Class: DeviseOtp::Devise::OtpCredentialsController

Inherits:
DeviseController
  • Object
show all
Includes:
Devise::Controllers::Rememberable
Defined in:
app/controllers/devise_otp/devise/otp_credentials_controller.rb

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.controller_path ⇒ Object 



131
132
133
 
# File 'app/controllers/devise_otp/devise/otp_credentials_controller.rb', line 131

def self.controller_path
  "#{::Devise.otp_controller_path}/otp_credentials"
end

Instance Method Details

#get_refresh ⇒ Object

displays the request for a credentials refresh



62
63
64
65
 
# File 'app/controllers/devise_otp/devise/otp_credentials_controller.rb', line 62

def get_refresh
  ensure_resource!
  render :refresh
end

#set_refresh ⇒ Object

lets the user through is the refresh is valid



70
71
72
73
74
75
76
77
78
 
# File 'app/controllers/devise_otp/devise/otp_credentials_controller.rb', line 70

def set_refresh
  ensure_resource!

  if resource.valid_password?(params[resource_name][:refresh_password])
    done_valid_refresh
  else
    failed_refresh
  end
end

#show ⇒ Object

show a request for the OTP token



19
20
21
22
23
24
25
 
# File 'app/controllers/devise_otp/devise/otp_credentials_controller.rb', line 19

def show
  if @recovery
    @recovery_count = resource.otp_recovery_counter
  end

  render :show
end

#update ⇒ Object

signs the resource in, if the OTP token is valid and the user has a valid challenge



30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
 
# File 'app/controllers/devise_otp/devise/otp_credentials_controller.rb', line 30

def update
  # The valid_for_authentication? method must be executed with the validation result as
  # a block (as the DatabaseAuthenticatable strategy does via the validate method of the
  # Authenticatable strategy). If true, and the account is not locked, then
  # authentication will proceed as normal. If false, then the valid_for_authentication?
  # method will increment the failed attempts and/or lock the account as specified.

  if resource.valid_for_authentication? { resource.validate_otp_token(@token, @recovery) }
    (resource_name, resource)

    remember_me(resource) if resource.devise_modules.include?(:rememberable) and @remember_me
    otp_refresh_credentials_for(resource)
    respond_with resource, location: (resource)
  elsif resource.devise_modules.include?(:lockable) and resource.access_locked?
    otp_set_flash_message :alert, resource.unauthenticated_message, scope: "devise.failure"
    redirect_to new_session_path(resource_name)
  else
    if resource.devise_modules.include?(:lockable) and resource.unauthenticated_message == :last_attempt
      otp_set_flash_message :alert, :last_attempt, scope: "devise.failure", now: true
    elsif @token.blank?
      otp_set_flash_message :alert, :token_blank, now: true
    else
      otp_set_flash_message :alert, :token_invalid, now: true
    end

    render :show, status: :unprocessable_entity
  end
end