google-authenticator-rails 1.4.0 → 1.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1b0e27a878d00efaf2b62b132ee490bed3b51135
-  data.tar.gz: 20d199184ac7af414fa73af13f2ca25f09df9818
+  metadata.gz: 258692fbcd739848ad81f173e797cb59ba5d781e
+  data.tar.gz: f55e0f035fc69bbb9e9cb8b32b07dfe76a4c0314
 SHA512:
-  metadata.gz: 17402d2412a5d8eef21fc856f3db1c50df5258e141144b2680842836429e5ef69d286246519296d6a0112de3150c30e2203e1b6b543635632dcca4f756dc7f94
-  data.tar.gz: 139193758c98d494c3b143edf136190b0d4f90ab6800af6d077464c8e2d0ed464b205d1c2089803e5296ea396c0045038e49fa686fbc74c3dc00329e623893df
+  metadata.gz: 4e8b07d17935c0517c7b6cd2b988cc680299952950891a36758803b751f28d5602391f0c480cb3de7ff6b8d2cf5668a412bff25666bfec7c9e71c63ef11821b8
+  data.tar.gz: 3698e4f4ba7ab053dd21d85a0c318625e1bd47921e8c6e3d679babcea0c6045114758e7db80f3c9a97ff55b95a26ae5f983d6b22b315bbe78ab3f6397caeae4c

data/Appraisals

@@ -33,3 +33,7 @@ end
 appraise "rails5.0" do
   gem "activerecord", "~> 5.0.0"
 end
+
+appraise "rails5.1" do
+  gem "activerecord", "~> 5.1.0"
+end

data/README.md

@@ -31,8 +31,11 @@ end
 
 @user = User.new
 @user.set_google_secret           # => true
+@user.google_secret_value         # => 16-character plain-text secret, whatever the name of the secret column
 @user.google_qr_uri               # => http://path.to.google/qr?with=params
 @user.google_authentic?(123456)   # => true
+@user.clear_google_secret!        # => true
+@user.google_secret_value         # => nil
 ```
 
 ## Google Labels
@@ -327,13 +330,12 @@ If you want to manually destroy the MFA cookie (for example, when a user logs ou
 UserMfaSession::destroy
 ```
 
-## Storing Secrets in Encrypted Form
+## Storing Secrets in Encrypted Form (Rails 4.1 and above)
 
 Normally, if an attacker gets access to the application database, they will be able to generate correct authentication codes,
 elmininating the security gains from two-factor authentication. If the application's ```secret_key_base``` is handled more securely
 than the database (by, for example, never putting it on the server filesystem), protection against database compromise can
-be gained by setting the ```:encrypt_secrets``` option to ```true```. Newly-created secrets will then be stored in encrypted
-form.
+be gained by setting the ```:encrypt_secrets``` option to ```true```. Newly-created secrets will then be stored in encrypted form.
 
 Existing non-encrypted secrets for all models for which the ```:encrypt_secrets``` option has been set to ```true```
 can be encrypted by running
@@ -353,6 +355,10 @@ Then run
 ```
 to change all encrypted google secret fields to use the new key.
 
+If the app is not running under Rails version 4.1 or above, encryption will be disabled, and a warning issued if ```:encrypt_secrets```
+is enabled on a model.
+
+If encryption is enabled for a model, the Google secret column of its table must be able to hold at least 138 characters, rather than just 16.
 
 ## Contributing
 

data/config/secrets.yml

@@ -0,0 +1,3 @@
+test:
+  secret_key_base: ea13d27b89aaa5004212cc78552e2a1f0ceaa21f797de0089277506a036b1d450f8508eb51b838c04af477c6d03d7c8b0f3258937dc291935eb49c2a8f3fa9d9
+  old_secret_key_base: c9e4baab86ab1d7373eafd7fbc467b227d44e23608834ea5bdfc502bd33211d205f245a06ced789af579e8d77aa4c1bfd605065190ee24d3709ada92366cadfb

data/lib/google-authenticator-rails.rb

@@ -1,6 +1,5 @@
 # Stuff the gem requires
 #
-require 'rails'
 require 'active_support'
 require 'active_record'
 require 'openssl'
@@ -24,11 +23,15 @@ GOOGLE_AUTHENTICATOR_RAILS_PATH = File.dirname(__FILE__) + "/google-authenticato
 # Sets up some basic accessors for use with the ROTP module
 #
 module GoogleAuthenticatorRails
+  def self.encryption_supported?
+    defined?(Rails) && (Rails::VERSION::MAJOR > 4 || Rails::VERSION::MAJOR == 4 && Rails::VERSION::MINOR > 0)
+  end
+  
   class Railtie < Rails::Railtie
     rake_tasks do
       load 'tasks/google_authenticator.rake'
     end
-  end
+  end if encryption_supported? && !Rails.env.test? # Without this last condition tasks under test are run twice 
     
   # Drift is set to 6 because ROTP drift is not inclusive. This allows a drift of 5 seconds.
   DRIFT = 6
@@ -41,7 +44,7 @@ module GoogleAuthenticatorRails
 
   # Additional configuration passed to a Session::Persistence cookie.
   @@cookie_options = { :httponly => true }
-
+  
   def self.generate_password(secret, iteration)
     ROTP::HOTP.new(secret).at(iteration)
   end

data/lib/google-authenticator-rails/active_record/acts_as_google_authenticated.rb

@@ -97,6 +97,16 @@ module GoogleAuthenticatorRails # :nodoc:
           @google_issuer            = options[:issuer]
           @google_qr_size           = options[:qr_size]               || '200x200'
           @google_secrets_encrypted = !!options[:encrypt_secrets]
+          
+          if @google_secrets_encrypted && !GoogleAuthenticatorRails.encryption_supported?
+            msg = "Google secret encryption is only supported on Ruby on Rails 4.1 and above. Encryption has been disabled for #{name}."
+            if defined?(Rails) && !Rails.env.test?
+              Rails.logger.warn msg
+            else
+              puts msg
+            end 
+            @google_secrets_encrypted = false
+          end
 
           puts ":skip_attr_accessible is no longer required.  Called from #{Kernel.caller[0]}}" if options.has_key?(:skip_attr_accessible)
 

data/lib/google-authenticator-rails/active_record/helpers.rb

@@ -1,14 +1,19 @@
 module GoogleAuthenticatorRails # :nodoc:
   mattr_accessor :secret_encryptor
+  
   module ActiveRecord  # :nodoc:
     module Helpers
+      
+      # Returns and memoizes the plain text google secret for this instance, irrespective of the
+      # name of the google secret storage column and whether secret encryption is enabled for this model.
+      #
       def google_secret_value
         if @google_secret_value_cached
           @google_secret_value
         else
           @google_secret_value_cached = true
           secret_in_db = google_secret_column_value
-          @google_secret_value = secret_in_db && self.class.google_secrets_encrypted ? google_secret_encryptor.decrypt_and_verify(secret_in_db) : secret_in_db
+          @google_secret_value = secret_in_db.present? && self.class.google_secrets_encrypted ? google_secret_encryptor.decrypt_and_verify(secret_in_db) : secret_in_db
         end
       end
       
@@ -16,6 +21,12 @@ module GoogleAuthenticatorRails # :nodoc:
         change_google_secret_to!(GoogleAuthenticatorRails::generate_secret)
       end
 
+      # Sets and saves a nil google secret value for this instance.
+      #
+      def clear_google_secret!
+        change_google_secret_to!(nil)
+      end
+
       def google_authentic?(code)
         GoogleAuthenticatorRails.valid?(code, google_secret_value, self.class.google_drift)
       end
@@ -55,7 +66,7 @@ module GoogleAuthenticatorRails # :nodoc:
 
       def change_google_secret_to!(secret, encrypt = self.class.google_secrets_encrypted)
         @google_secret_value = secret
-        self.__send__("#{self.class.google_secret_column}=", secret && encrypt ? google_secret_encryptor.encrypt_and_sign(secret) : secret)
+        self.__send__("#{self.class.google_secret_column}=", secret.present? && encrypt ? google_secret_encryptor.encrypt_and_sign(secret) : secret)
         @google_secret_value_cached = true
         save!
       end

data/lib/google-authenticator-rails/version.rb

@@ -1,7 +1,7 @@
 module Google
   module Authenticator
     module Rails
-      VERSION = "1.4.0"
+      VERSION = "1.4.1"
     end
   end
 end

data/lib/tasks/google_authenticator.rake

@@ -1,27 +1,36 @@
 namespace :google_authenticator do
 
-  def do_encrypt(already_encrypted, op_name)
+  def do_encrypt(args, already_encrypted, op_name)
+    model_names = if args[:optional_model_list]
+                    args.extras.unshift(args[:optional_model_list])
+                  else
+                    # Adapted from https://stackoverflow.com/a/8248849/7478194
+                    Dir[Rails.root.join('app/models/*.rb').to_s].map { |filename| File.basename(filename, '.rb').camelize }
+                  end
+    
     ActiveRecord::Base.transaction do
-      match_op = " #{already_encrypted ? '>' : '='} 16"
-      # Adapted from https://stackoverflow.com/a/8248849/7478194
-      Dir[Rails.root.join('app/models/*.rb').to_s].each do |filename|
-        klass = File.basename(filename, '.rb').camelize.constantize
+      match_op = " = #{already_encrypted ? 138 : 16}"
+      model_names.each do |model_name|
+        klass = model_name.constantize
         next unless klass.ancestors.include?(ActiveRecord::Base) && klass.try(:google_secrets_encrypted)
-        puts "#{op_name} model #{klass.name.inspect} (table #{klass.table_name.inspect})"
+        print "#{op_name}ing model #{klass.name.inspect} (table #{klass.table_name.inspect}): "
+        count = 0
         klass.where("LENGTH(#{klass.google_secret_column})#{match_op}").find_each do |record|
           yield record
+          count += 1
         end
+        puts "#{count} #{'secret'.pluralize(count)} #{op_name}ed"
       end
     end
   end
   
-  desc 'Encrypt all secret columns (add the :encrypt_secret options *before* running)'
-  task encrypt_secrets: :environment do
-    do_encrypt(false, 'Encrypting') { |record| record.encrypt_google_secret! }
+  desc 'Encrypt all secret columns (add the :encrypt_secrets options *before* running)'
+  task :encrypt_secrets, [:optional_model_list] => :environment do |_t, args|
+    do_encrypt(args, false, 'Encrypt') { |record| record.encrypt_google_secret! }
   end
 
   desc 'Re-encrypt all secret columns from old_secret_key_base to secret_key_base'
-  task reencrypt_secrets: :environment do
+  task :reencrypt_secrets, [:optional_model_list] => :environment do |_t, args|
     if Rails.application.secrets.old_secret_key_base.blank?
       puts 'old_secret_key_base is not set in config/secrets.yml'
     else
@@ -29,7 +38,7 @@ namespace :google_authenticator do
       Rails.application.secrets[:secret_key_base] = Rails.application.secrets.old_secret_key_base
       Rails.application.instance_eval { @caching_key_generator = nil }
       old_secret_encryptor = GoogleAuthenticatorRails::ActiveRecord::Helpers.get_google_secret_encryptor
-      do_encrypt(true, 'Re-encrypting') do |record|
+      do_encrypt(args, true, 'Re-encrypt') do |record|
         GoogleAuthenticatorRails.secret_encryptor = old_secret_encryptor
         plain_secret = record.google_secret_value
         GoogleAuthenticatorRails.secret_encryptor = secret_encryptor
@@ -38,9 +47,9 @@ namespace :google_authenticator do
     end
   end
   
-  desc 'Decrypt all secret columns (remove the :encrypt_secret options *after* running)'
-  task decrypt_secrets: :environment do
-    do_encrypt(true, 'Decrypting') { |record| record.send(:change_google_secret_to!, record.google_secret_value, false) }
+  desc 'Decrypt all secret columns (remove the :encrypt_secrets options *after* running)'
+  task :decrypt_secrets, [:optional_model_list] => :environment do |_t, args|
+    do_encrypt(args, true, 'Decrypt') { |record| record.send(:change_google_secret_to!, record.google_secret_value, false) }
   end  
 
 end

data/spec/google_authenticator_spec.rb

@@ -1,11 +1,6 @@
 require 'spec_helper'
 
 describe GoogleAuthenticatorRails do
-  let(:random32) { "5qlcip7azyjuwm36" }
-  before do
-    ROTP::Base32.stub!(:random_base32).and_return(random32)
-  end
-
   describe '#generate_password' do
     subject { GoogleAuthenticatorRails::generate_password("test", counter) }
 
@@ -21,144 +16,258 @@ describe GoogleAuthenticatorRails do
   end
 
   context 'time-based passwords' do
-    let!(:time)   { Time.parse("2012-08-07 11:11:11 AM +0700") }
-    let(:secret)  { "test" }
-    let(:code)    { 922511 }
-    before        { Time.stub!(:now).and_return(time) }
-
-    specify { GoogleAuthenticatorRails::time_based_password(secret).should == code }
-    specify { GoogleAuthenticatorRails::valid?(code, secret).should be true }
-
-    specify { GoogleAuthenticatorRails::valid?(code * 2, secret).should be false }
-    specify { GoogleAuthenticatorRails::valid?(code, secret * 2).should be false }
-  end
-
-  it 'can create a secret' do
-    GoogleAuthenticatorRails::generate_secret.should == random32
-  end
+    let(:secret)         { '5qlcip7azyjuwm36' }
+    let(:original_time)  { Time.parse("2012-08-07 11:11:00 AM +0700") }
+    let!(:time)          { original_time }
+    let(:code)           { 495502 }
 
-  context 'integration with ActiveRecord' do
-    let(:original_time) { Time.parse("2012-08-07 11:11:00 AM +0700") }
-    let!(:time)         { original_time }
-    let(:user)          { User.create(:email => "test@example.com", :user_name => "test_user") }
     before do
       Time.stub!(:now).and_return(time)
-      user.google_secret = "test"
+      ROTP::Base32.stub!(:random_base32).and_return(secret)
     end
 
-    context "custom drift" do
-      # 30 seconds drift
-      let(:user) { DriftUser.create(:email => "test@example.com", :user_name => "test_user") }
-      subject { user.google_authentic?(922511) }
-
-      context '6 seconds of drift' do
-        let(:time)  { original_time + 36.seconds }
-        it          { should be true }
-      end
-
-      context '30 seconds of drift' do
-        let(:time)  { original_time + 61.seconds }
-        it          { should be false }
-      end
-    end
-
-    context 'code validation' do
-      subject { user.google_authentic?(922511) }
-
-      it { should be true }
+    specify { GoogleAuthenticatorRails::time_based_password(secret).should == code }
+    specify { GoogleAuthenticatorRails::valid?(code, secret).should be true }
 
-      context 'within 5 seconds of drift' do
-        let(:time)  { original_time + 34.seconds }
-        it          { should be true }
-      end
+    specify { GoogleAuthenticatorRails::valid?(code * 2, secret).should be false }
+    specify { GoogleAuthenticatorRails::valid?(code, secret * 2).should be false }
 
-      context '6 seconds of drift' do
-        let(:time)  { original_time + 36.seconds }
-        it          { should be false }
-      end
+    it 'can create a secret' do
+      GoogleAuthenticatorRails::generate_secret.should == secret
     end
 
-    it 'creates a secret' do
-      user.set_google_secret
-      user.google_secret.should == random32
-    end
+    context 'integration with ActiveRecord' do
+      let(:user) { UserFactory.create User }
 
-    context 'secret column' do
       before do
-        GoogleAuthenticatorRails.stub!(:generate_secret).and_return("test")
-        @user = CustomUser.create(:email => "test@example.com", :user_name => "test_user")
-        @user.set_google_secret
+        @user = user
+        user.google_secret = secret
       end
-
-      it 'validates code' do
-        @user.google_authentic?(922511).should be_true
+  
+      context "custom drift" do
+        # 30 seconds drift
+        let(:user) { UserFactory.create DriftUser }
+        subject { user.google_authentic?(code) }
+  
+        context '6 seconds of drift' do
+          let(:time)  { original_time + 36.seconds }
+          it          { should be true }
+        end
+  
+        context '30 seconds of drift' do
+          let(:time)  { original_time + 61.seconds }
+          it          { should be false }
+        end
       end
-
-      it 'generates a url for a qr code' do
-        @user.google_qr_uri.should == "https://chart.googleapis.com/chart?cht=qr&chl=otpauth%3A%2F%2Ftotp%2Ftest%40example.com%3Fsecret%3Dtest&chs=200x200"
+  
+      context 'code validation' do
+        subject { user.google_authentic?(code) }
+  
+        it { should be true }
+  
+        context 'within 5 seconds of drift' do
+          let(:time)  { original_time + 34.seconds }
+          it          { should be true }
+        end
+  
+        context '6 seconds of drift' do
+          let(:time)  { original_time + 36.seconds }
+          it          { should be false }
+        end
       end
-    end
-
-    context 'google label' do
-      let(:user)    { NilMethodUser.create(:email => "test@example.com", :user_name => "test_user") }
-      subject       { lambda { user.google_label } }
-      it            { should raise_error(NoMethodError) }
-    end
-
-    context "drift value" do
-      it { DriftUser.google_drift.should == 31 }
-
-      context "default value" do
-        it { User.google_drift.should == 6 }
+  
+      it 'creates a secret' do
+        user.set_google_secret
+        user.google_secret.should == secret
       end
-    end
-
-    context 'qr codes' do
-      let(:options) { { :email => "test@example.com", :user_name => "test_user" } }
-      let(:user)  { User.create options }
-      before      { user.set_google_secret }
-      subject     { user.google_qr_uri }
-
-      it { should eq "https://chart.googleapis.com/chart?cht=qr&chl=otpauth%3A%2F%2Ftotp%2Ftest%40example.com%3Fsecret%3D5qlcip7azyjuwm36&chs=200x200" }
-
-      context 'custom column name' do
-        let(:user) { ColumnNameUser.create options }
-        it { should eq "https://chart.googleapis.com/chart?cht=qr&chl=otpauth%3A%2F%2Ftotp%2Ftest_user%3Fsecret%3D5qlcip7azyjuwm36&chs=200x200" }
+      
+      shared_examples 'handles nil secrets' do
+        it 'clears a secret' do
+          @user.clear_google_secret!
+          @user.google_secret_value.should(be_nil) && @user.reload.google_secret_value.should(be_nil)
+        end
       end
 
-      context 'custom proc' do
-        let(:user) { ProcUser.create options }
-        it { should eq "https://chart.googleapis.com/chart?cht=qr&chl=otpauth%3A%2F%2Ftotp%2Ftest_user%40futureadvisor-admin%3Fsecret%3D5qlcip7azyjuwm36&chs=200x200" }
+      it_behaves_like 'handles nil secrets'
+
+      context 'encrypted column' do
+        before do
+          @user = UserFactory.create EncryptedUser
+          @user.set_google_secret
+        end
+        
+        it 'encrypts_the_secret' do
+          @user.google_secret.length.should == (GoogleAuthenticatorRails.encryption_supported? ? 138 : 16)
+        end
+        
+        it 'decrypts_the_secret' do
+          @user.google_secret_value.should == secret
+        end        
+        
+        it 'validates code' do
+          @user.google_authentic?(code).should be_true
+        end
+
+        it_behaves_like 'handles nil secrets'
       end
-
-      context 'method defined by symbol' do
-        let(:user) { SymbolUser.create options }
-        it { should eq "https://chart.googleapis.com/chart?cht=qr&chl=otpauth%3A%2F%2Ftotp%2Ftest%40example.com%3Fsecret%3D5qlcip7azyjuwm36&chs=200x200" }
+  
+      context 'custom secret column' do
+        before do
+          @user = UserFactory.create CustomUser
+          @user.set_google_secret
+        end
+  
+        it 'validates code' do
+          @user.google_authentic?(code).should be_true
+        end
+  
+        it 'generates a url for a qr code' do
+          @user.google_qr_uri.should == "https://chart.googleapis.com/chart?cht=qr&chl=otpauth%3A%2F%2Ftotp%2Ftest%40example.com%3Fsecret%3D#{secret}&chs=200x200"
+        end
       end
-
-      context 'method defined by string' do
-        let(:user) { StringUser.create options }
-        it { should eq "https://chart.googleapis.com/chart?cht=qr&chl=otpauth%3A%2F%2Ftotp%2Ftest%40example.com%3Fsecret%3D5qlcip7azyjuwm36&chs=200x200" }
+      
+      context 'encrypted column with custom secret column' do
+        before do
+          @user = UserFactory.create EncryptedCustomUser
+          @user.set_google_secret
+        end
+        
+        it 'encrypts the secret' do
+          @user.mfa_secret.length.should == (GoogleAuthenticatorRails.encryption_supported? ? 138 : 16)
+        end
+        
+        it 'decrypts the secret' do
+          @user.google_secret_value.should == secret
+        end        
+        
+        it 'validates code' do
+          @user.google_authentic?(code).should be_true
+        end
       end
-
-      context 'custom qr size' do
-        let(:user) { QrCodeUser.create options }
-        it { should eq "https://chart.googleapis.com/chart?cht=qr&chl=otpauth%3A%2F%2Ftotp%2Ftest%40example.com%3Fsecret%3D5qlcip7azyjuwm36&chs=300x300" }
+      
+      if GoogleAuthenticatorRails.encryption_supported?
+        context 'encryption Rake tasks' do
+          before(:all) { Rails.application.load_tasks }
+          
+          def set_and_run_task(type)
+            User.delete_all
+            EncryptedCustomUser.delete_all 
+            @user = UserFactory.create User
+            @user.set_google_secret
+            @encrypted_user = UserFactory.create EncryptedCustomUser
+            @encrypted_user.set_google_secret
+            @non_encrypted_user = UserFactory.create EncryptedCustomUser
+            @non_encrypted_user.update_attribute(:mfa_secret, secret)
+            Rake.application.invoke_task("google_authenticator:#{type}_secrets[User,EncryptedCustomUser]")
+          end  
+            
+          def encryption_ok?(user, secret_should_be_encrypted)
+            secret_value = user.reload.send(:google_secret_column_value)
+            (secret_value.blank? || secret_value.length.should == (secret_should_be_encrypted ? 138 : 16)) &&
+            (user.class.google_secrets_encrypted ^ secret_should_be_encrypted || user.google_secret_value == secret)
+          end
+  
+          shared_examples 'task tests' do |type|
+            it 'handles non-encrypted secrets' do
+              encryption_ok?(@non_encrypted_user, type == 'encrypt')
+            end
+            
+            it 'handles encrypted secrets' do
+              encryption_ok?(@encrypted_user, type != 'decrypt')
+            end
+            
+            it "doesn't #{type} non-encrypted models" do
+              encryption_ok?(@user, false)
+            end
+          end
+          
+          context 'encrypt_secrets task' do
+            before(:all) { set_and_run_task('encrypt') }
+            it_behaves_like 'task tests', 'encrypt'
+          end
+          
+          context 'decrypt_secrets task' do
+            before(:all) { set_and_run_task('decrypt') }
+            it_behaves_like 'task tests', 'decrypt'
+          end
+          
+          context 'reencrypt_secrets task' do
+            before(:all) do
+              def reset_encryption(secret_key_base)
+                Rails.application.secrets[:secret_key_base] = secret_key_base
+                Rails.application.instance_eval { @caching_key_generator = nil }
+                GoogleAuthenticatorRails.secret_encryptor = nil
+              end
+              
+              current_secret_key_base = Rails.application.secrets[:secret_key_base]
+              reset_encryption(Rails.application.secrets.old_secret_key_base)
+              set_and_run_task('reencrypt')
+              reset_encryption(current_secret_key_base)
+            end
+            
+            it_behaves_like 'task tests', 'reencrypt'
+          end
+        end
       end
-
-      context 'qr size passed to method' do
-        subject { user.google_qr_uri('400x400') }
-        let(:user) { StringUser.create options }  
-        it { should eq "https://chart.googleapis.com/chart?cht=qr&chl=otpauth%3A%2F%2Ftotp%2Ftest%40example.com%3Fsecret%3D5qlcip7azyjuwm36&chs=400x400" }
+      
+      context 'google label' do
+        let(:user)    { UserFactory.create NilMethodUser }
+        subject       { lambda { user.google_label } }
+        it            { should raise_error(NoMethodError) }
       end
-
-      context 'qr size passed to method and size set on model' do
-        let(:user) { QrCodeUser.create options }
-        subject { user.google_qr_uri('400x400') }
-        it { should eq "https://chart.googleapis.com/chart?cht=qr&chl=otpauth%3A%2F%2Ftotp%2Ftest%40example.com%3Fsecret%3D5qlcip7azyjuwm36&chs=400x400" }
+  
+      context "drift value" do
+        it { DriftUser.google_drift.should == 31 }
+  
+        context "default value" do
+          it { User.google_drift.should == 6 }
+        end
+      end
+  
+      context 'qr codes' do
+        let(:user)  { UserFactory.create User }
+        before      { user.set_google_secret }
+        subject     { user.google_qr_uri }
+  
+        it { should eq "https://chart.googleapis.com/chart?cht=qr&chl=otpauth%3A%2F%2Ftotp%2Ftest%40example.com%3Fsecret%3D#{secret}&chs=200x200" }
+  
+        context 'custom column name' do
+          let(:user) { UserFactory.create ColumnNameUser }
+          it { should eq "https://chart.googleapis.com/chart?cht=qr&chl=otpauth%3A%2F%2Ftotp%2Ftest_user%3Fsecret%3D#{secret}&chs=200x200" }
+        end
+  
+        context 'custom proc' do
+          let(:user) { UserFactory.create ProcUser }
+          it { should eq "https://chart.googleapis.com/chart?cht=qr&chl=otpauth%3A%2F%2Ftotp%2Ftest_user%40futureadvisor-admin%3Fsecret%3D#{secret}&chs=200x200" }
+        end
+  
+        context 'method defined by symbol' do
+          let(:user) { UserFactory.create SymbolUser }
+          it { should eq "https://chart.googleapis.com/chart?cht=qr&chl=otpauth%3A%2F%2Ftotp%2Ftest%40example.com%3Fsecret%3D#{secret}&chs=200x200" }
+        end
+  
+        context 'method defined by string' do
+          let(:user) { UserFactory.create StringUser }
+          it { should eq "https://chart.googleapis.com/chart?cht=qr&chl=otpauth%3A%2F%2Ftotp%2Ftest%40example.com%3Fsecret%3D#{secret}&chs=200x200" }
+        end
+  
+        context 'custom qr size' do
+          let(:user) { UserFactory.create QrCodeUser }
+          it { should eq "https://chart.googleapis.com/chart?cht=qr&chl=otpauth%3A%2F%2Ftotp%2Ftest%40example.com%3Fsecret%3D#{secret}&chs=300x300" }
+        end
+  
+        context 'qr size passed to method' do
+          subject { user.google_qr_uri('400x400') }
+          let(:user) { UserFactory.create StringUser }  
+          it { should eq "https://chart.googleapis.com/chart?cht=qr&chl=otpauth%3A%2F%2Ftotp%2Ftest%40example.com%3Fsecret%3D#{secret}&chs=400x400" }
+        end
+  
+        context 'qr size passed to method and size set on model' do
+          let(:user) { UserFactory.create QrCodeUser }
+          subject { user.google_qr_uri('400x400') }
+          it { should eq "https://chart.googleapis.com/chart?cht=qr&chl=otpauth%3A%2F%2Ftotp%2Ftest%40example.com%3Fsecret%3D#{secret}&chs=400x400" }
+        end
       end
     end
-
   end
-
 end

data/spec/spec_helper.rb

@@ -1,4 +1,7 @@
+ENV['RAILS_ENV'] = 'test'
+
 require 'time'
+require 'rails'
 require 'active_record'
 require 'action_controller'
 require 'rotp'
@@ -132,3 +135,21 @@ end
 class QrCodeUser < BaseUser
   acts_as_google_authenticated :qr_size => '300x300', :method => :email
 end
+
+class EncryptedUser < BaseUser
+  acts_as_google_authenticated :encrypt_secrets => true
+end
+
+class EncryptedCustomUser < BaseUser
+  self.table_name = 'custom_users'
+  acts_as_google_authenticated :encrypt_secrets => true, :google_secret_column => :mfa_secret
+end
+
+class UserFactory
+  def self.create(klass)
+    klass.create(:email => 'test@example.com', :user_name => 'test_user')
+  end
+end
+
+class RailsApplication < Rails::Application
+end if defined?(Rails)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: google-authenticator-rails
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.4.1
 platform: ruby
 authors:
 - Jared McFarland
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-10-31 00:00:00.000000000 Z
+date: 2017-12-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rotp
@@ -153,6 +153,7 @@ files:
 - LICENSE
 - README.md
 - Rakefile
+- config/secrets.yml
 - gemfiles/rails3.0.gemfile
 - gemfiles/rails3.1.gemfile
 - gemfiles/rails3.2.gemfile
@@ -198,7 +199,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.14
+rubygems_version: 2.5.1
 signing_key: 
 specification_version: 4
 summary: Add the ability to use the Google Authenticator with ActiveRecord.