `config.routes = false`.
@return [Boolean]
Invalidate the session after the specified period of idle time. If the interval between the current access time and the last access time is greater than timeout_in
, the session is invalidated. The user will be prompted for authentication again.
Defaults to nil, which is no idle timeout.
Authenticate.configure do |config| config.timeout_in = 45.minutes end
@return [ActiveSupport::CoreExtensions::Numeric::Time]
ActiveRecord model class name that represents your user. Specify as a String.
Defaults to '::User'.
To set to a different class:
Authenticate.configure do |config| config.user_model = 'BlogUser' end
@return [String]
Public Class Methods
# File lib/authenticate/configuration.rb, line 240 def initialize # Defaults @debug = false @cookie_name = 'authenticate_session_token' @cookie_expiration = -> { 1.year.from_now.utc } @cookie_domain = nil @cookie_path = '/' @secure_cookie = false @cookie_http_only = true @mailer_sender = 'reply@example.com' @redirect_url = '/' @rotate_csrf_on_sign_in = false @allow_sign_up = true @routes = true @reset_password_within = 2.days @modules = [] @user_model = '::User' @authentication_strategy = :email @password_length = 8..128 end
Public Instance Methods
Is the user sign up route enabled? @return [Boolean]
# File lib/authenticate/configuration.rb, line 288 def allow_sign_up? @allow_sign_up end
# File lib/authenticate/configuration.rb, line 297 def rotate_csrf_on_sign_in? rotate_csrf_on_sign_in end
@return [Boolean] are Authenticate's built-in routes enabled?
# File lib/authenticate/configuration.rb, line 293 def routes_enabled? @routes end
Actions allowed for :user resources (in routes.rb). If sign up is allowed, the [:create] action is allowed, otherwise []. @return [Array<Symbol>]
# File lib/authenticate/configuration.rb, line 282 def user_actions allow_sign_up? ? [:create] : [] end
# File lib/authenticate/configuration.rb, line 261 def user_model_class @user_model_class ||= user_model.constantize end
The key for accessing user parameters. @return [Symbol]
# File lib/authenticate/configuration.rb, line 274 def user_model_param_key return :user if @user_model == '::User' # avoid nil in generator user_model_class.model_name.param_key.to_sym end
The routing key for user routes. See `routes.rb`. @return [Symbol]
# File lib/authenticate/configuration.rb, line 267 def user_model_route_key return :users if @user_model == '::User' # avoid nil in generator user_model_class.model_name.route_key end