two_factor_authentication 2.1.1 → 3.0.0

data/spec/lib/two_factor_authentication/models/two_factor_authenticatable_spec.rb

@@ -86,6 +86,11 @@ describe Devise::Models::TwoFactorAuthenticatable do
         expect(do_invoke(code, instance)).to eq(true)
       end
 
+      it 'authenticates a code entered with a space' do
+        code = @totp_helper.totp_code.insert(3, ' ')
+        expect(do_invoke(code, instance)).to eq(true)
+      end
+
       it 'does not authenticate an old code' do
         code = @totp_helper.totp_code(1.minutes.ago.to_i)
         expect(do_invoke(code, instance)).to eq(false)
@@ -132,25 +137,29 @@ describe Devise::Models::TwoFactorAuthenticatable do
         end
 
         it "returns uri with user's email" do
-          expect(instance.provisioning_uri).
-            to match(%r{otpauth://totp/houdini@example.com\?secret=\w{16}})
+          uri = URI.parse(instance.provisioning_uri)
+          params = URI.decode_www_form(uri.query).to_h
+
+          expect(uri.scheme).to eq('otpauth')
+          expect(uri.host).to eq('totp')
+          expect(URI.decode_www_form_component(uri.path)).to eq('/houdini@example.com')
+          expect(params['secret']).to match(/\w{32}/)
         end
 
         it 'returns uri with issuer option' do
           expect(instance.provisioning_uri('houdini')).
-            to match(%r{otpauth://totp/houdini\?secret=\w{16}$})
+            to match(%r{otpauth://totp/houdini\?secret=\w{32}$})
         end
 
         it 'returns uri with issuer option' do
-          require 'cgi'
           uri = URI.parse(instance.provisioning_uri('houdini', issuer: 'Magic'))
-          params = CGI.parse(uri.query)
+          params = URI.decode_www_form(uri.query).to_h
 
           expect(uri.scheme).to eq('otpauth')
           expect(uri.host).to eq('totp')
-          expect(uri.path).to eq('/Magic:houdini')
-          expect(params['issuer'].shift).to eq('Magic')
-          expect(params['secret'].shift).to match(/\w{16}/)
+          expect(URI.decode_www_form_component(uri.path)).to eq('/Magic:houdini')
+          expect(params['issuer']).to eq('Magic')
+          expect(params['secret']).to match(/\w{32}/)
         end
       end
     end
@@ -163,10 +172,10 @@ describe Devise::Models::TwoFactorAuthenticatable do
     shared_examples 'generate_totp_secret' do |klass|
       let(:instance) { klass.new }
 
-      it 'returns a 16 character string' do
+      it 'returns a 32 character string' do
         secret = instance.generate_totp_secret
 
-        expect(secret).to match(/\w{16}/)
+        expect(secret).to match(/\w{32}/)
       end
     end
 
@@ -318,4 +327,82 @@ describe Devise::Models::TwoFactorAuthenticatable do
       end
     end
   end
+
+  context 'with an ActiveRecord model' do
+    let(:user) { create_user }
+
+    describe '#create_direct_otp' do
+      it 'persists the code and the time it was sent' do
+        Timecop.freeze do
+          user.create_direct_otp
+          user.reload
+
+          expect(user.direct_otp).to match(/\A\d{6}\z/)
+          expect(user.direct_otp_sent_at).to be_within(1.second).of(Time.now)
+        end
+      end
+    end
+
+    describe '#authenticate_direct_otp' do
+      it 'clears the persisted code after a successful match' do
+        user.create_direct_otp
+        code = user.reload.direct_otp
+
+        expect(user.authenticate_direct_otp(code)).to eq(true)
+        user.reload
+        expect(user.direct_otp).to be_nil
+        expect(user.direct_otp_sent_at).to be_nil
+      end
+    end
+
+    describe '#send_new_otp' do
+      it 'delivers the persisted code' do
+        user.send_new_otp
+
+        expect(SMSProvider.last_message.body).to eq(user.reload.direct_otp)
+      end
+    end
+
+    describe '#authenticate_totp' do
+      shared_examples 'persisted totp' do
+        let(:secret) { record.generate_totp_secret }
+
+        before do
+          record.otp_secret_key = secret
+          record.save!
+        end
+
+        it 'stores the last used time step as a time' do
+          expect(record.authenticate_totp(ROTP::TOTP.new(secret).now)).to eq(true)
+          record.save!
+
+          expect(record.reload.totp_timestamp).to be_a(Time)
+        end
+
+        it 'rejects a reused code after the record is reloaded' do
+          code = ROTP::TOTP.new(secret).now
+          expect(record.authenticate_totp(code)).to eq(true)
+          record.save!
+
+          expect(record.class.find(record.id).authenticate_totp(code)).to eq(false)
+        end
+      end
+
+      context 'with a plain secret' do
+        let(:record) { user }
+        include_examples 'persisted totp'
+      end
+
+      context 'with an encrypted secret' do
+        let(:record) { create_secure_user }
+        include_examples 'persisted totp'
+
+        it 'keeps the secret encrypted in the database' do
+          expect(record.reload.encrypted_otp_secret_key).to be_present
+          expect(record.encrypted_otp_secret_key).not_to include(secret)
+          expect(record.otp_secret_key).to eq(secret)
+        end
+      end
+    end
+  end
 end

data/spec/lib/two_factor_authentication/schema_spec.rb

@@ -0,0 +1,41 @@
+require 'spec_helper'
+
+describe TwoFactorAuthentication::Schema do
+  let(:connection) { ActiveRecord::Base.connection }
+
+  after { connection.drop_table(:schema_helper_users, if_exists: true) }
+
+  def columns
+    connection.columns(:schema_helper_users).index_by(&:name)
+  end
+
+  it 'adds every column in create_table' do
+    connection.create_table(:schema_helper_users) do |t|
+      t.second_factor_attempts_count
+      t.encrypted_otp_secret_key
+      t.encrypted_otp_secret_key_iv
+      t.encrypted_otp_secret_key_salt
+      t.direct_otp
+      t.direct_otp_sent_at
+      t.totp_timestamp
+    end
+
+    expect(columns['second_factor_attempts_count'].type).to eq(:integer)
+    expect(columns['second_factor_attempts_count'].default.to_i).to eq(0)
+    %w(encrypted_otp_secret_key encrypted_otp_secret_key_iv encrypted_otp_secret_key_salt direct_otp).each do |name|
+      expect(columns[name].type).to eq(:string)
+    end
+    expect(columns['direct_otp_sent_at'].type).to eq(:datetime)
+    expect(columns['totp_timestamp'].type).to eq(:datetime)
+  end
+
+  it 'adds columns in change_table' do
+    connection.create_table(:schema_helper_users)
+    connection.change_table(:schema_helper_users) do |t|
+      t.second_factor_attempts_count
+      t.totp_timestamp
+    end
+
+    expect(columns.keys).to include('second_factor_attempts_count', 'totp_timestamp')
+  end
+end

data/spec/rails_app/app/assets/config/manifest.js

@@ -0,0 +1,2 @@
+//= link_directory ../javascripts .js
+//= link_directory ../stylesheets .css

data/spec/rails_app/app/controllers/home_controller.rb

@@ -1,5 +1,5 @@
 class HomeController < ApplicationController
-  before_action :authenticate_user!, only: :dashboard
+  before_action :authenticate_user!, only: [:dashboard, :secret]
 
   def index
   end
@@ -7,4 +7,9 @@ class HomeController < ApplicationController
   def dashboard
   end
 
+  # Responds to any format, to prove the 2FA check halts non-HTML/JSON requests
+  def secret
+    render plain: 'top secret'
+  end
+
 end

data/spec/rails_app/app/models/guest_user.rb

@@ -7,7 +7,7 @@ class GuestUser
   attr_accessor :direct_otp, :direct_otp_sent_at, :otp_secret_key, :email,
     :second_factor_attempts_count, :totp_timestamp
 
-  def update_attributes(attrs)
+  def update(attrs)
     attrs.each do |key, value|
       send(key.to_s + '=', value)
     end

data/spec/rails_app/app/models/secure_user.rb

@@ -0,0 +1,13 @@
+class SecureUser < ActiveRecord::Base
+  devise :two_factor_authenticatable, :database_authenticatable, :validatable
+
+  has_one_time_password(encrypted: true)
+
+  def send_two_factor_authentication_code(code)
+    SMSProvider.send_message(to: phone_number, body: code)
+  end
+
+  def phone_number
+    '14155550000'
+  end
+end

data/spec/rails_app/config/application.rb

@@ -1,3 +1,4 @@
+require 'logger'
 require File.expand_path('../boot', __FILE__)
 
 require "active_record/railtie"
@@ -60,4 +61,3 @@ module Dummy
     config.secret_key_base = 'secretvalue'
   end
 end
-

data/spec/rails_app/config/environments/test.rb

@@ -9,14 +9,8 @@ Dummy::Application.configure do
   config.eager_load = false
 
   # Configure static asset server for tests with Cache-Control for performance
-  if Rails::VERSION::MAJOR == 4 && Rails::VERSION::MINOR >= 2 ||
-    Rails::VERSION::MAJOR >= 5
-    config.serve_static_files = true
-  else
-    config.serve_static_assets = true
-  end
-
-  config.static_cache_control = "public, max-age=3600"
+  config.public_file_server.enabled = true
+  config.public_file_server.headers = { "Cache-Control" => "public, max-age=3600" }
 
   # Show full error reports and disable caching
   config.consider_all_requests_local       = true
@@ -38,4 +32,5 @@ Dummy::Application.configure do
 
   # For testing session variables in Capybara specs
   config.middleware.use RackSessionAccess::Middleware
+  config.assets.check_precompiled_asset = false
 end

data/spec/rails_app/config/initializers/inflections.rb

@@ -13,3 +13,7 @@
 # ActiveSupport::Inflector.inflections do |inflect|
 #   inflect.acronym 'RESTful'
 # end
+
+ActiveSupport::Inflector.inflections(:en) do |inflect|
+  inflect.acronym 'SMS'
+end

data/spec/rails_app/config/routes.rb

@@ -3,8 +3,10 @@ Dummy::Application.routes.draw do
   root to: "home#index"
 
   match "/dashboard", to: "home#dashboard", as: :dashboard, via: [:get]
+  get "/secret", to: "home#secret", as: :secret
 
   devise_for :users
+  devise_for :secure_users
 
   # The priority is based upon order of creation:
   # first created -> highest priority.

data/spec/rails_app/db/migrate/20140403184646_devise_create_users.rb

@@ -1,4 +1,4 @@
-class DeviseCreateUsers < ActiveRecord::Migration
+class DeviseCreateUsers < ActiveRecord::Migration[4.2]
   def change
     create_table(:users) do |t|
       ## Database authenticatable

data/spec/rails_app/db/migrate/20140407172619_two_factor_authentication_add_to_users.rb

@@ -1,4 +1,4 @@
-class TwoFactorAuthenticationAddToUsers < ActiveRecord::Migration
+class TwoFactorAuthenticationAddToUsers < ActiveRecord::Migration[4.2]
   def up
     change_table :users do |t|
       t.string   :otp_secret_key

data/spec/rails_app/db/migrate/20140407215513_add_nickanme_to_users.rb

@@ -1,4 +1,4 @@
-class AddNickanmeToUsers < ActiveRecord::Migration
+class AddNickanmeToUsers < ActiveRecord::Migration[4.2]
   def change
     change_table :users do |t|
       t.column :nickname, :string, limit: 64

data/spec/rails_app/db/migrate/20151224171231_add_encrypted_columns_to_user.rb

@@ -1,4 +1,4 @@
-class AddEncryptedColumnsToUser < ActiveRecord::Migration
+class AddEncryptedColumnsToUser < ActiveRecord::Migration[4.2]
   def change
     add_column :users, :encrypted_otp_secret_key, :string
     add_column :users, :encrypted_otp_secret_key_iv, :string

data/spec/rails_app/db/migrate/20151224180310_populate_otp_column.rb

@@ -1,4 +1,4 @@
-class PopulateOtpColumn < ActiveRecord::Migration
+class PopulateOtpColumn < ActiveRecord::Migration[4.2]
   def up
     User.reset_column_information
 

data/spec/rails_app/db/migrate/20151228230340_remove_otp_secret_key_from_user.rb

@@ -1,4 +1,4 @@
-class RemoveOtpSecretKeyFromUser < ActiveRecord::Migration
+class RemoveOtpSecretKeyFromUser < ActiveRecord::Migration[4.2]
   def change
     remove_column :users, :otp_secret_key, :string
   end

data/spec/rails_app/db/migrate/20160209032439_devise_create_admins.rb

@@ -1,4 +1,4 @@
-class DeviseCreateAdmins < ActiveRecord::Migration
+class DeviseCreateAdmins < ActiveRecord::Migration[4.2]
   def change
     create_table(:admins) do |t|
       ## Database authenticatable

data/spec/rails_app/db/migrate/20260929000000_add_otp_columns_to_users.rb

@@ -0,0 +1,8 @@
+class AddOtpColumnsToUsers < ActiveRecord::Migration[5.0]
+  def change
+    add_column :users, :otp_secret_key, :string
+    add_column :users, :direct_otp, :string
+    add_column :users, :direct_otp_sent_at, :datetime
+    add_column :users, :totp_timestamp, :timestamp
+  end
+end

data/spec/rails_app/db/migrate/20260929000001_devise_create_secure_users.rb

@@ -0,0 +1,22 @@
+# A second 2FA scope whose TOTP secret is encrypted.
+class DeviseCreateSecureUsers < ActiveRecord::Migration[5.0]
+  def change
+    create_table(:secure_users) do |t|
+      t.string :email,              null: false, default: ""
+      t.string :encrypted_password, null: false, default: ""
+
+      t.integer  :second_factor_attempts_count, default: 0
+      t.string   :encrypted_otp_secret_key
+      t.string   :encrypted_otp_secret_key_iv
+      t.string   :encrypted_otp_secret_key_salt
+      t.string   :direct_otp
+      t.datetime :direct_otp_sent_at
+      t.timestamp :totp_timestamp
+
+      t.timestamps null: false
+    end
+
+    add_index :secure_users, :email, unique: true
+    add_index :secure_users, :encrypted_otp_secret_key, unique: true
+  end
+end

data/spec/rails_app/db/schema.rb

@@ -1,58 +1,73 @@
-# encoding: UTF-8
 # This file is auto-generated from the current state of the database. Instead
 # of editing this file, please use the migrations feature of Active Record to
 # incrementally modify your database, and then regenerate this schema definition.
 #
-# Note that this schema.rb definition is the authoritative source for your
-# database schema. If you need to create the application database on another
-# system, you should be using db:schema:load, not running all the migrations
-# from scratch. The latter is a flawed and unsustainable approach (the more migrations
-# you'll amass, the slower it'll run and the greater likelihood for issues).
+# This file is the source Rails uses to define your schema when running `bin/rails
+# db:schema:load`. When creating a new database, `bin/rails db:schema:load` tends to
+# be faster and is potentially less error prone than running all of your
+# migrations from scratch. Old migrations may fail to apply correctly if those
+# migrations use external dependencies or application code.
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20160209032439) do
-
+ActiveRecord::Schema.define(version: 2026_09_29_000001) do
   create_table "admins", force: :cascade do |t|
-    t.string   "email",                  default: "", null: false
-    t.string   "encrypted_password",     default: "", null: false
-    t.string   "reset_password_token"
+    t.string "email", default: "", null: false
+    t.string "encrypted_password", default: "", null: false
+    t.string "reset_password_token"
     t.datetime "reset_password_sent_at"
     t.datetime "remember_created_at"
-    t.integer  "sign_in_count",          default: 0,  null: false
+    t.integer "sign_in_count", default: 0, null: false
     t.datetime "current_sign_in_at"
     t.datetime "last_sign_in_at"
-    t.string   "current_sign_in_ip"
-    t.string   "last_sign_in_ip"
-    t.datetime "created_at",                          null: false
-    t.datetime "updated_at",                          null: false
+    t.string "current_sign_in_ip"
+    t.string "last_sign_in_ip"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["email"], name: "index_admins_on_email", unique: true
+    t.index ["reset_password_token"], name: "index_admins_on_reset_password_token", unique: true
   end
 
-  add_index "admins", ["email"], name: "index_admins_on_email", unique: true
-  add_index "admins", ["reset_password_token"], name: "index_admins_on_reset_password_token", unique: true
+  create_table "secure_users", force: :cascade do |t|
+    t.string "email", default: "", null: false
+    t.string "encrypted_password", default: "", null: false
+    t.integer "second_factor_attempts_count", default: 0
+    t.string "encrypted_otp_secret_key"
+    t.string "encrypted_otp_secret_key_iv"
+    t.string "encrypted_otp_secret_key_salt"
+    t.string "direct_otp"
+    t.datetime "direct_otp_sent_at"
+    t.datetime "totp_timestamp"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["email"], name: "index_secure_users_on_email", unique: true
+    t.index ["encrypted_otp_secret_key"], name: "index_secure_users_on_encrypted_otp_secret_key", unique: true
+  end
 
   create_table "users", force: :cascade do |t|
-    t.string   "email",                                    default: "", null: false
-    t.string   "encrypted_password",                       default: "", null: false
-    t.string   "reset_password_token"
+    t.string "email", default: "", null: false
+    t.string "encrypted_password", default: "", null: false
+    t.string "reset_password_token"
     t.datetime "reset_password_sent_at"
     t.datetime "remember_created_at"
-    t.integer  "sign_in_count",                            default: 0,  null: false
+    t.integer "sign_in_count", default: 0, null: false
     t.datetime "current_sign_in_at"
     t.datetime "last_sign_in_at"
-    t.string   "current_sign_in_ip"
-    t.string   "last_sign_in_ip"
-    t.datetime "created_at",                                            null: false
-    t.datetime "updated_at",                                            null: false
-    t.integer  "second_factor_attempts_count",             default: 0
-    t.string   "nickname",                      limit: 64
-    t.string   "encrypted_otp_secret_key"
-    t.string   "encrypted_otp_secret_key_iv"
-    t.string   "encrypted_otp_secret_key_salt"
+    t.string "current_sign_in_ip"
+    t.string "last_sign_in_ip"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.integer "second_factor_attempts_count", default: 0
+    t.string "nickname", limit: 64
+    t.string "encrypted_otp_secret_key"
+    t.string "encrypted_otp_secret_key_iv"
+    t.string "encrypted_otp_secret_key_salt"
+    t.string "otp_secret_key"
+    t.string "direct_otp"
+    t.datetime "direct_otp_sent_at"
+    t.datetime "totp_timestamp"
+    t.index ["email"], name: "index_users_on_email", unique: true
+    t.index ["encrypted_otp_secret_key"], name: "index_users_on_encrypted_otp_secret_key", unique: true
+    t.index ["reset_password_token"], name: "index_users_on_reset_password_token", unique: true
   end
-
-  add_index "users", ["email"], name: "index_users_on_email", unique: true
-  add_index "users", ["encrypted_otp_secret_key"], name: "index_users_on_encrypted_otp_secret_key", unique: true
-  add_index "users", ["reset_password_token"], name: "index_users_on_reset_password_token", unique: true
-
 end

data/spec/rails_app/lib/sms_provider.rb

@@ -1,13 +1,11 @@
-require 'ostruct'
-
 class SMSProvider
-  Message = Class.new(OpenStruct)
+  Message = Struct.new(:to, :body)
 
   class_attribute :messages
   self.messages = []
 
   def self.send_message(opts = {})
-    self.messages << Message.new(opts)
+    self.messages << Message.new(opts[:to], opts[:body])
   end
 
   def self.last_message

data/spec/requests/two_factor_authentication_helpers_spec.rb

@@ -0,0 +1,48 @@
+require 'spec_helper'
+
+describe 'Requests from a user who has not completed two factor authentication', type: :request do
+  let(:user) { create_user }
+
+  before { login_as user, scope: :user }
+
+  it 'redirects HTML requests to the two factor page' do
+    get secret_path
+
+    expect(response).to redirect_to(user_two_factor_authentication_path)
+  end
+
+  it 'responds to JSON requests with 401 and the two factor path' do
+    get secret_path(format: :json)
+
+    expect(response).to have_http_status(:unauthorized)
+    expect(response.parsed_body).to eq('redirect_to' => user_two_factor_authentication_path)
+  end
+
+  it 'responds to other formats with 401 without running the action' do
+    get secret_path(format: :xml)
+
+    expect(response).to have_http_status(:unauthorized)
+    expect(response.body).not_to include('top secret')
+  end
+
+  it 'responds with 401 when the format comes from the Accept header' do
+    get secret_path, headers: { 'Accept' => 'text/csv' }
+
+    expect(response).to have_http_status(:unauthorized)
+    expect(response.body).not_to include('top secret')
+  end
+
+  context 'when the user does not need two factor authentication' do
+    before do
+      allow_any_instance_of(User).to receive(:need_two_factor_authentication?).and_return(false)
+    end
+
+    it 'runs the action and sends no code' do
+      get secret_path(format: :xml)
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to eq('top secret')
+      expect(SMSProvider.messages).to be_empty
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -1,5 +1,6 @@
 ENV["RAILS_ENV"] ||= "test"
 require File.expand_path("../rails_app/config/environment.rb",  __FILE__)
+require File.expand_path("../rails_app/lib/sms_provider.rb", __FILE__)
 
 require 'rspec/rails'
 require 'timecop'

data/spec/support/authenticated_model_helper.rb

@@ -3,9 +3,7 @@ module AuthenticatedModelHelper
     GuestUser.new
   end
 
-  def create_user(type = 'encrypted', attributes = {})
-    create_table_for_nonencrypted_user if type == 'not_encrypted'
-
+  def create_user(attributes = {})
     User.create!(valid_attributes(attributes))
   end
 
@@ -13,6 +11,10 @@ module AuthenticatedModelHelper
     Admin.create!(valid_attributes.except(:nickname))
   end
 
+  def create_secure_user(attributes = {})
+    SecureUser.create!(valid_attributes(attributes).except(:nickname))
+  end
+
   def valid_attributes(attributes={})
     {
       nickname: 'Marissa',
@@ -27,33 +29,6 @@ module AuthenticatedModelHelper
     @@email_count += 1
     "user#{@@email_count}@example.com"
   end
-
-  def create_table_for_nonencrypted_user
-    silence_stream(STDOUT) do
-      ActiveRecord::Schema.define(version: 1) do
-        create_table 'users', force: :cascade do |t|
-          t.string    'email', default: '', null: false
-          t.string    'encrypted_password', default: '', null: false
-          t.string    'reset_password_token'
-          t.datetime  'reset_password_sent_at'
-          t.datetime  'remember_created_at'
-          t.integer   'sign_in_count', default: 0,  null: false
-          t.datetime  'current_sign_in_at'
-          t.datetime  'last_sign_in_at'
-          t.string    'current_sign_in_ip'
-          t.string    'last_sign_in_ip'
-          t.datetime  'created_at', null: false
-          t.datetime  'updated_at', null: false
-          t.integer   'second_factor_attempts_count', default: 0
-          t.string    'nickname', limit: 64
-          t.string    'otp_secret_key'
-          t.string    'direct_otp'
-          t.datetime  'direct_otp_sent_at'
-          t.timestamp 'totp_timestamp'
-        end
-      end
-    end
-  end
 end
 
 RSpec.configuration.send(:include, AuthenticatedModelHelper)

data/spec/support/controller_helper.rb

@@ -1,8 +1,9 @@
 module ControllerHelper
-  def sign_in(user = create_user('not_encrypted'))
-    allow(warden).to receive(:authenticated?).with(:user).and_return(true)
-    allow(controller).to receive(:current_user).and_return(user)
-    warden.session(:user)[TwoFactorAuthentication::NEED_AUTHENTICATION] = true
+  def sign_in(user = create_user, scope: :user)
+    allow(warden).to receive(:authenticated?).and_call_original
+    allow(warden).to receive(:authenticated?).with(scope).and_return(true)
+    allow(controller).to receive(:"current_#{scope}").and_return(user)
+    warden.session(scope)[TwoFactorAuthentication::NEED_AUTHENTICATION] = true
   end
 end
 

data/spec/support/features_spec_helper.rb

@@ -30,6 +30,7 @@ end
 
 RSpec.configure do |config|
   config.include Warden::Test::Helpers, type: :feature
+  config.include Warden::Test::Helpers, type: :request
   config.include FeaturesSpecHelper, type: :feature
 
   config.before(:each) do

data/spec/support/totp_helper.rb

@@ -6,6 +6,6 @@ class TotpHelper
   end
 
   def totp_code(time = Time.now)
-    ROTP::TOTP.new(@secret_key, digits: @otp_length).at(time, true)
+    ROTP::TOTP.new(@secret_key, digits: @otp_length).at(time)
   end
 end