devise-security 0.17.0 → 0.18.0

data/test/tmp/config/locales/devise.security_extension.fr.yml

@@ -9,8 +9,8 @@ fr:
           one: doit contenir au moins un chiffre
           other: doit contenir au moins %{count} chiffres
         lower:
-          one: doit contenir au moins une lettre miniscule
-          other: doit contenir au moins %{count} lettres miniscules
+          one: doit contenir au moins une lettre minuscule
+          other: doit contenir au moins %{count} lettres minuscules
         symbol:
           one: doit contenir au moins un signe de ponctuation
           other: doit contenir au moins %{count} signes de ponctuation
@@ -22,9 +22,21 @@ fr:
     invalid_security_question: La réponse à la question de sécurité est invalide
     paranoid_verify:
       code_required: Veuillez entrer le code fourni par notre équipe de support
+    paranoid_verification_code:
+      updated: Code de vérification accepté
+      show:
+        submit_verification_code: Soumettre le code de vérification
+        verification_code: Code de vérification
+        submit: Soumettre
     password_expired:
       updated: Votre nouveau mot de passe est enregistré
       change_required: Votre mot de passe a expiré. Veuillez en choisir un autre
+      show:
+        renew_your_password: Renouveler votre mot de passe
+        current_password: Mot de passe actuel
+        new_password: Nouveau mot de passe
+        new_password_confirmation: Confirmer le nouveau mot de passe
+        change_my_password: Changer mon mot de passe
     failure:
       session_limited: Vos identifiants de connexion ont été utilisés dans un autre navigateur. Veuillez vous reconnecter pour continuer dans ce navigateur
       expired: Votre compte a expiré pour cause d'inactivité. Veuillez contacter l'administrateur du site

data/test/tmp/config/locales/devise.security_extension.hi.yml

@@ -24,6 +24,7 @@ hi:
     paranoid_verify:
       code_required: सपोर्ट टीम द्वारा दिया गया कोड डाले
     paranoid_verification_code:
+      updated: सत्यापन कोड स्वीकार किया गया
       show:
         submit_verification_code: वेरिफिकेशन कोड डाले
         verification_code: वेरिफिकेशन कोड

data/test/tmp/config/locales/devise.security_extension.it.yml

@@ -23,6 +23,7 @@ it:
     paranoid_verify:
       code_required: 'Inserisci il codice fornito dal nostro team di supporto'
     paranoid_verification_code:
+      updated: Codice di verifica accettato
       show:
         submit_verification_code: Invia codice di verifica
         verification_code: Codice di verifica

data/test/tmp/config/locales/devise.security_extension.ja.yml

@@ -22,9 +22,21 @@ ja:
     invalid_security_question: 'セキュリティ質問に対する回答が不正です。'
     paranoid_verify:
       code_required: 'サポートチームに提供された認証コードを入力してください。'
+    paranoid_verification_code:
+      updated: 確認コードを受け入れました
+      show:
+        submit_verification_code: 確認コードを送信する
+        verification_code: 検証コード
+        submit: 参加する
     password_expired:
       updated: '新しいパスワードが保存されました。'
       change_required: 'パスワードが期限切れです。パスワードを新しく設定してください。'
+      show:
+        renew_your_password: パスワードを更新する
+        current_password: 現在のパスワード
+        new_password: 新しいパスワード
+        new_password_confirmation: 新しいパスワードを確認
+        change_my_password: パスワードを変更する
     failure:
       session_limited: '他のブラウザでログインされました。このブラウザで続ける場合は、もう一度サインインしてください。'
       expired: '活動がなかったため、あなたのアカウントは期限切れとなりました。サイト管理者に連絡してください。'

data/test/tmp/config/locales/devise.security_extension.nl.yml

@@ -23,6 +23,7 @@ nl:
     paranoid_verify:
       code_required: Voer de aangeleverde code in
     paranoid_verification_code:
+      updated: Verificatiecode geaccepteerd
       show:
         submit_verification_code: Verstuur verificatie code
         verification_code: Verificatie code

data/test/tmp/config/locales/devise.security_extension.pt.yml

@@ -23,6 +23,7 @@ pt:
     paranoid_verify:
       code_required: 'Por favor entre o código que a equipe de suporte enviou'
     paranoid_verification_code:
+      updated: Código de verificação aceito
       show:
         submit_verification_code: Enviar código de verificação
         verification_code: Código de verificação

data/test/tmp/config/locales/devise.security_extension.ru.yml

@@ -31,6 +31,7 @@ ru:
     paranoid_verify:
       code_required: 'Пожалуйста введите код, полученный от нашей команды поддержки'
     paranoid_verification_code:
+      updated: Код подтверждения принят
       show:
         submit_verification_code: Ввод кода подтверждения
         verification_code: Код подверждения

data/test/tmp/config/locales/devise.security_extension.tr.yml

@@ -4,15 +4,39 @@ tr:
       taken_in_past: "daha önce kullanıldı."
       equal_to_current_password: "mevcut paroladan farklı olmalı."
       equal_to_email: "e-postadan farklı olmalı."
-      password_format: "büyük, küçük harfler ve sayılar içermeli."
+      password_complexity:
+        digit:
+          one: en az bir rakam içermelidir
+          other: en az %{count} basamak içermelidir
+        lower:
+          one: en az bir küçük harf içermelidir
+          other: en az %{count} küçük harf içermelidir
+        symbol:
+          one: en az bir noktalama işareti veya sembolü içermelidir
+          other: en az %{count} noktalama işareti veya sembolü içermelidir
+        upper:
+          one: en az bir büyük harf içermelidir
+          other: en az %{count} büyük harf içermelidir
   devise:
     invalid_captcha: "Captcha hatalı."
     invalid_security_question: "Güvenlik sorusunun cevabı yanlış."
     paranoid_verify:
       code_required: "Destek ekibimizden aldığınız kodu girin."
+    paranoid_verification_code:
+      updated: Doğrulama kodu kabul edildi
+      show:
+        submit_verification_code: Doğrulama kodunu gönder
+        verification_code: Doğrulama kodu
+        submit: Gönder
     password_expired:
       updated: "Yeni parolanız kaydedildi."
       change_required: "Parolanızın geçerlilik süresi dolmuş. Lütfen parolanızı yenileyin."
+      show:
+        renew_your_password: Şifrenizi yenileyin
+        current_password: Mevcut Şifre
+        new_password: Yeni Şifre
+        new_password_confirmation: Yeni şifreyi onayla
+        change_my_password: Şifremi Değiştir
     failure:
       session_limited: 'Hesabınıza başka bir tarayıcıdan giriş yapılmış. Lütfen devam etmek için yeniden giriş yapın.'
       expired: 'Hesabınız aktif olarak kullanılmadığı için artık geçerli değil. Lütfen yönetici ile irtibata geçin.'

data/test/tmp/config/locales/devise.security_extension.uk.yml

@@ -31,6 +31,7 @@ uk:
     paranoid_verify:
       code_required: 'Введіть, будь ласка, код від нашої команди підтримки'
     paranoid_verification_code:
+      updated: Код підтвердження прийнято
       show:
         submit_verification_code: Відправити код підтвердження
         verification_code: Код підтвердження

data/test/tmp/config/locales/devise.security_extension.zh_CN.yml

@@ -23,6 +23,7 @@ zh_CN:
     paranoid_verify:
       code_required: '请输入我们支持团队提供的代码'
     paranoid_verification_code:
+      updated: 接受验证码
       show:
         submit_verification_code: 提交验证码
         verification_code: 验证码

data/test/tmp/config/locales/devise.security_extension.zh_TW.yml

@@ -23,6 +23,7 @@ zh_TW:
     paranoid_verify:
       code_required: '請輸入由我們客服團隊提供的代碼'
     paranoid_verification_code:
+      updated: 接受驗證碼
       show:
         submit_verification_code: 送出驗證碼
         verification_code: 驗證碼

metadata

@@ -1,18 +1,18 @@
 --- !ruby/object:Gem::Specification
 name: devise-security
 version: !ruby/object:Gem::Version
-  version: 0.17.0
+  version: 0.18.0
 platform: ruby
 authors:
-- Marco Scholl
 - Alexander Dreher
-- Nate Bird
 - Dillon Welch
 - Kevin Olbrich
+- Marco Scholl
+- Nate Bird
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-12-29 00:00:00.000000000 Z
+date: 2023-04-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: devise
@@ -56,6 +56,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: byebug
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: database_cleaner
   requirement: !ruby/object:Gem::Requirement
@@ -85,7 +99,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: m
+  name: i18n-tasks
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -99,7 +113,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: minitest
+  name: m
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -113,7 +127,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: omniauth
+  name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -127,7 +141,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: pry-byebug
+  name: omniauth
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -172,16 +186,30 @@ dependencies:
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rubocop-minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.83.0
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.83.0
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rubocop-rails
   requirement: !ruby/object:Gem::Requirement
@@ -289,16 +317,8 @@ files:
 - lib/devise-security/models/session_limitable.rb
 - lib/devise-security/orm/mongoid.rb
 - lib/devise-security/patches.rb
-- lib/devise-security/patches/confirmations_controller_captcha.rb
-- lib/devise-security/patches/confirmations_controller_security_question.rb
 - lib/devise-security/patches/controller_captcha.rb
 - lib/devise-security/patches/controller_security_question.rb
-- lib/devise-security/patches/passwords_controller_captcha.rb
-- lib/devise-security/patches/passwords_controller_security_question.rb
-- lib/devise-security/patches/registrations_controller_captcha.rb
-- lib/devise-security/patches/sessions_controller_captcha.rb
-- lib/devise-security/patches/unlocks_controller_captcha.rb
-- lib/devise-security/patches/unlocks_controller_security_question.rb
 - lib/devise-security/rails.rb
 - lib/devise-security/routes.rb
 - lib/devise-security/validators/password_complexity_validator.rb
@@ -313,7 +333,6 @@ files:
 - test/dummy/app/assets/config/manifest.js
 - test/dummy/app/controllers/application_controller.rb
 - test/dummy/app/controllers/captcha/sessions_controller.rb
-- test/dummy/app/controllers/foos_controller.rb
 - test/dummy/app/controllers/overrides/paranoid_verification_code_controller.rb
 - test/dummy/app/controllers/overrides/password_expired_controller.rb
 - test/dummy/app/controllers/security_question/unlocks_controller.rb
@@ -377,11 +396,11 @@ files:
 - test/dummy/lib/shared_security_questions_fields.rb
 - test/dummy/lib/shared_user.rb
 - test/dummy/lib/shared_user_with_password_verification.rb
-- test/dummy/lib/shared_user_without_email.rb
 - test/dummy/lib/shared_user_without_omniauth.rb
 - test/dummy/lib/shared_verification_fields.rb
-- test/dummy/log/development.log
 - test/dummy/log/test.log
+- test/i18n_test.rb
+- test/integration/test_paranoid_verification_code_workflow.rb
 - test/integration/test_password_expirable_workflow.rb
 - test/integration/test_session_limitable_workflow.rb
 - test/orm/active_record.rb
@@ -436,7 +455,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.0
+rubygems_version: 3.1.6
 signing_key:
 specification_version: 4
 summary: Security extension for devise
@@ -479,7 +498,6 @@ test_files:
 - test/dummy/app/controllers/overrides/paranoid_verification_code_controller.rb
 - test/dummy/app/controllers/application_controller.rb
 - test/dummy/app/controllers/captcha/sessions_controller.rb
-- test/dummy/app/controllers/foos_controller.rb
 - test/dummy/app/controllers/widgets_controller.rb
 - test/dummy/app/controllers/security_question/unlocks_controller.rb
 - test/dummy/app/views/foos/index.html.erb
@@ -499,7 +517,6 @@ test_files:
 - test/dummy/Rakefile
 - test/dummy/lib/shared_verification_fields.rb
 - test/dummy/lib/shared_user.rb
-- test/dummy/lib/shared_user_without_email.rb
 - test/dummy/lib/shared_user_without_omniauth.rb
 - test/dummy/lib/shared_user_with_password_verification.rb
 - test/dummy/lib/shared_expirable_columns.rb
@@ -514,12 +531,13 @@ test_files:
 - test/dummy/db/migrate/20150407162345_add_verification_attempt_column.rb
 - test/dummy/db/migrate/20180318105329_add_confirmable_columns.rb
 - test/dummy/log/test.log
-- test/dummy/log/development.log
 - test/test_install_generator.rb
 - test/test_secure_validatable_overrides.rb
+- test/i18n_test.rb
 - test/test_paranoid_verification.rb
 - test/integration/test_session_limitable_workflow.rb
 - test/integration/test_password_expirable_workflow.rb
+- test/integration/test_paranoid_verification_code_workflow.rb
 - test/test_database_authenticatable_patch.rb
 - test/test_secure_validatable.rb
 - test/test_session_limitable.rb

data/lib/devise-security/patches/confirmations_controller_captcha.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-module DeviseSecurity::Patches
-  module ConfirmationsControllerCaptcha
-    extend ActiveSupport::Concern
-    included do
-      define_method :create do
-        if valid_captcha_if_defined?(params[:captcha])
-          self.resource = resource_class.send_confirmation_instructions(params[resource_name])
-
-          if successfully_sent?(resource)
-            respond_with({}, location: after_resending_confirmation_instructions_path_for(resource_name))
-          else
-            respond_with(resource)
-          end
-        else
-          flash[:alert] = t('devise.invalid_captcha') if is_navigational_format?
-          respond_with({}, location: new_confirmation_path(resource_name))
-        end
-      end
-    end
-  end
-end

data/lib/devise-security/patches/confirmations_controller_security_question.rb

@@ -1,26 +0,0 @@
-# frozen_string_literal: true
-
-module DeviseSecurity::Patches
-  module ConfirmationsControllerSecurityQuestion
-    extend ActiveSupport::Concern
-    included do
-      define_method :create do
-        # only find via email, not login
-        resource = resource_class.find_or_initialize_with_error_by(:email, params[resource_name][:email], :not_found)
-
-        if valid_captcha_or_security_question?(resource, params)
-          self.resource = resource_class.send_confirmation_instructions(params[resource_name])
-
-          if successfully_sent?(resource)
-            respond_with({}, location: after_resending_confirmation_instructions_path_for(resource_name))
-          else
-            respond_with(resource)
-          end
-        else
-          flash[:alert] = t('devise.invalid_security_question') if is_navigational_format?
-          respond_with({}, location: new_confirmation_path(resource_name))
-        end
-      end
-    end
-  end
-end

data/lib/devise-security/patches/passwords_controller_captcha.rb

@@ -1,22 +0,0 @@
-# frozen_string_literal: true
-
-module DeviseSecurity::Patches
-  module PasswordsControllerCaptcha
-    extend ActiveSupport::Concern
-    included do
-      define_method :create do
-        if valid_captcha_if_defined?(params[:captcha])
-          self.resource = resource_class.send_reset_password_instructions(params[resource_name])
-          if successfully_sent?(resource)
-            respond_with({}, location: new_session_path(resource_name))
-          else
-            respond_with(resource)
-          end
-        else
-          flash[:alert] = t('devise.invalid_captcha') if is_navigational_format?
-          respond_with({}, location: new_password_path(resource_name))
-        end
-      end
-    end
-  end
-end

data/lib/devise-security/patches/passwords_controller_security_question.rb

@@ -1,25 +0,0 @@
-# frozen_string_literal: true
-
-module DeviseSecurity::Patches
-  module PasswordsControllerSecurityQuestion
-    extend ActiveSupport::Concern
-    included do
-      define_method :create do
-        # only find via email, not login
-        resource = resource_class.find_or_initialize_with_error_by(:email, params[resource_name][:email], :not_found)
-
-        if valid_captcha_or_security_question?(resource, params)
-          self.resource = resource_class.send_reset_password_instructions(params[resource_name])
-          if successfully_sent?(resource)
-            respond_with({}, location: new_session_path(resource_name))
-          else
-            respond_with(resource)
-          end
-        else
-          flash[:alert] = t('devise.invalid_security_question') if is_navigational_format?
-          respond_with({}, location: new_password_path(resource_name))
-        end
-      end
-    end
-  end
-end

data/lib/devise-security/patches/registrations_controller_captcha.rb

@@ -1,35 +0,0 @@
-# frozen_string_literal: true
-
-module DeviseSecurity::Patches
-  module RegistrationsControllerCaptcha
-    extend ActiveSupport::Concern
-    included do
-      define_method :create do |&block|
-        build_resource(sign_up_params)
-
-        if valid_captcha_if_defined?(params[:captcha])
-          if resource.save
-            block.call(resource) if block
-            if resource.active_for_authentication?
-              set_flash_message :notice, :signed_up if is_flashing_format?
-              sign_up(resource_name, resource)
-              respond_with resource, location: after_sign_up_path_for(resource)
-            else
-              set_flash_message :notice, :"signed_up_but_#{resource.inactive_message}" if is_flashing_format?
-              expire_data_after_sign_in!
-              respond_with resource, location: after_inactive_sign_up_path_for(resource)
-            end
-          else
-            clean_up_passwords resource
-            respond_with resource
-          end
-
-        else
-          resource.errors.add :base, t('devise.invalid_captcha')
-          clean_up_passwords resource
-          respond_with resource
-        end
-      end
-    end
-  end
-end

data/lib/devise-security/patches/sessions_controller_captcha.rb

@@ -1,26 +0,0 @@
-# frozen_string_literal: true
-
-module DeviseSecurity::Patches
-  module SessionsControllerCaptcha
-    extend ActiveSupport::Concern
-    included do
-      define_method :create do |&block|
-        if valid_captcha_if_defined?(params[:captcha])
-          self.resource = warden.authenticate!(auth_options)
-          set_flash_message(:notice, :signed_in) if is_flashing_format?
-          sign_in(resource_name, resource)
-          block.call(resource) if block
-          respond_with resource, location: after_sign_in_path_for(resource)
-        else
-          flash[:alert] = t('devise.invalid_captcha') if is_flashing_format?
-          respond_with({}, location: new_session_path(resource_name))
-        end
-      end
-
-      # for bad protected use in controller
-      define_method :auth_options do
-        { scope: resource_name, recall: "#{controller_path}#new" }
-      end
-    end
-  end
-end

data/lib/devise-security/patches/unlocks_controller_captcha.rb

@@ -1,22 +0,0 @@
-# frozen_string_literal: true
-
-module DeviseSecurity::Patches
-  module UnlocksControllerCaptcha
-    extend ActiveSupport::Concern
-    included do
-      define_method :create do
-        if valid_captcha_if_defined?(params[:captcha])
-          self.resource = resource_class.send_unlock_instructions(params[resource_name])
-          if successfully_sent?(resource)
-            respond_with({}, location: new_session_path(resource_name))
-          else
-            respond_with(resource)
-          end
-        else
-          flash[:alert] = t('devise.invalid_captcha') if is_navigational_format?
-          respond_with({}, location: new_unlock_path(resource_name))
-        end
-      end
-    end
-  end
-end

data/lib/devise-security/patches/unlocks_controller_security_question.rb

@@ -1,25 +0,0 @@
-# frozen_string_literal: true
-
-module DeviseSecurity::Patches
-  module UnlocksControllerSecurityQuestion
-    extend ActiveSupport::Concern
-    included do
-      define_method :create do
-        # only find via email, not login
-        resource = resource_class.find_or_initialize_with_error_by(:email, params[resource_name][:email], :not_found)
-
-        if valid_captcha_or_security_question?(resource, params)
-          self.resource = resource_class.send_unlock_instructions(params[resource_name])
-          if successfully_sent?(resource)
-            respond_with({}, location: new_session_path(resource_name))
-          else
-            respond_with(resource)
-          end
-        else
-          flash[:alert] = t('devise.invalid_security_question') if is_navigational_format?
-          respond_with({}, location: new_unlock_path(resource_name))
-        end
-      end
-    end
-  end
-end

data/test/dummy/lib/shared_user_without_email.rb

@@ -1,29 +0,0 @@
-# frozen_string_literal: true
-
-module SharedUserWithoutEmail
-  extend ActiveSupport::Concern
-
-  included do
-    # NOTE: This is missing :validatable and :confirmable, as they both require
-    # an email field at the moment. It is also missing :omniauthable because that
-    # adds unnecessary complexity to the setup
-    devise :database_authenticatable, :lockable, :recoverable,
-           :registerable, :rememberable, :timeoutable,
-           :trackable
-  end
-
-  # This test stub is a bit rubbish because it's tied very closely to the
-  # implementation where we care about this one case. However, completely
-  # removing the email field breaks "recoverable" tests completely, so we are
-  # just taking the approach here that "email" is something that is a not an
-  # ActiveRecord field.
-  def email_changed?
-    raise NoMethodError
-  end
-
-  def respond_to?(method_name, include_all = false)
-    return false if method_name.to_sym == :email_changed?
-
-    super(method_name, include_all)
-  end
-end