quo_vadis 2.1.4 → 2.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c0b470ad4482010d9774287306051d802625c95fa5e20675a12bf4537e71d939
-  data.tar.gz: 67574e42473e4c87dc112f7e7ced2104c8df54a8a02e7befcedad6e806d136a4
+  metadata.gz: f2f5586e06a0e01dd89d66bf9cae01317b0d302ba51e5a82cfcb4bc00dc0ea85
+  data.tar.gz: f37f34fbae6ab23081643aff844525b4ca8795c9e5057cbce737e7348d6a254f
 SHA512:
-  metadata.gz: debe3294db5262b56514b9ece8181464783521f475c4472a43dd4555739cd97fd81bea5fde66e700be8a75ada62ee554d4374aa196bfcb063bc9ecfcd989d1cf
-  data.tar.gz: 00f90c64fd56cec727ba364d784de3928e68e5d34eb5fca1fd56382c77289c0d6c5a4be7396687e1e175d5dc66c4473e00ae77b8b6f52c56def2496e0abeab40
+  metadata.gz: de242f63f325f1520fb9fb209535a4dfcff1c6f3f2e80d6620bce3e940c1000d5452145e83b6917e9106deb844aa4f467be922880c92bbb357da2dcb6bbf563b
+  data.tar.gz: d706a441437cab9af6ee75f3581cc18df8edfd17414317555eecd58a1c984f7cc62a085297158fb5a42f9d244bcfdbde98bd6792220434a6118e32f801c0241e

data/CHANGELOG.md

@@ -4,6 +4,29 @@
 ## HEAD
 
 
+## 2.1.7 (30 May 2022)
+
+* Use SHA256 digest for encryption.
+* Use <time> element in logs view.
+
+
+## 2.1.6 (30 May 2022)
+
+* Fix typo in session scope.
+
+
+## 2.1.5 (27 May 2022)
+
+* Order sessions list and display more information.
+* Set status 303 See Other on destroy redirects.
+* Streamline bundler instructions.
+
+
+## 2.1.4 (2 October 2021)
+
+* Allow metadata for login log.
+
+
 ## 2.1.3 (30 September 2021)
 
 * Pass IP and timestamp as paramenters to mailer.

data/README.md

@@ -37,11 +37,9 @@ Simple to integrate into your application.  The main task is customising the exa
 Add the gem to your Gemfile:
 
 ```ruby
-gem 'quo_vadis', '~> 2.0'
+bundle add 'quo_vadis'
 ```
 
-Then run `bundle install`.
-
 Next, add the database tables:
 
 ```

data/app/controllers/quo_vadis/sessions_controller.rb

@@ -9,7 +9,7 @@ module QuoVadis
 
     def index
       @qv_session = qv.session
-      @qv_sessions = @qv_session.account.sessions
+      @qv_sessions = @qv_session.account.sessions.new_to_old
     end
 
 
@@ -58,12 +58,12 @@ module QuoVadis
         current_qv_session.account.sessions.destroy params[:id]
         qv.log current_qv_session.account, Log::LOGOUT_OTHER
         flash[:notice] = QuoVadis.translate 'flash.logout.other'
-        redirect_to action: :index
+        redirect_to action: :index, status: :see_other
       else  # this session
         qv.log authenticated_model.qv_account, Log::LOGOUT
         qv.logout
         flash[:notice] = QuoVadis.translate 'flash.logout.self'
-        redirect_to main_app.root_path
+        redirect_to main_app.root_path, status: :see_other
       end
     end
 

data/app/controllers/quo_vadis/twofas_controller.rb

@@ -14,7 +14,7 @@ module QuoVadis
       account.sessions.each &:reset_authenticated_with_second_factor  # OWASP ASV v4.0, 2.8.6
       qv.log account, Log::TWOFA_DEACTIVATED
       QuoVadis.notify :twofa_deactivated_notification, email: authenticated_model.email
-      redirect_to twofa_path, notice: QuoVadis.translate('flash.2fa.invalidated')
+      redirect_to twofa_path, notice: QuoVadis.translate('flash.2fa.invalidated'), status: :see_other
     end
 
     private

data/app/models/quo_vadis/session.rb

@@ -9,6 +9,7 @@ module QuoVadis
 
     belongs_to :account
     validates :ip, presence: true
+    scope :new_to_old, -> { order created_at: :desc }
 
     attribute :last_seen_at, :datetime, default: -> { Time.now.utc }
 

data/app/views/quo_vadis/logs/index.html.erb

@@ -12,7 +12,7 @@
   <tbody>
     <% @logs.each do |log| %>
       <tr>
-        <td><%= log.created_at %></td>
+        <td><time datetime="<%= log.created_at.to_formatted_s(:iso8601) %>"><%= log.created_at.to_formatted_s('%-d %B %Y') %></time></td>
         <td><%= QuoVadis.translate "log.action.#{log.action}" %></td>
         <td><%= log.ip %></td>
         <td><%= log.metadata.empty? ? '' : log.metadata.map {|k,v| "#{k}: #{v}"}.join(', ') %></td>

data/app/views/quo_vadis/sessions/index.html.erb

@@ -3,6 +3,9 @@
 <table>
   <thead>
     <tr>
+      <th>Signed in</th>
+      <th>Last seen</th>
+      <th>2FA used</th>
       <th>IP</th>
       <th>User agent</th>
       <th></th>
@@ -11,6 +14,9 @@
   <tbody>
     <% @qv_sessions.each do |sess| %>
       <tr>
+        <td><time datetime="<%= sess.created_at.to_formatted_s(:iso_8601) %>"><%= sess.created_at.to_formatted_s('%-d %B %Y') %></time></td>
+        <td><time datetime="<%= sess.last_seen_at.to_formatted_s(:iso_8601) %>"><%= sess.last_seen_at.to_formatted_s('%-d %B %Y') %></time></td>
+        <td><%= sess.second_factor_authenticated? ? 'Yes' : 'No' %></td>
         <td><%= sess.ip %></td>
         <td><%= sess.user_agent %></td>
         <td>

data/lib/quo_vadis/crypt.rb

@@ -8,7 +8,7 @@ module QuoVadis
       return '' if value == ''
 
       salt = SecureRandom.hex KEY_LENGTH
-      crypt = encryptor key(salt)
+      crypt = encryptor salt
       ciphertext = crypt.encrypt_and_sign value
       [salt, ciphertext].join SEPARATOR
     end
@@ -18,7 +18,7 @@ module QuoVadis
       return '' if value == ''
 
       salt, data = value.split SEPARATOR
-      crypt = encryptor key(salt)
+      crypt = encryptor salt
       crypt.decrypt_and_verify(data)
     end
 
@@ -27,12 +27,18 @@ module QuoVadis
     KEY_LENGTH = ActiveSupport::MessageEncryptor.key_len
     SEPARATOR = '$$'
 
-    def self.encryptor(key)
-      ActiveSupport::MessageEncryptor.new(key)
+    def self.encryptor(salt)
+      key_sha256 = key salt, OpenSSL::Digest::SHA256
+      key_sha1   = key salt, OpenSSL::Digest::SHA1
+      ActiveSupport::MessageEncryptor.new(key_sha256).tap { |crypt|
+        crypt.rotate key_sha1
+      }
     end
 
-    def self.key(salt)
-      ActiveSupport::KeyGenerator.new(secret).generate_key(salt, KEY_LENGTH)
+    def self.key(salt, hash_digest_class)
+      ActiveSupport::KeyGenerator
+        .new(secret, hash_digest_class: hash_digest_class)
+        .generate_key(salt, KEY_LENGTH)
     end
 
     def self.secret

data/lib/quo_vadis/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module QuoVadis
-  VERSION = '2.1.4'
+  VERSION = '2.1.7'
 end

data/quo_vadis.gemspec

@@ -8,7 +8,7 @@ Gem::Specification.new do |spec|
   spec.authors       = ['Andy Stewart']
   spec.email         = ['boss@airbladesoftware.com']
 
-  spec.summary       = 'Multifactor authentication for Rails 6.'
+  spec.summary       = 'Multifactor authentication for Rails 6 and 7.'
   spec.homepage      = 'https://github.com/airblade/quo_vadis'
   spec.license       = 'MIT'
 

data/test/integration/sessions_test.rb

@@ -54,7 +54,7 @@ class SessionsTest < IntegrationTest
     phone.get quo_vadis.sessions_path
     phone.assert_response :success
     phone.assert_select 'td', 'This session'
-    phone.assert_select 'td input[type=submit][value="Log out"]', 1
+    phone.assert_select 'td button[type=submit]', text: 'Log out', count: 1
 
     # on phone, log out the desktop session
     phone.delete quo_vadis.session_path(QuoVadis::Session.first.id)

data/test/models/crypt_test.rb

@@ -4,6 +4,13 @@ class CryptTest < ActiveSupport::TestCase
 
   setup do
     @crypt = QuoVadis::Crypt
+
+    @crypt_sha1 = Class.new(QuoVadis::Crypt) do
+      def self.encryptor(salt)
+        key_sha1 = key salt, OpenSSL::Digest::SHA1
+        ActiveSupport::MessageEncryptor.new key_sha1
+      end
+    end
   end
 
   test 'round trip' do
@@ -19,4 +26,16 @@ class CryptTest < ActiveSupport::TestCase
     refute_equal ciphertext, @crypt.encrypt(plaintext)
   end
 
+  test 'rotation' do
+    # This test only works if our test Rails contains this commit:
+    # https://github.com/rails/rails/commit/447e28347eb46e2ad5dc625de616152bd1b69a32
+    return unless ActiveSupport::KeyGenerator.respond_to? :hash_digest_class
+
+    plaintext = 'the quick brown fox'
+    # Encrypt with SHA1 digest
+    ciphertext_sha1 = @crypt_sha1.encrypt plaintext
+    # Ensure code can decrypt it.
+    assert_equal plaintext, @crypt.decrypt(ciphertext_sha1)
+  end
+
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: quo_vadis
 version: !ruby/object:Gem::Version
-  version: 2.1.4
+  version: 2.1.7
 platform: ruby
 authors:
 - Andy Stewart
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-10-02 00:00:00.000000000 Z
+date: 2022-05-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -224,8 +224,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
+rubygems_version: 3.2.22
 signing_key:
 specification_version: 4
-summary: Multifactor authentication for Rails 6.
+summary: Multifactor authentication for Rails 6 and 7.
 test_files: []