devise-otp 1.1.0 → 2.1.0

data/test/dummy/db/migrate/20250731000002_add_devise_to_lockable_users.rb

@@ -0,0 +1,52 @@
+class AddDeviseToLockableUsers < ActiveRecord::Migration[5.0]
+  def self.up
+    change_table(:lockable_users) do |t|
+      ## Database authenticatable
+      t.string :email, null: false, default: ""
+      t.string :encrypted_password, null: false, default: ""
+
+      ## Recoverable
+      t.string :reset_password_token
+      t.datetime :reset_password_sent_at
+
+      ## Rememberable
+      t.datetime :remember_created_at
+
+      ## Trackable
+      t.integer :sign_in_count, default: 0
+      t.datetime :current_sign_in_at
+      t.datetime :last_sign_in_at
+      t.string :current_sign_in_ip
+      t.string :last_sign_in_ip
+
+      ## Confirmable
+      # t.string   :confirmation_token
+      # t.datetime :confirmed_at
+      # t.datetime :confirmation_sent_at
+      # t.string   :unconfirmed_email # Only if using reconfirmable
+
+      ## Lockable
+      t.integer :failed_attempts, default: 0 # Only if lock strategy is :failed_attempts
+      t.string :unlock_token # Only if unlock strategy is :email or :both
+      t.datetime :locked_at
+
+      ## Token authenticatable
+      t.string :authentication_token
+
+      # Uncomment below if timestamps were not included in your original model.
+      # t.timestamps
+    end
+
+    add_index :lockable_users, :email, unique: true
+    add_index :lockable_users, :reset_password_token, unique: true
+    # add_index :lockable_users, :confirmation_token,   :unique => true
+    add_index :lockable_users, :unlock_token, unique: true
+    add_index :lockable_users, :authentication_token, unique: true
+  end
+
+  def self.down
+    # By default, we don't want to make any assumption about how to roll back a migration when your
+    # model already existed. Please edit below which fields you would like to remove in this migration.
+    raise ActiveRecord::IrreversibleMigration
+  end
+end

data/test/dummy/db/migrate/20250731000003_devise_otp_add_to_lockable_users.rb

@@ -0,0 +1,28 @@
+class DeviseOtpAddToLockableUsers < ActiveRecord::Migration[5.0]
+  def self.up
+    change_table :lockable_users do |t|
+      t.string :otp_auth_secret
+      t.string :otp_recovery_secret
+      t.boolean :otp_enabled, default: false, null: false
+      t.boolean :otp_mandatory, default: false, null: false
+      t.datetime :otp_enabled_on
+      t.integer :otp_time_drift, default: 0, null: false
+      t.integer :otp_failed_attempts, default: 0, null: false
+      t.integer :otp_recovery_counter, default: 0, null: false
+      t.string :otp_persistence_seed
+
+      t.string :otp_session_challenge
+      t.datetime :otp_challenge_expires
+    end
+
+    add_index :lockable_users, :otp_session_challenge, unique: true
+    add_index :lockable_users, :otp_challenge_expires
+  end
+
+  def self.down
+    change_table :lockable_users do |t|
+      t.remove :otp_auth_secret, :otp_recovery_secret, :otp_enabled, :otp_mandatory, :otp_enabled_on, :otp_session_challenge,
+        :otp_challenge_expires, :otp_time_drift, :otp_failed_attempts, :otp_recovery_counter, :otp_persistence_seed
+    end
+  end
+end

data/test/dummy/db/migrate/20250817221304_create_rememberable_users.rb

@@ -0,0 +1,50 @@
+class CreateRememberableUsers < ActiveRecord::Migration[7.0]
+  def change
+    create_table :rememberable_users do |t|
+      t.string :name
+
+      ## Database authenticatable
+      t.string :email, null: false, default: ""
+      t.string :encrypted_password, null: false, default: ""
+
+      ## Recoverable
+      t.string :reset_password_token
+      t.datetime :reset_password_sent_at
+
+      ## Rememberable
+      t.datetime :remember_created_at
+
+      ## Trackable
+      t.integer :sign_in_count, default: 0
+      t.datetime :current_sign_in_at
+      t.datetime :last_sign_in_at
+      t.string :current_sign_in_ip
+      t.string :last_sign_in_ip
+
+      ## Confirmable
+      # t.string   :confirmation_token
+      # t.datetime :confirmed_at
+      # t.datetime :confirmation_sent_at
+      # t.string   :unconfirmed_email # Only if using reconfirmable
+
+      ## Lockable
+      # t.integer :failed_attempts, default: 0 # Only if lock strategy is :failed_attempts
+      # t.string :unlock_token # Only if unlock strategy is :email or :both
+      # t.datetime :locked_at
+
+      ## Token authenticatable
+      # t.string :authentication_token
+
+      # Uncomment below if timestamps were not included in your original model.
+      # t.timestamps
+    end
+
+    add_index :rememberable_users, :email, unique: true
+    add_index :rememberable_users, :reset_password_token, unique: true
+    # add_index :rememberable_users, :confirmation_token,   :unique => true
+    # add_index :rememberable_users, :unlock_token, unique: true
+    # add_index :rememberable_users, :authentication_token, unique: true
+    #   t.timestamps
+    # end
+  end
+end

data/test/dummy/db/migrate/20250818030305_add_devise_otp_to_rememberable_users.rb

@@ -0,0 +1,28 @@
+class AddDeviseOtpToRememberableUsers < ActiveRecord::Migration[7.0]
+  def self.up
+    change_table :rememberable_users do |t|
+      t.string :otp_auth_secret
+      t.string :otp_recovery_secret
+      t.boolean :otp_enabled, default: false, null: false
+      t.boolean :otp_mandatory, default: false, null: false
+      t.datetime :otp_enabled_on
+      t.integer :otp_time_drift, default: 0, null: false
+      t.integer :otp_failed_attempts, default: 0, null: false
+      t.integer :otp_recovery_counter, default: 0, null: false
+      t.string :otp_persistence_seed
+
+      t.string :otp_session_challenge
+      t.datetime :otp_challenge_expires
+    end
+
+    add_index :rememberable_users, :otp_session_challenge, unique: true
+    add_index :rememberable_users, :otp_challenge_expires
+  end
+
+  def self.down
+    change_table :rememberable_users do |t|
+      t.remove :otp_auth_secret, :otp_recovery_secret, :otp_enabled, :otp_mandatory, :otp_enabled_on, :otp_session_challenge,
+        :otp_challenge_expires, :otp_time_drift, :otp_failed_attempts, :otp_recovery_counter, :otp_persistence_seed
+    end
+  end
+end

data/test/dummy/db/schema.rb

@@ -10,36 +10,36 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.0].define(version: 2025_07_18_092536) do
+ActiveRecord::Schema[8.0].define(version: 2025_08_18_030305) do
   create_table "admins", force: :cascade do |t|
-    t.string "name"
+    t.string "authentication_token"
     t.datetime "created_at", precision: nil, null: false
-    t.datetime "updated_at", precision: nil, null: false
+    t.datetime "current_sign_in_at", precision: nil
+    t.string "current_sign_in_ip"
     t.string "email", default: "", null: false
     t.string "encrypted_password", default: "", null: false
-    t.string "reset_password_token"
-    t.datetime "reset_password_sent_at", precision: nil
-    t.datetime "remember_created_at", precision: nil
-    t.integer "sign_in_count", default: 0
-    t.datetime "current_sign_in_at", precision: nil
+    t.integer "failed_attempts", default: 0
     t.datetime "last_sign_in_at", precision: nil
-    t.string "current_sign_in_ip"
     t.string "last_sign_in_ip"
-    t.integer "failed_attempts", default: 0
-    t.string "unlock_token"
     t.datetime "locked_at", precision: nil
-    t.string "authentication_token"
+    t.string "name"
     t.string "otp_auth_secret"
-    t.string "otp_recovery_secret"
+    t.datetime "otp_challenge_expires", precision: nil
     t.boolean "otp_enabled", default: false, null: false
-    t.boolean "otp_mandatory", default: false, null: false
     t.datetime "otp_enabled_on", precision: nil
-    t.integer "otp_time_drift", default: 0, null: false
     t.integer "otp_failed_attempts", default: 0, null: false
-    t.integer "otp_recovery_counter", default: 0, null: false
+    t.boolean "otp_mandatory", default: false, null: false
     t.string "otp_persistence_seed"
+    t.integer "otp_recovery_counter", default: 0, null: false
+    t.string "otp_recovery_secret"
     t.string "otp_session_challenge"
-    t.datetime "otp_challenge_expires", precision: nil
+    t.integer "otp_time_drift", default: 0, null: false
+    t.datetime "remember_created_at", precision: nil
+    t.datetime "reset_password_sent_at", precision: nil
+    t.string "reset_password_token"
+    t.integer "sign_in_count", default: 0
+    t.string "unlock_token"
+    t.datetime "updated_at", precision: nil, null: false
     t.index ["authentication_token"], name: "index_admins_on_authentication_token", unique: true
     t.index ["email"], name: "index_admins_on_email", unique: true
     t.index ["otp_challenge_expires"], name: "index_admins_on_otp_challenge_expires"
@@ -48,24 +48,61 @@ ActiveRecord::Schema[8.0].define(version: 2025_07_18_092536) do
     t.index ["unlock_token"], name: "index_admins_on_unlock_token", unique: true
   end
 
-  create_table "non_otp_users", force: :cascade do |t|
-    t.string "name"
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
+  create_table "lockable_users", force: :cascade do |t|
+    t.string "authentication_token"
+    t.datetime "created_at", precision: nil, null: false
+    t.datetime "current_sign_in_at", precision: nil
+    t.string "current_sign_in_ip"
     t.string "email", default: "", null: false
     t.string "encrypted_password", default: "", null: false
+    t.integer "failed_attempts", default: 0
+    t.datetime "last_sign_in_at", precision: nil
+    t.string "last_sign_in_ip"
+    t.datetime "locked_at", precision: nil
+    t.string "name"
+    t.string "otp_auth_secret"
+    t.datetime "otp_challenge_expires", precision: nil
+    t.boolean "otp_enabled", default: false, null: false
+    t.datetime "otp_enabled_on", precision: nil
+    t.integer "otp_failed_attempts", default: 0, null: false
+    t.boolean "otp_mandatory", default: false, null: false
+    t.string "otp_persistence_seed"
+    t.integer "otp_recovery_counter", default: 0, null: false
+    t.string "otp_recovery_secret"
+    t.string "otp_session_challenge"
+    t.integer "otp_time_drift", default: 0, null: false
+    t.datetime "remember_created_at", precision: nil
+    t.datetime "reset_password_sent_at", precision: nil
     t.string "reset_password_token"
-    t.datetime "reset_password_sent_at"
-    t.datetime "remember_created_at"
     t.integer "sign_in_count", default: 0
-    t.datetime "current_sign_in_at"
-    t.datetime "last_sign_in_at"
+    t.string "unlock_token"
+    t.datetime "updated_at", precision: nil, null: false
+    t.index ["authentication_token"], name: "index_lockable_users_on_authentication_token", unique: true
+    t.index ["email"], name: "index_lockable_users_on_email", unique: true
+    t.index ["otp_challenge_expires"], name: "index_lockable_users_on_otp_challenge_expires"
+    t.index ["otp_session_challenge"], name: "index_lockable_users_on_otp_session_challenge", unique: true
+    t.index ["reset_password_token"], name: "index_lockable_users_on_reset_password_token", unique: true
+    t.index ["unlock_token"], name: "index_lockable_users_on_unlock_token", unique: true
+  end
+
+  create_table "non_otp_users", force: :cascade do |t|
+    t.string "authentication_token"
+    t.datetime "created_at", precision: nil, null: false
+    t.datetime "current_sign_in_at", precision: nil
     t.string "current_sign_in_ip"
-    t.string "last_sign_in_ip"
+    t.string "email", default: "", null: false
+    t.string "encrypted_password", default: "", null: false
     t.integer "failed_attempts", default: 0
+    t.datetime "last_sign_in_at", precision: nil
+    t.string "last_sign_in_ip"
+    t.datetime "locked_at", precision: nil
+    t.string "name"
+    t.datetime "remember_created_at", precision: nil
+    t.datetime "reset_password_sent_at", precision: nil
+    t.string "reset_password_token"
+    t.integer "sign_in_count", default: 0
     t.string "unlock_token"
-    t.datetime "locked_at"
-    t.string "authentication_token"
+    t.datetime "updated_at", precision: nil, null: false
     t.index ["authentication_token"], name: "index_non_otp_users_on_authentication_token", unique: true
     t.index ["email"], name: "index_non_otp_users_on_email", unique: true
     t.index ["reset_password_token"], name: "index_non_otp_users_on_reset_password_token", unique: true
@@ -73,41 +110,70 @@ ActiveRecord::Schema[8.0].define(version: 2025_07_18_092536) do
   end
 
   create_table "posts", force: :cascade do |t|
-    t.string "title"
     t.text "body"
     t.datetime "created_at", precision: nil, null: false
+    t.string "title"
     t.datetime "updated_at", precision: nil, null: false
   end
 
-  create_table "users", force: :cascade do |t|
-    t.string "name"
-    t.datetime "created_at", precision: nil, null: false
-    t.datetime "updated_at", precision: nil, null: false
+  create_table "rememberable_users", force: :cascade do |t|
+    t.datetime "current_sign_in_at"
+    t.string "current_sign_in_ip"
     t.string "email", default: "", null: false
     t.string "encrypted_password", default: "", null: false
+    t.datetime "last_sign_in_at"
+    t.string "last_sign_in_ip"
+    t.string "name"
+    t.string "otp_auth_secret"
+    t.datetime "otp_challenge_expires"
+    t.boolean "otp_enabled", default: false, null: false
+    t.datetime "otp_enabled_on"
+    t.integer "otp_failed_attempts", default: 0, null: false
+    t.boolean "otp_mandatory", default: false, null: false
+    t.string "otp_persistence_seed"
+    t.integer "otp_recovery_counter", default: 0, null: false
+    t.string "otp_recovery_secret"
+    t.string "otp_session_challenge"
+    t.integer "otp_time_drift", default: 0, null: false
+    t.datetime "remember_created_at"
+    t.datetime "reset_password_sent_at"
     t.string "reset_password_token"
-    t.datetime "reset_password_sent_at", precision: nil
-    t.datetime "remember_created_at", precision: nil
     t.integer "sign_in_count", default: 0
+    t.index ["email"], name: "index_rememberable_users_on_email", unique: true
+    t.index ["otp_challenge_expires"], name: "index_rememberable_users_on_otp_challenge_expires"
+    t.index ["otp_session_challenge"], name: "index_rememberable_users_on_otp_session_challenge", unique: true
+    t.index ["reset_password_token"], name: "index_rememberable_users_on_reset_password_token", unique: true
+  end
+
+  create_table "users", force: :cascade do |t|
+    t.string "authentication_token"
+    t.datetime "created_at", precision: nil, null: false
     t.datetime "current_sign_in_at", precision: nil
-    t.datetime "last_sign_in_at", precision: nil
     t.string "current_sign_in_ip"
-    t.string "last_sign_in_ip"
+    t.string "email", default: "", null: false
+    t.string "encrypted_password", default: "", null: false
     t.integer "failed_attempts", default: 0
-    t.string "unlock_token"
+    t.datetime "last_sign_in_at", precision: nil
+    t.string "last_sign_in_ip"
     t.datetime "locked_at", precision: nil
-    t.string "authentication_token"
+    t.string "name"
     t.string "otp_auth_secret"
-    t.string "otp_recovery_secret"
+    t.datetime "otp_challenge_expires", precision: nil
     t.boolean "otp_enabled", default: false, null: false
-    t.boolean "otp_mandatory", default: false, null: false
     t.datetime "otp_enabled_on", precision: nil
-    t.integer "otp_time_drift", default: 0, null: false
     t.integer "otp_failed_attempts", default: 0, null: false
-    t.integer "otp_recovery_counter", default: 0, null: false
+    t.boolean "otp_mandatory", default: false, null: false
     t.string "otp_persistence_seed"
+    t.integer "otp_recovery_counter", default: 0, null: false
+    t.string "otp_recovery_secret"
     t.string "otp_session_challenge"
-    t.datetime "otp_challenge_expires", precision: nil
+    t.integer "otp_time_drift", default: 0, null: false
+    t.datetime "remember_created_at", precision: nil
+    t.datetime "reset_password_sent_at", precision: nil
+    t.string "reset_password_token"
+    t.integer "sign_in_count", default: 0
+    t.string "unlock_token"
+    t.datetime "updated_at", precision: nil, null: false
     t.index ["authentication_token"], name: "index_users_on_authentication_token", unique: true
     t.index ["email"], name: "index_users_on_email", unique: true
     t.index ["otp_challenge_expires"], name: "index_users_on_otp_challenge_expires"

data/test/integration/disable_token_test.rb

@@ -2,7 +2,6 @@ require "test_helper"
 require "integration_tests_helper"
 
 class DisableTokenTest < ActionDispatch::IntegrationTest
-
   def setup
     # log in 1fa
     @user = enable_otp_and_sign_in
@@ -52,5 +51,4 @@ class DisableTokenTest < ActionDispatch::IntegrationTest
     assert_not_nil @user.otp_recovery_secret
     assert_equal @user.otp_recovery_secret, recovery_secret
   end
-
 end

data/test/integration/enable_otp_form_test.rb

@@ -48,7 +48,7 @@ class EnableOtpFormTest < ActionDispatch::IntegrationTest
 
     visit "/"
     within "#alerts" do
-      assert !page.has_content?('The Confirmation Code you entered did not match the QR code shown below.')
+      assert_not page.has_content?('The Confirmation Code you entered did not match the QR code shown below.')
     end
   end
 
@@ -71,4 +71,15 @@ class EnableOtpFormTest < ActionDispatch::IntegrationTest
     assert_not user.otp_enabled?
   end
 
+  test "failed confirmation code should return a 422 'unprocessable entity' status" do
+    user = sign_user_in
+
+    visit edit_user_otp_token_path
+
+    fill_in "confirmation_code", with: "123456"
+
+    click_button "Continue..."
+
+    assert_equal 422, page.status_code
+  end
 end

data/test/integration/lockable_test.rb

@@ -0,0 +1,143 @@
+require "test_helper"
+require "integration_tests_helper"
+
+class SignInTest < ActionDispatch::IntegrationTest
+  def setup
+    @lockable_user = create_lockable_user
+    @lockable_user.populate_otp_secrets!
+    @lockable_user.update(otp_enabled: true)
+
+    sign_user_in(@lockable_user)
+    assert_equal lockable_user_otp_credential_path, current_path
+  end
+
+  def teardown
+    Capybara.reset_sessions!
+  end
+
+  test "a normal User should not get locked out for entering incorrect OTP tokens" do
+    enable_otp_and_sign_in
+
+    6.times do
+      fill_in "token", with: "123456"
+      click_button "Submit Token"
+    end
+
+    assert page.has_content? "The token you provided was invalid."
+  end
+
+  test "a Lockable User should increment failed_attempts for each incorrect OTP token" do
+    fill_in "token", with: "123456"
+    click_button "Submit Token"
+    assert page.has_content? "The token you provided was invalid."
+
+    @lockable_user.reload
+    assert_equal 1, @lockable_user.failed_attempts
+
+    fill_in "token", with: "123456"
+    click_button "Submit Token"
+    assert page.has_content? "The token you provided was invalid."
+
+    @lockable_user.reload
+    assert_equal 2, @lockable_user.failed_attempts
+  end
+
+  test "a Lockable User should reset failed_attempts after a correct OTP token" do
+    fill_in "token", with: ROTP::TOTP.new(@lockable_user.otp_auth_secret).at(Time.now)
+    click_button "Submit Token"
+    assert_equal root_path, current_path
+
+    @lockable_user.reload
+    assert_equal 0, @lockable_user.failed_attempts
+  end
+
+  test "a Lockable User should get locked out for entering incorrect OTP token too many times" do
+    # Enter incorrect token
+    5.times do
+      fill_in "token", with: "123456"
+      click_button "Submit Token"
+    end
+
+    @lockable_user.reload
+    assert @lockable_user.access_locked?
+  end
+
+  test "a locked out user should be redirected to the sign in form" do
+    # Enter incorrect token
+    5.times do
+      fill_in "token", with: "123456"
+      click_button "Submit Token"
+    end
+
+    assert_equal new_lockable_user_session_path, current_path
+  end
+
+  test "a locked out user should see the default 'Your account is locked' message" do
+    # Enter incorrect token
+    5.times do
+      fill_in "token", with: "123456"
+      click_button "Submit Token"
+    end
+
+    assert page.has_content? "Your account is locked."
+  end
+
+  test "the OTP credentials form should display the 'one more attempt' message before being locked out" do
+    # Enter incorrect token
+    4.times do
+      fill_in "token", with: "123456"
+      click_button "Submit Token"
+    end
+
+    assert page.has_content? "You have one more attempt"
+  end
+
+  test "the OTP credentials form should not work for a locked out user (in case of URL revisit)" do
+    # Save challenge path
+    uri = URI.parse(current_url)
+    challenge_path = "#{uri.path}?#{uri.query}"
+
+    # Enter incorrect token
+    5.times do
+      fill_in "token", with: "123456"
+      click_button "Submit Token"
+    end
+
+    visit challenge_path
+
+    # Enter correct token
+    fill_in "token", with: ROTP::TOTP.new(@lockable_user.otp_auth_secret).at(Time.now)
+    click_button "Submit Token"
+
+    assert page.has_content? "Your account is locked."
+  end
+
+  test "manually revisiting the sign_in form should not reset the failed attempts for the OTP form" do
+    # Enter incorrect token
+    4.times do
+      fill_in "token", with: "123456"
+      click_button "Submit Token"
+    end
+
+    @lockable_user.reload
+    assert_equal 4, @lockable_user.failed_attempts
+
+    # Attempt to reset failed attempts via sign_in form
+    reset!
+    visit posts_path
+    assert_equal new_user_session_path, current_path
+    sign_user_in(@lockable_user)
+
+    @lockable_user.reload
+    assert_equal 4, @lockable_user.failed_attempts
+
+    # Enter incorrect token again
+    fill_in "token", with: "123456"
+    click_button "Submit Token"
+
+    @lockable_user.reload
+    assert_equal 5, @lockable_user.failed_attempts
+
+    assert page.has_content? "Your account is locked."
+  end
+end

data/test/integration/non_otp_user_models_test.rb

@@ -2,7 +2,6 @@ require "test_helper"
 require "integration_tests_helper"
 
 class NonOtpUserModelsTest < ActionDispatch::IntegrationTest
-
   def teardown
     Capybara.reset_sessions!
   end
@@ -17,5 +16,4 @@ class NonOtpUserModelsTest < ActionDispatch::IntegrationTest
 
     assert_equal non_otp_posts_path, current_path
   end
-
 end

data/test/integration/otp_drift_test.rb

@@ -0,0 +1,35 @@
+require "test_helper"
+require "integration_tests_helper"
+
+class OtpDriftTest < ActionDispatch::IntegrationTest
+  def teardown
+    Capybara.reset_sessions!
+    Timecop.return
+  end
+
+  test "should allow OTP token usage up within the OTP drift window" do
+    user = enable_otp_and_sign_in
+
+    copied_token = ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
+
+    Timecop.freeze(Time.now + 90)
+
+    fill_in "token", with: copied_token
+    click_button "Submit Token"
+
+    assert_equal root_path, current_path
+  end
+
+  test "should not allow OTP token usage beyond the OTP drift window" do
+    user = enable_otp_and_sign_in
+
+    copied_token = ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
+
+    Timecop.freeze(Time.now + 120)
+
+    fill_in "token", with: copied_token
+    click_button "Submit Token"
+
+    assert_not_equal root_path, current_path
+  end
+end