authentication-zero 2.9.3 → 2.11.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d8173a1510dfbe78180ce29cbb83b5f79b84b0ed4ecacf0569344905c28f2a01
-  data.tar.gz: 9d89bc1c96a4b59b7c7bf2437bd038036e747f4e78c0a7d5a81f1c0ae4c86f28
+  metadata.gz: 26344aaefae4e99ea2048950089e5927a62d473f85d94596456006d6edbbc8ee
+  data.tar.gz: eebff7007c4754244993ac76b022081ccbd0201dac5cd1611ec84f8845e7a5d0
 SHA512:
-  metadata.gz: 34a5ed73cbd7f5e35cd9a1e16ae0e4880a677ffa94f3892c0c6292abb436b3fded01c4664dd5e77d5b8025718b60ea8507bdbd968243d94ef191980615b02ea4
-  data.tar.gz: 2afb2c4fbc2bef0c7e06fab12cf783f04c6bc811d7150ed58f4a73f430c23925f4e790c6e3477729e04f2ade59b80dd30220667952d7b41cc98a4106fc4e064e
+  metadata.gz: 6ccd04a438745b60d071c9203c5e36588b01333a17e37a5ee1067c7007824d52fb2a3be0c5e4864868c393f9dec04e2284487651f7d7b0f908c238dcbf4a9dd2
+  data.tar.gz: 51b53ff133cdf9a69e42f29cadd19127646d6c98a6d476c1565c5e6151708b57f4076e1f19af4f4335b8bd6a08ac90b9328b6fe393f85d702dd7d415621a9c8a

data/.rubocop.yml

@@ -0,0 +1,15 @@
+inherit_from: https://raw.githubusercontent.com/rails/rails/master/.rubocop.yml
+
+Performance:
+  Exclude:
+    - 'test/**/*'
+
+Style/FrozenStringLiteralComment:
+  Enabled: false
+
+Style/StringLiterals:
+  Enabled: true
+  EnforcedStyle: double_quotes
+  Include:
+    - 'app/**/*'
+    - 'test/**/*'

data/CHANGELOG.md

@@ -1,3 +1,13 @@
+## Authentication Zero 2.11.0 (March 27, 2022) ##
+
+* Remove sudo from default generator
+* Remove sudo_at from database
+* Implement sudoable using redis
+
+## Authentication Zero 2.10.0 (March 2, 2022) ##
+
+* Implement two-factor
+
 ## Authentication Zero 2.9.0 (March 2, 2022) ##
 
 * Implement trackable

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authentication-zero (2.9.3)
+    authentication-zero (2.11.1)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -11,8 +11,9 @@ The purpose of authentication zero is to generate a pre-built authentication sys
 - Checks if a password has been found in any data breach (--pwned)
 - Authentication by cookie
 - Authentication by token (--api)
+- Two factor authentication (--two-factor)
 - Social Login with OmniAuth (--omniauthable)
-- Ask password before sensitive data changes, aka: sudo
+- Ask password before sensitive data changes, aka: sudo (--sudoable)
 - Reset the user password and send reset instructions
 - Reset the user password only from verified emails
 - Lock sending reset password email after many attempts (--lockable)
@@ -53,7 +54,7 @@ root "home#index"
 ```
 
 ```
-$ rails generate controller home index
+rails generate controller home index
 ```
 
 Add these lines to your `app/views/home/index.html.erb`:
@@ -79,6 +80,10 @@ Add these lines to your `app/views/home/index.html.erb`:
   <%# link_to "Activity Log", authentications_events_path %>
 </div>
 
+<div>
+  <%# link_to "Two-Factor Authentication", new_two_factor_authentication_totp_path %>
+</div>
+
 <br>
 
 <%= button_to "Log out", Current.session, method: :delete %>
@@ -93,7 +98,7 @@ config.action_mailer.default_url_options = { host: 'localhost', port: 3000 }
 ## Usage
 
 ```
-$ rails generate authentication user
+rails generate authentication user
 ```
 
 Then run `bundle install` again!

data/authentication-zero-api.md

@@ -78,7 +78,6 @@ This endpoint will return `201 Created` with the current JSON representation of
     "user_id": 1,
     "user_agent": "insomnia/2022.1.0",
     "ip_address": "127.0.0.1",
-    "sudo_at": "2022-03-04T17:20:33.632Z",
     "created_at": "2022-03-04T17:20:33.632Z",
     "updated_at": "2022-03-04T17:20:33.632Z"
   },
@@ -87,7 +86,6 @@ This endpoint will return `201 Created` with the current JSON representation of
     "user_id": 1,
     "user_agent": "insomnia/2022.1.0",
     "ip_address": "127.0.0.1",
-    "sudo_at": "2022-03-04T17:14:03.386Z",
     "created_at": "2022-03-04T17:14:03.386Z",
     "updated_at": "2022-03-04T17:14:03.386Z"
   }
@@ -106,7 +104,6 @@ This endpoint will return `201 Created` with the current JSON representation of
   "user_id": 1,
   "user_agent": "insomnia/2022.1.0",
   "ip_address": "127.0.0.1",
-  "sudo_at": "2022-03-04T17:14:03.386Z",
   "created_at": "2022-03-04T17:14:03.386Z",
   "updated_at": "2022-03-04T17:14:03.386Z"
 }

data/lib/authentication_zero/version.rb

@@ -1,3 +1,3 @@
 module AuthenticationZero
-  VERSION = "2.9.3"
+  VERSION = "2.11.1"
 end

data/lib/generators/authentication/authentication_generator.rb

@@ -5,17 +5,19 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
 
   class_option :api,          type: :boolean, desc: "Generates API authentication"
   class_option :pwned,        type: :boolean, desc: "Add pwned password validation"
+  class_option :sudoable,     type: :boolean, desc: "Add password request before sensitive data changes"
   class_option :lockable,     type: :boolean, desc: "Add password reset locking"
   class_option :ratelimit,    type: :boolean, desc: "Add request rate limiting"
   class_option :omniauthable, type: :boolean, desc: "Add social login support"
   class_option :trackable,    type: :boolean, desc: "Add activity log support"
+  class_option :two_factor,   type: :boolean, desc: "Add two factor authentication"
 
   source_root File.expand_path("templates", __dir__)
 
   def add_gems
     uncomment_lines "Gemfile", /"bcrypt"/
-    uncomment_lines "Gemfile", /"redis"/  if options.lockable?
-    uncomment_lines "Gemfile", /"kredis"/ if options.lockable?
+    uncomment_lines "Gemfile", /"redis"/  if redis?
+    uncomment_lines "Gemfile", /"kredis"/ if redis?
 
     if options.pwned?
       gem "pwned", comment: "Use Pwned to check if a password has been found in any of the huge data breaches [https://github.com/philnash/pwned]"
@@ -29,10 +31,15 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
       gem "omniauth", comment: "Use OmniAuth to support multi-provider authentication [https://github.com/omniauth/omniauth]"
       gem "omniauth-rails_csrf_protection", comment: "Provides a mitigation against CVE-2015-9284 [https://github.com/cookpad/omniauth-rails_csrf_protection]"
     end
+
+    if two_factor?
+      gem "rotp", comment: "Use rotp for generating and validating one time passwords [https://github.com/mdp/rotp]"
+      gem "rqrcode", comment: "Use rqrcode for creating and rendering QR codes into various formats [https://github.com/whomwah/rqrcode]"
+    end
   end
 
   def create_configuration_files
-    copy_file "config/redis/shared.yml", "config/redis/shared.yml" if options.lockable?
+    copy_file "config/redis/shared.yml", "config/redis/shared.yml" if redis?
     copy_file "config/initializers/omniauth.rb", "config/initializers/omniauth.rb" if omniauthable?
   end
 
@@ -67,10 +74,11 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
     template  "controllers/#{format_folder}/application_controller.rb", "app/controllers/application_controller.rb", force: true
 
     directory "controllers/#{format_folder}/identity", "app/controllers/identity"
+    directory "controllers/#{format_folder}/two_factor_authentication", "app/controllers/two_factor_authentication" if two_factor?
+    template  "controllers/#{format_folder}/sessions_controller.rb", "app/controllers/sessions_controller.rb"
     template  "controllers/#{format_folder}/passwords_controller.rb", "app/controllers/passwords_controller.rb"
     template  "controllers/#{format_folder}/registrations_controller.rb", "app/controllers/registrations_controller.rb"
-    template  "controllers/#{format_folder}/sessions_controller.rb", "app/controllers/sessions_controller.rb"
-    template  "controllers/#{format_folder}/sessions/sudos_controller.rb", "app/controllers/sessions/sudos_controller.rb"
+    template  "controllers/#{format_folder}/sessions/sudos_controller.rb", "app/controllers/sessions/sudos_controller.rb" if options.sudoable?
     template  "controllers/#{format_folder}/sessions/omniauth_controller.rb", "app/controllers/sessions/omniauth_controller.rb" if omniauthable?
     template  "controllers/#{format_folder}/authentications/events_controller.rb", "app/controllers/authentications/events_controller.rb" if options.trackable?
   end
@@ -86,7 +94,13 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
       directory "erb/identity", "app/views/identity"
       directory "erb/passwords", "app/views/passwords"
       directory "erb/registrations", "app/views/registrations"
-      directory "erb/sessions", "app/views/sessions"
+
+      template  "erb/sessions/index.html.erb", "app/views/sessions/index.html.erb"
+      template  "erb/sessions/new.html.erb", "app/views/sessions/new.html.erb"
+
+      directory "erb/sessions/sudos", "app/views/sessions/sudos" if options.sudoable?
+
+      directory "erb/two_factor_authentication", "app/views/two_factor_authentication" if two_factor?
       directory "erb/authentications/events", "app/views/authentications/events" if options.trackable?
     end
   end
@@ -102,6 +116,11 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
       route "get  '/auth/failure',            to: 'sessions/omniauth#failure'"
     end
 
+    if two_factor?
+      route "resource :totp,      only: [:new, :create]", namespace: :two_factor_authentication
+      route "resource :challenge, only: [:new, :create]", namespace: :two_factor_authentication
+    end
+
     if options.trackable?
       route "resources :events, only: :index", namespace: :authentications
     end
@@ -109,7 +128,7 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
     route "resource :password_reset,     only: [:new, :edit, :create, :update]", namespace: :identity
     route "resource :email_verification, only: [:edit, :create]", namespace: :identity
     route "resource :email,              only: [:edit, :update]", namespace: :identity
-    route "resource :sudo, only: [:new, :create]", namespace: :sessions
+    route "resource :sudo, only: [:new, :create]", namespace: :sessions if options.sudoable?
     route "resource  :password, only: [:edit, :update]"
     route "resources :sessions, only: [:index, :show, :destroy]"
     route "post 'sign_up', to: 'registrations#create'"
@@ -133,4 +152,12 @@ class AuthenticationGenerator < Rails::Generators::NamedBase
     def omniauthable?
       options.omniauthable? && !options.api?
     end
+
+    def two_factor?
+      options.two_factor? && !options.api?
+    end
+
+    def redis?
+      options.lockable? || options.sudoable?
+    end
 end

data/lib/generators/authentication/templates/controllers/api/application_controller.rb.tt

@@ -3,12 +3,13 @@ class ApplicationController < ActionController::API
 
   before_action :set_current_request_details
   before_action :authenticate
-
+  <%- if options.sudoable? %>
   def require_sudo
-    if Current.session.sudo_at < 30.minutes.ago
+    unless Current.session.sudo?
       render json: { error: "Enter your password to continue" }, status: :forbidden
     end
   end
+  <%- end -%>
 
   private
     def authenticate

data/lib/generators/authentication/templates/controllers/api/identity/emails_controller.rb.tt

@@ -1,9 +1,10 @@
 class Identity::EmailsController < ApplicationController
-  before_action :require_sudo
   before_action :set_<%= singular_table_name %>
 
   def update
-    if @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
+    if !@<%= singular_table_name %>.authenticate(params[:current_password])
+      render json: { error: "The password you entered is incorrect" }, status: :bad_request
+    elsif @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
       render json: @<%= singular_table_name %>
     else
       render json: @<%= singular_table_name %>.errors, status: :unprocessable_entity

data/lib/generators/authentication/templates/controllers/api/identity/password_resets_controller.rb.tt

@@ -1,9 +1,9 @@
 class Identity::PasswordResetsController < ApplicationController
   skip_before_action :authenticate
 
-<% if options.lockable? -%>
+  <%- if options.lockable? -%>
   before_action :require_locking, only: :create
-<% end -%>
+  <%- end -%>
   before_action :set_<%= singular_table_name %>, only: :update
 
   def create
@@ -32,11 +32,11 @@ class Identity::PasswordResetsController < ApplicationController
     def <%= "#{singular_table_name}_params" %>
       params.permit(:password, :password_confirmation)
     end
-<% if options.lockable? %>
+    <%- if options.lockable? %>
     def require_locking
       Locking.lock_on("password_reset_lock:#{request.remote_ip}", wait: 1.hour, attempts: 10) do
         render json: { error: "You've exceeded the maximum number of attempts" }, status: :too_many_requests
       end
     end
-<% end -%>
+    <%- end -%>
 end

data/lib/generators/authentication/templates/controllers/api/sessions/sudos_controller.rb.tt

@@ -3,7 +3,7 @@ class Sessions::SudosController < ApplicationController
     session = Current.session
 
     if session.<%= singular_table_name %>.authenticate(params[:password])
-      session.update! sudo_at: Time.current
+      session.sudo.mark
     else
       render json: { error: "The password you entered is incorrect" }, status: :bad_request
     end

data/lib/generators/authentication/templates/controllers/html/application_controller.rb.tt

@@ -1,12 +1,13 @@
 class ApplicationController < ActionController::Base
   before_action :set_current_request_details
   before_action :authenticate
-
+  <%- if options.sudoable? %>
   def require_sudo
-    if Current.session.sudo_at < 30.minutes.ago
+    unless Current.session.sudo?
       redirect_to new_sessions_sudo_path(proceed_to_url: request.url)
     end
   end
+  <%- end -%>
 
   private
     def authenticate

data/lib/generators/authentication/templates/controllers/html/identity/emails_controller.rb.tt

@@ -1,12 +1,13 @@
 class Identity::EmailsController < ApplicationController
-  before_action :require_sudo
   before_action :set_<%= singular_table_name %>
 
   def edit
   end
 
   def update
-    if @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
+    if !@<%= singular_table_name %>.authenticate(params[:current_password])
+      redirect_to edit_identity_email_path, alert: "The password you entered is incorrect"
+    elsif @<%= singular_table_name %>.update(<%= "#{singular_table_name}_params" %>)
       redirect_to root_path, notice: "Your email has been changed"
     else
       render :edit, status: :unprocessable_entity

data/lib/generators/authentication/templates/controllers/html/identity/password_resets_controller.rb.tt

@@ -1,9 +1,9 @@
 class Identity::PasswordResetsController < ApplicationController
   skip_before_action :authenticate
 
-<% if options.lockable? -%>
+  <%- if options.lockable? -%>
   before_action :require_locking, only: :create
-<% end -%>
+  <%- end -%>
   before_action :set_<%= singular_table_name %>, only: %i[ edit update ]
 
   def new
@@ -39,11 +39,11 @@ class Identity::PasswordResetsController < ApplicationController
     def <%= "#{singular_table_name}_params" %>
       params.permit(:password, :password_confirmation)
     end
-<% if options.lockable? %>
+    <%- if options.lockable? %>
     def require_locking
       Locking.lock_on("password_reset_lock:#{request.remote_ip}", wait: 1.hour, attempts: 10) do
         redirect_to new_identity_password_reset_path, alert: "You've exceeded the maximum number of attempts"
       end
     end
-<% end -%>
+    <%- end -%>
 end

data/lib/generators/authentication/templates/controllers/html/sessions/sudos_controller.rb.tt

@@ -5,12 +5,12 @@ class Sessions::SudosController < ApplicationController
   def create
     session = Current.session
 
-<% if omniauthable? -%>
+    <%- if omniauthable? -%>
     if session.<%= singular_table_name %>.authenticate(params[:password]) || session.<%= singular_table_name %>.provider
-<% else -%>
+    <%- else -%>
     if session.<%= singular_table_name %>.authenticate(params[:password])
-<% end -%>
-      session.update!(sudo_at: Time.current); redirect_to(params[:proceed_to_url])
+    <%- end -%>
+      session.sudo.mark; redirect_to(params[:proceed_to_url])
     else
       redirect_to new_sessions_sudo_path(proceed_to_url: params[:proceed_to_url]), alert: "The password you entered is incorrect"
     end

data/lib/generators/authentication/templates/controllers/html/sessions_controller.rb.tt

@@ -15,10 +15,23 @@ class SessionsController < ApplicationController
     <%= singular_table_name %> = <%= class_name %>.find_by(email: params[:email])
 
     if <%= singular_table_name %> && <%= singular_table_name %>.authenticate(params[:password])
+      <%- if two_factor? -%>
+      if <%= singular_table_name %>.otp_secret
+        signed_id = <%= singular_table_name %>.signed_id(purpose: :authentication_challenge, expires_in: 20.minutes)
+
+        redirect_to new_two_factor_authentication_challenge_path(token: signed_id)
+      else
+        @session = <%= singular_table_name %>.sessions.create!
+        cookies.signed.permanent[:session_token] = { value: @session.id, httponly: true }
+
+        redirect_to root_path, notice: "Signed in successfully"
+      end
+      <%- else -%>
       @session = <%= singular_table_name %>.sessions.create!
       cookies.signed.permanent[:session_token] = { value: @session.id, httponly: true }
 
       redirect_to root_path, notice: "Signed in successfully"
+      <%- end -%>
     else
       redirect_to sign_in_path(email_hint: params[:email]), alert: "That email or password is incorrect"
     end

data/lib/generators/authentication/templates/controllers/html/two_factor_authentication/challenges_controller.rb.tt

@@ -0,0 +1,28 @@
+class TwoFactorAuthentication::ChallengesController < ApplicationController
+  skip_before_action :authenticate
+
+  before_action :set_<%= singular_table_name %>
+
+  def new
+  end
+
+  def create
+    @totp = ROTP::TOTP.new(@<%= singular_table_name %>.otp_secret, issuer: "YourAppName")
+
+    if @totp.verify(params[:code], drift_behind: 15)
+      session = @<%= singular_table_name %>.sessions.create!
+      cookies.signed.permanent[:session_token] = { value: session.id, httponly: true }
+
+      redirect_to root_path, notice: "Signed in successfully"
+    else
+      redirect_to new_two_factor_authentication_challenge_path(token: params[:token]), alert: "That code didn't work. Please try again"
+    end
+  end
+
+  private
+    def set_<%= singular_table_name %>
+      @<%= singular_table_name %> = <%= class_name %>.find_signed!(params[:token], purpose: :authentication_challenge)
+    rescue
+      redirect_to sign_in_path, alert: "That's taking too long. Please re-enter your password and try again"
+    end
+end

data/lib/generators/authentication/templates/controllers/html/two_factor_authentication/totps_controller.rb.tt

@@ -0,0 +1,27 @@
+class TwoFactorAuthentication::TotpsController < ApplicationController
+  before_action :set_<%= singular_table_name %>
+  before_action :set_totp
+
+  def new
+    @qr_code = RQRCode::QRCode.new(@totp.provisioning_uri(@<%= singular_table_name %>.email))
+  end
+
+  def create
+    if !@<%= singular_table_name %>.authenticate(params[:current_password])
+      redirect_to two_factor_authentication_totp_path, alert: "The password you entered is incorrect"
+    elsif @totp.verify(params[:code], drift_behind: 15)
+      @<%= singular_table_name %>.update! otp_secret: params[:secret]
+      redirect_to root_path, notice: "2FA is enabled on your account"
+    else
+      redirect_to two_factor_authentication_totp_path, alert: "That code didn't work. Please try again"
+    end
+  end
+
+  def set_<%= singular_table_name %>
+    @<%= singular_table_name %> = Current.<%= singular_table_name %>
+  end
+
+  def set_totp
+    @totp = ROTP::TOTP.new(params[:secret] || ROTP::Base32.random, issuer: "YourAppName")
+  end
+end

data/lib/generators/authentication/templates/erb/identity/emails/edit.html.erb.tt

@@ -21,6 +21,11 @@
     </div>
   <%% end %>
 
+  <div>
+    <%%= form.label :current_password, style: "display: block" %>
+    <%%= form.password_field :current_password, required: true, autofocus: true, autocomplete: "current-password" %>
+  </div>
+
   <div>
     <%%= form.label :email, "New email", style: "display: block" %>
     <%%= form.email_field :email %>

data/lib/generators/authentication/templates/erb/identity/password_resets/edit.html.erb.tt

@@ -13,7 +13,7 @@
     </div>
   <%% end %>
 
-  <%%= hidden_field_tag :token, params[:token] %>
+  <%%= form.hidden_field :token, value: params[:token] %>
 
   <div>
     <%%= form.label :password, "New password", style: "display: block" %>

data/lib/generators/authentication/templates/erb/passwords/edit.html.erb.tt

@@ -16,8 +16,8 @@
   <%% end %>
 
   <div>
-    <%%= label_tag :current_password, nil, style: "display: block" %>
-    <%%= password_field_tag :current_password, nil, required: true, autofocus: true, autocomplete: "current-password" %>
+    <%%= form.label :current_password, style: "display: block" %>
+    <%%= form.password_field :current_password, required: true, autofocus: true, autocomplete: "current-password" %>
   </div>
 
   <div>

data/lib/generators/authentication/templates/erb/sessions/sudos/new.html.erb.tt

@@ -4,10 +4,10 @@
 
 <%%= form_with(url: sessions_sudo_path) do |form| %>
 
-  <%%= hidden_field_tag :proceed_to_url, params[:proceed_to_url] %>
+  <%%= form.hidden_field :proceed_to_url, value: params[:proceed_to_url] %>
 
   <div>
-    <%%= password_field_tag :password, nil, required: true, autofocus: true, autocomplete: "current-password" %>
+    <%%= form.password_field :password, required: true, autofocus: true, autocomplete: "current-password" %>
   </div>
 
   <div>

data/lib/generators/authentication/templates/erb/two_factor_authentication/challenges/new.html.erb.tt

@@ -0,0 +1,16 @@
+<p style="color: red"><%%= alert %></p>
+
+<%%= form_with(url: two_factor_authentication_challenge_path) do |form| %>
+  <%%= form.hidden_field :token, value: params[:token] %>
+
+  <div>
+    <%%= form.label :code do %>
+      <h1>Next, open the 2FA authenticator app on your phone and type the six digit code below:</h1>
+    <%% end %>
+    <%%= form.text_field :code, autofocus: true, required: true, autocomplete: :off %>
+  </div>
+
+  <div>
+    <%%= form.submit "Verify" %>
+  </div>
+<%% end %>

data/lib/generators/authentication/templates/erb/two_factor_authentication/totps/new.html.erb.tt

@@ -0,0 +1,33 @@
+<p style="color: red"><%%= alert %></p>
+
+<h1>Upgrade your security with 2FA</h1>
+
+<h2>Step 1: Get an Authenticator App</h2>
+<p>First, you'll need a 2FA authenticator app on your phone. <strong>If you already have one, skip to step 2.</strong></p>
+<p><strong>If you don't have one, or you aren't sure, we recommend Microsoft Authenticator</strong>. You can download it free on the Apple App Store for iPhone, or Google Play Store for Android. Please grab your phone, search the store, and install it now.</p>
+
+<h2>Step 2: Scan + Enter the Code</h2>
+<p>Next, open the authenticator app, tap "Scan QR code" or "+", and, when it asks, point your phone's camera at this QR code picture below.</p>
+
+<figure>
+    <%%= image_tag @qr_code.as_png(resize_exactly_to: 200).to_data_url%>
+    <figcaption>Point your camera here</figcaption>
+</figure>
+
+<%%= form_with(url: two_factor_authentication_totp_path) do |form| %>
+  <%%= form.hidden_field :secret, value: @totp.secret %>
+
+  <div>
+    <%%= form.label :current_password, style: "display: block" %>
+    <%%= form.password_field :current_password, required: true, autofocus: true, autocomplete: "current-password" %>
+  </div>
+
+  <div>
+    <%%= form.label :code, "After scanning with your camera, the app will generate a six-digit code. Enter it here:", style: "display: block" %>
+    <%%= form.text_field :code, autofocus: true, required: true, autocomplete: :off %>
+  </div>
+
+  <div>
+    <%%= form.submit "Verify and active" %>
+  </div>
+<%% end %>

data/lib/generators/authentication/templates/migrations/create_sessions_migration.rb.tt

@@ -2,12 +2,9 @@ class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Mi
   def change
     create_table :sessions do |t|
       t.references :<%= singular_table_name %>, null: false, foreign_key: true
-
       t.string :user_agent
       t.string :ip_address
 
-      t.datetime :sudo_at, null: false
-
       t.timestamps
     end
   end

data/lib/generators/authentication/templates/migrations/create_table_migration.rb.tt

@@ -5,17 +5,20 @@ class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Mi
       t.string :password_digest, null: false
 
       t.boolean :verified, null: false, default: false
-<% if omniauthable? %>
+      <%- if two_factor? %>
+      t.string :otp_secret
+      <%- end -%>
+      <%- if omniauthable? %>
       t.string :provider
       t.string :uid
-<% end -%>
+      <%- end -%>
 
       t.timestamps
     end
 
     add_index :<%= table_name %>, :email, unique: true
-<% if omniauthable? -%>
+    <%- if omniauthable? -%>
     add_index :<%= table_name %>, [:provider, :uid], unique: true
-<% end -%>
+    <%- end -%>
   end
 end

data/lib/generators/authentication/templates/models/model.rb.tt

@@ -2,18 +2,18 @@ class <%= class_name %> < ApplicationRecord
   has_secure_password
 
   has_many :sessions, dependent: :destroy
-<% if options.trackable? -%>
+  <%- if options.trackable? -%>
   has_many :events, dependent: :destroy
-<% end -%>
+  <%- end -%>
 
   validates :email, presence: true, uniqueness: true
   validates_format_of :email, with: /\A[^@\s]+@[^@\s]+\z/
 
   validates_length_of :password, minimum: 12, allow_nil: true
   validates_format_of :password, with: /(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])/, allow_nil: true, message: "might easily be guessed"
-<% if options.pwned? -%>
+  <%- if options.pwned? -%>
   validates :password, not_pwned: { message: "might easily be guessed" }
-<% end -%>
+  <%- end -%>
 
   before_validation do
     self.email = email.downcase.strip
@@ -30,7 +30,7 @@ class <%= class_name %> < ApplicationRecord
   after_save_commit if: :email_previously_changed? do
     IdentityMailer.with(user: self).email_verify_confirmation.deliver_later
   end
-<% if options.trackable? %>
+  <%- if options.trackable? %>
   after_save_commit if: :email_previously_changed? do
     events.create! action: "email_verification_requested"
   end
@@ -42,5 +42,5 @@ class <%= class_name %> < ApplicationRecord
   after_update if: :verified_previously_changed? do
     events.create! action: "email_verified" if verified?
   end
-<% end -%>
+  <%- end -%>
 end

data/lib/generators/authentication/templates/models/session.rb.tt

@@ -1,16 +1,23 @@
 class Session < ApplicationRecord
   belongs_to :<%= singular_table_name %>
+  <%- if options.sudoable? %>
+  kredis_flag :sudo, expires_in: 30.minutes
+  <%- end -%>
 
   before_create do
     self.user_agent = Current.user_agent
     self.ip_address = Current.ip_address
-    self.sudo_at = Time.current
   end
+  <%- if options.sudoable? %>
+  after_create_commit do
+    self.sudo.mark
+  end
+  <%- end -%>
 
   after_create_commit do
     SessionMailer.with(session: self).signed_in_notification.deliver_later
   end
-<% if options.trackable? %>
+  <%- if options.trackable? %>
   after_create do
     <%= singular_table_name %>.events.create! action: "signed_in"
   end
@@ -18,5 +25,5 @@ class Session < ApplicationRecord
   after_destroy do
     <%= singular_table_name %>.events.create! action: "signed_out"
   end
-<% end -%>
+  <%- end -%>
 end

data/lib/generators/authentication/templates/test_unit/application_system_test_case.rb.tt

@@ -10,6 +10,6 @@ class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
     click_on "Sign in"
 
     assert_current_path root_url
-    return <%= singular_table_name %>
+    <%= singular_table_name %>
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/email_verifications_controller_test.rb.tt

@@ -9,21 +9,25 @@ class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTe
     @<%= singular_table_name %>.update! verified: false
   end
 
+  def default_headers
+    { "Authorization" => "Bearer #{@token}" }
+  end
+
   test "should send a verification email" do
     assert_enqueued_email_with IdentityMailer, :email_verify_confirmation, args: { <%= singular_table_name %>: @<%= singular_table_name %> } do
-      post identity_email_verification_url, headers: { "Authorization" => "Bearer #{@token}" }
+      post identity_email_verification_url, headers: default_headers
     end
 
     assert_response :no_content
   end
 
   test "should verify email" do
-    get edit_identity_email_verification_url, params: { token: @sid, email: @<%= singular_table_name %>.email }, headers: { "Authorization" => "Bearer #{@token}" }
+    get edit_identity_email_verification_url, params: { token: @sid, email: @<%= singular_table_name %>.email }, headers: default_headers
     assert_response :no_content
   end
 
   test "should not verify email with expired token" do
-    get edit_identity_email_verification_url, params: { token: @sid_exp, email: @<%= singular_table_name %>.email }, headers: { "Authorization" => "Bearer #{@token}" }
+    get edit_identity_email_verification_url, params: { token: @sid_exp, email: @<%= singular_table_name %>.email }, headers: default_headers
 
     assert_response :bad_request
     assert_equal "That email verification link is invalid", response.parsed_body["error"]
@@ -32,7 +36,7 @@ class Identity::EmailVerificationsControllerTest < ActionDispatch::IntegrationTe
   test "should not verify email with previous token" do
     @<%= singular_table_name %>.update! email: "other_email@hey.com"
 
-    get edit_identity_email_verification_url, params: { token: @sid, email: @<%= singular_table_name %>.email_previously_was }, headers: { "Authorization" => "Bearer #{@token}" }
+    get edit_identity_email_verification_url, params: { token: @sid, email: @<%= singular_table_name %>.email_previously_was }, headers: default_headers
 
     assert_response :bad_request
     assert_equal "That email verification link is invalid", response.parsed_body["error"]

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/emails_controller_test.rb.tt

@@ -5,17 +5,19 @@ class Identity::EmailsControllerTest < ActionDispatch::IntegrationTest
     @<%= singular_table_name %>, @token = sign_in_as(<%= table_name %>(:lazaro_nixon))
   end
 
+  def default_headers
+    { "Authorization" => "Bearer #{@token}" }
+  end
+
   test "should update email" do
-    patch identity_email_url, params: { email: "new_email@hey.com" }, headers: { "Authorization" => "Bearer #{@token}" }
+    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "Secret1*3*5*" }, headers: default_headers
     assert_response :success
   end
 
-  test "should not update email without sudo" do
-    @<%= singular_table_name %>.sessions.last.update! sudo_at: 1.day.ago
-
-    patch identity_email_url, params: { email: "new_email@hey.com" }, headers: { "Authorization" => "Bearer #{@token}" }
+  test "should not update email with wrong current password" do
+    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "SecretWrong1*3" }, headers: default_headers
 
-    assert_response :forbidden
-    assert_equal "Enter your password to continue", response.parsed_body["error"]
+    assert_response :bad_request
+    assert_equal "The password you entered is incorrect", response.parsed_body["error"]
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/api/identity/password_resets_controller_test.rb.tt

@@ -6,9 +6,6 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
     @sid = @<%= singular_table_name %>.signed_id(purpose: :password_reset, expires_in: 20.minutes)
     @sid_exp = @<%= singular_table_name %>.signed_id(purpose: :password_reset, expires_in: 0.minutes)
   end
-<% if options.lockable? %>
-  teardown { Kredis.clear_all }
-<% end -%>
 
   test "should send a password reset email" do
     assert_enqueued_email_with IdentityMailer, :password_reset_provision, args: { <%= singular_table_name %>: @<%= singular_table_name %> } do

data/lib/generators/authentication/templates/test_unit/controllers/api/passwords_controller_test.rb.tt

@@ -5,13 +5,17 @@ class PasswordsControllerTest < ActionDispatch::IntegrationTest
     @<%= singular_table_name %>, @token = sign_in_as(<%= table_name %>(:lazaro_nixon))
   end
 
+  def default_headers
+    { "Authorization" => "Bearer #{@token}" }
+  end
+
   test "should update password" do
-    patch password_url, params: { current_password: "Secret1*3*5*", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }, headers: { "Authorization" => "Bearer #{@token}" }
+    patch password_url, params: { current_password: "Secret1*3*5*", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }, headers: default_headers
     assert_response :success
   end
 
   test "should not update password with wrong current password" do
-    patch password_url, params: { current_password: "SecretWrong1*3", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }, headers: { "Authorization" => "Bearer #{@token}" }
+    patch password_url, params: { current_password: "SecretWrong1*3", password: "Secret6*4*2*", password_confirmation: "Secret6*4*2*" }, headers: default_headers
 
     assert_response :bad_request
     assert_equal "The current password you entered is incorrect", response.parsed_body["error"]

data/lib/generators/authentication/templates/test_unit/controllers/api/sessions_controller_test.rb.tt

@@ -5,13 +5,17 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest
     @<%= singular_table_name %>, @token = sign_in_as(<%= table_name %>(:lazaro_nixon))
   end
 
+  def default_headers
+    { "Authorization" => "Bearer #{@token}" }
+  end
+
   test "should get index" do
-    get sessions_url, headers: { "Authorization" => "Bearer #{@token}" }
+    get sessions_url, headers: default_headers
     assert_response :success
   end
 
   test "should show session" do
-    get session_url(@<%= singular_table_name %>.sessions.last), headers: { "Authorization" => "Bearer #{@token}" }
+    get session_url(@<%= singular_table_name %>.sessions.last), headers: default_headers
     assert_response :success
   end
 
@@ -28,7 +32,7 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "should sign out" do
-    delete session_url(@<%= singular_table_name %>.sessions.last), headers: { "Authorization" => "Bearer #{@token}" }
+    delete session_url(@<%= singular_table_name %>.sessions.last), headers: default_headers
     assert_response :no_content
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/html/identity/emails_controller_test.rb.tt

@@ -10,22 +10,15 @@ class Identity::EmailsControllerTest < ActionDispatch::IntegrationTest
     assert_response :success
   end
 
-  test "should not get edit without sudo" do
-    @<%= singular_table_name %>.sessions.last.update! sudo_at: 1.day.ago
-
-    get edit_identity_email_url
-    assert_redirected_to new_sessions_sudo_url(proceed_to_url: edit_identity_email_url)
-  end
-
   test "should update email" do
-    patch identity_email_url, params: { email: "new_email@hey.com" }
+    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "Secret1*3*5*" }
     assert_redirected_to root_url
   end
 
-  test "should not update email without sudo" do
-    @<%= singular_table_name %>.sessions.last.update! sudo_at: 1.day.ago
+  test "should not update email with wrong current password" do
+    patch identity_email_url, params: { email: "new_email@hey.com", current_password: "SecretWrong1*3" }
 
-    patch identity_email_url, params: { email: "new_email@hey.com" }
-    assert_redirected_to new_sessions_sudo_url(proceed_to_url: identity_email_url)
+    assert_redirected_to edit_identity_email_url
+    assert_equal "The password you entered is incorrect", flash[:alert]
   end
 end

data/lib/generators/authentication/templates/test_unit/controllers/html/identity/password_resets_controller_test.rb.tt

@@ -6,9 +6,6 @@ class Identity::PasswordResetsControllerTest < ActionDispatch::IntegrationTest
     @sid = @<%= singular_table_name %>.signed_id(purpose: :password_reset, expires_in: 20.minutes)
     @sid_exp = @<%= singular_table_name %>.signed_id(purpose: :password_reset, expires_in: 0.minutes)
   end
-<% if options.lockable? %>
-  teardown { Kredis.clear_all }
-<% end -%>
 
   test "should get new" do
     get new_identity_password_reset_url

data/lib/generators/authentication/templates/test_unit/system/identity/emails_test.rb.tt

@@ -8,6 +8,7 @@ class Identity::EmailsTest < ApplicationSystemTestCase
   test "updating the email" do
     click_on "Change email address"
 
+    fill_in "Current password", with: "Secret1*3*5*"
     fill_in "New email", with: "new_email@hey.com"
     click_on "Save changes"
 

data/lib/generators/authentication/templates/test_unit/system/identity/password_resets_test.rb.tt

@@ -5,9 +5,6 @@ class Identity::PasswordResetsTest < ApplicationSystemTestCase
     @<%= singular_table_name %> = <%= table_name %>(:lazaro_nixon)
     @sid = @<%= singular_table_name %>.signed_id(purpose: :password_reset, expires_in: 20.minutes)
   end
-<% if options.lockable? %>
-  teardown { Kredis.clear_all }
-<% end -%>
 
   test "sending a password reset email" do
     visit sign_in_url

data/lib/generators/authentication/templates/test_unit/test_helper.rb.tt

@@ -10,13 +10,13 @@ class ActiveSupport::TestCase
   fixtures :all
 
   # Add more helper methods to be used by all tests here...
-<% if options.api? -%>
+  <%- if options.api? -%>
   def sign_in_as(<%= singular_table_name %>)
     post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "Secret1*3*5*" }); [<%= singular_table_name %>, response.headers["X-Session-Token"]]
   end
-<% else -%>
+  <%- else -%>
   def sign_in_as(<%= singular_table_name %>)
     post(sign_in_url, params: { email: <%= singular_table_name %>.email, password: "Secret1*3*5*" }); <%= singular_table_name %>
   end
-<% end -%>
+  <%- end -%>
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authentication-zero
 version: !ruby/object:Gem::Version
-  version: 2.9.3
+  version: 2.11.1
 platform: ruby
 authors:
 - Nixon
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-03-08 00:00:00.000000000 Z
+date: 2022-03-27 00:00:00.000000000 Z
 dependencies: []
 description:
 email:
@@ -19,6 +19,7 @@ extra_rdoc_files: []
 files:
 - ".github/FUNDING.yml"
 - ".gitignore"
+- ".rubocop.yml"
 - CHANGELOG.md
 - CODE_OF_CONDUCT.md
 - Gemfile
@@ -54,6 +55,8 @@ files:
 - lib/generators/authentication/templates/controllers/html/sessions/omniauth_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/sessions/sudos_controller.rb.tt
 - lib/generators/authentication/templates/controllers/html/sessions_controller.rb.tt
+- lib/generators/authentication/templates/controllers/html/two_factor_authentication/challenges_controller.rb.tt
+- lib/generators/authentication/templates/controllers/html/two_factor_authentication/totps_controller.rb.tt
 - lib/generators/authentication/templates/erb/authentications/events/index.html.erb
 - lib/generators/authentication/templates/erb/identity/emails/edit.html.erb.tt
 - lib/generators/authentication/templates/erb/identity/password_resets/edit.html.erb.tt
@@ -69,6 +72,8 @@ files:
 - lib/generators/authentication/templates/erb/sessions/index.html.erb.tt
 - lib/generators/authentication/templates/erb/sessions/new.html.erb.tt
 - lib/generators/authentication/templates/erb/sessions/sudos/new.html.erb.tt
+- lib/generators/authentication/templates/erb/two_factor_authentication/challenges/new.html.erb.tt
+- lib/generators/authentication/templates/erb/two_factor_authentication/totps/new.html.erb.tt
 - lib/generators/authentication/templates/mailers/identity_mailer.rb.tt
 - lib/generators/authentication/templates/mailers/session_mailer.rb.tt
 - lib/generators/authentication/templates/migrations/create_events_migration.rb.tt
@@ -85,21 +90,18 @@ files:
 - lib/generators/authentication/templates/test_unit/controllers/api/identity/password_resets_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/api/passwords_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/api/registrations_controller_test.rb.tt
-- lib/generators/authentication/templates/test_unit/controllers/api/sessions/sudos_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/api/sessions_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/html/identity/email_verifications_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/html/identity/emails_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/html/identity/password_resets_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/html/passwords_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/html/registrations_controller_test.rb.tt
-- lib/generators/authentication/templates/test_unit/controllers/html/sessions/sudos_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/controllers/html/sessions_controller_test.rb.tt
 - lib/generators/authentication/templates/test_unit/fixtures.yml.tt
 - lib/generators/authentication/templates/test_unit/system/identity/emails_test.rb.tt
 - lib/generators/authentication/templates/test_unit/system/identity/password_resets_test.rb.tt
 - lib/generators/authentication/templates/test_unit/system/passwords_test.rb.tt
 - lib/generators/authentication/templates/test_unit/system/registrations_test.rb.tt
-- lib/generators/authentication/templates/test_unit/system/sessions/sudos_test.rb.tt
 - lib/generators/authentication/templates/test_unit/system/sessions_test.rb.tt
 - lib/generators/authentication/templates/test_unit/test_helper.rb.tt
 homepage: https://github.com/lazaronixon/authentication-zero

data/lib/generators/authentication/templates/test_unit/controllers/api/sessions/sudos_controller_test.rb.tt

@@ -1,20 +0,0 @@
-require "test_helper"
-
-class Sessions::SudosControllerTest < ActionDispatch::IntegrationTest
-  setup do
-    @<%= singular_table_name %>, @token = sign_in_as(<%= table_name %>(:lazaro_nixon))
-    @<%= singular_table_name %>.sessions.last.update! sudo_at: 1.day.ago
-  end
-
-  test "should sudo" do
-    post sessions_sudo_url, params: { password: "Secret1*3*5*" }, headers: { "Authorization" => "Bearer #{@token}" }
-    assert_response :no_content
-  end
-
-  test "should not sudo with wrong password" do
-    post sessions_sudo_url, params: { password: "SecretWrong1*3" }, headers: { "Authorization" => "Bearer #{@token}" }
-
-    assert_response :bad_request
-    assert_equal "The password you entered is incorrect", response.parsed_body["error"]
-  end
-end

data/lib/generators/authentication/templates/test_unit/controllers/html/sessions/sudos_controller_test.rb.tt

@@ -1,22 +0,0 @@
-require "test_helper"
-
-class Sessions::SudosControllerTest < ActionDispatch::IntegrationTest
-  setup do
-    @<%= singular_table_name %> = sign_in_as(<%= table_name %>(:lazaro_nixon))
-  end
-
-  test "should get new" do
-    get new_sessions_sudo_url(proceed_to_url: edit_password_url)
-    assert_response :success
-  end
-
-  test "should sudo" do
-    post sessions_sudo_url, params: { password: "Secret1*3*5*", proceed_to_url: edit_password_url }
-    assert_redirected_to edit_password_url
-  end
-
-  test "should not sudo with wrong password" do
-    post sessions_sudo_url, params: { password: "SecretWrong1*3", proceed_to_url: edit_password_url }
-    assert_redirected_to new_sessions_sudo_url(proceed_to_url: edit_password_url)
-  end
-end

data/lib/generators/authentication/templates/test_unit/system/sessions/sudos_test.rb.tt

@@ -1,15 +0,0 @@
-require "application_system_test_case"
-
-class Sessions::SudosTest < ApplicationSystemTestCase
-  setup do
-    @<%= singular_table_name %> = sign_in_as(<%= table_name %>(:lazaro_nixon))
-  end
-
-  test "executing sudo" do
-    visit new_sessions_sudo_url(proceed_to_url: edit_password_url)
-    fill_in :password, with: "Secret1*3*5*"
-    click_on "Continue"
-
-    assert_selector "h1", text: "Change your password"
-  end
-end