authentication-zero 2.16.14 → 2.16.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e0f83db44ee39461a039edbf34e4ab4b1af7698fc537361607b120310e3d828e
-  data.tar.gz: ecbf7f8578a9612f30bd7d19d9c482c7d9dbf62e2a28fa148f25c7cb5eb3bad6
+  metadata.gz: 99df48ab46b9859695eadb1675580d523f1953a3f211b648b3c752e22598557a
+  data.tar.gz: c9fa8cfc8785c16a3329737b89c43ded33f74b79857e52a32f5e1b00872e388f
 SHA512:
-  metadata.gz: c8b1ed8282c418a5941295a522640ec2bcbc43fcd5dd8f6743333a860051c7c2858301d019f4f3400e217e2a385527809ab7bee61ef49306e4f6aba88bbdad38
-  data.tar.gz: 48220896d353c7aa5c37584f84ec4bd75d189f2205440fe754256fd2cfb885d31a2e87859d8756ec54502ef1e5f6cad51eede0662b664a26dc9f2daa066ea8e6
+  metadata.gz: 72daf22b87d0960c34885348cdf1c24ae3d67dbc9e34c816ac0d1592fd9e46299776b624383d4d318034edfbcedfa5e894fa65495188afe94aee6b011d3b4281
+  data.tar.gz: 219aa2ebe407eacf4344c462e20aad1abea1389b96b629f6313486821d07f04ea3682e789accaef04fb2bf60365cacb229fddbbafbf8c6e2bb8172ab18195ec7

data/.github/workflows/CI.yml

@@ -6,12 +6,11 @@
 # run tests and linters.
 name: "Generate sample app and run tests"
 on: [push]
+
 jobs:
   test_html:
     name: 🧪 Run HTML Tests
     runs-on: ubuntu-latest
-    env:
-      RAILS_ENV: test
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
@@ -22,45 +21,39 @@ jobs:
           bundler-cache: true
 
       - name: Install the latest Rails gem
-        run: gem install rails
+        run: gem install rails -v "~> 7.0.0"
+
+      - name: Install Rubocop
+        run: gem install rubocop rubocop-performance rubocop-minitest rubocop-packaging rubocop-minitest rubocop-rails
 
       - name: Create fresh Rails app and run generator
         run: |
           rails new test-app
+          cp .rubocop.yml test-app/.rubocop.yml
           cd test-app
-          wget https://raw.githubusercontent.com/lazaronixon/authentication-zero/master/.rubocop.yml
-          bundle add authentication-zero --github ${{ github.repository }} --branch ${{ github.ref_name }}
+          bundle add authentication-zero --path ..
           bin/rails generate authentication
           bundle install
           bin/rails db:migrate
 
-
-      - name: Install Rubocop
-        run: gem install rubocop rubocop-performance rubocop-minitest rubocop-packaging rubocop-minitest rubocop-rails
-
       - name: Rubocop
-        run: |
-          cd test-app
-          rubocop
+        run: cd test-app && rubocop
 
-      - name: Install brakeman
+      - name: Install Brakeman
         run: gem install brakeman
 
       - name: Brakeman
-        run: |
-          cd test-app
-          brakeman
+        run: cd test-app && brakeman
 
       - name: Tests
         run: |
           cd test-app
           bin/rails test
           bin/rails test:system
+
   test_api:
     name: 🧪 Run API Tests
     runs-on: ubuntu-latest
-    env:
-      RAILS_ENV: test
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
@@ -71,36 +64,30 @@ jobs:
           bundler-cache: true
 
       - name: Install the latest Rails gem
-        run: gem install rails
+        run: gem install rails -v "~> 7.0.0"
+
+      - name: Install Rubocop
+        run: gem install rubocop rubocop-performance rubocop-minitest rubocop-packaging rubocop-minitest rubocop-rails
 
       - name: Create fresh Rails app and run generator
         run: |
           rails new test-app
+          cp .rubocop.yml test-app/.rubocop.yml
           cd test-app
-          wget https://raw.githubusercontent.com/lazaronixon/authentication-zero/master/.rubocop.yml
-          bundle add authentication-zero --github ${{ github.repository }} --branch ${{ github.ref_name }}
+          bundle add authentication-zero --path ..
           bin/rails generate authentication --api
           bundle install
           bin/rails db:migrate
 
-      - name: Install Rubocop
-        run: gem install rubocop rubocop-performance rubocop-minitest rubocop-packaging rubocop-minitest rubocop-rails
-
       - name: Rubocop
-        run: |
-          cd test-app
-          rubocop
+        run: cd test-app && rubocop
 
-      - name: Install brakeman
+      - name: Install Brakeman
         run: gem install brakeman
 
       - name: Brakeman
-        run: |
-          cd test-app
-          brakeman
+        run: cd test-app && brakeman
 
       - name: Tests
-        run: |
-          cd test-app
-          bin/rails test
+        run: cd test-app && bin/rails test
 

data/.ruby-version

@@ -1 +1 @@
-3.1.2
+3.2.2

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## Authentication Zero 2.16.16 ##
+
+* Add recovery codes to two factor auth
+
+## Authentication Zero 2.16.15 ##
+
+* Add sign-in as button functionallity (--masqueradable)
+
 ## Authentication Zero 2.16.14 ##
 
 * Remove password requirements

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authentication-zero (2.16.14)
+    authentication-zero (2.16.16)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -28,11 +28,11 @@ Since Authentication Zero generates this code into your application instead of b
 - Authentication by cookie
 - Authentication by token (--api)
 - Passwordless authentication (--passwordless)
-- Two factor authentication (--two-factor)
+- Two factor authentication + recovery codes (--two-factor)
 - Social Login with OmniAuth (--omniauthable)
 - Send invitations (--invitable)
+- Sign-in as button functionallity (--masqueradable)
 - Verify email using a link with token
-- Verify email using a six random digits code for api (--code-verifiable)
 - Ask password before sensitive data changes, aka: sudo (--sudoable)
 - Reset the user password and send reset instructions
 - Reset the user password only from verified emails

data/lib/authentication_zero/version.rb

@@ -1,3 +1,3 @@
 module AuthenticationZero
-  VERSION = "2.16.14"
+  VERSION = "2.16.16"
 end

data/lib/generators/authentication/authentication_generator.rb

@@ -3,17 +3,17 @@ require "rails/generators/active_record"
 class AuthenticationGenerator < Rails::Generators::Base
   include ActiveRecord::Generators::Migration
 
-  class_option :api,             type: :boolean, desc: "Generates API authentication"
-  class_option :pwned,           type: :boolean, desc: "Add pwned password validation"
-  class_option :code_verifiable, type: :boolean, desc: "Add email verification using a code for api"
-  class_option :sudoable,        type: :boolean, desc: "Add password request before sensitive data changes"
-  class_option :lockable,        type: :boolean, desc: "Add password reset locking"
-  class_option :ratelimit,       type: :boolean, desc: "Add request rate limiting"
-  class_option :passwordless,    type: :boolean, desc: "Add passwordless sign"
-  class_option :omniauthable,    type: :boolean, desc: "Add social login support"
-  class_option :trackable,       type: :boolean, desc: "Add activity log support"
-  class_option :two_factor,      type: :boolean, desc: "Add two factor authentication"
-  class_option :invitable,       type: :boolean, desc: "Add sending invitations"
+  class_option :api,           type: :boolean, desc: "Generates API authentication"
+  class_option :pwned,         type: :boolean, desc: "Add pwned password validation"
+  class_option :sudoable,      type: :boolean, desc: "Add password request before sensitive data changes"
+  class_option :lockable,      type: :boolean, desc: "Add password reset locking"
+  class_option :ratelimit,     type: :boolean, desc: "Add request rate limiting"
+  class_option :passwordless,  type: :boolean, desc: "Add passwordless sign"
+  class_option :omniauthable,  type: :boolean, desc: "Add social login support"
+  class_option :trackable,     type: :boolean, desc: "Add activity log support"
+  class_option :two_factor,    type: :boolean, desc: "Add two factor authentication"
+  class_option :invitable,     type: :boolean, desc: "Add sending invitations"
+  class_option :masqueradable, type: :boolean, desc: "Add sign-in as button functionallity"
 
   source_root File.expand_path("templates", __dir__)
 
@@ -86,6 +86,7 @@ class AuthenticationGenerator < Rails::Generators::Base
     template  "controllers/#{format_folder}/sessions_controller.rb", "app/controllers/sessions_controller.rb"
     template  "controllers/#{format_folder}/passwords_controller.rb", "app/controllers/passwords_controller.rb"
     template  "controllers/#{format_folder}/invitations_controller.rb", "app/controllers/invitations_controller.rb" if invitable?
+    template  "controllers/#{format_folder}/masquerades_controller.rb", "app/controllers/masquerades_controller.rb" if masqueradable?
     template  "controllers/#{format_folder}/registrations_controller.rb", "app/controllers/registrations_controller.rb"
     template  "controllers/#{format_folder}/home_controller.rb", "app/controllers/home_controller.rb" unless options.api?
     template  "controllers/#{format_folder}/sessions/sudos_controller.rb", "app/controllers/sessions/sudos_controller.rb" if sudoable?
@@ -96,9 +97,13 @@ class AuthenticationGenerator < Rails::Generators::Base
 
   def create_views
     if options.api?
-      directory "erb/user_mailer", "app/views/user_mailer"
+      template "erb/user_mailer/email_verification.html.erb", "app/views/user_mailer/email_verification.html.erb"
+      template "erb/user_mailer/password_reset.html.erb", "app/views/user_mailer/password_reset.html.erb"
     else
-      directory "erb/user_mailer", "app/views/user_mailer"
+      template "erb/user_mailer/email_verification.html.erb", "app/views/user_mailer/email_verification.html.erb"
+      template "erb/user_mailer/password_reset.html.erb", "app/views/user_mailer/password_reset.html.erb"
+      template "erb/user_mailer/invitation_instructions.html.erb", "app/views/user_mailer/invitation_instructions.html.erb" if invitable?
+      template "erb/user_mailer/passwordless.html.erb", "app/views/user_mailer/passwordless.html.erb" if passwordless?
 
       directory "erb/home", "app/views/home"
 
@@ -131,10 +136,18 @@ class AuthenticationGenerator < Rails::Generators::Base
       route "resource :sudo, only: [:new, :create]", namespace: :sessions
     end
 
+    if invitable?
+      route "resource :invitation, only: [:new, :create]"
+    end
+
     if passwordless?
       route "resource :passwordless, only: [:new, :edit, :create]", namespace: :sessions
     end
 
+    if masqueradable?
+      route 'post "users/:user_id/masquerade", to: "masquerades#create", as: :user_masquerade'
+    end
+
     if omniauthable?
       route 'post "/auth/:provider/callback", to: "sessions/omniauth#create"'
       route 'get  "/auth/:provider/callback", to: "sessions/omniauth#create"'
@@ -142,8 +155,9 @@ class AuthenticationGenerator < Rails::Generators::Base
     end
 
     if two_factor?
-      route "resource :totp,      only: [:new, :create]", namespace: :two_factor_authentication
-      route "resource :challenge, only: [:new, :create]", namespace: :two_factor_authentication
+      route "resources :recovery_codes, only: [:index, :create]", namespace: :two_factor_authentication
+      route "resource  :totp,           only: [:new, :create]", namespace: :two_factor_authentication
+      route "resource  :challenge,      only: [:new, :create]", namespace: :two_factor_authentication
     end
 
     if options.trackable?
@@ -154,11 +168,12 @@ class AuthenticationGenerator < Rails::Generators::Base
     route "resource :email_verification, only: [:show, :create]", namespace: :identity
     route "resource :email,              only: [:edit, :update]", namespace: :identity
 
-    route "resource  :invitation, only: [:new, :create]" if invitable?
-    route "resource  :password,   only: [:edit, :update]"
-    route "resources :sessions,   only: [:index, :show, :destroy]"
+    route "resource  :password, only: [:edit, :update]"
+    route "resources :sessions, only: [:index, :show, :destroy]"
+
     route 'post "sign_up", to: "registrations#create"'
     route 'get  "sign_up", to: "registrations#new"' unless options.api?
+
     route 'post "sign_in", to: "sessions#create"'
     route 'get  "sign_in", to: "sessions#new"' unless options.api?
   end
@@ -199,15 +214,15 @@ class AuthenticationGenerator < Rails::Generators::Base
       options.invitable? && !options.api?
     end
 
-    def sudoable?
-      options.sudoable? && !options.api?
+    def masqueradable?
+      options.masqueradable? && !options.api?
     end
 
-    def code_verifiable?
-      options.code_verifiable? && options.api?
+    def sudoable?
+      options.sudoable? && !options.api?
     end
 
     def redis?
-      options.lockable? || options.ratelimit? || sudoable? || code_verifiable?
+      options.lockable? || options.ratelimit? || sudoable?
     end
 end

data/lib/generators/authentication/templates/controllers/api/identity/email_verifications_controller.rb.tt

@@ -13,18 +13,8 @@ class Identity::EmailVerificationsController < ApplicationController
 
   private
     def set_user
-    <%- if code_verifiable? -%>
-      verified_user = User.find_by(email: params[:email])
-
-      if verified_user && verified_user.verification_code.value == params[:token]
-        @user = verified_user
-      else
-        render json: { error: "That email verification code is invalid" }, status: :bad_request
-      end
-    <%- else -%>
       @token = EmailVerificationToken.find_signed!(params[:sid]); @user = @token.user
-    rescue
+    rescue StandardError
       render json: { error: "That email verification link is invalid" }, status: :bad_request
-    <%- end -%>
     end
 end

data/lib/generators/authentication/templates/controllers/api/identity/password_resets_controller.rb.tt

@@ -6,6 +6,10 @@ class Identity::PasswordResetsController < ApplicationController
   <%- end -%>
   before_action :set_user, only: :update
 
+  def edit
+    head :no_content
+  end
+
   def create
     if @user = User.find_by(email: params[:email], verified: true)
       UserMailer.with(user: @user).password_reset.deliver_later
@@ -25,7 +29,7 @@ class Identity::PasswordResetsController < ApplicationController
   private
     def set_user
       @token = PasswordResetToken.find_signed!(params[:sid]); @user = @token.user
-    rescue
+    rescue StandardError
       render json: { error: "That password reset link is invalid" }, status: :bad_request
     end
 

data/lib/generators/authentication/templates/controllers/html/identity/email_verifications_controller.rb.tt

@@ -16,7 +16,7 @@ class Identity::EmailVerificationsController < ApplicationController
   private
     def set_user
       @token = EmailVerificationToken.find_signed!(params[:sid]); @user = @token.user
-    rescue
+    rescue StandardError
       redirect_to edit_identity_email_path, alert: "That email verification link is invalid"
     end
 

data/lib/generators/authentication/templates/controllers/html/identity/password_resets_controller.rb.tt

@@ -32,7 +32,7 @@ class Identity::PasswordResetsController < ApplicationController
   private
     def set_user
       @token = PasswordResetToken.find_signed!(params[:sid]); @user = @token.user
-    rescue
+    rescue StandardError
       redirect_to new_identity_password_reset_path, alert: "That password reset link is invalid"
     end
 

data/lib/generators/authentication/templates/controllers/html/masquerades_controller.rb.tt

@@ -0,0 +1,20 @@
+class MasqueradesController < ApplicationController
+  before_action :authorize
+  before_action :set_user
+
+  def create
+    session = @user.sessions.create!
+    cookies.signed.permanent[:session_token] = { value: session.id, httponly: true }
+
+    redirect_to root_path, notice: "Signed in successfully"
+  end
+
+  private
+    def set_user
+      @user = User.find(params[:user_id])
+    end
+
+    def authorize
+      redirect_to(root_path, alert: "You must be in development") unless Rails.env.development?
+    end
+end

data/lib/generators/authentication/templates/controllers/html/sessions/passwordlesses_controller.rb.tt

@@ -28,7 +28,7 @@ class Sessions::PasswordlessesController < ApplicationController
   private
     def set_user
       @token = SignInToken.find_signed!(params[:sid]); @user = @token.user
-    rescue
+    rescue StandardError
       redirect_to new_sessions_passwordless_path, alert: "That sign in link is invalid"
     end
 

data/lib/generators/authentication/templates/controllers/html/sessions_controller.rb.tt

@@ -16,7 +16,7 @@ class SessionsController < ApplicationController
 
     if user && user.authenticate(params[:password])
       <%- if two_factor? -%>
-      if user.otp_secret
+      if user.otp_secret.present?
         signed_id = user.signed_id(purpose: :authentication_challenge, expires_in: 20.minutes)
         redirect_to new_two_factor_authentication_challenge_path(token: signed_id)
       else

data/lib/generators/authentication/templates/controllers/html/two_factor_authentication/challenges_controller.rb.tt

@@ -7,22 +7,46 @@ class TwoFactorAuthentication::ChallengesController < ApplicationController
   end
 
   def create
-    @totp = ROTP::TOTP.new(@user.otp_secret, issuer: "YourAppName")
-
-    if @totp.verify(params[:code], drift_behind: 15)
-      session = @user.sessions.create!
-      cookies.signed.permanent[:session_token] = { value: session.id, httponly: true }
-
-      redirect_to root_path, notice: "Signed in successfully"
+    if params[:scheme_type] == "recovery_codes"
+      verify_recovery_code
     else
-      redirect_to new_two_factor_authentication_challenge_path(token: params[:token]), alert: "That code didn't work. Please try again"
+      verify_time_based_one_time_password
     end
   end
 
   private
     def set_user
       @user = User.find_signed!(params[:token], purpose: :authentication_challenge)
-    rescue
+    rescue StandardError
       redirect_to sign_in_path, alert: "That's taking too long. Please re-enter your password and try again"
     end
+
+    def verify_recovery_code
+      if recover_code = @user.recovery_codes.find_by(code: params[:code], used: false)
+        recover_code.update!(used: true); sign_in_and_redirect_to_root
+      else
+        redirect_to_authentication_challenge
+      end
+    end
+
+    def verify_time_based_one_time_password
+      @totp = ROTP::TOTP.new(@user.otp_secret, issuer: "YourAppName")
+
+      if @totp.verify(params[:code], drift_behind: 15)
+        sign_in_and_redirect_to_root
+      else
+        redirect_to_authentication_challenge
+      end
+    end
+
+    def sign_in_and_redirect_to_root
+      session = @user.sessions.create!
+      cookies.signed.permanent[:session_token] = { value: session.id, httponly: true }
+
+      redirect_to root_path, notice: "Signed in successfully"
+    end
+
+    def redirect_to_authentication_challenge
+      redirect_to new_two_factor_authentication_challenge_path(token: params[:token], scheme_type: params[:scheme_type]), alert: "That code didn't work. Please try again"
+    end
 end

data/lib/generators/authentication/templates/controllers/html/two_factor_authentication/recovery_codes_controller.rb.tt

@@ -0,0 +1,31 @@
+class TwoFactorAuthentication::RecoveryCodesController < ApplicationController
+  before_action :set_user
+
+  def index
+    if Current.user.recovery_codes.exists?
+      @recovery_codes = @user.recovery_codes
+    else
+      @recovery_codes = @user.recovery_codes.create!(new_recovery_codes)
+    end
+  end
+
+  def create
+    @user.recovery_codes.delete_all
+    @user.recovery_codes.create!(new_recovery_codes)
+
+    redirect_to two_factor_authentication_recovery_codes_path, notice: "Your new recovery codes have been generated"
+  end
+
+  private
+    def set_user
+      @user = Current.user
+    end
+
+    def new_recovery_codes
+      10.times.map { { code: new_recovery_code } }
+    end
+
+    def new_recovery_code
+      SecureRandom.alphanumeric(10).insert(5, "-").downcase
+    end
+end

data/lib/generators/authentication/templates/controllers/html/two_factor_authentication/totps_controller.rb.tt

@@ -9,17 +9,18 @@ class TwoFactorAuthentication::TotpsController < ApplicationController
   def create
     if @totp.verify(params[:code], drift_behind: 15)
       @user.update! otp_secret: params[:secret]
-      redirect_to root_path, notice: "2FA is enabled on your account"
+      redirect_to two_factor_authentication_recovery_codes_path
     else
       redirect_to new_two_factor_authentication_totp_path, alert: "That code didn't work. Please try again"
     end
   end
 
-  def set_user
-    @user = Current.user
-  end
+  private
+    def set_user
+      @user = Current.user
+    end
 
-  def set_totp
-    @totp = ROTP::TOTP.new(params[:secret] || ROTP::Base32.random, issuer: "YourAppName")
-  end
+    def set_totp
+      @totp = ROTP::TOTP.new(params[:secret] || ROTP::Base32.random, issuer: "YourAppName")
+    end
 end

data/lib/generators/authentication/templates/erb/home/index.html.erb.tt

@@ -24,10 +24,19 @@
     <%%= link_to "Send invitation", new_invitation_path %>
   </div>
   <%- end -%>
+  <%- if masqueradable? %>
+  <div>
+    <%%= button_to "Signin as last user", user_masquerade_path(User.last) %>
+  </div>
+  <%- end -%>
   <%- if two_factor? %>
   <div>
     <%%= link_to "Two-Factor Authentication", new_two_factor_authentication_totp_path %>
   </div>
+
+  <%% if Current.user.otp_secret.present? %>
+    <div><%%= link_to "Recovery Codes", two_factor_authentication_recovery_codes_path %></div>
+  <%% end %>
   <%- end -%>
 
   <br>

data/lib/generators/authentication/templates/erb/two_factor_authentication/challenges/_recovery_code_form.html.erb.tt

@@ -0,0 +1,19 @@
+<%%= form_with(url: two_factor_authentication_challenge_path) do |form| %>
+  <%%= form.hidden_field :token, value: params[:token] %>
+  <%%= form.hidden_field :scheme_type, value: "recovery_codes" %>
+
+  <div>
+    <%%= form.label :code do %>
+      <h1>OK, enter one of your recovery codes below:</h1>
+    <%% end %>
+    <%%= form.text_field :code, autofocus: true, required: true, autocomplete: :off %>
+  </div>
+
+  <div>
+    <%%= form.submit "Continue" %>
+  </div>
+<%% end %>
+
+<div>
+  <p>To access your account, enter one of the recovery codes (e.g., XXXXX-XXXXX) you saved when you set up your two-factor authentication device.</p>
+</div>

data/lib/generators/authentication/templates/erb/two_factor_authentication/challenges/_totp_form.html.erb.tt

@@ -0,0 +1,20 @@
+<%%= form_with(url: two_factor_authentication_challenge_path) do |form| %>
+  <%%= form.hidden_field :token, value: params[:token] %>
+  <%%= form.hidden_field :scheme_type, value: "totp" %>
+
+  <div>
+    <%%= form.label :code do %>
+      <h1>Next, open the 2FA authenticator app on your phone and type the six digit code below:</h1>
+    <%% end %>
+    <%%= form.text_field :code, autofocus: true, required: true, autocomplete: :off %>
+  </div>
+
+  <div>
+    <%%= form.submit "Verify" %>
+  </div>
+<%% end %>
+
+<div>
+  <p><strong>Don't have your phone?</strong></p>
+  <%%= link_to "Use a recovery code to access your account.", new_two_factor_authentication_challenge_path(token: params[:token], scheme_type: "recovery_codes") %>
+</div>

data/lib/generators/authentication/templates/erb/two_factor_authentication/challenges/new.html.erb.tt

@@ -1,16 +1,7 @@
 <p style="color: red"><%%= alert %></p>
 
-<%%= form_with(url: two_factor_authentication_challenge_path) do |form| %>
-  <%%= form.hidden_field :token, value: params[:token] %>
-
-  <div>
-    <%%= form.label :code do %>
-      <h1>Next, open the 2FA authenticator app on your phone and type the six digit code below:</h1>
-    <%% end %>
-    <%%= form.text_field :code, autofocus: true, required: true, autocomplete: :off %>
-  </div>
-
-  <div>
-    <%%= form.submit "Verify" %>
-  </div>
+<%% if params[:scheme_type] == "recovery_codes" %>
+  <%%= render "recovery_code_form" %>
+<%% else %>
+  <%%= render "totp_form" %>
 <%% end %>

data/lib/generators/authentication/templates/erb/two_factor_authentication/recovery_codes/_recovery_code.html.erb.tt

@@ -0,0 +1,5 @@
+<%% if recovery_code.used? %>
+  <li><del><%%= recovery_code.code %></del></li>
+<%% else %>
+  <li><%%= recovery_code.code %></li>
+<%% end %>

data/lib/generators/authentication/templates/erb/two_factor_authentication/recovery_codes/index.html.erb.tt

@@ -0,0 +1,16 @@
+<p style="color: green"><%%= notice %></p>
+
+<h1>Two-factor recovery codes</h1>
+<p>Recovery codes provide a way to log in if you lose your phone (or don't have it with you). Save these and keep them somewhere safe.</p>
+
+<ul><%%= render @recovery_codes %></ul>
+
+<%%= link_to "OK, I'm done", root_path %>
+
+<hr>
+
+<h2>Need new recovery codes?</h2>
+
+<p>If you think your codes have fallen into the wrong hands, you can get a new set. Be sure to save the new ones because the old codes will stop working.</p>
+
+<%%= button_to "Generate new recovery codes", two_factor_authentication_recovery_codes_path %>

data/lib/generators/authentication/templates/erb/two_factor_authentication/totps/new.html.erb.tt

@@ -10,8 +10,8 @@
 <p>Next, open the authenticator app, tap "Scan QR code" or "+", and, when it asks, point your phone's camera at this QR code picture below.</p>
 
 <figure>
-    <%%= image_tag @qr_code.as_png(resize_exactly_to: 200).to_data_url%>
-    <figcaption>Point your camera here</figcaption>
+  <%%= image_tag @qr_code.as_png(resize_exactly_to: 200).to_data_url%>
+  <figcaption>Point your camera here</figcaption>
 </figure>
 
 <%%= form_with(url: two_factor_authentication_totp_path) do |form| %>

data/lib/generators/authentication/templates/erb/user_mailer/email_verification.html.erb.tt

@@ -2,13 +2,9 @@
 
 <p>This is to confirm that <%%= @user.email %> is the email you want to use on your account. If you ever lose your password, that's where we'll email a reset link.</p>
 
-<p><strong>You must <%= code_verifiable? ? "put the code" : "hit the link" %> below to confirm that you received this email.</strong></p>
+<p><strong>You must hit the link below to confirm that you received this email.</strong></p>
 
-<%- if code_verifiable? -%>
-<strong><%%= @user.verification_code.value %></strong>
-<%- else -%>
 <%%= link_to "Yes, use this email for my account", identity_email_verification_url(sid: @signed_id) %>
-<%- end -%>
 
 <hr>
 

data/lib/generators/authentication/templates/mailers/user_mailer.rb.tt

@@ -8,11 +8,7 @@ class UserMailer < ApplicationMailer
 
   def email_verification
     @user = params[:user]
-    <%- if code_verifiable? -%>
-    @user.verification_code.value = rand.to_s[2..7]
-    <%- else -%>
     @signed_id = @user.email_verification_tokens.create.signed_id(expires_in: 2.days)
-    <%- end -%>
 
     mail to: @user.email, subject: "Verify your email"
   end

data/lib/generators/authentication/templates/migrations/create_recovery_codes_migration.rb.tt

@@ -0,0 +1,11 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    create_table :recovery_codes do |t|
+      t.references :user, null: false, foreign_key: true
+      t.string  :code, null: false
+      t.boolean :used, null: false, default: false
+
+      t.timestamps
+    end
+  end
+end

data/lib/generators/authentication/templates/models/recovery_code.rb.tt

@@ -0,0 +1,3 @@
+class RecoveryCode < ApplicationRecord
+  belongs_to :user
+end

data/lib/generators/authentication/templates/models/user.rb.tt

@@ -3,6 +3,9 @@ class User < ApplicationRecord
 
   has_many :email_verification_tokens, dependent: :destroy
   has_many :password_reset_tokens, dependent: :destroy
+  <%- if two_factor? -%>
+  has_many :recovery_codes, dependent: :destroy
+  <%- end -%>
   <%- if passwordless? -%>
   has_many :sign_in_tokens, dependent: :destroy
   <%- end -%>
@@ -11,9 +14,6 @@ class User < ApplicationRecord
   <%- if options.trackable? -%>
   has_many :events, dependent: :destroy
   <%- end -%>
-  <%- if code_verifiable? %>
-  kredis_string :verification_code, expires_in: 2.days
-  <%- end -%>
 
   validates :email, presence: true, uniqueness: true, format: { with: URI::MailTo::EMAIL_REGEXP }
   validates :password, allow_nil: true, length: { minimum: 12 }
@@ -30,7 +30,7 @@ class User < ApplicationRecord
   end
 
   after_update if: :password_digest_previously_changed? do
-    sessions.where.not(id: Current.session).destroy_all
+    sessions.where.not(id: Current.session).delete_all
   end
   <%- if options.trackable? %>
   after_update if: :email_previously_changed? do

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/password_resets_controller_test.rb.tt

@@ -5,6 +5,13 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
     @user = users(:lazaro_nixon)
   end
 
+  test "should get edit" do
+    sid = @user.password_reset_tokens.create.signed_id(expires_in: 20.minutes)
+
+    get edit_identity_password_reset_url(sid: sid)
+    assert_response :no_content
+  end
+
   test "should send a password reset email" do
     assert_enqueued_email_with UserMailer, :password_reset, args: { user: @user } do
       post identity_password_reset_url, params: { email: @user.email }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authentication-zero
 version: !ruby/object:Gem::Version
-  version: 2.16.14
+  version: 2.16.16
 platform: ruby
 authors:
 - Nixon
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-04-06 00:00:00.000000000 Z
+date: 2023-04-07 00:00:00.000000000 Z
 dependencies: []
 description:
 email:
@@ -52,6 +52,7 @@ files:
 - lib/generators/authentication/templates/controllers/html/identity/emails_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/identity/password_resets_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/invitations_controller.rb.tt
+- lib/generators/authentication/templates/controllers/html/masquerades_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/passwords_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/registrations_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/sessions/omniauth_controller.rb.tt
@@ -59,6 +60,7 @@ files:
 - lib/generators/authentication/templates/controllers/html/sessions/sudos_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/sessions_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/two_factor_authentication/challenges_controller.rb.tt
+- lib/generators/authentication/templates/controllers/html/two_factor_authentication/recovery_codes_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/two_factor_authentication/totps_controller.rb.tt
 - lib/generators/authentication/templates/erb/authentications/events/index.html.erb.tt
 - lib/generators/authentication/templates/erb/home/index.html.erb.tt
@@ -72,7 +74,11 @@ files:
 - lib/generators/authentication/templates/erb/sessions/new.html.erb.tt
 - lib/generators/authentication/templates/erb/sessions/passwordlesses/new.html.erb.tt
 - lib/generators/authentication/templates/erb/sessions/sudos/new.html.erb.tt
+- lib/generators/authentication/templates/erb/two_factor_authentication/challenges/_recovery_code_form.html.erb.tt
+- lib/generators/authentication/templates/erb/two_factor_authentication/challenges/_totp_form.html.erb.tt
 - lib/generators/authentication/templates/erb/two_factor_authentication/challenges/new.html.erb.tt
+- lib/generators/authentication/templates/erb/two_factor_authentication/recovery_codes/_recovery_code.html.erb.tt
+- lib/generators/authentication/templates/erb/two_factor_authentication/recovery_codes/index.html.erb.tt
 - lib/generators/authentication/templates/erb/two_factor_authentication/totps/new.html.erb.tt
 - lib/generators/authentication/templates/erb/user_mailer/email_verification.html.erb.tt
 - lib/generators/authentication/templates/erb/user_mailer/invitation_instructions.html.erb.tt
@@ -82,6 +88,7 @@ files:
 - lib/generators/authentication/templates/migrations/create_email_verification_tokens_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_events_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_password_reset_tokens_migration.rb.tt
+- lib/generators/authentication/templates/migrations/create_recovery_codes_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_sessions_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_sign_in_tokens_migration.rb.tt
 - lib/generators/authentication/templates/migrations/create_users_migration.rb.tt
@@ -89,6 +96,7 @@ files:
 - lib/generators/authentication/templates/models/email_verification_token.rb.tt
 - lib/generators/authentication/templates/models/event.rb.tt
 - lib/generators/authentication/templates/models/password_reset_token.rb.tt
+- lib/generators/authentication/templates/models/recovery_code.rb.tt
 - lib/generators/authentication/templates/models/session.rb.tt
 - lib/generators/authentication/templates/models/sign_in_token.rb.tt
 - lib/generators/authentication/templates/models/user.rb.tt
@@ -135,7 +143,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
+rubygems_version: 3.4.10
 signing_key:
 specification_version: 4
 summary: An authentication system generator for Rails applications