RubyGems - devise-otp-rails5 - Versions diffs - 0.2.4 - Mend

devise-otp-rails5 0.2.4

Files changed (89) hide show

checksums.yaml +7 -0
data/.gitignore +42 -0
data/.travis.yml +12 -0
data/Gemfile +25 -0
data/LICENSE.txt +22 -0
data/README.md +140 -0
data/Rakefile +42 -0
data/app/assets/javascripts/devise-otp.js +1 -0
data/app/assets/javascripts/qrcode.js +609 -0
data/app/controllers/devise_otp/credentials_controller.rb +106 -0
data/app/controllers/devise_otp/tokens_controller.rb +111 -0
data/app/views/devise_otp/credentials/refresh.html.erb +20 -0
data/app/views/devise_otp/credentials/show.html.erb +23 -0
data/app/views/devise_otp/tokens/_token_secret.html.erb +19 -0
data/app/views/devise_otp/tokens/_trusted_devices.html.erb +10 -0
data/app/views/devise_otp/tokens/recovery.html.erb +21 -0
data/app/views/devise_otp/tokens/recovery_codes.text.erb +3 -0
data/app/views/devise_otp/tokens/show.html.erb +19 -0
data/config/locales/en.yml +66 -0
data/devise-otp.gemspec +25 -0
data/lib/devise-otp.rb +83 -0
data/lib/devise-otp/version.rb +5 -0
data/lib/devise_otp_authenticatable/controllers/helpers.rb +168 -0
data/lib/devise_otp_authenticatable/controllers/url_helpers.rb +33 -0
data/lib/devise_otp_authenticatable/engine.rb +23 -0
data/lib/devise_otp_authenticatable/hooks.rb +13 -0
data/lib/devise_otp_authenticatable/hooks/sessions.rb +59 -0
data/lib/devise_otp_authenticatable/mapping.rb +19 -0
data/lib/devise_otp_authenticatable/models/otp_authenticatable.rb +137 -0
data/lib/devise_otp_authenticatable/routes.rb +32 -0
data/lib/generators/active_record/devise_otp_generator.rb +13 -0
data/lib/generators/active_record/templates/migration.rb +27 -0
data/lib/generators/devise_otp/devise_otp_generator.rb +17 -0
data/lib/generators/devise_otp/install_generator.rb +53 -0
data/lib/generators/devise_otp/views_generator.rb +19 -0
data/test/dummy/README.rdoc +261 -0
data/test/dummy/Rakefile +7 -0
data/test/dummy/app/assets/javascripts/application.js +13 -0
data/test/dummy/app/assets/stylesheets/application.css +13 -0
data/test/dummy/app/controllers/application_controller.rb +4 -0
data/test/dummy/app/controllers/posts_controller.rb +83 -0
data/test/dummy/app/helpers/application_helper.rb +2 -0
data/test/dummy/app/helpers/posts_helper.rb +2 -0
data/test/dummy/app/mailers/.gitkeep +0 -0
data/test/dummy/app/models/post.rb +2 -0
data/test/dummy/app/models/user.rb +20 -0
data/test/dummy/app/views/layouts/application.html.erb +14 -0
data/test/dummy/app/views/posts/_form.html.erb +25 -0
data/test/dummy/app/views/posts/edit.html.erb +6 -0
data/test/dummy/app/views/posts/index.html.erb +25 -0
data/test/dummy/app/views/posts/new.html.erb +5 -0
data/test/dummy/app/views/posts/show.html.erb +15 -0
data/test/dummy/config.ru +4 -0
data/test/dummy/config/application.rb +67 -0
data/test/dummy/config/boot.rb +10 -0
data/test/dummy/config/database.yml +25 -0
data/test/dummy/config/environment.rb +5 -0
data/test/dummy/config/environments/development.rb +30 -0
data/test/dummy/config/environments/production.rb +69 -0
data/test/dummy/config/environments/test.rb +36 -0
data/test/dummy/config/initializers/backtrace_silencers.rb +7 -0
data/test/dummy/config/initializers/devise.rb +253 -0
data/test/dummy/config/initializers/inflections.rb +15 -0
data/test/dummy/config/initializers/mime_types.rb +5 -0
data/test/dummy/config/initializers/secret_token.rb +8 -0
data/test/dummy/config/initializers/session_store.rb +8 -0
data/test/dummy/config/initializers/wrap_parameters.rb +14 -0
data/test/dummy/config/locales/en.yml +5 -0
data/test/dummy/config/routes.rb +6 -0
data/test/dummy/db/migrate/20130125101430_create_users.rb +9 -0
data/test/dummy/db/migrate/20130131092406_add_devise_to_users.rb +53 -0
data/test/dummy/db/migrate/20130131142320_create_posts.rb +10 -0
data/test/dummy/db/migrate/20130131160351_devise_otp_add_to_users.rb +28 -0
data/test/dummy/lib/assets/.gitkeep +0 -0
data/test/dummy/public/404.html +26 -0
data/test/dummy/public/422.html +26 -0
data/test/dummy/public/500.html +25 -0
data/test/dummy/public/favicon.ico +0 -0
data/test/dummy/script/rails +6 -0
data/test/integration/persistence_test.rb +65 -0
data/test/integration/refresh_test.rb +106 -0
data/test/integration/sign_in_test.rb +87 -0
data/test/integration/token_test.rb +34 -0
data/test/integration_tests_helper.rb +66 -0
data/test/model_tests_helper.rb +22 -0
data/test/models/otp_authenticatable_test.rb +122 -0
data/test/orm/active_record.rb +4 -0
data/test/test_helper.rb +22 -0
metadata +253 -0

data/test/dummy/db/migrate/20130131160351_devise_otp_add_to_users.rb ADDED

@@ -0,0 +1,28 @@
+class DeviseOtpAddToUsers < ActiveRecord::Migration[5.0]
+  def self.up
+    change_table :users do |t|
+      t.string    :otp_auth_secret
+      t.string    :otp_recovery_secret
+      t.boolean   :otp_enabled,          :default => false, :null => false
+      t.boolean   :otp_mandatory,        :default => false, :null => false
+      t.datetime  :otp_enabled_on
+      t.integer   :otp_time_drift,       :default => 0, :null => false
+      t.integer   :otp_failed_attempts,  :default => 0, :null => false
+      t.integer   :otp_recovery_counter, :default => 0, :null => false
+      t.string    :otp_persistence_seed
+      t.string    :otp_session_challenge
+      t.datetime  :otp_challenge_expires
+    end
+    add_index :users, :otp_session_challenge,  :unique => true
+    add_index :users, :otp_challenge_expires
+  end
+  def self.down
+    change_table :users do |t|
+      t.remove :otp_auth_secret, :otp_recovery_secret, :otp_enabled, :otp_mandatory, :otp_enabled_on, :otp_session_challenge,
+          :otp_challenge_expires, :otp_time_drift, :otp_failed_attempts, :otp_recovery_counter, :otp_persistence_seed
+    end
+  end
+end

data/test/dummy/lib/assets/.gitkeep ADDED

File without changes

data/test/dummy/public/404.html ADDED

@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>The page you were looking for doesn't exist (404)</title>
+  <style type="text/css">
+    body { background-color: #fff; color: #666; text-align: center; font-family: arial, sans-serif; }
+    div.dialog {
+      width: 25em;
+      padding: 0 4em;
+      margin: 4em auto 0 auto;
+      border: 1px solid #ccc;
+      border-right-color: #999;
+      border-bottom-color: #999;
+    }
+    h1 { font-size: 100%; color: #f00; line-height: 1.5em; }
+  </style>
+</head>
+<body>
+  <!-- This file lives in public/404.html -->
+  <div class="dialog">
+    <h1>The page you were looking for doesn't exist.</h1>
+    <p>You may have mistyped the address or the page may have moved.</p>
+  </div>
+</body>
+</html>

data/test/dummy/public/422.html ADDED

@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>The change you wanted was rejected (422)</title>
+  <style type="text/css">
+    body { background-color: #fff; color: #666; text-align: center; font-family: arial, sans-serif; }
+    div.dialog {
+      width: 25em;
+      padding: 0 4em;
+      margin: 4em auto 0 auto;
+      border: 1px solid #ccc;
+      border-right-color: #999;
+      border-bottom-color: #999;
+    }
+    h1 { font-size: 100%; color: #f00; line-height: 1.5em; }
+  </style>
+</head>
+<body>
+  <!-- This file lives in public/422.html -->
+  <div class="dialog">
+    <h1>The change you wanted was rejected.</h1>
+    <p>Maybe you tried to change something you didn't have access to.</p>
+  </div>
+</body>
+</html>

data/test/dummy/public/500.html ADDED

@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>We're sorry, but something went wrong (500)</title>
+  <style type="text/css">
+    body { background-color: #fff; color: #666; text-align: center; font-family: arial, sans-serif; }
+    div.dialog {
+      width: 25em;
+      padding: 0 4em;
+      margin: 4em auto 0 auto;
+      border: 1px solid #ccc;
+      border-right-color: #999;
+      border-bottom-color: #999;
+    }
+    h1 { font-size: 100%; color: #f00; line-height: 1.5em; }
+  </style>
+</head>
+<body>
+  <!-- This file lives in public/500.html -->
+  <div class="dialog">
+    <h1>We're sorry, but something went wrong.</h1>
+  </div>
+</body>
+</html>

data/test/dummy/public/favicon.ico ADDED

File without changes

data/test/dummy/script/rails ADDED

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+# This command will automatically be run when you run "rails" with Rails 3 gems installed from the root of your application.
+APP_PATH = File.expand_path('../../config/application',  __FILE__)
+require File.expand_path('../../config/boot',  __FILE__)
+require 'rails/commands'

data/test/integration/persistence_test.rb ADDED

@@ -0,0 +1,65 @@
+require 'test_helper'
+require 'integration_tests_helper'
+class PersistenceTest < ActionDispatch::IntegrationTest
+  def setup
+    @old_persistence = User.otp_trust_persistence
+    User.otp_trust_persistence = 3.seconds
+  end
+  def teardown
+    User.otp_trust_persistence = @old_persistence
+    Capybara.reset_sessions!
+  end
+  test 'a user should be requested the otp challenge every log in' do
+    # log in 1fa
+    user = enable_otp_and_sign_in
+    otp_challenge_for user
+    visit user_otp_token_path
+    assert_equal user_otp_token_path, current_path
+    sign_out
+    sign_user_in
+    assert_equal user_otp_credential_path, current_path
+  end
+  test 'a user should be able to set their browser as trusted' do
+    # log in 1fa
+    user = enable_otp_and_sign_in
+    otp_challenge_for user
+    visit user_otp_token_path
+    assert_equal user_otp_token_path, current_path
+    click_link('Trust this browser')
+    assert_text 'Your browser is trusted.'
+    sign_out
+    sign_user_in
+    assert_equal root_path, current_path
+  end
+  test 'trusted status should expire' do
+    # log in 1fa
+    user = enable_otp_and_sign_in
+    otp_challenge_for user
+    visit user_otp_token_path
+    assert_equal user_otp_token_path, current_path
+    click_link('Trust this browser')
+    assert_text 'Your browser is trusted.'
+    sign_out
+    sleep User.otp_trust_persistence.to_i + 1
+    sign_user_in
+    assert_equal user_otp_credential_path, current_path
+  end
+end

data/test/integration/refresh_test.rb ADDED

@@ -0,0 +1,106 @@
+require 'test_helper'
+require 'integration_tests_helper'
+class RefreshTest < ActionDispatch::IntegrationTest
+  def setup
+    @old_refresh = User.otp_credentials_refresh
+    User.otp_credentials_refresh = 1.second
+  end
+  def teardown
+    User.otp_credentials_refresh = @old_refresh
+    Capybara.reset_sessions!
+  end
+  test 'a user that just signed in should be able to access their OTP settings without refreshing' do
+    sign_user_in
+    visit user_otp_token_path
+    assert_equal user_otp_token_path, current_path
+  end
+  test 'a user should be prompted for credentials when the credentials_refresh time is expired' do
+    sign_user_in
+    visit user_otp_token_path
+    assert_equal user_otp_token_path, current_path
+    sleep(2)
+    visit user_otp_token_path
+    assert_equal refresh_user_otp_credential_path, current_path
+  end
+  test 'a user should be able to access their OTP settings after refreshing' do
+    sign_user_in
+    visit user_otp_token_path
+    assert_equal user_otp_token_path, current_path
+    sleep(2)
+    visit user_otp_token_path
+    assert_equal refresh_user_otp_credential_path, current_path
+    fill_in 'user_refresh_password', :with => '12345678'
+    click_button 'Continue...'
+    assert_equal user_otp_token_path, current_path
+  end
+  test 'a user should NOT be able to access their OTP settings unless refreshing' do
+    sign_user_in
+    visit user_otp_token_path
+    assert_equal user_otp_token_path, current_path
+    sleep(2)
+    visit user_otp_token_path
+    assert_equal refresh_user_otp_credential_path, current_path
+    fill_in 'user_refresh_password', :with => '12345670'
+    click_button 'Continue...'
+    assert_equal refresh_user_otp_credential_path, current_path
+  end
+  test 'user should be asked their OTP challenge in order to refresh, if they have OTP' do
+    enable_otp_and_sign_in_with_otp
+    sleep(2)
+    visit user_otp_token_path
+    assert_equal refresh_user_otp_credential_path, current_path
+    fill_in 'user_refresh_password', :with => '12345678'
+    click_button 'Continue...'
+    assert_equal refresh_user_otp_credential_path, current_path
+  end
+  test 'user should be finally be able to access their settings, if they provide both a password and a valid OTP token' do
+    user = enable_otp_and_sign_in_with_otp
+    sleep(2)
+    visit user_otp_token_path
+    assert_equal refresh_user_otp_credential_path, current_path
+    fill_in 'user_refresh_password', :with => '12345678'
+    fill_in 'user_token', :with => ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
+    click_button 'Continue...'
+    assert_equal user_otp_token_path, current_path
+  end
+  test 'and rejected when the token is blank or null' do
+    user = enable_otp_and_sign_in_with_otp
+    sleep(2)
+    visit user_otp_token_path
+    assert_equal refresh_user_otp_credential_path, current_path
+    fill_in 'user_refresh_password', :with => '12345678'
+    fill_in 'user_token', :with => ''
+    click_button 'Continue...'
+    assert_equal refresh_user_otp_credential_path, current_path
+  end
+end

data/test/integration/sign_in_test.rb ADDED

@@ -0,0 +1,87 @@
+require 'test_helper'
+require 'integration_tests_helper'
+class SignInTest < ActionDispatch::IntegrationTest
+  def teardown
+    Capybara.reset_sessions!
+  end
+  test 'a new user should be able to sign in without using their token' do
+    create_full_user
+    visit new_user_session_path
+    fill_in 'user_email', :with => 'user@email.invalid'
+    fill_in 'user_password', :with => '12345678'
+    page.has_content?('Log in') ? click_button('Log in') : click_button('Sign in')
+    assert_equal root_path, current_path
+  end
+  test 'a new user, just signed in, should be able to sign in and enable their OTP authentication' do
+    user = sign_user_in
+    visit user_otp_token_path
+    assert !page.has_content?('Your token secret')
+    check 'user_otp_enabled'
+    click_button 'Continue...'
+    assert_equal user_otp_token_path, current_path
+    assert page.has_content?('Your token secret')
+    assert !user.otp_auth_secret.nil?
+    assert !user.otp_persistence_seed.nil?
+  end
+  test 'a new user should be able to sign in enable OTP and be prompted for their token' do
+    enable_otp_and_sign_in
+    assert_equal user_otp_credential_path, current_path
+  end
+  test 'fail token authentication' do
+    enable_otp_and_sign_in
+    assert_equal user_otp_credential_path, current_path
+    fill_in 'user_token', :with => '123456'
+    click_button 'Submit Token'
+    assert_equal new_user_session_path, current_path
+  end
+  test 'fail blank token authentication' do
+    enable_otp_and_sign_in
+    assert_equal user_otp_credential_path, current_path
+    fill_in 'user_token', :with => ''
+    click_button 'Submit Token'
+    assert_equal user_otp_credential_path, current_path
+  end
+  test 'successful token authentication' do
+    user = enable_otp_and_sign_in
+    fill_in 'user_token', :with => ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
+    click_button 'Submit Token'
+    assert_equal root_path, current_path
+  end
+  test 'should fail if the the challenge times out' do
+    old_timeout = User.otp_authentication_timeout
+    User.otp_authentication_timeout = 1.second
+    user = enable_otp_and_sign_in
+    sleep(2)
+    fill_in 'user_token', :with => ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
+    click_button 'Submit Token'
+    User.otp_authentication_timeout = old_timeout
+    assert_equal new_user_session_path, current_path
+  end
+end

data/test/integration/token_test.rb ADDED

@@ -0,0 +1,34 @@
+require 'test_helper'
+require 'integration_tests_helper'
+class TokenTest < ActionDispatch::IntegrationTest
+  def teardown
+    Capybara.reset_sessions!
+  end
+  test 'disabling OTP after successfully enabling' do
+    # log in 1fa
+    user = enable_otp_and_sign_in
+    assert_equal user_otp_credential_path, current_path
+    # otp 2fa
+    fill_in 'user_token', :with => ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
+    click_button 'Submit Token'
+    assert_equal root_path, current_path
+    # disable OTP
+    disable_otp
+    # logout
+    sign_out
+    # log back in 1fa
+    sign_user_in(user)
+    assert_equal root_path, current_path
+  end
+end

data/test/integration_tests_helper.rb ADDED

@@ -0,0 +1,66 @@
+class ActionDispatch::IntegrationTest
+  include Warden::Test::Helpers
+  def warden
+    request.env['warden']
+  end
+  def create_full_user
+    @user ||= begin
+      user = User.create!(
+        :email                 => 'user@email.invalid',
+        :password              => '12345678',
+        :password_confirmation => '12345678'
+      )
+      user
+    end
+  end
+  def enable_otp_and_sign_in_with_otp
+    enable_otp_and_sign_in.tap do |user|
+      fill_in 'user_token', :with => ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
+      click_button 'Submit Token'
+    end
+  end
+  def enable_otp_and_sign_in
+    user = create_full_user
+    sign_user_in(user)
+    visit user_otp_token_path
+    check 'user_otp_enabled'
+    click_button 'Continue...'
+    Capybara.reset_sessions!
+    sign_user_in(user)
+    user
+  end
+  def otp_challenge_for(user)
+    fill_in 'user_token', :with => ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
+    click_button 'Submit Token'
+  end
+  def disable_otp
+    visit user_otp_token_path
+    uncheck 'user_otp_enabled'
+    click_button 'Continue...'
+  end
+  def sign_out
+    logout :user
+  end
+  def sign_user_in(user = nil)
+    user ||= create_full_user
+    resource_name = user.class.name.underscore
+    visit send("new_#{resource_name}_session_path")
+    fill_in "#{resource_name}_email", :with => user.email
+    fill_in "#{resource_name}_password", :with => user.password
+    page.has_content?('Log in') ? click_button('Log in') : click_button('Sign in')
+    user
+  end
+end