decidim-verifications 0.31.8 → 0.32.0.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4f0ac0c1f45842d5bb1d1fd3b2834e4331f665fe1dd695d5e1d8fbd8316a0ec0
-  data.tar.gz: ef3a1596ec1fc37e9ea6c5a7d91eb4f3776f22ce7acc532e1dfb33e95f947d9c
+  metadata.gz: 18eeb490e000d6bdf84f6a1745e60fd21d005e88c2a9bb16a8e660b6b090ea2b
+  data.tar.gz: 82511430b2884829f35dae429c9bc611bf14c88f16f4328fa9d3a87e87dc560e
 SHA512:
-  metadata.gz: 127d52242a65b9011ed240076cf48c01d74a07d873675d56c0705d98f5bf0ee3e05d6789ec938fc8867479590128d705c65843e5749050a20d36613cb802f5ff
-  data.tar.gz: 5b7839ff8788b33e67b3e28aa6c6f726c34e19a264082626b128c7ecf1cb00593b67f6fd8df8a027a8b82514902a19b7ce280ffc730667c57a6f633375c8f3f0
+  metadata.gz: '096de425a399c348ec3f0964d53a484310686280b3ed1d28de458566585b7f65ea0b9bf306eb9706cbd37062c498661bcdfe0080f1a0875c0304d7c946cfeb34'
+  data.tar.gz: 5a7f737b1c79c194e1c859c5ef83c5fb07bf8fc2fae183ec3994fc60b27474f36e7590c8f0b188f707d1c7e29f1a0fb8e5cea4d9f765ea7ebdaf31de7cc22426

data/README.md

@@ -1,4 +1,4 @@
-# Decidim::Verifications
+# decidim-verifications
 
 Decidim offers several methods for allowing participants to get authorization to
 perform certain privileged actions. This module implements several of those methods
@@ -23,6 +23,10 @@ There are several use cases for this, such as
 Right now Decidim supports only a few of these cases, but we have an internal
 API where you can program your own kind of authorizations.
 
+## Usage
+
+This is a module oriented for developers, as a building block to be used by other modules.
+
 ## Introduction
 
 Each decidim instance is in full control of its authorizations, and can customize:
@@ -151,7 +155,7 @@ In order to setup Decidim with SMS verification you need to:
 Keep in mind that Decidim will not store a free text version of the mobile phone, only a hashed
 version so we can avoid duplicates and guarantee the users' privacy.
 
-You can find an example [here][example SMS gateway].
+You can find an example in the [example SMS gateway implementation][example SMS gateway].
 
 ## Authorization options
 
@@ -243,17 +247,7 @@ authorization.
 
 ## Installation
 
-Add this line to your application's Gemfile:
-
-```ruby
-gem 'decidim-verifications'
-```
-
-And then execute:
-
-```bash
-bundle
-```
+This is on the default Decidim installation so you should not change anything to use this feature.
 
 ## Contributing
 

data/app/commands/decidim/verifications/confirm_user_authorization.rb

@@ -4,41 +4,36 @@ module Decidim
   module Verifications
     # A command to confirm a previous partial authorization.
     class ConfirmUserAuthorization < Decidim::Command
+      # Number of failed confirmation attempts before throttling.
+      MAX_FAILED_ATTEMPTS = 2
+
       # Public: Initializes the command.
       #
       # authorization - An Authorization to be confirmed.
       # form - A form object with the verification data to confirm it.
-      def initialize(authorization, form)
+      def initialize(authorization, form, session)
         @authorization = authorization
         @form = form
+        @session = session
       end
 
       # Executes the command. Broadcasts these events:
       #
       # - :ok when everything is valid.
       # - :invalid if the handler was not valid and we could not proceed.
-      # - :locked if too many failed attempts and the authorization is locked.
-      # - :expired if the verification code has expired.
       #
       # Returns nothing.
       def call
         return already_confirmed! if authorization.granted?
 
-        Decidim::Authorization.transaction do
-          authorization.lock!
-          authorization.clear_expired_lock!
-
-          return locked! if authorization.locked_for_confirmation?
-
-          return invalid! unless form.valid?
+        return invalid! unless form.valid?
 
-          return expired! if code_expired?
+        throttle! if too_many_failed_attempts?
 
-          if confirmation_successful?
-            valid!
-          else
-            invalid!
-          end
+        if confirmation_successful?
+          valid!
+        else
+          invalid!
         end
       rescue StandardError => e
         invalid!(e.message)
@@ -56,39 +51,41 @@ module Decidim
 
       def valid!
         authorization.grant!
-        authorization.reset_failed_attempts!
+        reset_failed_attempts!
         broadcast(:ok)
       end
 
       def invalid!(message = nil)
-        authorization.record_failed_attempt!
+        record_failed_attempt!
         broadcast(:invalid, message)
       end
 
       def already_confirmed!
-        authorization.reset_failed_attempts!
+        reset_failed_attempts!
         broadcast(:already_confirmed)
       end
 
-      def locked!
-        broadcast(:locked)
+      def too_many_failed_attempts?
+        failed_attempts > MAX_FAILED_ATTEMPTS
       end
 
-      def code_expired?
-        sent_at = authorization.verification_metadata["code_sent_at"]
-        return false unless sent_at
+      def failed_attempts
+        session[:failed_attempts] ||= 0
+      end
+
+      def reset_failed_attempts!
+        session[:failed_attempts] = 0
+      end
 
-        sent_at = Time.zone.parse(sent_at.to_s) if sent_at.is_a?(String)
-        sent_at < Decidim.verification_code_expiry_minutes.minutes.ago
+      def record_failed_attempt!
+        session[:failed_attempts] = failed_attempts + 1
       end
 
-      def expired!
-        authorization.update!(verification_metadata: {})
-        authorization.reset_failed_attempts!
-        broadcast(:expired)
+      def throttle!
+        sleep rand * failed_attempts
       end
 
-      attr_reader :authorization, :form
+      attr_reader :authorization, :form, :session
     end
   end
 end

data/app/commands/decidim/verifications/csv_census/confirm_census_authorization.rb

@@ -7,20 +7,11 @@ module Decidim
         def call
           return broadcast(:invalid) unless form.valid?
 
-          Decidim::Authorization.transaction do
-            authorization.lock!
-            authorization.clear_expired_lock!
-
-            return broadcast(:locked) if authorization.locked_for_confirmation?
-
-            if confirmation_successful?
-              authorization.grant!
-              authorization.reset_failed_attempts!
-              broadcast(:ok)
-            else
-              authorization.record_failed_attempt!
-              broadcast(:invalid)
-            end
+          if confirmation_successful?
+            authorization.grant!
+            broadcast(:ok)
+          else
+            broadcast(:invalid)
           end
         end
       end

data/app/commands/decidim/verifications/perform_authorization_step.rb

@@ -34,9 +34,7 @@ module Decidim
           unique_id: handler.unique_id,
           metadata: handler.metadata,
           verification_metadata: handler.verification_metadata,
-          verification_attachment: handler.verification_attachment,
-          failed_attempts: 0,
-          locked_at: nil
+          verification_attachment: handler.verification_attachment
         }
 
         authorization.save!

data/app/commands/decidim/verifications/revoke_all_authorizations.rb

@@ -22,7 +22,20 @@ module Decidim
       def call
         return broadcast(:invalid) unless @organization
 
-        RevokeAllAuthorizationsJob.perform_later(organization, current_user)
+        auths = Decidim::Verifications::Authorizations.new(
+          organization:,
+          granted: true
+        ).query
+
+        auths.find_each do |auth|
+          Decidim.traceability.perform_action!(
+            :destroy,
+            auth,
+            current_user
+          ) do
+            auth.destroy
+          end
+        end
 
         broadcast(:ok)
       end

data/app/commands/decidim/verifications/revoke_by_condition_authorizations.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Verifications
+    # A command to revoke authorizations with filter
+    class RevokeByConditionAuthorizations < Decidim::Command
+      delegate :current_user, to: :form
+      # Public: Initializes the command.
+      #
+      # organization - Organization object.
+      # current_user - The current user.
+      # form - A form object with the verification data to confirm it.
+      def initialize(organization, form)
+        @organization = organization
+        @form = form
+      end
+
+      # Executes the command. Broadcasts these events:
+      #
+      # - :ok when everything is valid.
+      # - :invalid if the handler was not valid and we could not proceed.
+      #
+      # Returns nothing.
+      def call
+        return broadcast(:invalid) unless @organization
+        return broadcast(:invalid) unless @form.valid?
+
+        # Check before date
+        if @form.before_date.present?
+          authorizations_to_revoke = if @form.impersonated_only?
+                                       Decidim::Verifications::AuthorizationsBeforeDate.new(
+                                         organization:,
+                                         date: @form.before_date,
+                                         granted: true,
+                                         impersonated_only: @form.impersonated_only
+                                       )
+                                     else
+                                       Decidim::Verifications::AuthorizationsBeforeDate.new(
+                                         organization:,
+                                         date: @form.before_date,
+                                         granted: true
+                                       )
+                                     end
+
+          auths = authorizations_to_revoke.query
+          auths.find_each do |auth|
+            Decidim.traceability.perform_action!(
+              :destroy,
+              auth,
+              current_user
+            ) do
+              auth.destroy
+            end
+          end
+
+          broadcast(:ok)
+
+        else
+          broadcast(:invalid)
+        end
+      end
+
+      private
+
+      attr_reader :organization, :form
+    end
+  end
+end

data/app/controllers/concerns/decidim/verifications/renewable.rb

@@ -7,6 +7,7 @@ module Decidim
     # Common logic to renew authorizations
     module Renewable
       extend ActiveSupport::Concern
+
       included do
         def renew
           enforce_permission_to(:renew, :authorization, authorization:)

data/app/controllers/decidim/verifications/admin/verifications_controller.rb

@@ -9,7 +9,7 @@ module Decidim
           return unless params.has_key?(:revocations_before_date)
 
           form = RevocationsBeforeDateForm.from_params(params[:revocations_before_date])
-          RevokeAuthorizationsByCondition.call(current_organization, form) do
+          RevokeByConditionAuthorizations.call(current_organization, form) do
             on(:ok) do
               flash[:notice] = t("authorization_revocation.destroy_ok", scope: "decidim.admin.menu")
               redirect_to decidim_admin.authorization_workflows_url

data/app/controllers/decidim/verifications/application_controller.rb

@@ -10,8 +10,6 @@ module Decidim
 
       before_action :confirmed_user, only: [:new, :create, :renew]
 
-      protected
-
       def new
         raise NotImplementedError
       end
@@ -29,9 +27,8 @@ module Decidim
       def confirmed_user
         return true if !current_user || (current_user && current_user.verifiable?)
 
-        redirect_back(
-          fallback_location: root_path,
-          alert: t(
+        redirect_back_or_to(
+          root_path, alert: t(
             "authorizations.create.unconfirmed",
             scope: "decidim.verifications"
           )

data/app/controllers/decidim/verifications/authorizations_controller.rb

@@ -14,23 +14,18 @@ module Decidim
       include Decidim::UserProfile
       include Decidim::HtmlSafeFlash
       include Decidim::Verifications::Renewable
+
       helper Decidim::DecidimFormHelper
       helper Decidim::AuthorizationFormHelper
       helper Decidim::TranslationsHelper
 
       layout "layouts/decidim/authorizations", except: [:index, :onboarding_pending]
 
-      def new
-        enforce_permission_to :read, :authorization
-      end
+      def new; end
 
-      def index
-        enforce_permission_to :read, :authorization
-      end
+      def index; end
 
       def onboarding_pending
-        enforce_permission_to :read, :authorization
-
         return redirect_back_or_to(authorizations_path) unless onboarding_manager.valid?
 
         authorizations = action_authorized_to(onboarding_manager.action, **onboarding_manager.action_authorized_resources)
@@ -61,8 +56,6 @@ module Decidim
       end
 
       def create
-        enforce_permission_to(:create, :authorization, authorization:)
-
         AuthorizeUser.call(handler, current_organization) do
           on(:ok) do
             flash[:notice] = t("authorizations.create.success", scope: "decidim.verifications")
@@ -94,22 +87,18 @@ module Decidim
 
           on(:invalid) do
             flash[:alert] = t("authorizations.create.error", scope: "decidim.verifications")
-            render action: :new, status: :unprocessable_entity
+            render action: :new, status: :unprocessable_content
           end
         end
       end
 
       def renew_onboarding_data
-        enforce_permission_to :read, :authorization
-
         store_onboarding_cookie_data!(current_user)
 
         redirect_to onboarding_pending_authorizations_path
       end
 
       def clear_onboarding_data
-        enforce_permission_to :read, :authorization
-
         clear_onboarding_data!(current_user)
       end
 
@@ -163,7 +152,7 @@ module Decidim
         authorizations = action_authorized_to(onboarding_manager.action, **onboarding_manager.action_authorized_resources)
         return unless authorizations.ephemeral?
 
-        form = Decidim::EphemeralUserForm.new(organization: current_organization, locale: current_locale)
+        form = Decidim::EphemeralUserForm.new(organization: current_organization)
         CreateEphemeralUser.call(form) do
           on(:ok) do |ephemeral_user|
             sign_in(ephemeral_user)
@@ -198,7 +187,7 @@ module Decidim
       private
 
       def authorization
-        @authorization ||= Decidim::Authorization.find_or_initialize_by(
+        @authorization ||= Decidim::Authorization.find_by(
           user: current_user,
           name: handler_name
         )

data/app/controllers/decidim/verifications/csv_census/admin/census_controller.rb

@@ -18,13 +18,9 @@ module Decidim
 
           helper_method :csv_census_data, :last_login
 
-          def index
-            enforce_permission_to :index, :authorization
-          end
+          def index; end
 
           def destroy
-            enforce_permission_to :destroy, :authorization
-
             Decidim::Commands::DestroyResource.call(census_data, current_user) do
               on(:ok) do
                 flash[:notice] = I18n.t("census.destroy.success", scope: "decidim.verifications.csv_census.admin")
@@ -34,15 +30,12 @@ module Decidim
           end
 
           def new_import
-            enforce_permission_to :create, :authorization
-
             @form = form(CensusDataForm).from_params(params)
             @status = Status.new(current_organization)
           end
 
           def create_import
             enforce_permission_to :create, :authorization
-
             @form = form(CensusDataForm).from_params(params)
             @status = Status.new(current_organization)
 
@@ -83,7 +76,6 @@ module Decidim
 
           def show_instructions
             enforce_permission_to :index, :authorization
-
             render :instructions
           end
 
@@ -96,7 +88,7 @@ module Decidim
 
             return { icon: nil, text: t(".no_user"), last_sign_in: nil } unless user
 
-            authorized = Decidim::Authorization.where(name: "csv_census", user:) # rubocop:disable Decidim/OrganizationScopedFinder -- user is already scoped to current_organization (line 95)
+            authorized = Decidim::Authorization.where(name: "csv_census", user:)
                                                .where.not(granted_at: nil)
                                                .exists?
 

data/app/controllers/decidim/verifications/csv_census/admin/census_records_controller.rb

@@ -10,14 +10,10 @@ module Decidim
           helper_method :csv_census_data
 
           def new_record
-            enforce_permission_to :create, :authorization
-
             @form = form(Admin::CensusForm).instance
           end
 
           def create_record
-            enforce_permission_to :create, :authorization
-
             @form = form(Admin::CensusForm).from_params(params)
             Admin::CreateCensusRecord.call(@form) do
               on(:ok) do
@@ -26,20 +22,16 @@ module Decidim
               end
 
               on(:invalid) do
-                render :new_record, status: :unprocessable_entity
+                render :new_record, status: :unprocessable_content
               end
             end
           end
 
           def edit_record
-            enforce_permission_to :update, :authorization
-
             @form = form(Admin::CensusForm).from_model(census_data)
           end
 
           def update_record
-            enforce_permission_to :update, :authorization
-
             @form = form(Admin::CensusForm).from_params(params)
 
             Admin::UpdateCensusRecord.call(@form, census_data) do
@@ -50,7 +42,7 @@ module Decidim
 
               on(:invalid) do
                 flash.now[:alert] = I18n.t("census_records.update_record.invalid", scope: "decidim.verifications.csv_census.admin")
-                render action: "edit_record", status: :unprocessable_entity
+                render action: "edit_record", status: :unprocessable_content
               end
             end
           end

data/app/controllers/decidim/verifications/csv_census/authorizations_controller.rb

@@ -11,19 +11,14 @@ module Decidim
         before_action :load_authorization
 
         def new
-          enforce_permission_to :create, :authorization, authorization: @authorization
-
           @form = CensusForm.from_params(user: current_user)
-          ConfirmCensusAuthorization.call(@authorization, @form) do
+          ConfirmCensusAuthorization.call(@authorization, @form, session) do
             on(:ok) do
               flash[:notice] = t("authorizations.new.success", scope: "decidim.verifications.csv_census")
             end
             on(:invalid) do
               flash[:alert] = t("authorizations.new.error", scope: "decidim.verifications.csv_census")
             end
-            on(:locked) do
-              flash[:alert] = t("authorizations.new.locked", scope: "decidim.verifications.csv_census")
-            end
             redirect_to decidim_verifications.authorizations_path
           end
         end

data/app/controllers/decidim/verifications/id_documents/admin/config_controller.rb

@@ -33,7 +33,7 @@ module Decidim
 
               on(:invalid) do
                 flash.now[:alert] = t("config.update.error", scope: "decidim.verifications.id_documents.admin")
-                render action: :edit, status: :unprocessable_entity
+                render action: :edit, status: :unprocessable_content
               end
             end
           end

data/app/controllers/decidim/verifications/id_documents/admin/confirmations_controller.rb

@@ -13,7 +13,6 @@ module Decidim
           before_action :load_pending_authorization
 
           include Decidim::Admin::WorkflowsBreadcrumb
-          include Decidim::Verifications::Admin::PendingAuthorizationLoader
 
           add_breadcrumb_item_from_menu :workflows_menu
 
@@ -28,7 +27,7 @@ module Decidim
 
             @form = InformationForm.from_params(params)
 
-            ConfirmUserAuthorization.call(@pending_authorization, @form) do
+            ConfirmUserAuthorization.call(@pending_authorization, @form, session) do
               on(:ok) do
                 flash[:notice] = t("confirmations.create.success", scope: "decidim.verifications.id_documents.admin")
                 redirect_to pending_authorizations_path
@@ -36,12 +35,7 @@ module Decidim
 
               on(:invalid) do
                 flash.now[:alert] = t("confirmations.create.error", scope: "decidim.verifications.id_documents.admin")
-                render action: :new, status: :unprocessable_entity
-              end
-
-              on(:locked) do
-                flash.now[:alert] = t("confirmations.create.locked", scope: "decidim.verifications.id_documents.admin")
-                render action: :new, status: :too_many_requests
+                render action: :new, status: :unprocessable_content
               end
             end
           end
@@ -49,7 +43,7 @@ module Decidim
           private
 
           def load_pending_authorization
-            @pending_authorization = load_pending_authorization!("id_documents", params[:pending_authorization_id])
+            @pending_authorization = Authorization.find(params[:pending_authorization_id])
           end
         end
       end

data/app/controllers/decidim/verifications/id_documents/admin/offline_confirmations_controller.rb

@@ -33,7 +33,7 @@ module Decidim
 
               on(:invalid) do
                 flash.now[:alert] = t("offline_confirmations.create.error", scope: "decidim.verifications.id_documents.admin")
-                render action: :new, status: :unprocessable_entity
+                render action: :new, status: :unprocessable_content
               end
             end
           end

data/app/controllers/decidim/verifications/id_documents/admin/rejections_controller.rb

@@ -13,7 +13,6 @@ module Decidim
           before_action :load_pending_authorization
 
           include Decidim::Admin::WorkflowsBreadcrumb
-          include Decidim::Verifications::Admin::PendingAuthorizationLoader
 
           add_breadcrumb_item_from_menu :workflows_menu
 
@@ -33,7 +32,7 @@ module Decidim
           private
 
           def load_pending_authorization
-            @pending_authorization = load_pending_authorization!("id_documents", params[:pending_authorization_id])
+            @pending_authorization = Authorization.find(params[:pending_authorization_id])
           end
         end
       end

data/app/controllers/decidim/verifications/id_documents/authorizations_controller.rb

@@ -14,8 +14,6 @@ module Decidim
         before_action :load_authorization
 
         def choose
-          enforce_permission_to :create, :authorization, authorization: @authorization
-
           url_params = { redirect_url: }.compact
 
           return redirect_to(action: :new, **url_params.merge(using: verification_type)) if available_methods.count == 1
@@ -44,7 +42,7 @@ module Decidim
 
             on(:invalid) do
               flash.now[:alert] = t("authorizations.create.error", scope: "decidim.verifications.id_documents")
-              render action: :new, status: :unprocessable_entity
+              render action: :new, status: :unprocessable_content
             end
           end
         end
@@ -74,7 +72,7 @@ module Decidim
 
             on(:invalid) do
               flash.now[:alert] = t("authorizations.update.error", scope: "decidim.verifications.id_documents")
-              render action: :edit, status: :unprocessable_entity
+              render action: :edit, status: :unprocessable_content
             end
           end
         end

data/app/controllers/decidim/verifications/postal_letter/admin/postages_controller.rb

@@ -13,7 +13,6 @@ module Decidim
           before_action :load_pending_authorization
 
           include Decidim::Admin::WorkflowsBreadcrumb
-          include Decidim::Verifications::Admin::PendingAuthorizationLoader
 
           add_breadcrumb_item_from_menu :workflows_menu
 
@@ -29,7 +28,7 @@ module Decidim
               end
 
               on(:invalid) do
-                render json: { error: I18n.t("postages.create.error", scope: "decidim.verifications.postal_letter.admin") }, status: :unprocessable_entity
+                render json: { error: I18n.t("postages.create.error", scope: "decidim.verifications.postal_letter.admin") }, status: :unprocessable_content
               end
             end
           end
@@ -37,7 +36,7 @@ module Decidim
           private
 
           def load_pending_authorization
-            @pending_authorization = load_pending_authorization!("postal_letter", params[:pending_authorization_id])
+            @pending_authorization = Authorization.find(params[:pending_authorization_id])
           end
         end
       end