Rodauth 2.38.0 Released

[jeremyevans]

Rodauth 2.38.0 has been released!

New Features

• Rodauth now automatically supports fixed locals in templates if
  using Roda 3.88+ and Tilt 2.6+. This allows you to use the
  Roda default_fixed_locals: '()' template option without breaking
  Rodauth. If the default fixed locals support breaks your Rodauth
  configuration, such as if you are overriding Rodauth templates
  and modifying the local variables they accept, you can disable
  the use of fixed locals in your Rodauth configuration:

    use_template_fixed_locals? false

• Rodauth::ConfigurationError has been added, and issues that
  Rodauth believes are configuration errors now use this
  exception class.

Other Improvements

• The following methods are now public:

  • has_password?
  • email_auth_email_recently_sent?
  • unlock_account_email_recently_sent?
  • reset_password_email_recently_sent?
  • verify_account_email_recently_sent?

  This makes it supported to call these methods and use the result
  in your own code.

• The verify-account-resend page now works if
  verify_account_resend_explanatory_text calls
  verify_account_email_recently_sent?. Rodauth does not do that
  by default, but if you override
  verify_account_resend_explanatory_text to use different text
  depending on whether the email was recently sent, direct
  navigations to the verify-account-resend page previously failed.

• Rodauth now uses JWT.gem_version to check the JWT gem version, which
  works with JWT 2.10.0. JWT 2.10.1 restored the constants Rodauth
  used to check the version, but this allows the JWT to remove
  such constants again in the future without breaking Rodauth.

Backwards Compatibility

• The change to use Rodauth::ConfigurationError can break code that
  rescued other exception classes, such as ArgumentError,
  RuntimeError, or NotImplementedError.

Best,
Jeremy

[aguynamedben]

@jeremyevans Very rad. This project seems very active. Any reason I should NOT use it for a new Rails app? Seems like you're doing killer work, I've just always used Devise before and wanted to send out an "is this thing on?" Seems like a project that will have success for years down the road...? :)

[jeremyevans]

I cannot speak directly to Rails support, but I know @janko runs https://github.com/janko/rodauth-rails and keeps it up-to-date with changes in Rodauth. As far I know, there are many users running Rodauth with Rails using rodauth-rails. I would guess that more than half of Rodauth's usage is via rodauth-rails, looking at the download numbers. I don't have any personal experience running a production Rails up with Rodauth, though.

[janko]

Any reason I should NOT use it for a new Rails app?

For a new Rails app, I see very little reason not to. It does bring new abstraction layers – Roda and Sequel – but I think the source code is very readable, should you ever need to debug things or find out what exactly Rodauth does. I studied Devise code a lot while building out rodauth-rails, and I find it very difficult to follow code execution there, even though it's "pure Rails" (aside from Warden and ORM Adapter).

I don't see any future for Devise, it hasn't seen new features in several years, I think its technical debt is just too baked in at this point. Some folks consider Devise "done", but the authentication area is continuously developing (e.g. passkeys), and community efforts like making password optional typically die out.

As for the Rails 8 authentication generator, it's very basic, it doesn't even include registration + account verification code. But it's good for people that prefer not to delegate auth to a framework.

Rodauth continues to be very active. My every attempt to making DX and UX smoother has been accepted an even improved upon by Jeremy. It's already the most advanced authentication framework for Ruby, so I think it's an excellent choice for new apps.

[aguynamedben]

Just an update - We're using it via rodauth-rails and it's VERY nice. I would highly recommend. The great docs for rodauth and rodauth-rails also make it very easy to hook up things like OmniAuth. RodAuth seems to do a great job of taking care of auth in a clear way that is easy to work with.

Thanks for the work you put into this library. We're loving it.