action_auth 1.8.9 → 2.0.0

data/app/controllers/action_auth/webauthn_credentials_controller.rb

@@ -1,38 +1,37 @@
-class ActionAuth::WebauthnCredentialsController < ApplicationController
-  before_action :authenticate_user!
-  layout "action_auth/application"
+module ActionAuth
+  class WebauthnCredentialsController < ApplicationController
+    before_action :authenticate_user!
 
-  def new
-  end
-
-  def options
-    if current_user.webauthn_id.blank?
-      current_user.update!(webauthn_id: WebAuthn.generate_user_id)
+    def new
     end
 
-    create_options = WebAuthn::Credential.options_for_create(
-      user: {
-        id: current_user.webauthn_id,
-        name: current_user.email
-      },
-      exclude: current_user.webauthn_credentials.pluck(:external_id)
-    )
+    def options
+      if current_user.webauthn_id.blank?
+        current_user.update!(webauthn_id: WebAuthn.generate_user_id)
+      end
 
-    session[:current_challenge] = create_options.challenge
+      create_options = WebAuthn::Credential.options_for_create(
+        user: {
+          id: current_user.webauthn_id,
+          name: current_user.email
+        },
+        exclude: current_user.webauthn_credentials.pluck(:external_id),
+        authenticator_selection: authenticator_selection
+      )
 
-    respond_to do |format|
-      format.json { render json: create_options }
-      if defined?(Turbo)
-        format.turbo_stream { render json: create_options }
+      session[:current_challenge] = create_options.challenge
+
+      respond_to do |format|
+        format.json { render json: create_options }
+        if defined?(Turbo)
+          format.turbo_stream { render json: create_options }
+        end
       end
     end
-  end
-
-  def create
-    webauthn_credential = WebAuthn::Credential.from_create(params)
 
-    begin
-      webauthn_credential.verify(session[:current_challenge])
+    def create
+      webauthn_credential = verified_registration
+      return render(json: "Verification failed", status: :unprocessable_entity) unless webauthn_credential
 
       credential = current_user.webauthn_credentials.build(
         external_id: webauthn_credential.id,
@@ -47,38 +46,51 @@ class ActionAuth::WebauthnCredentialsController < ApplicationController
       else
         render json: "Couldn't add your Security Key", status: :unprocessable_entity
       end
-    rescue WebAuthn::Error => e
-      Rails.logger.error "❌ Verification failed: #{e.message}"
-      render json: "Verification failed: #{e.message}", status: :unprocessable_entity
     end
-  end
 
-  def destroy
-    current_user.webauthn_credentials.destroy(params[:id])
+    def destroy
+      current_user.webauthn_credentials.destroy(params[:id])
 
-    redirect_to sessions_path
-  end
+      redirect_to sessions_path, status: :see_other
+    end
 
-  private
+    private
 
-  def key_type
-    transports = params.dig(:response, :transports)
-    return :unknown unless transports.present?
+    # Signing in with only a passkey doesn't name an account up front, so the
+    # authenticator has to be able to find the credential by itself. Browsers
+    # don't create that kind of credential unless asked.
+    def authenticator_selection
+      ActionAuth.configuration.passkey_only? ? { resident_key: "preferred" } : {}
+    end
 
-    transport_types = {
-      ["internal", "hybrid"] => :passkey,
-      ["usb", "nfc"] => :hardware,
-      ["bluetooth", "wireless"] => :wireless,
-    }.freeze
+    # See verify_webauthn_assertion for why this rescues broadly.
+    def verified_registration
+      challenge = session.delete(:current_challenge)
+      WebAuthn::Credential.from_create(params).tap { |credential| credential.verify(challenge) }
+    rescue StandardError => e
+      Rails.logger.warn "ActionAuth rejected a WebAuthn registration: #{e.class}: #{e.message}"
+      nil
+    end
 
-    transport_types.each do |keys, type|
-      if transports.is_a?(String)
-        return type if keys.include?(transports)
-      elsif transports.is_a?(Array)
-        return type if (keys & transports).any?
+    def key_type
+      transports = params.dig(:response, :transports)
+      return :unknown unless transports.present?
+
+      transport_types = {
+        ["internal", "hybrid"] => :passkey,
+        ["usb", "nfc"] => :hardware,
+        ["bluetooth", "wireless"] => :wireless,
+      }.freeze
+
+      transport_types.each do |keys, type|
+        if transports.is_a?(String)
+          return type if keys.include?(transports)
+        elsif transports.is_a?(Array)
+          return type if (keys & transports).any?
+        end
       end
-    end
 
-    :unknown
+      :unknown
+    end
   end
 end

data/app/helpers/action_auth/application_helper.rb

@@ -1,4 +1,87 @@
 module ActionAuth
   module ApplicationHelper
+    WEBAUTHN_SCREENS = %w[
+      action_auth/webauthn_credentials
+      action_auth/webauthn_credential_authentications
+      action_auth/sessions/passkeys
+    ].freeze
+
+    # The other auth screens someone could go to from here, as [label, path]
+    # pairs, leaving out the current page and any feature that's turned off.
+    # Use this in a custom view to style the links without repeating the checks:
+    #
+    #   <% action_auth_links.each do |label, path| %>
+    #     <%= link_to label, path, class: "underline" %>
+    #   <% end %>
+    def action_auth_links
+      config = ActionAuth.configuration
+
+      links = [["Sign In", sign_in_path], ["Sign Up", sign_up_path]]
+      links << ["Magic Link", new_magics_requests_path] if config.magic_link_enabled?
+      links << ["SMS Auth", new_sms_auths_requests_path] if config.sms_auth_enabled?
+      links << ["Passkey", new_sessions_passkey_path] if config.passkey_only?
+      links << ["Reset Password", new_identity_password_reset_path]
+      links << ["Verify Email", edit_identity_email_path] if config.verify_email_on_sign_in
+
+      links.reject { |_label, path| current_page?(path) }
+    end
+
+    # The configured OAuth providers, as [label, path] pairs. These have to be POSTed
+    # by a form that Turbo stays out of, because the response redirects to another site:
+    #
+    #   <% action_auth_oauth_providers.each do |label, path| %>
+    #     <%= button_to "Continue with #{label}", path, form: { data: { turbo: false } } %>
+    #   <% end %>
+    def action_auth_oauth_providers
+      return [] unless ActionAuth.configuration.oauth_enabled?
+
+      ActionAuth.configuration.oauth_providers.map { |oauth| [oauth.label, oauth_request_path(oauth.key)] }
+    end
+
+    # Everything the browser side of WebAuthn needs. The three screens that use
+    # it include this themselves, so they work inside any layout, and the
+    # third-party scripts it loads stay off the pages where people type passwords.
+    # Only renders once per page, so it's safe to call from a view and a layout.
+    def action_auth_webauthn_tags
+      return if @action_auth_webauthn_tags_rendered
+
+      @action_auth_webauthn_tags_rendered = true
+
+      safe_join([
+        csrf_meta_tags,
+        tag.meta(name: "webauthn_auth_url", content: webauthn_credential_authentications_url),
+        tag.meta(name: "webauthn_cred_url", content: webauthn_credentials_url),
+        tag.meta(name: "webauthn_redirect_url", content: sessions_url),
+        javascript_include_tag("action_auth/application", type: "module", "data-turbo-track": "reload")
+      ].compact, "\n")
+    end
+
+    # For the default layout, so that a WebAuthn view copied from an older version
+    # of ActionAuth, which relied on the layout for these tags, keeps working.
+    def action_auth_webauthn_screen?
+      controller_path.in?(WEBAUTHN_SCREENS)
+    end
+
+    # Engine views only have the engine's routes, so an app's layout would blow
+    # up on its first root_path or posts_path. Fall back to the app's routes.
+    # The engine's routes still win when both define the same name, so use
+    # main_app.session_path for an app route that clashes.
+    def method_missing(name, *args, **options, &block)
+      if action_auth_main_app_route?(name)
+        main_app.public_send(name, *args, **options, &block)
+      else
+        super
+      end
+    end
+
+    def respond_to_missing?(name, include_private = false)
+      action_auth_main_app_route?(name) || super
+    end
+
+    private
+
+    def action_auth_main_app_route?(name)
+      name.end_with?("_path", "_url") && main_app.respond_to?(name)
+    end
   end
 end

data/app/mailers/action_auth/application_mailer.rb

@@ -1,6 +1,6 @@
 module ActionAuth
   class ApplicationMailer < ActionMailer::Base
-    default from: ActionAuth.configuration.default_from_email
+    default from: -> { ActionAuth.configuration.default_from_email }
     layout "mailer"
   end
 end

data/app/mailers/action_auth/user_mailer.rb

@@ -20,5 +20,12 @@ module ActionAuth
 
       mail to: @user.email, subject: "Sign in to your account"
     end
+
+    def account_locked
+      @user = params[:user]
+      @duration = ActionAuth.configuration.account_lockout_duration
+
+      mail to: @user.email, subject: "Your account has been locked"
+    end
   end
 end

data/app/models/action_auth/connected_account.rb

@@ -0,0 +1,18 @@
+module ActionAuth
+  # An account on another site that can be used to sign in to this one. Only what
+  # identifies it is stored. There are no access tokens here to leak.
+  class ConnectedAccount < ApplicationRecord
+    self.table_name = "action_auth_connected_accounts"
+
+    belongs_to :user, class_name: "ActionAuth::User"
+
+    validates :provider, :uid, presence: true
+    validates :uid, uniqueness: { scope: :provider }
+
+    # The provider may have been removed from the config since this was connected.
+    def provider_label
+      configured = ActionAuth.configuration.oauth_providers.find { |oauth| oauth.key == provider }
+      configured ? configured.label : provider.titleize
+    end
+  end
+end

data/app/models/action_auth/session.rb

@@ -4,8 +4,16 @@ module ActionAuth
 
     belongs_to :user, class_name: "ActionAuth::User", foreign_key: "user_id"
 
+    # The controllers refuse these with a message. This is what guarantees that no
+    # path, including a new one or an app's own sign in code, can get past that.
+    validate on: :create do
+      errors.add(:user, "is suspended") if user&.account_suspended?
+    end
+
     before_create do
-      self.user_agent = Current.user_agent
+      # Some in-app browsers send very long user agents, and a 255 character
+      # column on MySQL would refuse them and fail the sign in.
+      self.user_agent = Current.user_agent&.first(255)
       self.ip_address = Current.ip_address
     end
   end

data/app/models/action_auth/user.rb

@@ -2,6 +2,9 @@ module ActionAuth
   class User < ApplicationRecord
     self.table_name = "users"
 
+    SMS_EMAIL_SUFFIX = "@smsauth".freeze
+    OAUTH_EMAIL_SUFFIX = "@oauth".freeze
+
     has_secure_password
 
     has_many :sessions, dependent: :destroy,
@@ -12,21 +15,25 @@ module ActionAuth
         class_name: "ActionAuth::WebauthnCredential", foreign_key: "user_id"
     end
 
+    # No dependent option, because that would query a table that doesn't exist until
+    # the app has run the migration. The foreign key removes these with the user.
+    has_many :connected_accounts, class_name: "ActionAuth::ConnectedAccount", foreign_key: "user_id"
+
     generates_token_for :email_verification, expires_in: 2.days do
       email
     end
 
     generates_token_for :password_reset, expires_in: 20.minutes do
-      password_salt.last(10)
+      [password_salt.last(10), email]
     end
 
     generates_token_for :magic_token, expires_in: 20.minutes do
-      password_salt.last(10)
+      [password_salt.last(10), email, magic_link_used_at]
     end
 
     validates :email, presence: true, uniqueness: true, format: { with: URI::MailTo::EMAIL_REGEXP }
     validates :password, allow_nil: true, length: { minimum: 12 }
-    validate :password_complexity, if: -> { ActionAuth.configuration.password_complexity_check? && password.present? && !Rails.env.test? }
+    validate :password_complexity, if: -> { ActionAuth.configuration.password_complexity_check? && password.present? }
     validates :phone_number,
               allow_nil: true,
               uniqueness: true,
@@ -38,12 +45,28 @@ module ActionAuth
     normalizes :phone_number, with: -> phone_number { phone_number.gsub(/[^+\d]/, '') }
     normalizes :email, with: -> email { email.strip.downcase }
 
+    # Always written with the new email, even if this copy already reads false. Otherwise
+    # a verification of the old address finishing at the same moment would leave the new
+    # address marked as verified.
     before_validation if: :email_changed?, on: :update do
       self.verified = false
+      verified_will_change!
     end
 
     after_update if: :password_digest_previously_changed? do
-      sessions.where.not(id: Current.session).delete_all
+      sessions.where.not(id: Current.session&.id).delete_all
+      unlock_account!
+    end
+
+    # Lockout and suspension are on by default, so they're switched on for apps that
+    # have upgraded the gem but not yet run the migration. Until it has run they do
+    # nothing, rather than breaking sign in for everyone.
+    def self.account_lockout_available?
+      ActionAuth.configuration.account_lockout_enabled? && column_names.include?("account_locked_at")
+    end
+
+    def self.account_suspension_available?
+      ActionAuth.configuration.account_suspension_enabled? && column_names.include?("account_suspended_at")
     end
 
     def second_factor_enabled?
@@ -51,8 +74,178 @@ module ActionAuth
       webauthn_credentials.any?
     end
 
+    # Uses up every magic link sent so far, since their tokens include this value.
+    # Returns false to all but one of several simultaneous clicks: the update only
+    # matches if nobody has changed these values since this record was loaded. Holding
+    # a link also proves the email address is theirs. In a transaction, because a claim
+    # that half happened couldn't be tried again: the account would already be verified.
+    def claim_magic_link
+      address_was_unproven = !verified?
+      now = Time.current
+
+      transaction do
+        claimed = self.class.where(id: id, verified: verified, magic_link_used_at: magic_link_used_at)
+          .update_all(magic_link_used_at: now, verified: true, updated_at: now)
+        next false unless claimed == 1
+
+        reload
+        if address_was_unproven
+          self.password = SecureRandom.base58(32)
+          save!(validate: false)
+          remove_access_from_before_address_was_proven
+        end
+        true
+      end
+    end
+
+    # Verifying takes both the emailed link, which proves the inbox, and the password,
+    # which proves it's whoever set up this account. Neither is enough alone. Anyone can
+    # sign up with someone else's address and know the password, and that address's owner
+    # or their mail scanner can open the link without having signed up at all.
+    def verify_email_with_password(password)
+      keeping_emailed_address do
+        next false if account_locked? || !authenticate_password(password)
+
+        update!(verified: true)
+      end
+    end
+
+    # A reset link proves the inbox too, and it's how an address's owner takes over an
+    # account they don't know the password to, so it does what a first magic link does.
+    def reset_password_from_emailed_link(attributes)
+      keeping_emailed_address do
+        next false unless update(attributes)
+        next true if verified?
+
+        update_column(:verified, true)
+        remove_access_from_before_address_was_proven
+        true
+      end
+    end
+
+    # An account made by signing in with SMS, or through a provider that doesn't
+    # share an email address, has a random password and a placeholder email address,
+    # so nobody can know that password or reset it.
+    def password_usable?
+      !email.end_with?(SMS_EMAIL_SUFFIX, OAUTH_EMAIL_SUFFIX)
+    end
+
+    # How someone without a usable password proves it's them.
+    def fresh_sign_in_method
+      email.end_with?(OAUTH_EMAIL_SUFFIX) ? "your connected account" : "a new SMS code"
+    end
+
+    # Whether disconnecting +connected_account+ would leave a way to sign in.
+    def can_sign_in_without?(connected_account)
+      config = ActionAuth.configuration
+
+      password_usable? ||
+        connected_accounts.where.not(id: connected_account.id).exists? ||
+        (config.passkey_only? && webauthn_credentials.exists?) ||
+        (config.sms_auth_enabled? && phone_number.present?)
+    end
+
+    # Locks out the guessable factors, passwords and SMS codes. A magic link, passkey
+    # or connected account can't be guessed, so they still work. Without that, anyone
+    # who knew an email address could keep its owner out by failing on purpose.
+    def account_locked?
+      return false unless self.class.account_lockout_available? && account_locked_at
+
+      duration = ActionAuth.configuration.account_lockout_duration
+      duration.nil? || account_locked_at > duration.ago
+    end
+
+    # Counts a failed guess, and returns true if it's the one that locked the account.
+    # Uses single statements so that simultaneous guesses are all counted and only one
+    # of them locks the account, and an attempt during a lock doesn't extend it.
+    def register_failed_sign_in
+      unless self.class.account_lockout_available?
+        warn_about_lockout_migration
+        return false
+      end
+      return false if account_locked?
+
+      config = ActionAuth.configuration
+      account = self.class.where(id: id)
+
+      # Failures from a lock that has run out don't count towards the next one.
+      if config.account_lockout_duration
+        account.where(account_locked_at: ..config.account_lockout_duration.ago)
+          .update_all(account_locked_at: nil, failed_sign_in_attempts: 0)
+      end
+
+      self.class.update_counters(id, failed_sign_in_attempts: 1)
+      locked = account.where(account_locked_at: nil, failed_sign_in_attempts: config.account_lockout_max_attempts..)
+        .update_all(account_locked_at: Time.current)
+
+      reload
+      locked == 1
+    end
+
+    # Also runs whenever someone signs in or changes the password, which ends any
+    # lock and restarts the count.
+    def unlock_account!
+      return unless self.class.account_lockout_available?
+      return if failed_sign_in_attempts.zero? && account_locked_at.nil?
+
+      update_columns(failed_sign_in_attempts: 0, account_locked_at: nil)
+    end
+
+    def account_suspended?
+      self.class.account_suspension_available? && account_suspended_at.present?
+    end
+
+    # Blocks every way of signing in and signs the account out everywhere, until
+    # unsuspend_account!. Skips validations, because an old account that no longer
+    # passes them still has to be suspendable. Raises if it can't take effect, since
+    # someone suspending an account needs to know it didn't work.
+    def suspend_account!
+      unless self.class.account_suspension_available?
+        raise "ActionAuth can't suspend accounts. Check config.account_suspension_enabled, and run: " \
+          "bin/rails action_auth:install:migrations db:migrate"
+      end
+
+      transaction do
+        self.account_suspended_at = Time.current
+        save!(validate: false)
+        sessions.delete_all
+      end
+    end
+
+    def unsuspend_account!
+      self.account_suspended_at = nil
+      save!(validate: false)
+    end
+
     private
 
+    # Until now nobody had shown this address is theirs, so whoever set this account
+    # up may be a stranger: anyone can sign up with someone else's address, or change
+    # their own account to it. The address's owner mustn't end up sharing the account
+    # with them, so nothing from before this point can still get in.
+    #
+    # Security keys stay. They're still asked for after a magic link, so a stranger's
+    # key keeps the owner out rather than letting the two share an account, and removing
+    # keys would let someone holding only the inbox get past a second factor.
+    def remove_access_from_before_address_was_proven
+      sessions.delete_all
+      connected_accounts.destroy_all if ConnectedAccount.table_exists?
+    end
+
+    # A link only proves the address it was sent to. Hashing a password is slow enough
+    # for someone to change the email in the meantime, so this holds the row and checks
+    # that the address is still the one the link was checked against.
+    def keeping_emailed_address
+      address = email
+      with_lock { email == address && yield }
+    end
+
+    def warn_about_lockout_migration
+      return unless ActionAuth.configuration.account_lockout_enabled?
+
+      Rails.logger.warn "ActionAuth account lockout isn't active yet. Run: bin/rails action_auth:install:migrations db:migrate"
+    end
+
     def password_complexity
       return if password.blank?
 

data/app/models/action_auth/webauthn_credential.rb

@@ -2,6 +2,8 @@ module ActionAuth
   class WebauthnCredential < ApplicationRecord
     self.table_name = "webauthn_credentials"
 
+    belongs_to :user, class_name: "ActionAuth::User", optional: true
+
     validates :external_id, :public_key, :nickname, :sign_count, presence: true
     validates :external_id, uniqueness: true
     validates :sign_count,

data/app/views/action_auth/identity/email_verifications/show.html.erb

@@ -0,0 +1,23 @@
+<%= render "action_auth/shared/flash" %>
+
+<h1>Verify your email</h1>
+
+<p>Enter the password for this account to confirm that <strong><%= @user.email %></strong> is yours.</p>
+
+<%= form_with(url: identity_email_verification_path, method: :patch) do |form| %>
+  <%= form.hidden_field :sid, value: params[:sid] %>
+
+  <div class="mb-3">
+    <%= form.label :password, style: "display: block" %>
+    <%= form.password_field :password, required: true, autofocus: true, autocomplete: "current-password" %>
+  </div>
+
+  <div>
+    <%= form.submit "Verify email", class: "btn btn-primary" %>
+  </div>
+<% end %>
+
+<p>
+  Don't know the password? You can <%= link_to "reset it", new_identity_password_reset_path %>, which also verifies this
+  address. If you didn't sign up, you can ignore this and nothing will change.
+</p>

data/app/views/action_auth/identity/emails/edit.html.erb

@@ -1,50 +1,49 @@
+<%= render "action_auth/shared/flash" %>
 
-<% if user_signed_in? && ActionAuth::Current.user.verified? %>
-  <% header_text = "Change Your Email" %>
-  <% label_text = "New email" %>
-  <% button_text = "Save changes" %>
-  <% form_url = identity_email_path %>
-  <% form_method = :patch %>
-<% else %>
-  <% header_text = "Verify Your Email" %>
-  <% label_text = "Email" %>
-  <% button_text = "Send verification email" %>
-  <% form_url = identity_email_verification_path %>
-  <% form_method = :post %>
-<% end %>
-<h1><%= header_text %></h1>
-
-<p style="color: red"><%= alert %></p>
-
-<%= form_with(url: form_url, method: form_method) do |form| %>
-  <% if @user&.errors&.any? %>
-    <div style="color: red">
-      <h2><%= pluralize(@user.errors.count, "error") %> prohibited this user from being saved:</h2>
-      <ul>
-        <% @user.errors.each do |error| %>
-          <li><%= error.full_message %></li>
-        <% end %>
-      </ul>
+<% if user_signed_in? %>
+  <h1>Change Your Email</h1>
+
+  <%= form_with(url: identity_email_path, method: :patch) do |form| %>
+    <%= render "action_auth/shared/errors", record: @user %>
+
+    <div class="mb-3">
+      <%= form.label :email, "New email", style: "display: block" %>
+      <%= form.email_field :email, value: params[:email], required: true, autofocus: true, autocomplete: "email" %>
+    </div>
+
+    <div class="mb-3">
+      <%= form.label :password_challenge, "Current password", style: "display: block" %>
+      <%= form.password_field :password_challenge, required: true, autocomplete: "current-password" %>
+    </div>
+
+    <div class="mb-3">
+      <%= form.submit "Save changes", class: "btn btn-primary" %>
+    </div>
+  <% end %>
+
+  <% unless current_user.verified? %>
+    <div class="mb-3">
+      <p><%= current_user.email %> hasn't been verified yet.</p>
+      <%= button_to "Resend verification email", identity_email_verification_path, params: { email: current_user.email }, class: "btn btn-primary" %>
     </div>
   <% end %>
 
-  <div class="mb-3">
-    <%= form.label :email, label_text, style: "display: block" %>
-    <%= form.email_field :email, required: true, autofocus: true %>
+  <div>
+    <%= link_to "Back", sessions_path %>
   </div>
+<% else %>
+  <h1>Verify Your Email</h1>
 
-  <div class="mb-3">
-    <% if user_signed_in? && ActionAuth::Current.user.verified? %>
-      <%= form.submit button_text, class: "btn btn-primary" %>
-    <% else %>
-      <%= button_to button_text, identity_email_verification_path, class: "btn btn-primary" %>
-    <% end %>
+  <%= form_with(url: identity_email_verification_path) do |form| %>
+    <div class="mb-3">
+      <%= form.label :email, style: "display: block" %>
+      <%= form.email_field :email, required: true, autofocus: true, autocomplete: "email" %>
+    </div>
 
-  </div>
-<% end %>
+    <div class="mb-3">
+      <%= form.submit "Send verification email", class: "btn btn-primary" %>
+    </div>
+  <% end %>
 
-<div class="mb-3">
-  <%= link_to "Sign In", sign_in_path %> |
-  <%= link_to "Sign Up", sign_up_path %> |
-  <%= link_to "Reset Password", new_identity_password_reset_path %>
-</div>
+  <%= render "action_auth/shared/links" %>
+<% end %>