authentication-zero 2.10.0 → 2.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c0ad4048d0c9df83173acebd1bbf770f519a7bb2a8b5b45c7e9af3c268904052
-  data.tar.gz: 06a897ebfc48122cfaf151a49b7412ef13b098069eb3bc7a2a4c088bcc711c90
+  metadata.gz: 702b78645aff0919daf1e518101731363068e6aef74fac0591f3257b5bf6b7a3
+  data.tar.gz: d07d22eb48277537484ef5f5c1cd4fd78f65e65d739fb7031384e3a594248e3a
 SHA512:
-  metadata.gz: fd26a42853d553616f366e1ddc57439ce91ba039f2cf25a5d3c80be48a6b0f0e7fee6816ead70587780ebc8a358e74e53543c0b6438eb39d7baf818aacc5191c
-  data.tar.gz: 657bb45b7e9edfd6a036e9df9a2df41a2b2001199e65586d82548d7bd4ade28946be06ec3dbb28ba6fba100e275881c1a02dbb3de29b8546899393829b4cdc97
+  metadata.gz: 99224479fcc817abaeed4492a5a48d071e98e3e32fcea32ec56e77007031b186feb0978405e5ec5f90750cf434bc86a554df73dea88245aa6185f18a16d7d2e3
+  data.tar.gz: 344af675d6c106d41c3a34dc2fdd04d93ca6028c83bc5acda497791a70a220a7854455cb336345d00d9371b529b7581d64617f4c244b1c15182bf5a869ada997

data/.rubocop.yml

@@ -0,0 +1,15 @@
+inherit_from: https://raw.githubusercontent.com/rails/rails/master/.rubocop.yml
+
+Performance:
+  Exclude:
+    - 'test/**/*'
+
+Style/FrozenStringLiteralComment:
+  Enabled: false
+
+Style/StringLiterals:
+  Enabled: true
+  EnforcedStyle: double_quotes
+  Include:
+    - 'app/**/*'
+    - 'test/**/*'

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## Authentication Zero 2.11.0 (March 27, 2022) ##
+
+* Remove sudo from default generator
+* Remove sudo_at from database
+* Implement sudoable using redis
+
 ## Authentication Zero 2.10.0 (March 2, 2022) ##
 
 * Implement two-factor

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authentication-zero (2.10.0)
+    authentication-zero (2.11.0)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -13,7 +13,7 @@ The purpose of authentication zero is to generate a pre-built authentication sys
 - Authentication by token (--api)
 - Two factor authentication (--two-factor)
 - Social Login with OmniAuth (--omniauthable)
-- Ask password before sensitive data changes, aka: sudo
+- Ask password before sensitive data changes, aka: sudo (--sudoable)
 - Reset the user password and send reset instructions
 - Reset the user password only from verified emails
 - Lock sending reset password email after many attempts (--lockable)

data/authentication-zero-api.md

@@ -78,7 +78,6 @@ This endpoint will return `201 Created` with the current JSON representation of
     "user_id": 1,
     "user_agent": "insomnia/2022.1.0",
     "ip_address": "127.0.0.1",
-    "sudo_at": "2022-03-04T17:20:33.632Z",
     "created_at": "2022-03-04T17:20:33.632Z",
     "updated_at": "2022-03-04T17:20:33.632Z"
   },
@@ -87,7 +86,6 @@ This endpoint will return `201 Created` with the current JSON representation of
     "user_id": 1,
     "user_agent": "insomnia/2022.1.0",
     "ip_address": "127.0.0.1",
-    "sudo_at": "2022-03-04T17:14:03.386Z",
     "created_at": "2022-03-04T17:14:03.386Z",
     "updated_at": "2022-03-04T17:14:03.386Z"
   }
@@ -106,7 +104,6 @@ This endpoint will return `201 Created` with the current JSON representation of
   "user_id": 1,
   "user_agent": "insomnia/2022.1.0",
   "ip_address": "127.0.0.1",
-  "sudo_at": "2022-03-04T17:14:03.386Z",
   "created_at": "2022-03-04T17:14:03.386Z",
   "updated_at": "2022-03-04T17:14:03.386Z"
 }

data/lib/authentication_zero/version.rb

@@ -1,3 +1,3 @@
 module AuthenticationZero
-  VERSION = "2.10.0"
+  VERSION = "2.11.0"
 end

data/lib/generators/authentication/authentication_generator.rb

@@ -5,6 +5,7 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
 
   class_option :api,          type: :boolean, desc: "Generates API authentication"
   class_option :pwned,        type: :boolean, desc: "Add pwned password validation"
+  class_option :sudoable,     type: :boolean, desc: "Add password request before sensitive data changes"
   class_option :lockable,     type: :boolean, desc: "Add password reset locking"
   class_option :ratelimit,    type: :boolean, desc: "Add request rate limiting"
   class_option :omniauthable, type: :boolean, desc: "Add social login support"
@@ -15,8 +16,8 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
 
   def add_gems
     uncomment_lines "Gemfile", /"bcrypt"/
-    uncomment_lines "Gemfile", /"redis"/  if options.lockable?
-    uncomment_lines "Gemfile", /"kredis"/ if options.lockable?
+    uncomment_lines "Gemfile", /"redis"/  if redis?
+    uncomment_lines "Gemfile", /"kredis"/ if redis?
 
     if options.pwned?
       gem "pwned", comment: "Use Pwned to check if a password has been found in any of the huge data breaches [https://github.com/philnash/pwned]"
@@ -38,7 +39,7 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
   end
 
   def create_configuration_files
-    copy_file "config/redis/shared.yml", "config/redis/shared.yml" if options.lockable?
+    copy_file "config/redis/shared.yml", "config/redis/shared.yml" if redis?
     copy_file "config/initializers/omniauth.rb", "config/initializers/omniauth.rb" if omniauthable?
   end
 
@@ -72,17 +73,12 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
   def create_controllers
     template  "controllers/#{format_folder}/application_controller.rb", "app/controllers/application_controller.rb", force: true
 
-    if two_factor?
-      directory "controllers/#{format_folder}/two_factor_authentication", "app/controllers/two_factor_authentication"
-      template  "controllers/#{format_folder}/sessions_controller_two_factor.rb", "app/controllers/sessions_controller.rb"
-    else
-      template  "controllers/#{format_folder}/sessions_controller.rb", "app/controllers/sessions_controller.rb"
-    end
-
     directory "controllers/#{format_folder}/identity", "app/controllers/identity"
+    directory "controllers/#{format_folder}/two_factor_authentication", "app/controllers/two_factor_authentication" if two_factor?
+    template  "controllers/#{format_folder}/sessions_controller.rb", "app/controllers/sessions_controller.rb"
     template  "controllers/#{format_folder}/passwords_controller.rb", "app/controllers/passwords_controller.rb"
     template  "controllers/#{format_folder}/registrations_controller.rb", "app/controllers/registrations_controller.rb"
-    template  "controllers/#{format_folder}/sessions/sudos_controller.rb", "app/controllers/sessions/sudos_controller.rb"
+    template  "controllers/#{format_folder}/sessions/sudos_controller.rb", "app/controllers/sessions/sudos_controller.rb" if options.sudoable?
     template  "controllers/#{format_folder}/sessions/omniauth_controller.rb", "app/controllers/sessions/omniauth_controller.rb" if omniauthable?
     template  "controllers/#{format_folder}/authentications/events_controller.rb", "app/controllers/authentications/events_controller.rb" if options.trackable?
   end
@@ -98,7 +94,12 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
       directory "erb/identity", "app/views/identity"
       directory "erb/passwords", "app/views/passwords"
       directory "erb/registrations", "app/views/registrations"
-      directory "erb/sessions", "app/views/sessions"
+
+      template  "erb/sessions/index.html.erb", "app/views/sessions/index.html.erb"
+      template  "erb/sessions/new.html.erb", "app/views/sessions/new.html.erb"
+
+      directory "erb/sessions/sudos", "app/views/sessions/sudos" if options.sudoable?
+
       directory "erb/two_factor_authentication", "app/views/two_factor_authentication" if two_factor?
       directory "erb/authentications/events", "app/views/authentications/events" if options.trackable?
     end
@@ -127,7 +128,7 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
     route "resource :password_reset,     only: [:new, :edit, :create, :update]", namespace: :identity
     route "resource :email_verification, only: [:edit, :create]", namespace: :identity
     route "resource :email,              only: [:edit, :update]", namespace: :identity
-    route "resource :sudo, only: [:new, :create]", namespace: :sessions
+    route "resource :sudo, only: [:new, :create]", namespace: :sessions if options.sudoable?
     route "resource  :password, only: [:edit, :update]"
     route "resources :sessions, only: [:index, :show, :destroy]"
     route "post 'sign_up', to: 'registrations#create'"
@@ -155,4 +156,8 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
     def two_factor?
       options.two_factor? && !options.api?
     end
+
+    def redis?
+      options.lockable? || options.sudoable?
+    end
 end

data/lib/generators/authentication/templates/controllers/api/application_controller.rb.tt

@@ -3,12 +3,13 @@ class ApplicationController < ActionController::API
 
   before_action :set_current_request_details
   before_action :authenticate
-
+  <%- if options.sudoable? %>
   def require_sudo
-    if Current.session.sudo_at < 30.minutes.ago
+    unless Current.session.sudo?
       render json: { error: "Enter your password to continue" }, status: :forbidden
     end
   end
+  <%- end -%>
 
   private
     def authenticate

data/lib/generators/authentication/templates/controllers/api/identity/emails_controller.rb.tt

@@ -1,9 +1,10 @@
 class Identity::EmailsController < ApplicationController
-  before_action :require_sudo
   before_action :set_<%= singular_table_name %>
 
   def update
-    if @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
+    if !@<%= singular_table_name %>.authenticate(params[:current_password])
+      render json: { error: "The password you entered is incorrect" }, status: :bad_request
+    elsif @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
       render json: @<%= singular_table_name %>
     else
       render json: @<%= singular_table_name %>.errors, status: :unprocessable_entity

data/lib/generators/authentication/templates/controllers/api/sessions/sudos_controller.rb.tt

@@ -3,7 +3,7 @@ class Sessions::SudosController < ApplicationController
     session = Current.session
 
     if session.<%= singular_table_name %>.authenticate(params[:password])
-      session.update! sudo_at: Time.current
+      session.sudo.mark expires_in: 30.minutes
     else
       render json: { error: "The password you entered is incorrect" }, status: :bad_request
     end

data/lib/generators/authentication/templates/controllers/html/application_controller.rb.tt

@@ -1,12 +1,13 @@
 class ApplicationController < ActionController::Base
   before_action :set_current_request_details
   before_action :authenticate
-
+  <%- if options.sudoable? %>
   def require_sudo
-    if Current.session.sudo_at < 30.minutes.ago
+    unless Current.session.sudo?
       redirect_to new_sessions_sudo_path(proceed_to_url: request.url)
     end
   end
+  <%- end -%>
 
   private
     def authenticate

data/lib/generators/authentication/templates/controllers/html/identity/emails_controller.rb.tt

@@ -1,12 +1,13 @@
 class Identity::EmailsController < ApplicationController
-  before_action :require_sudo
   before_action :set_<%= singular_table_name %>
 
   def edit
   end
 
   def update
-    if @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
+    if !@<%= singular_table_name %>.authenticate(params[:current_password])
+      redirect_to edit_identity_email_path, alert: "The password you entered is incorrect"
+    elsif @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
       redirect_to root_path, notice: "Your email has been changed"
     else
       render :edit, status: :unprocessable_entity

data/lib/generators/authentication/templates/controllers/html/sessions/sudos_controller.rb.tt

@@ -10,7 +10,7 @@ class Sessions::SudosController < ApplicationController
     <%- else -%>
     if session.<%= singular_table_name %>.authenticate(params[:password])
     <%- end -%>
-      session.update!(sudo_at: Time.current); redirect_to(params[:proceed_to_url])
+      session.sudo.mark(expires_in: 30.minutes); redirect_to(params[:proceed_to_url])
     else
       redirect_to new_sessions_sudo_path(proceed_to_url: params[:proceed_to_url]), alert: "The password you entered is incorrect"
     end

data/lib/generators/authentication/templates/controllers/html/sessions_controller.rb.tt

@@ -15,10 +15,23 @@ class SessionsController < ApplicationController
     <%= singular_table_name %> = <%= class_name %>.find_by(email: params[:email])
 
     if <%= singular_table_name %> && <%= singular_table_name %>.authenticate(params[:password])
+      <%- if two_factor? -%>
+      if <%= singular_table_name %>.otp_secret
+        signed_id = <%= singular_table_name %>.signed_id(purpose: :authentication_challenge, expires_in: 20.minutes)
+
+        redirect_to new_two_factor_authentication_challenge_path(token: signed_id)
+      else
+        @session = <%= singular_table_name %>.sessions.create!
+        cookies.signed.permanent[:session_token] = { value: @session.id, httponly: true }
+
+        redirect_to root_path, notice: "Signed in successfully"
+      end
+      <%- else -%>
       @session = <%= singular_table_name %>.sessions.create!
       cookies.signed.permanent[:session_token] = { value: @session.id, httponly: true }
 
       redirect_to root_path, notice: "Signed in successfully"
+      <%- end -%>
     else
       redirect_to sign_in_path(email_hint: params[:email]), alert: "That email or password is incorrect"
     end

data/lib/generators/authentication/templates/controllers/html/two_factor_authentication/totps_controller.rb.tt

@@ -1,5 +1,4 @@
 class TwoFactorAuthentication::TotpsController < ApplicationController
-  before_action :require_sudo
   before_action :set_<%= singular_table_name %>
   before_action :set_totp
 
@@ -8,7 +7,9 @@ class TwoFactorAuthentication::TotpsController < ApplicationController
   end
 
   def create
-    if @totp.verify(params[:code], drift_behind: 15)
+    if !@<%= singular_table_name %>.authenticate(params[:current_password])
+      redirect_to two_factor_authentication_totp_path, alert: "The password you entered is incorrect"
+    elsif @totp.verify(params[:code], drift_behind: 15)
       @<%= singular_table_name %>.update! otp_secret: params[:secret]
       redirect_to root_path, notice: "2FA is enabled on your account"
     else

data/lib/generators/authentication/templates/erb/identity/emails/edit.html.erb.tt

@@ -21,6 +21,11 @@
     </div>
   <%% end %>
 
+  <div>
+    <%%= form.label :current_password, style: "display: block" %>
+    <%%= form.password_field :current_password, required: true, autofocus: true, autocomplete: "current-password" %>
+  </div>
+
   <div>
     <%%= form.label :email, "New email", style: "display: block" %>
     <%%= form.email_field :email %>

data/lib/generators/authentication/templates/erb/two_factor_authentication/totps/new.html.erb.tt

@@ -17,6 +17,11 @@
 <%%= form_with(url: two_factor_authentication_totp_path) do |form| %>
   <%%= form.hidden_field :secret, value: @totp.secret %>
 
+  <div>
+    <%%= form.label :current_password, style: "display: block" %>
+    <%%= form.password_field :current_password, required: true, autofocus: true, autocomplete: "current-password" %>
+  </div>
+
   <div>
     <%%= form.label :code, "After scanning with your camera, the app will generate a six-digit code. Enter it here:", style: "display: block" %>
     <%%= form.text_field :code, autofocus: true, required: true, autocomplete: :off %>

data/lib/generators/authentication/templates/migrations/create_sessions_migration.rb.tt

@@ -2,12 +2,9 @@ class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Mi
   def change
     create_table :sessions do |t|
       t.references :<%= singular_table_name %>, null: false, foreign_key: true
-
       t.string :user_agent
       t.string :ip_address
 
-      t.datetime :sudo_at, null: false
-
       t.timestamps
     end
   end

data/lib/generators/authentication/templates/models/session.rb.tt

@@ -1,11 +1,18 @@
 class Session < ApplicationRecord
   belongs_to :<%= singular_table_name %>
+  <%- if options.sudoable? %>
+  kredis_flag :sudo
+  <%- end -%>
 
   before_create do
     self.user_agent = Current.user_agent
     self.ip_address = Current.ip_address
-    self.sudo_at = Time.current
   end
+  <%- if options.sudoable? %>
+  after_create_commit do
+    self.sudo.mark expires_in: 30.minutes
+  end
+  <%- end -%>
 
   after_create_commit do
     SessionMailer.with(session: self).signed_in_notification.deliver_later

data/lib/generators/authentication/templates/test_unit/application_system_test_case.rb.tt

@@ -10,6 +10,6 @@ class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
     click_on "Sign in"
 
     assert_current_path root_url
-    return <%= singular_table_name %>
+    <%= singular_table_name %>
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/email_verifications_controller_test.rb.tt

@@ -9,21 +9,25 @@ class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTe
     @<%= singular_table_name %>.update! verified: false
   end
 
+  def default_headers
+    { "Authorization" => "Bearer #{@token}" }
+  end
+
   test "should send a verification email" do
     assert_enqueued_email_with IdentityMailer, :email_verify_confirmation, args: { <%= singular_table_name %>: @<%= singular_table_name %> } do
-      post identity_email_verification_url, headers: { "Authorization" => "Bearer #{@token}" }
+      post identity_email_verification_url, headers: default_headers
     end
 
     assert_response :no_content
   end
 
   test "should verify email" do
-    get edit_identity_email_verification_url, params: { token: @sid, email: @<%= singular_table_name %>.email }, headers: { "Authorization" => "Bearer #{@token}" }
+    get edit_identity_email_verification_url, params: { token: @sid, email: @<%= singular_table_name %>.email }, headers: default_headers
     assert_response :no_content
   end
 
   test "should not verify email with expired token" do
-    get edit_identity_email_verification_url, params: { token: @sid_exp, email: @<%= singular_table_name %>.email }, headers: { "Authorization" => "Bearer #{@token}" }
+    get edit_identity_email_verification_url, params: { token: @sid_exp, email: @<%= singular_table_name %>.email }, headers: default_headers
 
     assert_response :bad_request
     assert_equal "That email verification link is invalid", response.parsed_body["error"]
@@ -32,7 +36,7 @@ class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTe
   test "should not verify email with previous token" do
     @<%= singular_table_name %>.update! email: "other_email@hey.com"
 
-    get edit_identity_email_verification_url, params: { token: @sid, email: @<%= singular_table_name %>.email_previously_was }, headers: { "Authorization" => "Bearer #{@token}" }
+    get edit_identity_email_verification_url, params: { token: @sid, email: @<%= singular_table_name %>.email_previously_was }, headers: default_headers
 
     assert_response :bad_request
     assert_equal "That email verification link is invalid", response.parsed_body["error"]

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/emails_controller_test.rb.tt

@@ -5,17 +5,19 @@ class Identity::EmailsControllerTest < ActionDispatch::IntegrationTest
     @<%= singular_table_name %>, @token = sign_in_as(<%= table_name %>(:lazaro_nixon))
   end
 
+  def default_headers
+    { "Authorization" => "Bearer #{@token}" }
+  end
+
   test "should update email" do
-    patch identity_email_url, params: { email: "new_email@hey.com" }, headers: { "Authorization" => "Bearer #{@token}" }
+    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "Secret1*3*5*" }, headers: default_headers
     assert_response :success
   end
 
-  test "should not update email without sudo" do
-    @<%= singular_table_name %>.sessions.last.update! sudo_at: 1.day.ago
-
-    patch identity_email_url, params: { email: "new_email@hey.com" }, headers: { "Authorization" => "Bearer #{@token}" }
+  test "should not update email with wrong current password" do
+    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "SecretWrong1*3" }, headers: default_headers
 
-    assert_response :forbidden
-    assert_equal "Enter your password to continue", response.parsed_body["error"]
+    assert_response :bad_request
+    assert_equal "The password you entered is incorrect", response.parsed_body["error"]
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/password_resets_controller_test.rb.tt

@@ -6,9 +6,6 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
     @sid = @<%= singular_table_name %>.signed_id(purpose: :password_reset, expires_in: 20.minutes)
     @sid_exp = @<%= singular_table_name %>.signed_id(purpose: :password_reset, expires_in: 0.minutes)
   end
-  <%- if options.lockable? %>
-  teardown { Kredis.clear_all }
-  <%- end -%>
 
   test "should send a password reset email" do
     assert_enqueued_email_with IdentityMailer, :password_reset_provision, args: { <%= singular_table_name %>: @<%= singular_table_name %> } do

data/lib/generators/authentication/templates/test_unit/controllers/api/passwords_controller_test.rb.tt

@@ -5,13 +5,17 @@ class PasswordsControllerTest < ActionDispatch::IntegrationTest
     @<%= singular_table_name %>, @token = sign_in_as(<%= table_name %>(:lazaro_nixon))
   end
 
+  def default_headers
+    { "Authorization" => "Bearer #{@token}" }
+  end
+
   test "should update password" do
-    patch password_url, params: { current_password: "Secret1*3*5*", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }, headers: { "Authorization" => "Bearer #{@token}" }
+    patch password_url, params: { current_password: "Secret1*3*5*", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }, headers: default_headers
     assert_response :success
   end
 
   test "should not update password with wrong current password" do
-    patch password_url, params: { current_password: "SecretWrong1*3", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }, headers: { "Authorization" => "Bearer #{@token}" }
+    patch password_url, params: { current_password: "SecretWrong1*3", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }, headers: default_headers
 
     assert_response :bad_request
     assert_equal "The current password you entered is incorrect", response.parsed_body["error"]

data/lib/generators/authentication/templates/test_unit/controllers/api/sessions_controller_test.rb.tt

@@ -5,13 +5,17 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest
     @<%= singular_table_name %>, @token = sign_in_as(<%= table_name %>(:lazaro_nixon))
   end
 
+  def default_headers
+    { "Authorization" => "Bearer #{@token}" }
+  end
+
   test "should get index" do
-    get sessions_url, headers: { "Authorization" => "Bearer #{@token}" }
+    get sessions_url, headers: default_headers
     assert_response :success
   end
 
   test "should show session" do
-    get session_url(@<%= singular_table_name %>.sessions.last), headers: { "Authorization" => "Bearer #{@token}" }
+    get session_url(@<%= singular_table_name %>.sessions.last), headers: default_headers
     assert_response :success
   end
 
@@ -28,7 +32,7 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should sign out" do
-    delete session_url(@<%= singular_table_name %>.sessions.last), headers: { "Authorization" => "Bearer #{@token}" }
+    delete session_url(@<%= singular_table_name %>.sessions.last), headers: default_headers
     assert_response :no_content
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/html/identity/emails_controller_test.rb.tt

@@ -10,22 +10,15 @@ class Identity::EmailsControllerTest < ActionDispatch::IntegrationTest
     assert_response :success
   end
 
-  test "should not get edit without sudo" do
-    @<%= singular_table_name %>.sessions.last.update! sudo_at: 1.day.ago
-
-    get edit_identity_email_url
-    assert_redirected_to new_sessions_sudo_url(proceed_to_url: edit_identity_email_url)
-  end
-
   test "should update email" do
-    patch identity_email_url, params: { email: "new_email@hey.com" }
+    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "Secret1*3*5*" }
     assert_redirected_to root_url
   end
 
-  test "should not update email without sudo" do
-    @<%= singular_table_name %>.sessions.last.update! sudo_at: 1.day.ago
+  test "should not update email with wrong current password" do
+    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "SecretWrong1*3" }
 
-    patch identity_email_url, params: { email: "new_email@hey.com" }
-    assert_redirected_to new_sessions_sudo_url(proceed_to_url: identity_email_url)
+    assert_redirected_to edit_identity_email_url
+    assert_equal "The password you entered is incorrect", flash[:alert]
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/html/identity/password_resets_controller_test.rb.tt

@@ -6,9 +6,6 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
     @sid = @<%= singular_table_name %>.signed_id(purpose: :password_reset, expires_in: 20.minutes)
     @sid_exp = @<%= singular_table_name %>.signed_id(purpose: :password_reset, expires_in: 0.minutes)
   end
-  <%- if options.lockable? %>
-  teardown { Kredis.clear_all }
-  <%- end -%>
 
   test "should get new" do
     get new_identity_password_reset_url

data/lib/generators/authentication/templates/test_unit/system/identity/emails_test.rb.tt

@@ -8,6 +8,7 @@ class Identity::EmailsTest < ApplicationSystemTestCase
   test "updating the email" do
     click_on "Change email address"
 
+    fill_in "Current password", with: "Secret1*3*5*"
     fill_in "New email", with: "new_email@hey.com"
     click_on "Save changes"
 

data/lib/generators/authentication/templates/test_unit/system/identity/password_resets_test.rb.tt

@@ -5,9 +5,6 @@ class Identity::PasswordResetsTest < ApplicationSystemTestCase
     @<%= singular_table_name %> = <%= table_name %>(:lazaro_nixon)
     @sid = @<%= singular_table_name %>.signed_id(purpose: :password_reset, expires_in: 20.minutes)
   end
-  <%- if options.lockable? %>
-  teardown { Kredis.clear_all }
-  <%- end -%>
 
   test "sending a password reset email" do
     visit sign_in_url

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authentication-zero
 version: !ruby/object:Gem::Version
-  version: 2.10.0
+  version: 2.11.0
 platform: ruby
 authors:
 - Nixon
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-03-14 00:00:00.000000000 Z
+date: 2022-03-27 00:00:00.000000000 Z
 dependencies: []
 description:
 email:
@@ -19,6 +19,7 @@ extra_rdoc_files: []
 files:
 - ".github/FUNDING.yml"
 - ".gitignore"
+- ".rubocop.yml"
 - CHANGELOG.md
 - CODE_OF_CONDUCT.md
 - Gemfile
@@ -54,7 +55,6 @@ files:
 - lib/generators/authentication/templates/controllers/html/sessions/omniauth_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/sessions/sudos_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/sessions_controller.rb.tt
-- lib/generators/authentication/templates/controllers/html/sessions_controller_two_factor.rb.tt
 - lib/generators/authentication/templates/controllers/html/two_factor_authentication/challenges_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/two_factor_authentication/totps_controller.rb.tt
 - lib/generators/authentication/templates/erb/authentications/events/index.html.erb
@@ -90,21 +90,18 @@ files:
 - lib/generators/authentication/templates/test_unit/controllers/api/identity/password_resets_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/api/passwords_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/api/registrations_controller_test.rb.tt
-- lib/generators/authentication/templates/test_unit/controllers/api/sessions/sudos_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/api/sessions_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/html/identity/email_verifications_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/html/identity/emails_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/html/identity/password_resets_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/html/passwords_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/html/registrations_controller_test.rb.tt
-- lib/generators/authentication/templates/test_unit/controllers/html/sessions/sudos_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/html/sessions_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/fixtures.yml.tt
 - lib/generators/authentication/templates/test_unit/system/identity/emails_test.rb.tt
 - lib/generators/authentication/templates/test_unit/system/identity/password_resets_test.rb.tt
 - lib/generators/authentication/templates/test_unit/system/passwords_test.rb.tt
 - lib/generators/authentication/templates/test_unit/system/registrations_test.rb.tt
-- lib/generators/authentication/templates/test_unit/system/sessions/sudos_test.rb.tt
 - lib/generators/authentication/templates/test_unit/system/sessions_test.rb.tt
 - lib/generators/authentication/templates/test_unit/test_helper.rb.tt
 homepage: https://github.com/lazaronixon/authentication-zero

data/lib/generators/authentication/templates/controllers/html/sessions_controller_two_factor.rb.tt

@@ -1,41 +0,0 @@
-class SessionsController < ApplicationController
-  skip_before_action :authenticate, only: %i[ new create ]
-
-  before_action :set_session, only: :destroy
-
-  def index
-    @sessions = Current.<%= singular_table_name %>.sessions.order(created_at: :desc)
-  end
-
-  def new
-    @<%= singular_table_name %> = <%= class_name %>.new
-  end
-
-  def create
-    <%= singular_table_name %> = <%= class_name %>.find_by(email: params[:email])
-
-    if <%= singular_table_name %> && <%= singular_table_name %>.authenticate(params[:password])
-      if <%= singular_table_name %>.otp_secret
-        signed_id = <%= singular_table_name %>.signed_id(purpose: :authentication_challenge, expires_in: 20.minutes)
-
-        redirect_to new_two_factor_authentication_challenge_path(token: signed_id)
-      else
-        @session = <%= singular_table_name %>.sessions.create!
-        cookies.signed.permanent[:session_token] = { value: @session.id, httponly: true }
-
-        redirect_to root_path, notice: "Signed in successfully"
-      end
-    else
-      redirect_to sign_in_path(email_hint: params[:email]), alert: "That email or password is incorrect"
-    end
-  end
-
-  def destroy
-    @session.destroy; redirect_to(sessions_path, notice: "That session has been logged out")
-  end
-
-  private
-    def set_session
-      @session = Current.<%= singular_table_name %>.sessions.find(params[:id])
-    end
-end

data/lib/generators/authentication/templates/test_unit/controllers/api/sessions/sudos_controller_test.rb.tt

@@ -1,20 +0,0 @@
-require "test_helper"
-
-class Sessions::SudosControllerTest < ActionDispatch::IntegrationTest
-  setup do
-    @<%= singular_table_name %>, @token = sign_in_as(<%= table_name %>(:lazaro_nixon))
-    @<%= singular_table_name %>.sessions.last.update! sudo_at: 1.day.ago
-  end
-
-  test "should sudo" do
-    post sessions_sudo_url, params: { password: "Secret1*3*5*" }, headers: { "Authorization" => "Bearer #{@token}" }
-    assert_response :no_content
-  end
-
-  test "should not sudo with wrong password" do
-    post sessions_sudo_url, params: { password: "SecretWrong1*3" }, headers: { "Authorization" => "Bearer #{@token}" }
-
-    assert_response :bad_request
-    assert_equal "The password you entered is incorrect", response.parsed_body["error"]
-  end
-end

data/lib/generators/authentication/templates/test_unit/controllers/html/sessions/sudos_controller_test.rb.tt

@@ -1,22 +0,0 @@
-require "test_helper"
-
-class Sessions::SudosControllerTest < ActionDispatch::IntegrationTest
-  setup do
-    @<%= singular_table_name %> = sign_in_as(<%= table_name %>(:lazaro_nixon))
-  end
-
-  test "should get new" do
-    get new_sessions_sudo_url(proceed_to_url: edit_password_url)
-    assert_response :success
-  end
-
-  test "should sudo" do
-    post sessions_sudo_url, params: { password: "Secret1*3*5*", proceed_to_url: edit_password_url }
-    assert_redirected_to edit_password_url
-  end
-
-  test "should not sudo with wrong password" do
-    post sessions_sudo_url, params: { password: "SecretWrong1*3", proceed_to_url: edit_password_url }
-    assert_redirected_to new_sessions_sudo_url(proceed_to_url: edit_password_url)
-  end
-end

data/lib/generators/authentication/templates/test_unit/system/sessions/sudos_test.rb.tt

@@ -1,15 +0,0 @@
-require "application_system_test_case"
-
-class Sessions::SudosTest < ApplicationSystemTestCase
-  setup do
-    @<%= singular_table_name %> = sign_in_as(<%= table_name %>(:lazaro_nixon))
-  end
-
-  test "executing sudo" do
-    visit new_sessions_sudo_url(proceed_to_url: edit_password_url)
-    fill_in :password, with: "Secret1*3*5*"
-    click_on "Continue"
-
-    assert_selector "h1", text: "Change your password"
-  end
-end