action_auth 1.8.9 → 2.0.0

data/app/assets/javascripts/action_auth/application.js

@@ -1,75 +1,114 @@
-import { Application, Controller } from "https://unpkg.com/@hotwired/stimulus/dist/stimulus.js";
-window.Stimulus = Application.start();
+import { Application, Controller } from "https://unpkg.com/@hotwired/stimulus@3.2.2/dist/stimulus.js";
+import * as WebAuthnJSON from "https://unpkg.com/@github/webauthn-json@2.1.1/dist/esm/webauthn-json.js";
+
+const application = Application.start();
+
+const GENERIC_ERROR = "Something went wrong. Please try again.";
 
-import * as WebAuthnJSON from 'https://unpkg.com/@github/webauthn-json@2.1.1/dist/esm/webauthn-json.js';
 const Credential = {
-  getCRFSToken: function () {
-    const CSRFSelector = document.querySelector('meta[name="csrf-token"]');
-    if (CSRFSelector) {
-      return CSRFSelector.getAttribute("content");
-    } else {
-      return null;
+  csrfToken: function () {
+    const selector = document.querySelector('meta[name="csrf-token"]');
+    return selector ? selector.getAttribute("content") : null;
+  },
+
+  showError: function (message) {
+    const element = document.getElementById("webauthn_error");
+    if (element) {
+      element.textContent = message;
+      element.hidden = false;
     }
+    console.error("[ActionAuth]", message);
   },
 
   callback: function (url, body, redirectUrl) {
-    const token = this.getCRFSToken();
-    fetch(url, {
+    const self = this;
+    return fetch(url, {
       method: "POST",
       body: JSON.stringify(body),
       headers: {
         "Content-Type": "application/json",
         "Accept": "application/json",
-        "X-CSRF-Token": token
+        "X-CSRF-Token": self.csrfToken()
       },
-      credentials: 'same-origin'
-    }).then(function (response) {
+      credentials: "same-origin"
+    }).then(async function (response) {
       if (response.ok) {
-        console.log("Credential created", response);
-        window.location.replace(redirectUrl);
+        const data = await response.json().catch(() => ({}));
+        window.location.replace(data.redirect_url || redirectUrl);
       } else if (response.status < 500) {
-        response.text();
+        self.showError((await response.text()) || GENERIC_ERROR);
+      } else {
+        self.showError(GENERIC_ERROR);
       }
     });
   },
 
   create: function (callbackUrl, credentialOptions) {
     const self = this;
-    const webauthnRedirectUrl = document.querySelector('meta[name="webauthn_redirect_url"]').getAttribute("content");
-    WebAuthnJSON.create({ "publicKey": credentialOptions }).then(function (credential) {
-      self.callback(callbackUrl, credential, webauthnRedirectUrl);
-    });
+    const redirectUrl = document.querySelector('meta[name="webauthn_redirect_url"]').getAttribute("content");
+    return WebAuthnJSON.create({ "publicKey": credentialOptions })
+      .then((credential) => self.callback(callbackUrl, credential, redirectUrl))
+      .catch((error) => self.showError(error.message || GENERIC_ERROR));
   },
 
   get: function (credentialOptions) {
     const self = this;
-    const webauthnUrlTag = document.querySelector('meta[name="passkey_auth_url"]') ||
+    const urlTag = document.querySelector('meta[name="passkey_auth_url"]') ||
       document.querySelector('meta[name="webauthn_auth_url"]');
-    const webauthnUrl = webauthnUrlTag.getAttribute("content");
-    WebAuthnJSON.get({ "publicKey": credentialOptions }).then(function (credential) {
-      self.callback(webauthnUrl, credential, "/");
-    });
+    return WebAuthnJSON.get({ "publicKey": credentialOptions })
+      .then((credential) => self.callback(urlTag.getAttribute("content"), credential, "/"))
+      .catch((error) => self.showError(error.message || GENERIC_ERROR));
   }
 };
 
-
-Stimulus.register(
+application.register(
   "add-credential",
   class extends Controller {
+    // Attached here rather than on page load so it also works when Turbo brings
+    // the form in, and so it wins over Turbo's own form handling.
+    connect() {
+      this.submit = this.submit.bind(this);
+      this.element.addEventListener("submit", this.submit);
+    }
+
+    disconnect() {
+      this.element.removeEventListener("submit", this.submit);
+    }
+
+    submit(event) {
+      event.preventDefault();
+      const form = this.element;
+
+      fetch(form.action, {
+        method: "POST",
+        body: new FormData(form),
+        headers: {
+          "Accept": "application/json",
+          "X-CSRF-Token": Credential.csrfToken()
+        },
+        credentials: "same-origin"
+      }).then((response) => {
+        if (!response.ok) { throw new Error(GENERIC_ERROR); }
+        return response.json();
+      }).then((data) => {
+        form.dispatchEvent(new CustomEvent("ajax:success", { detail: data }));
+      }).catch((error) => Credential.showError(error.message || GENERIC_ERROR));
+    }
+
     create(event) {
       const webauthnUrl = document.querySelector('meta[name="webauthn_cred_url"]').getAttribute("content");
-      const credentialOptions = event.detail;
-      const credential_nickname = event.target.querySelector("input[name='webauthn_credential[nickname]']").value;
-      const callback_url = `${webauthnUrl}/?credential_nickname=${credential_nickname}`
-      Credential.create(encodeURI(callback_url), credentialOptions);
+      const nickname = event.target.querySelector("input[name='webauthn_credential[nickname]']").value;
+      const callbackUrl = `${webauthnUrl}?credential_nickname=${encodeURIComponent(nickname)}`;
+      Credential.create(callbackUrl, event.detail);
     }
   }
 );
 
-Stimulus.register(
+application.register(
   "credential-authenticator",
   class extends Controller {
     static values = { options: Object }
+
     connect() {
       if (this.hasOptionsValue) {
         Credential.get(this.optionsValue);
@@ -77,41 +116,3 @@ Stimulus.register(
     }
   }
 );
-
-function submitFormWithTurbo(form) {
-  const formData = new FormData(form);
-  fetch(form.action, {
-    method: 'POST',
-    body: formData,
-    headers: {
-      'X-CSRF-Token': document.querySelector('[name="csrf-token"]').content
-    },
-    credentials: 'same-origin'
-  }).then(response => {
-    return response.json();
-  }).then(data => {
-    form.dispatchEvent(new CustomEvent('ajax:success', { detail: data }));
-  });
-}
-
-if (!window.Turbo) {
-  document.addEventListener('DOMContentLoaded', function () {
-    const form = document.getElementById('webauthn_credential_form');
-    if (form) {
-      form.addEventListener('submit', function (event) {
-        event.preventDefault();
-        submitFormWithTurbo(form);
-      });
-    }
-  });
-} else {
-  document.addEventListener('turbo:load', function () {
-    const form = document.getElementById('webauthn_credential_form');
-    if (form) {
-      form.addEventListener('submit', function (event) {
-        event.preventDefault();
-        submitFormWithTurbo(form);
-      });
-    }
-  });
-}

data/app/assets/stylesheets/action_auth/application.css

@@ -124,12 +124,34 @@ input[type="password"] {
   pointer-events: none;
 }
 
-.btn-primary {
+.btn-primary,
+a.btn-primary:visited {
   color: #fff;
   background-color: #007bff;
   border-color: #007bff;
 }
 
+.btn-danger {
+  color: #fff;
+  background-color: #dc3545;
+  border-color: #dc3545;
+}
+
+.btn-danger:hover {
+  color: #fff;
+  background-color: #b02a37;
+  border-color: #b02a37;
+}
+
+.action-auth--notice {
+  color: #146c43;
+}
+
+.action-auth--alert,
+.action-auth--errors {
+  color: #b02a37;
+}
+
 .action-auth--table {
   width: 100%;
   border-collapse: separate;
@@ -217,6 +239,21 @@ input[type="password"] {
     color: #fbf1c7;
   }
 
+  a.btn,
+  a.btn:visited,
+  a.btn:hover {
+    color: #fbf1c7;
+  }
+
+  .action-auth--notice {
+    color: #b8bb26;
+  }
+
+  .action-auth--alert,
+  .action-auth--errors {
+    color: #fb4934;
+  }
+
   .action-auth--table {
     background-color: #3c3836;
     color: #d5c4a1;

data/app/controllers/action_auth/application_controller.rb

@@ -1,7 +1,128 @@
 module ActionAuth
-  class ApplicationController < ActionController::Base
+  class ApplicationController < ActionAuth.configuration.parent_controller.constantize
+    # A host parent controller usually requires sign in for everything, which
+    # would make the sign in page unreachable. Each controller here opts back in
+    # to authenticate_user! on the actions that need it.
+    skip_before_action :authenticate_user!, raise: false
+
+    protect_from_forgery with: :exception
+
+    layout -> { ActionAuth.configuration.layout }
+
+    helper_method :after_sign_in_path, :after_sign_out_path
+
     private
 
+    def action_auth_controller?
+      true
+    end
+
+    # Rails turns email[]=x into an Array and email[a]=b into a Hash. Neither is a
+    # valid answer to any question these forms ask, so they count as blank.
+    def string_param(name)
+      value = params[name]
+      value.is_a?(String) ? value : ""
+    end
+
+    def after_sign_in_path
+      action_auth_redirect_path(ActionAuth.configuration.after_sign_in_path)
+    end
+
+    def after_sign_out_path
+      action_auth_redirect_path(ActionAuth.configuration.after_sign_out_path)
+    end
+
+    def action_auth_redirect_path(configured)
+      return instance_exec(&configured) if configured.respond_to?(:call)
+
+      configured || main_app.root_path
+    end
+
+    # Every first factor (password, magic link, SMS, OAuth) ends here, so that a
+    # suspended account is always refused, and an account with a security key
+    # always gets prompted for it.
+    def complete_sign_in(user, notice:)
+      if user.account_suspended?
+        redirect_to sign_in_path, alert: ACCOUNT_SUSPENDED_MESSAGE, status: :see_other
+      elsif user.second_factor_enabled?
+        session[:webauthn_user_id] = user.id
+        redirect_to new_webauthn_credential_authentications_path
+      else
+        start_session_for(user)
+        redirect_to after_sign_in_path, notice: notice
+      end
+    end
+
+    def start_session_for(user)
+      user.sessions.create!.tap do |user_session|
+        user.unlock_account!
+        cookies.signed.permanent[:session_token] = action_auth_session_cookie_options.merge(value: user_session.id)
+      end
+    end
+
+    def record_failed_sign_in(user)
+      return unless user&.register_failed_sign_in
+
+      Rails.logger.warn "ActionAuth locked account #{user.id} after too many failed sign ins"
+      send_account_locked_email(user)
+    end
+
+    # Lockout is on by default, including for apps that have never had to set up email
+    # or a job queue, and this is the answer to someone's sign in. It can't take that
+    # down with it. A placeholder address has nobody to tell.
+    def send_account_locked_email(user)
+      UserMailer.with(user: user).account_locked.deliver_later if user.password_usable?
+    rescue StandardError => e
+      Rails.logger.error "ActionAuth could not send the account locked email: #{e.class}: #{e.message}"
+    end
+
+    # Checks the assertion the browser posted against one of +credentials+ and
+    # the challenge issued to this session. Returns the credential, or nil if it
+    # doesn't verify.
+    #
+    # The challenge is removed first so it can't be replayed. The rest works on
+    # client-supplied bytes, which can make the library raise far more than
+    # WebAuthn::Error (bad base64, truncated CBOR, missing keys). All of those
+    # mean the same thing here: not verified.
+    def verify_webauthn_assertion(credentials, **verify_options)
+      challenge = session.delete(:current_challenge)
+      assertion = WebAuthn::Credential.from_get(params)
+      credential = credentials.find_by(external_id: assertion.id)
+      return unless credential
+
+      assertion.verify(challenge, public_key: credential.public_key, sign_count: credential.sign_count, **verify_options)
+      credential.update!(sign_count: assertion.sign_count)
+      credential
+    rescue StandardError => e
+      Rails.logger.warn "ActionAuth rejected a WebAuthn assertion: #{e.class}: #{e.message}"
+      nil
+    end
+
+    # Before filter body for screens that set a new password. Renders +template+
+    # with an error when the submitted password is blank or known to be breached.
+    def reject_unusable_password(user, template)
+      password = string_param(:password)
+
+      if password.blank?
+        user.errors.add(:password, :blank)
+      elsif (count = pwned_count(password)).positive?
+        user.errors.add(:password, "has been pwned #{count} times. Please choose a different password.")
+      end
+
+      render template, status: :unprocessable_entity if user.errors.any?
+    end
+
+    # Have I Been Pwned being unreachable shouldn't stop anyone from signing up
+    # or resetting a password, so an outage counts as "not pwned".
+    def pwned_count(password)
+      return 0 unless ActionAuth.configuration.pwned_enabled?
+
+      Pwned::Password.new(password).pwned_count
+    rescue Pwned::Error => e
+      Rails.logger.warn "ActionAuth could not check Have I Been Pwned: #{e.message}"
+      0
+    end
+
     def generate_compliant_password
       uppercase = ('A'..'Z').to_a.sample
       lowercase = ('a'..'z').to_a.sample

data/app/controllers/action_auth/connected_accounts_controller.rb

@@ -0,0 +1,16 @@
+module ActionAuth
+  class ConnectedAccountsController < ApplicationController
+    before_action :authenticate_user!
+
+    def destroy
+      connected_account = Current.user.connected_accounts.find(params[:id])
+
+      if Current.user.can_sign_in_without?(connected_account)
+        connected_account.destroy
+        redirect_to sessions_path, notice: "#{connected_account.provider_label} has been disconnected.", status: :see_other
+      else
+        redirect_to sessions_path, alert: "That's the only way to sign in to this account, so it can't be disconnected.", status: :see_other
+      end
+    end
+  end
+end

data/app/controllers/action_auth/identity/email_verifications_controller.rb

@@ -1,15 +1,42 @@
 module ActionAuth
   module Identity
     class EmailVerificationsController < ApplicationController
-      before_action :set_user, only: :show
+      before_action :set_user, only: [:show, :update]
 
+      rate_limit to: 5,
+        within: 1.minute,
+        only: :create,
+        name: "email-verification-throttle",
+        with: -> { redirect_to sign_in_path, alert: "Too many requests. Try again later." }
+
+      rate_limit to: 5,
+        within: 1.minute,
+        only: :update,
+        name: "email-verification-password-throttle",
+        with: -> { redirect_to sign_in_path, alert: "Too many attempts. Try again later.", status: :see_other }
+
+      # Mail scanners and link previews open the links in an email, so opening one
+      # changes nothing. It only asks for the password.
       def show
-        @user.update! verified: true
-        redirect_to sign_in_path, notice: "Thank you for verifying your email address"
+        redirect_to sign_in_path, notice: "Your email address is already verified" if @user.verified?
+      end
+
+      # A locked account gets the same answer whether or not the password is right, as
+      # it does at sign in, so that this can't be used to carry on guessing.
+      def update
+        if @user.verify_email_with_password(string_param(:password))
+          redirect_to sign_in_path, notice: "Thank you for verifying your email address", status: :see_other
+        else
+          # An empty form isn't a guess.
+          record_failed_sign_in(@user) if string_param(:password).present?
+
+          flash.now[:alert] = "That password is incorrect"
+          render :show, status: :unprocessable_entity
+        end
       end
 
       def create
-        user = ActionAuth::User.find_by(email: params[:email])
+        user = ActionAuth::User.find_by(email: string_param(:email))
         UserMailer.with(user: user).email_verification.deliver_later if user
         redirect_to sign_in_path, notice: "We sent a verification email to your email address"
       end
@@ -17,7 +44,11 @@ module ActionAuth
       private
 
       def set_user
-        @user = ActionAuth::User.find_by_token_for!(:email_verification, params[:sid])
+        # The "Verify Email" link has no token. It's a way to reach the form that
+        # sends one, not a failed verification.
+        return redirect_to(edit_identity_email_path) if params[:sid].blank?
+
+        @user = ActionAuth::User.find_by_token_for!(:email_verification, string_param(:sid))
       rescue StandardError
         redirect_to edit_identity_email_path, alert: "That email verification link is invalid"
       end

data/app/controllers/action_auth/identity/emails_controller.rb

@@ -1,15 +1,27 @@
 module ActionAuth
   module Identity
     class EmailsController < ApplicationController
+      # edit stays public: it doubles as the "resend my verification email" form
+      # for people who can't sign in yet.
+      before_action :authenticate_user!, only: :update
       before_action :set_user
 
+      rate_limit to: 5,
+        within: 1.minute,
+        only: :update,
+        name: "email-change-throttle",
+        with: -> { redirect_to edit_identity_email_path, alert: "Too many attempts. Try again later.", status: :see_other }
+
       def edit
       end
 
       def update
         if @user.update(user_params)
-          redirect_to_root
+          redirect_after_update
         else
+          # The form shows what was typed from params. Current.user is shared
+          # with the rest of the request, so don't leave it holding a rejected email.
+          @user.restore_attributes
           render :edit, status: :unprocessable_entity
         end
       end
@@ -24,12 +36,12 @@ module ActionAuth
         params.permit(:email, :password_challenge).with_defaults(password_challenge: "")
       end
 
-      def redirect_to_root
+      def redirect_after_update
         if @user.email_previously_changed?
           resend_email_verification
-          redirect_to sign_in_path, notice: "Your email has been changed. Check your email to verify your email."
+          redirect_to sessions_path, notice: "Your email has been changed. Check your email to verify your email.", status: :see_other
         else
-          redirect_to sign_in_path
+          redirect_to sessions_path, status: :see_other
         end
       end
 

data/app/controllers/action_auth/identity/password_resets_controller.rb

@@ -2,7 +2,14 @@ module ActionAuth
   module Identity
     class PasswordResetsController < ApplicationController
       before_action :set_user, only: %i[ edit update ]
-      before_action :validate_pwned_password, only: :update
+
+      rate_limit to: 5,
+        within: 1.minute,
+        only: :create,
+        name: "password-reset-request-throttle",
+        with: -> { redirect_to new_identity_password_reset_path, alert: "Too many requests. Try again later." }
+
+      before_action :validate_new_password, only: :update
 
       def new
       end
@@ -10,18 +17,18 @@ module ActionAuth
       def edit
       end
 
+      # The response is the same whether or not the account exists, so this form
+      # can't be used to find out who has an account.
       def create
-        if @user = ActionAuth::User.find_by(email: params[:email], verified: true)
-          send_password_reset_email
-          redirect_to sign_in_path, notice: "Check your email for reset instructions"
-        else
-          redirect_to sign_in_path, alert: "You can't reset your password until you verify your email"
-        end
+        user = ActionAuth::User.find_by(email: string_param(:email))
+        UserMailer.with(user: user).password_reset.deliver_later if user && !user.account_suspended?
+
+        redirect_to sign_in_path, notice: "If there's an account with that email address, you'll receive reset instructions shortly."
       end
 
       def update
-        if @user.update(user_params)
-          redirect_to sign_in_path, notice: "Your password was reset successfully. Please sign in"
+        if @user.reset_password_from_emailed_link(user_params)
+          redirect_to sign_in_path, notice: "Your password was reset successfully. Please sign in", status: :see_other
         else
           render :edit, status: :unprocessable_entity
         end
@@ -30,7 +37,8 @@ module ActionAuth
       private
 
       def set_user
-        @user = ActionAuth::User.find_by_token_for!(:password_reset, params[:sid])
+        @user = ActionAuth::User.find_by_token_for!(:password_reset, string_param(:sid))
+        redirect_to new_identity_password_reset_path, alert: "That password reset link is invalid" if @user.account_suspended?
       rescue StandardError
         redirect_to new_identity_password_reset_path, alert: "That password reset link is invalid"
       end
@@ -39,18 +47,8 @@ module ActionAuth
         params.permit(:password, :password_confirmation)
       end
 
-      def send_password_reset_email
-        UserMailer.with(user: @user).password_reset.deliver_later
-      end
-
-      def validate_pwned_password
-        return unless ActionAuth.configuration.pwned_enabled?
-
-        pwned = Pwned::Password.new(params[:password])
-        if pwned.pwned?
-          @user.errors.add(:password, "has been pwned #{pwned.pwned_count} times. Please choose a different password.")
-          render :edit, status: :unprocessable_entity
-        end
+      def validate_new_password
+        reject_unusable_password(@user, :edit)
       end
     end
   end

data/app/controllers/action_auth/magics/requests_controller.rb

@@ -1,20 +1,41 @@
 module ActionAuth
   class Magics::RequestsController < ApplicationController
+    rate_limit to: 5,
+      within: 1.minute,
+      only: :create,
+      name: "magic-link-throttle",
+      with: -> { redirect_to new_magics_requests_path, alert: "Too many requests. Try again later." }
+
+    before_action :require_magic_link_migration, only: :create
+
     def new
     end
 
     def create
-      user = User.find_or_initialize_by(email: params[:email])
+      user = User.find_or_initialize_by(email: string_param(:email))
+
       if user.new_record?
-        password = generate_compliant_password
-        user.password = password
-        user.password_confirmation = password
-        user.save!
+        user.password = user.password_confirmation = generate_compliant_password
+
+        unless user.save
+          flash.now[:alert] = user.errors.full_messages.to_sentence
+          return render :new, status: :unprocessable_entity
+        end
       end
 
-      UserMailer.with(user: user).magic_link.deliver_later
+      UserMailer.with(user: user).magic_link.deliver_later unless user.account_suspended?
 
       redirect_to sign_in_path, notice: "Check your email for a magic link."
     end
+
+    private
+
+    # Without the column the email would fail in a background job, after this page
+    # had already told the person to check their inbox.
+    def require_magic_link_migration
+      return if User.column_names.include?("magic_link_used_at")
+
+      raise "ActionAuth magic links need a new migration. Run: bin/rails action_auth:install:migrations db:migrate"
+    end
   end
 end

data/app/controllers/action_auth/magics/sign_ins_controller.rb

@@ -1,15 +1,30 @@
 module ActionAuth
   class Magics::SignInsController < ApplicationController
+    INVALID_LINK = "That sign in link has expired or has already been used. Please request a new one.".freeze
+
+    # Mail scanners and link previews open the links in an email, so opening one
+    # only asks for confirmation. Otherwise they'd use up the link before the
+    # person it was sent to could click it.
     def show
-      user = ActionAuth::User.find_by_token_for(:magic_token, params[:token])
-      if user
-        @session = user.sessions.create
-        cookies.signed.permanent[:session_token] = { value: @session.id, httponly: true }
-        user.update(verified: true)
-        redirect_to main_app.root_path, notice: "Signed In"
+      @user = user_from_token
+
+      redirect_to sign_in_path, alert: INVALID_LINK unless @user
+    end
+
+    def create
+      user = user_from_token
+
+      if user&.claim_magic_link
+        complete_sign_in(user, notice: "Signed In")
       else
-        redirect_to sign_in_path, alert: "Authentication failed, please try again."
+        redirect_to sign_in_path, alert: INVALID_LINK, status: :see_other
       end
     end
+
+    private
+
+    def user_from_token
+      User.find_by_token_for(:magic_token, string_param(:token))
+    end
   end
 end