two_factor_authentication 2.2.0 → 3.0.0

data/README.md

@@ -2,14 +2,14 @@
 
 [![Gitter](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/Houdini/two_factor_authentication?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
 
-[![Build Status](https://travis-ci.org/Houdini/two_factor_authentication.svg?branch=master)](https://travis-ci.org/Houdini/two_factor_authentication)
+[![CI](https://github.com/Houdini/two_factor_authentication/actions/workflows/ci.yml/badge.svg)](https://github.com/Houdini/two_factor_authentication/actions/workflows/ci.yml)
 [![Code Climate](https://codeclimate.com/github/Houdini/two_factor_authentication.svg)](https://codeclimate.com/github/Houdini/two_factor_authentication)
 
 ## Features
 
 * Support for 2 types of OTP codes
- 1. Codes delivered directly to the user
- 2. TOTP (Google Authenticator) codes based on a shared secret (HMAC)
+    1. Codes delivered directly to the user
+    2. TOTP (Google Authenticator) codes based on a shared secret (HMAC)
 * Configurable OTP code digit length
 * Configurable max login attempts
 * Customizable logic to determine if a user needs two factor authentication
@@ -28,7 +28,7 @@ Once that's done, run:
 
     bundle install
 
-Note that Ruby 2.1 or greater is required.
+The gem is tested on Ruby 2.3 – 4.0 with Rails 5.2 through 8.1.
 
 ### Installation
 
@@ -69,13 +69,20 @@ rails g migration AddTwoFactorFieldsToUsers second_factor_attempts_count:integer
 
 Open your migration file (it will be in the `db/migrate` directory and will be
 named something like `20151230163930_add_two_factor_fields_to_users.rb`), and
-add `unique: true` to the `add_index` line so that it looks like this:
+set the attempt counter's default to `0` and add `unique: true` to the
+`add_index` line so that they look like this:
 
 ```ruby
+add_column :users, :second_factor_attempts_count, :integer, default: 0
 add_index :users, :encrypted_otp_secret_key, unique: true
 ```
 Save the file.
 
+The counter must contain an integer because failed OTP submissions increment
+it. If you already ran a migration without this default, add a follow-up
+migration that sets the default to `0` and backfills existing `NULL` counters
+to `0`, preserving other counter values.
+
 #### Complete the setup
 
 Run the migration with:
@@ -161,9 +168,13 @@ Below is an example using ERB:
   <%= submit_tag "Log in!" %>
 <% end %>
 
-<%= link_to "Sign out", destroy_user_session_path, :method => :delete %>
+<%= button_to "Sign out", destroy_user_session_path, :method => :delete %>
 ```
 
+#### Upgrading from version 2.2.0 to 3.0.0
+
+See the [Migration Guide](MIGRATION_GUIDE.md#upgrading-from-220-to-300).
+
 #### Upgrading from version 1.X to 2.X
 
 The following database fields are new in version 2.
@@ -224,7 +235,7 @@ steps:
 
    Open the generated file, and replace its contents with the following:
    ```ruby
-   class PopulateEncryptedOtpFields < ActiveRecord::Migration
+   class PopulateEncryptedOtpFields < ActiveRecord::Migration[8.1]
      def up
        User.reset_column_information
 
@@ -238,8 +249,9 @@ steps:
        User.reset_column_information
 
        User.find_each do |user|
-         user.otp_secret_key = ROTP::Base32.random_base32
-         user.save!
+         # Read through the encrypted accessor, then write the plaintext column
+         # directly without invoking the encrypted setter.
+         user.update_columns(otp_secret_key: user.otp_secret_key)
        end
      end
    end
@@ -255,14 +267,23 @@ steps:
 If, for some reason, you want to switch back to the old non-encrypted version,
 use these steps:
 
-1. Remove `(encrypted: true)` from `has_one_time_password`
+1. Stop application writes while rolling back and changing the model
+   configuration. Keep `has_one_time_password(encrypted: true)` and the same
+   `otp_secret_encryption_key` configured throughout the rollback.
 
 2. Roll back the last 3 migrations (assuming you haven't added any new ones
-after them):
+   after them):
    ```
    bundle exec rake db:rollback STEP=3
    ```
 
+   This recreates the plaintext column, copies each decrypted secret back into
+   it, and then removes the encryption columns. Existing authenticator secrets
+   are preserved, and users without TOTP retain a `nil` secret.
+
+3. Remove `(encrypted: true)` from `has_one_time_password` and restart the
+   application before allowing writes again.
+
 #### Critical Security Note! Add before_action to your user registration controllers
 
 You should have a file registrations_controller.rb in your controllers folder
@@ -283,61 +304,103 @@ to overwrite/customize user registrations. It should include the lines below, fo
    end
    ```
 
+   Route registrations through this controller in `config/routes.rb`:
+
+   ```ruby
+   devise_for :users, controllers: { registrations: 'registrations' }
+   ```
+
+   Update your existing `devise_for :users` declaration. Defining the controller
+   alone does not change Devise's routes, so the callback will not run until
+   this mapping is configured.
+
+   `is_fully_authenticated?` checks the scope of the current Devise controller,
+   or `Devise.default_scope` elsewhere. Pass a scope to check another model,
+   e.g. `is_fully_authenticated?(:admin)`.
+
 #### Critical Security Note! Add 2FA validation to your custom user actions
 
-Make sure you are passing the 2FA secret codes securely and checking for them upon critical user actions, such as API key updates, user email or pgp pubkey updates, or any other changess to private/secure account-related details. Validate the secret during the initial 2FA key/secret verification by the user also, of course.
+Require fresh second-factor verification for sensitive account changes,
+including replacing or disabling TOTP. Verify a code against the existing
+secret before assigning a replacement; a code for the replacement secret only
+proves that the user configured the new authenticator.
 
- For example, a simple account_controller.rb may look something like this:
+For initial TOTP enrollment, verify a fresh direct OTP instead. The following
+example generates a pending secret on the server, keeps it separate from the
+active secret, and requires separate `current_code` and `new_code` values:
 
-   ```
-   require 'json'
-
-   class AccountController < ApplicationController
-     before_action :require_signed_in!
-     before_action :authenticate_user!
-     respond_to :html, :json
-     
-     def account_API
-       resp = {}
-       begin       
-         if(account_params["twoFAKey"] && account_params["twoFASecret"])
-           current_user.otp_secret_key = account_params["twoFAKey"]
-           if(current_user.authenticate_totp(account_params["twoFASecret"]))
-             # user has validated their temporary 2FA code, save it to their account, enable 2FA on this account
-             current_user.save!
-             resp['success'] = "passed 2FA validation!"
-           else
-             resp['error'] = "failed 2FA validation!"
-           end
-         elsif(param[:userAccountStuff] && param[:userAccountWidget])
-           #before updating important user account stuff and widgets,
-           #check to see that the 2FA secret has also been passed in, and verify it...
-           if(account_params["twoFASecret"] && current_user.totp_enabled? && current_user.authenticate_totp(account_params["twoFASecret"]))
-             # user has passed 2FA checks, do cool user account stuff here
-             ...
-           else 
-             # user failed 2FA check! No cool user stuff happens!             
-              resp[error] = 'You failed 2FA validation!'
-           end
-           
-             ...
-           end
-         else
-           resp['error'] = 'unknown format error, not saved!'  
-         end
-       rescue Exception => e
-         puts "WARNING: account api threw error : '#{e}' for user #{current_user.username}"
-         #print "error trace: #{e.backtrace}\n"
-         resp['error'] = "unanticipated server response"
-       end
-       render json: resp.to_json
-     end
-   
-     def account_params
-       params.require(:twoFA).permit(:userAccountStuff, :userAcountWidget, :twoFAKey, :twoFASecret)
-     end
-   end   
-   ```
+```ruby
+class AccountController < ApplicationController
+  before_action :authenticate_user!
+
+  def new_totp
+    secret = current_user.generate_totp_secret
+    session[:pending_totp] = { 'user_id' => current_user.id, 'secret' => secret }
+    current_user.send_new_otp unless current_user.totp_enabled?
+    render json: { provisioning_uri: current_user.provisioning_uri(nil, otp_secret_key: secret) }
+  end
+
+  def update_totp
+    codes = params.require(:two_factor).permit(:current_code, :new_code)
+    pending = session[:pending_totp]
+    unless pending && pending['user_id'] == current_user.id
+      render json: { error: 'Start TOTP setup first.' }, status: :unprocessable_entity
+      return
+    end
+
+    updated = false
+    current_user.with_lock do
+      next if current_user.max_login_attempts?
+
+      valid_current_code = if current_user.totp_enabled?
+                             current_user.authenticate_totp(codes[:current_code].to_s)
+                           else
+                             current_user.authenticate_direct_otp(codes[:current_code].to_s)
+                           end
+      unless valid_current_code
+        current_user.increment!(:second_factor_attempts_count)
+        next
+      end
+
+      # Persist consumption of the current code even if the new code is invalid.
+      current_user.save!
+
+      # The new secret has its own replay timestamp, independent of the old one.
+      candidate = current_user.class.new
+      next unless candidate.confirm_totp_secret(pending['secret'], codes[:new_code].to_s)
+
+      current_user.update!(
+        otp_secret_key: candidate.otp_secret_key,
+        totp_timestamp: candidate.totp_timestamp,
+        direct_otp: nil,
+        direct_otp_sent_at: nil,
+        second_factor_attempts_count: 0
+      )
+      updated = true
+    end
+
+    if updated
+      session.delete(:pending_totp)
+      render json: { success: 'TOTP configuration saved.' }
+    else
+      render json: { error: 'Second-factor verification failed.' }, status: :unauthorized
+    end
+  end
+end
+```
+
+Connect these actions in `config/routes.rb`:
+
+```ruby
+post 'account/totp/setup', to: 'account#new_totp'
+patch 'account/totp', to: 'account#update_totp'
+```
+
+Show the provisioning URI as a QR code and ask for both codes before submitting
+the update. Users without TOTP receive a fresh direct code through your
+`send_two_factor_authentication_code` implementation. Apply the same existing
+factor check to other sensitive changes, and save the user after a successful
+TOTP check to persist its replay timestamp.
 
 
 ### Example App
@@ -353,20 +416,12 @@ config.otp_secret_encryption_key = ENV['OTP_SECRET_ENCRYPTION_KEY']
 
 to set up TOTP for Google Authenticator for user:
 
-   ```
-   current_user.otp_secret_key =  current_user.generate_totp_secret
-   current_user.save!
-   ```
-   
-( encrypted db fields are set upon user model save action,
-rails c access relies on setting env var: OTP_SECRET_ENCRYPTION_KEY )
-
-to check if user has input the correct code (from the QR display page)
-before saving the user model:
+Use the `new_totp` and `update_totp` actions above to prepare the QR code and
+verify both the current factor and the new authenticator code. Keep the pending
+secret separate from `current_user.otp_secret_key` until both checks succeed.
 
-   ```
-   current_user.authenticate_totp('123456')
-   ```
+Encrypted database fields are persisted when the update action saves the user.
+Rails console access also requires `OTP_SECRET_ENCRYPTION_KEY` to be set.
 
 additional note:
  
@@ -381,25 +436,22 @@ otpauth://totp/LABEL?secret=p6wwetjnkjnrcmpd    (example secret used here)
 
 where LABEL should be something like "example.com (Username)", which shows up in their GA app to remind them the code is for example.com
 
-this returns true or false with an allowed_otp_drift_seconds 'grace period'
-
 to set TOTP to DISABLED for a user account:
 
-   ```
-   current_user.second_factor_attempts_count=nil
-   current_user.encrypted_otp_secret_key=nil
-   current_user.encrypted_otp_secret_key_iv=nil
-   current_user.encrypted_otp_secret_key_salt=nil
-   current_user.direct_otp=nil
-   current_user.direct_otp_sent_at=nil
-   current_user.totp_timestamp=nil
-   current_user.direct_otp=nil
-   current_user.otp_secret_key=nil
-   current_user.otp_confirmed=nil
-   current_user.save! (if in ruby code instead of console)
-   current_user.direct_otp? => false
-   current_user.totp_enabled? => false
-   ```
-   
+After verifying the existing factor as described above:
 
+```ruby
+current_user.update!(
+  otp_secret_key: nil,
+  totp_timestamp: nil,
+  direct_otp: nil,
+  direct_otp_sent_at: nil,
+  second_factor_attempts_count: 0
+)
+current_user.direct_otp? # => false
+current_user.totp_enabled? # => false
+```
 
+This disables TOTP and leaves the attempt counter at an integer value. Direct
+OTP authentication remains required unless `need_two_factor_authentication?`
+returns `false`.

data/app/controllers/devise/two_factor_authentication_controller.rb

@@ -61,11 +61,12 @@ class Devise::TwoFactorAuthenticationController < DeviseController
     resource.save
     set_flash_message :alert, :attempt_failed, now: true
 
+    # 422 lets Turbo (the Rails 7+ default) render the response to a form submission
     if resource.max_login_attempts?
       sign_out(resource)
-      render :max_login_attempts_reached
+      render :max_login_attempts_reached, status: 422
     else
-      render :show
+      render :show, status: 422
     end
   end
 

data/app/views/devise/two_factor_authentication/show.html.erb

@@ -7,13 +7,13 @@
 <p><%= flash[:notice] %></p>
 
 <%= form_tag([resource_name, :two_factor_authentication], :method => :put) do %>
-  <%= text_field_tag :code %>
+  <%= text_field_tag :code, '', autofocus: true %>
   <%= submit_tag "Submit" %>
 <% end %>
 
 <% if resource.direct_otp %>
-  <%= link_to "Resend Code", send("resend_code_#{resource_name}_two_factor_authentication_path"), action: :get %>
+  <%= link_to "Resend Code", send("resend_code_#{resource_name}_two_factor_authentication_path") %>
 <% else %>
-<%= link_to "Send me a code instead", send("resend_code_#{resource_name}_two_factor_authentication_path"), action: :get %>
+<%= link_to "Send me a code instead", send("resend_code_#{resource_name}_two_factor_authentication_path") %>
 <% end %>
-<%= link_to "Sign out", send("destroy_#{resource_name}_session_path"), :method => :delete %>
+<%= button_to "Sign out", send("destroy_#{resource_name}_session_path"), :method => Array(Devise.sign_out_via).first %>

data/config/locales/de.yml

@@ -0,0 +1,8 @@
+de:
+  devise:
+    two_factor_authentication:
+      success: "Ihre Zwei-Faktor-Authentifizierung war erfolgreich."
+      attempt_failed: "Authentifizierungsversuch fehlgeschlagen."
+      max_login_attempts_reached: "Ihr Zugang wurde ganz verweigert, da Sie Ihr Versuchslimit erreicht haben."
+      contact_administrator: "Kontaktieren Sie bitte einen Ihrer Administratoren."
+      code_has_been_sent: "Ihr Einmal-Passwort wurde verschickt."

data/lib/generators/active_record/templates/migration.rb

@@ -1,4 +1,8 @@
-class TwoFactorAuthenticationAddTo<%= table_name.camelize %> < ActiveRecord::Migration
+class TwoFactorAuthenticationAddTo<%= table_name.camelize %> < ActiveRecord::Migration<%= migration_version %>
+<% if postgresql? -%>
+  disable_ddl_transaction!
+
+<% end -%>
   def change
     add_column :<%= table_name %>, :second_factor_attempts_count, :integer, default: 0
     add_column :<%= table_name %>, :encrypted_otp_secret_key, :string
@@ -8,6 +12,10 @@ class TwoFactorAuthenticationAddTo<%= table_name.camelize %> < ActiveRecord::Mig
     add_column :<%= table_name %>, :direct_otp_sent_at, :datetime
     add_column :<%= table_name %>, :totp_timestamp, :timestamp
 
+<% if postgresql? -%>
+    add_index :<%= table_name %>, :encrypted_otp_secret_key, unique: true, algorithm: :concurrently
+<% else -%>
     add_index :<%= table_name %>, :encrypted_otp_secret_key, unique: true
+<% end -%>
   end
 end

data/lib/generators/active_record/two_factor_authentication_generator.rb

@@ -9,6 +9,24 @@ module ActiveRecord
         migration_template "migration.rb", "db/migrate/two_factor_authentication_add_to_#{table_name}.rb"
       end
 
+      private
+
+      def migration_version
+        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
+      end
+
+      # CREATE INDEX CONCURRENTLY is PostgreSQL-only; other adapters reject the option.
+      def postgresql?
+        config = if ActiveRecord::Base.respond_to?(:connection_db_config)
+                   ActiveRecord::Base.connection_db_config
+                 else
+                   ActiveRecord::Base.connection_config
+                 end
+        adapter = config.respond_to?(:adapter) ? config.adapter : config[:adapter]
+        adapter.to_s.include?("postg")
+      rescue StandardError
+        false
+      end
     end
   end
 end

data/lib/generators/two_factor_authentication/two_factor_authentication_generator.rb

@@ -7,7 +7,7 @@ module TwoFactorAuthenticatable
 
       def inject_two_factor_authentication_content
         path = File.join("app", "models", "#{file_path}.rb")
-        inject_into_file(path, "two_factor_authenticatable, :", :after => "devise :") if File.exists?(path)
+        inject_into_file(path, "two_factor_authenticatable, :", :after => "devise :") if File.exist?(File.join(destination_root, path))
       end
 
       hook_for :orm

data/lib/two_factor_authentication/controllers/helpers.rb

@@ -20,9 +20,12 @@ module TwoFactorAuthentication
       end
 
       def handle_failed_second_factor(scope)
-        if request.format.present? and request.format.html?
+        if request.format&.html?
           session["#{scope}_return_to"] = request.original_fullpath if request.get?
           redirect_to two_factor_authentication_path_for(scope)
+        elsif request.format&.json?
+          session["#{scope}_return_to"] = root_path(format: :html)
+          render json: { redirect_to: two_factor_authentication_path_for(scope) }, status: :unauthorized
         else
           head :unauthorized
         end
@@ -41,8 +44,9 @@ end
 module Devise
   module Controllers
     module Helpers
-      def is_fully_authenticated?
-        !session["warden.user.user.session"].try(:[], TwoFactorAuthentication::NEED_AUTHENTICATION)
+      def is_fully_authenticated?(scope = nil)
+        scope ||= devise_controller? ? resource_name : Devise.default_scope
+        !session["warden.user.#{scope}.session"].try(:[], TwoFactorAuthentication::NEED_AUTHENTICATION)
       end
     end
   end

data/lib/two_factor_authentication/models/two_factor_authenticatable.rb

@@ -16,7 +16,7 @@ module Devise
         ::Devise::Models.config(
           self, :max_login_attempts, :allowed_otp_drift_seconds, :otp_length,
           :remember_otp_session_for_seconds, :otp_secret_encryption_key,
-          :direct_otp_length, :direct_otp_valid_for, :totp_timestamp, :delete_cookie_on_logout
+          :direct_otp_length, :direct_otp_valid_for, :delete_cookie_on_logout
         )
       end
 
@@ -44,7 +44,7 @@ module Devise
             drift_ahead: drift, drift_behind: drift, after: totp_timestamp
           )
           return false unless new_timestamp
-          self.totp_timestamp = new_timestamp
+          self.totp_timestamp = Time.at(new_timestamp).utc
           true
         end
 
@@ -92,13 +92,16 @@ module Devise
         end
 
         def generate_totp_secret
-          ROTP::Base32.random_base32
+          # ROTP gem since version 5 to version 5.1
+          # at version 5.1 ROTP gem reinstates.
+          # Details: https://github.com/mdp/rotp/blob/master/CHANGELOG.md#510
+          ROTP::Base32.try(:random) || ROTP::Base32.random_base32
         end
 
         def create_direct_otp(options = {})
           # Create a new random OTP and store it in the database
           digits = options[:length] || self.class.direct_otp_length || 6
-          update_attributes(
+          update(
             direct_otp: random_base10(digits),
             direct_otp_sent_at: Time.now.utc
           )
@@ -119,7 +122,7 @@ module Devise
         end
 
         def clear_direct_otp
-          update_attributes(direct_otp: nil, direct_otp_sent_at: nil)
+          update(direct_otp: nil, direct_otp_sent_at: nil)
         end
       end
 

data/lib/two_factor_authentication/routes.rb

@@ -3,7 +3,7 @@ module ActionDispatch::Routing
     protected
 
       def devise_two_factor_authentication(mapping, controllers)
-        resource :two_factor_authentication, :only => [:show, :update, :resend_code], :path => mapping.path_names[:two_factor_authentication], :controller => controllers[:two_factor_authentication] do
+        resource :two_factor_authentication, :only => [:show, :update], :path => mapping.path_names[:two_factor_authentication], :controller => controllers[:two_factor_authentication] do
           collection { get "resend_code" }
         end
       end

data/lib/two_factor_authentication/schema.rb

@@ -1,31 +1,31 @@
 module TwoFactorAuthentication
   module Schema
     def second_factor_attempts_count
-      apply_devise_schema :second_factor_attempts_count, Integer, :default => 0
+      integer :second_factor_attempts_count, :default => 0
     end
 
     def encrypted_otp_secret_key
-      apply_devise_schema :encrypted_otp_secret_key, String
+      string :encrypted_otp_secret_key
     end
 
     def encrypted_otp_secret_key_iv
-      apply_devise_schema :encrypted_otp_secret_key_iv, String
+      string :encrypted_otp_secret_key_iv
     end
 
     def encrypted_otp_secret_key_salt
-      apply_devise_schema :encrypted_otp_secret_key_salt, String
+      string :encrypted_otp_secret_key_salt
     end
 
     def direct_otp
-      apply_devise_schema :direct_otp, String
+      string :direct_otp
     end
 
     def direct_otp_sent_at
-      apply_devise_schema :direct_otp_sent_at, DateTime
+      datetime :direct_otp_sent_at
     end
 
     def totp_timestamp
-      apply_devise_schema :totp_timestamp, Timestamp
+      timestamp :totp_timestamp
     end
   end
 end

data/lib/two_factor_authentication/version.rb

@@ -1,3 +1,3 @@
 module TwoFactorAuthentication
-  VERSION = "2.2.0".freeze
+  VERSION = "3.0.0".freeze
 end

data/spec/controllers/two_factor_authentication_controller_spec.rb

@@ -1,15 +1,15 @@
 require 'spec_helper'
 
 describe Devise::TwoFactorAuthenticationController, type: :controller do
-  describe 'is_fully_authenticated? helper' do
-    def post_code(code)
-      if Rails::VERSION::MAJOR >= 5
-        post :update, params: { code: code }
-      else
-        post :update, code: code
-      end
+  def post_code(code)
+    if Rails::VERSION::MAJOR >= 5
+      post :update, params: { code: code }
+    else
+      post :update, code: code
     end
+  end
 
+  describe 'is_fully_authenticated? helper' do
     before do
       sign_in
     end
@@ -38,4 +38,81 @@ describe Devise::TwoFactorAuthenticationController, type: :controller do
       end
     end
   end
+
+  describe 'PUT update' do
+    render_views
+
+    let(:user) { create_user }
+
+    before do
+      sign_in user
+      user.send_new_otp
+    end
+
+    it 'responds with 422 and re-renders the form for an invalid code' do
+      post_code '00000000'
+
+      expect(response).to have_http_status(422)
+      expect(response.body).to include('Enter the code that was sent to you')
+      expect(user.reload.second_factor_attempts_count).to eq(1)
+    end
+
+    it 'responds with 422 and signs out when the last attempt fails' do
+      user.update!(second_factor_attempts_count: User.max_login_attempts - 1)
+
+      post_code '00000000'
+
+      expect(response).to have_http_status(422)
+      expect(response.body).to include('Access completely denied')
+    end
+
+    it 'resets the failed attempt counter after a valid code' do
+      user.update!(second_factor_attempts_count: 1)
+
+      post_code user.reload.direct_otp
+
+      expect(response).to redirect_to(root_path)
+      expect(user.reload.second_factor_attempts_count).to eq(0)
+    end
+  end
+
+  describe 'GET resend_code' do
+    let(:user) { create_user }
+
+    before { sign_in user }
+
+    it 'sends a new code and redirects back to the form' do
+      get :resend_code
+
+      expect(SMSProvider.messages.size).to eq(1)
+      expect(SMSProvider.last_message.body).to eq(user.reload.direct_otp)
+      expect(response).to redirect_to(user_two_factor_authentication_path)
+      expect(flash[:notice]).to eq('Your authentication code has been sent.')
+    end
+  end
+
+  context 'with a second devise scope' do
+    let(:secure_user) { create_secure_user }
+
+    before do
+      @request.env['devise.mapping'] = Devise.mappings[:secure_user]
+      sign_in secure_user, scope: :secure_user
+    end
+
+    it 'reports the scope of the current resource as not fully authenticated' do
+      get :show
+
+      expect(response).to have_http_status(200)
+      expect(subject.is_fully_authenticated?).to eq false
+      expect(subject.is_fully_authenticated?(:secure_user)).to eq false
+    end
+
+    it 'reports the scope as fully authenticated after a valid code' do
+      secure_user.send_new_otp
+      post_code secure_user.reload.direct_otp
+
+      expect(subject.is_fully_authenticated?).to eq true
+      expect(subject.is_fully_authenticated?(:secure_user)).to eq true
+    end
+  end
 end