two_factor_authentication 2.2.0 → 3.0.0

data/spec/requests/two_factor_authentication_helpers_spec.rb

@@ -0,0 +1,48 @@
+require 'spec_helper'
+
+describe 'Requests from a user who has not completed two factor authentication', type: :request do
+  let(:user) { create_user }
+
+  before { login_as user, scope: :user }
+
+  it 'redirects HTML requests to the two factor page' do
+    get secret_path
+
+    expect(response).to redirect_to(user_two_factor_authentication_path)
+  end
+
+  it 'responds to JSON requests with 401 and the two factor path' do
+    get secret_path(format: :json)
+
+    expect(response).to have_http_status(:unauthorized)
+    expect(response.parsed_body).to eq('redirect_to' => user_two_factor_authentication_path)
+  end
+
+  it 'responds to other formats with 401 without running the action' do
+    get secret_path(format: :xml)
+
+    expect(response).to have_http_status(:unauthorized)
+    expect(response.body).not_to include('top secret')
+  end
+
+  it 'responds with 401 when the format comes from the Accept header' do
+    get secret_path, headers: { 'Accept' => 'text/csv' }
+
+    expect(response).to have_http_status(:unauthorized)
+    expect(response.body).not_to include('top secret')
+  end
+
+  context 'when the user does not need two factor authentication' do
+    before do
+      allow_any_instance_of(User).to receive(:need_two_factor_authentication?).and_return(false)
+    end
+
+    it 'runs the action and sends no code' do
+      get secret_path(format: :xml)
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to eq('top secret')
+      expect(SMSProvider.messages).to be_empty
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -1,5 +1,6 @@
 ENV["RAILS_ENV"] ||= "test"
 require File.expand_path("../rails_app/config/environment.rb",  __FILE__)
+require File.expand_path("../rails_app/lib/sms_provider.rb", __FILE__)
 
 require 'rspec/rails'
 require 'timecop'

data/spec/support/authenticated_model_helper.rb

@@ -3,9 +3,7 @@ module AuthenticatedModelHelper
     GuestUser.new
   end
 
-  def create_user(type = 'encrypted', attributes = {})
-    create_table_for_nonencrypted_user if type == 'not_encrypted'
-
+  def create_user(attributes = {})
     User.create!(valid_attributes(attributes))
   end
 
@@ -13,6 +11,10 @@ module AuthenticatedModelHelper
     Admin.create!(valid_attributes.except(:nickname))
   end
 
+  def create_secure_user(attributes = {})
+    SecureUser.create!(valid_attributes(attributes).except(:nickname))
+  end
+
   def valid_attributes(attributes={})
     {
       nickname: 'Marissa',
@@ -27,33 +29,6 @@ module AuthenticatedModelHelper
     @@email_count += 1
     "user#{@@email_count}@example.com"
   end
-
-  def create_table_for_nonencrypted_user
-    ActiveRecord::Migration.suppress_messages do
-      ActiveRecord::Schema.define(version: 1) do
-        create_table 'users', force: :cascade do |t|
-          t.string    'email', default: '', null: false
-          t.string    'encrypted_password', default: '', null: false
-          t.string    'reset_password_token'
-          t.datetime  'reset_password_sent_at'
-          t.datetime  'remember_created_at'
-          t.integer   'sign_in_count', default: 0,  null: false
-          t.datetime  'current_sign_in_at'
-          t.datetime  'last_sign_in_at'
-          t.string    'current_sign_in_ip'
-          t.string    'last_sign_in_ip'
-          t.datetime  'created_at', null: false
-          t.datetime  'updated_at', null: false
-          t.integer   'second_factor_attempts_count', default: 0
-          t.string    'nickname', limit: 64
-          t.string    'otp_secret_key'
-          t.string    'direct_otp'
-          t.datetime  'direct_otp_sent_at'
-          t.timestamp 'totp_timestamp'
-        end
-      end
-    end
-  end
 end
 
 RSpec.configuration.send(:include, AuthenticatedModelHelper)

data/spec/support/controller_helper.rb

@@ -1,8 +1,9 @@
 module ControllerHelper
-  def sign_in(user = create_user('not_encrypted'))
-    allow(warden).to receive(:authenticated?).with(:user).and_return(true)
-    allow(controller).to receive(:current_user).and_return(user)
-    warden.session(:user)[TwoFactorAuthentication::NEED_AUTHENTICATION] = true
+  def sign_in(user = create_user, scope: :user)
+    allow(warden).to receive(:authenticated?).and_call_original
+    allow(warden).to receive(:authenticated?).with(scope).and_return(true)
+    allow(controller).to receive(:"current_#{scope}").and_return(user)
+    warden.session(scope)[TwoFactorAuthentication::NEED_AUTHENTICATION] = true
   end
 end
 

data/spec/support/features_spec_helper.rb

@@ -30,6 +30,7 @@ end
 
 RSpec.configure do |config|
   config.include Warden::Test::Helpers, type: :feature
+  config.include Warden::Test::Helpers, type: :request
   config.include FeaturesSpecHelper, type: :feature
 
   config.before(:each) do

data/two_factor_authentication.gemspec

@@ -9,6 +9,7 @@ Gem::Specification.new do |s|
   s.email       = ["dmitrii.golub@gmail.com"]
   s.homepage    = "https://github.com/Houdini/two_factor_authentication"
   s.summary     = %q{Two factor authentication plugin for devise}
+  s.license     = "MIT"
   s.description = <<-EOF
     ### Features ###
     * control sms code pattern
@@ -17,23 +18,21 @@ Gem::Specification.new do |s|
     * your own sms logic
   EOF
 
-  s.rubyforge_project = "two_factor_authentication"
-
   s.files         = `git ls-files`.split("\n")
   s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
   s.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
   s.require_paths = ["lib"]
 
-  s.add_runtime_dependency 'rails', '>= 3.1.1'
+  s.add_runtime_dependency 'rails', '>= 5.0'
   s.add_runtime_dependency 'devise'
   s.add_runtime_dependency 'randexp'
   s.add_runtime_dependency 'rotp', '>= 4.0.0'
   s.add_runtime_dependency 'encryptor'
 
-  s.add_development_dependency 'bundler'
   s.add_development_dependency 'rake'
   s.add_development_dependency 'rspec-rails', '>= 3.0.1'
-  s.add_development_dependency 'capybara', '~> 2.5'
+  s.add_development_dependency 'capybara', '>= 2.5', '< 4'
   s.add_development_dependency 'pry'
+  s.add_development_dependency 'byebug'
   s.add_development_dependency 'timecop'
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: two_factor_authentication
 version: !ruby/object:Gem::Version
-  version: 2.2.0
+  version: 3.0.0
 platform: ruby
 authors:
 - Dmitrii Golub
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-01-29 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -16,14 +15,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.1
+        version: '5.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.1
+        version: '5.0'
 - !ruby/object:Gem::Dependency
   name: devise
   requirement: !ruby/object:Gem::Requirement
@@ -81,7 +80,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: bundler
+  name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -95,49 +94,55 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: rake
+  name: rspec-rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 3.0.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 3.0.1
 - !ruby/object:Gem::Dependency
-  name: rspec-rails
+  name: capybara
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.0.1
+        version: '2.5'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.0.1
+        version: '2.5'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
 - !ruby/object:Gem::Dependency
-  name: capybara
+  name: pry
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.5'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.5'
+        version: '0'
 - !ruby/object:Gem::Dependency
-  name: pry
+  name: byebug
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -177,17 +182,19 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".codeclimate.yml"
+- ".github/workflows/ci.yml"
 - ".gitignore"
 - ".rubocop.yml"
-- ".travis.yml"
 - CHANGELOG.md
 - Gemfile
 - LICENSE
+- MIGRATION_GUIDE.md
 - README.md
 - Rakefile
 - app/controllers/devise/two_factor_authentication_controller.rb
 - app/views/devise/two_factor_authentication/max_login_attempts_reached.html.erb
 - app/views/devise/two_factor_authentication/show.html.erb
+- config/locales/de.yml
 - config/locales/en.yml
 - config/locales/es.yml
 - config/locales/fr.yml
@@ -207,10 +214,13 @@ files:
 - spec/controllers/two_factor_authentication_controller_spec.rb
 - spec/features/two_factor_authenticatable_spec.rb
 - spec/generators/active_record/two_factor_authentication_generator_spec.rb
+- spec/generators/two_factor_authentication/two_factor_authentication_generator_spec.rb
 - spec/lib/two_factor_authentication/models/two_factor_authenticatable_spec.rb
+- spec/lib/two_factor_authentication/schema_spec.rb
 - spec/rails_app/.gitignore
 - spec/rails_app/README.md
 - spec/rails_app/Rakefile
+- spec/rails_app/app/assets/config/manifest.js
 - spec/rails_app/app/assets/javascripts/application.js
 - spec/rails_app/app/assets/stylesheets/application.css
 - spec/rails_app/app/controllers/application_controller.rb
@@ -221,6 +231,7 @@ files:
 - spec/rails_app/app/models/admin.rb
 - spec/rails_app/app/models/encrypted_user.rb
 - spec/rails_app/app/models/guest_user.rb
+- spec/rails_app/app/models/secure_user.rb
 - spec/rails_app/app/models/user.rb
 - spec/rails_app/app/views/home/dashboard.html.erb
 - spec/rails_app/app/views/home/index.html.erb
@@ -238,7 +249,6 @@ files:
 - spec/rails_app/config/initializers/devise.rb
 - spec/rails_app/config/initializers/inflections.rb
 - spec/rails_app/config/initializers/mime_types.rb
-- spec/rails_app/config/initializers/secret_token.rb
 - spec/rails_app/config/initializers/session_store.rb
 - spec/rails_app/config/initializers/wrap_parameters.rb
 - spec/rails_app/config/locales/devise.en.yml
@@ -251,6 +261,8 @@ files:
 - spec/rails_app/db/migrate/20151224180310_populate_otp_column.rb
 - spec/rails_app/db/migrate/20151228230340_remove_otp_secret_key_from_user.rb
 - spec/rails_app/db/migrate/20160209032439_devise_create_admins.rb
+- spec/rails_app/db/migrate/20260929000000_add_otp_columns_to_users.rb
+- spec/rails_app/db/migrate/20260929000001_devise_create_secure_users.rb
 - spec/rails_app/db/schema.rb
 - spec/rails_app/lib/assets/.gitkeep
 - spec/rails_app/lib/sms_provider.rb
@@ -259,6 +271,7 @@ files:
 - spec/rails_app/public/500.html
 - spec/rails_app/public/favicon.ico
 - spec/rails_app/script/rails
+- spec/requests/two_factor_authentication_helpers_spec.rb
 - spec/spec_helper.rb
 - spec/support/authenticated_model_helper.rb
 - spec/support/capybara.rb
@@ -268,9 +281,9 @@ files:
 - spec/support/totp_helper.rb
 - two_factor_authentication.gemspec
 homepage: https://github.com/Houdini/two_factor_authentication
-licenses: []
+licenses:
+- MIT
 metadata: {}
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -285,19 +298,20 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: two_factor_authentication
-rubygems_version: 2.6.14
-signing_key: 
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Two factor authentication plugin for devise
 test_files:
 - spec/controllers/two_factor_authentication_controller_spec.rb
 - spec/features/two_factor_authenticatable_spec.rb
 - spec/generators/active_record/two_factor_authentication_generator_spec.rb
+- spec/generators/two_factor_authentication/two_factor_authentication_generator_spec.rb
 - spec/lib/two_factor_authentication/models/two_factor_authenticatable_spec.rb
+- spec/lib/two_factor_authentication/schema_spec.rb
 - spec/rails_app/.gitignore
 - spec/rails_app/README.md
 - spec/rails_app/Rakefile
+- spec/rails_app/app/assets/config/manifest.js
 - spec/rails_app/app/assets/javascripts/application.js
 - spec/rails_app/app/assets/stylesheets/application.css
 - spec/rails_app/app/controllers/application_controller.rb
@@ -308,6 +322,7 @@ test_files:
 - spec/rails_app/app/models/admin.rb
 - spec/rails_app/app/models/encrypted_user.rb
 - spec/rails_app/app/models/guest_user.rb
+- spec/rails_app/app/models/secure_user.rb
 - spec/rails_app/app/models/user.rb
 - spec/rails_app/app/views/home/dashboard.html.erb
 - spec/rails_app/app/views/home/index.html.erb
@@ -325,7 +340,6 @@ test_files:
 - spec/rails_app/config/initializers/devise.rb
 - spec/rails_app/config/initializers/inflections.rb
 - spec/rails_app/config/initializers/mime_types.rb
-- spec/rails_app/config/initializers/secret_token.rb
 - spec/rails_app/config/initializers/session_store.rb
 - spec/rails_app/config/initializers/wrap_parameters.rb
 - spec/rails_app/config/locales/devise.en.yml
@@ -338,6 +352,8 @@ test_files:
 - spec/rails_app/db/migrate/20151224180310_populate_otp_column.rb
 - spec/rails_app/db/migrate/20151228230340_remove_otp_secret_key_from_user.rb
 - spec/rails_app/db/migrate/20160209032439_devise_create_admins.rb
+- spec/rails_app/db/migrate/20260929000000_add_otp_columns_to_users.rb
+- spec/rails_app/db/migrate/20260929000001_devise_create_secure_users.rb
 - spec/rails_app/db/schema.rb
 - spec/rails_app/lib/assets/.gitkeep
 - spec/rails_app/lib/sms_provider.rb
@@ -346,6 +362,7 @@ test_files:
 - spec/rails_app/public/500.html
 - spec/rails_app/public/favicon.ico
 - spec/rails_app/script/rails
+- spec/requests/two_factor_authentication_helpers_spec.rb
 - spec/spec_helper.rb
 - spec/support/authenticated_model_helper.rb
 - spec/support/capybara.rb

data/.travis.yml

@@ -1,28 +0,0 @@
-language: ruby
-
-env:
-  - "RAILS_VERSION=4.2"
-  - "RAILS_VERSION=5.2"
-  - "RAILS_VERSION=master"
-
-rvm:
-  - 2.3.8
-  - 2.4.5
-  - 2.5.3
-
-matrix:
-  fast_finish: true
-  allow_failures:
-    - env: "RAILS_VERSION=master"
-  include:
-    - rvm: 2.2
-      env: RAILS_VERSION=4.2
-
-before_install:
-  - gem uninstall -v '>= 2' -i $(rvm gemdir)@global -ax bundler || true
-  - gem install bundler -v '< 2'
-
-before_script:
-  - bundle exec rake app:db:setup
-
-script: bundle exec rake spec

data/spec/rails_app/config/initializers/secret_token.rb

@@ -1,7 +0,0 @@
-# Be sure to restart your server when you modify this file.
-
-# Your secret key for verifying the integrity of signed cookies.
-# If you change this key, all old signed cookies will become invalid!
-# Make sure the secret is at least 30 characters and all random,
-# no regular words or you'll be exposed to dictionary attacks.
-Dummy::Application.config.secret_token = 'e75d8cdfc7c99757a5d4b427bde4b4b1072eb169c022cdbb038bdbcefb3901ef60ac912b6fb14260db099156520b9cc8838e4bf8e209b7246fad891950825032'