devise_challenge_questionable 0.1.1

checksums.yaml

@@ -0,0 +1,7 @@
+--- 
+SHA1: 
+  metadata.gz: be8f8f0325e99887de470960d55a3fc9c1b37ec7
+  data.tar.gz: fdaa87f16cfc9d30b8b20406525e3e5b193cbb9e
+SHA512: 
+  metadata.gz: d81bc9b249d222646417c525eaad2c68f87d404a0c49d777a02dc33bcf677c1bf0e40b6d8e65307c590dd5b793c35caf914d8a366a6fc548e43e8d01f7091066
+  data.tar.gz: dfefac2714845f6aff75bd17c11b0e515a821bf47bb2e9956033d9386bbadc43febe77289038f5d35c566c8344609ee5b797e9f70d808589abb5688715676c8d

data/.gitignore

@@ -0,0 +1,20 @@
+*.gem
+.bundle
+Gemfile.lock
+pkg/*
+
+# Temporary files of every sort
+.DS_Store
+.idea
+.rvmrc
+.stgit*
+*.swap
+*.swo
+*.swp
+*~
+bin/*
+nbproject
+patches-*
+capybara-*.html
+dump.rdb
+*.ids

data/Gemfile

@@ -0,0 +1,4 @@
+source "http://rubygems.org"
+
+# Specify your gem's dependencies in devise_ip_filter.gemspec
+gemspec

data/LICENSE

@@ -0,0 +1,19 @@
+Copyright (C) 2012 Dmitrii Golub
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,136 @@
+## Challenge questions plugin for Devise
+
+This plugin forces a two step login process.  After entering username and password, you must then answer a challenge question.  Unlike security questions which are typically used when doing things like changing passwords, the challenge question must be answered each time logging in.  You can set which users(or preferred resource) need to answer a challenge question
+## Features
+
+* configure max challenge question attempts
+* configure number of challenge questions stored for each {resource}
+* per {resource} level control if he really need challenge question authentication
+
+## Configuration
+
+### Initial Setup
+
+In a Rails environment, require the gem in your Gemfile:
+
+    gem 'devise_challenge_questionable'
+
+Once that's done, run:
+
+    bundle install
+
+
+### Automatic installation
+
+In order to add challenge questions to a model, run the command:
+
+    bundle exec rails g devise_challenge_questionable MODEL
+    
+    bundle exec rails g devise_challenge_questionable:install
+    
+    bundle exec rails g devise_challenge_questionable:views {resource}s
+
+Where MODEL is your model name (e.g. User or Admin). This generator will add `:challenge_questionable` to your model
+and create a migration in `db/migrate/`, which will add `:reset_challenge_questions_token` and `:challenge_question_failed_attempts` to your table.
+Finally, run the migration with:
+
+    bundle exec rake db:migrate
+
+
+### Manual installation
+
+To manually enable challenge questions for the {Resource} model, you should add the following. Set up relationships. You should already have a devise line so you would just add :challenge_questionable to it.  Also, you need to allow accessibility to `:{resource}_challenge_questions_attributes`.  Replace {resource} with whatever resource you are using. Typically it would be {resource} or admin.
+
+```ruby
+  has_many :{resource}_challenge_questions, :validate => true, :inverse_of => :{resource}
+  accepts_nested_attributes_for :{resource}_challenge_questions, :allow_destroy => true
+  
+  devise :challenge_questionable
+  
+  attr_accessible :{resource}_challenge_questions_attributes
+```
+
+You also need to add the `{resource}_challenge_question.rb` Model.
+
+```ruby
+  class {Resource}ChallengeQuestion < ActiveRecord::Base
+    belongs_to :{resource}
+
+    validates :challenge_question, :challenge_answer, :presence => true
+    validates :challenge_answer, :length => { :in => 4..56 }, :format => {:with => /^[\w\s:]*$/, :message => "can not contain special characters"}, :allow_blank => true
+
+    # Must use custom validation since uniqueness scope will not work with has_many association
+    validate :challenge_question_uniqueness
+    validate :challenge_answer_uniqueness
+    validate :challenge_answer_repeating
+
+    before_save :digest_challenge_answer
+
+    def digest_challenge_answer
+      write_attribute(:challenge_answer, Digest::MD5.hexdigest(self.challenge_answer.downcase)) unless self.challenge_answer.nil?
+    end
+  
+    private
+    def challenge_question_uniqueness
+      if self.challenge_question.present? && self.{resource}.{resource}_challenge_questions.select{|q| q.challenge_question == self.challenge_question}.count > 1
+        errors.add(:challenge_question, 'can only be used once')
+      end
+    end
+
+    def challenge_answer_uniqueness
+      if  self.challenge_answer.present? && self.{resource}.{resource}_challenge_questions.select{|q| q.challenge_answer == self.challenge_answer}.count > 1
+        errors.add(:challenge_answer, 'can only be used once')
+      end
+    end
+  
+    def challenge_answer_repeating
+      if self.challenge_answer.present? && self.challenge_answer =~ /(.)\1{2,}/
+        errors.add(:challenge_answer, 'can not have more then two repeating characters in a row')
+      end
+    end
+  end
+```
+
+Locales:
+
+```yaml
+  en:
+    activerecord:
+      attributes:
+        user:
+          user_challenge_questions:
+            challenge_question: "Question"
+            challenge_answer: "Answer"
+    devise:
+      challenge_questions:
+        attempt_failed: "Attempt failed."
+        updated_challenge_questions: "Successfully updated challenge questions."
+        send_instructions: "You will receive an email with instructions about how to reset your challenge questions in a few minutes."
+```
+
+Configuration settings
+
+```ruby
+  # ==> Configuration for :challenge_questionable
+  # Max challenge question attempts
+  config.max_challenge_question_attempts = 3
+
+  # Number of challenge questions to store for each {resource}
+  config.number_of_challenge_questions = 3
+
+  # Default challenge question options
+  config.challenge_questions = ["What was your high school mascot?","In which city was your first elementary school?","In which city was your mother born?","What is the name of your favorite movie?","Who is your favorite athlete?","What was your most memorable gift as a child?","What is your favorite cartoon character?","What is the name of your favorite novel?","Name of favorite childhood pet?","What is the name of your elementary school?","What is your youngest child's middle name?","Last Name of your kindergarten teacher?","What is the first name of your grandmother (your father's mother)?","What is your spouse's nickname?","Name of the place where your wedding reception was held?","Name of a college you applied to but did not attend?","What is the first name of the youngest of your siblings?","What is the first name of the eldest of your siblings?","What is your favorite television show?","If you needed a new first name, what would it be?","What is the first name of your youngest child?","When is your mother's birthday (MM/DD)?","What is your eldest child's middle name?","What is the last name of the funniest friend you know?","Name the highest mountain you've been to the top of?","What is the first name of your grandmother (your mother's mother)?","What is the first name of your grandfather (your mother's father)?","What was the first name of your best man/maid of honor?","What was the last name of your first grade teacher?","What is the last name of your first boyfriend or girlfriend?","Which high school did you attend?","What was your major during college?","What was the name of your first pet?","What was your favorite place from your childhood?","What is your favorite song?","What is your favorite car?","What is your mother’s middle name?","What is the (MM/DD) of your employment?","What is the make/model of first car?","What is the name of the city or town where you were born?","What is the name of your favorite childhood teacher?","What is the name of your favorite childhood friend?","What are your oldest sibling’s (MM/YYYY) of birth?","What is your oldest sibling’s middle name?","What school did you attend for sixth grade?","On what street did you live in third grade?"]
+
+```
+
+### Customization
+
+By default challenge questions are enabled for each {resource}, you can change it with this method in your User model:
+
+```ruby
+  def need_challenge_questions?(request)
+    request.ip != '127.0.0.1'
+  end
+```
+
+this will disable challenge questions for local {resource}s

data/Rakefile

@@ -0,0 +1 @@
+require "bundler/gem_tasks"

data/app/controllers/devise/challenge_questions_controller.rb

@@ -0,0 +1,106 @@
+class Devise::ChallengeQuestionsController < ApplicationController
+  include Devise::Controllers::InternalHelpers
+  prepend_before_filter :require_no_authentication, :only => [ :new, :create, :edit, :update ]
+  prepend_before_filter :authenticate_scope!, :only => [:show, :authenticate, :manage, :forgot]
+  before_filter :prepare_and_validate, :handle_challenge_questions, :only => [:show, :authenticate] 
+  
+  # GET /resource/challenge_question/new
+  def new
+    build_resource
+    render_with_scope :new
+  end
+  
+  # POST /resource/challenge_question
+  def create
+    self.resource = resource_class.send_reset_challenge_questions_instructions(params[resource_name])
+    
+    if resource.errors.empty?
+      set_flash_message :notice, :send_instructions
+      redirect_to new_session_path(resource_name)
+    else
+      render_with_scope :new
+    end
+  end
+  
+  # GET /resource/challenge_question/edit?reset_challenge_questions_token=abcdef
+  def edit
+    self.resource = resource_class.new
+    resource.reset_challenge_questions_token = params[:reset_challenge_questions_token]
+    Devise.number_of_challenge_questions.times { resource.send("#{resource_name}_challenge_questions").build }
+    render_with_scope :edit
+  end
+  
+  # PUT /resource/challenge_question
+  def update
+    self.resource = resource_class.reset_challenge_questions_by_token(params[resource_name])
+
+    if resource.errors.empty?
+      set_flash_message :notice, :updated_challenge_questions
+      redirect_to :root
+    else
+      render_with_scope :edit
+    end
+  end
+
+  # GET /resource/challenge_question
+  def show
+    @challenge_question = resource.send("#{resource_name}_challenge_questions").sample
+    if @challenge_question.nil?
+      resource.set_reset_challenge_questions_token
+      sign_out(resource)
+      redirect_to edit_challenge_question_path(resource, :reset_challenge_questions_token => resource.reset_challenge_questions_token) 
+    else
+      render_with_scope :show
+    end
+  end
+
+  def authenticate
+    render_with_scope :show and return if params[:challenge_answer].nil?
+    @challenge_question = resource.send("#{resource_name}_challenge_questions").find(params[:challenge_question_id])
+    md5 = Digest::MD5.hexdigest(params[:challenge_answer].downcase)
+    if md5.eql?(@challenge_question.challenge_answer)
+      warden.session(resource_name)[:need_challenge_questions] = false
+      sign_in resource_name, resource
+      redirect_to stored_location_for(resource_name) || :root
+      resource.update_attribute(:challenge_question_failed_attempts, 0)
+    else
+      resource.challenge_question_failed_attempts += 1
+      resource.save
+      set_flash_message :notice, :attempt_failed
+      if resource.max_challenge_question_attempts?
+        resource.max_challenge_question_lock_account
+        sign_out(resource)
+        render_with_scope :max_challenge_question_attempts_reached and return
+      else
+        redirect_to send("#{resource_name}_challenge_question_path")
+      end
+    end
+  end
+  
+  # Build token and redirect
+  def manage
+    resource.set_reset_challenge_questions_token
+    sign_out(resource)
+    redirect_to edit_challenge_question_path(resource, :reset_challenge_questions_token => resource.reset_challenge_questions_token) 
+  end
+  
+  def forgot
+    sign_out(resource)
+    redirect_to new_challenge_question_path(resource_name) 
+  end
+
+  private
+
+    def authenticate_scope!
+      self.resource = send("current_#{resource_name}")
+    end
+
+    def prepare_and_validate
+      redirect_to :root and return if resource.nil?
+      @limit = resource.class.max_challenge_question_attempts
+      if resource.max_challenge_question_attempts?
+        sign_out(resource)
+        render_with_scope :max_challenge_question_attempts_reached and return
+      end
+    end
+end

data/app/views/devise/challenge_questions/edit.html.erb

@@ -0,0 +1,64 @@
+<h3>Change Your Challenge Questions</h3>
+<p>Change your current challenge questions by filling out the form below. The questions you set up previously will be replaced with these new questions. All fields are required.</p>
+
+<fieldset>
+  <h4>Please select <%= Devise.number_of_challenge_questions %> questions below, 1 from each drop down. Then type your answers in the field provided.</h4>
+  <%= form_for(resource, :as => resource_name, :url => challenge_question_path(resource_name), :html => { :method => :put }) do |f| %>
+    <%= devise_error_messages! %>
+    <%= f.hidden_field :id %>
+    <%= f.hidden_field :reset_challenge_questions_token %>
+  
+    <%= f.fields_for :"#{resource_name}_challenge_questions", resource.send("#{resource_name}_challenge_questions") do |cq| %>
+      <% if cq.object.new_record? %>
+        <p>
+          Question: <%= cq.select :challenge_question, Devise.challenge_questions.shuffle, :prompt => 'Please select a question' %>
+          <br />
+          Answer:&nbsp;&nbsp;&nbsp; <%= cq.text_field :challenge_answer, :placeholder => "Type your answer here", :autocomplete => "off" %>
+          <hr>
+        </p>
+      <% end %>
+    <% end %>
+    <p>Remember, your current Challenge Questions will be overwritten.</p>
+    <p><%= f.submit "Change my challenge questions" %></p>
+  <% end %>
+</fieldset>
+
+<%- content_for :sidebar do %>
+  <div>
+    <h3>Tips for Creating Security Questions</h3>
+    <ul>
+      <li>1. Please choose questions with clear answers that you can remember easily.</li>
+      <li>2. All questions must be answered.</li>
+      <li>3. You cannot use the same answer for more than 1 question.</li>
+      <li>4. Answers must have between 3 and 56 characters.</li>
+      <li>5. Answers cannot have more than 2 repeating characters in a row.</li>
+      <li>6. Special characters, such as & and () are not allowed.</li>
+      <li>7. Answers are not case sensitive.</li>
+    </ul>
+  </div>
+<% end %>
+
+<script type="text/javascript" language="javascript">
+  if (window.jQuery) {
+    jQuery(document).ready(function() {
+      $("select").change(function () {
+        var $this = $(this);
+        var prevVal = $this.data("prev");
+        var otherSelects = $("select").not(this);
+        otherSelects.find('option:contains('+ $(this).val() +')').attr('disabled', 'disabled');
+        if (prevVal) {
+            otherSelects.find('option:contains('+ prevVal +')').removeAttr('disabled');
+        }  
+        $this.data("prev", $this.val());
+      });
+  
+      $("select").each(function () {
+        var $this = $(this);
+        var prevVal = $this.data("prev");
+        var otherSelects = $("select").not(this);
+        otherSelects.find('option:contains('+ $(this).val() +')').attr('disabled', 'disabled');  
+        $this.data("prev", $this.val());
+      });
+    });
+  }
+</script>

data/app/views/devise/challenge_questions/max_challenge_question_attempts_reached.html.erb

@@ -0,0 +1,11 @@
+<h3>Please contact your system administrator.</h3>
+
+<fieldset>
+  <p>
+    Access denied as you have reached your max challenge question attempts.
+  </p>
+  <p>
+    <%= link_to "Forgot your challenge questions?", new_challenge_question_path(resource_name) %>
+  </p>
+</fieldset>
+

data/app/views/devise/challenge_questions/new.html.erb

@@ -0,0 +1,12 @@
+<h3>Forgot your challenge questions?</h3>
+
+<%= form_for(resource, :as => resource_name, :url => challenge_question_path(resource_name), :html => { :method => :post }) do |f| %>
+  <fieldset>
+    <%= devise_error_messages! %>
+
+    <p><%= f.label :email %><br />
+    <%= f.text_field :email, :autocomplete => "off", :placeholder => "example@email.com" %></p>
+
+    <p><%= f.submit "Send me reset challenge question instructions" %></p>
+  </fieldset>
+<% end %>

data/app/views/devise/challenge_questions/show.html.erb

@@ -0,0 +1,20 @@
+<h3>Answer the challenge question below</h3>
+
+<%= form_tag([:authenticate, resource_name, :challenge_question], :method => :put) do %>
+  <fieldset>
+    <p>
+      <%= hidden_field_tag :challenge_question_id, @challenge_question.id%>
+      <%= label_tag :challege_question, @challenge_question.challenge_question %>
+      <br>
+      <%= password_field_tag :challenge_answer, nil, :placeholder => 'Answer', :class => 'wide', :style => 'font-size: 1.8em;padding:5px', :autofocus => 'true', :autocomplete => "off" %>
+    </p>
+    <p>
+      <%= submit_tag "Submit", :style => 'font-size:1.8em;'%>
+      or
+      <%= link_to "Cancel", destroy_user_session_path %>
+    </p>
+    <p>
+      <%= link_to "Forgot your challenge questions?", forgot_challenge_question_path(resource_name) %>
+    </p>
+  </fieldset>
+<% end %>

data/app/views/devise/mailer/reset_challenge_questions_instructions.html.erb

@@ -0,0 +1,8 @@
+<p>Hello <%= @resource.email %>!</p>
+
+<p>Someone has requested a link to change your challenge questions, and you can do this through the link below.</p>
+
+<p><%= link_to 'Change my challenge questions', edit_challenge_question_url(@resource, :reset_challenge_questions_token => @resource.reset_challenge_questions_token) %></p>
+
+<p>If you didn't request this, please ignore this email.</p>
+<p>Your challenge questions won't change until you access the link above and create a new ones.</p>

data/config/locales/en.yml

@@ -0,0 +1,13 @@
+en:
+  activerecord:
+    attributes:
+      user:
+        user_challenge_questions:
+          challenge_question: "Question"
+          challenge_answer: "Answer"
+  devise:
+    challenge_questions:
+      attempt_failed: "Attempt failed."
+      updated_challenge_questions: "Successfully updated challenge questions."
+      send_instructions: "You will receive an email with instructions about how to reset your challenge questions in a few minutes."
+ 

data/devise_challenge_questionable.gemspec

@@ -0,0 +1,29 @@
+# -*- encoding: utf-8 -*-
+$:.push File.expand_path("../lib", __FILE__)
+require "devise_challenge_questionable/version"
+
+Gem::Specification.new do |s|
+  s.name        = "devise_challenge_questionable"
+  s.version     = DeviseChallengeQuestionable::VERSION.dup
+  s.authors     = ["Andrew Kennedy"]
+  s.email       = ["andrew@akennedy.io"]
+  s.homepage    = "https://github.com/akennedy/devise_challenge_questionable"
+  s.summary     = %q{Challenge question plugin for devise}
+  s.description = <<-EOF
+    ### Features ###
+    * configure max challenge question attempts
+    * per user level control if he really need challenge questions
+  EOF
+
+  s.rubyforge_project = "devise_challenge_questionable"
+
+  s.files         = `git ls-files`.split("\n")
+  s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
+  s.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
+  s.require_paths = ["lib"]
+
+  s.add_runtime_dependency 'rails', '3.0.20'
+  s.add_runtime_dependency 'devise', '1.1.3'
+
+  s.add_development_dependency 'bundler'
+end

data/lib/devise_challenge_questionable.rb

@@ -0,0 +1,32 @@
+require 'devise_challenge_questionable/version'
+require 'devise'
+require 'digest'
+require 'active_support/concern'
+
+module Devise
+  mattr_accessor :max_challenge_question_attempts
+  @@max_challenge_question_attempts = 3
+  
+  mattr_accessor :challenge_questions 
+  @@challenge_questions = ["What was your high school mascot?","In which city was your first elementary school?","In which city was your mother born?","What is the name of your favorite movie?","Who is your favorite athlete?","What was your most memorable gift as a child?","What is your favorite cartoon character?","What is the name of your favorite novel?","Name of favorite childhood pet?","What is the name of your elementary school?","What is your youngest child's middle name?","Last Name of your kindergarten teacher?","What is the first name of your grandmother (your father's mother)?","What is your spouse's nickname?","Name of the place where your wedding reception was held?","Name of a college you applied to but did not attend?","What is the first name of the youngest of your siblings?","What is the first name of the eldest of your siblings?","What is your favorite television show?","If you needed a new first name, what would it be?","What is the first name of your youngest child?","When is your mother's birthday (MM/DD)?","What is your eldest child's middle name?","What is the last name of the funniest friend you know?","Name the highest mountain you've been to the top of?","What is the first name of your grandmother (your mother's mother)?","What is the first name of your grandfather (your mother's father)?","What was the first name of your best man/maid of honor?","What was the last name of your first grade teacher?","What is the last name of your first boyfriend or girlfriend?","Which high school did you attend?","What was your major during college?","What was the name of your first pet?","What was your favorite place from your childhood?","What is your favorite song?","What is your favorite car?","What is your mother’s middle name?","What is the (MM/DD) of your employment?","What is the make/model of first car?","What is the name of the city or town where you were born?","What is the name of your favorite childhood teacher?","What is the name of your favorite childhood friend?","What are your oldest sibling’s (MM/YYYY) of birth?","What is your oldest sibling’s middle name?","What school did you attend for sixth grade?","On what street did you live in third grade?"]
+
+  
+  mattr_accessor :number_of_challenge_questions
+  @@number_of_challenge_questions = 3
+end
+
+module DeviseChallengeQuestionable
+  autoload :Schema, 'devise_challenge_questionable/schema'
+  module Controllers
+    autoload :Helpers, 'devise_challenge_questionable/controllers/helpers'
+    autoload :UrlHelpers, 'devise_challenge_questionable/controllers/url_helpers'
+  end
+end
+
+Devise.add_module :challenge_questionable, :model => 'devise_challenge_questionable/model', :controller => :challenge_questions, :route => :challenge_question
+
+require 'devise_challenge_questionable/mailer'
+require 'devise_challenge_questionable/routes'
+require 'devise_challenge_questionable/model'
+require 'devise_challenge_questionable/rails'
+

data/lib/devise_challenge_questionable/controllers/helpers.rb

@@ -0,0 +1,39 @@
+module DeviseChallengeQuestionable
+  module Controllers
+    module Helpers
+      extend ActiveSupport::Concern
+
+      included do
+        before_filter :handle_challenge_questions
+      end
+
+      private
+
+      def handle_challenge_questions
+        unless devise_controller? && (controller_name != 'registrations' && ![:edit, :update, :destroy].include?(action_name))
+          Devise.mappings.keys.flatten.any? do |scope|
+            if signed_in?(scope) and warden.session(scope)[:need_challenge_questions]
+              failed_challenge_question(scope)
+            end
+          end
+        end
+      end
+
+      def failed_challenge_question(scope)
+        if request.format.present? and request.format.html?
+          session["#{scope}_return_to"] = request.path if request.get?
+          redirect_to challenge_questions_path_for(scope)
+        else
+          render :nothing => true, :status => :unauthorized
+        end
+      end
+
+      def challenge_questions_path_for(resource_or_scope = nil)
+        scope = Devise::Mapping.find_scope!(resource_or_scope)
+        change_path = "#{scope}_challenge_question_path"
+        send(change_path)
+      end
+
+    end
+  end
+end

data/lib/devise_challenge_questionable/controllers/url_helpers.rb

@@ -0,0 +1,24 @@
+module DeviseChallengeQuestionable
+  module Controllers
+    module UrlHelpers
+      [:path, :url].each do |path_or_url|
+        [nil, :edit_, :authenticate_, :manage_, :forgot_].each do |action|
+          class_eval <<-URL_HELPERS, __FILE__, __LINE__ + 1
+            def #{action}challenge_question_#{path_or_url}(resource, *args)
+              resource = case resource
+                when Symbol, String
+                  resource
+                when Class
+                  resource.name.underscore
+                else
+                  resource.class.name.underscore
+              end
+              
+              send("#{action}\#{resource}_challenge_question_#{path_or_url}", *args)
+            end
+          URL_HELPERS
+        end
+      end
+    end
+  end
+end

data/lib/devise_challenge_questionable/hooks/challenge_questions.rb

@@ -0,0 +1,5 @@
+Warden::Manager.after_authentication do |user, auth, options|
+  if user.respond_to?(:need_challenge_questions?)
+    auth.session(options[:scope])[:need_challenge_questions] = user.need_challenge_questions?(auth.request)
+  end
+end

data/lib/devise_challenge_questionable/mailer.rb

@@ -0,0 +1,8 @@
+module DeviseChallengeQuestionable
+  module Mailer
+    # Deliver reset challenge question instructions when is requested
+    def reset_challenge_questions_instructions(record)
+      setup_mail(record, :reset_challenge_questions_instructions)
+    end
+  end
+end

data/lib/devise_challenge_questionable/model.rb

@@ -0,0 +1,102 @@
+require 'devise_challenge_questionable/hooks/challenge_questions'
+module Devise
+  module Models
+    module ChallengeQuestionable
+      extend ActiveSupport::Concern
+      
+      # Update challenge questions saving the record and clearing token. Returns true if
+      # the challenge questions are valid and the record was saved, false otherwise.
+      def reset_challenge_questions!(attributes)
+        self.send("#{self.class.name.underscore}_challenge_questions").destroy_all
+        self.attributes = {"#{self.class.name.underscore}_challenge_questions_attributes" => attributes["#{self.class.name.underscore}_challenge_questions_attributes"]}       
+        clear_reset_challenge_questions_token if self.valid?
+        self.save
+      end
+
+      def need_challenge_questions?(request)
+        true
+      end
+      
+      def max_challenge_question_lock_account
+        self.lock_access! if self.class.lock_strategy_enabled?(:failed_attempts)
+      end
+
+      def max_challenge_question_attempts?
+        challenge_question_failed_attempts >= self.class.max_challenge_question_attempts
+      end
+      
+      # Resets reset challenge question token and send reset challenge question instructions by email
+      def send_reset_challenge_questions_instructions
+        generate_reset_challenge_questions_token!
+        ::Devise.mailer.reset_challenge_questions_instructions(self).deliver
+      end
+      
+      # Generates a new random token for reset challenge_question
+      def set_reset_challenge_questions_token
+        generate_reset_challenge_questions_token!
+      end
+      
+      def unlock_access_including_challenge_questions!
+        if_access_locked do
+          self.locked_at = nil
+          self.failed_attempts = 0 if respond_to?(:failed_attempts=)
+          self.challenge_question_failed_attempts = 0 if respond_to?(:challenge_question_failed_attempts=)
+          self.unlock_token = nil  if respond_to?(:unlock_token=)
+          save(:validate => false)
+        end
+      end
+      
+      protected
+
+        # Generates a new random token for reset challenge_question
+        def generate_reset_challenge_questions_token
+          self.reset_challenge_questions_token = self.class.reset_challenge_questions_token
+        end
+
+        # Resets the reset challenge_question token with and save the record without
+        # validating
+        def generate_reset_challenge_questions_token!
+          generate_reset_challenge_questions_token && save(:validate => false)
+        end
+
+        # Removes reset_challenge_question token
+        def clear_reset_challenge_questions_token
+          self.reset_challenge_questions_token = nil
+        end
+        
+        def clear_challenge_question_failed_attempts
+          self.challenge_question_failed_attempts = 0
+        end
+        
+      module ClassMethods
+        ::Devise::Models.config(self, :max_challenge_question_attempts)
+        
+        # Attempt to find a user by it's email. If a record is found, send new
+        # challenge_question instructions to it. If not user is found, returns a new user
+        # with an email not found error.
+        # Attributes must contain the user email
+        def send_reset_challenge_questions_instructions(attributes={})
+          challenge_questionable = find_or_initialize_with_error_by(:email, attributes[:email], :not_found)
+          challenge_questionable.send_reset_challenge_questions_instructions if challenge_questionable.persisted?
+          challenge_questionable
+        end
+
+        # Generate a token checking if one does not already exist in the database.
+        def reset_challenge_questions_token
+          generate_token(:reset_challenge_questions_token)
+        end
+
+        # Attempt to find a user by it's reset_challenge_questions_token to reset it's
+        # challenge_question. If a user is found, reset it's challenge_question and automatically
+        # try saving the record. If not user is found, returns a new user
+        # containing an error in reset_challenge_questions_token attribute.
+        # Attributes must contain reset_challenge_questions_token, challenge_question and confirmation
+        def reset_challenge_questions_by_token(attributes={})
+          challenge_questionable = find_or_initialize_with_error_by(:reset_challenge_questions_token, attributes[:reset_challenge_questions_token])
+          challenge_questionable.reset_challenge_questions!(attributes) if challenge_questionable.persisted?
+          challenge_questionable
+        end
+      end
+    end
+  end
+end

data/lib/devise_challenge_questionable/rails.rb

@@ -0,0 +1,21 @@
+module DeviseChallengeQuestionable
+  class Engine < ::Rails::Engine
+    ActiveSupport.on_load(:action_controller) { include DeviseChallengeQuestionable::Controllers::Helpers }  
+    ActiveSupport.on_load(:action_controller) { include DeviseChallengeQuestionable::Controllers::UrlHelpers }
+    ActiveSupport.on_load(:action_view) { include DeviseChallengeQuestionable::Controllers::UrlHelpers }
+    
+    # We use to_prepare instead of after_initialize here because Devise is a Rails engine; its
+    # mailer is reloaded like the rest of the user's app.  Got to make sure that our mailer methods
+    # are included each time Devise::Mailer is (re)loaded.
+    config.to_prepare do
+      require 'devise/mailer'
+      Devise::Mailer.send :include, DeviseChallengeQuestionable::Mailer
+    end
+    
+    
+    initializer "devise.add_filters" do |app|
+      app.config.filter_parameters += [:challenge_answer, :reset_challenge_questions_token]
+      app.config.filter_parameters.uniq
+    end
+  end
+end

data/lib/devise_challenge_questionable/routes.rb

@@ -0,0 +1,13 @@
+module ActionDispatch::Routing
+  class Mapper
+    protected
+
+      def devise_challenge_question(mapping, controllers)
+        resource :challenge_question, :only => [:show, :new, :create, :edit, :update], :path => mapping.path_names[:challenge_question], :controller => controllers[:challenge_questions] do
+          put :authenticate, :path => mapping.path_names[:authenticate]
+          get :manage, :path => mapping.path_names[:manage]
+          get :forgot, :path => mapping.path_names[:forgot]
+        end
+      end
+  end
+end

data/lib/devise_challenge_questionable/schema.rb

@@ -0,0 +1,7 @@
+module DeviseChallengeQuestionable
+  module Schema
+    # def second_factor_attempts_count
+    #   apply_devise_schema :second_factor_attempts_count, Integer, :default => 0
+    # end
+  end
+end

data/lib/devise_challenge_questionable/version.rb

@@ -0,0 +1,3 @@
+module DeviseChallengeQuestionable
+  VERSION = "0.1.1"
+end

data/lib/generators/active_record/devise_challenge_questionable_generator.rb

@@ -0,0 +1,14 @@
+require 'rails/generators/active_record'
+
+module ActiveRecord
+  module Generators
+    class DeviseChallengeQuestionableGenerator < ActiveRecord::Generators::Base
+      source_root File.expand_path("../templates", __FILE__)
+
+      def copy_migration
+        migration_template "migration.rb", "db/migrate/devise_challenge_questionable_add_to_#{table_name}"
+      end
+
+    end
+  end
+end

data/lib/generators/active_record/templates/migration.rb

@@ -0,0 +1,21 @@
+class DeviseChallengeQuestionableAddTo<%= table_name.camelize %> < ActiveRecord::Migration  
+  def self.up
+    add_column :<%= table_name %>, :reset_challenge_questions_token, :string
+    add_column :<%= table_name %>, :challenge_question_failed_attempts, :integer, :default => 0
+    
+    create_table :<%= class_name.underscore %>_challenge_questions do |t|
+      t.integer :<%= table_name.singularize %>_id
+      t.string  :challenge_question
+      t.string  :challenge_answer
+      t.timestamps
+    end
+    
+  end
+
+  def self.down
+    drop_table :<%= class_name.underscore %>_challenge_questions
+    remove_column :<%= table_name %>, :reset_challenge_questions_token
+    remove_column :<%= table_name %>, :challenge_question_failed_attempts
+  end
+
+end

data/lib/generators/devise_challenge_questionable/devise_challenge_questionable_generator.rb

@@ -0,0 +1,95 @@
+module DeviseChallengeQuestionable
+  module Generators
+    class DeviseChallengeQuestionableGenerator < Rails::Generators::NamedBase
+      source_root File.expand_path("../templates", __FILE__)
+      namespace "devise_challenge_questionable"
+
+      desc "Adds :challenge_questionable directive in the given model. It also generates an active record migration."
+
+      def inject_devise_challenge_questionable_content
+        path = File.join("app", "models", "#{file_path}.rb")
+        inject_into_file(path, "challenge_questionable, :", :after => "devise :") if File.exists?(path)
+        inject_into_file(path, "user_challenge_questions_attributes, :", :after => "attr_accessible :") if File.exists?(path)
+        inject_into_file path, :after => "class #{class_name} < ActiveRecord::Base\n" do
+<<-CONTENT
+  has_many :#{class_name.underscore}_challenge_questions, :validate => true, :inverse_of => :user
+  accepts_nested_attributes_for :#{class_name.underscore}_challenge_questions, :allow_destroy => true
+CONTENT
+        end if File.exists?(path)
+      end
+      
+      def generate_model
+        invoke "active_record:model", ["#{file_path}_challenge_question"], :migration => false
+      end
+      
+      def inject_scope_challenge_question_content
+        path = File.join("app", "models", "#{file_path}_challenge_question.rb")
+        inject_into_file path, :before => /^end/ do
+<<-CONTENT
+  belongs_to :#{class_name.underscore}
+
+  validates :challenge_question, :challenge_answer, :presence => true
+  validates :challenge_answer, :length => { :in => 3..56 }, :format => {:with => /^[\\w\\s:]*$/, :message => "can not contain special characters"}, :allow_blank => true
+
+  # Must use custom validation since uniqueness scope will not work with has_many association
+  validate :challenge_question_uniqueness
+  validate :challenge_answer_uniqueness
+  validate :challenge_answer_repeating
+
+  before_save :digest_challenge_answer
+
+  def digest_challenge_answer
+    write_attribute(:challenge_answer, Digest::MD5.hexdigest(self.challenge_answer.downcase)) unless self.challenge_answer.nil?
+  end
+  
+  private
+  def challenge_question_uniqueness
+    if self.challenge_question.present? && self.#{class_name.underscore}.#{class_name.underscore}_challenge_questions.select{|q| q.challenge_question == self.challenge_question}.count > 1
+      errors.add(:challenge_question, 'can only be used once')
+    end
+  end
+
+  def challenge_answer_uniqueness
+    if  self.challenge_answer.present? && self.#{class_name.underscore}.#{class_name.underscore}_challenge_questions.select{|q| q.challenge_answer == self.challenge_answer}.count > 1
+      errors.add(:challenge_answer, 'can only be used once')
+    end
+  end
+  
+  def challenge_answer_repeating
+    if self.challenge_answer.present? && self.challenge_answer =~ /(.)\1{2,}/
+      errors.add(:challenge_answer, 'can not have more then two repeating characters in a row')
+    end
+  end
+CONTENT
+        end if File.exists?(path)
+      end
+      
+      def inject_localization_model_content
+        path = File.join("config", "locales", "devise.en.yml")
+        inject_into_file path, :after => "en:\n" do
+<<-CONTENT
+  activerecord:
+    attributes:
+      #{class_name.underscore}:
+        #{class_name.underscore}_challenge_questions:
+          challenge_question: "Question"
+          challenge_answer: "Answer"
+CONTENT
+        end if File.exists?(path)
+        inject_into_file path, :after => "devise:\n" do
+<<-CONTENT
+    challenge_questions:
+      attempt_failed: "Attempt failed."
+      updated_challenge_questions: "Successfully updated challenge questions."
+      send_instructions: "You will receive an email with instructions about how to reset your challenge questions in a few minutes."
+CONTENT
+        end if File.exists?(path)
+      end
+      
+      hook_for :orm
+
+    end
+  end
+end
+
+

data/lib/generators/devise_challenge_questionable/install_generator.rb

@@ -0,0 +1,35 @@
+module DeviseChallengeQuestionable
+  module Generators
+    class InstallGenerator < Rails::Generators::Base
+      source_root File.expand_path("../../templates", __FILE__)
+      desc "Add DeviseChallengeQuestionable config variables to the Devise initializer and copy DeviseChallengeQuestionable locale files to your application."
+      
+      def add_config_options_to_initializer
+        devise_initializer_path = "config/initializers/devise.rb"
+        if File.exist?(devise_initializer_path)
+          old_content = File.read(devise_initializer_path)
+          
+          if old_content.match(Regexp.new(/^\s# ==> Configuration for :challenge_questionable\n/))
+            false
+          else
+            inject_into_file(devise_initializer_path, :before => "  # ==> Configuration for :confirmable\n") do
+<<-CONTENT
+  # ==> Configuration for :challenge_questionable
+  # Max challenge question attempts
+  config.max_challenge_question_attempts = 3
+  
+  # Number of challenge questions to store for each user
+  config.number_of_challenge_questions = 3
+  
+  # Default challenge question options
+  config.challenge_questions = ["What was your high school mascot?","In which city was your first elementary school?","In which city was your mother born?","What is the name of your favorite movie?","Who is your favorite athlete?","What was your most memorable gift as a child?","What is your favorite cartoon character?","What is the name of your favorite novel?","Name of favorite childhood pet?","What is the name of your elementary school?","What is your youngest child's middle name?","Last Name of your kindergarten teacher?","What is the first name of your grandmother (your father's mother)?","What is your spouse's nickname?","Name of the place where your wedding reception was held?","Name of a college you applied to but did not attend?","What is the first name of the youngest of your siblings?","What is the first name of the eldest of your siblings?","What is your favorite television show?","If you needed a new first name, what would it be?","What is the first name of your youngest child?","When is your mother's birthday (MM/DD)?","What is your eldest child's middle name?","What is the last name of the funniest friend you know?","Name the highest mountain you've been to the top of?","What is the first name of your grandmother (your mother's mother)?","What is the first name of your grandfather (your mother's father)?","What was the first name of your best man/maid of honor?","What was the last name of your first grade teacher?","What is the last name of your first boyfriend or girlfriend?","Which high school did you attend?","What was your major during college?","What was the name of your first pet?","What was your favorite place from your childhood?","What is your favorite song?","What is your favorite car?","What is your mother’s middle name?","What is the (MM/DD) of your employment?","What is the make/model of first car?","What is the name of the city or town where you were born?","What is the name of your favorite childhood teacher?","What is the name of your favorite childhood friend?","What are your oldest sibling’s (MM/YYYY) of birth?","What is your oldest sibling’s middle name?","What school did you attend for sixth grade?","On what street did you live in third grade?"]
+  
+CONTENT
+            end
+          end
+        end
+      end
+      
+    end
+  end
+end

data/lib/generators/devise_challenge_questionable/templates/challenge_question_model.rb

@@ -0,0 +1,14 @@
+class <%= class_name %>ChallengeQuestion < ActiveRecord::Base
+  
+  belongs_to :<%= class_name.underscore %>
+  
+  validates :challenge_question, :uniqueness => {:scope => :<%= class_name.underscore %>_id}
+  validates :challenge_answer, :presence => true
+  
+  before_save :digest_challenge_answer
+  
+  def digest_challenge_answer
+    write_attribute(:challenge_answer, Digest::MD5.hexdigest(self.challenge_answer)) unless self.challenge_answer.nil?
+  end
+  
+end

data/lib/generators/devise_challenge_questionable/views_generator.rb

@@ -0,0 +1,10 @@
+require 'generators/devise/views_generator'
+
+module DeviseChallengeQuestionable
+  module Generators
+    class ViewsGenerator < Devise::Generators::ViewsGenerator
+      source_root File.expand_path("../../../../app/views", __FILE__)
+      desc 'Copies all DeviseChallengeQuestionable views to your application.'
+    end
+  end
+end

metadata

@@ -0,0 +1,108 @@
+--- !ruby/object:Gem::Specification 
+name: devise_challenge_questionable
+version: !ruby/object:Gem::Version 
+  version: 0.1.1
+platform: ruby
+authors: 
+- Andrew Kennedy
+autorequire: 
+bindir: bin
+cert_chain: []
+
+date: 2014-01-23 00:00:00 Z
+dependencies: 
+- !ruby/object:Gem::Dependency 
+  name: rails
+  prerelease: false
+  requirement: &id001 !ruby/object:Gem::Requirement 
+    requirements: 
+    - - "="
+      - !ruby/object:Gem::Version 
+        version: 3.0.20
+  type: :runtime
+  version_requirements: *id001
+- !ruby/object:Gem::Dependency 
+  name: devise
+  prerelease: false
+  requirement: &id002 !ruby/object:Gem::Requirement 
+    requirements: 
+    - - "="
+      - !ruby/object:Gem::Version 
+        version: 1.1.3
+  type: :runtime
+  version_requirements: *id002
+- !ruby/object:Gem::Dependency 
+  name: bundler
+  prerelease: false
+  requirement: &id003 !ruby/object:Gem::Requirement 
+    requirements: 
+    - &id004 
+      - ">="
+      - !ruby/object:Gem::Version 
+        version: "0"
+  type: :development
+  version_requirements: *id003
+description: "    ### Features ###\n    * configure max challenge question attempts\n    * per user level control if he really need challenge questions\n"
+email: 
+- andrew@akennedy.io
+executables: []
+
+extensions: []
+
+extra_rdoc_files: []
+
+files: 
+- .gitignore
+- Gemfile
+- LICENSE
+- README.md
+- Rakefile
+- app/controllers/devise/challenge_questions_controller.rb
+- app/views/devise/challenge_questions/edit.html.erb
+- app/views/devise/challenge_questions/max_challenge_question_attempts_reached.html.erb
+- app/views/devise/challenge_questions/new.html.erb
+- app/views/devise/challenge_questions/show.html.erb
+- app/views/devise/mailer/reset_challenge_questions_instructions.html.erb
+- config/locales/en.yml
+- devise_challenge_questionable.gemspec
+- lib/devise_challenge_questionable.rb
+- lib/devise_challenge_questionable/controllers/helpers.rb
+- lib/devise_challenge_questionable/controllers/url_helpers.rb
+- lib/devise_challenge_questionable/hooks/challenge_questions.rb
+- lib/devise_challenge_questionable/mailer.rb
+- lib/devise_challenge_questionable/model.rb
+- lib/devise_challenge_questionable/rails.rb
+- lib/devise_challenge_questionable/routes.rb
+- lib/devise_challenge_questionable/schema.rb
+- lib/devise_challenge_questionable/version.rb
+- lib/generators/active_record/devise_challenge_questionable_generator.rb
+- lib/generators/active_record/templates/migration.rb
+- lib/generators/devise_challenge_questionable/devise_challenge_questionable_generator.rb
+- lib/generators/devise_challenge_questionable/install_generator.rb
+- lib/generators/devise_challenge_questionable/templates/challenge_question_model.rb
+- lib/generators/devise_challenge_questionable/views_generator.rb
+homepage: https://github.com/akennedy/devise_challenge_questionable
+licenses: []
+
+metadata: {}
+
+post_install_message: 
+rdoc_options: []
+
+require_paths: 
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement 
+  requirements: 
+  - *id004
+required_rubygems_version: !ruby/object:Gem::Requirement 
+  requirements: 
+  - *id004
+requirements: []
+
+rubyforge_project: devise_challenge_questionable
+rubygems_version: 2.0.13
+signing_key: 
+specification_version: 4
+summary: Challenge question plugin for devise
+test_files: []
+