Class: SessionsController

Inherits:
Devise::SessionsController
  • Object
show all
Defined in:
app/controllers/sessions_controller.rb

Overview

Copyright © 2010-2011, Diaspora Inc. This file is

licensed under the Affero General Public License version 3 or later.  See
the COPYRIGHT file.

Instance Method Summary collapse

Instance Method Details

#authenticate_with_2faObject


20
21
22
23
24
25
26
27
28
29
30
31
# File 'app/controllers/sessions_controller.rb', line 20

def authenticate_with_2fa
  self.resource = find_user

  return true unless resource&.otp_required_for_login?

  if params[:user][:otp_attempt].present? && session[:otp_user_id]
    authenticate_with_two_factor_via_otp(resource)
  else
    strategy = Warden::Strategies[:database_authenticatable].new(warden.env, :user)
    prompt_for_two_factor(strategy.user) if strategy.valid? && strategy._run!.successful?
  end
end

#authenticate_with_two_factor_via_otp(user) ⇒ Object


40
41
42
43
44
45
46
47
48
# File 'app/controllers/sessions_controller.rb', line 40

def authenticate_with_two_factor_via_otp(user)
  if valid_otp_attempt?(user)
    session.delete(:otp_user_id)
    (user)
  else
    flash.now[:alert] = "Invalid token"
    prompt_for_two_factor(user)
  end
end

#find_userObject

rubocop:enable Rails/LexicallyScopedActionFilter


14
15
16
17
18
# File 'app/controllers/sessions_controller.rb', line 14

def find_user
  return User.find_for_authentication(username: params[:user][:username]) if params[:user][:username]

  User.find(session[:otp_user_id]) if session[:otp_user_id]
end

#prompt_for_two_factor(user) ⇒ Object


50
51
52
53
# File 'app/controllers/sessions_controller.rb', line 50

def prompt_for_two_factor(user)
  session[:otp_user_id] = user.id
  render :two_factor
end

#reset_authentication_tokenObject


55
56
57
# File 'app/controllers/sessions_controller.rb', line 55

def reset_authentication_token
  current_user&.reset_authentication_token!
end

#valid_otp_attempt?(user) ⇒ Boolean

Returns:

  • (Boolean)

33
34
35
36
37
38
# File 'app/controllers/sessions_controller.rb', line 33

def valid_otp_attempt?(user)
  user.validate_and_consume_otp!(params[:user][:otp_attempt]) ||
    user.invalidate_otp_backup_code!(params[:user][:otp_attempt])
rescue OpenSSL::Cipher::CipherError => _error
  false
end