devise-otp 1.1.0 → 2.1.0

data/app/views/devise/otp_tokens/recovery.html.erb

@@ -1,13 +1,13 @@
-<h2><%= I18n.t('title', :scope => 'devise.otp.otp_tokens.recovery') %></h2>
-<p><%= I18n.t('explain', :scope => 'devise.otp.otp_tokens.recovery') %></p>
+<h2><%= t('title', scope: 'devise.otp.otp_tokens.recovery') %></h2>
+<p><%= t('explain', scope: 'devise.otp.otp_tokens.recovery') %></p>
 
 <table>
   <caption>
     <thead>
-        <tr>
-          <th><%= I18n.t('sequence', :scope => 'devise.otp.otp_tokens.recovery') %></th>
-          <th><%= I18n.t('code', :scope => 'devise.otp.otp_tokens.recovery') %></th>
-        </tr>
+      <tr>
+        <th><%= t('sequence', scope: 'devise.otp.otp_tokens.recovery') %></th>
+        <th><%= t('code', scope: 'devise.otp.otp_tokens.recovery') %></th>
+      </tr>
     </thead>
     <tbody>
       <%- resource.next_otp_recovery_tokens.each do |seq, code| %>
@@ -19,3 +19,5 @@
     </tbody>
   </caption>
 </table>
+
+<%= link_to "Back", otp_token_path_for(resource) %>

data/app/views/devise/otp_tokens/show.html.erb

@@ -1,14 +1,14 @@
-<h2><%= I18n.t('title', :scope => 'devise.otp.otp_tokens') %></h2>
+<h2><%= t('title', scope: 'devise.otp.otp_tokens') %></h2>
 
-<p><strong>Status:</strong> <%= resource.otp_enabled? ? "Enabled" : "Disabled" %></p>
+<p><strong>Status:</strong> <%= t(resource.otp_enabled? ? :enabled : :disabled, scope: 'devise.otp.general') %></p>
 
 <%- if resource.otp_enabled? %>
-  <%= render :partial => 'token_secret' if resource.otp_enabled? %>
-  <%= render :partial => 'trusted_devices' if trusted_devices_enabled? %>
+  <%= render partial: 'token_secret' if resource.otp_enabled? %>
+  <%= render partial: 'trusted_devices' if trusted_devices_enabled? %>
 
   <% unless otp_mandatory_on?(resource) %>
-    <%= button_to I18n.t('disable_link', :scope => 'devise.otp.otp_tokens'), otp_token_path_for(resource), :method => :delete, :data => { "turbo-method": "DELETE" } %>
+    <%= button_to t('disable_link', scope: 'devise.otp.otp_tokens'), otp_token_path_for(resource), method: :delete, data: { turbo_method: :delete } %>
   <% end %>
 <% else %>
-  <%= link_to I18n.t('enable_link', :scope => 'devise.otp.otp_tokens'), edit_otp_token_path_for(resource) %>
+  <%= link_to t('enable_link', scope: 'devise.otp.otp_tokens'), edit_otp_token_path_for(resource) %>
 <% end %>

data/bin/appraisal

@@ -0,0 +1,16 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+#
+# This file was generated by Bundler.
+#
+# The application 'appraisal' is installed as part of a gem, and
+# this file is here to facilitate running it.
+#
+
+ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../Gemfile", __dir__)
+
+require "rubygems"
+require "bundler/setup"
+
+load Gem.bin_path("appraisal", "appraisal")

data/bin/erb_lint

@@ -0,0 +1,16 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+#
+# This file was generated by Bundler.
+#
+# The application 'erb_lint' is installed as part of a gem, and
+# this file is here to facilitate running it.
+#
+
+ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../Gemfile", __dir__)
+
+require "rubygems"
+require "bundler/setup"
+
+load Gem.bin_path("erb_lint", "erb_lint")

data/bin/rake

@@ -0,0 +1,16 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+#
+# This file was generated by Bundler.
+#
+# The application 'rake' is installed as part of a gem, and
+# this file is here to facilitate running it.
+#
+
+ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../Gemfile", __dir__)
+
+require "rubygems"
+require "bundler/setup"
+
+load Gem.bin_path("rake", "rake")

data/bin/rubocop

@@ -0,0 +1,16 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+#
+# This file was generated by Bundler.
+#
+# The application 'rubocop' is installed as part of a gem, and
+# this file is here to facilitate running it.
+#
+
+ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../Gemfile", __dir__)
+
+require "rubygems"
+require "bundler/setup"
+
+load Gem.bin_path("rubocop", "rubocop")

data/config/locales/{en.yml → devise-otp.en.yml}

@@ -2,7 +2,8 @@ en:
   devise:
     otp:
       general:
-        remember: Remember me
+        enabled: 'Enabled'
+        disabled: 'Disabled'
       submit_token:
         title: 'Check Token'
         explain: "You're getting this because you enabled Two-Factor Authentication on your account"
@@ -18,7 +19,7 @@ en:
         invalid_refresh: 'Sorry, you provided the wrong credentials.'
       credentials_refresh:
         title: 'Please enter your password again.'
-        explain: 'In order to ensure this is  safe, please enter your password again.'
+        explain: 'In order to ensure this is safe, please enter your password again.'
         go_on: 'Continue...'
         identity: 'Identity:'
         token: 'Your Two-Factor Authentication token'
@@ -31,22 +32,23 @@ en:
         enable_link: 'Enable Two-Factor Authentication'
         disable_link: 'Disable Two-Factor Authentication'
         reset_link: 'Reset Token Secret'
-        reset_explain: 'Resetting your token secret will temporarilly disable Two-Factor Authentication.'
+        reset_explain: 'Resetting your token secret will temporarily disable Two-Factor Authentication.'
         reset_explain_warn: 'To re-enable Two-Factor Authentication, you will need to re-enroll your mobile device with the new token secret.'
         successfully_updated: 'Your Two-Factor Authentication settings have been updated.'
         could_not_confirm: 'The Confirmation Code you entered did not match the QR code shown below.'
         successfully_disabled_otp: 'Two-Factor Authentication has been disabled.'
         successfully_reset_otp: 'Your token secret has been reset. Please confirm your new token secret below.'
-        successfully_set_persistence: 'Your device is now trusted.'
-        successfully_cleared_persistence: 'Your device has been removed from the list of trusted devices.'
-        successfully_reset_persistence: 'Your list of trusted devices has been cleared.'
         recovery:
           title: 'Your Emergency Recovery Codes'
-          explain: 'Take note or print these recovery codes. The will allow you to log back in in case your token device is lost, stolen, or unavailable.'
+          explain: 'Take note or print these recovery codes. They will allow you to log in if your token device is lost, stolen, or unavailable.'
           sequence: 'Sequence'
           code: 'Recovery Code'
-          codes_list: 'Here is the list of your recovery codes'
+          codes_list: 'View recovery codes'
           download_codes: 'Download recovery codes'
+      otp_persistence:
+        successfully_set_persistence: 'Your device is now trusted.'
+        successfully_cleared_persistence: 'Your device has been removed from the list of trusted devices.'
+        successfully_reset_persistence: 'Your list of trusted devices has been cleared.'
       edit_otp_token:
         title: 'Enable Two-factor Authentication'
         explain: 'Two-Factor Authentication adds an additional layer of security to your account. When logging in you will be asked for a code that you can generate on a physical device, like your phone.'

data/devise-otp.gemspec

@@ -18,7 +18,7 @@ Gem::Specification.new do |gem|
   gem.required_ruby_version = ">= 3.2.0"
 
   gem.add_dependency "rails", ">= 7.1"
-  gem.add_dependency "devise", ">= 4.8.0", "< 5.0"
+  gem.add_dependency "devise", ">= 4.8.0", "< 6.0"
   gem.add_dependency "rotp", ">= 2.0.0"
-  gem.add_dependency "rqrcode", "~> 2.0"
+  gem.add_dependency "rqrcode", "~> 3.0"
 end

data/gemfiles/rails_8.0.gemfile

@@ -11,7 +11,11 @@ gem "rdoc"
 gem "shoulda"
 gem "sprockets-rails"
 gem "sqlite3", "~> 2.1"
-gem "standardrb"
+gem "timecop", "~> 0.9.10"
+gem "standardrb", require: false
+gem "rubocop-rails-omakase", require: false
+gem "erb_lint", require: false
+gem "debug"
 gem "rails", "~> 8.0.0"
 
 gemspec path: "../"

data/gemfiles/{rails_7.1.gemfile → rails_8.1.gemfile}

@@ -10,12 +10,12 @@ gem "rake"
 gem "rdoc"
 gem "shoulda"
 gem "sprockets-rails"
-gem "sqlite3", "~> 1.5.0"
-gem "standardrb"
-gem "rails", "~> 7.1.0"
-
-install_if -> { Gem::Version.new(RUBY_VERSION) >= Gem::Version.new("3.4.0") } do
-  gem "logger"
-end
+gem "sqlite3", "~> 2.1"
+gem "timecop", "~> 0.9.10"
+gem "standardrb", require: false
+gem "rubocop-rails-omakase", require: false
+gem "erb_lint", require: false
+gem "debug"
+gem "rails", "~> 8.1.0"
 
 gemspec path: "../"

data/lib/devise/strategies/database_authenticatable.rb

@@ -10,11 +10,11 @@ module Devise
         resource  = password.present? && mapping.to.find_for_database_authentication(authentication_hash)
         hashed = false
 
-        if validate(resource){ hashed = true; resource.valid_password?(password) }
+        if validate(resource) { hashed = true; resource.valid_password?(password) }
           if otp_challenge_required_on?(resource)
             # Redirect to challenge
             challenge = resource.generate_otp_challenge!
-            redirect!(otp_challenge_url, {:challenge => challenge})
+            redirect!(otp_challenge_path, {challenge: challenge, remember_me: remember_me?})
           else
             # Sign in user as usual
             remember_me(resource)
@@ -41,21 +41,8 @@ module Devise
         resource.respond_to?(:otp_enabled?) && resource.otp_enabled?
       end
 
-      def otp_challenge_url
-        if Rails.env.development? || Rails.env.test?
-          host = "#{request.host}:#{request.port}"
-        else
-          host = "#{request.host}"
-        end
-
-        path_fragments = ["otp", mapping.path_names[:credentials]]
-        if mapping.fullpath == "/"
-          path = mapping.fullpath + path_fragments.join("/")
-        else
-          path = path_fragments.prepend(mapping.fullpath).join("/")
-        end
-
-        request.protocol + host + path
+      def otp_challenge_path
+        Rails.application.routes.url_helpers.public_send("#{mapping.singular}_otp_credential_path")
       end
     end
   end

data/lib/devise-otp/version.rb

@@ -1,5 +1,5 @@
 module Devise
   module OTP
-    VERSION = "1.1.0"
+    VERSION = "2.1.0"
   end
 end

data/lib/devise-otp.rb

@@ -45,7 +45,7 @@ module Devise
   @@otp_trust_persistence = 30.days
 
   mattr_accessor :otp_drift_window
-  @@otp_drift_window = 3 # in minutes
+  @@otp_drift_window = 3
 
   #
   # if the user wants to change Otp settings,
@@ -75,7 +75,6 @@ module Devise
 
   module Otp
   end
-
 end
 
 Devise.add_module :otp_authenticatable,

data/lib/devise_otp_authenticatable/controllers/helpers.rb

@@ -122,10 +122,9 @@ module DeviseOtpAuthenticatable
       #
       def otp_authenticator_token_image(resource)
         content_tag(:div, class: "qrcode-container") do
-          raw RQRCode::QRCode.new(resource.otp_provisioning_uri).as_svg(:module_size => 5, :viewbox => true, :use_path => true)
+          raw RQRCode::QRCode.new(resource.otp_provisioning_uri).as_svg(module_size: 5, viewbox: true, use_path: true)
         end
       end
-
     end
   end
 end

data/lib/devise_otp_authenticatable/controllers/public_helpers.rb

@@ -9,7 +9,7 @@ module DeviseOtpAuthenticatable
         end
       end
 
-      def self.define_helpers(mapping) #:nodoc:
+      def self.define_helpers(mapping) # :nodoc:
         mapping = mapping.name
 
         class_eval <<-METHODS, __FILE__, __LINE__ + 1
@@ -33,7 +33,6 @@ module DeviseOtpAuthenticatable
       def mandatory_otp_missing_on?(resource)
         otp_mandatory_on?(resource) && !resource.otp_enabled
       end
-
     end
   end
 end

data/lib/devise_otp_authenticatable/controllers/url_helpers.rb

@@ -11,9 +11,14 @@ module DeviseOtpAuthenticatable
         send("refresh_#{scope}_otp_credential_path", opts)
       end
 
-      def persistence_otp_token_path_for(resource_or_scope, opts = {})
+      def otp_persistence_path_for(resource_or_scope, opts = {})
         scope = ::Devise::Mapping.find_scope!(resource_or_scope)
-        send("persistence_#{scope}_otp_token_path", opts)
+        send("#{scope}_otp_persistence_path", opts)
+      end
+
+      def reset_otp_persistence_path_for(resource_or_scope, opts = {})
+        scope = ::Devise::Mapping.find_scope!(resource_or_scope)
+        send("reset_#{scope}_otp_persistence_path", opts)
       end
 
       def otp_token_path_for(resource_or_scope, opts = {})

data/lib/devise_otp_authenticatable/hooks/refreshable.rb

@@ -4,4 +4,3 @@ Warden::Manager.after_set_user except: :fetch do |record, warden, options|
     warden.session(options[:scope])["credentials_refreshed_at"] = (Time.now + record.class.otp_credentials_refresh)
   end
 end
-

data/lib/devise_otp_authenticatable/models/otp_authenticatable.rb

@@ -19,7 +19,11 @@ module Devise::Models
     end
 
     def time_based_otp
-      @time_based_otp ||= ROTP::TOTP.new(otp_auth_secret, issuer: (self.class.otp_issuer || Rails.application.class.module_parent_name).to_s)
+      @time_based_otp ||= ROTP::TOTP.new(otp_auth_secret, issuer: otp_issuer)
+    end
+
+    def otp_issuer
+      (self.class.otp_issuer || Rails.application.class.module_parent_name).to_s
     end
 
     def recovery_otp
@@ -56,13 +60,13 @@ module Devise::Models
       @recovery_otp = nil
 
       self.update!(
-        :otp_auth_secret => nil,
-        :otp_recovery_secret => nil,
-        :otp_persistence_seed => nil,
-        :otp_session_challenge => nil,
-        :otp_challenge_expires => nil,
-        :otp_failed_attempts => 0,
-        :otp_recovery_counter => 0
+        otp_auth_secret: nil,
+        otp_recovery_secret: nil,
+        otp_persistence_seed: nil,
+        otp_session_challenge: nil,
+        otp_challenge_expires: nil,
+        otp_failed_attempts: 0,
+        otp_recovery_counter: 0
       )
     end
 
@@ -116,10 +120,12 @@ module Devise::Models
     private
 
     def validate_otp_token_with_drift(token)
-      # should be centered around saved drift
-      (-self.class.otp_drift_window..self.class.otp_drift_window).any? { |drift|
-        time_based_otp.verify(token, at: Time.now.ago(30 * drift))
-      }
+      verified_token_time = time_based_otp.verify(token,
+        drift_behind: self.class.otp_drift_window * 30,
+        drift_ahead: self.class.otp_drift_window * 30,
+      )
+
+      verified_token_time.present?
     end
 
     def generate_otp_persistence_seed

data/lib/devise_otp_authenticatable/routes.rb

@@ -6,22 +6,22 @@ module ActionDispatch::Routing
       namespace :otp, module: :devise_otp do
         resource :token, only: [:show, :edit, :update, :destroy],
           path: mapping.path_names[:token], controller: controllers[:otp_tokens] do
-          if Devise.otp_trust_persistence
-            get :persistence, action: "get_persistence"
-            post :persistence, action: "clear_persistence"
-            delete :persistence, action: "delete_persistence"
-          end
-
           get :recovery
           post :reset
         end
 
+        if Devise.otp_trust_persistence
+          resource :persistence, only: [:show, :create, :destroy],
+            path: mapping.path_names[:persistence], controller: controllers[:otp_persistence] do
+            delete :reset
+          end
+        end
+
         resource :credential, only: [:show, :update],
           path: mapping.path_names[:credentials], controller: controllers[:otp_credentials] do
           get :refresh, action: "get_refresh"
           put :refresh, action: "set_refresh"
         end
-
       end
     end
   end

data/test/dummy/app/assets/stylesheets/application.css

@@ -8,7 +8,21 @@
  * You're free to add application-wide styles to this file and they'll appear at the top of the
  * compiled file, but it's generally better to create a new file per style scope.
  *
- *= require devise-otp
  *= require_self
  *= require_tree .
  */
+
+@import url("devise-otp.css");
+
+nav {
+  ul {
+    float: right;
+    margin: 0;
+    display: flex;
+  }
+  li {
+    list-style: none;
+    padding: 0.25rem 0.5rem;;
+    margin: 0;
+  }
+}

data/test/dummy/app/controllers/admin_posts_controller.rb

@@ -9,5 +9,4 @@ class AdminPostsController < ApplicationController
       format.json { render json: @posts }
     end
   end
-
 end

data/test/dummy/app/controllers/base_controller.rb

@@ -1,6 +1,4 @@
 class BaseController < ApplicationController
-
   def home
   end
-
 end

data/test/dummy/app/controllers/non_otp_posts_controller.rb

@@ -9,5 +9,4 @@ class NonOtpPostsController < ApplicationController
       format.json { render json: @posts }
     end
   end
-
 end

data/test/dummy/app/models/admin.rb

@@ -9,5 +9,4 @@ class Admin < ActiveRecord::Base
   def self.otp_mandatory
     true
   end
-
 end

data/test/dummy/app/models/lockable_user.rb

@@ -0,0 +1,8 @@
+class LockableUser < ActiveRecord::Base
+  devise :otp_authenticatable, :database_authenticatable, :registerable,
+    :trackable, :validatable, :lockable
+
+  # Setup accessible (or protected) attributes for your model
+  # attr_accessible :otp_enabled, :otp_mandatory, :as => :otp_privileged
+  # attr_accessible :email, :password, :password_confirmation, :remember_me
+end

data/test/dummy/app/models/non_otp_user.rb

@@ -1,4 +1,3 @@
 class NonOtpUser < ActiveRecord::Base
   devise :database_authenticatable, :registerable, :trackable, :validatable
-
 end

data/test/dummy/app/models/rememberable_user.rb

@@ -0,0 +1,8 @@
+class RememberableUser < ActiveRecord::Base
+  devise :otp_authenticatable, :database_authenticatable, :registerable,
+    :trackable, :validatable, :rememberable
+
+  # Setup accessible (or protected) attributes for your model
+  # attr_accessible :otp_enabled, :otp_mandatory, :as => :otp_privileged
+  # attr_accessible :email, :password, :password_confirmation, :remember_me
+end

data/test/dummy/app/views/layouts/application.html.erb

@@ -2,15 +2,17 @@
 <html>
 <head>
   <title>Dummy</title>
-  <%= stylesheet_link_tag    "application", :media => "all" %>
+  <%= stylesheet_link_tag "application", media: "all" %>
   <%= javascript_include_tag "application" %>
   <%= csrf_meta_tags %>
 </head>
 <body>
 
+  <%= render "shared/navbar" %>
+
   <div id="alerts">
     <% flash.keys.each do |key| %>
-      <%= content_tag :p, flash[key], :id => key %>
+      <%= content_tag :p, flash[key], id: key %>
     <% end %>
   </div>
 

data/test/dummy/app/views/posts/show.html.erb

@@ -10,6 +10,5 @@
   <%= @post.body %>
 </p>
 
-
 <%= link_to 'Edit', edit_post_path(@post) %> |
 <%= link_to 'Back', posts_path %>

data/test/dummy/app/views/shared/_navbar.html.erb

@@ -0,0 +1,23 @@
+<nav>
+  <ul style="float: right;">
+    <li><%= link_to "Home", root_path %></li>
+    <% if current_user.present? %>
+      <li><%= link_to "Posts", posts_path %></li>
+      <li><%= link_to "OTP Token", user_otp_token_path %></li>
+      <li><%= button_to "Sign Out", destroy_user_session_path, method: :delete, data: { turbo_method: :delete } %></li>
+    <% elsif current_admin.present? %>
+      <li><%= link_to "Posts", admin_posts_path %></li>
+      <li><%= link_to "OTP Token", admin_otp_token_path %></li>
+      <li><%= button_to "Sign Out", destroy_admin_session_path, method: :delete, data: { turbo_method: :delete } %></li>
+    <% elsif current_lockable_user.present? %>
+      <li><%= link_to "OTP Token", lockable_user_otp_token_path %></li>
+      <li><%= button_to "Sign Out", destroy_lockable_user_session_path, method: :delete, data: { turbo_method: :delete } %></li>
+    <% elsif current_non_otp_user.present? %>
+      <li><%= link_to "Posts", admin_posts_path %></li>
+      <li><%= button_to "Sign Out", destroy_non_otp_user_session_path, method: :delete, data: { turbo_method: :delete } %></li>
+    <% elsif current_rememberable_user.present? %>
+      <li><%= link_to "OTP Token", rememberable_user_otp_token_path %></li>
+      <li><%= button_to "Sign Out", destroy_rememberable_user_session_path, method: :delete, data: { turbo_method: :delete } %></li>
+    <% end %>
+  </ul >
+</nav>

data/test/dummy/config/application.rb

@@ -56,5 +56,8 @@ module Dummy
 
     # Version of your assets, change this if you want to expire all your assets
     config.assets.version = "1.0"
+
+    # Default URL for Devise
+    config.action_mailer.default_url_options = { host: 'localhost', port: 3000 }
   end
 end

data/test/dummy/config/initializers/devise.rb

@@ -143,7 +143,7 @@ Devise.setup do |config|
   # Defines which strategy will be used to lock an account.
   # :failed_attempts = Locks an account after a number of failed attempts to sign in.
   # :none            = No lock strategy. You should handle locking by yourself.
-  # config.lock_strategy = :failed_attempts
+  config.lock_strategy = :failed_attempts
 
   # Defines which key will be used when locking and unlocking an account
   # config.unlock_keys = [ :email ]
@@ -157,7 +157,7 @@ Devise.setup do |config|
 
   # Number of authentication tries before locking an account if lock_strategy
   # is failed attempts.
-  # config.maximum_attempts = 20
+  config.maximum_attempts = 5
 
   # Time interval to unlock the account if :time is enabled as unlock_strategy.
   # config.unlock_in = 1.hour

data/test/dummy/config/routes.rb

@@ -1,7 +1,10 @@
 Dummy::Application.routes.draw do
   devise_for :admins
   devise_for :users
+
+  devise_for :lockable_users
   devise_for :non_otp_users
+  devise_for :rememberable_users
 
   resources :posts
   resources :admin_posts

data/test/dummy/db/migrate/20250731000001_create_lockable_users.rb

@@ -0,0 +1,9 @@
+class CreateLockableUsers < ActiveRecord::Migration[5.0]
+  def change
+    create_table :lockable_users do |t|
+      t.string :name
+
+      t.timestamps
+    end
+  end
+end