devise-suspicious_login 0.1.1

data/lib/suspicious_login.rb

@@ -0,0 +1,38 @@
+module SuspiciousLogin
+  autoload :Schema, 'suspcious_login/schema'
+  autoload :Patches, 'suspicious_login/patches'
+  autoload :Mailer, 'suspicious_login/mailer'
+
+  class MissingModelError < StandardError; end
+  class DeviseMissingFromModel < StandardError; end
+end
+
+require 'devise'
+require 'suspicious_login/model'
+require 'suspicious_login/rails'
+require 'suspicious_login/strategies/token'
+require 'colorize'
+
+module Devise
+  mattr_accessor :expire_login_token_after
+  @@expire_login_token_after = 10.minutes
+
+  mattr_accessor :resend_login_token_after
+  @@resend_login_token_after = 1.minute
+
+  mattr_accessor :dormant_sign_in_after
+  @@dormant_sign_in_after = 3.months
+
+  mattr_accessor :token_field_name
+  @@token_field_name = :login_token
+
+  mattr_accessor :token_created_at_field_name
+  @@token_created_at_field_name = :login_token_sent_at
+
+  mattr_accessor :clear_token_on_login
+  @@clear_token_on_login = true
+end
+
+I18n.load_path.unshift File.join(File.dirname(__FILE__), *%w[suspicious_login locales en.yml])
+
+Devise.add_module :suspicious_login, model: "suspicious_login/model"

data/lib/suspicious_login/controllers/helpers.rb

@@ -0,0 +1,6 @@
+module SuspiciousLogin::Controllers::Helpers
+  extend ActiveSupport::Concern
+
+  included do
+  end
+end

data/lib/suspicious_login/hooks/suspicious_login.rb

@@ -0,0 +1,8 @@
+Warden::Manager.after_set_user except: :fetch do |user, warden, opts|
+  if user && !user.token_login? && user.respond_to?(:suspicious?) && user.suspicious?(warden.request)
+    user.send_suspicious_login_instructions(warden.request) if user.login_token_sent_at.nil? || Time.now.utc - user.login_token_sent_at > Devise.resend_login_token_after
+    scope = opts[:scope]
+    warden.logout(scope) if warden.authenticated?(scope)
+    throw(:warden, message: I18n.t('devise.failure.suspicious_login'))
+  end
+end

data/lib/suspicious_login/mailer.rb

@@ -0,0 +1,11 @@
+module SuspiciousLogin
+  module Mailer
+    def suspicious_login_instructions(record, token=nil, opts={})
+      @record = record
+      @token = ERB::Util.url_encode(record.reset_suspicious_login_token!(token))
+      @reset_password_token = record.generate_reset_password_token!
+
+      devise_mail(record, :suspicious_login_instructions, opts)
+    end
+  end
+end

data/lib/suspicious_login/model.rb

@@ -0,0 +1,79 @@
+require "suspicious_login/hooks/suspicious_login"
+
+module Devise
+  module Models
+    module SuspiciousLogin
+      extend ActiveSupport::Concern
+
+      def self.required_fields(klass)
+        [Devise.token_field_name, Devise.token_created_at_field_name]
+      end
+
+      def generate_login_token
+        loop do
+          token = Devise.friendly_token
+          break token unless User.where(authentication_token: token).first
+        end
+      end
+
+      def generate_reset_password_token
+        raw, enc = Devise.token_generator.generate(self.class, :reset_password_token)
+        self.reset_password_token = enc
+        self.reset_password_sent_at = Time.now.utc
+        raw
+      end
+
+      def reset_suspicious_login_token(token=nil)
+        token = token || generate_login_token
+        self[Devise.token_field_name] = token
+        self[Devise.token_created_at_field_name] = Time.now.utc unless Devise.expire_login_token_after.blank?
+        token
+      end
+
+      def generate_reset_password_token!
+        token = generate_reset_password_token
+        save(validate: false)
+        token
+      end
+
+      def reset_suspicious_login_token!(token=nil)
+        token = reset_suspicious_login_token(token)
+        save(validate: false)
+        token
+      end
+
+      def clear_suspicious_login_token!
+        self[Devise.token_field_name] = nil
+        self[Devise.token_created_at_field_name] = nil
+        save(validate: false)
+      end
+
+      def after_login_token_authentication
+        clear_suspicious_login_token! if Devise.clear_token_on_login
+        @token_login = true
+      end
+
+      def suspicious?(request = {})
+        respond_to?(:suspicious_login_attempt?) ? suspicious_login_attempt?(request) || dormant_account?(request) : dormant_account?(request)
+      end
+
+      def send_suspicious_login_instructions(request = {})
+        send_devise_notification(:suspicious_login_instructions, nil, {})
+      end
+
+      def token_login?
+        @token_login || false
+      end
+
+      def dormant_account?(request)
+        return true if !(respond_to?(:last_sign_in_at))
+
+        !last_sign_in_at.nil? &&
+        !current_sign_in_ip.nil? &&
+        request.remote_ip != last_sign_in_ip &&
+        request.remote_ip != current_sign_in_ip &&
+        Time.now.utc - current_sign_in_at > Devise.dormant_sign_in_after
+      end
+    end
+  end
+end

data/lib/suspicious_login/patches.rb

@@ -0,0 +1,12 @@
+require 'suspicious_login/mailer'
+
+module SuspiciousLogin
+  module Patches
+    class << self
+      def apply
+        Devise.mailer.send(:include, SuspiciousLogin::Mailer)
+        Devise.mailer.send(:include, Devise::Mailers::Helpers) unless Devise.mailer.ancestors.include?(Devise::Mailers::Helpers)
+      end
+    end
+  end
+end

data/lib/suspicious_login/rails.rb

@@ -0,0 +1,9 @@
+require 'suspicious_login'
+
+module SuspiciousLogin
+  class Engine < ::Rails::Engine
+    ActiveSupport::Reloader.to_prepare do
+      SuspiciousLogin::Patches.apply
+    end
+  end
+end

data/lib/suspicious_login/schema.rb

@@ -0,0 +1,19 @@
+module SuspiciousLogin
+  module Schema
+    # # For a new resource migration:
+    # create_table :the_resource do |t|
+    #   t.login_token
+    # end
+
+    # # For existing resource, define a migration and add the following:
+    # change_table :the_resource do |t|
+    #   t.string login_token
+    #   t.datetime :login_token_sent_at
+    # end
+
+    def login_token
+      apply_devise_schema :login_token, String
+      apply_devise_schema :login_token_sent_at, DateTime
+    end
+  end
+end

data/lib/suspicious_login/strategies/token.rb

@@ -0,0 +1,54 @@
+require 'devise/strategies/base'
+
+module Devise
+  module Strategies
+    class SecureTokenAuthenticatable < Authenticatable
+      def store?
+        super
+      end
+
+      def valid?
+        resource_email.present? && login_token.present?
+      end
+
+      def authenticate!
+        resource = resource_email && mapping.to.find_by(:email => resource_email)
+
+        if resource
+          if Time.now.utc.to_i < (resource[Devise.token_created_at_field_name].to_i + token_expires_after.to_i) && Devise.secure_compare(resource[Devise.token_field_name], login_token)
+            resource.after_login_token_authentication
+            return success!(resource)
+          end
+        else
+          Devise.secure_compare("foo", login_token)
+          throw(:warden, message: I18n.t('devise.failure.invalid'))
+          return fail!
+        end
+      end
+
+      private
+
+      def valid_params_request?
+        true
+      end
+
+      def resource
+        @resource ||= mapping.to.find_by(:email => params)
+      end
+
+      def resource_email
+        @email ||= params[:email]
+      end
+
+      def login_token
+        @login_token ||= params[:login_token]
+      end
+
+      def token_expires_after
+        @token_expires_after ||= Devise.expire_login_token_after
+      end
+    end
+  end
+end
+
+Warden::Strategies.add(:suspicious_login_token, Devise::Strategies::SecureTokenAuthenticatable)

data/lib/suspicious_login/version.rb

@@ -0,0 +1,3 @@
+module SuspiciousLogin
+  VERSION = '0.1.1'
+end

data/test/dummy/Rakefile

@@ -0,0 +1,6 @@
+# Add your own tasks in files placed in lib/tasks ending in .rake,
+# for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
+
+require_relative 'config/application'
+
+Rails.application.load_tasks

data/test/dummy/app/controllers/application_controller.rb

@@ -0,0 +1,3 @@
+class ApplicationController < ActionController::Base
+  protect_from_forgery with: :exception
+end

data/test/dummy/app/controllers/home_controller.rb

@@ -0,0 +1,5 @@
+class HomeController < ::ApplicationController
+  before_action :authenticate_user!
+  def index
+  end
+end

data/test/dummy/app/mailers/application_mailer.rb

@@ -0,0 +1,4 @@
+class ApplicationMailer < ActionMailer::Base
+  default from: 'from@example.com'
+  layout 'mailer'
+end

data/test/dummy/app/models/application_record.rb

@@ -0,0 +1,3 @@
+class ApplicationRecord < ActiveRecord::Base
+  self.abstract_class = true
+end

data/test/dummy/app/models/user.rb

@@ -0,0 +1,9 @@
+class User < ApplicationRecord
+  devise :database_authenticatable, :recoverable, :registerable, :authenticatable, :trackable, :suspicious_login
+
+  has_many :ip_addresses
+
+  def suspicious_login_attempt?(request = nil)
+    email.include?("suspicious")
+  end
+end

data/test/dummy/bin/bundle

@@ -0,0 +1,3 @@
+#!/usr/bin/env ruby
+ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../Gemfile', __FILE__)
+load Gem.bin_path('bundler', 'bundle')

data/test/dummy/bin/rails

@@ -0,0 +1,4 @@
+#!/usr/bin/env ruby
+APP_PATH = File.expand_path('../config/application', __dir__)
+require_relative '../config/boot'
+require 'rails/commands'

data/test/dummy/bin/rake

@@ -0,0 +1,4 @@
+#!/usr/bin/env ruby
+require_relative '../config/boot'
+require 'rake'
+Rake.application.run

data/test/dummy/bin/setup

@@ -0,0 +1,38 @@
+#!/usr/bin/env ruby
+require 'pathname'
+require 'fileutils'
+include FileUtils
+
+# path to your application root.
+APP_ROOT = Pathname.new File.expand_path('../../', __FILE__)
+
+def system!(*args)
+  system(*args) || abort("\n== Command #{args} failed ==")
+end
+
+chdir APP_ROOT do
+  # This script is a starting point to setup your application.
+  # Add necessary setup steps to this file.
+
+  puts '== Installing dependencies =='
+  system! 'gem install bundler --conservative'
+  system('bundle check') || system!('bundle install')
+
+  # Install JavaScript dependencies if using Yarn
+  # system('bin/yarn')
+
+
+  # puts "\n== Copying sample files =="
+  # unless File.exist?('config/database.yml')
+  #   cp 'config/database.yml.sample', 'config/database.yml'
+  # end
+
+  puts "\n== Preparing database =="
+  system! 'bin/rails db:setup'
+
+  puts "\n== Removing old logs and tempfiles =="
+  system! 'bin/rails log:clear tmp:clear'
+
+  puts "\n== Restarting application server =="
+  system! 'bin/rails restart'
+end

data/test/dummy/bin/update

@@ -0,0 +1,29 @@
+#!/usr/bin/env ruby
+require 'pathname'
+require 'fileutils'
+include FileUtils
+
+# path to your application root.
+APP_ROOT = Pathname.new File.expand_path('../../', __FILE__)
+
+def system!(*args)
+  system(*args) || abort("\n== Command #{args} failed ==")
+end
+
+chdir APP_ROOT do
+  # This script is a way to update your development environment automatically.
+  # Add necessary update steps to this file.
+
+  puts '== Installing dependencies =='
+  system! 'gem install bundler --conservative'
+  system('bundle check') || system!('bundle install')
+
+  puts "\n== Updating database =="
+  system! 'bin/rails db:migrate'
+
+  puts "\n== Removing old logs and tempfiles =="
+  system! 'bin/rails log:clear tmp:clear'
+
+  puts "\n== Restarting application server =="
+  system! 'bin/rails restart'
+end

data/test/dummy/bin/yarn

@@ -0,0 +1,11 @@
+#!/usr/bin/env ruby
+VENDOR_PATH = File.expand_path('..', __dir__)
+Dir.chdir(VENDOR_PATH) do
+  begin
+    exec "yarnpkg #{ARGV.join(" ")}"
+  rescue Errno::ENOENT
+    $stderr.puts "Yarn executable was not detected in the system."
+    $stderr.puts "Download Yarn at https://yarnpkg.com/en/docs/install"
+    exit 1
+  end
+end

data/test/dummy/config.ru

@@ -0,0 +1,5 @@
+# This file is used by Rack-based servers to start the application.
+
+require_relative 'config/environment'
+
+run Rails.application

data/test/dummy/config/application.rb

@@ -0,0 +1,17 @@
+require_relative 'boot'
+
+require 'rails/all'
+
+Bundler.require(*Rails.groups)
+require "suspicious_login"
+
+module Dummy
+  class Application < Rails::Application
+    config.active_record.sqlite3.represent_boolean_as_integer = true
+    config.encoding = 'utf-8'
+    config.filter_parameters += [:password]
+    config.assets.enabled = true
+    config.assets.version = '1.0'
+    config.secret_key_base = 'change_me'
+  end
+end

data/test/dummy/config/boot.rb

@@ -0,0 +1,5 @@
+# Set up gems listed in the Gemfile.
+ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../../Gemfile', __dir__)
+
+require 'bundler/setup' if File.exist?(ENV['BUNDLE_GEMFILE'])
+$LOAD_PATH.unshift File.expand_path('../../../lib', __dir__)

data/test/dummy/config/database.yml

@@ -0,0 +1,21 @@
+# SQLite version 3.x
+#   gem install sqlite3
+#
+#   Ensure the SQLite 3 gem is defined in your Gemfile
+#   gem 'sqlite3'
+#
+default: &default
+  adapter: sqlite3
+  pool: <%= ENV.fetch("RAILS_MAX_THREADS") { 5 } %>
+  timeout: 5000
+
+development:
+  <<: *default
+  database: db/development.sqlite3
+
+# Warning: The database defined as "test" will be erased and
+# re-generated from your development database when you run "rake".
+# Do not set this db to the same as development or production.
+test:
+  <<: *default
+  database: db/test.sqlite3