RubyGems - devise-otp - Versions diffs - 0.1.1 - Mend

devise-otp 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (83) hide show

checksums.yaml +7 -0
data/.gitignore +42 -0
data/.travis.yml +11 -0
data/Gemfile +25 -0
data/LICENSE.txt +22 -0
data/README.md +124 -0
data/Rakefile +42 -0
data/app/controllers/devise_otp/credentials_controller.rb +106 -0
data/app/controllers/devise_otp/tokens_controller.rb +105 -0
data/app/views/devise_otp/credentials/refresh.html.erb +20 -0
data/app/views/devise_otp/credentials/show.html.erb +23 -0
data/app/views/devise_otp/tokens/_token_secret.html.erb +17 -0
data/app/views/devise_otp/tokens/recovery.html.erb +21 -0
data/app/views/devise_otp/tokens/show.html.erb +31 -0
data/config/locales/en.yml +66 -0
data/devise-otp.gemspec +25 -0
data/lib/devise-otp.rb +76 -0
data/lib/devise-otp/version.rb +5 -0
data/lib/devise_otp_authenticatable/controllers/helpers.rb +144 -0
data/lib/devise_otp_authenticatable/controllers/url_helpers.rb +35 -0
data/lib/devise_otp_authenticatable/engine.rb +23 -0
data/lib/devise_otp_authenticatable/hooks.rb +13 -0
data/lib/devise_otp_authenticatable/hooks/sessions.rb +57 -0
data/lib/devise_otp_authenticatable/mapping.rb +19 -0
data/lib/devise_otp_authenticatable/models/otp_authenticatable.rb +140 -0
data/lib/devise_otp_authenticatable/routes.rb +30 -0
data/lib/generators/active_record/devise_otp_generator.rb +13 -0
data/lib/generators/active_record/templates/migration.rb +28 -0
data/lib/generators/devise_otp/devise_otp_generator.rb +17 -0
data/lib/generators/devise_otp/install_generator.rb +31 -0
data/lib/generators/devise_otp/views_generator.rb +19 -0
data/test/dummy/README.rdoc +261 -0
data/test/dummy/Rakefile +7 -0
data/test/dummy/app/assets/javascripts/application.js +13 -0
data/test/dummy/app/assets/stylesheets/application.css +13 -0
data/test/dummy/app/controllers/application_controller.rb +4 -0
data/test/dummy/app/controllers/posts_controller.rb +83 -0
data/test/dummy/app/helpers/application_helper.rb +2 -0
data/test/dummy/app/helpers/posts_helper.rb +2 -0
data/test/dummy/app/mailers/.gitkeep +0 -0
data/test/dummy/app/models/post.rb +2 -0
data/test/dummy/app/models/user.rb +20 -0
data/test/dummy/app/views/layouts/application.html.erb +14 -0
data/test/dummy/app/views/posts/_form.html.erb +25 -0
data/test/dummy/app/views/posts/edit.html.erb +6 -0
data/test/dummy/app/views/posts/index.html.erb +25 -0
data/test/dummy/app/views/posts/new.html.erb +5 -0
data/test/dummy/app/views/posts/show.html.erb +15 -0
data/test/dummy/config.ru +4 -0
data/test/dummy/config/application.rb +68 -0
data/test/dummy/config/boot.rb +10 -0
data/test/dummy/config/database.yml +25 -0
data/test/dummy/config/environment.rb +5 -0
data/test/dummy/config/environments/development.rb +37 -0
data/test/dummy/config/environments/production.rb +73 -0
data/test/dummy/config/environments/test.rb +36 -0
data/test/dummy/config/initializers/backtrace_silencers.rb +7 -0
data/test/dummy/config/initializers/devise.rb +253 -0
data/test/dummy/config/initializers/inflections.rb +15 -0
data/test/dummy/config/initializers/mime_types.rb +5 -0
data/test/dummy/config/initializers/secret_token.rb +8 -0
data/test/dummy/config/initializers/session_store.rb +8 -0
data/test/dummy/config/initializers/wrap_parameters.rb +14 -0
data/test/dummy/config/locales/en.yml +5 -0
data/test/dummy/config/routes.rb +6 -0
data/test/dummy/db/migrate/20130125101430_create_users.rb +9 -0
data/test/dummy/db/migrate/20130131092406_add_devise_to_users.rb +53 -0
data/test/dummy/db/migrate/20130131142320_create_posts.rb +10 -0
data/test/dummy/db/migrate/20130131160351_devise_otp_add_to_users.rb +28 -0
data/test/dummy/lib/assets/.gitkeep +0 -0
data/test/dummy/public/404.html +26 -0
data/test/dummy/public/422.html +26 -0
data/test/dummy/public/500.html +25 -0
data/test/dummy/public/favicon.ico +0 -0
data/test/dummy/script/rails +6 -0
data/test/integration/refresh_test.rb +92 -0
data/test/integration/sign_in_test.rb +77 -0
data/test/integration_tests_helper.rb +48 -0
data/test/model_tests_helper.rb +22 -0
data/test/models/otp_authenticatable_test.rb +116 -0
data/test/orm/active_record.rb +4 -0
data/test/test_helper.rb +19 -0
metadata +237 -0

data/test/dummy/db/migrate/20130131160351_devise_otp_add_to_users.rb ADDED

@@ -0,0 +1,28 @@
+class DeviseOtpAddToUsers < ActiveRecord::Migration
+  def self.up
+    change_table :users do |t|
+      t.string    :otp_auth_secret
+      t.string    :otp_recovery_secret
+      t.boolean   :otp_enabled,          :default => false, :null => false
+      t.boolean   :otp_mandatory,        :default => false, :null => false
+      t.datetime  :otp_enabled_on
+      t.integer   :otp_time_drift,       :default => 0, :null => false
+      t.integer   :otp_failed_attempts,  :default => 0, :null => false
+      t.integer   :otp_recovery_counter, :default => 0, :null => false
+      t.string    :otp_persistence_seed
+      t.string    :otp_session_challenge
+      t.datetime  :otp_challenge_expires
+    end
+    add_index :users, :otp_session_challenge,  :unique => true
+    add_index :users, :otp_challenge_expires
+  end
+  def self.down
+    change_table :users do |t|
+      t.remove :otp_auth_secret, :otp_recovery_secret, :otp_enabled, :otp_mandatory, :otp_enabled_on, :otp_session_challenge,
+          :otp_challenge_expires, :otp_time_drift, :otp_failed_attempts, :otp_recovery_counter, :otp_persistence_seed
+    end
+  end
+end

data/test/dummy/lib/assets/.gitkeep ADDED

File without changes

data/test/dummy/public/404.html ADDED

@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>The page you were looking for doesn't exist (404)</title>
+  <style type="text/css">
+    body { background-color: #fff; color: #666; text-align: center; font-family: arial, sans-serif; }
+    div.dialog {
+      width: 25em;
+      padding: 0 4em;
+      margin: 4em auto 0 auto;
+      border: 1px solid #ccc;
+      border-right-color: #999;
+      border-bottom-color: #999;
+    }
+    h1 { font-size: 100%; color: #f00; line-height: 1.5em; }
+  </style>
+</head>
+<body>
+  <!-- This file lives in public/404.html -->
+  <div class="dialog">
+    <h1>The page you were looking for doesn't exist.</h1>
+    <p>You may have mistyped the address or the page may have moved.</p>
+  </div>
+</body>
+</html>

data/test/dummy/public/422.html ADDED

@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>The change you wanted was rejected (422)</title>
+  <style type="text/css">
+    body { background-color: #fff; color: #666; text-align: center; font-family: arial, sans-serif; }
+    div.dialog {
+      width: 25em;
+      padding: 0 4em;
+      margin: 4em auto 0 auto;
+      border: 1px solid #ccc;
+      border-right-color: #999;
+      border-bottom-color: #999;
+    }
+    h1 { font-size: 100%; color: #f00; line-height: 1.5em; }
+  </style>
+</head>
+<body>
+  <!-- This file lives in public/422.html -->
+  <div class="dialog">
+    <h1>The change you wanted was rejected.</h1>
+    <p>Maybe you tried to change something you didn't have access to.</p>
+  </div>
+</body>
+</html>

data/test/dummy/public/500.html ADDED

@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>We're sorry, but something went wrong (500)</title>
+  <style type="text/css">
+    body { background-color: #fff; color: #666; text-align: center; font-family: arial, sans-serif; }
+    div.dialog {
+      width: 25em;
+      padding: 0 4em;
+      margin: 4em auto 0 auto;
+      border: 1px solid #ccc;
+      border-right-color: #999;
+      border-bottom-color: #999;
+    }
+    h1 { font-size: 100%; color: #f00; line-height: 1.5em; }
+  </style>
+</head>
+<body>
+  <!-- This file lives in public/500.html -->
+  <div class="dialog">
+    <h1>We're sorry, but something went wrong.</h1>
+  </div>
+</body>
+</html>

data/test/dummy/public/favicon.ico ADDED

File without changes

data/test/dummy/script/rails ADDED

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+# This command will automatically be run when you run "rails" with Rails 3 gems installed from the root of your application.
+APP_PATH = File.expand_path('../../config/application',  __FILE__)
+require File.expand_path('../../config/boot',  __FILE__)
+require 'rails/commands'

data/test/integration/refresh_test.rb ADDED

@@ -0,0 +1,92 @@
+require 'test_helper'
+require 'integration_tests_helper'
+class RefreshTest < ActionDispatch::IntegrationTest
+  def setup
+    @old_refresh = User.otp_credentials_refresh
+    User.otp_credentials_refresh = 1.second
+  end
+  def teardown
+    User.otp_credentials_refresh = @old_refresh
+    Capybara.reset_sessions!
+  end
+  test 'a user that just signed in should be able to access their OTP settings without refreshing' do
+    sign_user_in
+    visit user_otp_token_path
+    assert_equal user_otp_token_path, current_path
+  end
+  test 'a user should be prompted for credentials when the credentials_refresh time is expired' do
+    sign_user_in
+    visit user_otp_token_path
+    assert_equal user_otp_token_path, current_path
+    sleep(2)
+    visit user_otp_token_path
+    assert_equal refresh_user_otp_credential_path, current_path
+  end
+  test 'a user should be able to access their OTP settings after refreshing' do
+    sign_user_in
+    visit user_otp_token_path
+    assert_equal user_otp_token_path, current_path
+    sleep(2)
+    visit user_otp_token_path
+    assert_equal refresh_user_otp_credential_path, current_path
+    fill_in 'user_refresh_password', :with => '12345678'
+    click_button 'Continue...'
+    assert_equal user_otp_token_path, current_path
+  end
+  test 'a user should NOT be able to access their OTP settings unless refreshing' do
+    sign_user_in
+    visit user_otp_token_path
+    assert_equal user_otp_token_path, current_path
+    sleep(2)
+    visit user_otp_token_path
+    assert_equal refresh_user_otp_credential_path, current_path
+    fill_in 'user_refresh_password', :with => '12345670'
+    click_button 'Continue...'
+    assert_equal refresh_user_otp_credential_path, current_path
+  end
+  test 'user should be asked their OTP challenge in order to refresh, if they have OTP' do
+    enable_otp_and_sign_in_with_otp
+    sleep(2)
+    visit user_otp_token_path
+    assert_equal refresh_user_otp_credential_path, current_path
+    fill_in 'user_refresh_password', :with => '12345678'
+    click_button 'Continue...'
+    assert_equal refresh_user_otp_credential_path, current_path
+  end
+  test 'user should be finally be able to access their settings, if they provide both a password and a valid OTP token' do
+    user = enable_otp_and_sign_in_with_otp
+    sleep(2)
+    visit user_otp_token_path
+    assert_equal refresh_user_otp_credential_path, current_path
+    fill_in 'user_refresh_password', :with => '12345678'
+    fill_in 'user_token', :with => ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
+    click_button 'Continue...'
+    assert_equal user_otp_token_path, current_path
+  end
+end

data/test/integration/sign_in_test.rb ADDED

@@ -0,0 +1,77 @@
+require 'test_helper'
+require 'integration_tests_helper'
+class SignInTest < ActionDispatch::IntegrationTest
+  def teardown
+    Capybara.reset_sessions!
+  end
+  test 'a new user should be able to sign in without using their token' do
+    create_full_user
+    visit new_user_session_path
+    fill_in 'user_email', :with => 'user@email.invalid'
+    fill_in 'user_password', :with => '12345678'
+    click_button 'Sign in'
+    assert_equal root_path, current_path
+  end
+  test 'a new user, just signed in, should be able to sign in and enable their OTP authentication' do
+    user = sign_user_in
+    visit user_otp_token_path
+    assert !page.has_content?('Your token secret')
+    check 'user_otp_enabled'
+    click_button 'Continue...'
+    assert_equal user_otp_token_path, current_path
+    assert page.has_content?('Your token secret')
+    assert !user.otp_auth_secret.nil?
+    assert !user.otp_persistence_seed.nil?
+  end
+  test 'a new user should be able to sign in enable OTP and be prompted for their token' do
+    enable_otp_and_sign_in
+    assert_equal user_otp_credential_path, current_path
+  end
+  test 'fail token authentication' do
+    enable_otp_and_sign_in
+    assert_equal user_otp_credential_path, current_path
+    fill_in 'user_token', :with => '123456'
+    click_button 'Submit Token'
+    assert_equal new_user_session_path, current_path
+  end
+  test 'successful token authentication' do
+    user = enable_otp_and_sign_in
+    fill_in 'user_token', :with => ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
+    click_button 'Submit Token'
+    assert_equal root_path, current_path
+  end
+  test 'should fail if the the challenge times out' do
+    old_timeout = User.otp_authentication_timeout
+    User.otp_authentication_timeout = 1.second
+    user = enable_otp_and_sign_in
+    sleep(2)
+    fill_in 'user_token', :with => ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
+    click_button 'Submit Token'
+    User.otp_authentication_timeout = old_timeout
+    assert_equal new_user_session_path, current_path
+  end
+end

data/test/integration_tests_helper.rb ADDED

@@ -0,0 +1,48 @@
+class ActionDispatch::IntegrationTest
+  def warden
+    request.env['warden']
+  end
+  def create_full_user
+    @user ||= begin
+      user = User.create!(
+        :email                 => 'user@email.invalid',
+        :password              => '12345678',
+        :password_confirmation => '12345678'
+      )
+      user
+    end
+  end
+  def enable_otp_and_sign_in_with_otp
+    enable_otp_and_sign_in.tap do |user|
+      fill_in 'user_token', :with => ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
+      click_button 'Submit Token'
+    end
+  end
+  def enable_otp_and_sign_in
+    user = create_full_user
+    sign_user_in(user)
+    visit user_otp_token_path
+    check 'user_otp_enabled'
+    click_button 'Continue...'
+    Capybara.reset_sessions!
+    sign_user_in(user)
+    user
+  end
+  def sign_user_in(user = nil)
+    user ||= create_full_user
+    resource_name = user.class.name.underscore
+    visit send("new_#{resource_name}_session_path")
+    fill_in "#{resource_name}_email", :with => user.email
+    fill_in "#{resource_name}_password", :with => user.password
+    click_button 'Sign in'
+    user
+  end
+end

data/test/model_tests_helper.rb ADDED

@@ -0,0 +1,22 @@
+class ActiveSupport::TestCase
+  #
+  # Helpers for creating new users
+  #
+  def unique_identity
+    @@unique_identity_count ||= 0
+    @@unique_identity_count += 1
+    "user-#{@@unique_identity_count}@mail.invalid"
+  end
+  def valid_attributes(attributes={})
+    { :email => unique_identity,
+      :password => '12345678',
+      :password_confirmation => '12345678' }.update(attributes)
+  end
+  def new_user(attributes={})
+    User.new(valid_attributes(attributes)).save
+  end
+end

data/test/models/otp_authenticatable_test.rb ADDED

@@ -0,0 +1,116 @@
+require 'test_helper'
+require 'model_tests_helper'
+class OtpAuthenticatableTest < ActiveSupport::TestCase
+	def setup
+		new_user
+  end
+  test 'new users have a non-nil secret set' do
+ 		assert_not_nil User.first.otp_auth_secret
+ 	end
+  test 'new users have OTP disabled by default' do
+ 		assert !User.first.otp_enabled
+ 	end
+  test 'users should have an instance of TOTP/ROTP objects' do
+    u = User.first
+    assert u.time_based_otp.is_a? ROTP::TOTP
+    assert u.recovery_otp.is_a? ROTP::HOTP
+  end
+  test 'users should have their otp_auth_secret/persistence_seed set on creation' do
+    assert User.first.otp_auth_secret
+    assert User.first.otp_persistence_seed
+  end
+  test 'reset_otp_credentials should generate new secrets and disable OTP' do
+    u = User.first
+    u.update_attribute(:otp_enabled, true)
+    assert u.otp_enabled
+    otp_auth_secret = u.otp_auth_secret
+    otp_persistence_seed = u.otp_persistence_seed
+    u.reset_otp_credentials!
+    assert !(otp_auth_secret == u.otp_auth_secret)
+    assert !(otp_persistence_seed == u.otp_persistence_seed)
+    assert !u.otp_enabled
+  end
+  test 'reset_otp_persistence should generate new persistence_seed but NOT change the otp_auth_secret' do
+    u = User.first
+    u.update_attribute(:otp_enabled, true)
+    assert u.otp_enabled
+    otp_auth_secret = u.otp_auth_secret
+    otp_persistence_seed = u.otp_persistence_seed
+    u.reset_otp_persistence!
+    assert (otp_auth_secret == u.otp_auth_secret)
+    assert !(otp_persistence_seed == u.otp_persistence_seed)
+    assert u.otp_enabled
+  end
+  test 'generating a challenge, should retrieve the user later' do
+    u = User.first
+    u.update_attribute(:otp_enabled, true)
+    challenge = u.generate_otp_challenge!
+    w = User.find_valid_otp_challenge(challenge)
+    assert w.is_a? User
+    assert_equal w,u
+  end
+  test 'expiring the challenge, should retrieve nothing' do
+    u = User.first
+    u.update_attribute(:otp_enabled, true)
+    challenge = u.generate_otp_challenge!(1.second)
+    sleep(2)
+    w = User.find_valid_otp_challenge(challenge)
+    assert_nil w
+  end
+  test 'expired challenges should not be valid' do
+    u = User.first
+    u.update_attribute(:otp_enabled, true)
+    challenge = u.generate_otp_challenge!(1.second)
+    sleep(2)
+    assert_equal false, u.otp_challenge_valid?
+  end
+  test 'generated otp token should be valid for the user' do
+    u = User.first
+    u.update_attribute(:otp_enabled, true)
+    secret = u.otp_auth_secret
+    token = ROTP::TOTP.new(secret).now
+    assert_equal true, u.validate_otp_token(token)
+  end
+  test 'generated otp token, out of drift window, should be NOT valid for the user' do
+    u = User.first
+    u.update_attribute(:otp_enabled, true)
+    secret = u.otp_auth_secret
+    [3.minutes.from_now, 3.minutes.ago].each do |time|
+      token = ROTP::TOTP.new(secret).at(time)
+      assert_equal false, u.valid_otp_token?(token)
+    end
+  end
+  test 'recovery secrets should be valid, and valid only once' do
+    u = User.first
+    u.update_attribute(:otp_enabled, true)
+    recovery = u.next_otp_recovery_tokens
+    assert u.valid_otp_recovery_token? recovery.fetch(0)
+    assert_equal false, u.valid_otp_recovery_token?(recovery.fetch(0))
+    assert u.valid_otp_recovery_token? recovery.fetch(2)
+  end
+end