rodauth 1.20.0 → 1.21.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7ecf305eda0aef347c6464decf7ef50e8e5fd4a69927bd690b68deae66de6b63
-  data.tar.gz: 6f8e6ffcd70b5ff94b4f922c04661896055b401a85930e085e8aaa91d1e12dfe
+  metadata.gz: e2660e5b2f14afadab7d56a0a7329ff3f22cea0bb800fa952b3b40c3dcfbcb29
+  data.tar.gz: 34b96d4d8bc26d641288af6bced9a42b9a895790b019a03b00c3f0e55b67843b
 SHA512:
-  metadata.gz: ebc055ab52ae0da05d5145b273cc63b53e93f29dae456ff86c321e4c5d5798b92d65b43f0d91272ccb2a44b7b77fc29765e45ffc511564c814771b87fc1b62bf
-  data.tar.gz: fe083dd6517fd410eacfba69e061b3b7b82e6beae68e1413334db939c956ccb953e28d0a7a074731205e1d3ada60f12e96660b525bfc836a5a4fea45b33b881f
+  metadata.gz: c1f90ea3269e61b7de2e336bbe08ccde86b9d343d4b773971fcda7c4f3294804d9b251087978a57ae6eb0fea0a435fd16f0dd239ae524c465739fa6a129b3584
+  data.tar.gz: 6d8b86790ac1214bd48fffea3aaeffdce63351b8bf6fc40dce6ca96fa471f84a2d08be525d804f5138ba5664ac73bbc68bfda6f279ef17655fc4f24e64bd23d0

data/CHANGELOG

@@ -1,3 +1,9 @@
+=== 1.21.0 (2019-07-24)
+
+* Support rotp 5.1 in the otp feature (jeremyevans)
+
+* Log user out when locking out OTP account if no fallback options available (jeremyevans)
+
 === 1.20.0 (2019-06-07)
 
 * Support rotp 5 in the otp feature (jeremyevans)

data/doc/internals.rdoc

@@ -183,7 +183,7 @@ Here's a heavily commented example showing what is going on inside a Rodauth fea
           foo_view
         end
 
-        # Just like in Roda, r.post is called for GET requests
+        # Just like in Roda, r.post is called for POST requests
         r.post do
           # This is called before performing the foo action
           before_foo

data/doc/release_notes/1.21.0.txt

@@ -0,0 +1,12 @@
+= Improvements
+
+* rotp 5.1 is now supported in the otp feature.  Previous rotp
+  versions down to rotp 2.1.1 remain supported.
+
+* When using the otp feature without the sms or recovery_codes
+  features, if an account gets locked out from OTP authentication due
+  to multiple invalid OTP authentication codes, automatically log
+  them out, and redirect them to the login page.  Previously, the
+  default behavior in this case could be a redirect loop if OTP
+  authentication is required for the user on the default_redirect
+  page.

data/lib/rodauth/features/otp.rb

@@ -109,7 +109,12 @@ module Rodauth
       if otp_locked_out?
         set_response_error_status(lockout_error_status)
         set_redirect_error_flash otp_lockout_error_flash
-        redirect otp_lockout_redirect
+        if redir = otp_lockout_redirect
+          redirect redir
+        else
+          clear_session
+          redirect require_login_redirect
+        end
       end
 
       before_otp_auth_route
@@ -241,7 +246,7 @@ module Rodauth
 
     def otp_lockout_redirect
       return super if defined?(super)
-      default_redirect
+      nil
     end
 
     def otp_lockout_error_flash
@@ -359,7 +364,7 @@ module Rodauth
     if ROTP::Base32.respond_to?(:random_base32)
       # :nocov:
       def otp_new_secret
-        ROTP::Base32.random_base32
+        ROTP::Base32.random_base32.downcase
       end
       # :nocov:
     else

data/lib/rodauth/version.rb

@@ -6,7 +6,7 @@ module Rodauth
   MAJOR = 1
 
   # The minor version of Rodauth, updated for new feature releases of Rodauth.
-  MINOR = 20
+  MINOR = 21
 
   # The patch version of Rodauth, updated only for bug fixes from the last
   # feature release.

data/spec/two_factor_spec.rb

@@ -560,10 +560,49 @@ describe 'Rodauth OTP feature' do
     DB[:account_recovery_codes].select_order_map(:code).must_equal ['a', 'b']
   end
 
+  it "should handle two factor lockout when using rodauth.require_two_factor_setup and rodauth.require_authentication" do
+    rodauth do
+      enable :login, :logout, :otp
+      otp_drift 10
+    end
+    roda do |r|
+      r.rodauth
+      rodauth.require_authentication
+      rodauth.require_two_factor_setup
+
+      view :content=>"Logged in"
+    end
+
+    login
+    page.title.must_equal 'Setup Two Factor Authentication'
+    secret = page.html.match(/Secret: ([a-z2-7]{#{secret_length}})/)[1]
+    totp = ROTP::TOTP.new(secret)
+    fill_in 'Password', :with=>'0123456789'
+    fill_in 'Authentication Code', :with=>totp.now
+    click_button 'Setup Two Factor Authentication'
+    page.find('#notice_flash').text.must_equal 'Two factor authentication is now setup'
+    page.current_path.must_equal '/'
+    page.html.must_include 'Logged in'
+    reset_otp_last_use
+
+    logout
+    login
+
+    6.times do
+      page.title.must_equal 'Enter Authentication Code'
+      fill_in 'Authentication Code', :with=>'foo'
+      click_button 'Authenticate via 2nd Factor'
+    end
+    page.find('#error_flash').text.must_equal 'Authentication code use locked out due to numerous failures.'
+    page.title.must_include 'Login'
+    page.current_path.must_equal '/login'
+  end
+
   it "should allow two factor authentication setup, login, removal without recovery" do
     rodauth do
       enable :login, :logout, :otp
       otp_drift 10
+      otp_lockout_redirect '/'
     end
     roda do |r|
       r.rodauth
@@ -1149,7 +1188,7 @@ describe 'Rodauth OTP feature' do
       json_request(path).must_equal [403, {'error'=>'SMS authentication has not been setup yet.'}]
     end
 
-    secret = (ROTP::Base32.respond_to?(:random_base32) ? ROTP::Base32.random_base32 : ROTP::Base32.random.downcase)
+    secret = (ROTP::Base32.respond_to?(:random_base32) ? ROTP::Base32.random_base32 : ROTP::Base32.random).downcase
     totp = ROTP::TOTP.new(secret)
 
     res = json_request('/otp-setup', :password=>'123456', :otp_secret=>secret)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth
 version: !ruby/object:Gem::Version
-  version: 1.20.0
+  version: 1.21.0
 platform: ruby
 authors:
 - Jeremy Evans
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-06-07 00:00:00.000000000 Z
+date: 2019-07-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sequel
@@ -253,6 +253,7 @@ extra_rdoc_files:
 - doc/release_notes/1.18.0.txt
 - doc/release_notes/1.19.0.txt
 - doc/release_notes/1.20.0.txt
+- doc/release_notes/1.21.0.txt
 files:
 - CHANGELOG
 - MIT-LICENSE
@@ -298,6 +299,7 @@ files:
 - doc/release_notes/1.19.0.txt
 - doc/release_notes/1.2.0.txt
 - doc/release_notes/1.20.0.txt
+- doc/release_notes/1.21.0.txt
 - doc/release_notes/1.3.0.txt
 - doc/release_notes/1.4.0.txt
 - doc/release_notes/1.5.0.txt