authentication-zero 2.16.22 → 2.16.24

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 92a96efa7edf8438760960d32bc93e431f786889e95fd9a92343c96a19617edb
-  data.tar.gz: 8ae66c2b5b556df1281e8c49dd1c6879bbe118af1617838725f3dd7d251457fc
+  metadata.gz: 769f7682100782d48f09608fc6468e6be06375acd2d1dabd01f0aef1074b2c96
+  data.tar.gz: 04453fdec338106d6d2668809f2dc84b40bfb0f0635ac26204be27f6f7d0f001
 SHA512:
-  metadata.gz: 02f153adacde895b01bf833726d3cfa4339cbe9665a60cc06ca0140b0fe64832c087f7c2b6ec139040cf6751def4ff0d2d5537576412adb02146fdd5c234e4ca
-  data.tar.gz: 87c0513ffa13f295c78fd054c12ee8d3e79f17464def8174394b0751915ae3f0777e3132b2cd3a0feb3c028118843b7473425513bb0534f726a1c9ab2ca51a51
+  metadata.gz: 5b020228f7e344bf79771883bf498f25315078f0a8282ea617e817d658808c7706f70dc8325e1c759cf305177e9999a9f8c564666f366e25f3a9c7f85156c8c8
+  data.tar.gz: 57ab3706f6025956a4e08d4c3c332b36685cb4f9d8dedbf5d88ccfe4ff445d4d7c572a74bea5d64071e1e9b19ddcad938357836f07c0e0a630f86cca1c5c3d0f

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## Authentication Zero 2.16.24 ##
+
+* Remove otp secret from client
+
 ## Authentication Zero 2.16.21 ##
 
 * Add two factor authentication using a hardware security key (--webauthn)

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authentication-zero (2.16.22)
+    authentication-zero (2.16.24)
 
 GEM
   remote: https://rubygems.org/

data/lib/authentication_zero/version.rb

@@ -1,3 +1,3 @@
 module AuthenticationZero
-  VERSION = "2.16.22"
+  VERSION = "2.16.24"
 end

data/lib/generators/authentication/templates/controllers/html/sessions_controller.rb.tt

@@ -16,7 +16,7 @@ class SessionsController < ApplicationController
 
     if user && user.authenticate(params[:password])
       <%- if two_factor? -%>
-      if user.otp_secret.present?
+      if user.otp_required_for_sign_in?
         session[:challenge_token] = user.signed_id(purpose: :authentication_challenge, expires_in: 20.minutes)
         redirect_to new_two_factor_authentication_challenge_totp_path
       else

data/lib/generators/authentication/templates/controllers/html/two_factor_authentication/profile/totps_controller.rb.tt

@@ -3,12 +3,12 @@ class TwoFactorAuthentication::Profile::TotpsController < ApplicationController
   before_action :set_totp
 
   def new
-    @qr_code = RQRCode::QRCode.new(@totp.provisioning_uri(@user.email))
+    @qr_code = RQRCode::QRCode.new(provisioning_uri)
   end
 
   def create
     if @totp.verify(params[:code], drift_behind: 15)
-      @user.update! otp_secret: params[:secret]
+      @user.update! otp_required_for_sign_in: true
       redirect_to two_factor_authentication_profile_recovery_codes_path
     else
       redirect_to new_two_factor_authentication_profile_totp_path, alert: "That code didn't work. Please try again"
@@ -21,6 +21,10 @@ class TwoFactorAuthentication::Profile::TotpsController < ApplicationController
     end
 
     def set_totp
-      @totp = ROTP::TOTP.new(params[:secret] || ROTP::Base32.random, issuer: "YourAppName")
+      @totp = ROTP::TOTP.new(@user.otp_secret, issuer: "YourAppName")
+    end
+
+    def provisioning_uri
+      @totp.provisioning_uri @user.email
     end
 end

data/lib/generators/authentication/templates/erb/home/index.html.erb.tt

@@ -16,7 +16,7 @@
   <%%= link_to "Two-Factor Authentication", new_two_factor_authentication_profile_totp_path %>
 </div>
 
-<%% if Current.user.otp_secret.present? %>
+<%% if Current.user.otp_required_for_sign_in? %>
   <div><%%= link_to "Recovery Codes", two_factor_authentication_profile_recovery_codes_path %></div>
   <%- if webauthn? -%>
   <div><%%= link_to "Security keys", two_factor_authentication_profile_security_keys_path %></div>

data/lib/generators/authentication/templates/erb/two_factor_authentication/profile/totps/new.html.erb.tt

@@ -15,8 +15,6 @@
 </figure>
 
 <%%= form_with(url: two_factor_authentication_profile_totp_path) do |form| %>
-  <%%= form.hidden_field :secret, value: @totp.secret %>
-
   <div>
     <%%= form.label :code, "After scanning with your camera, the app will generate a six-digit code. Enter it here:", style: "display: block" %>
     <%%= form.text_field :code, required: true, autofocus: true, autocomplete: :off %>

data/lib/generators/authentication/templates/migrations/create_users_migration.rb.tt

@@ -6,10 +6,11 @@ class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Mi
 
       t.boolean :verified, null: false, default: false
       <%- if two_factor? %>
-      t.string :otp_secret
+      t.boolean :otp_required_for_sign_in, null: false, default: false
+      t.string  :otp_secret, null: false
       <%- end -%>
       <%- if webauthn? %>
-      t.string :webauthn_id
+      t.string :webauthn_id, null: false
       <%- end -%>
       <%- if omniauthable? %>
       t.string :provider

data/lib/generators/authentication/templates/models/user.rb.tt

@@ -30,8 +30,13 @@ class User < ApplicationRecord
   before_validation if: :email_changed?, on: :update do
     self.verified = false
   end
+  <%- if two_factor? %>
+  before_create do
+    self.otp_secret = ROTP::Base32.random
+  end
+  <%- end -%>
   <%- if webauthn? %>
-  before_validation if: :otp_secret_changed?, on: :update do
+  before_create do
     self.webauthn_id = WebAuthn.generate_user_id
   end
   <%- end -%>

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authentication-zero
 version: !ruby/object:Gem::Version
-  version: 2.16.22
+  version: 2.16.24
 platform: ruby
 authors:
 - Nixon
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-04-12 00:00:00.000000000 Z
+date: 2023-04-13 00:00:00.000000000 Z
 dependencies: []
 description:
 email: