authentication-zero 2.2.8 → 2.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b36f33fad8ac0fd532efd29f0db68dc51bcac45a8fff39d53f914d7d3f4381e6
-  data.tar.gz: f44735476b0095bd9f4c5dd9db09c16b9e8bc7edf636d32372da2a974bfe249b
+  metadata.gz: ecdb3e457838bc86f570bc73f0d7766cb68743b04fc3eebbecd20c3fce0ed836
+  data.tar.gz: 9581bcee36b253a0f0811df40d226b588d0c2b5535ffd6c1993ce98ef1d64b61
 SHA512:
-  metadata.gz: 1fb6d2a12d39475fa1ced3b188230426ad18fc67bef7c6f560e1744bc73b17e45b676bf8b68c79129474004fbe9e47150c4fd82b36cdd78555772df03f398d8b
-  data.tar.gz: 0d1b0553b77a69ee1a67546c9d2e749abf47481cc2cf7355eda039777ade3ad14d95531ea640b694d698ccac7f7603fdf1d70faf2e1efac2ab59c79b90613e09
+  metadata.gz: 3acf56145974e3fdcdf9edbc5524be60c2dcccdc44787fe3f97cc77f367fcdb6f40984f6c8a7ecf1e35e2228037813516609326fe0951c74a7f2be2f0dce9969
+  data.tar.gz: 190228711ae47a0960233cb61ceb6273a6698981f379aca58afb79d9aec0182bc9c122606cec2d68c77fd9fad64474ed27d55b894f3306d9f424b31a8f50a2fd

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authentication-zero (2.2.8)
+    authentication-zero (2.3.0)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -8,10 +8,11 @@ The purpose of authentication zero is to generate a pre-built authentication sys
 - **Inspired by hey.com**
 - Sign up
 - Email and password validations
-- Reset the user password and send reset instructions
-- Reset the user password only from verified emails
 - Authentication by cookie (html)
 - Authentication by token (api)
+- Ask password before sensitive data changes, aka: sudo
+- Reset the user password and send reset instructions
+- Reset the user password only from verified emails
 - Send e-mail verification when your email has been changed
 - Send email when someone has logged into your account
 - Manage multiple sessions & devices

data/lib/authentication_zero/version.rb

@@ -1,3 +1,3 @@
 module AuthenticationZero
-  VERSION = "2.2.8"
+  VERSION = "2.3.0"
 end

data/lib/generators/authentication/authentication_generator.rb

@@ -11,7 +11,7 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
   class_option :fixture, type: :boolean, default: true
   class_option :system_tests, type: :string, desc: "Skip system test files"
 
-  class_option :skip_routes, type: :boolean
+  class_option :skip_routes, type: :boolean, default: false
   class_option :template_engine, type: :string, desc: "Template engine to be invoked"
 
   source_root File.expand_path("templates", __dir__)
@@ -47,27 +47,37 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
 
       before_action :authenticate
 
-      private
-        def authenticate
-          if session = authenticate_with_http_token { |token, _| Session.find_signed(token) }
-            Current.session = session
-          else
-            request_http_token_authentication
-          end
+      def authenticate
+        if session = authenticate_with_http_token { |token, _| Session.find_signed(token) }
+          Current.session = session
+        else
+          request_http_token_authentication
         end
+      end
+
+      def require_sudo
+        if Time.current > 30.minutes.after(Current.session.sudo_at)
+          render json: { error: "Enter your password to continue" }, status: :forbidden
+        end
+      end
     CODE
 
     html_code = <<~CODE
       before_action :authenticate
 
-      private
-        def authenticate
-          if session = Session.find_by_id(cookies.signed[:session_token])
-            Current.session = session
-          else
-            redirect_to sign_in_path
-          end
+      def authenticate
+        if session = Session.find_by_id(cookies.signed[:session_token])
+          Current.session = session
+        else
+          redirect_to sign_in_path
+        end
+      end
+
+      def require_sudo
+        if Time.current > 30.minutes.after(Current.session.sudo_at)
+          redirect_to new_sudo_path(proceed_to_url: request.url)
         end
+      end
     CODE
 
     inject_code = options.api? ? api_code : html_code
@@ -93,6 +103,7 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
 
   def add_routes
     unless options.skip_routes
+      route "resource :sudo, only: [:new, :create]"
       route "resource :registration, only: :destroy"
       route "resource :password_reset, only: [:new, :edit, :create, :update]"
       route "resource :password, only: [:edit, :update]"

data/lib/generators/authentication/templates/controllers/api/emails_controller.rb.tt

@@ -1,6 +1,6 @@
 class EmailsController < ApplicationController
+  before_action :require_sudo
   before_action :set_<%= singular_table_name %>
-  before_action :validate_current_password
 
   def update
     if @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
@@ -18,10 +18,4 @@ class EmailsController < ApplicationController
     def <%= "#{singular_table_name}_params" %>
       params.permit(:email)
     end
-
-    def validate_current_password
-      unless @<%= singular_table_name %>.authenticate(params[:current_password])
-        render json: { error: "The current password you entered is incorrect" }, status: :bad_request
-      end
-    end
 end

data/lib/generators/authentication/templates/controllers/api/password_resets_controller.rb.tt

@@ -1,11 +1,11 @@
 class PasswordResetsController < ApplicationController
-  before_action :set_<%= singular_table_name %>, only: :update
-
   skip_before_action :authenticate
 
+  before_action :set_<%= singular_table_name %>, only: :update
+
   def create
-    if @<%= singular_table_name %> = <%= class_name %>.find_by(email: params[:email], verified: true)
-      IdentityMailer.with(<%= singular_table_name %>: @<%= singular_table_name %>).password_reset_provision.deliver_later
+    if <%= singular_table_name %> = <%= class_name %>.find_by(email: params[:email], verified: true)
+      IdentityMailer.with(<%= singular_table_name %>: <%= singular_table_name %>).password_reset_provision.deliver_later
     else
       render json: { error: "You can't reset your password until you verify your email" }, status: :not_found
     end

data/lib/generators/authentication/templates/controllers/api/passwords_controller.rb.tt

@@ -1,9 +1,10 @@
 class PasswordsController < ApplicationController
   before_action :set_<%= singular_table_name %>
-  before_action :validate_current_password
 
   def update
-    if @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
+    if !@<%= singular_table_name %>.authenticate(params[:current_password])
+      render json: { error: "The current password you entered is incorrect" }, status: :bad_request
+    elsif @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
       render json: @<%= singular_table_name %>
     else
       render json: @<%= singular_table_name %>.errors, status: :unprocessable_entity
@@ -18,10 +19,4 @@ class PasswordsController < ApplicationController
     def <%= "#{singular_table_name}_params" %>
       params.permit(:password, :password_confirmation)
     end
-
-    def validate_current_password
-      unless @<%= singular_table_name %>.authenticate(params[:current_password])
-        render json: { error: "The current password you entered is incorrect" }, status: :bad_request
-      end
-    end
 end

data/lib/generators/authentication/templates/controllers/api/registrations_controller.rb.tt

@@ -2,12 +2,12 @@ class RegistrationsController < ApplicationController
   skip_before_action :authenticate, only: :create
 
   def create
-    @<%= singular_table_name %> = <%= class_name %>.new(<%= "#{singular_table_name}_params" %>)
+    <%= singular_table_name %> = <%= class_name %>.new(<%= "#{singular_table_name}_params" %>)
 
-    if @<%= singular_table_name %>.save
-      render json: @<%= singular_table_name %>, status: :created
+    if <%= singular_table_name %>.save
+      render json: <%= singular_table_name %>, status: :created
     else
-      render json: @<%= singular_table_name %>.errors, status: :unprocessable_entity
+      render json: <%= singular_table_name %>.errors, status: :unprocessable_entity
     end
   end
 

data/lib/generators/authentication/templates/controllers/api/sessions_controller.rb.tt

@@ -1,8 +1,8 @@
 class SessionsController < ApplicationController
-  before_action :set_session, only: %i[ show destroy ]
-
   skip_before_action :authenticate, only: :create
 
+  before_action :set_session, only: %i[ show destroy ]
+
   def index
     render json: Current.<%= singular_table_name %>.sessions.order(created_at: :desc)
   end
@@ -12,10 +12,10 @@ class SessionsController < ApplicationController
   end
 
   def create
-    @<%= singular_table_name %> = <%= class_name %>.find_by_email(params[:email])
+    <%= singular_table_name %> = <%= class_name %>.find_by_email(params[:email])
 
-    if @<%= singular_table_name %> && @<%= singular_table_name %>.authenticate(params[:password])
-      session = @<%= singular_table_name %>.sessions.create!(session_params)
+    if <%= singular_table_name %> && <%= singular_table_name %>.authenticate(params[:password])
+      session = <%= singular_table_name %>.sessions.create!(session_params)
       response.set_header("X-Session-Token", session.signed_id)
 
       render json: session, status: :created
@@ -34,6 +34,6 @@ class SessionsController < ApplicationController
     end
 
     def session_params
-      { user_agent: request.user_agent, ip_address: request.remote_ip }
+      { user_agent: request.user_agent, ip_address: request.remote_ip, sudo_at: Time.current }
     end
 end

data/lib/generators/authentication/templates/controllers/api/sudos_controller.rb.tt

@@ -0,0 +1,11 @@
+class SudosController < ApplicationController
+  def create
+    session = Current.session
+
+    if session.<%= singular_table_name %>.authenticate(params[:password])
+      session.update! sudo_at: Time.current
+    else
+      render json: { error: "The password you entered is incorrect" }, status: :bad_request
+    end
+  end
+end

data/lib/generators/authentication/templates/controllers/html/emails_controller.rb.tt

@@ -1,6 +1,6 @@
 class EmailsController < ApplicationController
+  before_action :require_sudo
   before_action :set_<%= singular_table_name %>
-  before_action :validate_current_password, only: :update
 
   def edit
   end
@@ -21,10 +21,4 @@ class EmailsController < ApplicationController
     def <%= "#{singular_table_name}_params" %>
       params.require(:<%= singular_table_name %>).permit(:email)
     end
-
-    def validate_current_password
-      unless @<%= singular_table_name %>.authenticate(params[:current_password])
-        redirect_to edit_email_path, alert: "The current password you entered is incorrect"
-      end
-    end
 end

data/lib/generators/authentication/templates/controllers/html/password_resets_controller.rb.tt

@@ -1,8 +1,8 @@
 class PasswordResetsController < ApplicationController
-  before_action :set_<%= singular_table_name %>, only: %i[ edit update ]
-
   skip_before_action :authenticate
 
+  before_action :set_<%= singular_table_name %>, only: %i[ edit update ]
+
   def new
   end
 
@@ -10,8 +10,8 @@ class PasswordResetsController < ApplicationController
   end
 
   def create
-    if @<%= singular_table_name %> = <%= class_name %>.find_by(email: params[:email], verified: true)
-      IdentityMailer.with(<%= singular_table_name %>: @<%= singular_table_name %>).password_reset_provision.deliver_later
+    if <%= singular_table_name %> = <%= class_name %>.find_by(email: params[:email], verified: true)
+      IdentityMailer.with(<%= singular_table_name %>: <%= singular_table_name %>).password_reset_provision.deliver_later
       redirect_to sign_in_path, notice: "Check your email for reset instructions"
     else
       redirect_to new_password_reset_path, alert: "You can't reset your password until you verify your email"

data/lib/generators/authentication/templates/controllers/html/passwords_controller.rb.tt

@@ -1,12 +1,13 @@
 class PasswordsController < ApplicationController
   before_action :set_<%= singular_table_name %>
-  before_action :validate_current_password, only: :update
 
   def edit
   end
 
   def update
-    if @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
+    if !@<%= singular_table_name %>.authenticate(params[:current_password])
+      redirect_to edit_password_path, alert: "The current password you entered is incorrect"
+    elsif @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
       redirect_to root_path, notice: "Your password has been changed"
     else
       render :edit, status: :unprocessable_entity
@@ -21,10 +22,4 @@ class PasswordsController < ApplicationController
     def <%= "#{singular_table_name}_params" %>
       params.require(:<%= singular_table_name %>).permit(:password, :password_confirmation)
     end
-
-    def validate_current_password
-      unless @<%= singular_table_name %>.authenticate(params[:current_password])
-        redirect_to edit_password_path, alert: "The current password you entered is incorrect"
-      end
-    end
 end

data/lib/generators/authentication/templates/controllers/html/registrations_controller.rb.tt

@@ -6,10 +6,10 @@ class RegistrationsController < ApplicationController
   end
 
   def create
-    @<%= singular_table_name %> = <%= class_name %>.new(<%= "#{singular_table_name}_params" %>)
+    <%= singular_table_name %> = <%= class_name %>.new(<%= "#{singular_table_name}_params" %>)
 
-    if @<%= singular_table_name %>.save
-      session = @<%= singular_table_name %>.sessions.create!(session_params)
+    if <%= singular_table_name %>.save
+      session = <%= singular_table_name %>.sessions.create!(session_params)
       cookies.signed.permanent[:session_token] = { value: session.id, httponly: true }
 
       redirect_to root_path, notice: "Welcome! You have signed up successfully"
@@ -19,8 +19,7 @@ class RegistrationsController < ApplicationController
   end
 
   def destroy
-    Current.<%= singular_table_name %>.destroy
-    redirect_to sign_in_path, notice: "Your account is closed"
+    Current.<%= singular_table_name %>.destroy; redirect_to(sign_in_path, notice: "Your account is closed")
   end
 
   private
@@ -29,6 +28,6 @@ class RegistrationsController < ApplicationController
     end
 
     def session_params
-      { user_agent: request.user_agent, ip_address: request.remote_ip }
+      { user_agent: request.user_agent, ip_address: request.remote_ip, sudo_at: Time.current }
     end
 end

data/lib/generators/authentication/templates/controllers/html/sessions_controller.rb.tt

@@ -1,8 +1,8 @@
 class SessionsController < ApplicationController
-  before_action :set_session, only: :destroy
-
   skip_before_action :authenticate, only: %i[ new create ]
 
+  before_action :set_session, only: :destroy
+
   def index
     @sessions = Current.<%= singular_table_name %>.sessions.order(created_at: :desc)
   end
@@ -12,10 +12,10 @@ class SessionsController < ApplicationController
   end
 
   def create
-    @<%= singular_table_name %> = <%= class_name %>.find_by_email(params[:email])
+    <%= singular_table_name %> = <%= class_name %>.find_by_email(params[:email])
 
-    if @<%= singular_table_name %> && @<%= singular_table_name %>.authenticate(params[:password])
-      session = @<%= singular_table_name %>.sessions.create!(session_params)
+    if <%= singular_table_name %> && <%= singular_table_name %>.authenticate(params[:password])
+      session = <%= singular_table_name %>.sessions.create!(session_params)
       cookies.signed.permanent[:session_token] = { value: session.id, httponly: true }
 
       redirect_to root_path, notice: "Signed in successfully"
@@ -35,6 +35,6 @@ class SessionsController < ApplicationController
     end
 
     def session_params
-      { user_agent: request.user_agent, ip_address: request.remote_ip }
+      { user_agent: request.user_agent, ip_address: request.remote_ip, sudo_at: Time.current }
     end
 end

data/lib/generators/authentication/templates/controllers/html/sudos_controller.rb.tt

@@ -0,0 +1,14 @@
+class SudosController < ApplicationController
+  def new
+  end
+
+  def create
+    session = Current.session
+
+    if session.<%= singular_table_name %>.authenticate(params[:password])
+      session.update!(sudo_at: Time.current); redirect_to(params[:proceed_to_url])
+    else
+      redirect_to new_sudo_path(proceed_to_url: params[:proceed_to_url]), alert: "The password you entered is incorrect"
+    end
+  end
+end

data/lib/generators/authentication/templates/erb/emails/edit.html.erb.tt

@@ -21,11 +21,6 @@
     </div>
   <%% end %>
 
-  <div>
-    <%%= label_tag :current_password, nil, style: "display: block" %>
-    <%%= password_field_tag :current_password, nil, autofocus: true, autocomplete: "current-password" %>
-  </div>
-
   <div>
     <%%= form.label :email, "New email", style: "display: block" %>
     <%%= form.email_field :email %>

data/lib/generators/authentication/templates/erb/password_resets/edit.html.erb.tt

@@ -18,7 +18,7 @@
   <div>
     <%%= form.label :password, "New password", style: "display: block" %>
     <%%= form.password_field :password, autofocus: true, autocomplete: "new-password" %>
-    <div>8 characters minimum.</div>
+    <div>12 characters minimum.</div>
   </div>
 
   <div>

data/lib/generators/authentication/templates/erb/passwords/edit.html.erb.tt

@@ -23,7 +23,7 @@
   <div>
     <%%= form.label :password, "New password", style: "display: block" %>
     <%%= form.password_field :password, autocomplete: "new-password" %>
-    <div>8 characters minimum.</div>
+    <div>12 characters minimum.</div>
   </div>
 
   <div>

data/lib/generators/authentication/templates/erb/registrations/new.html.erb.tt

@@ -21,7 +21,7 @@
   <div>
     <%%= form.label :password, style: "display: block" %>
     <%%= form.password_field :password, autocomplete: "new-password" %>
-    <div>8 characters minimum.</div>
+    <div>12 characters minimum.</div>
   </div>
 
   <div>

data/lib/generators/authentication/templates/erb/sudos/new.html.erb.tt

@@ -0,0 +1,28 @@
+<p style="color: red"><%%= alert %></p>
+
+<h1>Enter your password to continue</h1>
+
+<%%= form_with(url: sudo_path) do |form| %>
+
+  <%%= hidden_field_tag :proceed_to_url, params[:proceed_to_url] %>
+
+  <div>
+    <%%= password_field_tag :password, nil, autofocus: true, autocomplete: "current-password" %>
+  </div>
+
+  <div>
+    <%%= form.submit "Continue" %>
+  </div>
+<%% end %>
+
+<br>
+
+<p>
+  <strong>Why are you asking me to do this?</strong><br>
+  To better protect your account, we'll occasionally ask you to confirm your password before performing sensitive actions.
+</p>
+
+<p>
+  <strong>Forgot your password?</strong><br>
+  We'll help you <%%= link_to "reset it", new_password_reset_path %> so you can continue.
+</p>

data/lib/generators/authentication/templates/migrations/create_sessions_migration.rb.tt

@@ -5,6 +5,8 @@ class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Mi
       t.string :user_agent
       t.string :ip_address
 
+      t.datetime :sudo_at, null: false
+
       t.timestamps
     end
   end

data/lib/generators/authentication/templates/models/model.rb.tt

@@ -4,8 +4,10 @@ class <%= class_name %> < ApplicationRecord
   has_many :sessions, dependent: :destroy
 
   validates :email, presence: true, uniqueness: true
-  validates :email, format: { with: /\A[^@\s]+@[^@\s]+\z/ }
-  validates_length_of :password, minimum: 8, allow_blank: true
+  validates_format_of :email, with: /\A[^@\s]+@[^@\s]+\z/
+
+  validates_length_of :password, minimum: 12, allow_blank: true
+  validates_format_of :password, with: /(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])/, allow_blank: true, message: "might easily be guessed"
 
   before_validation do
     self.email = email.downcase.strip
@@ -15,6 +17,10 @@ class <%= class_name %> < ApplicationRecord
     self.verified = false
   end
 
+  after_update if: :password_digest_previously_changed? do
+    sessions.where.not(id: Current.session).destroy_all
+  end
+
   after_create_commit do
     IdentityMailer.with(<%= singular_table_name %>: self).email_verify_confirmation.deliver_later
   end

data/lib/generators/authentication/templates/test_unit/controllers/api/email_verifications_controller_test.rb.tt

@@ -39,6 +39,6 @@ class EmailVerificationsControllerTest < ActionDispatch::IntegrationTest
   end
 
   def sign_in_as(<%= singular_table_name %>)
-    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "secret123" }); [<%= singular_table_name %>, response.headers["X-Session-Token"]]
+    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "Secret123456" }); [<%= singular_table_name %>, response.headers["X-Session-Token"]]
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/api/emails_controller_test.rb.tt

@@ -6,18 +6,20 @@ class EmailsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update email" do
-    patch email_url, params: { current_password: "secret123", email: "new_email@hey.com" }, headers: { "Authorization" => "Bearer #{@token}" }
+    patch email_url, params: { email: "new_email@hey.com" }, headers: { "Authorization" => "Bearer #{@token}" }
     assert_response :success
   end
 
-  test "should not update email with wrong current password" do
-    patch email_url, params: { current_password: "wrong_password", email: @<%= singular_table_name %>.email }, headers: { "Authorization" => "Bearer #{@token}" }
+  test "should not update email without sudo" do
+    @<%= singular_table_name %>.sessions.last.update! sudo_at: 1.day.ago
 
-    assert_response :bad_request
-    assert_equal "The current password you entered is incorrect", response.parsed_body["error"]
+    patch email_url, params: { email: "new_email@hey.com" }, headers: { "Authorization" => "Bearer #{@token}" }
+
+    assert_response :forbidden
+    assert_equal "Enter your password to continue", response.parsed_body["error"]
   end
 
   def sign_in_as(<%= singular_table_name %>)
-    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "secret123" }); [<%= singular_table_name %>, response.headers["X-Session-Token"]]
+    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "Secret123456" }); [<%= singular_table_name %>, response.headers["X-Session-Token"]]
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/api/password_resets_controller_test.rb.tt

@@ -25,7 +25,7 @@ class PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should not send a password reset email to a unverified email" do
-    @<%= singular_table_name %>.update!(verified: false)
+    @<%= singular_table_name %>.update! verified: false
 
     assert_no_enqueued_emails do
       post password_reset_url, params: { email: @<%= singular_table_name %>.email }
@@ -36,12 +36,12 @@ class PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update password" do
-    patch password_reset_url, params: { token: @sid, password: "new_password", password_confirmation: "new_password" }
+    patch password_reset_url, params: { token: @sid, password: "Secret654321", password_confirmation: "Secret654321" }
     assert_response :success
   end
 
   test "should not update password with expired token" do
-    patch password_reset_url, params: { token: @sid_exp, password: "new_password", password_confirmation: "new_password" }
+    patch password_reset_url, params: { token: @sid_exp, password: "Secret654321", password_confirmation: "Secret654321" }
 
     assert_response :bad_request
     assert_equal "That password reset link is invalid", response.parsed_body["error"]

data/lib/generators/authentication/templates/test_unit/controllers/api/passwords_controller_test.rb.tt

@@ -6,18 +6,18 @@ class PasswordsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update password" do
-    patch password_url, params: { current_password: "secret123", password: "new_password", password_confirmation: "new_password" }, headers: { "Authorization" => "Bearer #{@token}" }
+    patch password_url, params: { current_password: "Secret123456", password: "Secret654321", password_confirmation: "Secret654321" }, headers: { "Authorization" => "Bearer #{@token}" }
     assert_response :success
   end
 
   test "should not update password with wrong current password" do
-    patch password_url, params: { current_password: "wrong_password", password: "new_password", password_confirmation: "new_password" }, headers: { "Authorization" => "Bearer #{@token}" }
+    patch password_url, params: { current_password: "SecretWrong123", password: "Secret654321", password_confirmation: "Secret654321" }, headers: { "Authorization" => "Bearer #{@token}" }
 
     assert_response :bad_request
     assert_equal "The current password you entered is incorrect", response.parsed_body["error"]
   end
 
   def sign_in_as(<%= singular_table_name %>)
-    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "secret123" }); [<%= singular_table_name %>, response.headers["X-Session-Token"]]
+    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "Secret123456" }); [<%= singular_table_name %>, response.headers["X-Session-Token"]]
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/api/registrations_controller_test.rb.tt

@@ -3,7 +3,7 @@ require "test_helper"
 class RegistrationsControllerTest < ActionDispatch::IntegrationTest
   test "should sign up" do
     assert_difference("<%= class_name %>.count") do
-      post sign_up_url, params: { email: "lazaronixon@hey.com", password: "secret123", password_confirmation: "secret123" }
+      post sign_up_url, params: { email: "lazaronixon@hey.com", password: "Secret123456", password_confirmation: "Secret123456" }
     end
 
     assert_response :created
@@ -20,6 +20,6 @@ class RegistrationsControllerTest < ActionDispatch::IntegrationTest
   end
 
   def sign_in_as(<%= singular_table_name %>)
-    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "secret123" }); [<%= singular_table_name %>, response.headers["X-Session-Token"]]
+    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "Secret123456" }); [<%= singular_table_name %>, response.headers["X-Session-Token"]]
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/api/sessions_controller_test.rb.tt

@@ -16,14 +16,14 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should sign in" do
-    post sign_in_url, params: { email: @<%= singular_table_name %>.email, password: "secret123" }
+    post sign_in_url, params: { email: @<%= singular_table_name %>.email, password: "Secret123456" }
 
     assert_enqueued_email_with SessionMailer, :signed_in_notification, args: { session: @<%= singular_table_name %>.sessions.last }
     assert_response :created
   end
 
   test "should not sign in with wrong credentials" do
-    post sign_in_url, params: { email: @<%= singular_table_name %>.email, password: "wrong_password" }
+    post sign_in_url, params: { email: @<%= singular_table_name %>.email, password: "SecretWrong123" }
     assert_response :unauthorized
   end
 
@@ -33,6 +33,6 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest
   end
 
   def sign_in_as(<%= singular_table_name %>)
-    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "secret123" }); [<%= singular_table_name %>, response.headers["X-Session-Token"]]
+    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "Secret123456" }); [<%= singular_table_name %>, response.headers["X-Session-Token"]]
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/api/sudos_controller_test.rb.tt

@@ -0,0 +1,24 @@
+require "test_helper"
+
+class SudosControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @<%= singular_table_name %>, @token = sign_in_as(<%= table_name %>(:lazaro_nixon))
+    @<%= singular_table_name %>.sessions.last.update! sudo_at: 1.day.ago
+  end
+
+  test "should sudo" do
+    post sudo_url, params: { password: "Secret123456" }, headers: { "Authorization" => "Bearer #{@token}" }
+    assert_response :no_content
+  end
+
+  test "should not sudo with wrong password" do
+    post sudo_url, params: { password: "SecretWrong123" }, headers: { "Authorization" => "Bearer #{@token}" }
+
+    assert_response :bad_request
+    assert_equal "The password you entered is incorrect", response.parsed_body["error"]
+  end
+
+  def sign_in_as(<%= singular_table_name %>)
+    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "Secret123456" }); [<%= singular_table_name %>, response.headers["X-Session-Token"]]
+  end
+end

data/lib/generators/authentication/templates/test_unit/controllers/html/email_verifications_controller_test.rb.tt

@@ -39,6 +39,6 @@ class EmailVerificationsControllerTest < ActionDispatch::IntegrationTest
   end
 
   def sign_in_as(<%= singular_table_name %>)
-    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "secret123" }); <%= singular_table_name %>
+    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "Secret123456" }); <%= singular_table_name %>
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/html/emails_controller_test.rb.tt

@@ -10,19 +10,26 @@ class EmailsControllerTest < ActionDispatch::IntegrationTest
     assert_response :success
   end
 
+  test "should not get edit without sudo" do
+    @<%= singular_table_name %>.sessions.last.update! sudo_at: 1.day.ago
+
+    get edit_email_url
+    assert_redirected_to new_sudo_path(proceed_to_url: edit_email_url)
+  end
+
   test "should update email" do
-    patch email_url, params: { current_password: "secret123", <%= singular_table_name %>: { email: "new_email@hey.com" } }
+    patch email_url, params: { <%= singular_table_name %>: { email: "new_email@hey.com" } }
     assert_redirected_to root_path
   end
 
-  test "should not update email with wrong current password" do
-    patch email_url, params: { current_password: "wrong_password", <%= singular_table_name %>: { email: @<%= singular_table_name %>.email } }
+  test "should not update email without sudo" do
+    @<%= singular_table_name %>.sessions.last.update! sudo_at: 1.day.ago
 
-    assert_redirected_to edit_email_path
-    assert_equal "The current password you entered is incorrect", flash[:alert]
+    patch email_url, params: { <%= singular_table_name %>: { email: "new_email@hey.com" } }
+    assert_redirected_to new_sudo_path(proceed_to_url: email_url)
   end
 
   def sign_in_as(<%= singular_table_name %>)
-    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "secret123" }); <%= singular_table_name %>
+    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "Secret123456" }); <%= singular_table_name %>
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/html/password_resets_controller_test.rb.tt

@@ -35,7 +35,7 @@ class PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should not send a password reset email to a unverified email" do
-    @<%= singular_table_name %>.update!(verified: false)
+    @<%= singular_table_name %>.update! verified: false
 
     assert_no_enqueued_emails do
       post password_reset_url, params: { email: @<%= singular_table_name %>.email }
@@ -46,12 +46,12 @@ class PasswordResetsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update password" do
-    patch password_reset_url, params: { token: @sid, <%= singular_table_name %>: { password: "new_password", password_confirmation: "new_password" } }
+    patch password_reset_url, params: { token: @sid, <%= singular_table_name %>: { password: "Secret654321", password_confirmation: "Secret654321" } }
     assert_redirected_to sign_in_path
   end
 
   test "should not update password with expired token" do
-    patch password_reset_url, params: { token: @sid_exp, password: "new_password", password_confirmation: "new_password" }
+    patch password_reset_url, params: { token: @sid_exp, password: "Secret654321", password_confirmation: "Secret654321" }
 
     assert_redirected_to new_password_reset_path
     assert_equal "That password reset link is invalid", flash[:alert]

data/lib/generators/authentication/templates/test_unit/controllers/html/passwords_controller_test.rb.tt

@@ -11,18 +11,18 @@ class PasswordsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should update password" do
-    patch password_url, params: { current_password: "secret123", <%= singular_table_name %>: { password: "new_password", password_confirmation: "new_password" } }
+    patch password_url, params: { current_password: "Secret123456", <%= singular_table_name %>: { password: "Secret654321", password_confirmation: "Secret654321" } }
     assert_redirected_to root_path
   end
 
   test "should not update password with wrong current password" do
-    patch password_url, params: { current_password: "wrong_password", <%= singular_table_name %>: { password: "new_password", password_confirmation: "new_password" } }
+    patch password_url, params: { current_password: "SecretWrong123", <%= singular_table_name %>: { password: "Secret654321", password_confirmation: "Secret654321" } }
 
     assert_redirected_to edit_password_path
     assert_equal "The current password you entered is incorrect", flash[:alert]
   end
 
   def sign_in_as(<%= singular_table_name %>)
-    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "secret123" }); <%= singular_table_name %>
+    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "Secret123456" }); <%= singular_table_name %>
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/html/registrations_controller_test.rb.tt

@@ -8,7 +8,7 @@ class RegistrationsControllerTest < ActionDispatch::IntegrationTest
 
   test "should sign up" do
     assert_difference("<%= class_name %>.count") do
-      post sign_up_url, params: { <%= singular_table_name %>: { email: "lazaronixon@hey.com", password: "secret123", password_confirmation: "secret123" } }
+      post sign_up_url, params: { <%= singular_table_name %>: { email: "lazaronixon@hey.com", password: "Secret123456", password_confirmation: "Secret123456" } }
     end
 
     assert_redirected_to root_url
@@ -25,6 +25,6 @@ class RegistrationsControllerTest < ActionDispatch::IntegrationTest
   end
 
   def sign_in_as(<%= singular_table_name %>)
-    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "secret123" }); <%= singular_table_name %>
+    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "Secret123456" }); <%= singular_table_name %>
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/html/sessions_controller_test.rb.tt

@@ -18,7 +18,7 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should sign in" do
-    post sign_in_url, params: { email: @<%= singular_table_name %>.email, password: "secret123" }
+    post sign_in_url, params: { email: @<%= singular_table_name %>.email, password: "Secret123456" }
     assert_enqueued_email_with SessionMailer, :signed_in_notification, args: { session: @<%= singular_table_name %>.sessions.last }
 
     assert_redirected_to root_url
@@ -28,7 +28,7 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should not sign in with wrong credentials" do
-    post sign_in_url, params: { email: @<%= singular_table_name %>.email, password: "wrong_password" }
+    post sign_in_url, params: { email: @<%= singular_table_name %>.email, password: "SecretWrong123" }
     assert_redirected_to sign_in_url(email_hint: @<%= singular_table_name %>.email)
     assert_equal "That email or password is incorrect", flash[:alert]
 
@@ -47,6 +47,6 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest
   end
 
   def sign_in_as(<%= singular_table_name %>)
-    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "secret123" }); <%= singular_table_name %>
+    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "Secret123456" }); <%= singular_table_name %>
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/html/sudos_controller_test.rb.tt

@@ -0,0 +1,26 @@
+require "test_helper"
+
+class SudosControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @<%= singular_table_name %> = sign_in_as(<%= table_name %>(:lazaro_nixon))
+  end
+
+  test "should get new" do
+    get new_sudo_url(proceed_to_url: edit_password_url)
+    assert_response :success
+  end
+
+  test "should sudo" do
+    post sudo_url, params: { password: "Secret123456", proceed_to_url: edit_password_url }
+    assert_redirected_to edit_password_url
+  end
+
+  test "should not sudo with wrong password" do
+    post sudo_url, params: { password: "SecretWrong123", proceed_to_url: edit_password_url }
+    assert_redirected_to new_sudo_url(proceed_to_url: edit_password_url)
+  end
+
+  def sign_in_as(<%= singular_table_name %>)
+    post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "Secret123456" }); [<%= singular_table_name %>, response.headers["X-Session-Token"]]
+  end
+end

data/lib/generators/authentication/templates/test_unit/fixtures.yml.tt

@@ -2,5 +2,5 @@
 
 lazaro_nixon:
   email: lazaronixon@hotmail.com
-  password_digest: <%%= BCrypt::Password.create("secret123") %>
+  password_digest: <%%= BCrypt::Password.create("Secret123456") %>
   verified: true

data/lib/generators/authentication/templates/test_unit/system/emails_test.rb.tt

@@ -8,7 +8,6 @@ class EmailsTest < ApplicationSystemTestCase
   test "updating the email" do
     click_on "Change email address"
 
-    fill_in "Current password", with: "secret123"
     fill_in "New email", with: "new_email@hey.com"
     click_on "Save changes"
 
@@ -27,9 +26,10 @@ class EmailsTest < ApplicationSystemTestCase
   def sign_in_as(<%= singular_table_name %>)
     visit sign_in_url
     fill_in :email, with: <%= singular_table_name %>.email
-    fill_in :password, with: "secret123"
+    fill_in :password, with: "Secret123456"
     click_on "Sign in"
 
+    assert_current_path root_path
     return <%= singular_table_name %>
   end
 end

data/lib/generators/authentication/templates/test_unit/system/password_resets_test.rb.tt

@@ -19,8 +19,8 @@ class PasswordResetsTest < ApplicationSystemTestCase
   test "updating password" do
     visit edit_password_reset_url(token: @sid)
 
-    fill_in "New password", with: "new_password"
-    fill_in "Confirm new password", with: "new_password"
+    fill_in "New password", with: "Secret654321"
+    fill_in "Confirm new password", with: "Secret654321"
     click_on "Save changes"
 
     assert_text "Your password was reset successfully. Please sign in"

data/lib/generators/authentication/templates/test_unit/system/passwords_test.rb.tt

@@ -8,9 +8,9 @@ class PasswordsTest < ApplicationSystemTestCase
   test "updating the password" do
     click_on "Change password"
 
-    fill_in "Current password", with: "secret123"
-    fill_in "New password", with: "new_password"
-    fill_in "Confirm new password", with: "new_password"
+    fill_in "Current password", with: "Secret123456"
+    fill_in "New password", with: "Secret654321"
+    fill_in "Confirm new password", with: "Secret654321"
     click_on "Save changes"
 
     assert_text "Your password has been changed"
@@ -19,9 +19,10 @@ class PasswordsTest < ApplicationSystemTestCase
   def sign_in_as(<%= singular_table_name %>)
     visit sign_in_url
     fill_in :email, with: <%= singular_table_name %>.email
-    fill_in :password, with: "secret123"
+    fill_in :password, with: "Secret123456"
     click_on "Sign in"
 
+    assert_current_path root_path
     return <%= singular_table_name %>
   end
 end

data/lib/generators/authentication/templates/test_unit/system/registrations_test.rb.tt

@@ -6,12 +6,11 @@ class RegistrationsTest < ApplicationSystemTestCase
   end
 
   test "signing up" do
-    visit sign_in_url
-    click_on "Sign up"
+    visit sign_up_url
 
     fill_in "Email", with: "lazaronixon@hey.com"
-    fill_in "Password", with: "new_password"
-    fill_in "Password confirmation", with: "new_password"
+    fill_in "Password", with: "Secret654321"
+    fill_in "Password confirmation", with: "Secret654321"
     click_on "Sign up"
 
     assert_text "Welcome! You have signed up successfully"
@@ -19,17 +18,18 @@ class RegistrationsTest < ApplicationSystemTestCase
 
   test "cancelling my account" do
     sign_in_as @<%= singular_table_name %>
-    click_on "Cancel my account & delete my data"
 
+    click_on "Cancel my account & delete my data"
     assert_text "Your account is closed"
   end
 
   def sign_in_as(<%= singular_table_name %>)
     visit sign_in_url
     fill_in :email, with: <%= singular_table_name %>.email
-    fill_in :password, with: "secret123"
+    fill_in :password, with: "Secret123456"
     click_on "Sign in"
 
+    assert_current_path root_path
     return <%= singular_table_name %>
   end
 end

data/lib/generators/authentication/templates/test_unit/system/sessions_test.rb.tt

@@ -15,25 +15,19 @@ class SessionsTest < ApplicationSystemTestCase
   test "signing in" do
     visit sign_in_url
     fill_in "Email", with: @<%= singular_table_name %>.email
-    fill_in "Password", with: "secret123"
+    fill_in "Password", with: "Secret123456"
     click_on "Sign in"
 
     assert_text "Signed in successfully"
   end
 
-  test "signing out" do
-    sign_in_as @<%= singular_table_name %>
-
-    click_on "Log out"
-    assert_selector "h1", text: "Sign in"
-  end
-
   def sign_in_as(<%= singular_table_name %>)
     visit sign_in_url
     fill_in :email, with: <%= singular_table_name %>.email
-    fill_in :password, with: "secret123"
+    fill_in :password, with: "Secret123456"
     click_on "Sign in"
 
+    assert_current_path root_path
     return <%= singular_table_name %>
   end
 end

data/lib/generators/authentication/templates/test_unit/system/sudos_test.rb.tt

@@ -0,0 +1,25 @@
+require "application_system_test_case"
+
+class SudosTest < ApplicationSystemTestCase
+  setup do
+    @<%= singular_table_name %> = sign_in_as(<%= table_name %>(:lazaro_nixon))
+  end
+
+  test "executing sudo" do
+    visit new_sudo_url(proceed_to_url: edit_password_url)
+    fill_in :password, with: "Secret123456"
+    click_on "Continue"
+
+    assert_selector "h1", text: "Enter your password to continue"
+  end
+
+  def sign_in_as(<%= singular_table_name %>)
+    visit sign_in_url
+    fill_in :email, with: <%= singular_table_name %>.email
+    fill_in :password, with: "Secret123456"
+    click_on "Sign in"
+
+    assert_current_path root_path
+    return <%= singular_table_name %>
+  end
+end

metadata

@@ -1,16 +1,16 @@
 --- !ruby/object:Gem::Specification
 name: authentication-zero
 version: !ruby/object:Gem::Version
-  version: 2.2.8
+  version: 2.3.0
 platform: ruby
 authors:
 - Nixon
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-02-24 00:00:00.000000000 Z
+date: 2022-02-26 00:00:00.000000000 Z
 dependencies: []
-description: 
+description:
 email:
 - lazaronixon@hotmail.com
 executables: []
@@ -37,12 +37,14 @@ files:
 - lib/generators/authentication/templates/controllers/api/passwords_controller.rb.tt
 - lib/generators/authentication/templates/controllers/api/registrations_controller.rb.tt
 - lib/generators/authentication/templates/controllers/api/sessions_controller.rb.tt
+- lib/generators/authentication/templates/controllers/api/sudos_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/email_verifications_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/emails_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/password_resets_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/passwords_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/registrations_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/sessions_controller.rb.tt
+- lib/generators/authentication/templates/controllers/html/sudos_controller.rb.tt
 - lib/generators/authentication/templates/erb/emails/edit.html.erb.tt
 - lib/generators/authentication/templates/erb/identity_mailer/email_verify_confirmation.html.erb.tt
 - lib/generators/authentication/templates/erb/identity_mailer/email_verify_confirmation.text.erb.tt
@@ -56,6 +58,7 @@ files:
 - lib/generators/authentication/templates/erb/session_mailer/signed_in_notification.text.erb.tt
 - lib/generators/authentication/templates/erb/sessions/index.html.erb.tt
 - lib/generators/authentication/templates/erb/sessions/new.html.erb.tt
+- lib/generators/authentication/templates/erb/sudos/new.html.erb.tt
 - lib/generators/authentication/templates/mailers/identity_mailer.rb.tt
 - lib/generators/authentication/templates/mailers/session_mailer.rb.tt
 - lib/generators/authentication/templates/migrations/create_sessions_migration.rb.tt
@@ -69,18 +72,21 @@ files:
 - lib/generators/authentication/templates/test_unit/controllers/api/passwords_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/api/registrations_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/api/sessions_controller_test.rb.tt
+- lib/generators/authentication/templates/test_unit/controllers/api/sudos_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/html/email_verifications_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/html/emails_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/html/password_resets_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/html/passwords_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/html/registrations_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/html/sessions_controller_test.rb.tt
+- lib/generators/authentication/templates/test_unit/controllers/html/sudos_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/fixtures.yml.tt
 - lib/generators/authentication/templates/test_unit/system/emails_test.rb.tt
 - lib/generators/authentication/templates/test_unit/system/password_resets_test.rb.tt
 - lib/generators/authentication/templates/test_unit/system/passwords_test.rb.tt
 - lib/generators/authentication/templates/test_unit/system/registrations_test.rb.tt
 - lib/generators/authentication/templates/test_unit/system/sessions_test.rb.tt
+- lib/generators/authentication/templates/test_unit/system/sudos_test.rb.tt
 homepage: https://github.com/lazaronixon/authentication-zero
 licenses:
 - MIT
@@ -88,7 +94,7 @@ metadata:
   homepage_uri: https://github.com/lazaronixon/authentication-zero
   source_code_uri: https://github.com/lazaronixon/authentication-zero
   changelog_uri: https://github.com/lazaronixon/authentication-zero/blob/main/CHANGELOG.md
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -103,8 +109,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
-signing_key: 
+rubygems_version: 3.3.7
+signing_key:
 specification_version: 4
 summary: An authentication system generator for Rails applications
 test_files: []