two_factor_authentication 2.1.1 → 3.0.0

data/app/views/devise/two_factor_authentication/show.html.erb

@@ -7,13 +7,13 @@
 <p><%= flash[:notice] %></p>
 
 <%= form_tag([resource_name, :two_factor_authentication], :method => :put) do %>
-  <%= text_field_tag :code %>
+  <%= text_field_tag :code, '', autofocus: true %>
   <%= submit_tag "Submit" %>
 <% end %>
 
 <% if resource.direct_otp %>
-  <%= link_to "Resend Code", send("resend_code_#{resource_name}_two_factor_authentication_path"), action: :get %>
+  <%= link_to "Resend Code", send("resend_code_#{resource_name}_two_factor_authentication_path") %>
 <% else %>
-<%= link_to "Send me a code instead", send("resend_code_#{resource_name}_two_factor_authentication_path"), action: :get %>
+<%= link_to "Send me a code instead", send("resend_code_#{resource_name}_two_factor_authentication_path") %>
 <% end %>
-<%= link_to "Sign out", send("destroy_#{resource_name}_session_path"), :method => :delete %>
+<%= button_to "Sign out", send("destroy_#{resource_name}_session_path"), :method => Array(Devise.sign_out_via).first %>

data/config/locales/de.yml

@@ -0,0 +1,8 @@
+de:
+  devise:
+    two_factor_authentication:
+      success: "Ihre Zwei-Faktor-Authentifizierung war erfolgreich."
+      attempt_failed: "Authentifizierungsversuch fehlgeschlagen."
+      max_login_attempts_reached: "Ihr Zugang wurde ganz verweigert, da Sie Ihr Versuchslimit erreicht haben."
+      contact_administrator: "Kontaktieren Sie bitte einen Ihrer Administratoren."
+      code_has_been_sent: "Ihr Einmal-Passwort wurde verschickt."

data/lib/generators/active_record/templates/migration.rb

@@ -1,4 +1,8 @@
-class TwoFactorAuthenticationAddTo<%= table_name.camelize %> < ActiveRecord::Migration
+class TwoFactorAuthenticationAddTo<%= table_name.camelize %> < ActiveRecord::Migration<%= migration_version %>
+<% if postgresql? -%>
+  disable_ddl_transaction!
+
+<% end -%>
   def change
     add_column :<%= table_name %>, :second_factor_attempts_count, :integer, default: 0
     add_column :<%= table_name %>, :encrypted_otp_secret_key, :string
@@ -8,6 +12,10 @@ class TwoFactorAuthenticationAddTo<%= table_name.camelize %> < ActiveRecord::Mig
     add_column :<%= table_name %>, :direct_otp_sent_at, :datetime
     add_column :<%= table_name %>, :totp_timestamp, :timestamp
 
+<% if postgresql? -%>
+    add_index :<%= table_name %>, :encrypted_otp_secret_key, unique: true, algorithm: :concurrently
+<% else -%>
     add_index :<%= table_name %>, :encrypted_otp_secret_key, unique: true
+<% end -%>
   end
 end

data/lib/generators/active_record/two_factor_authentication_generator.rb

@@ -9,6 +9,24 @@ module ActiveRecord
         migration_template "migration.rb", "db/migrate/two_factor_authentication_add_to_#{table_name}.rb"
       end
 
+      private
+
+      def migration_version
+        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
+      end
+
+      # CREATE INDEX CONCURRENTLY is PostgreSQL-only; other adapters reject the option.
+      def postgresql?
+        config = if ActiveRecord::Base.respond_to?(:connection_db_config)
+                   ActiveRecord::Base.connection_db_config
+                 else
+                   ActiveRecord::Base.connection_config
+                 end
+        adapter = config.respond_to?(:adapter) ? config.adapter : config[:adapter]
+        adapter.to_s.include?("postg")
+      rescue StandardError
+        false
+      end
     end
   end
 end

data/lib/generators/two_factor_authentication/two_factor_authentication_generator.rb

@@ -7,7 +7,7 @@ module TwoFactorAuthenticatable
 
       def inject_two_factor_authentication_content
         path = File.join("app", "models", "#{file_path}.rb")
-        inject_into_file(path, "two_factor_authenticatable, :", :after => "devise :") if File.exists?(path)
+        inject_into_file(path, "two_factor_authenticatable, :", :after => "devise :") if File.exist?(File.join(destination_root, path))
       end
 
       hook_for :orm

data/lib/two_factor_authentication/controllers/helpers.rb

@@ -20,11 +20,14 @@ module TwoFactorAuthentication
       end
 
       def handle_failed_second_factor(scope)
-        if request.format.present? and request.format.html?
+        if request.format&.html?
           session["#{scope}_return_to"] = request.original_fullpath if request.get?
           redirect_to two_factor_authentication_path_for(scope)
+        elsif request.format&.json?
+          session["#{scope}_return_to"] = root_path(format: :html)
+          render json: { redirect_to: two_factor_authentication_path_for(scope) }, status: :unauthorized
         else
-          render nothing: true, status: :unauthorized
+          head :unauthorized
         end
       end
 
@@ -41,8 +44,9 @@ end
 module Devise
   module Controllers
     module Helpers
-      def is_fully_authenticated?
-        !session["warden.user.user.session"].try(:[], TwoFactorAuthentication::NEED_AUTHENTICATION)
+      def is_fully_authenticated?(scope = nil)
+        scope ||= devise_controller? ? resource_name : Devise.default_scope
+        !session["warden.user.#{scope}.session"].try(:[], TwoFactorAuthentication::NEED_AUTHENTICATION)
       end
     end
   end

data/lib/two_factor_authentication/models/two_factor_authenticatable.rb

@@ -16,7 +16,7 @@ module Devise
         ::Devise::Models.config(
           self, :max_login_attempts, :allowed_otp_drift_seconds, :otp_length,
           :remember_otp_session_for_seconds, :otp_secret_encryption_key,
-          :direct_otp_length, :direct_otp_valid_for, :totp_timestamp, :delete_cookie_on_logout
+          :direct_otp_length, :direct_otp_valid_for, :delete_cookie_on_logout
         )
       end
 
@@ -39,9 +39,12 @@ module Devise
           drift = options[:drift] || self.class.allowed_otp_drift_seconds
           raise "authenticate_totp called with no otp_secret_key set" if totp_secret.nil?
           totp = ROTP::TOTP.new(totp_secret, digits: digits)
-          new_timestamp = totp.verify_with_drift_and_prior(code, drift, totp_timestamp)
+          new_timestamp = totp.verify(
+            without_spaces(code), 
+            drift_ahead: drift, drift_behind: drift, after: totp_timestamp
+          )
           return false unless new_timestamp
-          self.totp_timestamp = new_timestamp
+          self.totp_timestamp = Time.at(new_timestamp).utc
           true
         end
 
@@ -89,13 +92,16 @@ module Devise
         end
 
         def generate_totp_secret
-          ROTP::Base32.random_base32
+          # ROTP gem since version 5 to version 5.1
+          # at version 5.1 ROTP gem reinstates.
+          # Details: https://github.com/mdp/rotp/blob/master/CHANGELOG.md#510
+          ROTP::Base32.try(:random) || ROTP::Base32.random_base32
         end
 
         def create_direct_otp(options = {})
           # Create a new random OTP and store it in the database
           digits = options[:length] || self.class.direct_otp_length || 6
-          update_attributes(
+          update(
             direct_otp: random_base10(digits),
             direct_otp_sent_at: Time.now.utc
           )
@@ -103,6 +109,10 @@ module Devise
 
         private
 
+        def without_spaces(code)
+          code.gsub(/\s/, '')
+        end
+
         def random_base10(digits)
           SecureRandom.random_number(10**digits).to_s.rjust(digits, '0')
         end
@@ -112,7 +122,7 @@ module Devise
         end
 
         def clear_direct_otp
-          update_attributes(direct_otp: nil, direct_otp_sent_at: nil)
+          update(direct_otp: nil, direct_otp_sent_at: nil)
         end
       end
 

data/lib/two_factor_authentication/orm/active_record.rb

@@ -1,3 +1,5 @@
+require "active_record"
+
 module TwoFactorAuthentication
   module Orm
     module ActiveRecord

data/lib/two_factor_authentication/routes.rb

@@ -3,7 +3,7 @@ module ActionDispatch::Routing
     protected
 
       def devise_two_factor_authentication(mapping, controllers)
-        resource :two_factor_authentication, :only => [:show, :update, :resend_code], :path => mapping.path_names[:two_factor_authentication], :controller => controllers[:two_factor_authentication] do
+        resource :two_factor_authentication, :only => [:show, :update], :path => mapping.path_names[:two_factor_authentication], :controller => controllers[:two_factor_authentication] do
           collection { get "resend_code" }
         end
       end

data/lib/two_factor_authentication/schema.rb

@@ -1,31 +1,31 @@
 module TwoFactorAuthentication
   module Schema
     def second_factor_attempts_count
-      apply_devise_schema :second_factor_attempts_count, Integer, :default => 0
+      integer :second_factor_attempts_count, :default => 0
     end
 
     def encrypted_otp_secret_key
-      apply_devise_schema :encrypted_otp_secret_key, String
+      string :encrypted_otp_secret_key
     end
 
     def encrypted_otp_secret_key_iv
-      apply_devise_schema :encrypted_otp_secret_key_iv, String
+      string :encrypted_otp_secret_key_iv
     end
 
     def encrypted_otp_secret_key_salt
-      apply_devise_schema :encrypted_otp_secret_key_salt, String
+      string :encrypted_otp_secret_key_salt
     end
 
     def direct_otp
-      apply_devise_schema :direct_otp, String
+      string :direct_otp
     end
 
     def direct_otp_sent_at
-      apply_devise_schema :direct_otp_sent_at, DateTime
+      datetime :direct_otp_sent_at
     end
 
     def totp_timestamp
-      apply_devise_schema :totp_timestamp, Timestamp
+      timestamp :totp_timestamp
     end
   end
 end

data/lib/two_factor_authentication/version.rb

@@ -1,3 +1,3 @@
 module TwoFactorAuthentication
-  VERSION = "2.1.1".freeze
+  VERSION = "3.0.0".freeze
 end

data/lib/two_factor_authentication.rb

@@ -2,7 +2,6 @@ require 'two_factor_authentication/version'
 require 'devise'
 require 'active_support/concern'
 require "active_model"
-require "active_record"
 require "active_support/core_ext/class/attribute_accessors"
 require "cgi"
 
@@ -47,7 +46,7 @@ end
 
 Devise.add_module :two_factor_authenticatable, :model => 'two_factor_authentication/models/two_factor_authenticatable', :controller => :two_factor_authentication, :route => :two_factor_authentication
 
-require 'two_factor_authentication/orm/active_record'
+require 'two_factor_authentication/orm/active_record' if defined?(ActiveRecord::Base)
 require 'two_factor_authentication/routes'
 require 'two_factor_authentication/models/two_factor_authenticatable'
 require 'two_factor_authentication/rails'

data/spec/controllers/two_factor_authentication_controller_spec.rb

@@ -1,6 +1,14 @@
 require 'spec_helper'
 
 describe Devise::TwoFactorAuthenticationController, type: :controller do
+  def post_code(code)
+    if Rails::VERSION::MAJOR >= 5
+      post :update, params: { code: code }
+    else
+      post :update, code: code
+    end
+  end
+
   describe 'is_fully_authenticated? helper' do
     before do
       sign_in
@@ -9,7 +17,7 @@ describe Devise::TwoFactorAuthenticationController, type: :controller do
     context 'after user enters valid OTP code' do
       it 'returns true' do
         controller.current_user.send_new_otp
-        post :update, code: controller.current_user.direct_otp
+        post_code controller.current_user.direct_otp
         expect(subject.is_fully_authenticated?).to eq true
       end
     end
@@ -24,10 +32,87 @@ describe Devise::TwoFactorAuthenticationController, type: :controller do
 
     context 'when user enters an invalid OTP' do
       it 'returns false' do
-        post :update, code: '12345'
+        post_code '12345'
 
         expect(subject.is_fully_authenticated?).to eq false
       end
     end
   end
+
+  describe 'PUT update' do
+    render_views
+
+    let(:user) { create_user }
+
+    before do
+      sign_in user
+      user.send_new_otp
+    end
+
+    it 'responds with 422 and re-renders the form for an invalid code' do
+      post_code '00000000'
+
+      expect(response).to have_http_status(422)
+      expect(response.body).to include('Enter the code that was sent to you')
+      expect(user.reload.second_factor_attempts_count).to eq(1)
+    end
+
+    it 'responds with 422 and signs out when the last attempt fails' do
+      user.update!(second_factor_attempts_count: User.max_login_attempts - 1)
+
+      post_code '00000000'
+
+      expect(response).to have_http_status(422)
+      expect(response.body).to include('Access completely denied')
+    end
+
+    it 'resets the failed attempt counter after a valid code' do
+      user.update!(second_factor_attempts_count: 1)
+
+      post_code user.reload.direct_otp
+
+      expect(response).to redirect_to(root_path)
+      expect(user.reload.second_factor_attempts_count).to eq(0)
+    end
+  end
+
+  describe 'GET resend_code' do
+    let(:user) { create_user }
+
+    before { sign_in user }
+
+    it 'sends a new code and redirects back to the form' do
+      get :resend_code
+
+      expect(SMSProvider.messages.size).to eq(1)
+      expect(SMSProvider.last_message.body).to eq(user.reload.direct_otp)
+      expect(response).to redirect_to(user_two_factor_authentication_path)
+      expect(flash[:notice]).to eq('Your authentication code has been sent.')
+    end
+  end
+
+  context 'with a second devise scope' do
+    let(:secure_user) { create_secure_user }
+
+    before do
+      @request.env['devise.mapping'] = Devise.mappings[:secure_user]
+      sign_in secure_user, scope: :secure_user
+    end
+
+    it 'reports the scope of the current resource as not fully authenticated' do
+      get :show
+
+      expect(response).to have_http_status(200)
+      expect(subject.is_fully_authenticated?).to eq false
+      expect(subject.is_fully_authenticated?(:secure_user)).to eq false
+    end
+
+    it 'reports the scope as fully authenticated after a valid code' do
+      secure_user.send_new_otp
+      post_code secure_user.reload.direct_otp
+
+      expect(subject.is_fully_authenticated?).to eq true
+      expect(subject.is_fully_authenticated?(:secure_user)).to eq true
+    end
+  end
 end

data/spec/features/two_factor_authenticatable_spec.rb

@@ -3,20 +3,14 @@ include AuthenticatedModelHelper
 
 feature "User of two factor authentication" do
   context 'sending two factor authentication code via SMS' do
-    shared_examples 'sends and authenticates code' do |user, type|
-      before do
-        user.reload
-        if type == 'encrypted'
-          allow(User).to receive(:has_one_time_password).with(encrypted: true)
-        end
-      end
-
+    shared_examples 'sends and authenticates code' do |scope|
       it 'does not send an SMS before the user has signed in' do
+        user
         expect(SMSProvider.messages).to be_empty
       end
 
       it 'sends code via SMS after sign in' do
-        visit new_user_session_path
+        visit send("new_#{scope}_session_path")
         complete_sign_in_form_for(user)
 
         expect(page).to have_content 'Enter the code that was sent to you'
@@ -28,11 +22,9 @@ feature "User of two factor authentication" do
       end
 
       it 'authenticates a valid OTP code' do
-        visit new_user_session_path
+        visit send("new_#{scope}_session_path")
         complete_sign_in_form_for(user)
 
-        expect(page).to have_content('You are signed in as Marissa')
-
         fill_in 'code', with: SMSProvider.last_message.body
         click_button 'Submit'
 
@@ -42,10 +34,101 @@ feature "User of two factor authentication" do
 
         expect(current_path).to eq root_path
       end
+
+      it 'sends a new code when the user asks to resend it' do
+        visit send("new_#{scope}_session_path")
+        complete_sign_in_form_for(user)
+
+        click_link 'Resend Code'
+
+        expect(page).to have_content('Your authentication code has been sent.')
+        expect(SMSProvider.messages.size).to eq(2)
+
+        fill_in 'code', with: SMSProvider.last_message.body
+        click_button 'Submit'
+
+        expect(page).to have_content('Two factor authentication successful.')
+      end
+    end
+
+    context 'for a user with a plain OTP secret' do
+      let(:user) { create_user }
+
+      it_behaves_like 'sends and authenticates code', :user
+    end
+
+    context 'for a second devise scope with an encrypted OTP secret' do
+      let(:user) { create_secure_user }
+
+      it_behaves_like 'sends and authenticates code', :secure_user
+    end
+  end
+
+  context 'authenticating with an authenticator app (TOTP)' do
+    shared_examples 'authenticates a TOTP code' do |scope|
+      let(:secret) { user.generate_totp_secret }
+
+      before do
+        user.update!(otp_secret_key: secret)
+        visit send("new_#{scope}_session_path")
+        complete_sign_in_form_for(user)
+      end
+
+      it 'asks for the authenticator code without sending an SMS' do
+        expect(page).to have_content('Enter the code from your authenticator app')
+        expect(SMSProvider.messages).to be_empty
+      end
+
+      it 'accepts a valid TOTP code' do
+        fill_in 'code', with: ROTP::TOTP.new(secret).now
+        click_button 'Submit'
+
+        expect(page).to have_content('Two factor authentication successful.')
+        expect(current_path).to eq root_path
+      end
+
+      it 'rejects an invalid TOTP code' do
+        fill_in 'code', with: 'incorrect'
+        click_button 'Submit'
+
+        expect(page).to have_content('Attempt failed')
+        expect(page).to have_content('Enter the code from your authenticator app')
+      end
+
+      it 'sends a code by SMS on request instead' do
+        click_link 'Send me a code instead'
+
+        expect(SMSProvider.messages.size).to eq(1)
+        fill_in 'code', with: SMSProvider.last_message.body
+        click_button 'Submit'
+
+        expect(page).to have_content('Two factor authentication successful.')
+      end
+    end
+
+    context 'for a user with a plain OTP secret' do
+      let(:user) { create_user }
+
+      it_behaves_like 'authenticates a TOTP code', :user
     end
 
-    it_behaves_like 'sends and authenticates code', create_user('not_encrypted')
-    it_behaves_like 'sends and authenticates code', create_user, 'encrypted'
+    context 'for a second devise scope with an encrypted OTP secret' do
+      let(:user) { create_secure_user }
+
+      it_behaves_like 'authenticates a TOTP code', :secure_user
+    end
+  end
+
+  scenario 'user who does not need two factor authentication goes straight in' do
+    allow_any_instance_of(User).to receive(:need_two_factor_authentication?).and_return(false)
+    user = create_user
+
+    visit new_user_session_path
+    complete_sign_in_form_for(user)
+    visit dashboard_path
+
+    expect(page).to have_content('Your Personal Dashboard')
+    expect(SMSProvider.messages).to be_empty
   end
 
   scenario "must be logged in" do
@@ -94,6 +177,28 @@ feature "User of two factor authentication" do
       expect(page).to have_content("You are signed out")
     end
 
+    scenario "failed attempts are reset after a successful code" do
+      visit user_two_factor_authentication_path
+
+      fill_in "code", with: "incorrect"
+      click_button "Submit"
+      expect(user.reload.second_factor_attempts_count).to eq(1)
+
+      fill_in "code", with: SMSProvider.last_message.body
+      click_button "Submit"
+
+      expect(page).to have_content("Two factor authentication successful.")
+      expect(user.reload.second_factor_attempts_count).to eq(0)
+    end
+
+    scenario "can sign out from the two factor page" do
+      visit user_two_factor_authentication_path
+
+      click_button "Sign out"
+
+      expect(page).to have_content("You are signed out")
+    end
+
     scenario "cannot retry authentication after max attempts" do
       user.update_attribute(:second_factor_attempts_count, User.max_login_attempts)
 

data/spec/generators/active_record/two_factor_authentication_generator_spec.rb

@@ -1,9 +1,10 @@
 require 'spec_helper'
+require 'tmpdir'
 
 require 'generators/active_record/two_factor_authentication_generator'
 
 describe ActiveRecord::Generators::TwoFactorAuthenticationGenerator, type: :generator do
-  destination File.expand_path('../../../../../tmp', __FILE__)
+  destination File.join(Dir.tmpdir, 'two_factor_authentication_generator')
 
   before do
     prepare_destination
@@ -21,16 +22,63 @@ describe ActiveRecord::Generators::TwoFactorAuthenticationGenerator, type: :gene
     end
 
     describe 'the migration' do
-      subject { migration_file('db/migrate/two_factor_authentication_add_to_users.rb') }
+      subject { Pathname.new(migration_file('db/migrate/two_factor_authentication_add_to_users.rb')) }
 
-      it { is_expected.to exist }
+      it { is_expected.to satisfy { |path| File.exist?(path) } }
       it { is_expected.to be_a_migration }
+      it { is_expected.to contain /< ActiveRecord::Migration\[#{ActiveRecord::VERSION::MAJOR}\.#{ActiveRecord::VERSION::MINOR}\]/ }
       it { is_expected.to contain /def change/ }
       it { is_expected.to contain /add_column :users, :second_factor_attempts_count, :integer, default: 0/ }
       it { is_expected.to contain /add_column :users, :encrypted_otp_secret_key, :string/ }
       it { is_expected.to contain /add_column :users, :encrypted_otp_secret_key_iv, :string/ }
       it { is_expected.to contain /add_column :users, :encrypted_otp_secret_key_salt, :string/ }
-      it { is_expected.to contain /add_index :users, :encrypted_otp_secret_key, unique: true/ }
+      it { is_expected.to contain /add_column :users, :direct_otp, :string/ }
+      it { is_expected.to contain /add_column :users, :direct_otp_sent_at, :datetime/ }
+      it { is_expected.to contain /add_column :users, :totp_timestamp, :timestamp/ }
+      it { is_expected.to contain /add_index :users, :encrypted_otp_secret_key, unique: true$/ }
+      it { is_expected.not_to contain /concurrently/ }
+      it { is_expected.not_to contain /disable_ddl_transaction!/ }
+    end
+  end
+
+  describe 'on PostgreSQL' do
+    subject { Pathname.new(migration_file('db/migrate/two_factor_authentication_add_to_users.rb')) }
+
+    before do
+      gen = generator %w(users)
+      allow(gen).to receive(:postgresql?).and_return(true)
+      gen.invoke_all
+    end
+
+    it { is_expected.to contain /disable_ddl_transaction!/ }
+    it { is_expected.to contain /add_index :users, :encrypted_otp_secret_key, unique: true, algorithm: :concurrently/ }
+  end
+
+  describe 'running the generated migration' do
+    let(:connection) { ActiveRecord::Base.connection }
+
+    before do
+      connection.create_table(:accounts) { |t| t.string :email }
+      run_generator %w(accounts)
+      load migration_file('db/migrate/two_factor_authentication_add_to_accounts.rb')
+    end
+
+    after do
+      connection.drop_table(:accounts, if_exists: true)
+      Object.send(:remove_const, :TwoFactorAuthenticationAddToAccounts)
+    end
+
+    it 'adds the two factor columns and index' do
+      ActiveRecord::Migration.suppress_messages do
+        TwoFactorAuthenticationAddToAccounts.migrate(:up)
+      end
+
+      expect(connection.columns(:accounts).map(&:name)).to include(
+        'second_factor_attempts_count', 'encrypted_otp_secret_key',
+        'encrypted_otp_secret_key_iv', 'encrypted_otp_secret_key_salt',
+        'direct_otp', 'direct_otp_sent_at', 'totp_timestamp'
+      )
+      expect(connection.index_exists?(:accounts, :encrypted_otp_secret_key, unique: true)).to eq(true)
     end
   end
 end

data/spec/generators/two_factor_authentication/two_factor_authentication_generator_spec.rb

@@ -0,0 +1,37 @@
+require 'spec_helper'
+
+require 'generators/two_factor_authentication/two_factor_authentication_generator'
+
+describe TwoFactorAuthenticatable::Generators::TwoFactorAuthenticationGenerator, type: :generator do
+  destination File.expand_path('../../../tmp/generators', __dir__)
+
+  let(:model_path) { File.join(destination_root, 'app/models/account.rb') }
+
+  before do
+    prepare_destination
+    FileUtils.mkdir_p(File.dirname(model_path))
+    File.write(model_path, <<~RUBY)
+      class Account < ApplicationRecord
+        devise :database_authenticatable, :validatable
+      end
+    RUBY
+  end
+
+  it 'adds :two_factor_authenticatable to the devise call in the model' do
+    run_generator %w(account --orm=active_record)
+
+    expect(File.read(model_path)).to include('devise :two_factor_authenticatable, :database_authenticatable, :validatable')
+  end
+
+  it 'generates the migration through the orm hook' do
+    run_generator %w(account --orm=active_record)
+
+    expect(Pathname.new(migration_file('db/migrate/two_factor_authentication_add_to_accounts.rb'))).to exist
+  end
+
+  it 'does not fail when the model file is missing' do
+    File.delete(model_path)
+
+    expect { run_generator %w(account --orm=active_record) }.not_to raise_error
+  end
+end