RubyGems - devise-2fa - Versions diffs - 0.1.1 → 0.2.0 - Mend

devise-2fa 0.1.1 → 0.2.0

Files changed (115) hide show

checksums.yaml +5 -5
data/.circleci/config.yml +46 -0
data/.gitignore +8 -0
data/Gemfile +3 -22
data/README.md +13 -14
data/Rakefile +6 -28
data/bin/rspec +10 -0
data/bin/setup +12 -0
data/{devise-2fa.gemspec → devise_2fa.gemspec} +15 -8
data/lib/devise-2fa/version.rb +1 -1
data/lib/devise_two_factorable/models/two_factorable.rb +5 -1
data/{test → spec}/dummy/Rakefile +2 -3
data/{test/dummy/app/mailers/.gitkeep → spec/dummy/app/assets/images/.keep} +0 -0
data/spec/dummy/app/assets/javascripts/application.js +3 -0
data/{test/dummy/lib/assets/.gitkeep → spec/dummy/app/assets/javascripts/channels/.keep} +0 -0
data/spec/dummy/app/assets/stylesheets/application.css +15 -0
data/{test → spec}/dummy/app/controllers/application_controller.rb +4 -1
data/{test/dummy/public/favicon.ico → spec/dummy/app/controllers/concerns/.keep} +0 -0
data/{test → spec}/dummy/app/helpers/application_helper.rb +0 -0
data/spec/dummy/app/models/application_record.rb +3 -0
data/spec/dummy/app/models/concerns/.keep +0 -0
data/spec/dummy/app/models/user.rb +6 -0
data/spec/dummy/app/views/layouts/application.html.erb +19 -0
data/spec/dummy/app/views/layouts/mailer.text.erb +1 -0
data/spec/dummy/bin/bundle +3 -0
data/spec/dummy/bin/rails +4 -0
data/spec/dummy/bin/rake +4 -0
data/spec/dummy/bin/setup +25 -0
data/spec/dummy/bin/update +25 -0
data/spec/dummy/bin/yarn +11 -0
data/spec/dummy/config.ru +5 -0
data/spec/dummy/config/application.rb +14 -0
data/spec/dummy/config/boot.rb +5 -0
data/{test → spec}/dummy/config/database.yml +10 -10
data/spec/dummy/config/environment.rb +5 -0
data/spec/dummy/config/environments/development.rb +61 -0
data/{test → spec}/dummy/config/environments/test.rb +15 -5
data/spec/dummy/config/initializers/assets.rb +4 -0
data/{test → spec}/dummy/config/initializers/backtrace_silencers.rb +0 -0
data/spec/dummy/config/initializers/cookies_serializer.rb +5 -0
data/{test → spec}/dummy/config/initializers/devise.rb +134 -56
data/spec/dummy/config/initializers/filter_parameter_logging.rb +4 -0
data/{test → spec}/dummy/config/initializers/inflections.rb +6 -5
data/{test → spec}/dummy/config/initializers/mime_types.rb +0 -1
data/{test → spec}/dummy/config/initializers/wrap_parameters.rb +5 -5
data/spec/dummy/config/locales/devise.en.yml +68 -0
data/spec/dummy/config/locales/devise.two_factor.en.yml +57 -0
data/spec/dummy/config/locales/en.yml +2 -0
data/spec/dummy/config/puma.rb +9 -0
data/spec/dummy/config/routes.rb +4 -0
data/spec/dummy/config/spring.rb +6 -0
data/spec/dummy/config/storage.yml +8 -0
data/spec/dummy/db/migrate/20190311184605_devise_create_users.rb +44 -0
data/{test/dummy/db/migrate/20130131160351_devise_otp_add_to_users.rb → spec/dummy/db/migrate/20190312222952_devise_two_factor_add_to_users.rb} +4 -5
data/spec/dummy/db/schema.rb +39 -0
data/spec/dummy/lib/assets/.keep +0 -0
data/spec/dummy/package.json +5 -0
data/spec/dummy/public/404.html +1 -0
data/spec/dummy/public/422.html +1 -0
data/spec/dummy/public/500.html +19 -0
data/spec/dummy/public/apple-touch-icon-precomposed.png +0 -0
data/spec/dummy/public/apple-touch-icon.png +0 -0
data/spec/dummy/public/favicon.ico +0 -0
data/spec/dummy/storage/.keep +0 -0
data/spec/models/user_spec.rb +33 -0
data/spec/spec_helper.rb +69 -0
data/spec/system/persistence_spec.rb +59 -0
data/spec/system/refresh_spec.rb +100 -0
data/spec/system/token_spec.rb +41 -0
data/spec/system/users_spec.rb +98 -0
metadata +213 -123
data/.travis.yml +0 -28
data/lib/devise_two_factorable/two_factorable.rb +0 -131
data/test/dummy/README.rdoc +0 -261
data/test/dummy/app/assets/javascripts/application.js +0 -13
data/test/dummy/app/assets/stylesheets/application.css +0 -13
data/test/dummy/app/controllers/posts_controller.rb +0 -83
data/test/dummy/app/helpers/posts_helper.rb +0 -2
data/test/dummy/app/models/post.rb +0 -2
data/test/dummy/app/models/user.rb +0 -20
data/test/dummy/app/views/layouts/application.html.erb +0 -14
data/test/dummy/app/views/posts/_form.html.erb +0 -25
data/test/dummy/app/views/posts/edit.html.erb +0 -6
data/test/dummy/app/views/posts/index.html.erb +0 -25
data/test/dummy/app/views/posts/new.html.erb +0 -5
data/test/dummy/app/views/posts/show.html.erb +0 -15
data/test/dummy/config.ru +0 -4
data/test/dummy/config/application.rb +0 -67
data/test/dummy/config/boot.rb +0 -10
data/test/dummy/config/environment.rb +0 -5
data/test/dummy/config/environments/development.rb +0 -37
data/test/dummy/config/environments/production.rb +0 -73
data/test/dummy/config/initializers/secret_token.rb +0 -8
data/test/dummy/config/initializers/session_store.rb +0 -8
data/test/dummy/config/locales/en.yml +0 -5
data/test/dummy/config/routes.rb +0 -6
data/test/dummy/db/migrate/20130125101430_create_users.rb +0 -9
data/test/dummy/db/migrate/20130131092406_add_devise_to_users.rb +0 -52
data/test/dummy/db/migrate/20130131142320_create_posts.rb +0 -10
data/test/dummy/public/404.html +0 -26
data/test/dummy/public/422.html +0 -26
data/test/dummy/public/500.html +0 -25
data/test/dummy/script/rails +0 -6
data/test/integration/persistence_test.rb +0 -63
data/test/integration/refresh_test.rb +0 -103
data/test/integration/sign_in_test.rb +0 -85
data/test/integration/token_test.rb +0 -30
data/test/integration_tests_helper.rb +0 -64
data/test/model_tests_helper.rb +0 -20
data/test/models/two_factorable_test.rb +0 -120
data/test/orm/active_record.rb +0 -4
data/test/orm/mongoid.rb +0 -13
data/test/support/mongoid.yml +0 -6
data/test/support/symmetric_encryption.yml +0 -70
data/test/test_helper.rb +0 -18

data/test/dummy/db/migrate/20130125101430_create_users.rb DELETED

@@ -1,9 +0,0 @@
-class CreateUsers < ActiveRecord::Migration
-  def change
-    create_table :users do |t|
-      t.string :name
-      t.timestamps
-    end
-  end
-end

data/test/dummy/db/migrate/20130131092406_add_devise_to_users.rb DELETED

@@ -1,52 +0,0 @@
-class AddDeviseToUsers < ActiveRecord::Migration
-  def self.up
-    change_table(:users) do |t|
-      ## Database authenticatable
-      t.string :email,              null: false, default: ''
-      t.string :encrypted_password, null: false, default: ''
-      ## Recoverable
-      t.string   :reset_password_token
-      t.datetime :reset_password_sent_at
-      ## Rememberable
-      t.datetime :remember_created_at
-      ## Trackable
-      t.integer  :sign_in_count, default: 0
-      t.datetime :current_sign_in_at
-      t.datetime :last_sign_in_at
-      t.string   :current_sign_in_ip
-      t.string   :last_sign_in_ip
-      ## Confirmable
-      # t.string   :confirmation_token
-      # t.datetime :confirmed_at
-      # t.datetime :confirmation_sent_at
-      # t.string   :unconfirmed_email # Only if using reconfirmable
-      ## Lockable
-      t.integer  :failed_attempts, default: 0 # Only if lock strategy is :failed_attempts
-      t.string   :unlock_token # Only if unlock strategy is :email or :both
-      t.datetime :locked_at
-      ## Token authenticatable
-      t.string :authentication_token
-      # Uncomment below if timestamps were not included in your original model.
-      # t.timestamps
-    end
-    add_index :users, :email,                unique: true
-    add_index :users, :reset_password_token, unique: true
-    # add_index :users, :confirmation_token,   :unique => true
-    add_index :users, :unlock_token,         unique: true
-    add_index :users, :authentication_token, unique: true
-  end
-  def self.down
-    # By default, we don't want to make any assumption about how to roll back a migration when your
-    # model already existed. Please edit below which fields you would like to remove in this migration.
-    raise ActiveRecord::IrreversibleMigration
-  end
-end

data/test/dummy/db/migrate/20130131142320_create_posts.rb DELETED

@@ -1,10 +0,0 @@
-class CreatePosts < ActiveRecord::Migration
-  def change
-    create_table :posts do |t|
-      t.string :title
-      t.text :body
-      t.timestamps
-    end
-  end
-end

data/test/dummy/public/404.html DELETED

@@ -1,26 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>The page you were looking for doesn't exist (404)</title>
-  <style type="text/css">
-    body { background-color: #fff; color: #666; text-align: center; font-family: arial, sans-serif; }
-    div.dialog {
-      width: 25em;
-      padding: 0 4em;
-      margin: 4em auto 0 auto;
-      border: 1px solid #ccc;
-      border-right-color: #999;
-      border-bottom-color: #999;
-    }
-    h1 { font-size: 100%; color: #f00; line-height: 1.5em; }
-  </style>
-</head>
-<body>
-  <!-- This file lives in public/404.html -->
-  <div class="dialog">
-    <h1>The page you were looking for doesn't exist.</h1>
-    <p>You may have mistyped the address or the page may have moved.</p>
-  </div>
-</body>
-</html>

data/test/dummy/public/422.html DELETED

@@ -1,26 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>The change you wanted was rejected (422)</title>
-  <style type="text/css">
-    body { background-color: #fff; color: #666; text-align: center; font-family: arial, sans-serif; }
-    div.dialog {
-      width: 25em;
-      padding: 0 4em;
-      margin: 4em auto 0 auto;
-      border: 1px solid #ccc;
-      border-right-color: #999;
-      border-bottom-color: #999;
-    }
-    h1 { font-size: 100%; color: #f00; line-height: 1.5em; }
-  </style>
-</head>
-<body>
-  <!-- This file lives in public/422.html -->
-  <div class="dialog">
-    <h1>The change you wanted was rejected.</h1>
-    <p>Maybe you tried to change something you didn't have access to.</p>
-  </div>
-</body>
-</html>

data/test/dummy/public/500.html DELETED

@@ -1,25 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>We're sorry, but something went wrong (500)</title>
-  <style type="text/css">
-    body { background-color: #fff; color: #666; text-align: center; font-family: arial, sans-serif; }
-    div.dialog {
-      width: 25em;
-      padding: 0 4em;
-      margin: 4em auto 0 auto;
-      border: 1px solid #ccc;
-      border-right-color: #999;
-      border-bottom-color: #999;
-    }
-    h1 { font-size: 100%; color: #f00; line-height: 1.5em; }
-  </style>
-</head>
-<body>
-  <!-- This file lives in public/500.html -->
-  <div class="dialog">
-    <h1>We're sorry, but something went wrong.</h1>
-  </div>
-</body>
-</html>

data/test/dummy/script/rails DELETED

@@ -1,6 +0,0 @@
-#!/usr/bin/env ruby
-# This command will automatically be run when you run "rails" with Rails 3 gems installed from the root of your application.
-APP_PATH = File.expand_path('../../config/application', __FILE__)
-require File.expand_path('../../config/boot', __FILE__)
-require 'rails/commands'

data/test/integration/persistence_test.rb DELETED

@@ -1,63 +0,0 @@
-require 'test_helper'
-require 'integration_tests_helper'
-class PersistenceTest < ActionDispatch::IntegrationTest
-  def setup
-    @old_persistence = User.otp_trust_persistence
-    User.otp_trust_persistence = 3.seconds
-  end
-  def teardown
-    User.otp_trust_persistence = @old_persistence
-    Capybara.reset_sessions!
-  end
-  test 'a user should be requested the otp challenge every log in' do
-    # log in 1fa
-    user = enable_otp_and_sign_in
-    otp_challenge_for user
-    visit user_token_path
-    assert_equal user_token_path, current_path
-    sign_out
-    sign_user_in
-    assert_equal user_credential_path, current_path
-  end
-  test 'a user should be able to set their browser as trusted' do
-    # log in 1fa
-    user = enable_otp_and_sign_in
-    otp_challenge_for user
-    visit user_token_path
-    assert_equal user_token_path, current_path
-    click_link('Trust this browser')
-    assert_text 'Your browser is trusted.'
-    sign_out
-    sign_user_in
-    assert_equal root_path, current_path
-  end
-  test 'trusted status should expire' do
-    # log in 1fa
-    user = enable_otp_and_sign_in
-    otp_challenge_for user
-    visit user_token_path
-    assert_equal user_token_path, current_path
-    click_link('Trust this browser')
-    assert_text 'Your browser is trusted.'
-    sign_out
-    sleep User.otp_trust_persistence.to_i + 1
-    sign_user_in
-    assert_equal user_credential_path, current_path
-  end
-end

data/test/integration/refresh_test.rb DELETED

@@ -1,103 +0,0 @@
-require 'test_helper'
-require 'integration_tests_helper'
-class RefreshTest < ActionDispatch::IntegrationTest
-  def setup
-    @old_refresh = User.otp_credentials_refresh
-    User.otp_credentials_refresh = 1.second
-  end
-  def teardown
-    User.otp_credentials_refresh = @old_refresh
-    Capybara.reset_sessions!
-  end
-  test 'a user that just signed in should be able to access their OTP settings without refreshing' do
-    sign_user_in
-    visit user_token_path
-    assert_equal user_token_path, current_path
-  end
-  test 'a user should be prompted for credentials when the credentials_refresh time is expired' do
-    sign_user_in
-    visit user_token_path
-    assert_equal user_token_path, current_path
-    sleep(2)
-    visit user_token_path
-    assert_equal refresh_user_credential_path, current_path
-  end
-  test 'a user should be able to access their OTP settings after refreshing' do
-    sign_user_in
-    visit user_token_path
-    assert_equal user_token_path, current_path
-    sleep(2)
-    visit user_token_path
-    assert_equal refresh_user_credential_path, current_path
-    fill_in 'user_refresh_password', with: '12345678'
-    click_button 'Continue...'
-    assert_equal user_token_path, current_path
-  end
-  test 'a user should NOT be able to access their OTP settings unless refreshing' do
-    sign_user_in
-    visit user_token_path
-    assert_equal user_token_path, current_path
-    sleep(2)
-    visit user_token_path
-    assert_equal refresh_user_credential_path, current_path
-    fill_in 'user_refresh_password', with: '12345670'
-    click_button 'Continue...'
-    assert_equal refresh_user_credential_path, current_path
-  end
-  test 'user should be asked their OTP challenge in order to refresh, if they have OTP' do
-    enable_otp_and_sign_in_with_otp
-    sleep(2)
-    visit user_token_path
-    assert_equal refresh_user_credential_path, current_path
-    fill_in 'user_refresh_password', with: '12345678'
-    click_button 'Continue...'
-    assert_equal refresh_user_credential_path, current_path
-  end
-  test 'user should be finally be able to access their settings, if they provide both a password and a valid OTP token' do
-    user = enable_otp_and_sign_in_with_otp
-    sleep(2)
-    visit user_token_path
-    assert_equal refresh_user_credential_path, current_path
-    fill_in 'user_refresh_password', with: '12345678'
-    fill_in 'user_token', with: ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
-    click_button 'Continue...'
-    assert_equal user_token_path, current_path
-  end
-  test 'and rejected when the token is blank or null' do
-    user = enable_otp_and_sign_in_with_otp
-    sleep(2)
-    visit user_token_path
-    assert_equal refresh_user_credential_path, current_path
-    fill_in 'user_refresh_password', with: '12345678'
-    fill_in 'user_token', with: ''
-    click_button 'Continue...'
-    assert_equal refresh_user_credential_path, current_path
-  end
-end

data/test/integration/sign_in_test.rb DELETED

@@ -1,85 +0,0 @@
-require 'test_helper'
-require 'integration_tests_helper'
-class SignInTest < ActionDispatch::IntegrationTest
-  def teardown
-    Capybara.reset_sessions!
-  end
-  test 'a new user should be able to sign in without using their token' do
-    create_full_user
-    visit new_user_session_path
-    fill_in 'user_email', with: 'user@email.invalid'
-    fill_in 'user_password', with: '12345678'
-    page.has_content?('Log in') ? click_button('Log in') : click_button('Sign in')
-    assert_equal root_path, current_path
-  end
-  test 'a new user, just signed in, should be able to sign in and enable their OTP authentication' do
-    user = sign_user_in
-    visit user_token_path
-    assert !page.has_content?('Your token secret')
-    check 'user_otp_enabled'
-    click_button 'Continue...'
-    assert_equal user_token_path, current_path
-    assert page.has_content?('Your token secret')
-    assert !user.otp_auth_secret.nil?
-    assert !user.otp_persistence_seed.nil?
-  end
-  test 'a new user should be able to sign in enable OTP and be prompted for their token' do
-    enable_otp_and_sign_in
-    assert_equal user_credential_path, current_path
-  end
-  test 'fail token authentication' do
-    enable_otp_and_sign_in
-    assert_equal user_credential_path, current_path
-    fill_in 'user_token', with: '123456'
-    click_button 'Submit Token'
-    assert_equal new_user_session_path, current_path
-  end
-  test 'fail blank token authentication' do
-    enable_otp_and_sign_in
-    assert_equal user_credential_path, current_path
-    fill_in 'user_token', with: ''
-    click_button 'Submit Token'
-    assert_equal user_credential_path, current_path
-  end
-  test 'successful token authentication' do
-    user = enable_otp_and_sign_in
-    fill_in 'user_token', with: ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
-    click_button 'Submit Token'
-    assert_equal root_path, current_path
-  end
-  test 'should fail if the the challenge times out' do
-    old_timeout = User.otp_authentication_timeout
-    User.otp_authentication_timeout = 1.second
-    user = enable_otp_and_sign_in
-    sleep(2)
-    fill_in 'user_token', with: ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
-    click_button 'Submit Token'
-    User.otp_authentication_timeout = old_timeout
-    assert_equal new_user_session_path, current_path
-  end
-end

data/test/integration/token_test.rb DELETED

@@ -1,30 +0,0 @@
-require 'test_helper'
-require 'integration_tests_helper'
-class TokenTest < ActionDispatch::IntegrationTest
-  def teardown
-    Capybara.reset_sessions!
-  end
-  test 'disabling OTP after successfully enabling' do
-    # log in 1fa
-    user = enable_otp_and_sign_in
-    assert_equal user_credential_path, current_path
-    # otp two_factor
-    fill_in 'user_token', with: ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
-    click_button 'Submit Token'
-    assert_equal root_path, current_path
-    # disable OTP
-    disable_otp
-    # logout
-    sign_out
-    # log back in 1fa
-    sign_user_in(user)
-    assert_equal root_path, current_path
-  end
-end