module Devise::Models::SecurityNg

Public Instance Methods

access_locked?() click to toggle source

Verifies whether a user is locked or not.

# File lib/devise_security_ng/model.rb, line 21
def access_locked?
  !!locked_at && !lock_expired?
end
active_for_authentication?() click to toggle source

Overwrites active_for_authentication? from Devise::Models::Activatable

Calls superclass method
# File lib/devise_security_ng/model.rb, line 26
def active_for_authentication?
  super && !access_locked?
end
inactive_message() click to toggle source

Overwrites inactive_message from Devise::Models::Authenticatable

Calls superclass method
# File lib/devise_security_ng/model.rb, line 31
def inactive_message
  access_locked? ? locked_message : super
end
lock_access!() click to toggle source

Lock a user

# File lib/devise_security_ng/model.rb, line 9
def lock_access!
  self.locked_at = Time.current
  self.save!
end
unauthenticated_message() click to toggle source
Calls superclass method
# File lib/devise_security_ng/model.rb, line 66
def unauthenticated_message
  # If set to paranoid mode, do not show the locked message because it
  # leaks the existence of an account.
  if Devise.paranoid
    super
  elsif access_locked? || attempts_exceeded?
    locked_message
  elsif last_attempt? && self.class.last_attempt_warning && !!self.lockable
    :last_attempt
  else
    super
  end
end
unlock_access!() click to toggle source

Unlock a user by cleaning locked_at

# File lib/devise_security_ng/model.rb, line 15
def unlock_access!
  self.locked_at = nil
  self.save!
end
update_tracked_fields!(request) click to toggle source

Overwrites update_tracked_fields! from Devise::Models::Trackable to be able to verify if user successfully signed in

Calls superclass method
# File lib/devise_security_ng/model.rb, line 61
def update_tracked_fields!(request)
  self.login_attempts = 0
  super
end
valid_for_authentication?() click to toggle source

Overwrites valid_for_authentication? from Devise::Models::Authenticatable for verifying whether a user is allowed to sign in or not. If the user is locked, it should never be allowed.

Calls superclass method
# File lib/devise_security_ng/model.rb, line 38
def valid_for_authentication?
  # Unlock the user if the lock is expired, no matter
  # if the user can login or not (wrong password, etc)
  unlock_access! if lock_expired?

  if super && !access_locked?
    true
  else
    self.login_attempts ||= 0
    if !!self.lockable
      self.login_attempts += 1
    end
    if attempts_exceeded? && !access_locked?
      lock_access!
    else
      self.save!
    end
    false
  end
end

Protected Instance Methods

attempts_exceeded?() click to toggle source
# File lib/devise_security_ng/model.rb, line 82
def attempts_exceeded?
  self.login_attempts && self.login_attempts >= self.class.maximum_login_attempts
end
last_attempt?() click to toggle source
# File lib/devise_security_ng/model.rb, line 86
def last_attempt?
  self.login_attempts && self.login_attempts == self.class.maximum_login_attempts - 1
end
lock_expired?() click to toggle source

Checking if lock is expired

# File lib/devise_security_ng/model.rb, line 104
def lock_expired?
  if locked_at
    case self.login_attempts
    when 3..6
      (self.locked_at + 1.minutes).to_i < Time.current.to_i
    when 6..9
      (self.locked_at + 60.minutes).to_i < Time.current.to_i
    when 9..1.0/0
      false
    else
      true
    end
  else
    false
  end
end
locked_message() click to toggle source
# File lib/devise_security_ng/model.rb, line 90
def locked_message
  case self.login_attempts
  when 3..6
    :locked_3
  when 6..9
    :locked_6
  when 9..1.0/0
    :locked_9
  else
    :locked
  end
end