devise-otp 0.5.0 → 0.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (52) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/ci.yml +0 -2
  3. data/.gitignore +3 -1
  4. data/CHANGELOG.md +51 -8
  5. data/README.md +12 -2
  6. data/app/controllers/devise_otp/devise/otp_credentials_controller.rb +46 -29
  7. data/app/controllers/devise_otp/devise/otp_tokens_controller.rb +24 -6
  8. data/app/views/devise/otp_credentials/show.html.erb +6 -6
  9. data/app/views/devise/otp_tokens/_token_secret.html.erb +3 -4
  10. data/app/views/devise/otp_tokens/edit.html.erb +26 -0
  11. data/app/views/devise/otp_tokens/show.html.erb +7 -14
  12. data/config/locales/en.yml +23 -14
  13. data/devise-otp.gemspec +2 -3
  14. data/lib/devise/strategies/database_authenticatable.rb +64 -0
  15. data/lib/devise-otp/version.rb +1 -1
  16. data/lib/devise-otp.rb +31 -11
  17. data/lib/devise_otp_authenticatable/controllers/helpers.rb +9 -10
  18. data/lib/devise_otp_authenticatable/controllers/public_helpers.rb +39 -0
  19. data/lib/devise_otp_authenticatable/controllers/url_helpers.rb +10 -0
  20. data/lib/devise_otp_authenticatable/engine.rb +2 -5
  21. data/lib/devise_otp_authenticatable/hooks/refreshable.rb +5 -0
  22. data/lib/devise_otp_authenticatable/models/otp_authenticatable.rb +22 -20
  23. data/lib/devise_otp_authenticatable/routes.rb +3 -1
  24. data/test/dummy/app/controllers/admin_posts_controller.rb +85 -0
  25. data/test/dummy/app/controllers/application_controller.rb +0 -1
  26. data/test/dummy/app/controllers/base_controller.rb +6 -0
  27. data/test/dummy/app/models/admin.rb +25 -0
  28. data/test/dummy/app/views/admin_posts/_form.html.erb +25 -0
  29. data/test/dummy/app/views/admin_posts/edit.html.erb +6 -0
  30. data/test/dummy/app/views/admin_posts/index.html.erb +25 -0
  31. data/test/dummy/app/views/admin_posts/new.html.erb +5 -0
  32. data/test/dummy/app/views/admin_posts/show.html.erb +15 -0
  33. data/test/dummy/app/views/base/home.html.erb +1 -0
  34. data/test/dummy/config/application.rb +0 -2
  35. data/test/dummy/config/routes.rb +4 -1
  36. data/test/dummy/db/migrate/20240604000001_create_admins.rb +9 -0
  37. data/test/dummy/db/migrate/20240604000002_add_devise_to_admins.rb +52 -0
  38. data/test/dummy/db/migrate/20240604000003_devise_otp_add_to_admins.rb +28 -0
  39. data/test/integration/disable_token_test.rb +53 -0
  40. data/test/integration/enable_otp_form_test.rb +57 -0
  41. data/test/integration/persistence_test.rb +3 -6
  42. data/test/integration/refresh_test.rb +32 -0
  43. data/test/integration/reset_token_test.rb +45 -0
  44. data/test/integration/sign_in_test.rb +10 -14
  45. data/test/integration/trackable_test.rb +50 -0
  46. data/test/integration_tests_helper.rb +24 -6
  47. data/test/models/otp_authenticatable_test.rb +62 -27
  48. data/test/test_helper.rb +1 -71
  49. metadata +28 -25
  50. data/lib/devise_otp_authenticatable/hooks/sessions.rb +0 -57
  51. data/lib/devise_otp_authenticatable/hooks.rb +0 -11
  52. data/test/integration/token_test.rb +0 -30
data/lib/devise_otp_authenticatable/hooks/sessions.rb DELETED
@@ -1,57 +0,0 @@
1
- module DeviseOtpAuthenticatable::Hooks
2
- module Sessions
3
- extend ActiveSupport::Concern
4
- include DeviseOtpAuthenticatable::Controllers::UrlHelpers
5
-
6
- included do
7
- alias_method :create, :create_with_otp
8
- end
9
-
10
- #
11
- # replaces Devise::SessionsController#create
12
- #
13
- def create_with_otp
14
- resource = warden.authenticate!(auth_options)
15
-
16
- devise_stored_location = stored_location_for(resource) # Grab the current stored location before it gets lost by warden.logout
17
- store_location_for(resource, devise_stored_location) # Restore it since #stored_location_for removes it
18
-
19
- otp_refresh_credentials_for(resource)
20
-
21
- if otp_challenge_required_on?(resource)
22
- challenge = resource.generate_otp_challenge!
23
- warden.logout
24
- store_location_for(resource, devise_stored_location) # restore the stored location
25
- respond_with resource, location: otp_credential_path_for(resource, {challenge: challenge})
26
- elsif otp_mandatory_on?(resource) # if mandatory, log in user but send him to the must activate otp
27
- set_flash_message(:notice, :signed_in_but_otp) if is_navigational_format?
28
- sign_in(resource_name, resource)
29
- respond_with resource, location: otp_token_path_for(resource)
30
- else
31
- sign_in(resource_name, resource)
32
- respond_with resource, location: after_sign_in_path_for(resource)
33
- end
34
- end
35
-
36
- private
37
-
38
- #
39
- # resource should be challenged for otp
40
- #
41
- def otp_challenge_required_on?(resource)
42
- return false unless resource.respond_to?(:otp_enabled) && resource.respond_to?(:otp_auth_secret)
43
-
44
- resource.otp_enabled && !is_otp_trusted_browser_for?(resource)
45
- end
46
-
47
- #
48
- # the resource -should- have otp turned on, but it isn't
49
- #
50
- def otp_mandatory_on?(resource)
51
- return true if resource.class.otp_mandatory
52
- return false unless resource.respond_to?(:otp_mandatory)
53
-
54
- resource.otp_mandatory && !resource.otp_enabled
55
- end
56
- end
57
- end
data/lib/devise_otp_authenticatable/hooks.rb DELETED
@@ -1,11 +0,0 @@
1
- module DeviseOtpAuthenticatable
2
- module Hooks
3
- autoload :Sessions, "devise_otp_authenticatable/hooks/sessions.rb"
4
-
5
- class << self
6
- def apply
7
- ::Devise::SessionsController.send(:include, Hooks::Sessions)
8
- end
9
- end
10
- end
11
- end
data/test/integration/token_test.rb DELETED
@@ -1,30 +0,0 @@
1
- require "test_helper"
2
- require "integration_tests_helper"
3
-
4
- class TokenTest < ActionDispatch::IntegrationTest
5
- def teardown
6
- Capybara.reset_sessions!
7
- end
8
-
9
- test "disabling OTP after successfully enabling" do
10
- # log in 1fa
11
- user = enable_otp_and_sign_in
12
- assert_equal user_otp_credential_path, current_path
13
-
14
- # otp 2fa
15
- fill_in "user_token", with: ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
16
- click_button "Submit Token"
17
- assert_equal root_path, current_path
18
-
19
- # disable OTP
20
- disable_otp
21
-
22
- # logout
23
- sign_out
24
-
25
- # log back in 1fa
26
- sign_user_in(user)
27
-
28
- assert_equal root_path, current_path
29
- end
30
- end