booth 0.0.8 → 0.0.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c779268526f086dc6da451ea8cd36969525d8db694fa94a4d6e9c81a1b7b7e0b
-  data.tar.gz: 1382ff82844424fe05b32d57faea6a76975eb986cfb4eb35dad81ef8e50a2068
+  metadata.gz: 88710c6c007c94f19ab956a66dc1592665f9de10f786ef5cd5eb8fb2b386fbee
+  data.tar.gz: 70f45c4a38f515c779ebda2705c142df7ca8ffb1279d5c5f49c2cf90fdacebfb
 SHA512:
-  metadata.gz: 744a4c6084155c5e6d36c1aaf0a389d373511988d31312befb5418f309bbc1a3a142efff2d6beedd90307a1ffa1b9ad6c59abb174b7c6ef5630f35fd6a79b606
-  data.tar.gz: f2fb21ae84bd0c98c4293a22dda5d7f4a5dd0484745b4e750be1fbeda029308791b0413ae2f16de506ce7986d757935d626da2be426038919a2502d30dcdb99e
+  metadata.gz: 1d08a6b4a1fa1f7b520952777509041f46232b31152c281d0851dbbbf32296fb84b8f4b62883ecb0e657800edbaec3e7a9fd12af09d753e65090e1dd505d355a
+  data.tar.gz: f5273c88aab4cb7425755b58f2e0eade47307748ae9fbbeae0e0fa0ab2ea8cff24e668dc3278bb83adf701ee1fa865780bd08e284c7a34366d079b745c4b6dea

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # main
 
+# 0.0.9
+
+- Implement Adminland.start_incognito
+
+# 0.0.8
+
+- Add a screenshot after every partial test
+
 # 0.0.7
 
 - Ensure authenticators#provide_icon_dark is always defined

data/config/locales/de.yml

@@ -21,6 +21,7 @@ de:
     domain_mismatch: Dieser Benutzername kann sich nicht hier einloggen.
     email_too_long: The provided email is too long. It must be less at most %{maximum} characters long.
     email_too_short: The provided email is too short. It should be at least %{minimum} characters long.
+    incognito_started: Sie sind jetzt im Namen eines anderen Kontos angemeldet.
     incompatible_webauth_device: Sorry, this device cannot be used. Please try another webauth device.
     invalid_domain: Die Domain "%{domain}" ist keine gültige Domain.
     invalid_email_characters: The provided email address contains invalid characters.
@@ -33,6 +34,7 @@ de:
     missing_secret_key: Missing the secret key parameter. Is the URL correct?
     mode_username_and_webauth_description: Auch bekannt als WebAuthentication (WebAuthn), FIDO2, CTAP2, Apple Passkey (Touch ID, Face ID).
     mode_username_and_webauth_title: Hardwareschlüssel (empfohlen)
+    not_logged_in_as_impersonator: Sie müssen angemeldet sein, um sich als jemand anderen auszugeben.
     onboarding_timeout: Sie hatten %{lifespan_hours} Stunden to access this onboarding link, but it took too long.
     permanently_blocked: You failed too many times for this account. Please contact customer service.
     remote_login_path: fernlogin
@@ -41,6 +43,7 @@ de:
     session_revoked: Das Gerät mit der IP %{ip} wurde erfolgreich ausgeloggt.
     some_authenticator_removed: Hardware key successfully deleted.
     successfully_logged_out: Sie haben sich erfolgreich ausgeloggt.
+    target_credential_not_found: Das Zielkonto wurde nicht gefunden.
     try_again_cooldown: Sie können es es in %{distance_of_time_until_cooldown} erneut probieren.
     uninitialized_credential: This account has not been initialized yet. Please contact support.
     unknown_email: We don't know that email.

data/config/locales/en.yml

@@ -21,6 +21,7 @@ en:
     domain_mismatch: This username cannot log in here.
     email_too_long: The provided email is too long. It must be less at most %{maximum} characters long.
     email_too_short: The provided email is too short. It should be at least %{minimum} characters long.
+    incognito_started: You are now acting on behalf of another account.
     incompatible_webauth_device: Sorry, this device cannot be used. Please try another webauth device.
     invalid_domain: The Domain "%{domain}" is not a valid domain name.
     invalid_email_characters: The provided email address contains invalid characters.
@@ -33,6 +34,7 @@ en:
     missing_secret_key: Missing the secret key parameter. Is the URL correct?
     mode_username_and_webauth_description: Also known as WebAuthentication (WebAuthn), FIDO2, CTAP2, Apple Passkey (Touch ID, Face ID).
     mode_username_and_webauth_title: Hardware key (recommended)
+    not_logged_in_as_impersonator: You must be logged in to impersonate someone.
     onboarding_timeout: You had %{lifespan_hours} hours to access this onboarding link, but it took too long.
     permanently_blocked: You failed too many times for this account. Please contact customer service.
     remote_login_path: remote
@@ -41,6 +43,7 @@ en:
     session_revoked: The logged in device with the IP %{ip} has successfully been logged out.
     some_authenticator_removed: Hardware key successfully deleted.
     successfully_logged_out: Logout successful.
+    target_credential_not_found: The target account could not be found.
     try_again_cooldown: You may try again in %{distance_of_time_until_cooldown}.
     uninitialized_credential: This account has not been initialized yet. Please contact support.
     unknown_email: We don't know that email.

data/lib/booth/adminland/incognitos/start.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+module Booth
+  module Adminland
+    module Incognitos
+      # The admin (impersonator) specifies their own +scope+ and a +target_scope+.
+      # +request+ is coerced with the impersonator's +scope+ (+request.authentication+ checks the
+      # impersonator's scope). We create a new session for the target credential and store the
+      # impersonator's credential_id as +incognito_credential_id+. If +target_scope+ matches the
+      # impersonator's scope, we revoke the impersonator's session before logging in as the target.
+      class Start
+        include Calls
+        include ::Booth::Logging
+
+        option :scope, ::Booth::Coercers::Scope
+        option :request, ::Booth::Coercers::Request
+        option :target_credential_id
+        option :target_scope
+
+        def call
+          do_check_impersonator_logged_in
+            .on_success { do_find_target_credential }
+            .on_success { do_compare_domain }
+            .on_success { do_compare_scope }
+            .on_success { do_create_session }
+            .on_success { do_revoke_impersonator_if_same_scope }
+            .on_success { do_login }
+        end
+
+        private
+
+        attr_accessor :impersonator_credential_id, :target_credential, :session
+
+        def do_check_impersonator_logged_in
+          unless request.authentication.logged_in?
+            log { 'No impersonator logged in' }
+            return Tron.failure :not_logged_in_as_impersonator,
+                                public_message: I18n.t('booth.not_logged_in_as_impersonator')
+          end
+
+          self.impersonator_credential_id = request.authentication.credential_id
+          log { "Impersonator credential_id=#{impersonator_credential_id}" }
+          Tron.success :impersonator_captured
+        end
+
+        def do_find_target_credential
+          self.target_credential = ::Booth::Models::Credential.find_by(id: target_credential_id)
+
+          if target_credential
+            log { "Target credential ##{target_credential.id} found" }
+            Tron.success :target_credential_found
+          else
+            Tron.failure :target_credential_not_found,
+                         public_message: I18n.t('booth.target_credential_not_found')
+          end
+        end
+
+        def do_compare_domain
+          ::Booth::Comparisons::Domain.call(
+            expected: target_credential.domain,
+            actual: request.host,
+          )
+        end
+
+        def do_compare_scope
+          ::Booth::Comparisons::Scope.call(
+            expected: target_credential.scope,
+            actual: target_scope,
+          )
+        end
+
+        def do_create_session
+          self.session = ::Booth::Models::Session.create!(
+            credential: target_credential,
+            incognito_credential_id: impersonator_credential_id,
+            agent: request.agent,
+            most_recent_ip: request.ip,
+          )
+          log { "Created incognito session ##{session.id}" }
+          Tron.success :session_created
+        end
+
+        def do_revoke_impersonator_if_same_scope
+          return Tron.success(:no_revoke_needed) unless same_scope?
+
+          impersonator_session = ::Booth::Models::Session.find_by(
+            id: request.authentication.session_id,
+          )
+          return Tron.failure(:impersonator_session_not_found) unless impersonator_session
+
+          log { "Revoking impersonator session ##{impersonator_session.id}" }
+          impersonator_session.update!(revoked_at: Time.current, revoke_reason: :impersonation)
+
+          Tron.success :impersonator_session_revoked
+        end
+
+        def do_login
+          target_auth.login(session:)
+          log { "Incognito started: #{target_credential.username}" }
+          Tron.success :incognito_started,
+                       public_message: I18n.t('booth.incognito_started')
+        end
+
+        def same_scope?
+          target_scope == request.scope
+        end
+
+        def target_auth
+          @target_auth ||= request.authentication(scope: target_scope)
+        end
+      end
+    end
+  end
+end

data/lib/booth/adminland.rb

@@ -44,6 +44,14 @@ module Booth
       ::Booth::Adminland::Onboardings::Destroy.call(...)
     end
 
+    # -----------------
+    # Incognito Helpers
+    # -----------------
+
+    def self.start_incognito(...)
+      ::Booth::Adminland::Incognitos::Start.call(...)
+    end
+
     # ----------------
     # Internal Helpers
     # ----------------

data/lib/booth/request.rb

@@ -4,6 +4,7 @@ module Booth
   # Convenience wrapper for Rack::Request.
   class Request
     include ::Booth::Logging
+
     # Initializes a new Booth::Request instance.
     #
     # **Parameters:**
@@ -77,7 +78,7 @@ module Booth
       ::Booth::Core::Geolocation.lookup(ip)
     end
 
-    def authentication
+    def authentication(scope: self.scope)
       ::Booth::Requests::Authentication.new(scope:, warden: request.env['warden'])
     end
 

data/lib/booth/requests/authentication.rb

@@ -6,7 +6,7 @@ module Booth
     class Authentication
       include ::Booth::Logging
 
-      delegate :username, :credential_id, :mode,
+      delegate :username, :credential_id, :incognito_credential_id, :mode,
                to: :passport,
                allow_nil: true
 

data/lib/booth/testing/support/assert_partial.rb

@@ -54,7 +54,7 @@ module Booth
         # Because doing this manually is very hard (would have to play through every scenario).
         def take_screenshot
           screenshot_dir.mkpath
-          path = screenshot_dir.join(::ActiveStorage::Filename.new(partial).sanitized)
+          path = screenshot_dir.join(partial.gsub(/[^a-zA-Z0-9._-]/, '_'))
           page.save_screenshot(path.to_s) # rubocop:disable Lint/Debugger
           log { "Screenshot saved to `#{path}`" }
         end

data/lib/booth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Booth
-  VERSION = '0.0.8'
+  VERSION = '0.0.9'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: booth
 version: !ruby/object:Gem::Version
-  version: 0.0.8
+  version: 0.0.9
 platform: ruby
 authors:
 - halo
@@ -230,6 +230,7 @@ files:
 - lib/booth/adminland/authenticators/exist.rb
 - lib/booth/adminland/credentials/create.rb
 - lib/booth/adminland/credentials/index.rb
+- lib/booth/adminland/incognitos/start.rb
 - lib/booth/adminland/onboardings/create.rb
 - lib/booth/adminland/onboardings/destroy.rb
 - lib/booth/adminland/onboardings/find.rb