devise-two-factor 2.1.0 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8b48e2ba9c00be8daeb003205e6e0eb391541a0d
-  data.tar.gz: fddf7caf9e1ac9bcf03c4f9b9a41e481001ab13b
+  metadata.gz: 49da530a07a8536cd97a273716ac420983b6d5c5
+  data.tar.gz: 096e65bcf25b0a075c86f759ff8d96c1ac74e1e0
 SHA512:
-  metadata.gz: 2066c0f7459ad2b244d1fba4cfa0f6fbd3d7f6c421eee04a716b3a9c874afa7c986230b1adf919fd67f9e19476f68616d2a5048ce393b359ca5261c5905388ce
-  data.tar.gz: 69801b25f82ee866d7e843a326640aab0e566f37a1b54603be2df11b02caf0040ee81b2ab5c7256f7c0fca23eeb493f123e0c98ca05095aa0dc15c65701d7b38
+  metadata.gz: bb74672142accc67af59a6f4af54b7984e2e7ef72649c5cc089bf55702c9c7fb6443b4c07adcffce8ed8a78b9bb928c557c674fd1ca6b08587c146a4ecbc05fc
+  data.tar.gz: 2e5de1659867d6308c2987eb05dddda217ac9165d81e70b1fb036d8b4d2dbc8832dd24fa4c21c1b189935b9b941face1144cce62191af2a8be9cc42a0cc51de2

data/.travis.yml

@@ -5,8 +5,7 @@ before_install:
   - gem update --system
   - gem update bundler
 rvm:
-  - "1.9.3"
   - "2.0.0"
   - "2.1"
   - "2.2"
-  - jruby-19mode # JRuby in 1.9 mode
+  - "2.3.0"

data/UPGRADING.md

@@ -1,3 +1,21 @@
+# Guide to upgrading from 2.x to 3.x
+
+Pull request #73 allows for compatibility with `attr_encrypted` 2.0. This version changes many of the defaults which must be taken into account to avoid corrupted OTP secrets on your model.
+
+Due to new security practices in `attr_encrypted` an encryption key with insufficient length will cause an error. If you run into this, you may set `insecure_mode: true` in the `attr_encrypted` options.
+
+You should initially add compatibility by specifying the `attr_encrypted` attribute in your model (`User` for these examples) with the old default encryption algorithm before invoking `devise :two_factor_authenticatable`:
+```ruby
+class User < ActiveRecord::Base
+  attr_encrypted :otp_secret,
+    :key       => self.otp_secret_encryption_key,
+    :mode      => :per_attribute_iv_and_salt,
+    :algorithm => 'aes-256-cbc'
+
+  devise :two_factor_authenticatable,
+         :otp_secret_encryption_key => ENV['DEVISE_TWO_FACTOR_ENCRYPTION_KEY']
+```
+
 # Guide to upgrading from 1.x to 2.x
 
 Pull request #43 added a new field to protect against "shoulder-surfing" attacks. If upgrading, you'll need to add the `:consumed_timestep` column to your `Users` model.

data/devise-two-factor.gemspec

@@ -26,7 +26,7 @@ Gem::Specification.new do |s|
 
   s.add_runtime_dependency 'railties'
   s.add_runtime_dependency 'activesupport'
-  s.add_runtime_dependency 'attr_encrypted', '~> 1.3'
+  s.add_runtime_dependency 'attr_encrypted', '>= 1.3', '< 4'
   s.add_runtime_dependency 'devise',         '~> 3.5'
   s.add_runtime_dependency 'rotp',           '~> 2.0'
 

data/lib/devise-two-factor.rb

@@ -5,7 +5,7 @@ require 'devise_two_factor/strategies'
 module Devise
   # The length of generated OTP secrets
   mattr_accessor :otp_secret_length
-  @@otp_secret_length = 128
+  @@otp_secret_length = 24
 
   # The number of seconds before and after the current
   # time for which codes will be accepted

data/lib/devise_two_factor/models/two_factor_authenticatable.rb

@@ -8,8 +8,15 @@ module Devise
       include Devise::Models::DatabaseAuthenticatable
 
       included do
-        attr_encrypted :otp_secret, :key  => self.otp_secret_encryption_key,
-                                    :mode => :per_attribute_iv_and_salt unless self.attr_encrypted?(:otp_secret)
+        unless singleton_class.ancestors.include?(AttrEncrypted)
+          extend AttrEncrypted
+        end
+
+        unless attr_encrypted?(:otp_secret)
+          attr_encrypted :otp_secret,
+            :key  => self.otp_secret_encryption_key,
+            :mode => :per_attribute_iv_and_salt unless self.attr_encrypted?(:otp_secret)
+        end
 
         attr_accessor :otp_attempt
       end

data/lib/devise_two_factor/version.rb

@@ -1,3 +1,3 @@
 module DeviseTwoFactor
-   VERSION = '2.1.0'.freeze
+   VERSION = '2.2.0'.freeze
 end

data/spec/devise/models/two_factor_authenticatable_spec.rb

@@ -8,7 +8,32 @@ class TwoFactorAuthenticatableDouble
 
   define_model_callbacks :update
 
-  devise :two_factor_authenticatable, :otp_secret_encryption_key => 'test-key'
+  devise :two_factor_authenticatable, :otp_secret_encryption_key => 'test-key'*4
+
+  attr_accessor :consumed_timestep
+
+  def save(validate)
+    # noop for testing
+    true
+  end
+end
+
+class TwoFactorAuthenticatableWithCustomizeAttrEncryptedDouble
+  extend ::ActiveModel::Callbacks
+  include ::ActiveModel::Validations::Callbacks
+
+  # like https://github.com/tinfoil/devise-two-factor/blob/cf73e52043fbe45b74d68d02bc859522ad22fe73/UPGRADING.md#guide-to-upgrading-from-2x-to-3x
+  extend ::AttrEncrypted
+  attr_encrypted :otp_secret,
+                  :key       => 'test-key'*8,
+                  :mode      => :per_attribute_iv_and_salt,
+                  :algorithm => 'aes-256-cbc'
+
+  extend  ::Devise::Models
+
+  define_model_callbacks :update
+
+  devise :two_factor_authenticatable, :otp_secret_encryption_key => 'test-key'*4
 
   attr_accessor :consumed_timestep
 
@@ -25,3 +50,30 @@ describe ::Devise::Models::TwoFactorAuthenticatable do
     it_behaves_like 'two_factor_authenticatable'
   end
 end
+
+describe ::Devise::Models::TwoFactorAuthenticatable do
+  context 'When included in a class' do
+    subject { TwoFactorAuthenticatableWithCustomizeAttrEncryptedDouble.new }
+
+    it_behaves_like 'two_factor_authenticatable'
+
+    before :each do
+      subject.otp_secret = subject.class.generate_otp_secret
+      subject.consumed_timestep = nil
+    end
+
+    describe 'otp_secret options' do
+      it 'should be of the key' do
+        expect(subject.encrypted_attributes[:otp_secret][:key]).to eq('test-key'*8)
+      end
+
+      it 'should be of the mode' do
+        expect(subject.encrypted_attributes[:otp_secret][:mode]).to eq(:per_attribute_iv_and_salt)
+      end
+
+      it 'should be of the mode' do
+        expect(subject.encrypted_attributes[:otp_secret][:algorithm]).to eq('aes-256-cbc')
+      end
+    end
+  end
+end

data/spec/devise/models/two_factor_backupable_spec.rb

@@ -9,7 +9,7 @@ class TwoFactorBackupableDouble
   define_model_callbacks :update
 
   devise :two_factor_authenticatable, :two_factor_backupable,
-         :otp_secret_encryption_key => 'test-key'
+         :otp_secret_encryption_key => 'test-key'*4
 
   attr_accessor :otp_backup_codes
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: devise-two-factor
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 2.2.0
 platform: ruby
 authors:
 - Shane Wilton
@@ -84,7 +84,7 @@ cert_chain:
   5C31v4YyRBnNCp0pN66nxYX2avEiQ8riTBP5mlkPPOhsIoYQHHe2Uj75aVpu0LZ3
   cdFzuO4GC1dV0Wv+dsDm+MyF7DT5E9pUPXpnMJuPvPrFpCb+wrFlszW9hGjXbQ==
   -----END CERTIFICATE-----
-date: 2016-03-23 00:00:00.000000000 Z
+date: 2016-05-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -118,16 +118,22 @@ dependencies:
   name: attr_encrypted
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.3'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.3'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
 - !ruby/object:Gem::Dependency
   name: devise
   requirement: !ruby/object:Gem::Requirement
@@ -293,7 +299,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: devise-two-factor
-rubygems_version: 2.4.5.1
+rubygems_version: 2.6.3
 signing_key: 
 specification_version: 4
 summary: Barebones two-factor authentication with Devise