gridauth 0.1.0

data/lib/gridauth/model.rb

@@ -0,0 +1,48 @@
+module Gridauth
+  # Adds the `has_grid_card` macro to Active Record models.
+  #
+  #   class User < ApplicationRecord
+  #     has_secure_password
+  #     has_many :sessions, dependent: :destroy
+  #     has_grid_card
+  #   end
+  module Model
+    def has_grid_card
+      has_many :grid_cards, class_name: "Gridauth::GridCard", foreign_key: :user_id,
+        inverse_of: :user, dependent: :delete_all
+
+      include InstanceMethods
+    end
+
+    module InstanceMethods
+      # The card currently used to sign in, if any.
+      def grid_card
+        grid_cards.active.order(activated_at: :desc).first
+      end
+
+      # A card that has been issued but not yet confirmed by the user.
+      def pending_grid_card
+        grid_cards.pending.order(created_at: :desc).first
+      end
+
+      def grid_card_enabled?
+        grid_cards.active.exists?
+      end
+
+      # Issues a new pending card (replacing any other pending card) and
+      # returns `[card, grid]`, where `grid` is the only copy of the plaintext.
+      # The current card, if any, keeps working until the new one is activated.
+      def issue_grid_card!
+        Gridauth::GridCard.issue_for!(self)
+      end
+
+      # Revokes every card, e.g. when an administrator resets a lost card.
+      def revoke_grid_cards!
+        transaction do
+          grid_cards.pending.delete_all
+          grid_cards.active.find_each(&:revoke!)
+        end
+      end
+    end
+  end
+end

data/lib/gridauth/routing.rb

@@ -0,0 +1,29 @@
+module Gridauth
+  # Draws the grid card routes into the application's route set, so the
+  # engine's pages render inside the app's layout with all of its route
+  # helpers available.
+  #
+  #   Rails.application.routes.draw do
+  #     resource :session
+  #     gridauth_routes
+  #   end
+  #
+  # Route helpers: new_gridauth_challenge_path, gridauth_challenge_path,
+  # gridauth_grid_card_path, print_gridauth_grid_card_path,
+  # activate_gridauth_grid_card_path and discard_gridauth_grid_card_path.
+  module Routing
+    def gridauth_routes(path: "gridauth")
+      scope path, module: "gridauth", as: "gridauth" do
+        resource :challenge, only: %i[ new create destroy ]
+
+        resource :grid_card, path: "card", only: %i[ show create destroy ] do
+          get :print
+          post :activate
+          delete :discard
+        end
+      end
+    end
+  end
+end
+
+ActionDispatch::Routing::Mapper.include Gridauth::Routing

data/lib/gridauth/version.rb

@@ -0,0 +1,3 @@
+module Gridauth
+  VERSION = "0.1.0"
+end

data/lib/gridauth.rb

@@ -0,0 +1,41 @@
+require "gridauth/version"
+require "gridauth/configuration"
+require "gridauth/grid"
+require "gridauth/model"
+require "gridauth/routing"
+require "gridauth/authentication"
+require "gridauth/engine"
+
+# Grid card two-factor authentication for applications using the Rails 8
+# authentication generator.
+module Gridauth
+  # Rails session key holding a login that passed the password check but has
+  # not yet answered the grid card challenge.
+  PENDING_LOGIN_KEY = :gridauth_pending_login
+
+  # Rails session key holding the plaintext of a freshly issued card so it can
+  # be displayed and printed until the user activates it.
+  NEW_CARD_KEY = :gridauth_new_card
+
+  class << self
+    def table_name_prefix
+      "gridauth_"
+    end
+
+    def config
+      @config ||= Configuration.new
+    end
+
+    def configure
+      yield config
+    end
+
+    def reset_config!
+      @config = Configuration.new
+    end
+
+    def user_class
+      config.user_class.to_s.constantize
+    end
+  end
+end

data/lib/tasks/gridauth_tasks.rake

@@ -0,0 +1,20 @@
+namespace :gridauth do
+  desc "Revoke all grid cards for a user (e.g. a lost card): bin/rails \"gridauth:revoke[user@example.com]\""
+  task :revoke, [ :user ] => :environment do |_task, args|
+    abort "Usage: bin/rails \"gridauth:revoke[<user id or #{Gridauth.config.user_label_attribute}>]\"" if args[:user].blank?
+
+    users = Gridauth.user_class
+    user = users.find_by(id: args[:user]) || users.find_by(Gridauth.config.user_label_attribute => args[:user])
+    abort "No user found for #{args[:user].inspect}" unless user
+
+    user.revoke_grid_cards!
+    puts "Revoked grid cards for #{args[:user]}. They can sign in with their password and set up a new card."
+  end
+
+  desc "List active grid cards that are due for rotation"
+  task due: :environment do
+    Gridauth::GridCard.active.includes(:user).find_each do |card|
+      puts "#{card.serial}\tuser #{card.user_id}\tactivated #{card.activated_at.to_date}\tuses #{card.use_count}" if card.rotation_due?
+    end
+  end
+end

metadata

@@ -0,0 +1,86 @@
+--- !ruby/object:Gem::Specification
+name: gridauth
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- jcallahan
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '8.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '8.0'
+description: 'Adds a grid card (a printed table of random characters) as a second
+  factor to Rails 8+ apps using `bin/rails generate authentication`: per-user cards,
+  card rotation, and a challenge step after the password sign-in.'
+email:
+- jcallahan@acm.org
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- MIT-LICENSE
+- README.md
+- Rakefile
+- app/controllers/gridauth/application_controller.rb
+- app/controllers/gridauth/challenges_controller.rb
+- app/controllers/gridauth/grid_cards_controller.rb
+- app/helpers/gridauth/grid_helper.rb
+- app/models/gridauth/application_record.rb
+- app/models/gridauth/grid_card.rb
+- app/views/gridauth/challenges/new.html.erb
+- app/views/gridauth/grid_cards/print.html.erb
+- app/views/gridauth/grid_cards/show.html.erb
+- app/views/gridauth/shared/_challenge_fields.html.erb
+- app/views/gridauth/shared/_grid.html.erb
+- app/views/gridauth/shared/_styles.html.erb
+- config/locales/en.yml
+- lib/generators/gridauth/install/install_generator.rb
+- lib/generators/gridauth/install/templates/create_gridauth_grid_cards.rb.tt
+- lib/generators/gridauth/install/templates/initializer.rb.tt
+- lib/generators/gridauth/views/views_generator.rb
+- lib/gridauth.rb
+- lib/gridauth/authentication.rb
+- lib/gridauth/configuration.rb
+- lib/gridauth/engine.rb
+- lib/gridauth/grid.rb
+- lib/gridauth/model.rb
+- lib/gridauth/routing.rb
+- lib/gridauth/version.rb
+- lib/tasks/gridauth_tasks.rake
+homepage: https://github.com/johncallahan/gridauth
+licenses:
+- MIT
+metadata: {}
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.2'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: Grid card two-factor authentication for Rails 8 built-in authentication.
+test_files: []