two_factor_authentication 2.2.0 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 3d6d6636a281220ef8fd5aee19a4c4aaa4129797
-  data.tar.gz: 4954c89fa183dcb47c3104bfb14035ceaf6d20f4
+SHA256:
+  metadata.gz: 3f83f45de8b5992a3311c7d0d47479f7b7121c7460925fa8661d8b7eb98f4f72
+  data.tar.gz: 4df0c76ae151691cec84f1d036d79b93094826c892d01edef5d0a847a92407af
 SHA512:
-  metadata.gz: c559cf0c9c2c21519efdf25ce615ca5930dfc657564e4209b77298944ea3a2342414e7772b493db65c657c617641d0af4398a31bca0d3fbf81025e417fb688c2
-  data.tar.gz: 7e0d5abb909bb53f04d3d0cb887a4e869944eda656318c7e782562ecdf7bd635c8079d144506b1633e71c83368604b989dd9b4a21f2d8c21cb41d1f2849b3b58
+  metadata.gz: cef6991e8c5032e5779ee0c5ec0348ad1b0010f947748b49da40b42dabb9e2d83ff43106b6be09acae3acbf3cefa20fbc1ef257d10012098d287d03dbd94635a
+  data.tar.gz: 509142892d180c5fc74d9da25166a12e45e6570893386a5bba70feb50e91d80212b67ee78dd46451c8d58e7d88a37ed6f081872519bf919fa3757f257fdfdd02

data/.github/workflows/ci.yml

@@ -0,0 +1,77 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Ruby ${{ matrix.ruby }} / Rails ${{ matrix.rails }}
+    runs-on: ubuntu-latest
+    continue-on-error: ${{ matrix.rails == 'main' }}
+    timeout-minutes: 20
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - ruby: "2.3"
+            rails: "5.2"
+          - ruby: "2.4"
+            rails: "5.2"
+          - ruby: "2.5"
+            rails: "5.2"
+          - ruby: "2.5"
+            rails: "6.0"
+          - ruby: "2.7"
+            rails: "6.0"
+          - ruby: "2.5"
+            rails: "6.1"
+          - ruby: "3.1"
+            rails: "6.1"
+          - ruby: "2.7"
+            rails: "7.0"
+          - ruby: "3.2"
+            rails: "7.0"
+          - ruby: "2.7"
+            rails: "7.1"
+          - ruby: "3.3"
+            rails: "7.1"
+          - ruby: "3.1"
+            rails: "7.2"
+          - ruby: "4.0"
+            rails: "7.2"
+          - ruby: "3.2"
+            rails: "8.0"
+          - ruby: "4.0"
+            rails: "8.0"
+          - ruby: "3.2"
+            rails: "8.1"
+          - ruby: "4.0"
+            rails: "8.1"
+          - ruby: "4.0"
+            rails: main
+
+    env:
+      RAILS_VERSION: ${{ matrix.rails }}
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+
+      - name: Set up test database
+        run: bundle exec rake app:db:setup
+
+      - name: Run specs
+        run: bundle exec rake spec

data/.gitignore

@@ -21,3 +21,6 @@ dump.rdb
 .rbenv-version
 .ruby-gemset
 .ruby-version
+
+# Generator spec output
+/tmp

data/CHANGELOG.md

@@ -1,8 +1,43 @@
 # Change Log
 
-## [Unreleased](https://github.com/Houdini/two_factor_authentication/tree/HEAD)
+## [v3.0.0](https://github.com/Houdini/two_factor_authentication/tree/v3.0.0) (2026-10-01)
+[Full Changelog](https://github.com/Houdini/two_factor_authentication/compare/v2.2.0...v3.0.0)
 
-[Full Changelog](https://github.com/Houdini/two_factor_authentication/compare/v1.1.5...HEAD)
+See the [Migration Guide](MIGRATION_GUIDE.md#upgrading-from-220-to-300) for upgrade steps.
+
+**Breaking changes:**
+
+- Require Rails 5.0 or newer (was 3.1.1). Tested on Ruby 2.3–4.0 with Rails 5.2 through 8.1
+- `is_fully_authenticated?` checks the current Devise scope (or `Devise.default_scope`) instead of always `:user`, and accepts a scope: `is_fully_authenticated?(:admin)`. Before, it returned `true` for other models before the second factor had been entered
+- A rejected code or reaching the attempt limit now responds with 422 instead of 200, so Turbo renders the error
+- JSON requests that still need the second factor get a 401 with a `{"redirect_to": ...}` body instead of an empty 401 [\#143](https://github.com/Houdini/two_factor_authentication/pull/143) ([Kevinrob](https://github.com/Kevinrob))
+
+**Fixed bugs:**
+
+- Replace `update_attributes` (removed in Rails 6.1) with `update`, which broke `create_direct_otp`, `send_new_otp` and `clear_direct_otp`
+- Store `totp_timestamp` as a `Time`; PostgreSQL rejected the Integer, so every TOTP login failed
+- The generator writes a versioned migration (`ActiveRecord::Migration[x.y]`), which Rails 5.1+ requires
+- The generator no longer uses `File.exists?` (removed in Ruby 3.2) and finds the model relative to the destination root
+- Remove `resend_code` from the route's `only:`, which Rails 8.1 rejects
+- The schema table helpers (`t.second_factor_attempts_count`, `t.totp_timestamp`, ...) no longer call the removed `apply_devise_schema`
+- Remove `totp_timestamp` from the Devise model config; `User.totp_timestamp` raised `NoMethodError`
+- "Sign out" on the two factor page uses `button_to` with `Devise.sign_out_via`, so it works without rails-ujs
+- Support ROTP 5.0, which renamed `ROTP::Base32.random_base32` to `random` [\#171](https://github.com/Houdini/two_factor_authentication/pull/171) ([jaspervandenberg](https://github.com/jaspervandenberg))
+
+**Implemented enhancements:**
+
+- Add the encrypted OTP secret index concurrently on PostgreSQL [\#197](https://github.com/Houdini/two_factor_authentication/pull/197) ([Lackoftactics](https://github.com/Lackoftactics))
+- Autofocus the code field [\#174](https://github.com/Houdini/two_factor_authentication/pull/174) ([gustavokitman](https://github.com/gustavokitman))
+- Add German translations [\#166](https://github.com/Houdini/two_factor_authentication/pull/166) ([JanBussieck](https://github.com/JanBussieck))
+
+**Other changes:**
+
+- Replace Travis CI with GitHub Actions
+- Test TOTP sign-in, resending the code, the attempt counter reset and an encrypted-secret model end to end
+- README updates [\#168](https://github.com/Houdini/two_factor_authentication/pull/168) ([MarkFChavez](https://github.com/MarkFChavez)), [\#139](https://github.com/Houdini/two_factor_authentication/pull/139) ([rmm5t](https://github.com/rmm5t))
+
+## [v2.0](https://github.com/Houdini/two_factor_authentication/tree/v2.0) (2017-05-12)
+[Full Changelog](https://github.com/Houdini/two_factor_authentication/compare/v1.1.5...v2.0)
 
 **Merged pull requests:**
 

data/Gemfile

@@ -1,27 +1,48 @@
 source 'https://rubygems.org'
 
-# Specify your gem's dependencies in devise_ip_filter.gemspec
+# Specify your gem's dependencies in two_factor_authentication.gemspec
 gemspec
 
 rails_version = ENV["RAILS_VERSION"] || "default"
 
 rails = case rails_version
-        when "master"
-          {github: "rails/rails"}
+        when "main"
+          {github: "rails/rails", branch: "main"}
         when "default"
-          "~> 5.2"
+          "~> 8.1.0"
         else
-          "~> #{rails_version}"
+          requirement = rails_version.split('.').length == 2 ? "#{rails_version}.0" : rails_version
+          "~> #{requirement}"
         end
 
 gem "rails", rails
 
-if Gem::Version.new(RUBY_VERSION) >= Gem::Version.new('2.2.0')
-  gem "test-unit", "~> 3.0"
+# Rails main freezes controller default_url_options; rspec-rails 8.0.4 still
+# mutates it in feature specs. Drop once a release includes rspec/rspec-rails#2907.
+gem "rspec-rails", github: "rspec/rspec-rails", branch: "main" if rails_version == "main"
+
+ruby_version = Gem::Version.new(RUBY_VERSION)
+
+gem "test-unit", "~> 3.0"
+
+if ruby_version < Gem::Version.new('2.5.0')
+  gem 'nokogiri', '~> 1.10.10'
+elsif ruby_version < Gem::Version.new('2.6.0')
+  gem 'nokogiri', '~> 1.12.5'
 end
 
+gem 'loofah', '< 2.21' if ruby_version < Gem::Version.new('2.5.0')
+gem 'psych', '< 5' if rails_version == '7.1' && ruby_version < Gem::Version.new('3.0.0')
+
 group :test, :development do
-  gem 'sqlite3'
+  gem 'ostruct' if ruby_version >= Gem::Version.new('4.0.0')
+  case rails_version
+  when '5.2', '6.0', '6.1', '7.0'
+    gem 'sqlite3', '~> 1.4'
+  else
+    gem 'sqlite3'
+  end
+  gem 'sprockets-rails'
 end
 
 group :test do

data/MIGRATION_GUIDE.md

@@ -0,0 +1,143 @@
+# Migration Guide
+
+## Upgrading from 2.2.0 to 3.0.0
+
+Version 3.0.0 brings the gem up to date with current Ruby, Rails and Devise, and
+fixes several bugs that made 2.2.0 unusable on Rails 6.1+, Ruby 3.2+ and
+PostgreSQL. Most apps only need to bump the gem version, but a few behaviours
+changed. Go through the checklist below.
+
+### 1. Check your Ruby and Rails versions
+
+- **Rails 5.0 or newer is now required** (it was `>= 3.1.1`). If you are on
+  Rails 3.x or 4.x, stay on 2.2.0.
+- The gem is tested on Ruby 2.3 – 4.0 with Rails 5.2, 6.0, 6.1, 7.0, 7.1,
+  7.2, 8.0 and 8.1. Rails 5.0 and 5.1 are allowed by the gemspec but are not
+  tested.
+
+### 2. Fix old unversioned migrations
+
+Migrations generated by 2.2.0 and earlier inherit from
+`ActiveRecord::Migration` without a version. Rails 5.1+ refuses to run them,
+which breaks `db:migrate` on a fresh database (for example in CI). Add the
+Rails version the migration was written for:
+
+```ruby
+# Before
+class TwoFactorAuthenticationAddToUsers < ActiveRecord::Migration
+
+# After
+class TwoFactorAuthenticationAddToUsers < ActiveRecord::Migration[5.0]
+```
+
+Migrations that have already run are not executed again, so this only matters
+when the database is rebuilt from migrations.
+
+The generator (`rails g two_factor_authentication MODEL`) now writes a
+versioned migration. On PostgreSQL it also builds the
+`encrypted_otp_secret_key` index with `algorithm: :concurrently` and
+`disable_ddl_transaction!` so adding it does not lock the table.
+
+### 3. Pass a scope to `is_fully_authenticated?` for non-`:user` models
+
+`is_fully_authenticated?` used to read the `:user` warden session no matter
+which model was signed in. For any other model (e.g. `Admin`) it returned
+`true` before the second factor had been entered, so a
+`confirm_two_factor_authenticated` guard did not protect that model.
+
+It now checks:
+
+1. the scope of the current Devise controller (`resource_name`), or
+2. `Devise.default_scope` outside Devise controllers, or
+3. the scope you pass in.
+
+Inside a Devise controller, such as the `RegistrationsController` guard in the
+README, nothing changes for `:user` and other models are now protected. In your
+own controllers, pass the scope explicitly if you have more than one 2FA model,
+or if your default scope is not the model you want to check:
+
+```ruby
+# Before: always checked :user
+return if is_fully_authenticated?
+
+# After
+return if is_fully_authenticated?(:admin)
+```
+
+### 4. Expect `422` from the code form
+
+When a submitted code is wrong, or the attempt limit is reached, the
+`update` action now responds with **422 Unprocessable Entity** instead of 200.
+Turbo (the default since Rails 7) ignores a 200 response to a form submission,
+so the error page was never shown.
+
+- Update any request or controller specs that expect a 200 after a wrong code.
+- If you override `after_two_factor_fail_for` in a custom controller, render
+  with `status: 422` as well:
+
+  ```ruby
+  def after_two_factor_fail_for(resource)
+    # ...
+    render :show, status: 422
+  end
+  ```
+
+### 5. Update overridden views
+
+If you copied `app/views/devise/two_factor_authentication/show.html.erb` into
+your app, your copy does not get these changes:
+
+- **Sign out** now uses `button_to` with `Devise.sign_out_via`.
+  `link_to ..., method: :delete` needs `rails-ujs`, which Rails 7+ apps no
+  longer ship, so the link sends a GET and fails.
+
+  ```erb
+  <%# Before %>
+  <%= link_to "Sign out", destroy_user_session_path, :method => :delete %>
+
+  <%# After %>
+  <%= button_to "Sign out", destroy_user_session_path, :method => :delete %>
+  ```
+
+- The code field is autofocused: `text_field_tag :code, '', autofocus: true`.
+- The stray `action: :get` option was removed from the "Resend Code" links.
+
+### 6. Check JSON clients
+
+When a signed-in user still needs the second factor, a JSON request used to
+get an empty `401`. It now gets a `401` with a body that tells the client
+where to send the user:
+
+```json
+{ "redirect_to": "/users/two_factor_authentication" }
+```
+
+The user's return location is set to `root_path(format: :html)`, so **your app
+must define a `root` route** to use this. HTML requests are still redirected,
+and every other format still gets an empty `401`.
+
+### 7. Things that now work without changes
+
+These were broken in 2.2.0 and need no action, but you can remove any
+workarounds you added for them:
+
+- `create_direct_otp`, `send_new_otp` and `clear_direct_otp` no longer raise
+  `NoMethodError` on Rails 6.1+ (they called the removed `update_attributes`).
+- A successful TOTP login no longer fails on PostgreSQL with
+  `PG::DatetimeFieldOverflow`. `totp_timestamp` is now stored as a `Time`;
+  existing values keep working.
+- The schema helpers (`t.second_factor_attempts_count`, `t.totp_timestamp`,
+  ...) work again in `create_table` and `change_table`.
+- `rails g two_factor_authentication MODEL` works on Ruby 3.2+ and no longer
+  has to be run from the app root.
+- The routes load on Rails 8.1 (which rejected `resend_code` in `only:`).
+- ROTP 5.0, which renamed `ROTP::Base32.random_base32` to `random`, is
+  supported.
+- `User.totp_timestamp` is no longer defined as a class method. It read a
+  Devise setting that does not exist and always raised; the
+  `totp_timestamp` column on each record is unaffected.
+
+## Upgrading from 1.x to 2.x
+
+See [Upgrading from version 1.X to 2.X](README.md#upgrading-from-version-1x-to-2x)
+in the README.