rotp 2.0.0 → 2.1.0

data/lib/rotp/version.rb

@@ -1,3 +1,3 @@
 module ROTP
-  VERSION = "2.0.0"
+  VERSION = "2.1.0"
 end

data/rotp.gemspec

@@ -20,11 +20,8 @@ Gem::Specification.new do |s|
   s.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
   s.require_paths = ["lib"]
 
-  s.add_development_dependency('rake', '~>10.1.0')
-  s.add_development_dependency('rspec', '~>2.13.0')
-  if RUBY_VERSION < "1.9"
-    s.add_development_dependency('timecop', "~>0.5.9.2")
-  else
-    s.add_development_dependency('timecop')
-  end
+  s.add_development_dependency 'guard-rspec', '~> 4.5.0'
+  s.add_development_dependency 'rake', '~> 10.4.2'
+  s.add_development_dependency 'rspec', '~> 3.1.0'
+  s.add_development_dependency 'timecop', '~> 0.7.1'
 end

data/spec/lib/rotp/arguments_spec.rb

@@ -0,0 +1,88 @@
+require 'spec_helper'
+require 'rotp/arguments'
+
+RSpec.describe ROTP::Arguments do
+  let(:arguments) { described_class.new filename, argv }
+  let(:argv)      { '' }
+  let(:filename)  { 'rotp' }
+  let(:options)   { arguments.options }
+
+  context 'without options' do
+    describe '#help' do
+      it 'shows the help text' do
+        expect(arguments.to_s).to include 'Usage: '
+      end
+    end
+
+    describe '#options' do
+      it 'has the default options' do
+        expect(options.mode).to eq :time
+        expect(options.secret).to be_nil
+        expect(options.counter).to eq 0
+      end
+    end
+  end
+
+  context 'unknown arguments' do
+    let(:argv) { %w(--does-not-exist -xyz) }
+
+    describe '#options' do
+      it 'is in help mode' do
+        expect(options.mode).to eq :help
+      end
+
+      it 'knows about the problem' do
+        expect(options.warnings).to include 'invalid option: --does-not-exist'
+      end
+    end
+  end
+
+  context 'no arguments' do
+    let(:argv) { [] }
+
+    describe '#options' do
+      it 'is in help mode' do
+        expect(options.mode).to eq :help
+      end
+    end
+  end
+
+  context 'asking for help' do
+    let(:argv) { %w(--help) }
+
+    describe '#options' do
+      it 'is in help mode' do
+        expect(options.mode).to eq :help
+      end
+    end
+  end
+
+  context 'generating a counter based secret' do
+    let(:argv) { %w(--hmac --secret s3same) }
+
+    describe '#options' do
+      it 'is in hmac mode' do
+        expect(options.mode).to eq :hmac
+      end
+
+      it 'knows the secret' do
+        expect(options.secret).to eq 's3same'
+      end
+    end
+  end
+
+  context 'generating a time based secret' do
+    let(:argv) { %w(--secret s3same) }
+
+    describe '#options' do
+      it 'is in time mode' do
+        expect(options.mode).to eq :time
+      end
+
+      it 'knows the secret' do
+        expect(options.secret).to eq 's3same'
+      end
+    end
+  end
+
+end

data/spec/lib/rotp/base32_spec.rb

@@ -0,0 +1,49 @@
+require 'spec_helper'
+
+RSpec.describe ROTP::Base32 do
+
+  describe '.random_base32' do
+    context 'without arguments' do
+      let(:base32) { ROTP::Base32.random_base32 }
+
+      it 'is 16 characters long' do
+        expect(base32.length).to eq 16
+      end
+
+      it 'is hexadecimal' do
+        expect(base32).to match %r{\A[a-z2-7]+\z}
+      end
+    end
+
+    context 'with arguments' do
+      let(:base32) { ROTP::Base32.random_base32 32 }
+
+      it 'allows a specific length' do
+        expect(base32.length).to eq 32
+      end
+    end
+  end
+
+  describe '.decode' do
+    context 'corrupt input data' do
+      it 'raises a sane error' do
+        expect { ROTP::Base32.decode('4BCDEFG234BCDEF1') }.to \
+          raise_error(ROTP::Base32::Base32Error, "Invalid Base32 Character - '1'")
+      end
+    end
+
+    context 'valid input data' do
+      it 'correctly decodes a string' do
+        expect(ROTP::Base32.decode('F').unpack('H*').first).to eq '28'
+        expect(ROTP::Base32.decode('23').unpack('H*').first).to eq 'd6'
+        expect(ROTP::Base32.decode('234').unpack('H*').first).to eq 'd6f8'
+        expect(ROTP::Base32.decode('234A').unpack('H*').first).to eq 'd6f800'
+        expect(ROTP::Base32.decode('234B').unpack('H*').first).to eq 'd6f810'
+        expect(ROTP::Base32.decode('234BCD').unpack('H*').first).to eq 'd6f8110c'
+        expect(ROTP::Base32.decode('234BCDE').unpack('H*').first).to eq 'd6f8110c80'
+        expect(ROTP::Base32.decode('234BCDEFG').unpack('H*').first).to eq 'd6f8110c8530'
+        expect(ROTP::Base32.decode('234BCDEFG234BCDEFG').unpack('H*').first).to eq 'd6f8110c8536b7c0886429'
+      end
+    end
+  end
+end

data/spec/lib/rotp/cli_spec.rb

@@ -0,0 +1,29 @@
+require 'spec_helper'
+require 'rotp/cli'
+
+RSpec.describe ROTP::CLI do
+  let(:cli)    { described_class.new('executable', argv) }
+  let(:output) { cli.output }
+  let(:now)    { Time.utc 2012,1,1 }
+
+  before do
+    Timecop.freeze now
+  end
+
+  context 'generating a TOTP' do
+    let(:argv) { %w(--secret JBSWY3DPEHPK3PXP) }
+
+    it 'prints the corresponding token' do
+      expect(output).to eq '068212'
+    end
+  end
+
+  context 'generating a HOTP' do
+    let(:argv) { %W(--hmac --secret #{'a' * 32} --counter 1234) }
+
+    it 'prints the corresponding token' do
+      expect(output).to eq '161024'
+    end
+  end
+
+end

data/spec/lib/rotp/hotp_spec.rb

@@ -0,0 +1,142 @@
+require 'spec_helper'
+
+RSpec.describe ROTP::HOTP do
+  let(:counter) { 1234 }
+  let(:token)   { '161024' }
+  let(:hotp)    { ROTP::HOTP.new('a' * 32) }
+
+  describe '#at' do
+    let(:token) { hotp.at counter }
+
+    context 'only the counter as argument' do
+      it 'generates a string OTP' do
+        expect(token).to eq '161024'
+      end
+    end
+
+    context 'without padding' do
+      let(:token) { hotp.at counter, false }
+
+      it 'generates an integer OTP' do
+        expect(token).to eq 161024
+      end
+    end
+
+    context 'RFC compatibility' do
+      let(:hotp) { ROTP::HOTP.new('GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ') }
+
+      it 'matches the RFC documentation examples' do
+        # 12345678901234567890 in Base32
+        # GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ
+        expect(hotp.at(0)).to eq '755224'
+        expect(hotp.at(1)).to eq '287082'
+        expect(hotp.at(2)).to eq '359152'
+        expect(hotp.at(3)).to eq '969429'
+        expect(hotp.at(4)).to eq '338314'
+        expect(hotp.at(5)).to eq '254676'
+        expect(hotp.at(6)).to eq '287922'
+        expect(hotp.at(7)).to eq '162583'
+        expect(hotp.at(8)).to eq '399871'
+        expect(hotp.at(9)).to eq '520489'
+      end
+
+    end
+  end
+
+  describe '#verify' do
+    let(:verification) { hotp.verify token, counter }
+
+    context 'numeric token' do
+      let(:token) { 161024 }
+
+      it 'raises an error' do
+        expect { verification }.to raise_error
+      end
+    end
+
+    context 'string token' do
+      it 'is true' do
+        expect(verification).to be_truthy
+      end
+    end
+
+    context 'RFC compatibility' do
+      let(:hotp)  { ROTP::HOTP.new('GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ') }
+      let(:token) { '520489' }
+
+      it 'verifies and does not allow reuse' do
+        expect(hotp.verify(token, 9)).to be_truthy
+        expect(hotp.verify(token, 10)).to be_falsey
+      end
+    end
+  end
+
+  describe '#provisioning_uri' do
+    let(:uri)    { hotp.provisioning_uri('mark@percival') }
+    let(:params) { CGI::parse URI::parse(uri).query }
+
+    it 'has the correct format' do
+      expect(uri).to match %r{\Aotpauth:\/\/hotp.+}
+    end
+
+    it 'includes the secret as parameter' do
+      expect(params['secret'].first).to eq 'a' * 32
+    end
+  end
+
+  describe '#verify_with_retries' do
+    let(:verification) { hotp.verify_with_retries token, counter, retries }
+
+    context 'negative retries' do
+      let(:retries) { -1 }
+
+      it 'is false' do
+        expect(verification).to be_falsey
+      end
+    end
+
+    context 'zero retries' do
+      let(:retries) { 0 }
+
+      it 'is false' do
+        expect(verification).to be_falsey
+      end
+    end
+
+    context 'counter lower than retries' do
+      let(:counter) { 1223 }
+      let(:retries) { 10 }
+
+      it 'is false' do
+        expect(verification).to be_falsey
+      end
+    end
+
+    context 'counter exactly in retry range' do
+      let(:counter) { 1224 }
+      let(:retries) { 10 }
+
+      it 'is true' do
+        expect(verification).to eq 1234
+      end
+    end
+
+    context 'counter in retry range' do
+      let(:counter) { 1224 }
+      let(:retries) { 11 }
+
+      it 'is true' do
+        expect(verification).to eq 1234
+      end
+    end
+
+    context 'counter too high' do
+      let(:counter) { 1235 }
+      let(:retries) { 3 }
+
+      it 'is false' do
+        expect(verification).to be_falsey
+      end
+    end
+  end
+end

data/spec/lib/rotp/totp_spec.rb

@@ -0,0 +1,235 @@
+require 'spec_helper'
+
+RSpec.describe ROTP::TOTP do
+  let(:now)   { Time.utc 2012,1,1 }
+  let(:token) { '068212' }
+  let(:totp)  { ROTP::TOTP.new 'JBSWY3DPEHPK3PXP' }
+
+  describe '#at' do
+    context 'with padding' do
+      let(:token) { totp.at now }
+
+      it 'is a string number' do
+        expect(token).to eq '068212'
+      end
+    end
+
+    context 'without padding' do
+      let(:token) { totp.at now, false }
+
+      it 'is an integer' do
+        expect(token).to eq 68212
+      end
+    end
+
+    context 'RFC compatibility' do
+      let(:totp) { ROTP::TOTP.new('GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ') }
+
+      it 'matches the RFC documentation examples' do
+        expect(totp.at 1111111111).to eq '050471'
+        expect(totp.at 1234567890).to eq '005924'
+        expect(totp.at 2000000000).to eq '279037'
+      end
+
+    end
+  end
+
+  describe '#verify' do
+    let(:verification) { totp.verify token, now }
+
+    context 'numeric token' do
+      let(:token) { 68212 }
+
+      it 'raises an error' do
+        expect { verification }.to raise_error
+      end
+    end
+
+    context 'unpadded string token' do
+      let(:token) { '68212' }
+
+      it 'is false' do
+        expect(verification).to be_falsey
+      end
+    end
+
+    context 'correctly padded string token' do
+      it 'is true' do
+        expect(verification).to be_truthy
+      end
+    end
+
+    context 'RFC compatibility' do
+      let(:totp)  { ROTP::TOTP.new 'wrn3pqx5uqxqvnqr' }
+
+      before do
+        Timecop.freeze now
+      end
+
+      context 'correct time based OTP' do
+        let(:token) { '102705' }
+        let(:now)   { Time.at 1297553958 }
+
+        it 'is true' do
+          expect(totp.verify('102705')).to be_truthy
+        end
+      end
+
+      context 'wrong time based OTP' do
+        it 'is false' do
+          expect(totp.verify('102705')).to be_falsey
+        end
+      end
+    end
+  end
+
+  describe '#provisioning_uri' do
+    let(:uri)    { totp.provisioning_uri('mark@percival') }
+    let(:params) { CGI::parse URI::parse(uri).query }
+
+    context 'without issuer' do
+      it 'has the correct format' do
+        expect(uri).to match %r{\Aotpauth:\/\/totp.+}
+      end
+
+      it 'includes the secret as parameter' do
+        expect(params['secret'].first).to eq 'JBSWY3DPEHPK3PXP'
+      end
+    end
+
+    context 'with issuer' do
+      let(:totp)  { ROTP::TOTP.new 'JBSWY3DPEHPK3PXP', issuer: 'FooCo' }
+
+      it 'has the correct format' do
+        expect(uri).to match %r{\Aotpauth:\/\/totp.+}
+      end
+
+      it 'includes the secret as parameter' do
+        expect(params['secret'].first).to eq 'JBSWY3DPEHPK3PXP'
+      end
+
+      it 'includes the issuer as parameter' do
+        expect(params['issuer'].first).to eq 'FooCo'
+      end
+    end
+
+    context 'with custom interval' do
+      let(:totp)  { ROTP::TOTP.new 'JBSWY3DPEHPK3PXP', interval: 60 }
+
+      it 'has the correct format' do
+        expect(uri).to match %r{\Aotpauth:\/\/totp.+}
+      end
+
+      it 'includes the secret as parameter' do
+        expect(params['secret'].first).to eq 'JBSWY3DPEHPK3PXP'
+      end
+
+      it 'includes the interval as period parameter' do
+        expect(params['period'].first).to eq '60'
+      end
+    end
+  end
+
+  describe '#verify_with_drift' do
+    let(:verification) { totp.verify_with_drift token, drift, now }
+    let(:drift) { 0 }
+
+    context 'numeric token' do
+      let(:token) { 68212 }
+
+      it 'raises an error' do
+        # In the "old" specs this was not tested due to a typo. What is the expected behavior here?
+        expect { verification }.to raise_error
+      end
+    end
+
+    context 'unpadded string token' do
+      let(:token) { '68212' }
+
+      it 'is false' do
+        # Not sure whether this should be tested. It didn't exist in the "old" specs
+        expect(verification).to be_falsey
+      end
+    end
+
+    context 'correctly padded string token' do
+      let(:token) { '068212' }
+
+      it 'is true' do
+        expect(verification).to be_truthy
+      end
+    end
+
+    context 'slightly old number' do
+      let(:token) { totp.at now - 30 }
+      let(:drift) { 60 }
+
+      it 'is true' do
+        expect(verification).to be_truthy
+      end
+    end
+
+    context 'slightly new number' do
+      let(:token) { totp.at now + 60 }
+      let(:drift) { 60 }
+
+      it 'is true' do
+        expect(verification).to be_truthy
+      end
+    end
+
+    context 'outside of drift range' do
+      let(:token) { totp.at now - 60 }
+      let(:drift) { 30 }
+
+      it 'is false' do
+        expect(verification).to be_falsey
+      end
+    end
+
+    context 'drift is not multiple of TOTP interval' do
+      context 'slightly old number' do
+        let(:token) { totp.at now - 45 }
+        let(:drift) { 45 }
+
+        it 'is true' do
+          expect(verification).to be_truthy
+        end
+      end
+
+      context 'slightly new number' do
+        let(:token) { totp.at now + 40 }
+        let(:drift) { 40 }
+
+        it 'is true' do
+          expect(verification).to be_truthy
+        end
+      end
+    end
+  end
+
+  describe '#now' do
+    before do
+      Timecop.freeze now
+    end
+
+    context 'Google Authenticator' do
+      let(:totp) { ROTP::TOTP.new 'wrn3pqx5uqxqvnqr' }
+      let(:now)  { Time.at 1297553958 }
+
+      it 'matches the known output' do
+        expect(totp.now).to eq '102705'
+      end
+    end
+
+    context 'Dropbox 26 char secret output' do
+      let(:totp) { ROTP::TOTP.new 'tjtpqea6a42l56g5eym73go2oa' }
+      let(:now)  { Time.at 1378762454 }
+
+      it 'matches the known output' do
+        expect(totp.now).to eq '747864'
+      end
+    end
+  end
+
+end