two_factor_authentication 2.2.0 → 3.0.0

data/spec/features/two_factor_authenticatable_spec.rb

@@ -3,20 +3,14 @@ include AuthenticatedModelHelper
 
 feature "User of two factor authentication" do
   context 'sending two factor authentication code via SMS' do
-    shared_examples 'sends and authenticates code' do |user, type|
-      before do
-        user.reload
-        if type == 'encrypted'
-          allow(User).to receive(:has_one_time_password).with(encrypted: true)
-        end
-      end
-
+    shared_examples 'sends and authenticates code' do |scope|
       it 'does not send an SMS before the user has signed in' do
+        user
         expect(SMSProvider.messages).to be_empty
       end
 
       it 'sends code via SMS after sign in' do
-        visit new_user_session_path
+        visit send("new_#{scope}_session_path")
         complete_sign_in_form_for(user)
 
         expect(page).to have_content 'Enter the code that was sent to you'
@@ -28,11 +22,9 @@ feature "User of two factor authentication" do
       end
 
       it 'authenticates a valid OTP code' do
-        visit new_user_session_path
+        visit send("new_#{scope}_session_path")
         complete_sign_in_form_for(user)
 
-        expect(page).to have_content('You are signed in as Marissa')
-
         fill_in 'code', with: SMSProvider.last_message.body
         click_button 'Submit'
 
@@ -42,10 +34,101 @@ feature "User of two factor authentication" do
 
         expect(current_path).to eq root_path
       end
+
+      it 'sends a new code when the user asks to resend it' do
+        visit send("new_#{scope}_session_path")
+        complete_sign_in_form_for(user)
+
+        click_link 'Resend Code'
+
+        expect(page).to have_content('Your authentication code has been sent.')
+        expect(SMSProvider.messages.size).to eq(2)
+
+        fill_in 'code', with: SMSProvider.last_message.body
+        click_button 'Submit'
+
+        expect(page).to have_content('Two factor authentication successful.')
+      end
+    end
+
+    context 'for a user with a plain OTP secret' do
+      let(:user) { create_user }
+
+      it_behaves_like 'sends and authenticates code', :user
+    end
+
+    context 'for a second devise scope with an encrypted OTP secret' do
+      let(:user) { create_secure_user }
+
+      it_behaves_like 'sends and authenticates code', :secure_user
+    end
+  end
+
+  context 'authenticating with an authenticator app (TOTP)' do
+    shared_examples 'authenticates a TOTP code' do |scope|
+      let(:secret) { user.generate_totp_secret }
+
+      before do
+        user.update!(otp_secret_key: secret)
+        visit send("new_#{scope}_session_path")
+        complete_sign_in_form_for(user)
+      end
+
+      it 'asks for the authenticator code without sending an SMS' do
+        expect(page).to have_content('Enter the code from your authenticator app')
+        expect(SMSProvider.messages).to be_empty
+      end
+
+      it 'accepts a valid TOTP code' do
+        fill_in 'code', with: ROTP::TOTP.new(secret).now
+        click_button 'Submit'
+
+        expect(page).to have_content('Two factor authentication successful.')
+        expect(current_path).to eq root_path
+      end
+
+      it 'rejects an invalid TOTP code' do
+        fill_in 'code', with: 'incorrect'
+        click_button 'Submit'
+
+        expect(page).to have_content('Attempt failed')
+        expect(page).to have_content('Enter the code from your authenticator app')
+      end
+
+      it 'sends a code by SMS on request instead' do
+        click_link 'Send me a code instead'
+
+        expect(SMSProvider.messages.size).to eq(1)
+        fill_in 'code', with: SMSProvider.last_message.body
+        click_button 'Submit'
+
+        expect(page).to have_content('Two factor authentication successful.')
+      end
+    end
+
+    context 'for a user with a plain OTP secret' do
+      let(:user) { create_user }
+
+      it_behaves_like 'authenticates a TOTP code', :user
     end
 
-    it_behaves_like 'sends and authenticates code', create_user('not_encrypted')
-    it_behaves_like 'sends and authenticates code', create_user, 'encrypted'
+    context 'for a second devise scope with an encrypted OTP secret' do
+      let(:user) { create_secure_user }
+
+      it_behaves_like 'authenticates a TOTP code', :secure_user
+    end
+  end
+
+  scenario 'user who does not need two factor authentication goes straight in' do
+    allow_any_instance_of(User).to receive(:need_two_factor_authentication?).and_return(false)
+    user = create_user
+
+    visit new_user_session_path
+    complete_sign_in_form_for(user)
+    visit dashboard_path
+
+    expect(page).to have_content('Your Personal Dashboard')
+    expect(SMSProvider.messages).to be_empty
   end
 
   scenario "must be logged in" do
@@ -94,6 +177,28 @@ feature "User of two factor authentication" do
       expect(page).to have_content("You are signed out")
     end
 
+    scenario "failed attempts are reset after a successful code" do
+      visit user_two_factor_authentication_path
+
+      fill_in "code", with: "incorrect"
+      click_button "Submit"
+      expect(user.reload.second_factor_attempts_count).to eq(1)
+
+      fill_in "code", with: SMSProvider.last_message.body
+      click_button "Submit"
+
+      expect(page).to have_content("Two factor authentication successful.")
+      expect(user.reload.second_factor_attempts_count).to eq(0)
+    end
+
+    scenario "can sign out from the two factor page" do
+      visit user_two_factor_authentication_path
+
+      click_button "Sign out"
+
+      expect(page).to have_content("You are signed out")
+    end
+
     scenario "cannot retry authentication after max attempts" do
       user.update_attribute(:second_factor_attempts_count, User.max_login_attempts)
 

data/spec/generators/active_record/two_factor_authentication_generator_spec.rb

@@ -1,9 +1,10 @@
 require 'spec_helper'
+require 'tmpdir'
 
 require 'generators/active_record/two_factor_authentication_generator'
 
 describe ActiveRecord::Generators::TwoFactorAuthenticationGenerator, type: :generator do
-  destination File.expand_path('../../../../../tmp', __FILE__)
+  destination File.join(Dir.tmpdir, 'two_factor_authentication_generator')
 
   before do
     prepare_destination
@@ -21,16 +22,63 @@ describe ActiveRecord::Generators::TwoFactorAuthenticationGenerator, type: :gene
     end
 
     describe 'the migration' do
-      subject { migration_file('db/migrate/two_factor_authentication_add_to_users.rb') }
+      subject { Pathname.new(migration_file('db/migrate/two_factor_authentication_add_to_users.rb')) }
 
-      it { is_expected.to exist }
+      it { is_expected.to satisfy { |path| File.exist?(path) } }
       it { is_expected.to be_a_migration }
+      it { is_expected.to contain /< ActiveRecord::Migration\[#{ActiveRecord::VERSION::MAJOR}\.#{ActiveRecord::VERSION::MINOR}\]/ }
       it { is_expected.to contain /def change/ }
       it { is_expected.to contain /add_column :users, :second_factor_attempts_count, :integer, default: 0/ }
       it { is_expected.to contain /add_column :users, :encrypted_otp_secret_key, :string/ }
       it { is_expected.to contain /add_column :users, :encrypted_otp_secret_key_iv, :string/ }
       it { is_expected.to contain /add_column :users, :encrypted_otp_secret_key_salt, :string/ }
-      it { is_expected.to contain /add_index :users, :encrypted_otp_secret_key, unique: true/ }
+      it { is_expected.to contain /add_column :users, :direct_otp, :string/ }
+      it { is_expected.to contain /add_column :users, :direct_otp_sent_at, :datetime/ }
+      it { is_expected.to contain /add_column :users, :totp_timestamp, :timestamp/ }
+      it { is_expected.to contain /add_index :users, :encrypted_otp_secret_key, unique: true$/ }
+      it { is_expected.not_to contain /concurrently/ }
+      it { is_expected.not_to contain /disable_ddl_transaction!/ }
+    end
+  end
+
+  describe 'on PostgreSQL' do
+    subject { Pathname.new(migration_file('db/migrate/two_factor_authentication_add_to_users.rb')) }
+
+    before do
+      gen = generator %w(users)
+      allow(gen).to receive(:postgresql?).and_return(true)
+      gen.invoke_all
+    end
+
+    it { is_expected.to contain /disable_ddl_transaction!/ }
+    it { is_expected.to contain /add_index :users, :encrypted_otp_secret_key, unique: true, algorithm: :concurrently/ }
+  end
+
+  describe 'running the generated migration' do
+    let(:connection) { ActiveRecord::Base.connection }
+
+    before do
+      connection.create_table(:accounts) { |t| t.string :email }
+      run_generator %w(accounts)
+      load migration_file('db/migrate/two_factor_authentication_add_to_accounts.rb')
+    end
+
+    after do
+      connection.drop_table(:accounts, if_exists: true)
+      Object.send(:remove_const, :TwoFactorAuthenticationAddToAccounts)
+    end
+
+    it 'adds the two factor columns and index' do
+      ActiveRecord::Migration.suppress_messages do
+        TwoFactorAuthenticationAddToAccounts.migrate(:up)
+      end
+
+      expect(connection.columns(:accounts).map(&:name)).to include(
+        'second_factor_attempts_count', 'encrypted_otp_secret_key',
+        'encrypted_otp_secret_key_iv', 'encrypted_otp_secret_key_salt',
+        'direct_otp', 'direct_otp_sent_at', 'totp_timestamp'
+      )
+      expect(connection.index_exists?(:accounts, :encrypted_otp_secret_key, unique: true)).to eq(true)
     end
   end
 end

data/spec/generators/two_factor_authentication/two_factor_authentication_generator_spec.rb

@@ -0,0 +1,37 @@
+require 'spec_helper'
+
+require 'generators/two_factor_authentication/two_factor_authentication_generator'
+
+describe TwoFactorAuthenticatable::Generators::TwoFactorAuthenticationGenerator, type: :generator do
+  destination File.expand_path('../../../tmp/generators', __dir__)
+
+  let(:model_path) { File.join(destination_root, 'app/models/account.rb') }
+
+  before do
+    prepare_destination
+    FileUtils.mkdir_p(File.dirname(model_path))
+    File.write(model_path, <<~RUBY)
+      class Account < ApplicationRecord
+        devise :database_authenticatable, :validatable
+      end
+    RUBY
+  end
+
+  it 'adds :two_factor_authenticatable to the devise call in the model' do
+    run_generator %w(account --orm=active_record)
+
+    expect(File.read(model_path)).to include('devise :two_factor_authenticatable, :database_authenticatable, :validatable')
+  end
+
+  it 'generates the migration through the orm hook' do
+    run_generator %w(account --orm=active_record)
+
+    expect(Pathname.new(migration_file('db/migrate/two_factor_authentication_add_to_accounts.rb'))).to exist
+  end
+
+  it 'does not fail when the model file is missing' do
+    File.delete(model_path)
+
+    expect { run_generator %w(account --orm=active_record) }.not_to raise_error
+  end
+end

data/spec/lib/two_factor_authentication/models/two_factor_authenticatable_spec.rb

@@ -137,8 +137,13 @@ describe Devise::Models::TwoFactorAuthenticatable do
         end
 
         it "returns uri with user's email" do
-          expect(instance.provisioning_uri).
-            to match(%r{otpauth://totp/houdini@example.com\?secret=\w{32}})
+          uri = URI.parse(instance.provisioning_uri)
+          params = URI.decode_www_form(uri.query).to_h
+
+          expect(uri.scheme).to eq('otpauth')
+          expect(uri.host).to eq('totp')
+          expect(URI.decode_www_form_component(uri.path)).to eq('/houdini@example.com')
+          expect(params['secret']).to match(/\w{32}/)
         end
 
         it 'returns uri with issuer option' do
@@ -147,15 +152,14 @@ describe Devise::Models::TwoFactorAuthenticatable do
         end
 
         it 'returns uri with issuer option' do
-          require 'cgi'
           uri = URI.parse(instance.provisioning_uri('houdini', issuer: 'Magic'))
-          params = CGI.parse(uri.query)
+          params = URI.decode_www_form(uri.query).to_h
 
           expect(uri.scheme).to eq('otpauth')
           expect(uri.host).to eq('totp')
-          expect(uri.path).to eq('/Magic:houdini')
-          expect(params['issuer'].shift).to eq('Magic')
-          expect(params['secret'].shift).to match(/\w{32}/)
+          expect(URI.decode_www_form_component(uri.path)).to eq('/Magic:houdini')
+          expect(params['issuer']).to eq('Magic')
+          expect(params['secret']).to match(/\w{32}/)
         end
       end
     end
@@ -323,4 +327,82 @@ describe Devise::Models::TwoFactorAuthenticatable do
       end
     end
   end
+
+  context 'with an ActiveRecord model' do
+    let(:user) { create_user }
+
+    describe '#create_direct_otp' do
+      it 'persists the code and the time it was sent' do
+        Timecop.freeze do
+          user.create_direct_otp
+          user.reload
+
+          expect(user.direct_otp).to match(/\A\d{6}\z/)
+          expect(user.direct_otp_sent_at).to be_within(1.second).of(Time.now)
+        end
+      end
+    end
+
+    describe '#authenticate_direct_otp' do
+      it 'clears the persisted code after a successful match' do
+        user.create_direct_otp
+        code = user.reload.direct_otp
+
+        expect(user.authenticate_direct_otp(code)).to eq(true)
+        user.reload
+        expect(user.direct_otp).to be_nil
+        expect(user.direct_otp_sent_at).to be_nil
+      end
+    end
+
+    describe '#send_new_otp' do
+      it 'delivers the persisted code' do
+        user.send_new_otp
+
+        expect(SMSProvider.last_message.body).to eq(user.reload.direct_otp)
+      end
+    end
+
+    describe '#authenticate_totp' do
+      shared_examples 'persisted totp' do
+        let(:secret) { record.generate_totp_secret }
+
+        before do
+          record.otp_secret_key = secret
+          record.save!
+        end
+
+        it 'stores the last used time step as a time' do
+          expect(record.authenticate_totp(ROTP::TOTP.new(secret).now)).to eq(true)
+          record.save!
+
+          expect(record.reload.totp_timestamp).to be_a(Time)
+        end
+
+        it 'rejects a reused code after the record is reloaded' do
+          code = ROTP::TOTP.new(secret).now
+          expect(record.authenticate_totp(code)).to eq(true)
+          record.save!
+
+          expect(record.class.find(record.id).authenticate_totp(code)).to eq(false)
+        end
+      end
+
+      context 'with a plain secret' do
+        let(:record) { user }
+        include_examples 'persisted totp'
+      end
+
+      context 'with an encrypted secret' do
+        let(:record) { create_secure_user }
+        include_examples 'persisted totp'
+
+        it 'keeps the secret encrypted in the database' do
+          expect(record.reload.encrypted_otp_secret_key).to be_present
+          expect(record.encrypted_otp_secret_key).not_to include(secret)
+          expect(record.otp_secret_key).to eq(secret)
+        end
+      end
+    end
+  end
 end

data/spec/lib/two_factor_authentication/schema_spec.rb

@@ -0,0 +1,41 @@
+require 'spec_helper'
+
+describe TwoFactorAuthentication::Schema do
+  let(:connection) { ActiveRecord::Base.connection }
+
+  after { connection.drop_table(:schema_helper_users, if_exists: true) }
+
+  def columns
+    connection.columns(:schema_helper_users).index_by(&:name)
+  end
+
+  it 'adds every column in create_table' do
+    connection.create_table(:schema_helper_users) do |t|
+      t.second_factor_attempts_count
+      t.encrypted_otp_secret_key
+      t.encrypted_otp_secret_key_iv
+      t.encrypted_otp_secret_key_salt
+      t.direct_otp
+      t.direct_otp_sent_at
+      t.totp_timestamp
+    end
+
+    expect(columns['second_factor_attempts_count'].type).to eq(:integer)
+    expect(columns['second_factor_attempts_count'].default.to_i).to eq(0)
+    %w(encrypted_otp_secret_key encrypted_otp_secret_key_iv encrypted_otp_secret_key_salt direct_otp).each do |name|
+      expect(columns[name].type).to eq(:string)
+    end
+    expect(columns['direct_otp_sent_at'].type).to eq(:datetime)
+    expect(columns['totp_timestamp'].type).to eq(:datetime)
+  end
+
+  it 'adds columns in change_table' do
+    connection.create_table(:schema_helper_users)
+    connection.change_table(:schema_helper_users) do |t|
+      t.second_factor_attempts_count
+      t.totp_timestamp
+    end
+
+    expect(columns.keys).to include('second_factor_attempts_count', 'totp_timestamp')
+  end
+end

data/spec/rails_app/app/assets/config/manifest.js

@@ -0,0 +1,2 @@
+//= link_directory ../javascripts .js
+//= link_directory ../stylesheets .css

data/spec/rails_app/app/controllers/home_controller.rb

@@ -1,5 +1,5 @@
 class HomeController < ApplicationController
-  before_action :authenticate_user!, only: :dashboard
+  before_action :authenticate_user!, only: [:dashboard, :secret]
 
   def index
   end
@@ -7,4 +7,9 @@ class HomeController < ApplicationController
   def dashboard
   end
 
+  # Responds to any format, to prove the 2FA check halts non-HTML/JSON requests
+  def secret
+    render plain: 'top secret'
+  end
+
 end

data/spec/rails_app/app/models/guest_user.rb

@@ -7,7 +7,7 @@ class GuestUser
   attr_accessor :direct_otp, :direct_otp_sent_at, :otp_secret_key, :email,
     :second_factor_attempts_count, :totp_timestamp
 
-  def update_attributes(attrs)
+  def update(attrs)
     attrs.each do |key, value|
       send(key.to_s + '=', value)
     end

data/spec/rails_app/app/models/secure_user.rb

@@ -0,0 +1,13 @@
+class SecureUser < ActiveRecord::Base
+  devise :two_factor_authenticatable, :database_authenticatable, :validatable
+
+  has_one_time_password(encrypted: true)
+
+  def send_two_factor_authentication_code(code)
+    SMSProvider.send_message(to: phone_number, body: code)
+  end
+
+  def phone_number
+    '14155550000'
+  end
+end

data/spec/rails_app/config/application.rb

@@ -1,3 +1,4 @@
+require 'logger'
 require File.expand_path('../boot', __FILE__)
 
 require "active_record/railtie"
@@ -60,4 +61,3 @@ module Dummy
     config.secret_key_base = 'secretvalue'
   end
 end
-

data/spec/rails_app/config/environments/test.rb

@@ -9,14 +9,8 @@ Dummy::Application.configure do
   config.eager_load = false
 
   # Configure static asset server for tests with Cache-Control for performance
-  if Rails::VERSION::MAJOR == 4 && Rails::VERSION::MINOR >= 2 ||
-    Rails::VERSION::MAJOR >= 5
-    config.serve_static_files = true
-  else
-    config.serve_static_assets = true
-  end
-
-  config.static_cache_control = "public, max-age=3600"
+  config.public_file_server.enabled = true
+  config.public_file_server.headers = { "Cache-Control" => "public, max-age=3600" }
 
   # Show full error reports and disable caching
   config.consider_all_requests_local       = true
@@ -38,4 +32,5 @@ Dummy::Application.configure do
 
   # For testing session variables in Capybara specs
   config.middleware.use RackSessionAccess::Middleware
+  config.assets.check_precompiled_asset = false
 end

data/spec/rails_app/config/initializers/inflections.rb

@@ -13,3 +13,7 @@
 # ActiveSupport::Inflector.inflections do |inflect|
 #   inflect.acronym 'RESTful'
 # end
+
+ActiveSupport::Inflector.inflections(:en) do |inflect|
+  inflect.acronym 'SMS'
+end

data/spec/rails_app/config/routes.rb

@@ -3,8 +3,10 @@ Dummy::Application.routes.draw do
   root to: "home#index"
 
   match "/dashboard", to: "home#dashboard", as: :dashboard, via: [:get]
+  get "/secret", to: "home#secret", as: :secret
 
   devise_for :users
+  devise_for :secure_users
 
   # The priority is based upon order of creation:
   # first created -> highest priority.

data/spec/rails_app/db/migrate/20260929000000_add_otp_columns_to_users.rb

@@ -0,0 +1,8 @@
+class AddOtpColumnsToUsers < ActiveRecord::Migration[5.0]
+  def change
+    add_column :users, :otp_secret_key, :string
+    add_column :users, :direct_otp, :string
+    add_column :users, :direct_otp_sent_at, :datetime
+    add_column :users, :totp_timestamp, :timestamp
+  end
+end

data/spec/rails_app/db/migrate/20260929000001_devise_create_secure_users.rb

@@ -0,0 +1,22 @@
+# A second 2FA scope whose TOTP secret is encrypted.
+class DeviseCreateSecureUsers < ActiveRecord::Migration[5.0]
+  def change
+    create_table(:secure_users) do |t|
+      t.string :email,              null: false, default: ""
+      t.string :encrypted_password, null: false, default: ""
+
+      t.integer  :second_factor_attempts_count, default: 0
+      t.string   :encrypted_otp_secret_key
+      t.string   :encrypted_otp_secret_key_iv
+      t.string   :encrypted_otp_secret_key_salt
+      t.string   :direct_otp
+      t.datetime :direct_otp_sent_at
+      t.timestamp :totp_timestamp
+
+      t.timestamps null: false
+    end
+
+    add_index :secure_users, :email, unique: true
+    add_index :secure_users, :encrypted_otp_secret_key, unique: true
+  end
+end

data/spec/rails_app/db/schema.rb

@@ -2,16 +2,15 @@
 # of editing this file, please use the migrations feature of Active Record to
 # incrementally modify your database, and then regenerate this schema definition.
 #
-# Note that this schema.rb definition is the authoritative source for your
-# database schema. If you need to create the application database on another
-# system, you should be using db:schema:load, not running all the migrations
-# from scratch. The latter is a flawed and unsustainable approach (the more migrations
-# you'll amass, the slower it'll run and the greater likelihood for issues).
+# This file is the source Rails uses to define your schema when running `bin/rails
+# db:schema:load`. When creating a new database, `bin/rails db:schema:load` tends to
+# be faster and is potentially less error prone than running all of your
+# migrations from scratch. Old migrations may fail to apply correctly if those
+# migrations use external dependencies or application code.
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2016_02_09_032439) do
-
+ActiveRecord::Schema.define(version: 2026_09_29_000001) do
   create_table "admins", force: :cascade do |t|
     t.string "email", default: "", null: false
     t.string "encrypted_password", default: "", null: false
@@ -29,6 +28,22 @@ ActiveRecord::Schema.define(version: 2016_02_09_032439) do
     t.index ["reset_password_token"], name: "index_admins_on_reset_password_token", unique: true
   end
 
+  create_table "secure_users", force: :cascade do |t|
+    t.string "email", default: "", null: false
+    t.string "encrypted_password", default: "", null: false
+    t.integer "second_factor_attempts_count", default: 0
+    t.string "encrypted_otp_secret_key"
+    t.string "encrypted_otp_secret_key_iv"
+    t.string "encrypted_otp_secret_key_salt"
+    t.string "direct_otp"
+    t.datetime "direct_otp_sent_at"
+    t.datetime "totp_timestamp"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["email"], name: "index_secure_users_on_email", unique: true
+    t.index ["encrypted_otp_secret_key"], name: "index_secure_users_on_encrypted_otp_secret_key", unique: true
+  end
+
   create_table "users", force: :cascade do |t|
     t.string "email", default: "", null: false
     t.string "encrypted_password", default: "", null: false
@@ -47,9 +62,12 @@ ActiveRecord::Schema.define(version: 2016_02_09_032439) do
     t.string "encrypted_otp_secret_key"
     t.string "encrypted_otp_secret_key_iv"
     t.string "encrypted_otp_secret_key_salt"
+    t.string "otp_secret_key"
+    t.string "direct_otp"
+    t.datetime "direct_otp_sent_at"
+    t.datetime "totp_timestamp"
     t.index ["email"], name: "index_users_on_email", unique: true
     t.index ["encrypted_otp_secret_key"], name: "index_users_on_encrypted_otp_secret_key", unique: true
     t.index ["reset_password_token"], name: "index_users_on_reset_password_token", unique: true
   end
-
 end

data/spec/rails_app/lib/sms_provider.rb

@@ -1,13 +1,11 @@
-require 'ostruct'
-
 class SMSProvider
-  Message = Class.new(OpenStruct)
+  Message = Struct.new(:to, :body)
 
   class_attribute :messages
   self.messages = []
 
   def self.send_message(opts = {})
-    self.messages << Message.new(opts)
+    self.messages << Message.new(opts[:to], opts[:body])
   end
 
   def self.last_message