ditty 0.7.1 → 0.10.1

data/lib/ditty/controllers/{auth.rb → auth_controller.rb}

@@ -1,53 +1,63 @@
-require 'ditty/controllers/application'
+# frozen_string_literal: true
+
+require 'ditty/controllers/application_controller'
 require 'ditty/services/email'
 require 'securerandom'
 
 module Ditty
-  class Auth < Application
+  class AuthController < ApplicationController
     set track_actions: true
 
-    def find_template(views, name, engine, &block)
-      super(views, name, engine, &block) # Root
-      super(::Ditty::App.view_folder, name, engine, &block) # Basic Plugin
+    def redirect_path
+      return "#{settings.map_path}/" if omniauth_redirect_path.nil?
+      return "#{settings.map_path}/" if omniauth_redirect_path.match? %r{/#{settings.map_path}/auth/?}
+
+      omniauth_redirect_path
     end
 
-    def redirect_path
-      return "#{settings.map_path}/" unless env['omniauth.origin']
-      return "#{settings.map_path}/" if env['omniauth.origin'] =~ %r{/#{settings.map_path}/auth/?}
-      env['omniauth.origin']
+    def omniauth_redirect_path
+      env['omniauth.origin'] || request.session['omniauth.origin']
     end
 
     def omniauth_callback(provider)
       return failed_login unless env['omniauth.auth']
+
+      broadcast("before_#{provider}_login".to_sym, env['omniauth.auth'])
       user = User.first(email: env['omniauth.auth']['info']['email'])
-      user = register_user if user.nil? && ['ldap', 'google_oauth2'].include?(provider)
+      user = register_user if user.nil? && authorize(::Ditty::User, :register?)
       return failed_login if user.nil?
+
+      broadcast("#{provider}_login".to_sym, user)
       successful_login(user)
     end
 
     def failed_login
-      broadcast(:user_failed_login, target: self, details: "IP: #{request.ip}")
-      flash[:warning] = 'Invalid credentials. Please try again.'
+      details = params[:message] || 'None'
+      logger.warn "Invalid Login: #{details}"
+      broadcast(:user_failed_login, target: self, details: details)
+      flash[:warning] = 'Invalid credentials. Please try again'
+      headers 'X-Authentication-Failure' => params[:message] if params[:message]
       redirect "#{settings.map_path}/auth/login"
     end
 
     def successful_login(user)
       halt 200 if request.xhr?
       self.current_user = user
-      broadcast(:user_login, target: self, details: "IP: #{request.ip}")
+      broadcast(:user_login, target: self)
       flash[:success] = 'Logged In'
       redirect redirect_path
     end
 
     def register_user
       user = User.create(email: env['omniauth.auth']['info']['email'])
-      broadcast(:user_register, target: self, values: { user: user }, details: "IP: #{request.ip}")
+      broadcast(:user_register, target: self, values: { user: user })
       flash[:info] = 'Successfully Registered.'
       user
     end
 
     before '/login' do
       return if User.where(roles: Role.find_or_create(name: 'super_admin')).count.positive?
+
       flash[:info] = 'Please register the super admin user.'
       redirect "#{settings.map_path}/auth/register"
     end
@@ -55,14 +65,24 @@ module Ditty
     # TODO: Make this work for both LDAP and Identity
     get '/login' do
       authorize ::Ditty::Identity, :login
+      redirect settings.map_path if authenticated?
 
-      haml :'auth/login', locals: { title: 'Log In' }
+      haml :'auth/login', locals: { title: 'Log In' }, layout: :blank
+    end
+
+    # Custom login form for LDAP to allow CSRF checks. Set the `request_path` for
+    # the omniauth-ldap provider to another path so that this gest triggered
+    get '/ldap' do
+      authorize ::Ditty::Identity, :login
+      redirect settings.map_path if authenticated?
+
+      haml :'auth/ldap', locals: { title: 'Company Log In' }, layout: :blank
     end
 
     get '/forgot-password' do
       authorize ::Ditty::Identity, :forgot_password
 
-      haml :'auth/forgot_password', locals: { title: 'Forgot your password?' }
+      haml :'auth/forgot_password', locals: { title: 'Forgot your password?' }, layout: :blank
     end
 
     post '/forgot-password' do
@@ -76,15 +96,18 @@ module Ditty
         token = SecureRandom.hex(16)
         identity.update(reset_token: token, reset_requested: Time.now)
         # Send Email
-        reset_url = "#{request.base_url}#{settings.map_path}/reset-password?token=#{token}"
-        Ditty::Services::Email.deliver(
+        reset_url = "#{request.base_url}#{settings.map_path}/auth/reset-password?token=#{token}"
+        ::Ditty::Services::Email.deliver(
           :forgot_password,
           email,
           locals: { identity: identity, reset_url: reset_url, request: request }
         )
       end
       flash[:info] = 'An email was sent to the email provided with instructions on how to reset your password'
-      redirect '/login'
+      redirect "#{settings.map_path}/auth/login"
+    rescue Sinatra::Param::InvalidParameterError
+      flash[:warning] = 'Email address not provided'
+      redirect back
     end
 
     get '/reset-password' do
@@ -92,9 +115,9 @@ module Ditty
 
       param :token, String, required: true
       identity = Identity[reset_token: params[:token]]
-      halt 404 unless identity && identity.reset_requested && identity.reset_requested > (Time.now - (24 * 60 * 60))
+      halt 404 unless identity&.reset_requested && identity.reset_requested > (Time.now - (24 * 60 * 60))
 
-      haml :'auth/reset_password', locals: { title: 'Reset your password', identity: identity }
+      haml :'auth/reset_password', locals: { title: 'Reset your password', identity: identity }, layout: :blank
     end
 
     put '/reset-password' do
@@ -104,15 +127,15 @@ module Ditty
       halt 404 unless identity
       authorize identity, :reset_password
 
-      identity_params = permitted_attributes(Identity, :update)
+      identity_params = permitted_parameters(Identity, :update)
       identity.set identity_params.merge(reset_token: nil, reset_requested: nil)
-      if identity.valid? && identity.save
-        broadcast(:identity_update_password, target: self, details: "IP: #{request.ip}")
+      if identity.valid? && identity.save_changes
+        broadcast(:identity_update_password, target: self)
         flash[:success] = 'Password Updated'
         redirect "#{settings.map_path}/auth/login"
       else
-        broadcast(:identity_update_password_failed, target: self, details: "IP: #{request.ip}")
-        haml :'auth/reset_password', locals: { title: 'Reset your password', identity: identity }
+        broadcast(:identity_update_password_failed, target: self)
+        haml :'auth/reset_password', locals: { title: 'Reset your password', identity: identity }, layout: :blank
       end
     end
 
@@ -121,7 +144,7 @@ module Ditty
       authorize ::Ditty::User.new, :register
 
       identity = Identity.new
-      haml :'auth/register', locals: { title: 'Register', identity: identity }
+      haml :'auth/register', locals: { title: 'Register', identity: identity }, layout: :blank
     end
 
     # Register Action
@@ -132,27 +155,28 @@ module Ditty
       authorize user, :register
 
       begin
+        identity.valid?
         DB.transaction do
-          user.save
+          user.save_changes
           user.add_identity identity
-          broadcast(:user_register, target: self, values: { user: user }, details: "IP: #{request.ip}")
+          broadcast(:user_register, target: self, values: { user: user })
           flash[:info] = 'Successfully Registered. Please log in'
           redirect "#{settings.map_path}/auth/login"
         end
       rescue Sequel::ValidationFailed
         flash.now[:warning] = 'Could not complete the registration. Please try again.'
-        haml :'auth/register', locals: { identity: identity }
+        haml :'auth/register', locals: { identity: identity }, layout: :blank
       end
     end
 
     # Logout Action
     delete '/' do
-      broadcast(:user_logout, target: self, details: "IP: #{request.ip}")
+      broadcast(:user_logout, target: self)
       logout
 
       halt 200 if request.xhr?
       flash[:info] = 'Logged Out'
-      redirect(Ditty::Services::Settings[:logout_redirect_path] || "#{settings.map_path}/")
+      redirect(::Ditty::Services::Settings[:logout_redirect_path] || "#{settings.map_path}/")
     end
 
     # Unauthenticated

data/lib/ditty/controllers/{component.rb → component_controller.rb}

@@ -1,36 +1,50 @@
 # frozen_string_literal: true
 
-require 'ditty/controllers/application'
+require 'ditty/controllers/application_controller'
 require 'ditty/helpers/component'
 require 'ditty/helpers/response'
 require 'sinatra/json'
 
 module Ditty
-  class Component < Application
+  class ComponentController < ApplicationController
     helpers Helpers::Component, Helpers::Response
 
     set base_path: nil
     set dehumanized: nil
     set view_location: nil
     set track_actions: false
+    set heading: nil
 
     def read(id)
-      dataset.first(settings.model_class.primary_key => id)
+      dataset.with_pk(id)
+    end
+
+    def read!(id)
+      halt 404 unless (entity = read(id))
+      entity
     end
 
     def skip_verify!
       @skip_verify = true
     end
 
+    def trigger(event, attribs = {})
+      attribs[:target] ||= self
+      send(event, attribs) if respond_to? event
+      broadcast(event, attribs)
+    end
+
     after do
       return if settings.environment == 'production'
-      if (response.successful? || response.redirection?) && @skip_verify == false
-        verify_authorized if settings.environment != 'production'
+
+      if (response.successful? || response.redirection?) && @skip_verify == false && (settings.environment != 'production')
+        verify_authorized
       end
     end
 
     after '/' do
       return if settings.environment == 'production' || request.request_method != 'GET'
+
       verify_policy_scoped if (response.successful? || response.redirection?) && @skip_verify == false
     end
 
@@ -40,7 +54,8 @@ module Ditty
 
       result = list
 
-      broadcast(:component_list, target: self)
+      trigger :component_list
+
       list_response(result)
     end
 
@@ -48,8 +63,7 @@ module Ditty
     get '/new/?' do
       authorize settings.model_class, :create
 
-      entity = settings.model_class.new(permitted_attributes(settings.model_class, :create))
-      session[:redirect_to] = request.fullpath
+      entity = settings.model_class.new(permitted_parameters(settings.model_class, :create))
       haml :"#{view_location}/new",
            locals: { entity: entity, title: heading(:new) },
            layout: layout
@@ -57,12 +71,12 @@ module Ditty
 
     # Create
     post '/' do
-      entity = settings.model_class.new(permitted_attributes(settings.model_class, :create))
+      entity = settings.model_class.new(permitted_parameters(settings.model_class, :create))
       authorize entity, :create
 
       entity.db.transaction do
-        entity.save # Will trigger a Sequel::ValidationFailed exception if the model is incorrect
-        broadcast(:component_create, target: self, entity: entity)
+        entity.save_changes # Will trigger a Sequel::ValidationFailed exception if the model is incorrect
+        trigger :component_create, entity: entity
       end
 
       create_response(entity)
@@ -70,20 +84,19 @@ module Ditty
 
     # Read
     get '/:id/?' do |id|
-      entity = read(id)
-      halt 404 unless entity
+      entity = read!(id)
       authorize entity, :read
 
-      broadcast(:component_read, target: self, entity: entity)
+      trigger :component_read, entity: entity
       read_response(entity)
     end
 
     # Update Form
     get '/:id/edit/?' do |id|
-      entity = read(id)
-      halt 404 unless entity
+      entity = read!(id)
       authorize entity, :update
 
+      flash[:redirect_to] = "#{base_path}/#{entity.display_id}" unless flash.keep(:redirect_to)
       haml :"#{view_location}/edit",
            locals: { entity: entity, title: heading(:edit) },
            layout: layout
@@ -91,27 +104,25 @@ module Ditty
 
     # Update
     put '/:id/?' do |id|
-      entity = read(id)
-      halt 404 unless entity
+      entity = read!(id)
       authorize entity, :update
 
       entity.db.transaction do
-        entity.set(permitted_attributes(settings.model_class, :update))
-        entity.save # Will trigger a Sequel::ValidationFailed exception if the model is incorrect
-        broadcast(:component_update, target: self, entity: entity)
+        entity.set(permitted_parameters(settings.model_class, :update))
+        entity.save_changes # Will trigger a Sequel::ValidationFailed exception if the model is incorrect
+        trigger :component_update, entity: entity
       end
 
       update_response(entity)
     end
 
     delete '/:id/?' do |id|
-      entity = read(id)
-      halt 404 unless entity
+      entity = read!(id)
       authorize entity, :delete
 
       entity.db.transaction do
         entity.destroy
-        broadcast(:component_delete, target: self, entity: entity)
+        trigger :component_delete, entity: entity
       end
 
       delete_response(entity)

data/lib/ditty/controllers/{main.rb → main_controller.rb}

@@ -1,26 +1,26 @@
 # frozen_string_literal: true
 
-require 'ditty/controllers/application'
+require 'ditty/controllers/application_controller'
 require 'ditty/models/role'
 require 'ditty/models/user'
+require 'ditty/services/settings'
 
 module Ditty
-  class Main < Application
+  class MainController < ApplicationController
     set track_actions: true
 
-    def find_template(views, name, engine, &block)
-      super(views, name, engine, &block) # Root
-      super(::Ditty::App.view_folder, name, engine, &block) # Basic Plugin
-    end
-
     before '/' do
       return if User.where(roles: Role.find_or_create(name: 'super_admin')).count.positive?
+
       flash[:info] = 'Please register the super admin user.'
       redirect "#{settings.map_path}/auth/register"
     end
 
     # Home Page
     get '/' do
+      home_page = Services::Settings['ditty.home_page']
+      redirect "#{settings.map_path}#{home_page}" if home_page
+
       authenticate!
       haml :index, locals: { title: 'Home' }
     end

data/lib/ditty/controllers/roles_controller.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require 'ditty/controllers/component_controller'
+require 'ditty/models/role'
+require 'ditty/policies/role_policy'
+
+module Ditty
+  class RolesController < ::Ditty::ComponentController
+    SEARCHABLE = %i[name].freeze
+
+    set model_class: Role
+
+    helpers do
+      def parent_options(entity)
+        return policy_scope(::Ditty::Role) if entity.new?
+
+        policy_scope(::Ditty::Role)
+          .exclude(id: [entity.id] + entity.descendants.map(&:id))
+          .order(:name)
+      end
+    end
+  end
+end

data/lib/ditty/controllers/user_login_traits_controller.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'ditty/controllers/component_controller'
+require 'ditty/models/user_login_trait'
+require 'ditty/policies/user_login_trait_policy'
+
+module Ditty
+  class UserLoginTraitsController < ::Ditty::ComponentController
+    SEARCHABLE = %i[platform device browser ip_address].freeze
+    FILTERS = [
+      { name: :user, field: 'user.email' },
+      { name: :platform },
+      { name: :device },
+      { name: :browser }
+    ].freeze
+
+    set base_path: '/login-traits'
+    set model_class: UserLoginTrait
+    set heading: 'Login'
+    # set track_actions: true
+
+    helpers do
+      def user_options
+        policy_scope(::Ditty::User).as_hash(:email, :email)
+      end
+
+      def platform_options
+        policy_scope(::Ditty::UserLoginTrait).select(:platform).distinct.as_hash(:platform, :platform)
+      end
+
+      def device_options
+        policy_scope(::Ditty::UserLoginTrait).select(:device).distinct.as_hash(:device, :device)
+      end
+
+      def browser_options
+        policy_scope(::Ditty::UserLoginTrait).select(:browser).distinct.as_hash(:browser, :browser)
+      end
+    end
+
+    def list
+      return super if params[:sort]
+
+      super.order(:updated_at).reverse
+    end
+  end
+end