action_auth 1.8.9 → 2.0.0

data/app/controllers/action_auth/passwords_controller.rb

@@ -1,20 +1,22 @@
 module ActionAuth
   class PasswordsController < ApplicationController
+    before_action :authenticate_user!
     before_action :set_user
-    before_action :validate_pwned_password, only: :update
 
     rate_limit to: 3,
       within: 60.seconds,
       only: :update,
       name: "password-reset-throttle",
-      with: -> { redirect_to sign_in_path, alert: "Too many password reset attempts. Try again later." }
+      with: -> { redirect_to edit_password_path, alert: "Too many password change attempts. Try again later.", status: :see_other }
+
+    before_action :validate_new_password, only: :update
 
     def edit
     end
 
     def update
       if @user.update(user_params)
-        redirect_to sign_in_path, notice: "Your password has been changed"
+        redirect_to sessions_path, notice: "Your password has been changed", status: :see_other
       else
         render :edit, status: :unprocessable_entity
       end
@@ -30,21 +32,8 @@ module ActionAuth
       params.permit(:password, :password_confirmation, :password_challenge).with_defaults(password_challenge: "")
     end
 
-    def validate_pwned_password
-      return unless ActionAuth.configuration.pwned_enabled?
-
-      # Check minimum password requirements
-      if params[:password].present? && ActionAuth.configuration.password_complexity_check? && !Rails.env.test? &&
-         (params[:password] !~ /[A-Z]/ || params[:password] !~ /[a-z]/ || params[:password] !~ /[0-9]/ || params[:password] !~ /[^A-Za-z0-9]/)
-        @user.errors.add(:password, "must include at least one uppercase letter, one lowercase letter, one number, and one special character.")
-        render :edit, status: :unprocessable_entity and return
-      end
-
-      pwned = Pwned::Password.new(params[:password])
-      if pwned.pwned?
-        @user.errors.add(:password, "has been pwned #{pwned.pwned_count} times. Please choose a different password.")
-        render :edit, status: :unprocessable_entity
-      end
+    def validate_new_password
+      reject_unusable_password(@user, :edit)
     end
   end
 end

data/app/controllers/action_auth/provider_callbacks_controller.rb

@@ -0,0 +1,147 @@
+module ActionAuth
+  # Where someone comes back to after approving a sign in on another site. By the time
+  # create runs, the OmniAuth strategy has checked that this browser started the flow.
+  class ProviderCallbacksController < ApplicationController
+    FAILED = "We couldn't connect to that provider. Please try again.".freeze
+
+    # Some providers POST the callback from their own site, so it can't carry a token
+    # from ours. Nothing happens here without omniauth.auth, which only the strategy can
+    # set, and only after it has checked the OAuth state.
+    skip_forgery_protection only: :create
+
+    rate_limit to: 10,
+      within: 1.minute,
+      only: :create,
+      name: "oauth-callback-throttle",
+      with: -> { redirect_to sign_in_path, alert: "Too many attempts. Try again later." }
+
+    before_action :require_connected_accounts_migration, only: :create
+    before_action :require_valid_response, only: :create
+
+    def create
+      connected_account = ConnectedAccount.find_by(provider: provider_key, uid: uid)
+
+      if user_signed_in?
+        connect(connected_account)
+      elsif connected_account
+        complete_sign_in(connected_account.user, notice: "Signed in successfully")
+      else
+        sign_up
+      end
+    end
+
+    # What's sent in the message parameter can't be trusted, so it's never displayed.
+    def failure
+      if params[:message] == "authenticity_error"
+        Rails.logger.error "ActionAuth OAuth needs the omniauth-rails_csrf_protection gem, or the form was missing its token"
+      end
+
+      redirect_to user_signed_in? ? sessions_path : sign_in_path, alert: FAILED, status: :see_other
+    end
+
+    private
+
+    def auth
+      request.env["omniauth.auth"]
+    end
+
+    def provider_key
+      auth.provider.to_s
+    end
+
+    def uid
+      auth.uid.to_s
+    end
+
+    def provider_label
+      ActionAuth.configuration.oauth_providers.find { |oauth| oauth.key == provider_key }.label
+    end
+
+    # An app can also run OmniAuth for its own purposes, and an identity from one of
+    # those providers isn't one that ActionAuth was asked to trust for sign in.
+    def require_valid_response
+      return if auth && uid.present? && ActionAuth.configuration.oauth_providers.any? { |oauth| oauth.key == provider_key }
+
+      failure
+    end
+
+    def require_connected_accounts_migration
+      return if ConnectedAccount.table_exists?
+
+      raise "ActionAuth OAuth needs a new migration. Run: bin/rails action_auth:install:migrations db:migrate"
+    end
+
+    def connect(connected_account)
+      if connected_account&.user_id == Current.user.id
+        redirect_to sessions_path, notice: "#{provider_label} is already connected to your account."
+      elsif connected_account.nil? && create_connected_account(Current.user)
+        redirect_to sessions_path, notice: "#{provider_label} has been connected to your account."
+      else
+        redirect_to sessions_path, alert: "That #{provider_label} account is connected to a different account."
+      end
+    end
+
+    def create_connected_account(user)
+      user.connected_accounts.create!(provider: provider_key, uid: uid, display_name: display_name)
+    rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotUnique
+      false
+    end
+
+    # Only for showing on the management screen. Cut to fit, because a 255 character
+    # column on MySQL would refuse a long one and fail the sign in over nothing.
+    def display_name
+      info = auth.info
+
+      (info&.email.presence || info&.nickname.presence || info&.name.presence)&.first(255)
+    end
+
+    # Having the same email address isn't enough to sign in to an existing account.
+    # That would rely on every provider having verified it, and on nobody having signed
+    # up here with an address they don't own and kept the password. Signing in first
+    # proves it's the same person, and takes one step.
+    def sign_up
+      email = provider_email
+
+      if email && User.exists?(email: email)
+        return redirect_to(sign_in_path, alert: "There's already an account with that email address. " \
+          "Sign in, then connect #{provider_label} from your account page.")
+      end
+
+      user = create_user(email)
+
+      if user
+        complete_sign_in(user, notice: "Welcome! You have signed up successfully")
+      else
+        redirect_to sign_in_path, alert: FAILED
+      end
+    end
+
+    # Providers may not share an address, or may flag it as unverified, in which case
+    # it says nothing about who this is. Those accounts get a placeholder, as SMS does.
+    def provider_email
+      info = auth.info
+      email = info&.email.to_s.strip
+      flagged = ActiveModel::Type::Boolean.new.cast(info&.email_verified) == false
+
+      email if !flagged && email.match?(URI::MailTo::EMAIL_REGEXP)
+    end
+
+    def create_user(email)
+      password = generate_compliant_password
+
+      User.transaction do
+        User.create!(
+          email: email || "#{SecureRandom.hex(32)}#{User::OAUTH_EMAIL_SUFFIX}",
+          password: password,
+          password_confirmation: password,
+          verified: true
+        ).tap do |user|
+          user.connected_accounts.create!(provider: provider_key, uid: uid, display_name: display_name)
+        end
+      end
+    # Someone else got there first, such as a double click on the provider's page.
+    rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotUnique
+      nil
+    end
+  end
+end

data/app/controllers/action_auth/registrations_controller.rb

@@ -1,13 +1,13 @@
 module ActionAuth
   class RegistrationsController < ApplicationController
-    before_action :validate_pwned_password, only: :create
-
     rate_limit to: 3,
       within: 60.seconds,
       only: :create,
       name: "registration-throttle",
       with: -> { redirect_to new_user_registration_path, alert: "Too many registration attempts. Try again later." }
 
+    before_action :validate_new_password, only: :create
+
     def new
       @user = User.new
     end
@@ -20,13 +20,8 @@ module ActionAuth
           send_email_verification
           redirect_to sign_in_path, notice: "Welcome! You have signed up successfully. Please check your email to verify your account."
         else
-          session_record = @user.sessions.create!
-          cookie_options = { value: session_record.id, httponly: true }
-          cookie_options[:secure] = Rails.env.production? if Rails.env.production?
-          cookie_options[:same_site] = :lax unless Rails.env.test?
-          cookies.signed.permanent[:session_token] = cookie_options
-
-          redirect_to sign_in_path, notice: "Welcome! You have signed up successfully"
+          start_session_for(@user)
+          redirect_to after_sign_in_path, notice: "Welcome! You have signed up successfully"
         end
       else
         render :new, status: :unprocessable_entity
@@ -43,22 +38,9 @@ module ActionAuth
       UserMailer.with(user: @user).email_verification.deliver_later
     end
 
-    def validate_pwned_password
-      return unless ActionAuth.configuration.pwned_enabled?
-
-      if params[:password].present? && !Rails.env.test? && (params[:password] !~ /[A-Z]/ || params[:password] !~ /[a-z]/ || params[:password] !~ /[0-9]/ || params[:password] !~ /[^A-Za-z0-9]/)
-        @user = User.new(email: params[:email])
-        @user.errors.add(:password, "must include at least one uppercase letter, one lowercase letter, one number, and one special character.")
-        render :new, status: :unprocessable_entity and return
-      end
-
-      pwned = Pwned::Password.new(params[:password])
-
-      if pwned.pwned?
-        @user = User.new(email: params[:email])
-        @user.errors.add(:password, "has been pwned #{pwned.pwned_count} times. Please choose a different password.")
-        render :new, status: :unprocessable_entity
-      end
+    def validate_new_password
+      @user = User.new(email: string_param(:email))
+      reject_unusable_password(@user, :new)
     end
   end
 end

data/app/controllers/action_auth/sessions/passkeys_controller.rb

@@ -1,22 +1,30 @@
 module ActionAuth
   module Sessions
     class PasskeysController < ApplicationController
+      rate_limit to: 5,
+        within: 20.seconds,
+        only: :create,
+        name: "passkey-throttle",
+        with: -> { render json: "Too many attempts. Try again later.", status: :too_many_requests }
+
       def new
-        get_options = WebAuthn::Credential.options_for_get
+        get_options = WebAuthn::Credential.options_for_get(user_verification: "required")
         session[:current_challenge] = get_options.challenge
         @options = get_options
       end
 
+      # A passkey is the only factor on this path, so it has to prove the user
+      # was verified on the device (biometric or PIN), not just present.
       def create
-        webauthn_credential = WebAuthn::Credential.from_get(params)
-        credential = WebauthnCredential.find_by(external_id: webauthn_credential.id)
-        user = User.find_by(id: credential&.user_id)
-        if credential && user
-          session = user.sessions.create
-          cookies.signed.permanent[:session_token] = { value: session.id, httponly: true }
-          redirect_to main_app.root_path(format: :html), notice: "Signed in successfully"
+        credential = verify_webauthn_assertion(WebauthnCredential, user_verification: true)
+
+        if credential&.user&.account_suspended?
+          render json: ACCOUNT_SUSPENDED_MESSAGE, status: :unprocessable_entity
+        elsif credential&.user
+          start_session_for(credential.user)
+          render json: { status: "ok", redirect_url: after_sign_in_path }
         else
-          redirect_to sign_in_path(format: :html), alert: "That passkey is incorrect" and return
+          render json: "That passkey is incorrect", status: :unprocessable_entity
         end
       end
     end

data/app/controllers/action_auth/sessions_controller.rb

@@ -1,6 +1,5 @@
 module ActionAuth
   class SessionsController < ApplicationController
-    before_action :set_current_request_details
     before_action :authenticate_user!, only: [:index, :destroy]
 
     rate_limit to: 5,
@@ -17,35 +16,38 @@ module ActionAuth
     def new
     end
 
+    # A locked account gets the same answer whether or not the password is right.
+    # Saying "locked" only to the right password would let guessing carry on through
+    # the lock, and saying it to anyone would reveal who has an account. The account's
+    # owner finds out by email instead.
     def create
-      if user = User.authenticate_by(email: params[:email], password: params[:password])
-        if user.second_factor_enabled?
-          session[:webauthn_user_id] = user.id
-          redirect_to new_webauthn_credential_authentications_path
-        else
-          return if check_if_email_is_verified(user)
-          @session = user.sessions.create
-          session_token_hash = { value: @session.id, httponly: true }
-          session_token_hash[:secure] = Rails.env.production? if Rails.env.production?
-          session_token_hash[:same_site] = :lax unless Rails.env.test?
-          session_token_hash[:domain] = :all if ActionAuth.configuration.insert_cookie_domain
-          cookies.signed.permanent[:session_token] = session_token_hash
-          redirect_to main_app.root_path, notice: "Signed in successfully"
-        end
+      user = User.authenticate_by(email: string_param(:email), password: string_param(:password))
+
+      if user && !user.account_locked?
+        return if check_if_email_is_verified(user)
+
+        complete_sign_in(user, notice: "Signed in successfully")
       else
-        redirect_to sign_in_path(email_hint: params[:email]), alert: "That email or password is incorrect"
+        # An empty form isn't a guess.
+        record_failed_sign_in(user || User.find_by(email: string_param(:email))) if string_param(:password).present?
+
+        redirect_to sign_in_path(email_hint: string_param(:email)), alert: "That email or password is incorrect"
       end
     end
 
     def destroy
-      session = Current.user.sessions.find(params[:id])
-      session.destroy
-      cookie_options = {}
-      cookie_options[:secure] = Rails.env.production? if Rails.env.production?
-      cookie_options[:same_site] = :lax unless Rails.env.test?
-      cookies.delete(:session_token, cookie_options)
-      response.headers["Clear-Site-Data"] = '"cache","storage"'
-      redirect_to main_app.root_path, notice: "That session has been logged out"
+      user_session = Current.user.sessions.find(params[:id])
+      user_session.destroy
+
+      if user_session == Current.session
+        Current.session = nil
+        delete_action_auth_session_cookie
+        response.headers["Clear-Site-Data"] = '"cache","storage"'
+        redirect_to after_sign_out_path, notice: "That session has been logged out", status: :see_other
+      else
+        # Another device was signed out. This one stays signed in.
+        redirect_to sessions_path, notice: "That session has been logged out", status: :see_other
+      end
     end
 
     private
@@ -54,7 +56,7 @@ module ActionAuth
       return false unless ActionAuth.configuration.verify_email_on_sign_in
       return false if user.verified?
 
-      redirect_to sign_in_path(email_hint: params[:email]),
+      redirect_to sign_in_path(email_hint: string_param(:email)),
         alert: "You must verify your email before you sign in."
     end
   end

data/app/controllers/action_auth/sms_auths/requests_controller.rb

@@ -1,31 +1,57 @@
 module ActionAuth
   class SmsAuths::RequestsController < ApplicationController
+    TOO_MANY_REQUESTS = -> { redirect_to new_sms_auths_requests_path, alert: "Too many requests. Try again later." }
+
+    # Every message sent costs money, so limit both how fast one client can send
+    # to many numbers and how often any one number can be texted.
+    rate_limit to: 3, within: 1.minute, only: :create, name: "sms-request-throttle", with: TOO_MANY_REQUESTS
+    rate_limit to: 3, within: 5.minutes, only: :create, name: "sms-number-throttle",
+      by: -> { User.normalize_value_for(:phone_number, string_param(:phone_number)) }, with: TOO_MANY_REQUESTS
+
     def new
     end
 
     def create
-      @user = User.find_or_initialize_by(phone_number: params[:phone_number])
-      if @user.new_record?
-        password = generate_compliant_password
+      # Never nil: searching for a nil phone number would match every account that
+      # doesn't have one.
+      @user = User.find_or_initialize_by(phone_number: string_param(:phone_number))
 
-        @user.email = "#{SecureRandom.hex(32)}@smsauth"
-        @user.password = password
-        @user.password_confirmation = password
+      if @user.new_record?
+        @user.email = "#{SecureRandom.hex(32)}#{User::SMS_EMAIL_SUFFIX}"
+        @user.password = @user.password_confirmation = generate_compliant_password
         @user.verified = false
 
-        @user.save!
+        unless @user.save
+          flash.now[:alert] = @user.errors.full_messages_for(:phone_number).to_sentence
+          return render :new, status: :unprocessable_entity
+        end
       end
 
-      code = rand(100_000..999_999)
+      # There's no point paying for a code that couldn't be used. The answer stays the
+      # same, so this form doesn't reveal which numbers are locked or suspended.
+      send_new_code unless @user.account_locked? || @user.account_suspended?
+      cookies.signed[:sms_auth_phone_number] = action_auth_session_cookie_options.merge(value: @user.phone_number)
+
+      redirect_to sms_auths_sign_ins_path, notice: "Check your phone for a SMS Code."
+    end
+
+    private
+
+    def send_new_code
+      code = SecureRandom.random_number(100_000..999_999)
       @user.update!(sms_code: code, sms_code_sent_at: Time.current)
-      cookies.signed[:sms_auth_phone_number] = { value: @user.phone_number, httponly: true }
 
-      if defined?(ActionAuth.configuration.sms_send_class) &&
-        ActionAuth.configuration.sms_send_class.respond_to?(:send_code)
-        ActionAuth.configuration.sms_send_class.send_code(@user.phone_number, code)
-      end
+      send_code(@user.phone_number, code)
+    end
 
-      redirect_to sms_auths_sign_ins_path, notice: "Check your phone for a SMS Code."
+    def send_code(phone_number, code)
+      sender = ActionAuth.configuration.sms_send_class
+
+      if sender.respond_to?(:send_code)
+        sender.send_code(phone_number, code)
+      else
+        Rails.logger.error "ActionAuth could not send an SMS code: config.sms_send_class must respond to send_code"
+      end
     end
   end
 end

data/app/controllers/action_auth/sms_auths/sign_ins_controller.rb

@@ -1,27 +1,52 @@
 module ActionAuth
   class SmsAuths::SignInsController < ApplicationController
+    CODE_LIFETIME = 5.minutes
+
+    TOO_MANY_ATTEMPTS = -> { redirect_to sign_in_path, alert: "Too many attempts. Try again later." }
+
+    # A six digit code is only safe if it can't be guessed at speed, so limit
+    # guesses per client and against any one phone number.
+    rate_limit to: 5, within: 1.minute, only: :create, name: "sms-sign-in-throttle", with: TOO_MANY_ATTEMPTS
+    rate_limit to: 5, within: CODE_LIFETIME, only: :create, name: "sms-code-throttle",
+      by: -> { cookies.signed[:sms_auth_phone_number].to_s }, with: TOO_MANY_ATTEMPTS
+
     def show
-      @user = ActionAuth::User.find_by(phone_number: params[:phone_number])
     end
 
+    # The rate limits above depend on the app's cache. Lockout is the backstop on
+    # guessing a code that doesn't, and it says so whether or not the code is right.
     def create
-      user = ActionAuth::User.find_by(
-        phone_number: cookies.signed[:sms_auth_phone_number],
-        sms_code: params[:sms_code],
-        sms_code_sent_at: 5.minutes.ago..Time.current
-      )
-      if user
-        @session = user.sessions.create
-        cookies.signed.permanent[:session_token] = { value: @session.id, httponly: true }
-        user.update(
-          verified: true,
-          sms_code: nil,
-          sms_code_sent_at: nil
-        )
-        redirect_to main_app.root_path, notice: "Signed In"
+      user = user_for_phone_number
+
+      if user&.account_locked?
+        instance_exec(&TOO_MANY_ATTEMPTS)
+      elsif user && submitted_code_matches?(user)
+        user.update(verified: true, sms_code: nil, sms_code_sent_at: nil)
+        cookies.delete(:sms_auth_phone_number, action_auth_session_cookie_options)
+        complete_sign_in(user, notice: "Signed In")
       else
+        record_failed_sign_in(user) if string_param(:sms_code).present?
         redirect_to sign_in_path, alert: "Authentication failed, please try again."
       end
     end
+
+    private
+
+    # Never searches for a blank number, which would match every account without one.
+    def user_for_phone_number
+      phone_number = cookies.signed[:sms_auth_phone_number]
+
+      User.find_by(phone_number: phone_number) if phone_number.present?
+    end
+
+    # Compares one code in Ruby rather than putting it in the query, where an
+    # array parameter would let one request try thousands of codes.
+    def submitted_code_matches?(user)
+      code = string_param(:sms_code)
+      return false unless code.present? && user.sms_code.present?
+      return false unless user.sms_code_sent_at&.between?(CODE_LIFETIME.ago, Time.current)
+
+      ActiveSupport::SecurityUtils.secure_compare(user.sms_code, code)
+    end
   end
 end

data/app/controllers/action_auth/users_controller.rb

@@ -1,10 +1,44 @@
 module ActionAuth
   class UsersController < ApplicationController
+    RECENT_SIGN_IN = 10.minutes
+
     before_action :authenticate_user!
 
+    # Per session, because this is a way to guess the password of whoever left
+    # themselves signed in, and that shouldn't get easier from more IP addresses.
+    rate_limit to: 5,
+      within: 1.minute,
+      only: :destroy,
+      name: "account-deletion-throttle",
+      by: -> { Current.session.id },
+      with: -> { redirect_to sessions_path, alert: "Too many attempts. Try again later.", status: :see_other }
+
     def destroy
+      if Current.user.password_usable?
+        return refuse("Your account wasn't deleted because the password was missing or incorrect.") unless password_confirmed?
+      else
+        return refuse("Please sign in again with #{Current.user.fresh_sign_in_method}, then delete your account within 10 minutes.") unless recently_signed_in?
+      end
+
       Current.user.destroy
-      redirect_to main_app.root_url, notice: "Your account has been deleted."
+      delete_action_auth_session_cookie
+      redirect_to after_sign_out_path, notice: "Your account has been deleted.", status: :see_other
+    end
+
+    private
+
+    def password_confirmed?
+      Current.user.authenticate(string_param(:password_challenge))
+    end
+
+    # A new SMS code or provider sign in proves the same thing a password would. This uses created_at
+    # because updated_at keeps moving while the session is being used.
+    def recently_signed_in?
+      Current.session.created_at > RECENT_SIGN_IN.ago
+    end
+
+    def refuse(message)
+      redirect_to sessions_path, alert: message, status: :see_other
     end
   end
 end

data/app/controllers/action_auth/webauthn_credential_authentications_controller.rb

@@ -1,59 +1,44 @@
-class ActionAuth::WebauthnCredentialAuthenticationsController < ApplicationController
-  before_action :ensure_user_not_authenticated
-  before_action :ensure_login_initiated
-  layout "action_auth/application"
-
-  rate_limit to: 5,
-    within: 20.seconds,
-    only: :create,
-    name: "webauthn-throttle",
-    with: -> { redirect_to sign_in_path, alert: "Too many attempts. Try again later." }
-
-  def new
-    get_options = WebAuthn::Credential.options_for_get(allow: user.webauthn_credentials.pluck(:external_id))
-    session[:current_challenge] = get_options.challenge
-    @options = get_options
-  end
-
-  def create
-    webauthn_credential = WebAuthn::Credential.from_get(params)
-
-    credential = user.webauthn_credentials.find_by(external_id: webauthn_credential.id)
-
-    begin
-      webauthn_credential.verify(
-        session[:current_challenge],
-        public_key: credential.public_key,
-        sign_count: credential.sign_count
-      )
+module ActionAuth
+  class WebauthnCredentialAuthenticationsController < ApplicationController
+    before_action :ensure_user_not_authenticated
+    before_action :ensure_login_initiated
+
+    rate_limit to: 5,
+      within: 20.seconds,
+      only: :create,
+      name: "webauthn-throttle",
+      with: -> { render json: "Too many attempts. Try again later.", status: :too_many_requests }
+
+    def new
+      get_options = WebAuthn::Credential.options_for_get(allow: user.webauthn_credentials.pluck(:external_id))
+      session[:current_challenge] = get_options.challenge
+      @options = get_options
+    end
 
-      credential.update!(sign_count: webauthn_credential.sign_count)
-      session.delete(:webauthn_user_id)
-      session = user.sessions.create
-      cookie_options = { value: session.id, httponly: true }
-      cookie_options[:secure] = Rails.env.production? if Rails.env.production?
-      cookie_options[:same_site] = :lax unless Rails.env.test?
-      cookies.signed.permanent[:session_token] = cookie_options
-      render json: { status: "ok" }, status: :ok
-    rescue WebAuthn::Error => e
-      Rails.logger.error "❌ Verification failed: #{e.message}"
-      render json: "Verification failed: #{e.message}", status: :unprocessable_entity
+    def create
+      if verify_webauthn_assertion(user.webauthn_credentials)
+        session.delete(:webauthn_user_id)
+        start_session_for(user)
+        render json: { status: "ok", redirect_url: after_sign_in_path }
+      else
+        render json: "Verification failed", status: :unprocessable_entity
+      end
     end
-  end
 
-  private
+    private
 
-  def user
-    @user ||= ActionAuth::User.find_by(id: session[:webauthn_user_id])
-  end
+    def user
+      @user ||= ActionAuth::User.find_by(id: session[:webauthn_user_id])
+    end
 
-  def ensure_login_initiated
-    return unless session[:webauthn_user_id].blank?
-    redirect_to sign_in_path
-  end
+    def ensure_login_initiated
+      return if user && !user.account_suspended?
+      redirect_to sign_in_path
+    end
 
-  def ensure_user_not_authenticated
-    return unless current_user
-    redirect_to main_app.root_path
+    def ensure_user_not_authenticated
+      return unless current_user
+      redirect_to after_sign_in_path
+    end
   end
 end