lato 3.24.0 → 3.26.0

data/app/controllers/lato/account_controller.rb

@@ -3,8 +3,20 @@ module Lato
     before_action :authenticate_session
     before_action { active_navbar(:account) }
 
+    before_action :discard_expired_security_enrollment
+    before_action :limit_requests, only: %i[update_user_action update_password_action update_authenticator_action update_webauthn_action update_web3_action destroy_action security_challenge]
+    before_action :reauthenticate_sensitive_action, only: %i[update_user_action update_password_action update_authenticator_action update_webauthn_action update_web3_action destroy_action]
+
     def index; end
 
+    def security_challenge
+      return head :not_found unless @session.user.webauthn_enabled?
+
+      options = @session.user.webauthn_authentication_options
+      @session.set_security_challenge(options.challenge)
+      render json: options.as_json
+    end
+
     def update_user_action
       respond_to do |format|
         if @session.user.update(params.require(:user).permit(:first_name, :last_name, :email))
@@ -20,25 +32,32 @@ module Lato
     def update_authenticator_action
       return respond_to_with_not_found unless Lato.config.authenticator_connection
 
-      if @session.user.authenticator_secret
-        respond_to do |format|
-          if @session.user.remove_authenticator_secret
-            format.html { redirect_to lato.account_path }
-            format.json { render json: @session.user }
-          else
-            format.html { render :index, status: :unprocessable_entity }
-            format.json { render json: @session.user.errors, status: :unprocessable_entity }
-          end
-        end
+      user = @session.user
+      if user.authenticator_enabled?
+        success = user.remove_authenticator_secret
+      elsif params.dig(:user, :authenticator_command) == "confirm"
+        pending = session.delete(:pending_authenticator_secret)
+        used_at = pending.present? && ROTP::TOTP.new(pending).verify(params.dig(:user, :authenticator_code).to_s, drift_behind: 15)
+        # Store the enrollment code timestamp so the same code can not be replayed for the first login.
+        success = used_at ? user.update(authenticator_secret: pending, authenticator_last_used_at: Time.at(used_at)) : false
+        user.errors.add(:base, :authenticator_code_invalid) unless success
+        @session.clear_security_continuation
       else
-        respond_to do |format|
-          if @session.user.generate_authenticator_secret
-            format.html { redirect_to lato.account_path }
-            format.json { render json: @session.user }
-          else
-            format.html { render :index, status: :unprocessable_entity }
-            format.json { render json: @session.user.errors, status: :unprocessable_entity }
-          end
+        session[:pending_authenticator_secret] = ROTP::Base32.random
+        grant_security_continuation
+        return respond_to do |format|
+          format.html { redirect_to lato.account_path }
+          format.json { render json: { secret: session[:pending_authenticator_secret] } }
+        end
+      end
+
+      respond_to do |format|
+        if success
+          format.html { redirect_to lato.account_path }
+          format.json { render json: user }
+        else
+          format.html { render :index, status: :unprocessable_entity }
+          format.json { render json: user.errors, status: :unprocessable_entity }
         end
       end
     end
@@ -76,6 +95,7 @@ module Lato
             format.json { render json: @session.user.errors, status: :unprocessable_entity }
           end
         else
+          grant_security_continuation
           options = @session.user.webauthn_registration_options
           session[:webauthn_registration_challenge] = Base64.strict_encode64(options.challenge)
           session[:webauthn_registration_options] = options.as_json
@@ -107,19 +127,18 @@ module Lato
         end
       elsif session[:web3_nonce]
         respond_to do |format|
-          if @session.user.add_web3_connection(params.require(:user).permit(:web3_address, :web3_signed_nonce).merge(web3_nonce: session[:web3_nonce]))
-            session[:web3_nonce] = nil
+          if @session.user.add_web3_connection(params.require(:user).permit(:web3_address, :web3_signed_nonce).merge(web3_nonce: web3_message_consume))
             format.html { redirect_to lato.account_path }
             format.json { render json: @session.user }
           else
-            session[:web3_nonce] = nil
             format.html { render :index, status: :unprocessable_entity }
             format.json { render json: @session.user.errors, status: :unprocessable_entity }
           end
         end
       else
         respond_to do |format|
-          if session[:web3_nonce] = SecureRandom.hex(32)
+          grant_security_continuation
+          if web3_message_generate('connect your wallet')
             format.html { redirect_to lato.account_path }
             format.json { render json: @session.user }
           else
@@ -145,8 +164,9 @@ module Lato
     def update_password_action
       respond_to do |format|
         if @session.user.update(params.require(:user).permit(:password, :password_confirmation))
-          format.html { redirect_to lato.account_path, notice: I18n.t('lato.account_controller.update_password_action_notice') }
-          format.json { render json: @session.user }
+          session_destroy
+          format.html { redirect_to lato.authentication_signin_path, notice: I18n.t('lato.account_controller.update_password_action_notice') }
+          format.json { render json: {} }
         else
           format.html { render :index, status: :unprocessable_entity }
           format.json { render json: @session.user.errors, status: :unprocessable_entity }
@@ -194,7 +214,61 @@ module Lato
 
     private
 
+    def discard_expired_security_enrollment
+      action = @session.security_continuation_action
+      session.delete(:pending_authenticator_secret) unless action == "update_authenticator_action"
+      unless action == "update_webauthn_action"
+        session.delete(:webauthn_registration_challenge)
+        session.delete(:webauthn_registration_options)
+      end
+      return if action == "update_web3_action"
+
+      session.delete(:web3_nonce)
+      session.delete(:web3_nonce_expires_at)
+    end
+
+    def reauthenticate_sensitive_action
+      if action_name == "update_user_action"
+        email = params.dig(:user, :email)
+        return if email.nil? || email.to_s.downcase.strip == @session.user.email
+      end
+      return if action_name == "update_webauthn_action" && params.dig(:user, :webauthn_command) == "cancel"
+
+      continuation = case action_name
+      when "update_authenticator_action"
+        params.dig(:user, :authenticator_command) == "confirm"
+      when "update_webauthn_action"
+        params.dig(:user, :webauthn_command) == "complete"
+      when "update_web3_action"
+        session[:web3_nonce].present?
+      end
+      return if continuation && @session.consume_security_continuation(action_name)
+
+      user = @session.user
+      password_valid = user.authenticate(params.dig(:user, :current_password).to_s)
+      factor_valid = if user.authenticator_enabled?
+        user.authenticator(authenticator_code: params.dig(:user, :current_authenticator_code).to_s)
+      elsif user.webauthn_enabled?
+        challenge = @session.take_security_challenge
+        user.webauthn_authentication({ webauthn_credential: params.dig(:user, :current_webauthn_credential) }, challenge)
+      else
+        true
+      end
+      return if password_valid && factor_valid
+
+      user.errors.add(:base, I18n.t('lato.security_confirmation_required'))
+      respond_to do |format|
+        format.html { render :index, status: :unprocessable_entity }
+        format.json { render json: user.errors, status: :unprocessable_entity }
+      end
+    end
+
+    def grant_security_continuation
+      @session.grant_security_continuation(action_name)
+    end
+
     def reset_webauthn_registration_state
+      @session.clear_security_continuation
       session[:webauthn_registration_challenge] = nil
       session[:webauthn_registration_options] = nil
     end

data/app/controllers/lato/application_controller.rb

@@ -46,11 +46,35 @@ module Lato
 
     def respond_to_redirect_same_page(notice = nil)
       respond_to do |format|
-        format.html { redirect_to request.referer, notice: notice }
+        # Never follow a Referer pointing to another host (open redirect).
+        format.html { redirect_back_or_to lato.root_path, allow_other_host: false, notice: notice }
         format.json { render json: {} }
       end
     end
 
+    # Web3 challenge: the signed text binds the signature to this host, a purpose and a short lifetime,
+    # so a signature collected by another site can not be replayed here.
+    WEB3_MESSAGE_LIFETIME = 5.minutes
+
+    def web3_message_generate(purpose)
+      session[:web3_nonce] = [
+        "#{request.host} wants you to #{purpose} with your Ethereum account.",
+        "",
+        "URI: #{request.base_url}",
+        "Nonce: #{SecureRandom.hex(16)}",
+        "Issued At: #{Time.current.utc.iso8601}"
+      ].join("\n")
+      session[:web3_nonce_expires_at] = WEB3_MESSAGE_LIFETIME.from_now.to_i
+      session[:web3_nonce]
+    end
+
+    # Single use: the message is removed from the session whatever the outcome.
+    def web3_message_consume
+      message = session.delete(:web3_nonce)
+      expires_at = session.delete(:web3_nonce_expires_at).to_i
+      message if message.present? && Time.current.to_i <= expires_at
+    end
+
     def respond_to_with_offline
       hide_sidebar
       respond_to do |format|

data/app/controllers/lato/authentication_controller.rb

@@ -1,13 +1,13 @@
 module Lato
   class AuthenticationController < ApplicationController
-    before_action :limit_requests, only: %i[signin_action signup_action accept_invitation_action recover_password_action update_password_action verify_email_action authenticator_action webauthn_action]
-    before_action :not_authenticate_session, only: %i[signin signin_action signup signup_action accept_invitation accept_invitation_action]
+    before_action :limit_requests, only: %i[signin_action signup_action accept_invitation_action recover_password_action update_password_action verify_email_action authenticator_action webauthn_action web3_signin_action]
+    before_action :not_authenticate_session, only: %i[signin signin_action web3_signin web3_signin_action signup signup_action accept_invitation accept_invitation_action]
     before_action :authenticate_session, only: %i[signout signout_action]
 
     before_action :find_user, only: %i[verify_email verify_email_action]
     before_action :find_recover_password_user, only: %i[update_password update_password_action]
     before_action :find_invitation, only: %i[accept_invitation accept_invitation_action]
-    before_action :find_authentication_user, only: %i[authentication_method authentication_method_action webauthn webauthn_action]
+    before_action :find_authentication_user, only: %i[authentication_method authentication_method_action authenticator authenticator_action webauthn webauthn_action]
 
     before_action :lock_signup_if_disabled, only: %i[signup signup_action]
     before_action :lock_recover_password_if_disabled, only: %i[recover_password recover_password_action update_password update_password_action]
@@ -26,12 +26,15 @@ module Lato
 
     def signin_action
       @user = Lato::User.new
+      signin_params = params.require(:user).permit(:email, :password)
+      return if account_limit_reached?(signin_params[:email])
 
       respond_to do |format|
-        if @user.signin(params.require(:user).permit(:email, :password).merge(
+        if @user.signin(signin_params.merge(
           ip_address: request.remote_ip,
           user_agent: request.user_agent
         ))
+          account_limit_reset(signin_params[:email])
           redirect_path = determine_authentication_redirect(@user)
           if redirect_path
             # Second factor still pending: expose only where to continue, not user data.
@@ -43,6 +46,7 @@ module Lato
             format.json { render json: @user }
           end
         else
+          account_limit_track_failure(signin_params[:email])
           format.html { render :signin, status: :unprocessable_entity }
           format.json { render json: @user.errors, status: :unprocessable_entity }
         end
@@ -51,7 +55,7 @@ module Lato
 
     def web3_signin
       @user = Lato::User.new
-      session[:web3_nonce] = SecureRandom.hex(32)
+      web3_message_generate('sign in')
     end
 
     def web3_signin_action
@@ -61,20 +65,18 @@ module Lato
         if @user.web3_signin(params.require(:user).permit(:web3_address, :web3_signed_nonce).merge(
           ip_address: request.remote_ip,
           user_agent: request.user_agent,
-          web3_nonce: session[:web3_nonce]
+          web3_nonce: web3_message_consume
         ))
-          session[:web3_nonce] = nil
           redirect_path = determine_authentication_redirect(@user)
           if redirect_path
             format.html { redirect_to redirect_path }
-            format.json { render json: @user }
+            format.json { render json: { redirect: redirect_path } }
           else
             session_create(@user.id)
             format.html { redirect_to lato.root_path }
             format.json { render json: @user }
           end
         else
-          session[:web3_nonce] = nil
           format.html { render :web3_signin, status: :unprocessable_entity }
           format.json { render json: @user.errors, status: :unprocessable_entity }
         end
@@ -232,22 +234,19 @@ module Lato
     # Authenticator
     ##
 
-    def authenticator
-      @user = Lato::User.find_by_id(session[:authentication_user_id])
-      return respond_to_with_not_found unless @user
-    end
+    def authenticator; end
 
     def authenticator_action
-      @user = Lato::User.find_by_id(session[:authentication_user_id])
-
       respond_to do |format|
         if @user.authenticator(params.require(:user).permit(:authenticator_code))
+          account_limit_reset(authentication_limit_identifier)
           clear_authentication_session
           session_create(@user.id)
 
           format.html { redirect_to lato.root_path }
           format.json { render json: @user }
         else
+          track_authentication_failure
           format.html { render :authenticator, status: :unprocessable_entity }
           format.json { render json: @user.errors, status: :unprocessable_entity }
         end
@@ -265,12 +264,14 @@ module Lato
     def webauthn_action
       respond_to do |format|
         if @user.webauthn_authentication(params.require(:user).permit(:webauthn_credential), session[:webauthn_challenge])
+          account_limit_reset(authentication_limit_identifier)
           clear_authentication_session
           session_create(@user.id)
 
           format.html { redirect_to lato.root_path }
           format.json { render json: @user }
         else
+          track_authentication_failure
           @options = @user.webauthn_authentication_options
           session[:webauthn_challenge] = @options.challenge
           format.html { render :webauthn, status: :unprocessable_entity }
@@ -305,9 +306,30 @@ module Lato
       respond_to_with_not_found unless @invitation
     end
 
+    # Pending second factor state lives in the session cookie: it expires and allows a few attempts only.
+    AUTHENTICATION_PENDING_LIFETIME = 10.minutes
+    AUTHENTICATION_PENDING_MAX_ATTEMPTS = 5
+
     def find_authentication_user
-      @user = Lato::User.find_by_id(session[:authentication_user_id])
-      respond_to_with_not_found unless @user
+      expired = session[:authentication_expires_at].to_i < Time.current.to_i
+      @user = Lato::User.find_by_id(session[:authentication_user_id]) unless expired
+      unless @user
+        clear_authentication_session
+        return respond_to_with_not_found
+      end
+
+      account_limit_reached?(authentication_limit_identifier)
+    end
+
+    def authentication_limit_identifier
+      "second_factor/#{@user.id}"
+    end
+
+    # Counted both in the session and per user in cache, so replaying an older cookie does not reset the budget.
+    def track_authentication_failure
+      account_limit_track_failure(authentication_limit_identifier)
+      session[:authentication_attempts] = session[:authentication_attempts].to_i + 1
+      clear_authentication_session if session[:authentication_attempts] >= AUTHENTICATION_PENDING_MAX_ATTEMPTS
     end
 
     def determine_authentication_redirect(user)
@@ -317,6 +339,8 @@ module Lato
       return nil unless authenticator_enabled || webauthn_enabled
 
       session[:authentication_user_id] = user.id
+      session[:authentication_expires_at] = AUTHENTICATION_PENDING_LIFETIME.from_now.to_i
+      session[:authentication_attempts] = 0
 
       if authenticator_enabled && webauthn_enabled
         lato.authentication_authentication_method_path
@@ -329,6 +353,8 @@ module Lato
 
     def clear_authentication_session
       session[:authentication_user_id] = nil
+      session[:authentication_expires_at] = nil
+      session[:authentication_attempts] = nil
       session[:authentication_method] = nil
       session[:webauthn_challenge] = nil
     end
@@ -372,35 +398,44 @@ module Lato
 
       hcaptcha_response = params["h-captcha-response"]
       if hcaptcha_response.blank?
-        @user.errors.add(:base, "hCaptcha response is missing")
-        respond_to do |format|
-          format.html { render render_key, status: :unprocessable_entity }
-          format.json { render json: @user.errors, status: :unprocessable_entity }
-        end
-        return false
+        return respond_to_hcaptcha_error(render_key, I18n.t('lato.hcaptcha_missing'))
       end
 
+      unless hcaptcha_verified?(hcaptcha_response)
+        return respond_to_hcaptcha_error(render_key, I18n.t('lato.hcaptcha_failed'))
+      end
+
+      true
+    end
+
+    # Short timeouts: a slow hCaptcha must not hold server threads. Any network or parsing error counts as failure.
+    def hcaptcha_verified?(hcaptcha_response)
       require 'net/http'
-      require 'uri'
       require 'json'
+
       uri = URI.parse("https://hcaptcha.com/siteverify")
-      response = Net::HTTP.post_form(uri, {
-        "secret" => Lato.config.hcaptcha_secret,
-        "response" => hcaptcha_response,
-        "remoteip" => request.remote_ip
-      })
-      result = JSON.parse(response.body)
-      Rails.logger.info("[hCaptcha] Verification result: #{result}")
-      unless result["success"]
-        @user.errors.add(:base, "hCaptcha verification failed")
-        respond_to do |format|
-          format.html { render render_key, status: :unprocessable_entity }
-          format.json { render json: @user.errors, status: :unprocessable_entity }
-        end
-        return false
+      response = Net::HTTP.start(uri.host, uri.port, use_ssl: true, open_timeout: 3, read_timeout: 5) do |http|
+        http.post(uri.path, URI.encode_www_form(
+          "secret" => Lato.config.hcaptcha_secret,
+          "response" => hcaptcha_response,
+          "remoteip" => request.remote_ip
+        ), "Content-Type" => "application/x-www-form-urlencoded")
       end
+      result = JSON.parse(response.body)
+      Rails.logger.info("[hCaptcha] Verification success: #{result['success'].inspect}")
+      result["success"] == true
+    rescue StandardError => e
+      Rails.logger.error("[hCaptcha] Verification error: #{e.class}")
+      false
+    end
 
-      true
+    def respond_to_hcaptcha_error(render_key, message)
+      @user.errors.add(:base, message)
+      respond_to do |format|
+        format.html { render render_key, status: :unprocessable_entity }
+        format.json { render json: @user.errors, status: :unprocessable_entity }
+      end
+      false
     end
   end
 end

data/app/helpers/lato/components_helper.rb

@@ -106,7 +106,12 @@ module Lato
       # setup classes
       options[:class] ||= []
       options[:class].push(classes)
-      options[:class].push('is-invalid') if form.object && form.object.errors[key] && form.object.errors[key].any?
+      if _lato_form_errors?(form, key)
+        options[:class].push('is-invalid')
+        options[:aria] ||= {}
+        options[:aria][:invalid] = true
+        options[:aria][:describedby] = [options[:aria][:describedby], _lato_form_feedback_id(form, key)].compact.join(' ')
+      end
 
       # setup stimulus
       options[:data] ||= {}
@@ -115,6 +120,25 @@ module Lato
       options[:data][:lato_form_target] = 'input'
     end
 
+    def _lato_form_errors?(form, key)
+      form.object.respond_to?(:errors) && form.object.errors[key].any?
+    end
+
+    def _lato_form_feedback_id(form, key)
+      form.field_id(key, :feedback)
+    end
+
+    # Inline error message linked to the input through aria-describedby.
+    def _lato_form_input_feedback(form, key)
+      return ''.html_safe unless _lato_form_errors?(form, key)
+
+      content_tag :div, form.object.errors[key].to_sentence, id: _lato_form_feedback_id(form, key), class: 'invalid-feedback'
+    end
+
+    def _lato_form_input_with_feedback(form, key)
+      yield + _lato_form_input_feedback(form, key)
+    end
+
     def lato_form_notices(options = {})
       return unless notice
 
@@ -134,6 +158,7 @@ module Lato
       options[:class] ||= []
       options[:class] += %w[alert alert-danger]
       options[:class] += %w[alert-dismissible fade show] unless options[:fixed]
+      options[:role] ||= 'alert'
 
       errors_list = content_tag(:ul, class: %w[mb-0 ps-3]) do
         instance.errors.collect do |error|
@@ -158,48 +183,48 @@ module Lato
     def lato_form_item_input_text(form, key, options = {})
       _lato_form_input_options(form, key, options, :keyup, 'form-control')
 
-      form.text_field key, options
+      _lato_form_input_with_feedback(form, key) { form.text_field key, options }
     end
 
     def lato_form_item_input_number(form, key, options = {})
       _lato_form_input_options(form, key, options, :keyup, 'form-control')
 
-      form.number_field key, options
+      _lato_form_input_with_feedback(form, key) { form.number_field key, options }
     end
 
     def lato_form_item_input_email(form, key, options = {})
       _lato_form_input_options(form, key, options, :keyup, 'form-control')
 
-      form.email_field key, options
+      _lato_form_input_with_feedback(form, key) { form.email_field key, options }
     end
 
     def lato_form_item_input_password(form, key, options = {})
       _lato_form_input_options(form, key, options, :keyup, 'form-control')
 
-      form.password_field key, options
+      _lato_form_input_with_feedback(form, key) { form.password_field key, options }
     end
 
     def lato_form_item_input_check(form, key, label, options = {})
       _lato_form_input_options(form, key, options, :change, 'form-check-input')
 
-      # TO-DO: Trovare il modo di calcolare l'id dato da rails a check_input_tag e metterlo nell'attributo :for di check_label_tag
-
+      # The label is escaped unless the caller passes an html_safe string (e.g. a translation with a trusted link).
       content_tag :div, class: 'form-check' do
         concat form.check_box(key, options)
-        concat label_tag(key, raw(label), class: 'form-check-label')
+        concat form.label(key, label, class: 'form-check-label', for: options[:id] || form.field_id(key))
+        concat _lato_form_input_feedback(form, key)
       end
     end
 
     def lato_form_item_input_select(form, key, select_options = [], options = {})
       _lato_form_input_options(form, key, options, :change, 'form-control')
 
-      form.select key, select_options, {}, options
+      _lato_form_input_with_feedback(form, key) { form.select key, select_options, {}, options }
     end
 
     def lato_form_item_input_file(form, key, options = {})
       _lato_form_input_options(form, key, options, :change, 'form-control')
 
-      form.file_field key, options
+      _lato_form_input_with_feedback(form, key) { form.file_field key, options }
     end
 
     def lato_form_item_input_file_dropzone(form, key, options = {})
@@ -211,25 +236,25 @@ module Lato
     def lato_form_item_input_textarea(form, key, options = {})
       _lato_form_input_options(form, key, options, :keyup, 'form-control')
 
-      form.text_area key, options
+      _lato_form_input_with_feedback(form, key) { form.text_area key, options }
     end
 
     def lato_form_item_input_date(form, key, options = {})
       _lato_form_input_options(form, key, options, :change, 'form-control')
 
-      form.date_field key, options
+      _lato_form_input_with_feedback(form, key) { form.date_field key, options }
     end
 
     def lato_form_item_input_datetime(form, key, options = {})
       _lato_form_input_options(form, key, options, :change, 'form-control')
 
-      form.datetime_field key, options
+      _lato_form_input_with_feedback(form, key) { form.datetime_field key, options }
     end
 
     def lato_form_item_input_time(form, key, options = {})
       _lato_form_input_options(form, key, options, :change, 'form-control')
 
-      form.time_field key, options
+      _lato_form_input_with_feedback(form, key) { form.time_field key, options }
     end
 
     def lato_form_item_input_color(form, key, options = {})
@@ -237,7 +262,7 @@ module Lato
       options[:class] ||= []
       options[:class].push('lato-form-item-input-color')
       
-      form.color_field key, options
+      _lato_form_input_with_feedback(form, key) { form.color_field key, options }
     end
 
     def lato_form_item_input_list(form, key, partial, partial_params = {})
@@ -270,7 +295,8 @@ module Lato
       image_url ||= image_path('lato/user-150x150.jpg')
 
       content_tag :div, class: 'd-flex align-items-center' do
-        concat content_tag :div, '', class: 'border border-2 rounded-circle me-2', style: "background-position: center; background-size: cover; background-repeat: no-repeat; background-image: url(#{image_url}); width: 30px; height: 30px;"
+        # An img attribute is escaped, while a url() inside inline CSS could be broken out of by a crafted image URL.
+        concat image_tag(image_url, alt: '', width: 30, height: 30, class: 'border border-2 rounded-circle me-2', style: 'object-fit: cover;')
         concat content_tag :small, label, class: 'text-black'
       end
     end

data/app/jobs/lato/active_storage_cleaner_job.rb

@@ -3,23 +3,22 @@ module Lato
     def perform(params = {})
       update_operation_percentage(0)
 
-      # delete all active storage blobs that are not attached to any record with more than 12 hours of life
+      # delete all active storage blobs that are not attached to any record older than the minimum age (default 12 hours)
+      min_age_hours = (params[:min_age_hours] || params['min_age_hours'] || 12).to_i
       query = ActiveStorage::Blob.joins("LEFT JOIN active_storage_attachments ON active_storage_attachments.blob_id = active_storage_blobs.id")
                                  .where("active_storage_attachments.blob_id IS NULL")
-                                 .where("active_storage_blobs.created_at < ?", 12.hours.ago)
+                                 .where("active_storage_blobs.created_at < ?", min_age_hours.hours.ago)
       totals = query.count
       runned = 0
       query.find_in_batches do |blobs|
         blobs.each(&:purge_later)
         runned += blobs.size
-        update_operation_percentage((runned.to_f / totals * 100).round)
+        update_operation_percentage((runned.to_f / totals * 100).round) if totals.positive?
       end
 
       # delete all empty folders in active storage local service (if exists)
-      if ActiveStorage::Blob.service.class.to_s == 'ActiveStorage::Service::DiskService'
-        storage_folder = ActiveStorage::Blob.service.root
-        return unless File.directory?(storage_folder)
-
+      storage_folder = ActiveStorage::Blob.service.root if ActiveStorage::Blob.service.class.to_s == 'ActiveStorage::Service::DiskService'
+      if storage_folder && File.directory?(storage_folder)
         Dir.foreach(storage_folder) do |folder|
           next if folder == '.' || folder == '..'
 
@@ -27,6 +26,8 @@ module Lato
           FileUtils.rm_rf(folder_path) if File.directory?(folder_path) && Dir.empty?(folder_path)
         end
       end
+
+      update_operation_percentage(100)
     end
   end
 end

data/app/models/lato/invitation.rb

@@ -23,7 +23,7 @@ module Lato
     # be sure that email is not already used by another user
     before_create do
       if Lato::User.find_by(email: email)
-        errors.add(:email, 'is already used by another user')
+        errors.add(:email, :taken)
         throw :abort
       end
     end

data/app/models/lato/operation.rb

@@ -73,9 +73,13 @@ module Lato
 
     def start
       begin
-        active_job_name.constantize.perform_later(active_job_input.merge(_operation_id: id))
+        # Only operation jobs can be started: active_job_name may come from request params in host apps.
+        job_class = active_job_name.to_s.safe_constantize
+        raise ArgumentError, "#{active_job_name} is not a Lato::ApplicationJob" unless job_class.is_a?(Class) && job_class < Lato::ApplicationJob
+
+        job_class.perform_later(active_job_input.merge(_operation_id: id))
       rescue StandardError
-        errors.add(:base, 'Impossibile eseguire il job')
+        errors.add(:base, :start_error)
         return false
       end