jeremyevans / rodauth

Ruby's Most Advanced Authentication Framework
http://rodauth.jeremyevans.net
MIT License
1.69k stars 95 forks source link

Ensure roda class is assigned before calling `#post_configure` #190

Closed janko closed 2 years ago

janko commented 2 years ago

It's possible to define named auth classes separately from plugin initialization, and configure the features directly via Rodauth::Auth.configure. Most features work just fine without roda class being assigned, but internal_request feature needs that when creating the internal auth subclass in #post_configure. Third-party plugins might rely on this too, some may even try to load Roda plugins.

To ensure roda class is always assigned, we call #post_configure only in the roda plugin's configure method. That way it will be called only after the auth class is has been registered on the Roda app. We check that #post_configure is defined, as it might not be when registering an auth class without yet calling its .configure method.

class RodauthMain < Rodauth::Auth
  configure do
    enable :internal_request
  end
end

class RodauthApp < Roda
  plugin :rodauth, auth_class: RodauthMain
end

RodauthMain.account_exists?(login: "user@example.com")
# BEFORE: fails when trying to initialize the roda class
# AFTER: works without any issues

While here, I've simplified the spec for assigning internal class into a constant, since it had to work around this issue. In that spec we didn't need to name the auth class anymore after https://github.com/jeremyevans/rodauth/commit/1ddefd92ac7b81ff15a8ecf0f46a4217873cbb3e.

This is a follow-up to this discussion.

jeremyevans commented 2 years ago

This looks good on initial review. I'll try to merge and test this tomorrow.