Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Implement Two Factor Authentication #147

Merged
merged 27 commits into from Oct 23, 2020
Merged

Implement Two Factor Authentication #147

merged 27 commits into from Oct 23, 2020

Conversation

raccube
Copy link
Contributor

@raccube raccube commented Oct 18, 2020 •
edited

Closes #84

@raccube raccube marked this pull request as draft October 18, 2020 08:54
@raccube
Fix OTP auth triggering for users who haven't set it up
25410e1 
I thought I could be clever by using a null secret key as an indicator of it being disabled
@raccube
Fix detaching, improve UI for attaching 2FA
4ce5dfc
@raccube
Copy link
Contributor Author

raccube commented Oct 18, 2020

image
Setup UI

@codecov
Copy link

codecov bot commented Oct 19, 2020 •
edited

Codecov Report

Merging #147 into master will increase coverage by 0.58%.
The diff coverage is 80.00%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master     #147      +/-   ##
==========================================
+ Coverage   56.61%   57.19%   +0.58%     
==========================================
  Files          85       86       +1     
  Lines        1957     2007      +50     
==========================================
+ Hits         1108     1148      +40     
- Misses        849      859      +10
Impacted Files Coverage Δ
app/controllers/user/sessions_controller.rb 69.23% <69.23%> (ø)
app/controllers/user_controller.rb 38.93% <90.00%> (+10.98%) ⬆️
app/models/user.rb 75.57% <100.00%> (+0.76%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d9cc9da...d20f527. Read the comment docs.

@raccube raccube marked this pull request as ready for review October 21, 2020 14:53
nilsding
nilsding requested changes Oct 23, 2020
View reviewed changes
app/controllers/user/sessions_controller.rb Outdated Show resolved Hide resolved
app/controllers/user/sessions_controller.rb Outdated Show resolved Hide resolved
app/controllers/user/sessions_controller.rb Outdated Show resolved Hide resolved
app/controllers/user/sessions_controller.rb Outdated Show resolved Hide resolved
app/controllers/user/sessions_controller.rb Outdated Show resolved Hide resolved
app/views/settings/security/_totp_setup.haml Outdated Show resolved Hide resolved
db/migrate/20201001172537_add_otp_secret_key_to_users.rb Outdated Show resolved Hide resolved
spec/controllers/user/sessions_controller_spec.rb Outdated Show resolved Hide resolved
nilsding
nilsding requested changes Oct 23, 2020
View reviewed changes
app/controllers/user/sessions_controller.rb Outdated Show resolved Hide resolved
config/routes.rb Outdated Show resolved Hide resolved
@raccube
Copy link
Contributor Author

raccube commented Oct 23, 2020

TOTP Setup screenshots

Desktop:
image
Mobile:
image
Tablet:
image
Tablet (portrait):
image

pixeldesu
pixeldesu approved these changes Oct 23, 2020
View reviewed changes
Copy link
Member

@pixeldesu pixeldesu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generally, superb execution on the frontend side, nothing I feel I have to complain about, looking over it. Layout seems fine too.

The fact that the QR code adapts to the theme is awesome, but I fear that might cause it to become unreadable with certain themes, especially lighter ones, doesn't it? Generally not much of a problem, and we still can add a disclaimer later on.

nilsding
nilsding reviewed Oct 23, 2020
View reviewed changes
config/justask.yml.example
@@ -68,3 +68,6 @@ hcaptcha:
enabled: false
site_key: ''
secret_key: ''

# TOTP Drift period in seconds
otp_drift_period: 30
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

change deployed

@raccube raccube merged commit ab03fad into master Oct 23, 2020
@raccube raccube deleted the feature/2fa branch October 23, 2020 22:30
@raccube
Copy link
Contributor Author

raccube commented Oct 23, 2020

Won't do another deployment until recovery codes are implemented.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@pixeldesu pixeldesu pixeldesu approved these changes

@nilsding nilsding nilsding approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Implement 2FA
3 participants
@raccube @pixeldesu @nilsding