devise-secure_password 1.0.6 → 2.0.1

data/gemfiles/rails_6_1.gemfile

@@ -0,0 +1,57 @@
+source 'https://rubygems.org'
+git_source(:github) { |repo| "https://github.com/#{repo}.git" }
+
+ENV['RAILS_TARGET'] ||= '6.1'
+
+gemspec path: '../'
+
+# Bundle edge Rails instead: gem 'rails', github: 'rails/rails', branch: 'main'
+gem 'rails', '~> 6.1.3', '>= 6.1.3.1'
+# Use sqlite3 as the database for Active Record
+gem 'sqlite3', '~> 1.4'
+# Use Puma as the app server
+gem 'puma', '~> 5.0'
+# Use SCSS for stylesheets
+gem 'sass-rails', '>= 6'
+# Transpile app-like JavaScript. Read more: https://github.com/rails/webpacker
+gem 'webpacker', '~> 5.0'
+# Turbolinks makes navigating your web application faster. Read more: https://github.com/turbolinks/turbolinks
+gem 'turbolinks', '~> 5'
+# Build JSON APIs with ease. Read more: https://github.com/rails/jbuilder
+gem 'jbuilder', '~> 2.7'
+# Use Redis adapter to run Action Cable in production
+# gem 'redis', '~> 4.0'
+# Use Active Model has_secure_password
+# gem 'bcrypt', '~> 3.1.7'
+
+# Use Active Storage variant
+# gem 'image_processing', '~> 1.2'
+
+# Reduces boot times through caching; required in config/boot.rb
+gem 'bootsnap', '>= 1.4.4', require: false
+
+group :development, :test do
+  # Call 'byebug' anywhere in the code to stop execution and get a debugger console
+  gem 'byebug', platforms: %i(mri mingw x64_mingw)
+end
+
+group :development do
+  # Access an interactive console on exception pages or by calling 'console' anywhere in the code.
+  gem 'listen', '~> 3.3'
+  gem 'web-console', '>= 4.1.0'
+end
+
+group :test do
+  # Adds support for Capybara system testing and selenium driver
+  gem 'capybara', '>= 3.26'
+  gem 'codecov', require: false
+  gem 'selenium-webdriver'
+  gem 'shoulda-matchers'
+  # Easy installation and use of web drivers to run system tests with browsers
+  gem 'webdrivers'
+end
+
+# Windows does not include zoneinfo files, so bundle the tzinfo-data gem
+gem 'tzinfo-data', platforms: %i(mingw mswin x64_mingw jruby)
+
+gem 'webrick', '~> 1.7'

data/gemfiles/rails_6_1.gemfile.lock

@@ -0,0 +1,352 @@
+PATH
+  remote: ..
+  specs:
+    devise-secure_password (1.1.0)
+      devise (>= 4.0.0, < 5.0.0)
+      railties (>= 5.0.0, < 7.0.0)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    actioncable (6.1.3.1)
+      actionpack (= 6.1.3.1)
+      activesupport (= 6.1.3.1)
+      nio4r (~> 2.0)
+      websocket-driver (>= 0.6.1)
+    actionmailbox (6.1.3.1)
+      actionpack (= 6.1.3.1)
+      activejob (= 6.1.3.1)
+      activerecord (= 6.1.3.1)
+      activestorage (= 6.1.3.1)
+      activesupport (= 6.1.3.1)
+      mail (>= 2.7.1)
+    actionmailer (6.1.3.1)
+      actionpack (= 6.1.3.1)
+      actionview (= 6.1.3.1)
+      activejob (= 6.1.3.1)
+      activesupport (= 6.1.3.1)
+      mail (~> 2.5, >= 2.5.4)
+      rails-dom-testing (~> 2.0)
+    actionpack (6.1.3.1)
+      actionview (= 6.1.3.1)
+      activesupport (= 6.1.3.1)
+      rack (~> 2.0, >= 2.0.9)
+      rack-test (>= 0.6.3)
+      rails-dom-testing (~> 2.0)
+      rails-html-sanitizer (~> 1.0, >= 1.2.0)
+    actiontext (6.1.3.1)
+      actionpack (= 6.1.3.1)
+      activerecord (= 6.1.3.1)
+      activestorage (= 6.1.3.1)
+      activesupport (= 6.1.3.1)
+      nokogiri (>= 1.8.5)
+    actionview (6.1.3.1)
+      activesupport (= 6.1.3.1)
+      builder (~> 3.1)
+      erubi (~> 1.4)
+      rails-dom-testing (~> 2.0)
+      rails-html-sanitizer (~> 1.1, >= 1.2.0)
+    activejob (6.1.3.1)
+      activesupport (= 6.1.3.1)
+      globalid (>= 0.3.6)
+    activemodel (6.1.3.1)
+      activesupport (= 6.1.3.1)
+    activerecord (6.1.3.1)
+      activemodel (= 6.1.3.1)
+      activesupport (= 6.1.3.1)
+    activestorage (6.1.3.1)
+      actionpack (= 6.1.3.1)
+      activejob (= 6.1.3.1)
+      activerecord (= 6.1.3.1)
+      activesupport (= 6.1.3.1)
+      marcel (~> 1.0.0)
+      mini_mime (~> 1.0.2)
+    activesupport (6.1.3.1)
+      concurrent-ruby (~> 1.0, >= 1.0.2)
+      i18n (>= 1.6, < 2)
+      minitest (>= 5.1)
+      tzinfo (~> 2.0)
+      zeitwerk (~> 2.3)
+    addressable (2.7.0)
+      public_suffix (>= 2.0.2, < 5.0)
+    ansi (1.5.0)
+    ast (2.4.2)
+    bcrypt (3.1.16)
+    bindex (0.8.1)
+    bootsnap (1.7.4)
+      msgpack (~> 1.0)
+    builder (3.2.4)
+    byebug (11.1.3)
+    capybara (3.35.3)
+      addressable
+      mini_mime (>= 0.1.3)
+      nokogiri (~> 1.8)
+      rack (>= 1.6.0)
+      rack-test (>= 0.6.3)
+      regexp_parser (>= 1.5, < 3.0)
+      xpath (~> 3.2)
+    capybara-screenshot (1.0.25)
+      capybara (>= 1.0, < 4)
+      launchy
+    childprocess (3.0.0)
+    codecov (0.5.2)
+      simplecov (>= 0.15, < 0.22)
+    concurrent-ruby (1.1.8)
+    crass (1.0.6)
+    database_cleaner (2.0.1)
+      database_cleaner-active_record (~> 2.0.0)
+    database_cleaner-active_record (2.0.0)
+      activerecord (>= 5.a)
+      database_cleaner-core (~> 2.0.0)
+    database_cleaner-core (2.0.1)
+    devise (4.8.0)
+      bcrypt (~> 3.0)
+      orm_adapter (~> 0.1)
+      railties (>= 4.1.0)
+      responders
+      warden (~> 1.2.3)
+    diff-lcs (1.4.4)
+    docile (1.3.5)
+    erubi (1.10.0)
+    erubis (2.7.0)
+    ffi (1.15.0)
+    flay (2.12.1)
+      erubis (~> 2.7.0)
+      path_expander (~> 1.0)
+      ruby_parser (~> 3.0)
+      sexp_processor (~> 4.0)
+    globalid (0.4.2)
+      activesupport (>= 4.2.0)
+    i18n (1.8.10)
+      concurrent-ruby (~> 1.0)
+    jbuilder (2.11.2)
+      activesupport (>= 5.0.0)
+    launchy (2.5.0)
+      addressable (~> 2.7)
+    listen (3.5.1)
+      rb-fsevent (~> 0.10, >= 0.10.3)
+      rb-inotify (~> 0.9, >= 0.9.10)
+    loofah (2.9.1)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.5.9)
+    mail (2.7.1)
+      mini_mime (>= 0.1.1)
+    marcel (1.0.1)
+    method_source (1.0.0)
+    mini_mime (1.0.3)
+    mini_portile2 (2.5.1)
+    minitest (5.14.4)
+    msgpack (1.4.2)
+    nio4r (2.5.7)
+    nokogiri (1.11.3)
+      mini_portile2 (~> 2.5.0)
+      racc (~> 1.4)
+    orm_adapter (0.5.0)
+    parallel (1.20.1)
+    parser (3.0.1.1)
+      ast (~> 2.4.1)
+    path_expander (1.1.0)
+    public_suffix (4.0.6)
+    puma (5.2.2)
+      nio4r (~> 2.0)
+    racc (1.5.2)
+    rack (2.2.3)
+    rack-proxy (0.6.5)
+      rack
+    rack-test (1.1.0)
+      rack (>= 1.0, < 3)
+    rails (6.1.3.1)
+      actioncable (= 6.1.3.1)
+      actionmailbox (= 6.1.3.1)
+      actionmailer (= 6.1.3.1)
+      actionpack (= 6.1.3.1)
+      actiontext (= 6.1.3.1)
+      actionview (= 6.1.3.1)
+      activejob (= 6.1.3.1)
+      activemodel (= 6.1.3.1)
+      activerecord (= 6.1.3.1)
+      activestorage (= 6.1.3.1)
+      activesupport (= 6.1.3.1)
+      bundler (>= 1.15.0)
+      railties (= 6.1.3.1)
+      sprockets-rails (>= 2.0.0)
+    rails-dom-testing (2.0.3)
+      activesupport (>= 4.2.0)
+      nokogiri (>= 1.6)
+    rails-html-sanitizer (1.3.0)
+      loofah (~> 2.3)
+    railties (6.1.3.1)
+      actionpack (= 6.1.3.1)
+      activesupport (= 6.1.3.1)
+      method_source
+      rake (>= 0.8.7)
+      thor (~> 1.0)
+    rainbow (3.0.0)
+    rake (13.0.3)
+    rb-fsevent (0.10.4)
+    rb-inotify (0.10.1)
+      ffi (~> 1.0)
+    regexp_parser (2.1.1)
+    responders (3.0.1)
+      actionpack (>= 5.0)
+      railties (>= 5.0)
+    rexml (3.2.5)
+    rspec (3.10.0)
+      rspec-core (~> 3.10.0)
+      rspec-expectations (~> 3.10.0)
+      rspec-mocks (~> 3.10.0)
+    rspec-core (3.10.1)
+      rspec-support (~> 3.10.0)
+    rspec-expectations (3.10.1)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.10.0)
+    rspec-mocks (3.10.2)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.10.0)
+    rspec-rails (5.0.1)
+      actionpack (>= 5.2)
+      activesupport (>= 5.2)
+      railties (>= 5.2)
+      rspec-core (~> 3.10)
+      rspec-expectations (~> 3.10)
+      rspec-mocks (~> 3.10)
+      rspec-support (~> 3.10)
+    rspec-support (3.10.2)
+    rspec_junit_formatter (0.4.1)
+      rspec-core (>= 2, < 4, != 2.12.0)
+    rubocop (1.13.0)
+      parallel (~> 1.10)
+      parser (>= 3.0.0.0)
+      rainbow (>= 2.2.2, < 4.0)
+      regexp_parser (>= 1.8, < 3.0)
+      rexml
+      rubocop-ast (>= 1.2.0, < 2.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (>= 1.4.0, < 3.0)
+    rubocop-ast (1.5.0)
+      parser (>= 3.0.1.1)
+    rubocop-rails (2.9.1)
+      activesupport (>= 4.2.0)
+      rack (>= 1.1)
+      rubocop (>= 0.90.0, < 2.0)
+    rubocop-rspec (2.3.0)
+      rubocop (~> 1.0)
+      rubocop-ast (>= 1.1.0)
+    ruby-progressbar (1.11.0)
+    ruby2ruby (2.4.4)
+      ruby_parser (~> 3.1)
+      sexp_processor (~> 4.6)
+    ruby_parser (3.15.1)
+      sexp_processor (~> 4.9)
+    rubyzip (2.3.0)
+    sass-rails (6.0.0)
+      sassc-rails (~> 2.1, >= 2.1.1)
+    sassc (2.4.0)
+      ffi (~> 1.9)
+    sassc-rails (2.1.2)
+      railties (>= 4.0.0)
+      sassc (>= 2.0)
+      sprockets (> 3.0)
+      sprockets-rails
+      tilt
+    selenium-webdriver (3.142.7)
+      childprocess (>= 0.5, < 4.0)
+      rubyzip (>= 1.2.2)
+    semantic_range (3.0.0)
+    sexp_processor (4.15.2)
+    shoulda-matchers (4.5.1)
+      activesupport (>= 4.2.0)
+    simplecov (0.21.2)
+      docile (~> 1.1)
+      simplecov-html (~> 0.11)
+      simplecov_json_formatter (~> 0.1)
+    simplecov-console (0.9.1)
+      ansi
+      simplecov
+      terminal-table
+    simplecov-html (0.12.3)
+    simplecov_json_formatter (0.1.3)
+    sprockets (4.0.2)
+      concurrent-ruby (~> 1.0)
+      rack (> 1, < 3)
+    sprockets-rails (3.2.2)
+      actionpack (>= 4.0)
+      activesupport (>= 4.0)
+      sprockets (>= 3.0.0)
+    sqlite3 (1.4.2)
+    terminal-table (3.0.0)
+      unicode-display_width (~> 1.1, >= 1.1.1)
+    thor (1.1.0)
+    tilt (2.0.10)
+    turbolinks (5.2.1)
+      turbolinks-source (~> 5.2)
+    turbolinks-source (5.2.0)
+    tzinfo (2.0.4)
+      concurrent-ruby (~> 1.0)
+    unicode-display_width (1.7.0)
+    warden (1.2.9)
+      rack (>= 2.0.9)
+    web-console (4.1.0)
+      actionview (>= 6.0.0)
+      activemodel (>= 6.0.0)
+      bindex (>= 0.4.0)
+      railties (>= 6.0.0)
+    webdrivers (4.6.0)
+      nokogiri (~> 1.6)
+      rubyzip (>= 1.3.0)
+      selenium-webdriver (>= 3.0, < 4.0)
+    webpacker (5.3.0)
+      activesupport (>= 5.2)
+      rack-proxy (>= 0.6.1)
+      railties (>= 5.2)
+      semantic_range (>= 2.3.0)
+    webrick (1.7.0)
+    websocket-driver (0.7.3)
+      websocket-extensions (>= 0.1.0)
+    websocket-extensions (0.1.5)
+    xpath (3.2.0)
+      nokogiri (~> 1.8)
+    zeitwerk (2.4.2)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  bootsnap (>= 1.4.4)
+  bundler (>= 2.2.16)
+  byebug
+  capybara (>= 3.26)
+  capybara-screenshot (>= 1.0.18)
+  codecov
+  database_cleaner (>= 2.0.1)
+  devise (~> 4.0)
+  devise-secure_password!
+  flay (>= 2.10.0)
+  jbuilder (~> 2.7)
+  launchy (>= 2.4.3)
+  listen (~> 3.3)
+  puma (~> 5.0)
+  rails (~> 6.1.3, >= 6.1.3.1)
+  rake (>= 12.3)
+  rspec (>= 3.7)
+  rspec-rails (>= 3.7)
+  rspec_junit_formatter (>= 0.3)
+  rubocop (>= 1.0.0)
+  rubocop-rails (>= 2.3.2)
+  rubocop-rspec (>= 1.35.0)
+  ruby2ruby (>= 2.4.0)
+  sass-rails (>= 6)
+  selenium-webdriver
+  shoulda-matchers
+  simplecov (>= 0.18.2)
+  simplecov-console (>= 0.4.2)
+  sqlite3 (~> 1.4)
+  turbolinks (~> 5)
+  tzinfo-data
+  web-console (>= 4.1.0)
+  webdrivers
+  webpacker (~> 5.0)
+  webrick (~> 1.7)
+
+BUNDLED WITH
+   2.2.16

data/lib/devise/secure_password.rb

@@ -9,6 +9,7 @@ require 'devise/secure_password/models/password_has_required_content'
 require 'devise/secure_password/models/password_disallows_frequent_reuse'
 require 'devise/secure_password/models/password_disallows_frequent_changes'
 require 'devise/secure_password/models/password_requires_regular_updates'
+require 'devise/secure_password/grammar'
 
 module Devise
   # password_content_enforcement configuration parameters
@@ -27,19 +28,13 @@ module Devise
   @password_maximum_age = 180.days
 
   class << self
-    attr_accessor :password_required_uppercase_count
-    attr_accessor :password_required_lowercase_count
-    attr_accessor :password_required_number_count
-    attr_accessor :password_required_special_character_count
-    attr_accessor :password_previously_used_count
-    attr_accessor :password_minimum_age
-    attr_accessor :password_maximum_age
+    attr_accessor :password_required_uppercase_count, :password_required_lowercase_count, :password_required_number_count, :password_required_special_character_count, :password_previously_used_count, :password_minimum_age, :password_maximum_age
   end
 
   module SecurePassword
     module Controllers
+      autoload :Helpers,       'devise/secure_password/controllers/helpers'
       autoload :DeviseHelpers, 'devise/secure_password/controllers/devise_helpers'
-      autoload :ActiveHelpers, 'devise/secure_password/controllers/active_helpers'
     end
 
     class Engine < ::Rails::Engine
@@ -49,7 +44,7 @@ module Devise
       end
       ActiveSupport.on_load(:action_controller) do
         include ActionView::Helpers::DateHelper
-        include Devise::SecurePassword::Controllers::ActiveHelpers
+        include Devise::SecurePassword::Controllers::Helpers
       end
 
       # add exceptions to the inflector so it doesn't get tripped up by our concerns that end in an 's'

data/lib/devise/secure_password/controllers/devise_helpers.rb

@@ -4,63 +4,17 @@ module Devise
       module DeviseHelpers
         extend ActiveSupport::Concern
 
-        # rubocop:disable Style/ClassAndModuleChildren
         class ::DeviseController
-          alias old_require_no_authentication require_no_authentication
+          alias devise_sign_in sign_in
 
           protected
 
-          # Override the devise require_no_authentication before callback to
-          # prevent authenticated users with expired passwords from escaping to
-          # other pages without first updating their passwords.
-          def require_no_authentication
-            return if check_password_expired_and_redirect!
-
-            old_require_no_authentication
-          end
-
-          # Store the name of the current controller and action in the warden
-          # session store then redirect if signed in and password expired. The
-          # stored values will be used by non-devise controllers to prevent a
-          # user from escaping the change password process.
-          def check_password_expired_and_redirect!
-            assert_is_devise_resource!
-
-            return if skip_current_devise_controller?
-
-            if signed_in?(scope_name) && warden.session(scope_name)[:secure_password_expired]
-              save_controller_state
-              redirect_to edit_user_password_with_policy_url, alert: "#{error_string_for_password_expired}."
-              return true
+          def sign_in(*args)
+            devise_sign_in(*args).tap do
+              set_devise_secure_password_expired! if warden_user_has_password_expiration?
             end
-
-            false
-          end
-
-          def save_controller_state
-            warden.session(scope_name)[:secure_last_controller] = self.class.name
-            warden.session(scope_name)[:secure_last_action] = action_name
-          end
-
-          # Prevent infinite loops and allow specified controllers to bypass.
-          # @NOTE: The ability to extend this list may be made public, in the
-          # future if that functionality is needed.
-          def skip_current_devise_controller?
-            exclusion_list = [
-              'Devise::SessionsController'
-            ]
-            !(exclusion_list.include?("#{self.class.name}#" + action_name) || (exclusion_list & self.class.ancestors.map(&:to_s)).any?)
-          end
-
-          def error_string_for_password_expired
-            class_obj = scope_name.to_s.camelize.constantize
-            I18n.t(
-              'secure_password.password_requires_regular_updates.errors.messages.password_expired',
-              timeframe: distance_of_time_in_words(class_obj.password_maximum_age)
-            )
           end
         end
-        # rubocop:enable Style/ClassAndModuleChildren
       end
     end
   end