Merge branch 'main' into ms-standard

README.md

@@ -3,7 +3,6 @@
 [![Build Status](https://github.com/thoughtbot/clearance/actions/workflows/tests.yml/badge.svg)]( https://github.com/thoughtbot/clearance/actions/workflows/tests.yml?query=branch%3Amain)
 [![Code Climate](https://codeclimate.com/github/thoughtbot/clearance.svg)](https://codeclimate.com/github/thoughtbot/clearance)
 [![Documentation Quality](https://inch-ci.org/github/thoughtbot/clearance.svg?branch=main)](https://inch-ci.org/github/thoughtbot/clearance)
-[![Reviewed by Hound](https://img.shields.io/badge/Reviewed_by-Hound-8E64B0.svg)](https://houndci.com)
 
 Rails authentication with email & password.
 
@@ -63,7 +62,7 @@ Clearance.configure do |config|
   config.url_after_denied_access_when_signed_out = nil
   config.rotate_csrf_on_sign_in = true
   config.same_site = nil
-  config.secure_cookie = false
+  config.secure_cookie = Rails.configuration.force_ssl
   config.signed_cookie = false
   config.sign_in_guards = []
   config.user_model = "User"
@@ -497,4 +496,19 @@ redistributed under the terms specified in the [`LICENSE`] file.
 [`LICENSE`]: /LICENSE
 
 <!-- START /templates/footer.md -->
+## About thoughtbot
+
+![thoughtbot](https://thoughtbot.com/thoughtbot-logo-for-readmes.svg)
+
+This repo is maintained and funded by thoughtbot, inc.
+The names and logos for thoughtbot are trademarks of thoughtbot, inc.
+
+We love open source software!
+See [our other projects][community].
+We are [available for hire][hire].
+
+[community]: https://thoughtbot.com/community?utm_source=github
+[hire]: https://thoughtbot.com/hire-us?utm_source=github
+
+
 <!-- END /templates/footer.md -->

SECURITY.md

@@ -0,0 +1,16 @@
+# Security Policy
+
+## Supported Versions
+
+We will provide security updates for the latest 3 versions.
+
+| Version | Security updates |
+| - | - |
+| 2.7.x   | ✅ |
+| 2.6.x   | ✅ |
+| 2.5.x   | ✅ |
+| < 2.5.0 | :x: |
+
+## Reporting a Vulnerability
+
+You can contact <[email protected]>. See <https://thoughtbot.com/security> for more information about our security policy.

lib/clearance.rb

@@ -1,13 +1,13 @@
-require "clearance/configuration"
-require "clearance/sign_in_guard"
-require "clearance/session"
-require "clearance/rack_session"
-require "clearance/back_door"
-require "clearance/controller"
-require "clearance/user"
-require "clearance/engine"
-require "clearance/password_strategies"
-require "clearance/constraints"
+require 'clearance/configuration'
+require 'clearance/sign_in_guard'
+require 'clearance/session'
+require 'clearance/rack_session'
+require 'clearance/back_door'
+require 'clearance/controller'
+require 'clearance/user'
+require 'clearance/password_strategies'
+require 'clearance/constraints'
+require 'clearance/engine'
 
 module Clearance
 end

lib/clearance/engine.rb

@@ -1,4 +1,3 @@
-require "clearance"
 require "rails/engine"
 
 module Clearance

lib/clearance/user.rb

@@ -150,7 +150,7 @@ module Validations
 
       included do
         validates :email,
-          email: {strict_mode: true},
+          email: { mode: :strict },
           presence: true,
           uniqueness: {allow_blank: true, case_sensitive: true},
           unless: :email_optional?

spec/models/user_spec.rb

@@ -5,15 +5,16 @@
   it { is_expected.to have_db_index(:remember_token) }
   it { is_expected.to validate_presence_of(:email) }
   it { is_expected.to validate_presence_of(:password) }
-  it { is_expected.to allow_value("foo;@example.com").for(:email) }
-  it { is_expected.to allow_value("[email protected]").for(:email) }
-  it { is_expected.to allow_value("[email protected]").for(:email) }
   it { is_expected.to allow_value("[email protected]").for(:email) }
   it { is_expected.to allow_value("[email protected]").for(:email) }
   it { is_expected.to allow_value("[email protected]").for(:email) }
   it { is_expected.not_to allow_value("example.com").for(:email) }
   it { is_expected.not_to allow_value("foo").for(:email) }
   it { is_expected.not_to allow_value("foo@").for(:email) }
+  it { is_expected.not_to allow_value("foo@bar").for(:email) }
+  it { is_expected.not_to allow_value("foo;@example.com").for(:email) }
+  it { is_expected.not_to allow_value("[email protected]").for(:email) }
+  it { is_expected.not_to allow_value("[email protected]").for(:email) }
 
   describe "#email" do
     it "stores email in down case and removes whitespace" do