RubyGems - devise-2fa - Versions diffs - 0.1.1 → 0.2.0 - Mend

devise-2fa 0.1.1 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (115) hide show

checksums.yaml +5 -5
data/.circleci/config.yml +46 -0
data/.gitignore +8 -0
data/Gemfile +3 -22
data/README.md +13 -14
data/Rakefile +6 -28
data/bin/rspec +10 -0
data/bin/setup +12 -0
data/{devise-2fa.gemspec → devise_2fa.gemspec} +15 -8
data/lib/devise-2fa/version.rb +1 -1
data/lib/devise_two_factorable/models/two_factorable.rb +5 -1
data/{test → spec}/dummy/Rakefile +2 -3
data/{test/dummy/app/mailers/.gitkeep → spec/dummy/app/assets/images/.keep} +0 -0
data/spec/dummy/app/assets/javascripts/application.js +3 -0
data/{test/dummy/lib/assets/.gitkeep → spec/dummy/app/assets/javascripts/channels/.keep} +0 -0
data/spec/dummy/app/assets/stylesheets/application.css +15 -0
data/{test → spec}/dummy/app/controllers/application_controller.rb +4 -1
data/{test/dummy/public/favicon.ico → spec/dummy/app/controllers/concerns/.keep} +0 -0
data/{test → spec}/dummy/app/helpers/application_helper.rb +0 -0
data/spec/dummy/app/models/application_record.rb +3 -0
data/spec/dummy/app/models/concerns/.keep +0 -0
data/spec/dummy/app/models/user.rb +6 -0
data/spec/dummy/app/views/layouts/application.html.erb +19 -0
data/spec/dummy/app/views/layouts/mailer.text.erb +1 -0
data/spec/dummy/bin/bundle +3 -0
data/spec/dummy/bin/rails +4 -0
data/spec/dummy/bin/rake +4 -0
data/spec/dummy/bin/setup +25 -0
data/spec/dummy/bin/update +25 -0
data/spec/dummy/bin/yarn +11 -0
data/spec/dummy/config.ru +5 -0
data/spec/dummy/config/application.rb +14 -0
data/spec/dummy/config/boot.rb +5 -0
data/{test → spec}/dummy/config/database.yml +10 -10
data/spec/dummy/config/environment.rb +5 -0
data/spec/dummy/config/environments/development.rb +61 -0
data/{test → spec}/dummy/config/environments/test.rb +15 -5
data/spec/dummy/config/initializers/assets.rb +4 -0
data/{test → spec}/dummy/config/initializers/backtrace_silencers.rb +0 -0
data/spec/dummy/config/initializers/cookies_serializer.rb +5 -0
data/{test → spec}/dummy/config/initializers/devise.rb +134 -56
data/spec/dummy/config/initializers/filter_parameter_logging.rb +4 -0
data/{test → spec}/dummy/config/initializers/inflections.rb +6 -5
data/{test → spec}/dummy/config/initializers/mime_types.rb +0 -1
data/{test → spec}/dummy/config/initializers/wrap_parameters.rb +5 -5
data/spec/dummy/config/locales/devise.en.yml +68 -0
data/spec/dummy/config/locales/devise.two_factor.en.yml +57 -0
data/spec/dummy/config/locales/en.yml +2 -0
data/spec/dummy/config/puma.rb +9 -0
data/spec/dummy/config/routes.rb +4 -0
data/spec/dummy/config/spring.rb +6 -0
data/spec/dummy/config/storage.yml +8 -0
data/spec/dummy/db/migrate/20190311184605_devise_create_users.rb +44 -0
data/{test/dummy/db/migrate/20130131160351_devise_otp_add_to_users.rb → spec/dummy/db/migrate/20190312222952_devise_two_factor_add_to_users.rb} +4 -5
data/spec/dummy/db/schema.rb +39 -0
data/spec/dummy/lib/assets/.keep +0 -0
data/spec/dummy/package.json +5 -0
data/spec/dummy/public/404.html +1 -0
data/spec/dummy/public/422.html +1 -0
data/spec/dummy/public/500.html +19 -0
data/spec/dummy/public/apple-touch-icon-precomposed.png +0 -0
data/spec/dummy/public/apple-touch-icon.png +0 -0
data/spec/dummy/public/favicon.ico +0 -0
data/spec/dummy/storage/.keep +0 -0
data/spec/models/user_spec.rb +33 -0
data/spec/spec_helper.rb +69 -0
data/spec/system/persistence_spec.rb +59 -0
data/spec/system/refresh_spec.rb +100 -0
data/spec/system/token_spec.rb +41 -0
data/spec/system/users_spec.rb +98 -0
metadata +213 -123
data/.travis.yml +0 -28
data/lib/devise_two_factorable/two_factorable.rb +0 -131
data/test/dummy/README.rdoc +0 -261
data/test/dummy/app/assets/javascripts/application.js +0 -13
data/test/dummy/app/assets/stylesheets/application.css +0 -13
data/test/dummy/app/controllers/posts_controller.rb +0 -83
data/test/dummy/app/helpers/posts_helper.rb +0 -2
data/test/dummy/app/models/post.rb +0 -2
data/test/dummy/app/models/user.rb +0 -20
data/test/dummy/app/views/layouts/application.html.erb +0 -14
data/test/dummy/app/views/posts/_form.html.erb +0 -25
data/test/dummy/app/views/posts/edit.html.erb +0 -6
data/test/dummy/app/views/posts/index.html.erb +0 -25
data/test/dummy/app/views/posts/new.html.erb +0 -5
data/test/dummy/app/views/posts/show.html.erb +0 -15
data/test/dummy/config.ru +0 -4
data/test/dummy/config/application.rb +0 -67
data/test/dummy/config/boot.rb +0 -10
data/test/dummy/config/environment.rb +0 -5
data/test/dummy/config/environments/development.rb +0 -37
data/test/dummy/config/environments/production.rb +0 -73
data/test/dummy/config/initializers/secret_token.rb +0 -8
data/test/dummy/config/initializers/session_store.rb +0 -8
data/test/dummy/config/locales/en.yml +0 -5
data/test/dummy/config/routes.rb +0 -6
data/test/dummy/db/migrate/20130125101430_create_users.rb +0 -9
data/test/dummy/db/migrate/20130131092406_add_devise_to_users.rb +0 -52
data/test/dummy/db/migrate/20130131142320_create_posts.rb +0 -10
data/test/dummy/public/404.html +0 -26
data/test/dummy/public/422.html +0 -26
data/test/dummy/public/500.html +0 -25
data/test/dummy/script/rails +0 -6
data/test/integration/persistence_test.rb +0 -63
data/test/integration/refresh_test.rb +0 -103
data/test/integration/sign_in_test.rb +0 -85
data/test/integration/token_test.rb +0 -30
data/test/integration_tests_helper.rb +0 -64
data/test/model_tests_helper.rb +0 -20
data/test/models/two_factorable_test.rb +0 -120
data/test/orm/active_record.rb +0 -4
data/test/orm/mongoid.rb +0 -13
data/test/support/mongoid.yml +0 -6
data/test/support/symmetric_encryption.yml +0 -70
data/test/test_helper.rb +0 -18

data/test/dummy/db/migrate/20130125101430_create_users.rb DELETED

@@ -1,9 +0,0 @@
-class CreateUsers < ActiveRecord::Migration
-  def change
-    create_table :users do |t|
-      t.string :name
-      t.timestamps
-    end
-  end
-end

data/test/dummy/db/migrate/20130131092406_add_devise_to_users.rb DELETED

@@ -1,52 +0,0 @@
-class AddDeviseToUsers < ActiveRecord::Migration
-  def self.up
-    change_table(:users) do |t|
-      ## Database authenticatable
-      t.string :email,              null: false, default: ''
-      t.string :encrypted_password, null: false, default: ''
-      ## Recoverable
-      t.string   :reset_password_token
-      t.datetime :reset_password_sent_at
-      ## Rememberable
-      t.datetime :remember_created_at
-      ## Trackable
-      t.integer  :sign_in_count, default: 0
-      t.datetime :current_sign_in_at
-      t.datetime :last_sign_in_at
-      t.string   :current_sign_in_ip
-      t.string   :last_sign_in_ip
-      ## Confirmable
-      # t.string   :confirmation_token
-      # t.datetime :confirmed_at
-      # t.datetime :confirmation_sent_at
-      # t.string   :unconfirmed_email # Only if using reconfirmable
-      ## Lockable
-      t.integer  :failed_attempts, default: 0 # Only if lock strategy is :failed_attempts
-      t.string   :unlock_token # Only if unlock strategy is :email or :both
-      t.datetime :locked_at
-      ## Token authenticatable
-      t.string :authentication_token
-      # Uncomment below if timestamps were not included in your original model.
-      # t.timestamps
-    end
-    add_index :users, :email,                unique: true
-    add_index :users, :reset_password_token, unique: true
-    # add_index :users, :confirmation_token,   :unique => true
-    add_index :users, :unlock_token,         unique: true
-    add_index :users, :authentication_token, unique: true
-  end
-  def self.down
-    # By default, we don't want to make any assumption about how to roll back a migration when your
-    # model already existed. Please edit below which fields you would like to remove in this migration.
-    raise ActiveRecord::IrreversibleMigration
-  end
-end

data/test/dummy/db/migrate/20130131142320_create_posts.rb DELETED

@@ -1,10 +0,0 @@
-class CreatePosts < ActiveRecord::Migration
-  def change
-    create_table :posts do |t|
-      t.string :title
-      t.text :body
-      t.timestamps
-    end
-  end
-end

data/test/dummy/public/404.html DELETED

@@ -1,26 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>The page you were looking for doesn't exist (404)</title>
-  <style type="text/css">
-    body { background-color: #fff; color: #666; text-align: center; font-family: arial, sans-serif; }
-    div.dialog {
-      width: 25em;
-      padding: 0 4em;
-      margin: 4em auto 0 auto;
-      border: 1px solid #ccc;
-      border-right-color: #999;
-      border-bottom-color: #999;
-    }
-    h1 { font-size: 100%; color: #f00; line-height: 1.5em; }
-  </style>
-</head>
-<body>
-  <!-- This file lives in public/404.html -->
-  <div class="dialog">
-    <h1>The page you were looking for doesn't exist.</h1>
-    <p>You may have mistyped the address or the page may have moved.</p>
-  </div>
-</body>
-</html>

data/test/dummy/public/422.html DELETED

@@ -1,26 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>The change you wanted was rejected (422)</title>
-  <style type="text/css">
-    body { background-color: #fff; color: #666; text-align: center; font-family: arial, sans-serif; }
-    div.dialog {
-      width: 25em;
-      padding: 0 4em;
-      margin: 4em auto 0 auto;
-      border: 1px solid #ccc;
-      border-right-color: #999;
-      border-bottom-color: #999;
-    }
-    h1 { font-size: 100%; color: #f00; line-height: 1.5em; }
-  </style>
-</head>
-<body>
-  <!-- This file lives in public/422.html -->
-  <div class="dialog">
-    <h1>The change you wanted was rejected.</h1>
-    <p>Maybe you tried to change something you didn't have access to.</p>
-  </div>
-</body>
-</html>

data/test/dummy/public/500.html DELETED

@@ -1,25 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>We're sorry, but something went wrong (500)</title>
-  <style type="text/css">
-    body { background-color: #fff; color: #666; text-align: center; font-family: arial, sans-serif; }
-    div.dialog {
-      width: 25em;
-      padding: 0 4em;
-      margin: 4em auto 0 auto;
-      border: 1px solid #ccc;
-      border-right-color: #999;
-      border-bottom-color: #999;
-    }
-    h1 { font-size: 100%; color: #f00; line-height: 1.5em; }
-  </style>
-</head>
-<body>
-  <!-- This file lives in public/500.html -->
-  <div class="dialog">
-    <h1>We're sorry, but something went wrong.</h1>
-  </div>
-</body>
-</html>

data/test/dummy/script/rails DELETED

@@ -1,6 +0,0 @@
-#!/usr/bin/env ruby
-# This command will automatically be run when you run "rails" with Rails 3 gems installed from the root of your application.
-APP_PATH = File.expand_path('../../config/application', __FILE__)
-require File.expand_path('../../config/boot', __FILE__)
-require 'rails/commands'

data/test/integration/persistence_test.rb DELETED

@@ -1,63 +0,0 @@
-require 'test_helper'
-require 'integration_tests_helper'
-class PersistenceTest < ActionDispatch::IntegrationTest
-  def setup
-    @old_persistence = User.otp_trust_persistence
-    User.otp_trust_persistence = 3.seconds
-  end
-  def teardown
-    User.otp_trust_persistence = @old_persistence
-    Capybara.reset_sessions!
-  end
-  test 'a user should be requested the otp challenge every log in' do
-    # log in 1fa
-    user = enable_otp_and_sign_in
-    otp_challenge_for user
-    visit user_token_path
-    assert_equal user_token_path, current_path
-    sign_out
-    sign_user_in
-    assert_equal user_credential_path, current_path
-  end
-  test 'a user should be able to set their browser as trusted' do
-    # log in 1fa
-    user = enable_otp_and_sign_in
-    otp_challenge_for user
-    visit user_token_path
-    assert_equal user_token_path, current_path
-    click_link('Trust this browser')
-    assert_text 'Your browser is trusted.'
-    sign_out
-    sign_user_in
-    assert_equal root_path, current_path
-  end
-  test 'trusted status should expire' do
-    # log in 1fa
-    user = enable_otp_and_sign_in
-    otp_challenge_for user
-    visit user_token_path
-    assert_equal user_token_path, current_path
-    click_link('Trust this browser')
-    assert_text 'Your browser is trusted.'
-    sign_out
-    sleep User.otp_trust_persistence.to_i + 1
-    sign_user_in
-    assert_equal user_credential_path, current_path
-  end
-end

data/test/integration/refresh_test.rb DELETED

@@ -1,103 +0,0 @@
-require 'test_helper'
-require 'integration_tests_helper'
-class RefreshTest < ActionDispatch::IntegrationTest
-  def setup
-    @old_refresh = User.otp_credentials_refresh
-    User.otp_credentials_refresh = 1.second
-  end
-  def teardown
-    User.otp_credentials_refresh = @old_refresh
-    Capybara.reset_sessions!
-  end
-  test 'a user that just signed in should be able to access their OTP settings without refreshing' do
-    sign_user_in
-    visit user_token_path
-    assert_equal user_token_path, current_path
-  end
-  test 'a user should be prompted for credentials when the credentials_refresh time is expired' do
-    sign_user_in
-    visit user_token_path
-    assert_equal user_token_path, current_path
-    sleep(2)
-    visit user_token_path
-    assert_equal refresh_user_credential_path, current_path
-  end
-  test 'a user should be able to access their OTP settings after refreshing' do
-    sign_user_in
-    visit user_token_path
-    assert_equal user_token_path, current_path
-    sleep(2)
-    visit user_token_path
-    assert_equal refresh_user_credential_path, current_path
-    fill_in 'user_refresh_password', with: '12345678'
-    click_button 'Continue...'
-    assert_equal user_token_path, current_path
-  end
-  test 'a user should NOT be able to access their OTP settings unless refreshing' do
-    sign_user_in
-    visit user_token_path
-    assert_equal user_token_path, current_path
-    sleep(2)
-    visit user_token_path
-    assert_equal refresh_user_credential_path, current_path
-    fill_in 'user_refresh_password', with: '12345670'
-    click_button 'Continue...'
-    assert_equal refresh_user_credential_path, current_path
-  end
-  test 'user should be asked their OTP challenge in order to refresh, if they have OTP' do
-    enable_otp_and_sign_in_with_otp
-    sleep(2)
-    visit user_token_path
-    assert_equal refresh_user_credential_path, current_path
-    fill_in 'user_refresh_password', with: '12345678'
-    click_button 'Continue...'
-    assert_equal refresh_user_credential_path, current_path
-  end
-  test 'user should be finally be able to access their settings, if they provide both a password and a valid OTP token' do
-    user = enable_otp_and_sign_in_with_otp
-    sleep(2)
-    visit user_token_path
-    assert_equal refresh_user_credential_path, current_path
-    fill_in 'user_refresh_password', with: '12345678'
-    fill_in 'user_token', with: ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
-    click_button 'Continue...'
-    assert_equal user_token_path, current_path
-  end
-  test 'and rejected when the token is blank or null' do
-    user = enable_otp_and_sign_in_with_otp
-    sleep(2)
-    visit user_token_path
-    assert_equal refresh_user_credential_path, current_path
-    fill_in 'user_refresh_password', with: '12345678'
-    fill_in 'user_token', with: ''
-    click_button 'Continue...'
-    assert_equal refresh_user_credential_path, current_path
-  end
-end

data/test/integration/sign_in_test.rb DELETED

@@ -1,85 +0,0 @@
-require 'test_helper'
-require 'integration_tests_helper'
-class SignInTest < ActionDispatch::IntegrationTest
-  def teardown
-    Capybara.reset_sessions!
-  end
-  test 'a new user should be able to sign in without using their token' do
-    create_full_user
-    visit new_user_session_path
-    fill_in 'user_email', with: 'user@email.invalid'
-    fill_in 'user_password', with: '12345678'
-    page.has_content?('Log in') ? click_button('Log in') : click_button('Sign in')
-    assert_equal root_path, current_path
-  end
-  test 'a new user, just signed in, should be able to sign in and enable their OTP authentication' do
-    user = sign_user_in
-    visit user_token_path
-    assert !page.has_content?('Your token secret')
-    check 'user_otp_enabled'
-    click_button 'Continue...'
-    assert_equal user_token_path, current_path
-    assert page.has_content?('Your token secret')
-    assert !user.otp_auth_secret.nil?
-    assert !user.otp_persistence_seed.nil?
-  end
-  test 'a new user should be able to sign in enable OTP and be prompted for their token' do
-    enable_otp_and_sign_in
-    assert_equal user_credential_path, current_path
-  end
-  test 'fail token authentication' do
-    enable_otp_and_sign_in
-    assert_equal user_credential_path, current_path
-    fill_in 'user_token', with: '123456'
-    click_button 'Submit Token'
-    assert_equal new_user_session_path, current_path
-  end
-  test 'fail blank token authentication' do
-    enable_otp_and_sign_in
-    assert_equal user_credential_path, current_path
-    fill_in 'user_token', with: ''
-    click_button 'Submit Token'
-    assert_equal user_credential_path, current_path
-  end
-  test 'successful token authentication' do
-    user = enable_otp_and_sign_in
-    fill_in 'user_token', with: ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
-    click_button 'Submit Token'
-    assert_equal root_path, current_path
-  end
-  test 'should fail if the the challenge times out' do
-    old_timeout = User.otp_authentication_timeout
-    User.otp_authentication_timeout = 1.second
-    user = enable_otp_and_sign_in
-    sleep(2)
-    fill_in 'user_token', with: ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
-    click_button 'Submit Token'
-    User.otp_authentication_timeout = old_timeout
-    assert_equal new_user_session_path, current_path
-  end
-end

data/test/integration/token_test.rb DELETED

@@ -1,30 +0,0 @@
-require 'test_helper'
-require 'integration_tests_helper'
-class TokenTest < ActionDispatch::IntegrationTest
-  def teardown
-    Capybara.reset_sessions!
-  end
-  test 'disabling OTP after successfully enabling' do
-    # log in 1fa
-    user = enable_otp_and_sign_in
-    assert_equal user_credential_path, current_path
-    # otp two_factor
-    fill_in 'user_token', with: ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
-    click_button 'Submit Token'
-    assert_equal root_path, current_path
-    # disable OTP
-    disable_otp
-    # logout
-    sign_out
-    # log back in 1fa
-    sign_user_in(user)
-    assert_equal root_path, current_path
-  end
-end