devise-security 0.12.0 → 0.13.0

data/lib/devise-security/patches.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseSecurity
   module Patches
     autoload :ControllerCaptcha, 'devise-security/patches/controller_captcha'

data/lib/devise-security/patches/confirmations_controller_captcha.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseSecurity::Patches
   module ConfirmationsControllerCaptcha
     extend ActiveSupport::Concern

data/lib/devise-security/patches/confirmations_controller_security_question.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseSecurity::Patches
   module ConfirmationsControllerSecurityQuestion
     extend ActiveSupport::Concern

data/lib/devise-security/patches/controller_captcha.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseSecurity::Patches
   module ControllerCaptcha
     extend ActiveSupport::Concern

data/lib/devise-security/patches/controller_security_question.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseSecurity::Patches
   module ControllerSecurityQuestion
     extend ActiveSupport::Concern

data/lib/devise-security/patches/passwords_controller_captcha.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseSecurity::Patches
   module PasswordsControllerCaptcha
     extend ActiveSupport::Concern

data/lib/devise-security/patches/passwords_controller_security_question.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseSecurity::Patches
   module PasswordsControllerSecurityQuestion
     extend ActiveSupport::Concern

data/lib/devise-security/patches/registrations_controller_captcha.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseSecurity::Patches
   module RegistrationsControllerCaptcha
     extend ActiveSupport::Concern

data/lib/devise-security/patches/sessions_controller_captcha.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseSecurity::Patches
   module SessionsControllerCaptcha
     extend ActiveSupport::Concern

data/lib/devise-security/patches/unlocks_controller_captcha.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseSecurity::Patches
   module UnlocksControllerCaptcha
     extend ActiveSupport::Concern

data/lib/devise-security/patches/unlocks_controller_security_question.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseSecurity::Patches
   module UnlocksControllerSecurityQuestion
     extend ActiveSupport::Concern

data/lib/devise-security/rails.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseSecurity
   class Engine < ::Rails::Engine
     ActiveSupport.on_load(:action_controller) do

data/lib/devise-security/routes.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ActionDispatch::Routing
   class Mapper
 

data/lib/devise-security/schema.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseSecurity
   # add schema helper for migrations
   module Schema

data/lib/devise-security/validators/password_complexity_validator.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+# Password complexity validator
+# Options:
+# - digit:  minimum number of digits in the validated string
+# - lower:  minimum number of lower-case letters in the validated string
+# - symbol: minimum number of punctuation characters or symbols in the validated string
+# - upper:  minimum number of upper-case letters in the validated string
+class DeviseSecurity::PasswordComplexityValidator < ActiveModel::EachValidator
+  PATTERNS = {
+    digit: /\p{Digit}/,
+    digits: /\p{Digit}/,
+    lower: /\p{Lower}/,
+    upper: /\p{Upper}/,
+    symbol: /\p{Punct}|\p{S}/,
+    symbols: /\p{Punct}|\p{S}/
+  }.freeze
+
+  def validate_each(record, attribute, value)
+    active_pattern_keys.each do |key|
+      minimum = [0, options[key].to_i].max
+      pattern = Regexp.new PATTERNS[key]
+
+      unless (value || '').scan(pattern).size >= minimum
+        record.errors.add attribute, :"password_complexity.#{key}", count: minimum
+      end
+    end
+  end
+
+  def active_pattern_keys
+    options.keys & PATTERNS.keys
+  end
+end

data/lib/devise-security/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseSecurity
-  VERSION = '0.12.0'.freeze
+  VERSION = '0.13.0'
 end

data/lib/generators/devise_security/install_generator.rb

@@ -1,8 +1,10 @@
+# frozen_string_literal: true
+
 module DeviseSecurity
   module Generators
     # Generator for Rails to create or append to a Devise initializer.
     class InstallGenerator < Rails::Generators::Base
-      LOCALES = %w[ en de it ]
+      LOCALES = %w[en es de fr it tr].freeze
 
       source_root File.expand_path('../../templates', __FILE__)
       desc 'Install the devise security extension'

data/lib/generators/templates/devise-security.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 Devise.setup do |config|
   # ==> Security Extension
   # Configure security extension for devise
@@ -6,16 +8,20 @@ Devise.setup do |config|
   # config.expire_password_after = false
 
   # Need 1 char of A-Z, a-z and 0-9
-  # config.password_regex = /(?=.*\d)(?=.*[a-z])(?=.*[A-Z])/
+  # config.password_complexity = { digit: 1, lower: 1, symbol: 1, upper: 1 }
 
   # How many passwords to keep in archive
   # config.password_archiving_count = 5
 
-  # Deny old password (true, false, count)
+  # Deny old passwords (true, false, number_of_old_passwords_to_check)
+  # Examples:
+  # config.deny_old_passwords = false # allow old passwords
+  # config.deny_old_passwords = true # will deny all the old passwords
+  # config.deny_old_passwords = 3 # will deny new passwords that matches with the last 3 passwords
   # config.deny_old_passwords = true
 
   # enable email validation for :secure_validatable. (true, false, validation_options)
-  # dependency: need an email validator like rails_email_validator
+  # dependency: see https://github.com/devise-security/devise-security/blob/master/README.md#e-mail-validation
   # config.email_validation = true
 
   # captcha integration for recover form

data/test/dummy/Rakefile

@@ -1,6 +1,8 @@
+# frozen_string_literal: true
+
 # Add your own tasks in files placed in lib/tasks ending in .rake,
 # for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
 
-require File.expand_path('../config/application', __FILE__)
+require File.expand_path('config/application', __dir__)
 
 Rails.application.load_tasks

data/test/dummy/app/controllers/application_controller.rb

@@ -1,2 +1,4 @@
+# frozen_string_literal: true
+
 class ApplicationController < ActionController::Base
 end

data/test/dummy/app/controllers/captcha/sessions_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class Captcha::SessionsController < Devise::SessionsController
   include DeviseSecurity::Patches::ControllerCaptcha
 end

data/test/dummy/app/controllers/security_question/unlocks_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class SecurityQuestion::UnlocksController < Devise::UnlocksController
   include DeviseSecurity::Patches::ControllerSecurityQuestion
 end

data/test/dummy/app/models/application_record.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class ApplicationRecord < ActiveRecord::Base
   self.abstract_class = true
 end

data/test/dummy/app/models/captcha_user.rb

@@ -1,4 +1,6 @@
-class CaptchaUser < ActiveRecord::Base
+# frozen_string_literal: true
+
+class CaptchaUser < ApplicationRecord
   self.table_name = 'users'
   devise :database_authenticatable, :password_archivable,
          :paranoid_verification, :password_expirable

data/test/dummy/app/models/secure_user.rb

@@ -1,3 +1,5 @@
-class SecureUser < ActiveRecord::Base
+# frozen_string_literal: true
+
+class SecureUser < ApplicationRecord
   devise :database_authenticatable, :secure_validatable, email_validation: false
 end

data/test/dummy/app/models/security_question_user.rb

@@ -1,4 +1,6 @@
-class SecurityQuestionUser < ActiveRecord::Base
+# frozen_string_literal: true
+
+class SecurityQuestionUser < ApplicationRecord
   self.table_name = 'users'
   devise :database_authenticatable, :password_archivable, :lockable,
          :paranoid_verification, :password_expirable, :security_questionable

data/test/dummy/app/models/user.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class User < ApplicationRecord
 
   devise :database_authenticatable,

data/test/dummy/app/models/widget.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class Widget < ApplicationRecord
   belongs_to :user
   validates_associated :user

data/test/dummy/config.ru

@@ -1,4 +1,6 @@
+# frozen_string_literal: true
+
 # This file is used by Rack-based servers to start the application.
 
-require ::File.expand_path('../config/environment',  __FILE__)
+require ::File.expand_path('../config/environment', __FILE__)
 run RailsApp::Application

data/test/dummy/config/application.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require File.expand_path('../boot', __FILE__)
 
 require 'rails/all'

data/test/dummy/config/boot.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'rubygems'
 
 # Set up gems listed in the Gemfile.

data/test/dummy/config/environment.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # Load the rails application
 require File.expand_path('../application', __FILE__)
 

data/test/dummy/config/environments/test.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 RailsApp::Application.configure do
   config.cache_classes = true
   config.eager_load = false

data/test/dummy/config/initializers/devise.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'rails_email_validator'
 Devise.setup do |config|
   config.mailer_sender = 'please-change-me-at-config-initializers-devise@example.com'
@@ -7,4 +9,10 @@ Devise.setup do |config|
   config.case_insensitive_keys = [:email]
 
   config.strip_whitespace_keys = [:email]
+
+  config.password_complexity = {
+    digit: 1,
+    lower: 1,
+    upper: 1,
+  }
 end

data/test/dummy/config/initializers/migration_class.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 MIGRATION_CLASS =
   if ActiveRecord::VERSION::MAJOR >= 5
     ActiveRecord::Migration[4.2]

data/test/dummy/config/routes.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 RailsApp::Application.routes.draw do
   devise_for :users
 

data/test/dummy/db/migrate/20120508165529_create_tables.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class CreateTables < MIGRATION_CLASS
   def self.up
     create_table :users do |t|

data/test/dummy/db/migrate/20150402165590_add_verification_columns.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class AddVerificationColumns < MIGRATION_CLASS
   def self.up
     add_column :users, :paranoid_verification_code, :string

data/test/dummy/db/migrate/20150407162345_add_verification_attempt_column.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class AddVerificationAttemptColumn < MIGRATION_CLASS
   def self.up
     add_column :users, :paranoid_verification_attempt, :integer, default: 0

data/test/dummy/db/migrate/20160320162345_add_security_questions_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class AddSecurityQuestionsFields < MIGRATION_CLASS
   def change
     add_column :users, :locked_at, :datetime

data/test/dummy/db/migrate/20180318103603_add_expireable_columns.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class AddExpireableColumns < MIGRATION_CLASS
   def change
     add_column :users, :expired_at, :datetime

data/test/dummy/db/migrate/20180318105329_add_confirmable_columns.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class AddConfirmableColumns < MIGRATION_CLASS
   def change
     add_column :users, :confirmation_token, :string

data/test/dummy/db/migrate/20180318105732_add_rememberable_columns.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class AddRememberableColumns < MIGRATION_CLASS
   def change
     add_column :users, :remember_created_at, :datetime

data/test/dummy/db/migrate/20180318111336_add_recoverable_columns.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class AddRecoverableColumns < MIGRATION_CLASS
   def change
     add_column :users, :reset_password_token, :string

data/test/dummy/db/migrate/20180319114023_add_widget.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class AddWidget < MIGRATION_CLASS
   def change
     create_table :widgets do |t|

data/test/test_captcha_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'test_helper'
 
 class TestWithCaptcha < ActionController::TestCase

data/test/test_complexity_validator.rb

@@ -0,0 +1,60 @@
+require 'test_helper'
+
+class PasswordComplexityValidatorTest < Minitest::Test
+  class ModelWithPassword
+    include ActiveModel::Validations
+
+    attr_reader :password
+
+    def initialize(password)
+      @password = password
+    end
+  end
+
+  def setup
+    ModelWithPassword.clear_validators!
+  end
+
+  def test_with_no_rules_anything_goes
+    assert(ModelWithPassword.new('aaaa').valid?)
+  end
+
+  def test_enforces_uppercase
+    ModelWithPassword.validates :password, 'devise_security/password_complexity': { upper: 1 }
+    refute(ModelWithPassword.new('aaaa').valid?)
+    assert(ModelWithPassword.new('Aaaa').valid?)
+  end
+
+  def test_enforces_count
+    ModelWithPassword.validates :password, 'devise_security/password_complexity': { upper: 2 }
+    refute(ModelWithPassword.new('Aaaa').valid?)
+    assert(ModelWithPassword.new('AAaa').valid?)
+  end
+
+  def test_enforces_digit
+    ModelWithPassword.validates :password, 'devise_security/password_complexity': { digit: 1 }
+    refute(ModelWithPassword.new('aaaa').valid?)
+    assert(ModelWithPassword.new('aaa1').valid?)
+  end
+
+  def test_enforces_lower
+    ModelWithPassword.validates :password, 'devise_security/password_complexity': { lower: 1 }
+    refute(ModelWithPassword.new('AAAA').valid?)
+    assert(ModelWithPassword.new('AAAa').valid?)
+  end
+
+  def test_enforces_symbol
+    ModelWithPassword.validates :password, 'devise_security/password_complexity': { symbol: 1 }
+    refute(ModelWithPassword.new('aaaa').valid?)
+    assert(ModelWithPassword.new('aaa!').valid?)
+  end
+
+  def test_enforces_combination
+    ModelWithPassword.validates :password, 'devise_security/password_complexity': { lower: 1, upper: 1, digit: 1, symbol: 1 }
+    refute(ModelWithPassword.new('abcd').valid?)
+    refute(ModelWithPassword.new('ABCD').valid?)
+    refute(ModelWithPassword.new('1234').valid?)
+    refute(ModelWithPassword.new('$!,*').valid?)
+    assert(ModelWithPassword.new('aB3*').valid?)
+  end
+end