webauthn-rails 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5bf8803deeac8d925eef701fa4b9a25b3ecea1288e5af2b07dad81e60b16574d
-  data.tar.gz: ad28b85f03d4d693ec12d94c6702e6a8a6a0fbdd9226303efa520e61bc6c1000
+  metadata.gz: 20ded36acb2b7a3f4d67cdd4e860dc41e6f8490bb9143be6a0575117e1e7a84e
+  data.tar.gz: 8b2d46393c0d24e340b82f7f5d908e34fdd7cedb30501b8e8ba9663f217c23b9
 SHA512:
-  metadata.gz: 7d10d95538f98bfd0375159c3bd7acba311992cf06062aecfae5fe1f1c4bdf57de6494fd6c5ade9e70a5d5e096be723a768d330ec3722fe1f659904f4842d834
-  data.tar.gz: c81deb6084edc784f72d1cda4189e651a4748a75af71d80ad15e942a4ca6bd497f5f3211930b3416bb0ea474577fe7481850226938a9b725d1933bcbec652031
+  metadata.gz: 89c27f2bd69320aef0d3a36207788478ce85e7eea4b1f722950ec12749fa3fdcaa5a3eed1f322b77425d5d8b8e1d848cf912d84cd55c7872fa2142750626b345
+  data.tar.gz: d125c6229d26da7d19794479091ec59b706e10166a70a5e3f228a4d3571906a5b3d3a3db23c81cfb2c735e56c91c9bdf1ee01f249689761641d46aad1319f8ff

data/lib/generators/test_unit/webauthn_authentication/templates/test/controllers/passkeys_controller_test.rb

@@ -7,7 +7,7 @@ class PasskeysControllerTest < ActionDispatch::IntegrationTest
     @client = WebAuthn::FakeClient.new(WebAuthn.configuration.allowed_origins.first)
   end
 
-  test "initiates Passkey creation when user is authenticated" do
+  test "create_options" do
     sign_in_as @user
     post create_options_passkeys_url
 
@@ -20,14 +20,14 @@ class PasskeysControllerTest < ActionDispatch::IntegrationTest
     assert_equal session[:current_registration][:challenge], body["challenge"]
   end
 
-  test "requires authentication to initiate Passkey creation" do
+  test "create_options unauthenticated" do
     post create_options_passkeys_url
 
     assert_response :redirect
     assert_redirected_to new_session_url
   end
 
-  test "creates passkey when user is authenticated" do
+  test "create" do
     sign_in_as @user
 
     post create_options_passkeys_url
@@ -52,7 +52,7 @@ class PasskeysControllerTest < ActionDispatch::IntegrationTest
     assert_nil session[:current_registration]
   end
 
-  test "does not create passkey when there is a Webauthn error" do
+  test "create with WebAuthn error" do
     sign_in_as @user
 
     post create_options_passkeys_url
@@ -77,34 +77,26 @@ class PasskeysControllerTest < ActionDispatch::IntegrationTest
     assert_nil session[:current_registration]
   end
 
-  test "requires authentication to create passkey" do
-    post passkeys_url, params: {
-      credential: {
-        nickname: "My Passkey",
-        public_key_credential: "{}"
-      }
-    }
+  test "create unauthenticated" do
+    post passkeys_url
 
     assert_response :redirect
     assert_redirected_to new_session_url
   end
 
-  test "deletes passkey when user is authenticated" do
-    2.times do |i|
-      WebauthnCredential.create!(
-        nickname: "My Passkey #{i}",
-        user: @user,
-        external_id: "external-id-#{i}",
-        public_key: "public-key-#{i}",
-        sign_count: 0,
-        authentication_factor: 0
-      )
-    end
+  test "destroy" do
+    credential = WebauthnCredential.passkey.create!(
+      nickname: "My Passkey",
+      user: @user,
+      external_id: "external-id",
+      public_key: "public-key",
+      sign_count: 0,
+    )
 
     sign_in_as @user
 
     assert_difference("WebauthnCredential.count", -1) do
-      delete passkey_url(@user.webauthn_credentials.first)
+      delete passkey_url(credential)
     end
     assert_redirected_to root_path
   end

data/lib/generators/test_unit/webauthn_authentication/templates/test/controllers/second_factor_authentications_controller_test.rb

@@ -0,0 +1,131 @@
+require "test_helper"
+require "webauthn/fake_client"
+
+class SecondFactorAuthenticationsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = users(:one)
+    @client = WebAuthn::FakeClient.new(WebAuthn.configuration.allowed_origins.first)
+
+    creation_options = WebAuthn::Credential.options_for_create(
+      user: { id: @user.webauthn_id, name: @user.email_address },
+      authenticator_selection: { resident_key: "discouraged", user_verification: "discouraged" }
+    )
+    create_options = @client.create(challenge: creation_options.challenge)
+    credential = WebAuthn::Credential.from_create(create_options)
+
+    WebauthnCredential.second_factor.create!(
+      nickname: "My Security Key",
+      user: @user,
+      external_id: credential.id,
+      public_key: credential.public_key,
+      sign_count: 0
+    )
+  end
+
+  test "get_options" do
+    post session_path, params: { email_address: @user.email_address, password: "password" }
+
+    post get_options_second_factor_authentication_url
+
+    assert_response :success
+    body = JSON.parse(response.body)
+    assert body["challenge"].present?
+    assert body["userVerification"] == "discouraged"
+
+    assert_equal session[:current_authentication][:challenge], body["challenge"]
+  end
+
+  test "create" do
+    post session_path, params: { email_address: @user.email_address, password: "password" }
+
+    post get_options_second_factor_authentication_url
+    challenge = session[:current_authentication][:challenge]
+
+    public_key_credential = @client.get(challenge: challenge, user_verified: false)
+
+    post second_factor_authentication_url, params: {
+      session: {
+        public_key_credential: public_key_credential.to_json
+      }
+    }
+
+    assert_redirected_to root_path
+    assert_nil session[:current_authentication]
+  end
+
+  test "create with a passkey" do
+    client = WebAuthn::FakeClient.new(WebAuthn.configuration.allowed_origins.first)
+
+    creation_options = WebAuthn::Credential.options_for_create(
+      user: { id: @user.webauthn_id, name: @user.email_address },
+      authenticator_selection: { resident_key: "discouraged", user_verification: "discouraged" }
+    )
+    create_options = client.create(challenge: creation_options.challenge)
+    credential = WebAuthn::Credential.from_create(create_options)
+
+
+    WebauthnCredential.passkey.create!(
+      nickname: "My Security Key",
+      user: @user,
+      external_id: credential.id,
+      public_key: credential.public_key,
+      sign_count: 0
+    )
+
+    post session_path, params: { email_address: @user.email_address, password: "password" }
+
+    post get_options_second_factor_authentication_url
+    challenge = session[:current_authentication][:challenge]
+
+    public_key_credential = client.get(challenge: challenge, user_verified: false)
+
+    post second_factor_authentication_url, params: {
+      session: {
+        public_key_credential: public_key_credential.to_json
+      }
+    }
+
+    assert_redirected_to root_path
+    assert_nil session[:current_authentication]
+  end
+
+  test "create with WebAuthn error" do
+    post session_path, params: { email_address: @user.email_address, password: "password" }
+
+    post get_options_second_factor_authentication_url
+
+    public_key_credential = @client.get(
+      user_verified: false
+    )
+
+    post second_factor_authentication_url, params: {
+      session: {
+        public_key_credential: public_key_credential.to_json
+      }
+    }
+
+    assert_redirected_to new_second_factor_authentication_path
+    assert_match (/Verification failed/), flash[:alert]
+    assert_nil session[:current_authentication]
+  end
+
+  test "create with unrecognized credential" do
+    post session_path, params: { email_address: @user.email_address, password: "password" }
+
+    post get_options_second_factor_authentication_url
+    challenge = session[:current_authentication][:challenge]
+
+    public_key_credential = @client.get(challenge: challenge, user_verified: false)
+    public_key_credential["id"]= "invalid-id"
+
+    post second_factor_authentication_url, params: {
+      session: {
+        public_key_credential: public_key_credential.to_json
+      }
+    }
+
+    assert_redirected_to new_second_factor_authentication_path
+    assert_match (/Credential not recognized/), flash[:alert]
+    assert_nil session[:current_authentication]
+  end
+end

data/lib/generators/test_unit/webauthn_authentication/templates/test/controllers/second_factor_webauthn_credentials_controller_test.rb

@@ -0,0 +1,103 @@
+require "test_helper"
+require "webauthn/fake_client"
+
+class SecondFactorWebauthnCredentialsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = users(:one)
+    @client = WebAuthn::FakeClient.new(WebAuthn.configuration.allowed_origins.first)
+  end
+
+  test "create_options" do
+    sign_in_as @user
+    post create_options_second_factor_webauthn_credentials_url
+
+    assert_response :success
+    body = JSON.parse(response.body)
+    assert body["challenge"].present?
+    assert body["authenticatorSelection"]["residentKey"] == "discouraged"
+    assert body["authenticatorSelection"]["userVerification"] == "discouraged"
+
+    assert_equal session[:current_registration][:challenge], body["challenge"]
+  end
+
+  test "create_options unauthenticated" do
+    post create_options_second_factor_webauthn_credentials_url
+
+    assert_response :redirect
+    assert_redirected_to new_session_url
+  end
+
+  test "create" do
+    sign_in_as @user
+
+    post create_options_second_factor_webauthn_credentials_url
+    challenge = session[:current_registration][:challenge]
+
+    public_key_credential = @client.create(
+      challenge: challenge,
+      user_verified: false,
+    )
+
+    assert_difference("WebauthnCredential.second_factor.count", 1) do
+      post second_factor_webauthn_credentials_url, params: {
+        credential: {
+          nickname: "My Security Key",
+          public_key_credential: public_key_credential.to_json
+        }
+      }
+    end
+
+    assert_redirected_to root_path
+    assert_match (/Security Key registered successfully/), flash[:notice]
+    assert_nil session[:current_registration]
+  end
+
+  test "create with WebAuthn error" do
+    sign_in_as @user
+
+    post create_options_second_factor_webauthn_credentials_url
+
+    public_key_credential = @client.create(
+      user_verified: false,
+    )
+
+    assert_no_difference("WebauthnCredential.count") do
+      post second_factor_webauthn_credentials_url, params: {
+        credential: {
+          nickname: "My Security Key",
+          public_key_credential: public_key_credential.to_json
+        }
+      }
+    end
+
+    assert_redirected_to new_second_factor_webauthn_credential_path
+    assert_match (/Verification failed/), flash[:alert]
+    assert_nil session[:current_registration]
+  end
+
+  test "create unauthenticated" do
+    post second_factor_webauthn_credentials_url
+
+    assert_response :redirect
+    assert_redirected_to new_session_url
+  end
+
+  test "destroy" do
+    credential = WebauthnCredential.second_factor.create!(
+      user: @user,
+      nickname: "My Security Key",
+      external_id: "external_id",
+      public_key: "public_key",
+      sign_count: 0
+    )
+
+    sign_in_as @user
+
+    assert_difference("WebauthnCredential.second_factor.count", -1) do
+      delete second_factor_webauthn_credential_url(credential)
+    end
+
+    assert_redirected_to root_path
+    assert_match (/Security Key deleted successfully/), flash[:notice]
+  end
+end

data/lib/generators/test_unit/webauthn_authentication/templates/test/controllers/webauthn_sessions_controller_test.rb

@@ -12,17 +12,16 @@ class WebauthnSessionsControllerTest < ActionDispatch::IntegrationTest
     create_options = @client.create(challenge: creation_options.challenge)
     credential = WebAuthn::Credential.from_create(create_options)
 
-    WebauthnCredential.create!(
+    WebauthnCredential.passkey.create!(
       nickname: "My Passkey",
       user: @user,
       external_id: credential.id,
       public_key: credential.public_key,
       sign_count: 0,
-      authentication_factor: 0
     )
   end
 
-  test "should return get_options" do
+  test "get_options" do
     post get_options_webauthn_session_url
 
     assert_response :success
@@ -33,7 +32,7 @@ class WebauthnSessionsControllerTest < ActionDispatch::IntegrationTest
     assert_equal session[:current_authentication][:challenge], body["challenge"]
   end
 
-  test "should create session with valid credential" do
+  test "create" do
     post get_options_webauthn_session_url
     challenge = session[:current_authentication][:challenge]
 
@@ -49,7 +48,7 @@ class WebauthnSessionsControllerTest < ActionDispatch::IntegrationTest
     assert_nil session[:current_authentication]
   end
 
-  test "should not create session when there is a Webauthn error" do
+  test "create with WebAuthn error" do
     post get_options_webauthn_session_url
     challenge = session[:current_authentication][:challenge]
 
@@ -66,7 +65,7 @@ class WebauthnSessionsControllerTest < ActionDispatch::IntegrationTest
     assert_nil session[:current_authentication]
   end
 
-  test "should not create session with unrecognized credential" do
+  test "create with unrecognized credential" do
     post get_options_webauthn_session_url
     challenge = session[:current_authentication][:challenge]
 
@@ -84,7 +83,7 @@ class WebauthnSessionsControllerTest < ActionDispatch::IntegrationTest
     assert_nil session[:current_authentication]
   end
 
-  test "should not create session with a second factor credential" do
+  test "create with a second factor credential" do
     client = WebAuthn::FakeClient.new(WebAuthn.configuration.allowed_origins.first)
 
     creation_options = WebAuthn::Credential.options_for_create(
@@ -93,13 +92,12 @@ class WebauthnSessionsControllerTest < ActionDispatch::IntegrationTest
     create_options = client.create(challenge: creation_options.challenge)
     credential = WebAuthn::Credential.from_create(create_options)
 
-    WebauthnCredential.create!(
+    WebauthnCredential.second_factor.create!(
       nickname: "Second Factor Key",
       user: @user,
       external_id: credential.id,
       public_key: credential.public_key,
       sign_count: 0,
-      authentication_factor: 1
     )
 
     post get_options_webauthn_session_url
@@ -118,7 +116,7 @@ class WebauthnSessionsControllerTest < ActionDispatch::IntegrationTest
     assert_nil session[:current_authentication]
   end
 
-  test "should destroy session" do
+  test "destroy" do
     delete webauthn_session_url
     assert_redirected_to new_session_path
   end

data/lib/generators/test_unit/webauthn_authentication/webauthn_authentication_generator.rb

@@ -9,6 +9,8 @@ module TestUnit
       def create_controller_test_files
         template "test/controllers/passkeys_controller_test.rb"
         template "test/controllers/webauthn_sessions_controller_test.rb"
+        template "test/controllers/second_factor_authentications_controller_test.rb"
+        template "test/controllers/second_factor_webauthn_credentials_controller_test.rb"
       end
 
       def create_system_test_files

data/lib/generators/webauthn_authentication/templates/app/controllers/second_factor_authentications_controller.rb

@@ -35,9 +35,9 @@ class SecondFactorAuthenticationsController < ApplicationController
       redirect_to after_authentication_url
     rescue WebAuthn::Error => e
       redirect_to new_second_factor_authentication_path, alert: "Verification failed: #{e.message}"
-    ensure
-      session.delete(:current_authentication)
     end
+  ensure
+    session.delete(:current_authentication)
   end
 
   private
@@ -57,6 +57,6 @@ class SecondFactorAuthenticationsController < ApplicationController
   end
 
   def current_authentication_user_id
-    session[:current_authentication][:user_id] || session[:current_authentication]["user_id"]
+    session.dig(:current_authentication, :user_id) || session.dig(:current_authentication, "user_id")
   end
 end

data/lib/generators/webauthn_authentication/templates/app/controllers/second_factor_webauthn_credentials_controller.rb

@@ -40,9 +40,9 @@ class SecondFactorWebauthnCredentialsController < ApplicationController
       end
     rescue WebAuthn::Error => e
       redirect_to new_second_factor_webauthn_credential_path, alert: "Verification failed: #{e.message}"
-    ensure
-      session.delete(:current_registration)
     end
+  ensure
+    session.delete(:current_registration)
   end
 
   def destroy

data/lib/generators/webauthn_authentication/webauthn_authentication_generator.rb

@@ -8,7 +8,11 @@ end
 
 class WebauthnAuthenticationGenerator < ::Rails::Generators::Base
   include ActiveRecord::Generators::Migration
-  include BundleHelper
+  if Rails.version >= "8.1"
+    include Rails::Generators::BundleHelper
+  else
+    include BundleHelper
+  end
 
   source_root File.expand_path("../templates", __FILE__)
 
@@ -54,9 +58,7 @@ class WebauthnAuthenticationGenerator < ::Rails::Generators::Base
         <<-RUBY.strip_heredoc.indent(4)
 
           def require_no_authentication
-            if Current.user
-              redirect_to root_path
-            end
+            redirect_to root_path if find_session_by_cookie
           end
         RUBY
       end

data/lib/webauthn/rails/version.rb

@@ -1,5 +1,5 @@
 module Webauthn
   module Rails
-    VERSION = "0.1.0"
+    VERSION = "0.1.1"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: webauthn-rails
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Cedarcode
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2025-09-26 00:00:00.000000000 Z
+date: 2025-10-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -41,6 +41,8 @@ files:
 - lib/generators/erb/webauthn_authentication/templates/app/views/second_factor_webauthn_credentials/new.html.erb.tt
 - lib/generators/erb/webauthn_authentication/webauthn_authentication_generator.rb
 - lib/generators/test_unit/webauthn_authentication/templates/test/controllers/passkeys_controller_test.rb
+- lib/generators/test_unit/webauthn_authentication/templates/test/controllers/second_factor_authentications_controller_test.rb
+- lib/generators/test_unit/webauthn_authentication/templates/test/controllers/second_factor_webauthn_credentials_controller_test.rb
 - lib/generators/test_unit/webauthn_authentication/templates/test/controllers/webauthn_sessions_controller_test.rb
 - lib/generators/test_unit/webauthn_authentication/templates/test/system/manage_webauthn_credentials_test.rb
 - lib/generators/test_unit/webauthn_authentication/templates/test/test_helpers/virtual_authenticator_test_helper.rb