userbin 1.3.1 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 01656a6ef1aa891d26aadd81b5c2541f6bdee830
-  data.tar.gz: 131a697805e6e9a2e289efb08c2a2a60a9dfa6e5
+  metadata.gz: 0257d124a0048c84143386d8b283897aea15857b
+  data.tar.gz: dc8f8dfb8a4333dba7cd9f1852f54dadbe7a73bf
 SHA512:
-  metadata.gz: f46b4ffb2639ba4d842a75b733dd555a46499deeaf40acdbbc1a8ae3b07d1d70132f571eba1b3d75bfa28d1637431718fe395594d3eda29fe3ec9fd2756a4822
-  data.tar.gz: 3ee6024aae53c0502d9df9d8498873092f6121aa4afb521a2dc6e24567d2fce0e8397719595fbe9a2192878f781b31406301a671d4495d22ff58ae63166e806b
+  metadata.gz: 45a474521b983d95e7feb3db328d2253f5e8ba690ac3848b4a78198ff25520f5b5138363ca518c0061a45a290fcab48bdefd1e66972d0911f36a94c70443d753
+  data.tar.gz: 811d1c0c867a4f02b4dcceab6c67696fae958d96e130fc7c87b8d337da9727468d42aeda9e67111708aa24935b8f377e782459554033c43eaebaa17249661df5

data/README.md

@@ -43,12 +43,12 @@ require 'userbin'
 Userbin.api_secret = "YOUR_API_SECRET"
 ```
 
-Add a reference to the Userbin client in your main controller so that it's globally accessible throughout a request. The initializer takes a Rack request as argument from which it extracts details such as IP address and user agent and sends it along all API requests.
+Add a reference to the Userbin client in your main controller so that it's globally accessible throughout a request. The initializer takes a Rack **request** as argument from which it extracts details such as IP address and user agent and sends it along all API requests. The second argument is a reference to the **cookies** hash, used for storing the trusted device token.
 
 ```ruby
 class ApplicationController < ActionController::Base
   def userbin
-    @userbin ||= Userbin::Client.new(request)
+    @userbin ||= Userbin::Client.new(request, cookies)
   end
   # ...
 end
@@ -209,7 +209,7 @@ userbin.disable_mfa
 
 If the user has enabled two-factor authentication, `authorize!` might raise `ChallengeRequiredError`, which means they'll have to verify a challenge to proceed.
 
-Capture this error just as with UserUnauthorizedError and redirect the user.
+Capture this error just as with UserUnauthorizedError and redirect the user to a path **not protected** by `authorize!`.
 
 If the user tries to reach a path protected by `authorize!` after a challenge has been created but still not verified, the session will be destroyed and UserUnauthorizedError raised.
 
@@ -224,6 +224,8 @@ end
 
 Create a challenge, which will send the user and SMS if this is the default pairing. After the challenge has been verified, `authorize!` will not throw any further exceptions until any suspicious behavior is detected.
 
+When you call `trust_device`, the user will not be challenged for secondary authentication when they log in to your application from that device for a set period of time. You could add this to your form as a checkbox option.
+
 ```ruby
 class ChallengeController < ApplicationController
   def show
@@ -236,11 +238,17 @@ class ChallengeController < ApplicationController
 
     userbin.challenges.verify(challenge_id, response: code)
 
+    # Avoid verification on next login for better experience
+    userbin.trust_device if params[:trust_device]
+
     # Yay, the challenge was verified!
     redirect_to root_url
 
-  rescue Userbin::ForbiddenError
+  rescue Userbin::ForbiddenError => e
+    sign_out # log out your user locally
+
     flash.notice = 'Wrong code, bye!'
+    redirect_to root_path
   end
 end
 ```

data/lib/userbin.rb

@@ -13,6 +13,7 @@ require 'userbin/configuration'
 require 'userbin/client'
 require 'userbin/errors'
 require 'userbin/session_store'
+require 'userbin/trusted_token_store'
 require 'userbin/jwt'
 require 'userbin/utils'
 require 'userbin/request'
@@ -30,4 +31,5 @@ require 'userbin/models/monitoring'
 require 'userbin/models/pairing'
 require 'userbin/models/backup_codes'
 require 'userbin/models/session'
+require 'userbin/models/trusted_device'
 require 'userbin/models/user'

data/lib/userbin/client.rb

@@ -14,15 +14,16 @@ module Userbin
     end
 
     install_proxy_methods :challenges, :events, :sessions, :pairings,
-      :backup_codes, :generate_backup_codes, :enable_mfa, :disable_mfa
+      :backup_codes, :generate_backup_codes, :trusted_devices,
+      :enable_mfa, :disable_mfa
 
-    def initialize(request, opts = {})
+    def initialize(request, cookies, opts = {})
       # Save a reference in the per-request store so that the request
       # middleware in request.rb can access it
       RequestStore.store[:userbin] = self
 
       # By default the session token is persisted in the Rack store, which may
-      # in turn point to any source. But this option gives you an option to
+      # in turn point to any source. This option give you an option to
       # use any store, such as Redis or Memcached to store your Userbin tokens.
       if opts[:session_store]
         @session_store = opts[:session_store]
@@ -30,6 +31,8 @@ module Userbin
         @session_store = Userbin::SessionStore::Rack.new(request.session)
       end
 
+      @trusted_token_store = Userbin::TrustedTokenStore::Rack.new(cookies)
+
       @request_context = {
         ip: request.ip,
         user_agent: request.user_agent
@@ -49,11 +52,24 @@ module Userbin
       Userbin::SessionToken.new(token) if token
     end
 
+    def trusted_device_token=(value)
+      if value && value != @trusted_token_store.read
+        @trusted_token_store.write(value)
+      elsif !value
+        @trusted_token_store.destroy
+      end
+    end
+
+    def trusted_device_token
+      @trusted_token_store.read
+    end
+
     def identify(user_id)
       # The user identifier is used in API paths so it needs to be cleaned
       user_id = URI.encode(user_id.to_s)
 
       @session_store.user_id = user_id
+      @trusted_token_store.user_id = user_id
     end
 
     def authorize
@@ -82,7 +98,9 @@ module Userbin
             'Logged out due to being unverified'
       end
 
-      raise Userbin::ChallengeRequiredError if mfa_required?
+      if mfa_required? && !device_trusted?
+        raise Userbin::ChallengeRequiredError
+      end
     end
 
     def login(user_id, user_attrs = {})
@@ -92,12 +110,20 @@ module Userbin
       identify(user_id)
 
       session = Userbin::Session.post(
-        "users/#{@session_store.user_id}/sessions", user: user_attrs)
+        "users/#{@session_store.user_id}/sessions", user: user_attrs,
+        trusted_device_token: self.trusted_device_token)
 
       # Set the session token for use in all subsequent requests
       self.session_token = session.token
     end
 
+    def trust_device(attrs = {})
+      trusted_device = trusted_devices.create(attrs)
+
+      # Set the session token for use in all subsequent requests
+      self.trusted_device_token = trusted_device.token
+    end
+
     # This method ends the current monitoring session. It should be called
     # whenever the user logs out from your system.
     #
@@ -118,6 +144,10 @@ module Userbin
       session_token ? session_token.mfa_enabled? : false
     end
 
+    def device_trusted?
+      session_token ? session_token.device_trusted? : false
+    end
+
     def mfa_in_progress?
       session_token ? session_token.has_challenge? : false
     end

data/lib/userbin/models/trusted_device.rb

@@ -0,0 +1,5 @@
+module Userbin
+  class TrustedDevice < Model
+    collection_path "users/:user_id/trusted_devices"
+  end
+end

data/lib/userbin/models/user.rb

@@ -10,6 +10,7 @@ module Userbin
     has_many :events
     has_many :pairings
     has_many :sessions
+    has_many :trusted_devices
 
     def backup_codes(params={})
       Userbin::BackupCodes.get("/v1/users/#{id}/backup_codes", params)

data/lib/userbin/request.rb

@@ -35,7 +35,7 @@ module Userbin
 
         def call(env)
           value = Base64.encode64(":#{@api_secret || Userbin.config.api_secret}")
-          value.gsub!("\n", '')
+          value.delete!("\n")
           env[:request_headers]["Authorization"] = "Basic #{value}"
           @app.call(env)
         end

data/lib/userbin/session_token.rb

@@ -28,6 +28,10 @@ module Userbin
       @jwt.payload['mfa'] == 1
     end
 
+    def device_trusted?
+      @jwt.payload['tru'] == 1
+    end
+
     def challenge_type
       @jwt.payload['chg']['typ'].to_sym if has_challenge?
     end

data/lib/userbin/trusted_token_store.rb

@@ -0,0 +1,35 @@
+module Userbin
+  class TrustedTokenStore
+    class Rack < TrustedTokenStore
+      def initialize(cookies)
+        @cookies = cookies
+      end
+
+      def user_id
+        @cookies['userbin.user_id']
+      end
+
+      def user_id=(value)
+        @cookies['userbin.user_id'] = value
+      end
+
+      def read
+        @cookies[key]
+      end
+
+      def write(value)
+        @cookies[key] = value
+      end
+
+      def destroy
+        @cookies.delete(key)
+      end
+
+      private
+
+      def key
+        "userbin.trusted_device_token.#{user_id}"
+      end
+    end
+  end
+end

data/lib/userbin/version.rb

@@ -1,3 +1,3 @@
 module Userbin
-  VERSION = "1.3.1"
+  VERSION = "1.4.0"
 end

data/spec/jwt_spec.rb

@@ -13,14 +13,14 @@ describe 'Userbin::JWT' do
     it 'verifies that JWT has expired' do
       new_time = Time.utc(2014, 4, 23, 8, 46, 44)
       Timecop.freeze(new_time) do
-        Userbin::JWT.new(token).expired?.should be_true
+        Userbin::JWT.new(token).should be_expired
       end
     end
 
     it 'verifies that JWT has not expired' do
       new_time = Time.utc(2014, 4, 23, 8, 46, 43)
       Timecop.freeze(new_time) do
-        Userbin::JWT.new(token).expired?.should be_false
+        Userbin::JWT.new(token).should_not be_expired
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: userbin
 version: !ruby/object:Gem::Version
-  version: 1.3.1
+  version: 1.4.0
 platform: ruby
 authors:
 - Johan
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-10-10 00:00:00.000000000 Z
+date: 2014-10-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: her
@@ -185,10 +185,12 @@ files:
 - lib/userbin/models/monitoring.rb
 - lib/userbin/models/pairing.rb
 - lib/userbin/models/session.rb
+- lib/userbin/models/trusted_device.rb
 - lib/userbin/models/user.rb
 - lib/userbin/request.rb
 - lib/userbin/session_store.rb
 - lib/userbin/session_token.rb
+- lib/userbin/trusted_token_store.rb
 - lib/userbin/utils.rb
 - lib/userbin/version.rb
 - spec/fixtures/vcr_cassettes/challenge_create.yml