heapsource / active_model_otp

Adds methods to set and authenticate against one time passwords (Two-Factor Authentication). Inspired in AM::SecurePassword
MIT License
769 stars 81 forks source link

otp code broke after the gems update #48

Closed vtm9 closed 3 years ago

vtm9 commented 5 years ago

user.otp_code raises error ArgumentError: wrong number of arguments (given 2, expected 1)

gemfile lock GEM remote: https://rubygems.org/ specs: actioncable (5.2.1.1) actionpack (= 5.2.1.1) nio4r (~> 2.0) websocket-driver (>= 0.6.1) actionmailer (5.2.1.1) actionpack (= 5.2.1.1) actionview (= 5.2.1.1) activejob (= 5.2.1.1) mail (~> 2.5, >= 2.5.4) rails-dom-testing (~> 2.0) actionpack (5.2.1.1) actionview (= 5.2.1.1) activesupport (= 5.2.1.1) rack (~> 2.0) rack-test (>= 0.6.3) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.0.2) actionview (5.2.1.1) activesupport (= 5.2.1.1) builder (~> 3.1) erubi (~> 1.4) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.0.3) active_hash (2.2.0) activesupport (>= 5.0.0) active_model_otp (1.2.0) activemodel rotp activejob (5.2.1.1) activesupport (= 5.2.1.1) globalid (>= 0.3.6) activemodel (5.2.1.1) activesupport (= 5.2.1.1) activemodel-serializers-xml (1.0.2) activemodel (> 5.x) activesupport (> 5.x) builder (~> 3.1) activerecord (5.2.1.1) activemodel (= 5.2.1.1) activesupport (= 5.2.1.1) arel (>= 9.0) activestorage (5.2.1.1) actionpack (= 5.2.1.1) activerecord (= 5.2.1.1) marcel (~> 0.3.1) activesupport (5.2.1.1) concurrent-ruby (~> 1.0, >= 1.0.2) i18n (>= 0.7, < 2) minitest (~> 5.1) tzinfo (~> 1.1) addressable (2.5.2) public_suffix (>= 2.0.2, < 4.0) adequate_crypto_address (0.1.3) base58 (~> 0.2.3) digest-sha3 (~> 1.1.0) arel (9.0.0) ast (2.4.0) awesome_print (1.8.0) aws-eventstream (1.0.1) aws-partitions (1.118.0) aws-sdk-core (3.41.0) aws-eventstream (~> 1.0) aws-partitions (~> 1.0) aws-sigv4 (~> 1.0) jmespath (~> 1.0) aws-sdk-kms (1.13.0) aws-sdk-core (~> 3, >= 3.39.0) aws-sigv4 (~> 1.0) aws-sdk-s3 (1.27.0) aws-sdk-core (~> 3, >= 3.39.0) aws-sdk-kms (~> 1) aws-sigv4 (~> 1.0) aws-sdk-sns (1.9.0) aws-sdk-core (~> 3, >= 3.39.0) aws-sigv4 (~> 1.0) aws-sdk-sqs (1.10.0) aws-sdk-core (~> 3, >= 3.39.0) aws-sigv4 (~> 1.0) aws-sigv4 (1.0.3) base58 (0.2.3) bcrypt (3.1.12) bindex (0.5.0) bootsnap (1.3.2) msgpack (~> 1.0) brakeman (4.3.1) browser (2.5.3) builder (3.2.3) bundler-audit (0.6.0) bundler (~> 1.2) thor (~> 0.18) byebug (10.0.2) capybara (2.18.0) addressable mini_mime (>= 0.1.3) nokogiri (>= 1.3.3) rack (>= 1.0.0) rack-test (>= 0.5.4) xpath (>= 2.0, < 4.0) chartkick (3.0.1) chunky_png (1.3.11) cocoon (1.2.12) coderay (1.1.2) concurrent-ruby (1.1.3) config (1.7.0) activesupport (>= 3.0) deep_merge (~> 1.2.1) dry-validation (>= 0.10.4) countries (2.1.4) i18n_data (~> 0.8.0) money (~> 6.9) sixarm_ruby_unaccent (~> 1.1) unicode_utils (~> 1.4) country_select (3.1.1) countries (~> 2.0) sort_alphabetical (~> 1.0) crack (0.4.3) safe_yaml (~> 1.0.0) crass (1.0.4) daemons (1.2.6) data_migrate (5.2.0) rails (>= 4.2) deep_merge (1.2.1) diff-lcs (1.3) digest-sha3 (1.1.0) domain_name (0.5.20180417) unf (>= 0.0.5, < 1.0.0) dotenv (2.5.0) dotenv-rails (2.5.0) dotenv (= 2.5.0) railties (>= 3.2, < 6.0) down (4.7.0) addressable (~> 2.5) draper (3.0.1) actionpack (~> 5.0) activemodel (~> 5.0) activemodel-serializers-xml (~> 1.0) activesupport (~> 5.0) request_store (~> 1.0) dry-configurable (0.7.0) concurrent-ruby (~> 1.0) dry-container (0.6.0) concurrent-ruby (~> 1.0) dry-configurable (~> 0.1, >= 0.1.3) dry-core (0.4.7) concurrent-ruby (~> 1.0) dry-equalizer (0.2.1) dry-inflector (0.1.2) dry-logic (0.4.2) dry-container (~> 0.2, >= 0.2.6) dry-core (~> 0.2) dry-equalizer (~> 0.2) dry-monads (1.1.0) concurrent-ruby (~> 1.0) dry-core (~> 0.4, >= 0.4.4) dry-equalizer dry-types (0.13.3) concurrent-ruby (~> 1.0) dry-container (~> 0.3) dry-core (~> 0.4, >= 0.4.4) dry-equalizer (~> 0.2) dry-inflector (~> 0.1, >= 0.1.2) dry-logic (~> 0.4, >= 0.4.2) dry-validation (0.12.2) concurrent-ruby (~> 1.0) dry-configurable (~> 0.1, >= 0.1.3) dry-core (~> 0.2, >= 0.2.1) dry-equalizer (~> 0.2) dry-logic (~> 0.4, >= 0.4.0) dry-types (~> 0.13.1) enumerize (2.2.2) activesupport (>= 3.2) erubi (1.7.1) eventmachine (1.2.7) execjs (2.7.0) faker (1.9.1) i18n (>= 0.7) ffi (1.9.25) file_validators (2.3.0) activemodel (>= 3.2) mime-types (>= 1.0) flamegraph (0.9.5) font-awesome-rails (4.7.0.4) railties (>= 3.2, < 6.0) globalid (0.4.1) activesupport (>= 4.2.0) gon (6.2.1) actionpack (>= 3.0) multi_json request_store (>= 1.0) groupdate (4.1.0) activesupport (>= 4.2) haml (5.0.4) temple (>= 0.8.0) tilt hashdiff (0.3.7) high_voltage (3.1.0) highline (2.0.0) http (4.0.0) addressable (~> 2.3) http-cookie (~> 1.0) http-form_data (~> 2.0) http_parser.rb (~> 0.6.0) http-cookie (1.0.3) domain_name (~> 0.5) http-form_data (2.1.1) http_parser.rb (0.6.0) httparty (0.16.3) mime-types (~> 3.0) multi_xml (>= 0.5.2) i18n (1.1.1) concurrent-ruby (~> 1.0) i18n-js (3.2.0) i18n (>= 0.8.0, < 2) i18n-tasks (0.9.28) activesupport (>= 4.0.2) ast (>= 2.1.0) erubi highline (>= 2.0.0) i18n parser (>= 2.2.3.0) rails-i18n rainbow (>= 2.2.2, < 4.0) terminal-table (>= 1.5.1) i18n_data (0.8.0) jaro_winkler (1.5.1) jbuilder (2.8.0) activesupport (>= 4.2.0) multi_json (>= 1.2) jmespath (1.4.0) jquery-rails (4.3.3) rails-dom-testing (>= 1, < 3) railties (>= 4.2.0) thor (>= 0.14, < 2.0) json (2.1.0) jwt (2.1.0) kaminari (1.1.1) activesupport (>= 4.1.0) kaminari-actionview (= 1.1.1) kaminari-activerecord (= 1.1.1) kaminari-core (= 1.1.1) kaminari-actionview (1.1.1) actionview kaminari-core (= 1.1.1) kaminari-activerecord (1.1.1) activerecord kaminari-core (= 1.1.1) kaminari-core (1.1.1) listen (3.1.5) rb-fsevent (~> 0.9, >= 0.9.4) rb-inotify (~> 0.9, >= 0.9.7) ruby_dep (~> 1.2) lograge (0.10.0) actionpack (>= 4) activesupport (>= 4) railties (>= 4) request_store (~> 1.0) loofah (2.2.3) crass (~> 1.0.2) nokogiri (>= 1.5.9) mail (2.7.1) mini_mime (>= 0.1.1) mailcatcher (0.2.4) eventmachine haml i18n json mail sinatra skinny (>= 0.1.2) sqlite3-ruby thin mailgun-ruby (1.1.11) rest-client (~> 2.0.2) marcel (0.3.3) mimemagic (~> 0.3.2) memory_profiler (0.9.12) method_source (0.9.2) mime-types (3.2.2) mime-types-data (~> 3.2015) mime-types-data (3.2018.0812) mimemagic (0.3.2) mini_mime (1.0.1) mini_portile2 (2.3.0) minitest (5.11.3) minitest-power_assert (0.3.0) minitest power_assert (>= 1.1) minitest-profile (0.0.2) money (6.13.1) i18n (>= 0.6.4, <= 2) msgpack (1.2.4) multi_json (1.13.1) multi_xml (0.6.0) mustermann (1.0.3) netrc (0.11.0) nigilist (0.1.0) nio4r (2.3.1) nokogiri (1.8.5) mini_portile2 (~> 2.3.0) oj (3.7.1) parallel (1.12.1) parser (2.5.3.0) ast (~> 2.4.0) pg (1.1.3) phony (2.16.8) phony_rails (0.14.11) activesupport (>= 3.0) phony (> 2.15) power_assert (1.1.3) powerpack (0.1.2) pry (0.12.2) coderay (~> 1.1.0) method_source (~> 0.9.0) pry-byebug (3.6.0) byebug (~> 10.0) pry (~> 0.10) pry-rails (0.3.7) pry (>= 0.10.4) public_suffix (3.0.3) puma (3.12.0) rack (2.0.6) rack-mini-profiler (1.0.0) rack (>= 1.2.0) rack-protection (2.0.4) rack rack-proxy (0.6.5) rack rack-test (1.1.0) rack (>= 1.0, < 3) rails (5.2.1.1) actioncable (= 5.2.1.1) actionmailer (= 5.2.1.1) actionpack (= 5.2.1.1) actionview (= 5.2.1.1) activejob (= 5.2.1.1) activemodel (= 5.2.1.1) activerecord (= 5.2.1.1) activestorage (= 5.2.1.1) activesupport (= 5.2.1.1) bundler (>= 1.3.0) railties (= 5.2.1.1) sprockets-rails (>= 2.0.0) rails-dom-testing (2.0.3) activesupport (>= 4.2.0) nokogiri (>= 1.6) rails-html-sanitizer (1.0.4) loofah (~> 2.2, >= 2.2.2) rails-i18n (5.1.2) i18n (>= 0.7, < 2) railties (>= 5.0, < 6) railties (5.2.1.1) actionpack (= 5.2.1.1) activesupport (= 5.2.1.1) method_source rake (>= 0.8.7) thor (>= 0.19.0, < 2.0) rainbow (3.0.0) rake (12.3.1) ransack (2.1.0) actionpack (>= 5.0) activerecord (>= 5.0) activesupport (>= 5.0) i18n rb-fsevent (0.10.3) rb-inotify (0.9.10) ffi (>= 0.5.0, < 2) recaptcha (4.13.0) json request_store (1.4.1) rack (>= 1.4) rest-client (2.0.2) http-cookie (>= 1.0.2, < 2.0) mime-types (>= 1.16, < 4.0) netrc (~> 0.8) rollbar (2.18.0) multi_json rotp (4.0.2) addressable (~> 2.5) rqrcode (0.10.1) chunky_png (~> 1.0) rspec-mocks (3.8.0) diff-lcs (>= 1.2.0, < 2.0) rspec-support (~> 3.8.0) rspec-support (3.8.0) rubocop (0.60.0) jaro_winkler (~> 1.5.1) parallel (~> 1.10) parser (>= 2.5, != 2.5.1.1) powerpack (~> 0.1) rainbow (>= 2.2.2, < 4.0) ruby-progressbar (~> 1.7) unicode-display_width (~> 1.4.0) ruby-progressbar (1.10.0) ruby_dep (1.5.0) safe_yaml (1.0.4) sassc (2.0.0) ffi (~> 1.9.6) rake sassc-rails (2.0.0) railties (>= 4.0.0) sassc (>= 2.0) sprockets (> 3.0) sprockets-rails tilt shoryuken (4.0.2) aws-sdk-core (>= 2) concurrent-ruby thor shrine (2.13.0) down (~> 4.1) shrine-memory (0.3.0) shrine (~> 2.2) simple_form (4.1.0) actionpack (>= 5.0) activemodel (>= 5.0) sinatra (2.0.4) mustermann (~> 1.0) rack (~> 2.0) rack-protection (= 2.0.4) tilt (~> 2.0) sixarm_ruby_unaccent (1.2.0) skinny (0.2.2) eventmachine (~> 1.0) thin slack-notifier (2.3.2) slim (4.0.1) temple (>= 0.7.6, < 0.9) tilt (>= 2.0.6, < 2.1) slim-rails (3.2.0) actionpack (>= 3.1) railties (>= 3.1) slim (>= 3.0, < 5.0) sort_alphabetical (1.1.0) unicode_utils (>= 1.2.2) spring (2.0.2) activesupport (>= 4.2) spring-watcher-listen (2.0.1) listen (>= 2.7, < 4.0) spring (>= 1.2, < 3.0) sprockets (3.7.2) concurrent-ruby (~> 1.0) rack (> 1, < 3) sprockets-rails (3.2.1) actionpack (>= 4.0) activesupport (>= 4.0) sprockets (>= 3.0.0) sqlite3 (1.3.13) sqlite3-ruby (1.3.3) sqlite3 (>= 1.3.3) stackprof (0.2.12) state_machines (0.5.0) state_machines-activemodel (0.5.1) activemodel (>= 4.1, < 6.0) state_machines (>= 0.5.0) state_machines-activerecord (0.5.2) activerecord (>= 4.1, < 6.0) state_machines-activemodel (>= 0.5.0) temple (0.8.0) terminal-table (1.8.0) unicode-display_width (~> 1.1, >= 1.1.1) thin (1.7.2) daemons (~> 1.0, >= 1.0.9) eventmachine (~> 1.0, >= 1.0.4) rack (>= 1, < 3) thor (0.20.3) thread_safe (0.3.6) tilt (2.0.8) timecop (0.9.1) tzinfo (1.2.5) thread_safe (~> 0.1) uglifier (4.1.20) execjs (>= 0.3.0, < 3) unf (0.1.4) unf_ext unf_ext (0.0.7.5) unicode-display_width (1.4.0) unicode_utils (1.4.0) web-console (3.7.0) actionview (>= 5.0) activemodel (>= 5.0) bindex (>= 0.4.0) railties (>= 5.0) webdack-uuid_migration (1.2.0) activerecord (>= 4.0) webmock (3.4.2) addressable (>= 2.3.6) crack (>= 0.3.2) hashdiff webpacker (3.5.5) activesupport (>= 4.2) rack-proxy (>= 0.6.1) railties (>= 4.2) websocket-driver (0.7.0) websocket-extensions (>= 0.1.0) websocket-extensions (0.1.3) wicked_pdf (1.1.0) wkhtmltopdf-binary (0.12.4) xpath (3.2.0) nokogiri (~> 1.8) zonebie (0.6.1)

PLATFORMS ruby

DEPENDENCIES active_hash active_model_otp adequate_crypto_address awesome_print aws-sdk-s3 aws-sdk-sns aws-sdk-sqs bcrypt (~> 3.1.7) bootsnap (>= 1.1.0) brakeman browser bundler-audit byebug capybara (~> 2.13) chartkick cocoon config country_select data_migrate dotenv-rails draper dry-container dry-monads enumerize faker file_validators flamegraph font-awesome-rails gon groupdate high_voltage http httparty i18n-js i18n-tasks (~> 0.9.28) jbuilder (~> 2.5) jquery-rails jwt kaminari listen (>= 3.0.5, < 3.2) lograge mailcatcher mailgun-ruby (~> 1.1.6) memory_profiler minitest-power_assert minitest-profile money nigilist oj pg phony_rails pry-byebug pry-rails puma (~> 3.7) rack-mini-profiler rails (~> 5.2.1) ransack recaptcha rollbar rqrcode rspec-mocks rubocop sassc-rails shoryuken shrine (~> 2.0) shrine-memory simple_form (~> 4.0) slack-notifier slim-rails spring spring-watcher-listen stackprof state_machines state_machines-activerecord timecop tzinfo-data uglifier (>= 1.3.0) web-console (>= 3.3.0) webdack-uuid_migration webmock webpacker wicked_pdf wkhtmltopdf-binary zonebie

RUBY VERSION ruby 2.5.3p105

BUNDLED WITH 1.16.6

kiramclean commented 5 years ago

We're experiencing this, too, since upgrading to rails 5.2.1.1 because of a security vulnerability. The error appears to be coming from the rotp gem..

ArgumentError: wrong number of arguments (given 2, expected 1)
from /Users/kmclean/.rbenv/versions/2.5.1/lib/ruby/gems/2.5.0/gems/rotp-4.0.2/lib/rotp/totp.rb:17:in `at'

One solution might be to require a version of that gem that's compatible with this library.

grumpy commented 5 years ago

The latest commit to master fixes this for me. It isn't tagged with a new version, so I had to delete my gem cache to get it to update with the latest and install from git as well.

@guilleiguaran, thanks for the fix. I do have one issue with it that is giving me frequent log in failures. Drift now only applies to drift_behind, so it only adds padding to clocks being out of sync in one direction. It would work more reliably for me if it applied to drift_ahead as well, or provided a way to set both drift values.

grumpy commented 5 years ago

The other thing that worked for me was to explicitly specify the version of rotp to use to force it to a version that the published gem is compatible with by adding the following line to my Gemfile gem 'rotp', '~> 3.3.0'

kvandake commented 5 years ago

The latest commit to master fixes this for me. It isn't tagged with a new version, so I had to delete my gem cache to get it to update with the latest and install from git as well.

@guilleiguaran, thanks for the fix. I do have one issue with it that is giving me frequent log in failures. Drift now only applies to drift_behind, so it only adds padding to clocks being out of sync in one direction. It would work more reliably for me if it applied to drift_ahead as well, or provided a way to set both drift values.

Will the gem be updated in rubygems?

buncis commented 5 years ago

ruby 2.5.3 rails 5.2.2

to make it work the workaround is this

Gemfile

gem 'active_model_otp', :git => 'https://github.com/heapsource/active_model_otp.git'
gem 'rotp', '~> 3.3.1'

rotp has broken changes from version 3 to 4 using latest rotp only make authenticate_otp returning nil

idk if this gem is suitable for production though and if you doubt you can straight use the rotp gem since this gem is just an active record wrapper of it

====================

then I got another issue NoMethodError (undefined methodto_i' for {:drift_behind=>60}:Hash)` when using authenticate with drift

I think this gem is broken

prvinuch commented 5 years ago

I'm also getting this error... is it still an issue?

shlima commented 5 years ago

Only master branch works for me

gem 'active_model_otp', github: 'heapsource/active_model_otp'
prvinuch commented 5 years ago

I'm getting error in authenticate_otp, noMethodError for "verify_with_drift" .

what is the best way to resolve this error. kindly help.

shlima commented 5 years ago

@prvinuch @vtm9 please try 2.0 version

pedrofurtado commented 3 years ago

Is this still occuring in latest stable version (v2.1.1 at this moment)?