Merge branch '2fa' into 'master'

Two-factor authentication

Implement's Two-factor authentication using tokens.

- [X] Authentication logic
- [X] Enable/disable 2FA feature
- [x] Make 2-step login process if 2FA enabled
- [x] Backup codes
- [x] Backup code removed after being used
- [x] Check backup codes for mysql db (mention mysql limitation if applied)
- [x] Add tests
- [x] Test if https://github.com/tinfoil/devise-two-factor#disabling-automatic-login-after-password-resets applies, and address if so
- [x] Wait for fixed version of `attr_encrypted` or fork and use forked version - https://github.com/attr-encrypted/attr_encrypted/issues/155

Fixes http://feedback.gitlab.com/forums/176466-general/suggestions/4516817-implement-two-factor-authentication-2fa

See merge request !474

1 files changed, 17 insertions, 0 deletions

diff --git a/Gemfile.lock b/Gemfile.lock
index f5d3011376a..14b9a6848ab 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -46,6 +46,8 @@ GEM
     ast (2.0.0)
     astrolabe (1.3.0)
       parser (>= 2.2.0.pre.3, < 3.0)
+    attr_encrypted (1.3.4)
+      encryptor (>= 1.3.0)
     attr_required (1.0.0)
     autoprefixer-rails (5.1.11)
       execjs
@@ -136,6 +138,13 @@ GEM
       warden (~> 1.2.3)
     devise-async (0.9.0)
       devise (~> 3.2)
+    devise-two-factor (1.0.1)
+      activemodel
+      activesupport
+      attr_encrypted (~> 1.3.2)
+      devise (~> 3.2.4)
+      rails
+      rotp (~> 1.6.1)
     diff-lcs (1.2.5)
     diffy (3.0.3)
     docile (1.1.5)
@@ -147,6 +156,7 @@ GEM
     email_spec (1.5.0)
       launchy (~> 2.1)
       mail (~> 2.2)
+    encryptor (1.3.0)
     enumerize (0.7.0)
       activesupport (>= 3.2)
     equalizer (0.0.8)
@@ -482,7 +492,11 @@ GEM
     rest-client (1.6.7)
       mime-types (>= 1.16)
     rinku (1.7.3)
+    rotp (1.6.1)
     rouge (1.7.7)
+    rqrcode (0.4.2)
+    rqrcode-rails3 (0.1.7)
+      rqrcode (>= 0.4.2)
     rspec (2.99.0)
       rspec-core (~> 2.99.0)
       rspec-expectations (~> 2.99.0)
@@ -670,6 +684,7 @@ DEPENDENCIES
   annotate (~> 2.6.0.beta2)
   asana (~> 0.0.6)
   asciidoctor (= 0.1.4)
+  attr_encrypted (= 1.3.4)
   awesome_print
   better_errors
   binding_of_caller
@@ -691,6 +706,7 @@ DEPENDENCIES
   default_value_for (~> 3.0.0)
   devise (= 3.2.4)
   devise-async (= 0.9.0)
+  devise-two-factor
   diffy (~> 3.0.3)
   doorkeeper (= 2.1.3)
   dropzonejs-rails
@@ -762,6 +778,7 @@ DEPENDENCIES
   redis-rails
   request_store
   rerun (~> 0.10.0)
+  rqrcode-rails3
   rspec-rails (= 2.99)
   rubocop (= 0.28.0)
   rugments