Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix Issue with Invalid Token Message | Simplify OTP Credentials Controller #95

Merged
merged 4 commits into from
Sep 21, 2024
Merged

Fix Issue with Invalid Token Message | Simplify OTP Credentials Controller #95

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
454c6ad
add support for :now option to "otp_set_flash_message" method (follow…
strouptl Sep 19, 2024
193978c
update flash message for invalid token to render immediately within "…
strouptl Sep 19, 2024
a883aaa
update test specs to ensure correct display of blank/invalid token fl…
strouptl Sep 19, 2024
61bc8bc
update both blank and invalid OTP authentication attempts to render :…
strouptl Sep 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 3 additions & 5 deletions app/controllers/devise_otp/devise/otp_credentials_controller.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,17 +26,15 @@ def show
# signs the resource in, if the OTP token is valid and the user has a valid challenge
#
def update
if @token.blank?
otp_set_flash_message(:alert, :token_blank)
redirect_to otp_credential_path_for(resource_name, challenge: @challenge, recovery: @recovery)
elsif resource.otp_challenge_valid? && resource.validate_otp_token(@token, @recovery)
if resource.otp_challenge_valid? && resource.validate_otp_token(@token, @recovery)
sign_in(resource_name, resource)

otp_set_trusted_device_for(resource) if params[:enable_persistence] == "true"
otp_refresh_credentials_for(resource)
respond_with resource, location: after_sign_in_path_for(resource)
else
otp_set_flash_message :alert, :token_invalid
kind = (@token.blank? ? :token_blank : :token_invalid)
otp_set_flash_message :alert, kind, :now => true
render :show
end
end
Expand Down
9 changes: 8 additions & 1 deletion lib/devise_otp_authenticatable/controllers/helpers.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,14 @@ def otp_set_flash_message(key, kind, options = {})
options[:resource_name] = resource_name
options = devise_i18n_options(options) if respond_to?(:devise_i18n_options, true)
message = I18n.t("#{options[:resource_name]}.#{kind}", **options)
flash[key] = message if message.present?

if message.present?
if options[:now]
flash.now[key] = message
else
flash[key] = message
end
end
end

def otp_t
Expand Down
8 changes: 7 additions & 1 deletion test/dummy/app/views/layouts/application.html.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,13 @@
</head>
<body>

<%= yield %>
<% if flash[:alert].present? %>
<div id="alert">
<%= flash[:alert] %>
</div>
<% end %>

<%= yield %>

</body>
</html>
30 changes: 30 additions & 0 deletions test/integration/sign_in_test.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ def teardown
click_button "Submit Token"

assert_equal user_otp_credential_path, current_path
assert page.has_content? "The token you provided was invalid."
end

test "fail blank token authentication" do
Expand All @@ -53,6 +54,7 @@ def teardown
click_button "Submit Token"

assert_equal user_otp_credential_path, current_path
assert page.has_content? "You need to type in the token you generated with your device."
end

test "successful token authentication" do
Expand All @@ -78,4 +80,32 @@ def teardown
User.otp_authentication_timeout = old_timeout
assert_equal new_user_session_path, current_path
end

test "blank token flash message does not persist to successful authentication redirect." do
user = enable_otp_and_sign_in

fill_in "token", with: "123456"
click_button "Submit Token"

assert page.has_content?("The token you provided was invalid.")

fill_in "token", with: ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
click_button "Submit Token"

assert !page.has_content?("The token you provided was invalid.")
end

test "invalid token flash message does not persist to successful authentication redirect." do
user = enable_otp_and_sign_in

fill_in "token", with: ""
click_button "Submit Token"

assert page.has_content?("You need to type in the token you generated with your device.")

fill_in "token", with: ROTP::TOTP.new(user.otp_auth_secret).at(Time.now)
click_button "Submit Token"

assert !page.has_content?("You need to type in the token you generated with your device.")
end
end