module Devise::Models::SecurityNg
Public Instance Methods
access_locked?()
click to toggle source
Verifies whether a user is locked or not.
# File lib/devise_security_ng/model.rb, line 21 def access_locked? !!locked_at && !lock_expired? end
active_for_authentication?()
click to toggle source
Overwrites active_for_authentication? from Devise::Models::Activatable
Calls superclass method
# File lib/devise_security_ng/model.rb, line 26 def active_for_authentication? super && !access_locked? end
inactive_message()
click to toggle source
Overwrites inactive_message
from Devise::Models::Authenticatable
Calls superclass method
# File lib/devise_security_ng/model.rb, line 31 def inactive_message access_locked? ? locked_message : super end
lock_access!()
click to toggle source
Lock a user
# File lib/devise_security_ng/model.rb, line 9 def lock_access! self.locked_at = Time.current self.save! end
unauthenticated_message()
click to toggle source
Calls superclass method
# File lib/devise_security_ng/model.rb, line 66 def unauthenticated_message # If set to paranoid mode, do not show the locked message because it # leaks the existence of an account. if Devise.paranoid super elsif access_locked? || attempts_exceeded? locked_message elsif last_attempt? && self.class.last_attempt_warning && !!self.lockable :last_attempt else super end end
unlock_access!()
click to toggle source
Unlock a user by cleaning locked_at
# File lib/devise_security_ng/model.rb, line 15 def unlock_access! self.locked_at = nil self.save! end
update_tracked_fields!(request)
click to toggle source
Overwrites update_tracked_fields! from Devise::Models::Trackable to be able to verify if user successfully signed in
Calls superclass method
# File lib/devise_security_ng/model.rb, line 61 def update_tracked_fields!(request) self.login_attempts = 0 super end
valid_for_authentication?()
click to toggle source
Overwrites valid_for_authentication? from Devise::Models::Authenticatable for verifying whether a user is allowed to sign in or not. If the user is locked, it should never be allowed.
Calls superclass method
# File lib/devise_security_ng/model.rb, line 38 def valid_for_authentication? # Unlock the user if the lock is expired, no matter # if the user can login or not (wrong password, etc) unlock_access! if lock_expired? if super && !access_locked? true else self.login_attempts ||= 0 if !!self.lockable self.login_attempts += 1 end if attempts_exceeded? && !access_locked? lock_access! else self.save! end false end end
Protected Instance Methods
attempts_exceeded?()
click to toggle source
# File lib/devise_security_ng/model.rb, line 82 def attempts_exceeded? self.login_attempts && self.login_attempts >= self.class.maximum_login_attempts end
last_attempt?()
click to toggle source
# File lib/devise_security_ng/model.rb, line 86 def last_attempt? self.login_attempts && self.login_attempts == self.class.maximum_login_attempts - 1 end
lock_expired?()
click to toggle source
Checking if lock is expired
# File lib/devise_security_ng/model.rb, line 104 def lock_expired? if locked_at case self.login_attempts when 3..6 (self.locked_at + 1.minutes).to_i < Time.current.to_i when 6..9 (self.locked_at + 60.minutes).to_i < Time.current.to_i when 9..1.0/0 false else true end else false end end
locked_message()
click to toggle source
# File lib/devise_security_ng/model.rb, line 90 def locked_message case self.login_attempts when 3..6 :locked_3 when 6..9 :locked_6 when 9..1.0/0 :locked_9 else :locked end end