lato 3.24.0 → 3.26.0

data/app/models/lato/session.rb

@@ -4,48 +4,102 @@ module Lato
       @session = parse_session(session)
     end
 
-    # Questions
-    ##
-
     def valid?
-      !@session.blank?
+      record.present?
     end
 
     def really_valid?
-      !!user
+      valid? && user.present?
     end
 
-    # Helpers
-    ##
-
     def user
-      @user ||= Lato::User.find_by(id: user_id)
+      @user ||= record&.user if valid?
     end
 
     def user_id
-      @session&.dig(:user_id)
+      record&.lato_user_id
     end
 
     def get(key)
-      @session&.dig(key)
+      @session&.dig(key) if valid?
+    end
+
+    def expires_at
+      record&.expires_at
+    end
+
+    def update(extra_params)
+      return unless valid?
+
+      @session.merge!(extra_params.to_h.except(:user_id, :token, "user_id", "token"))
+      @session.to_json
     end
 
-    # Class
-    ##
+    def grant_security_continuation(action)
+      record.update!(security_grant_action: action, security_grant_expires_at: 5.minutes.from_now)
+    end
+
+    def security_continuation_action
+      current = record
+      current.security_grant_action if current&.security_grant_expires_at&.future?
+    end
+
+    def consume_security_continuation(action)
+      return false unless (current = record)
+
+      Lato::SessionRecord.where(id: current.id, security_grant_action: action).where("security_grant_expires_at > ?", Time.current).update_all(security_grant_action: nil, security_grant_expires_at: nil) == 1
+    end
+
+    def clear_security_continuation
+      record&.update!(security_grant_action: nil, security_grant_expires_at: nil)
+    end
+
+    def set_security_challenge(challenge)
+      record.update!(security_challenge: challenge, security_challenge_expires_at: 5.minutes.from_now)
+    end
+
+    def take_security_challenge
+      current = record
+      return unless current
+
+      current.with_lock do
+        challenge = current.security_challenge if current.security_challenge_expires_at&.future?
+        current.update!(security_challenge: nil, security_challenge_expires_at: nil)
+        challenge
+      end
+    end
+
+    def destroy
+      record&.destroy!
+      @session = nil
+    end
 
     def self.generate_session_per_user(user_id, extra_params = {})
-      extra_params.merge(user_id: user_id).to_json
+      user = Lato::User.find(user_id)
+      token = SecureRandom.hex(32)
+      user.with_lock do
+        user.lato_session_records.where("expires_at <= ?", Time.current).delete_all
+        user.lato_session_records.create!(token_digest: Digest::SHA256.hexdigest(token), expires_at: Lato.config.session_lifetime.from_now)
+      end
+      extra_params.to_h.except(:user_id, :token, "user_id", "token").merge(user_id: user.id, token: token).to_json
     end
 
     private
 
+    # Always query revocation state, including when a Session instance was already used.
+    def record
+      return unless @session&.dig(:token).is_a?(String) && @session[:token].present?
+
+      Lato::SessionRecord.where(lato_user_id: @session[:user_id], token_digest: Digest::SHA256.hexdigest(@session[:token])).where("expires_at > ?", Time.current).first
+    end
+
     def parse_session(session)
-      return nil if session.blank?
+      return if session.blank?
 
-      (session.is_a?(String) ? JSON.parse(session) : session).with_indifferent_access
-    rescue StandardError => e
-      Rails.logger.error "Lato::Session.parse_session: #{e.message}"
+      parsed = session.is_a?(String) ? JSON.parse(session) : session
+      parsed.with_indifferent_access if parsed.is_a?(Hash)
+    rescue JSON::ParserError
       nil
     end
   end
-end
+end

data/app/models/lato/session_record.rb

@@ -0,0 +1,5 @@
+module Lato
+  class SessionRecord < ApplicationRecord
+    belongs_to :user, class_name: "Lato::User", foreign_key: :lato_user_id
+  end
+end

data/app/models/lato/user.rb

@@ -17,10 +17,13 @@ module Lato
     validates :accepted_terms_and_conditions_version, presence: true
     validates :web3_address, uniqueness: true, allow_blank: true
     validates :webauthn_id, uniqueness: true, allow_blank: true
+    validate :validate_password_length, unless: -> { password.nil? }
 
     # Relations
     ##
 
+    has_many :lato_session_records, class_name: "Lato::SessionRecord", foreign_key: :lato_user_id, dependent: :delete_all
+
     has_many :lato_operations, class_name: 'Lato::Operation', foreign_key: :lato_user_id, dependent: :nullify
     has_many :lato_invitations, class_name: 'Lato::Invitation', foreign_key: :lato_user_id, dependent: :nullify
     has_many :lato_invitations_as_inviter, class_name: 'Lato::Invitation', foreign_key: :inviter_lato_user_id, dependent: :nullify
@@ -46,6 +49,16 @@ module Lato
       self.accepted_terms_and_conditions_version = Lato.config.legal_terms_and_conditions_version if accepted_terms_and_conditions_version_changed?
     end
 
+    after_update do
+      lato_session_records.delete_all if saved_change_to_password_digest?
+      if saved_change_to_email?
+        saved_change_to_email.each do |address|
+          Rails.cache.delete("Lato::User/c_email_verification_code/#{id}/#{Digest::SHA256.hexdigest(address.to_s)}")
+        end
+        c_email_verification_semaphore(false)
+      end
+    end
+
     # Questions
     ##
 
@@ -86,17 +99,17 @@ module Lato
 
     def email_protected
       return email unless email.include?('@')
-  
+
       local_part, domain = email.split('@', 2)
-      
+
       # Keep first 2 characters of local part
       chars_to_keep = [local_part.length, 2].min
       protected_local = local_part[0, chars_to_keep] + '*' * [local_part.length - chars_to_keep, 0].max
-      
+
       # Keep domain as is or partially protect it
       chars_to_keep = [domain.length, 2].min
       protected_domain = domain[0, chars_to_keep] + '*' * [domain.length - chars_to_keep, 0].max
-      
+
       "#{protected_local}@#{protected_domain}"
     end
 
@@ -104,8 +117,8 @@ module Lato
       @gravatar_image_url ||= "https://www.gravatar.com/avatar/#{Digest::MD5.hexdigest(email)}?s=#{size}"
     end
 
-    def authenticator_qr_code_base64(size = 200)
-      "data:image/png;base64,#{Base64.strict_encode64(RQRCode::QRCode.new(ROTP::TOTP.new(authenticator_secret, :issuer => Lato.config.application_title).provisioning_uri(email).to_s).as_png(size: size, border_modules: 0).to_s)}"
+    def authenticator_qr_code_base64(size = 200, secret: authenticator_secret)
+      "data:image/png;base64,#{Base64.strict_encode64(RQRCode::QRCode.new(ROTP::TOTP.new(secret, :issuer => Lato.config.application_title).provisioning_uri(email).to_s).as_png(size: size, border_modules: 0).to_s)}"
     end
 
     # Operations
@@ -162,16 +175,22 @@ module Lato
 
       self.web3_address = params[:web3_address]
 
-      user = Lato::User.find_by(web3_address: params[:web3_address].downcase)
+      user = Lato::User.find_by(web3_address: params[:web3_address].to_s.downcase)
       unless user
         errors.add(:web3_address, :not_correct)
         return
       end
 
+      # Missing or expired challenge message.
+      if params[:web3_nonce].blank?
+        errors.add(:base, :web3_address_invalid)
+        return
+      end
+
       signature_pubkey = Eth::Signature.personal_recover(params[:web3_nonce], params[:web3_signed_nonce])
       signature_address = Eth::Util.public_key_to_address signature_pubkey
       unless signature_address.to_s.downcase == params[:web3_address].downcase
-        errors.add(:web3_signed_nonce, :not_correct)
+        errors.add(:base, :web3_address_invalid)
         return
       end
 
@@ -228,8 +247,10 @@ module Lato
       c_email_verification_code('')
       c_email_verification_semaphore(false)
 
-      update_column(:email_verified_at, Time.now)
-      true
+      # A token for a stale model instance must never verify a concurrently changed address.
+      verified = self.class.where(id: id, email: email).update_all(email_verified_at: Time.current) == 1
+      errors.add(:base, :email_verification_code_invalid) unless verified
+      verified
     end
 
     # NOTE: Always succeeds for a well formed email, registered or not, so the response can not be used to enumerate users.
@@ -275,11 +296,7 @@ module Lato
       c_password_update_code('')
       c_password_update_semaphore(false)
 
-      update(params.permit(:password, :password_confirmation).merge(
-        authenticator_secret: nil, # Reset authenticator secret when password is updated
-        webauthn_id: nil,          # Reset webauthn credential when password is updated
-        webauthn_public_key: nil   # Reset webauthn credential when password is updated
-      ))
+      update(params.permit(:password, :password_confirmation))
     end
 
     def update_accepted_privacy_policy_version(params)
@@ -329,6 +346,11 @@ module Lato
     def add_web3_connection(params)
       depends_on('eth')
 
+      if params[:web3_nonce].blank?
+        errors.add(:base, :web3_address_invalid)
+        return
+      end
+
       signature_pubkey = Eth::Signature.personal_recover(params[:web3_nonce], params[:web3_signed_nonce])
       signature_address = Eth::Util.public_key_to_address signature_pubkey
       unless signature_address.to_s.downcase == params[:web3_address].downcase
@@ -381,7 +403,8 @@ module Lato
 
       update(
         webauthn_id: Base64.strict_encode64(credential.raw_id),
-        webauthn_public_key: credential.public_key
+        webauthn_public_key: credential.public_key,
+        webauthn_sign_count: credential.sign_count.to_i
       )
     rescue JSON::ParserError, WebAuthn::Error => e
       Rails.logger.error(e)
@@ -403,21 +426,23 @@ module Lato
       end
 
       parsed_payload = JSON.parse(params[:webauthn_credential])
-      
+
       # Converti i campi da base64url a base64 standard per il gem webauthn
       parsed_payload['rawId'] = base64url_to_base64(parsed_payload['rawId'])
       parsed_payload['response']['clientDataJSON'] = base64url_to_base64(parsed_payload['response']['clientDataJSON'])
       parsed_payload['response']['authenticatorData'] = base64url_to_base64(parsed_payload['response']['authenticatorData'])
       parsed_payload['response']['signature'] = base64url_to_base64(parsed_payload['response']['signature'])
       parsed_payload['response']['userHandle'] = base64url_to_base64(parsed_payload['response']['userHandle']) if parsed_payload['response']['userHandle']
-      
+
       credential = WebAuthn::Credential.from_get(parsed_payload)
-      
+
+      # A counter that does not grow (raises SignCountVerificationError) reveals a cloned authenticator.
       credential.verify(
         encoded_challenge,
         public_key: webauthn_public_key,
-        sign_count: 0
+        sign_count: webauthn_sign_count.to_i
       )
+      update_column(:webauthn_sign_count, credential.sign_count.to_i)
 
       true
     rescue JSON::ParserError, WebAuthn::Error => e
@@ -430,28 +455,38 @@ module Lato
     def remove_webauthn_credential
       update(
         webauthn_id: nil,
-        webauthn_public_key: nil
+        webauthn_public_key: nil,
+        webauthn_sign_count: 0
       )
     end
 
     def generate_authenticator_secret
-      update(authenticator_secret: ROTP::Base32.random)
+      update(authenticator_secret: ROTP::Base32.random, authenticator_last_used_at: nil)
     end
 
     def remove_authenticator_secret
-      update(authenticator_secret: nil)
+      update(authenticator_secret: nil, authenticator_last_used_at: nil)
     end
 
     def authenticator(params)
       return false unless authenticator_enabled?
 
       totp = ROTP::TOTP.new(authenticator_secret)
-      result = totp.verify(params[:authenticator_code])
-      unless result
+      # after: rejects codes of an already used time step, so an observed code can not be replayed.
+      used_at = totp.verify(params[:authenticator_code].to_s, after: authenticator_last_used_at&.to_i, drift_behind: 15)
+      used_at = Time.at(used_at) if used_at
+
+      # Conditional update: of two concurrent requests with the same code only one can claim it.
+      claimed = used_at && self.class.where(id: id)
+        .where('authenticator_last_used_at IS NULL OR authenticator_last_used_at < ?', used_at)
+        .update_all(authenticator_last_used_at: used_at) == 1
+      unless claimed
         errors.add(:base, :authenticator_code_invalid)
         return
       end
 
+      self.authenticator_last_used_at = used_at
+      clear_attribute_change(:authenticator_last_used_at)
       true
     end
 
@@ -480,7 +515,7 @@ module Lato
     end
 
     def c_email_verification_code(value = nil)
-      cache_key = "Lato::User/c_email_verification_code/#{id}"
+      cache_key = "Lato::User/c_email_verification_code/#{id}/#{Digest::SHA256.hexdigest(email.to_s)}"
       return Rails.cache.read(cache_key) if value.nil?
 
       Rails.cache.write(cache_key, value, expires_in: 30.minutes)
@@ -505,6 +540,11 @@ module Lato
 
     private
 
+    def validate_password_length
+      minimum = Lato.config.auth_password_min_length.to_i
+      errors.add(:password, :too_short, count: minimum) if password.to_s.length < minimum
+    end
+
     def normalize_email(value)
       value.to_s.downcase.strip
     end

data/app/views/lato/account/_alert-accepted-privacy-policy-version.html.erb

@@ -11,7 +11,7 @@
       <% end %>
       <%= form_with model: @session.user, url: lato.account_update_accepted_privacy_policy_version_action_path, data: { turbo_frame: '_self' } do |form| %>
         <%= lato_form_errors @session.user, class: %w[mb-3] %>
-        <%= lato_form_item_input_check form, :confirm, I18n.t('lato.privacy_policy_checkbox', link: link_to(I18n.t('lato.privacy_policy'), Lato.config.legal_privacy_policy_url, target: '_blank')), checked: false, required: true %>
+        <%= lato_form_item_input_check form, :confirm, I18n.t('lato.privacy_policy_checkbox', link: link_to(I18n.t('lato.privacy_policy'), Lato.config.legal_privacy_policy_url, target: '_blank')).html_safe, checked: false, required: true %>
 
         <div class="mt-3">
           <%= lato_form_submit form, I18n.t('lato.confirm') %>

data/app/views/lato/account/_alert-accepted-terms-and-conditions-version.html.erb

@@ -11,7 +11,7 @@
       <% end %>
       <%= form_with model: @session.user, url: lato.account_update_accepted_terms_and_conditions_version_action_path, data: { turbo_frame: '_self' } do |form| %>
         <%= lato_form_errors @session.user, class: %w[mb-3] %>
-        <%= lato_form_item_input_check form, :confirm, I18n.t('lato.terms_and_conditions_checkbox', link: link_to(I18n.t('lato.terms_and_conditions'), Lato.config.legal_terms_and_conditions_url)), checked: false, required: true %>
+        <%= lato_form_item_input_check form, :confirm, I18n.t('lato.terms_and_conditions_checkbox', link: link_to(I18n.t('lato.terms_and_conditions'), Lato.config.legal_terms_and_conditions_url)).html_safe, checked: false, required: true %>
 
         <div class="mt-3">
           <%= lato_form_submit form, I18n.t('lato.confirm') %>

data/app/views/lato/account/_form-authenticator.html.erb

@@ -1,42 +1,28 @@
-<%
-
-user ||= Lato::User.new
-
-%>
-
+<% user ||= Lato::User.new %>
 <%= turbo_frame_tag 'account_form-authenticator' do %>
   <%= form_with model: user, url: lato.account_update_authenticator_action_path, data: { turbo_frame: '_self', controller: 'lato-form' } do |form| %>
     <%= lato_form_notices class: %w[mb-3] %>
     <%= lato_form_errors user, class: %w[mb-3] %>
-
-    <% if user.authenticator_secret %>
-      <div class="d-block d-md-flex align-items-stretch">
-        <div class="text-center mb-3 mb-md-0 me-md-3">
-          <img class="shadow-sm rounded" src="<%= user.authenticator_qr_code_base64 %>" />
-        </div>
-        <div class="d-flex flex-column justify-content-between w-100">
-          <div class="alert alert-success">
-            <h4 class="alert-heading"><%= I18n.t('lato.account_authenticator_ready_title') %></h4>
-            <p class="mb-0">
-              <%= raw I18n.t('lato.account_authenticator_ready_qr') %>
-            </p>
-          </div>
-
-          <div class="d-flex justify-content-end">
-            <%= lato_form_submit form, I18n.t('lato.account_authenticator_disable'), class: %w[btn-danger] %>
-          </div>
-        </div>
+    <% if user.authenticator_enabled? %>
+      <div class="alert alert-success"><%= I18n.t('lato.account_authenticator_ready_title') %></div>
+      <%= render 'lato/account/security-confirmation', form: form, user: user %>
+      <%= lato_form_submit form, I18n.t('lato.account_authenticator_disable'), class: %w[btn-danger] %>
+    <% elsif session[:pending_authenticator_secret].present? %>
+      <div class="text-center mb-3">
+        <img class="shadow-sm rounded" alt="<%= I18n.t('lato.authenticator_qr_code_alt') %>" src="<%= user.authenticator_qr_code_base64(secret: session[:pending_authenticator_secret]) %>" />
       </div>
-    <% else %>
-      <div class="alert alert-light mb-0">
-        <h4 class="alert-heading"><%= I18n.t('lato.account_authenticator_start_title') %></h4>
-        <p>
-          <%= raw I18n.t('lato.account_authenticator_start_description') %>
-        </p>
-        <p class="mb-0">
-          <%= lato_form_submit form, I18n.t('lato.account_authenticator_generate_qr_code'), class: %w[btn-primary] %>
-        </p>
+      <div class="mb-3">
+        <label class="form-label" for="account_form-authenticator__manual-key"><%= I18n.t('lato.authenticator_manual_key') %></label>
+        <input type="text" class="form-control font-monospace" id="account_form-authenticator__manual-key" value="<%= session[:pending_authenticator_secret] %>" readonly>
       </div>
+      <%= form.hidden_field :authenticator_command, value: "confirm" %>
+      <%= form.label :authenticator_code, I18n.t('lato.confirm_authenticator_code'), class: "form-label" %>
+      <%= form.text_field :authenticator_code, value: nil, required: true, class: "form-control mb-3", autocomplete: "one-time-code", inputmode: "numeric" %>
+      <%= lato_form_submit form, I18n.t('lato.confirm'), class: %w[btn-primary] %>
+    <% else %>
+      <div class="alert alert-light"><%= raw I18n.t('lato.account_authenticator_start_description') %></div>
+      <%= render 'lato/account/security-confirmation', form: form, user: user %>
+      <%= lato_form_submit form, I18n.t('lato.account_authenticator_generate_qr_code'), class: %w[btn-primary] %>
     <% end %>
   <% end %>
 <% end %>

data/app/views/lato/account/_form-destroy.html.erb

@@ -8,6 +8,7 @@ user ||= Lato::User.new
   <%= form_with model: user, url: lato.account_destroy_action_path, method: :delete, data: { turbo_frame: '_self', controller: 'lato-form' } do |form| %>
     <%= lato_form_notices class: %w[mb-3] %>
     <%= lato_form_errors user, class: %w[mb-3] %>
+    <%= render 'lato/account/security-confirmation', form: form, user: user %>
     
     <div class="mb-3">
       <%= lato_form_item_label form, :email_confirmation, I18n.t('lato.signup_email') %>

data/app/views/lato/account/_form-password.html.erb

@@ -8,16 +8,18 @@ user ||= Lato::User.new
   <%= form_with model: user, url: lato.account_update_password_action_path, data: { turbo_frame: '_self', controller: 'lato-form' } do |form| %>
     <%= lato_form_notices class: %w[mb-3] %>
     <%= lato_form_errors user, class: %w[mb-3] %>
+    <%= render 'lato/account/security-confirmation', form: form, user: user %>
     
     <div class="row">
       <div class="col col-12 col-lg-6 mb-3">
         <%= lato_form_item_label form, :password, I18n.t('lato.new_password') %>
-        <%= lato_form_item_input_password form, :password, required: true %>
+        <%= lato_form_item_input_password form, :password, required: true, autocomplete: 'new-password', minlength: Lato.config.auth_password_min_length, aria: { describedby: form.field_id(:password, :help) } %>
+        <div class="form-text" id="<%= form.field_id(:password, :help) %>"><%= I18n.t('lato.password_requirements', count: Lato.config.auth_password_min_length) %></div>
       </div>
 
       <div class="col col-12 col-lg-6 mb-3">
         <%= lato_form_item_label form, :password_confirmation, I18n.t('lato.confirm_new_password') %>
-        <%= lato_form_item_input_password form, :password_confirmation, required: true %>
+        <%= lato_form_item_input_password form, :password_confirmation, required: true, autocomplete: 'new-password' %>
       </div>
     </div>
 

data/app/views/lato/account/_form-user.html.erb

@@ -8,6 +8,7 @@ user ||= Lato::User.new
   <%= form_with model: user, url: lato.account_update_user_action_path, data: { turbo_frame: '_self', controller: 'lato-form lato-account-form-user' } do |form| %>
     <%= lato_form_notices class: %w[mb-3] %>
     <%= lato_form_errors user, class: %w[mb-3] %>
+    <%= render 'lato/account/security-confirmation', form: form, user: user %>
 
     <div class="row">
       <div class="col col-12 col-lg-4 mb-3">

data/app/views/lato/account/_form-web3.html.erb

@@ -8,6 +8,7 @@ user ||= Lato::User.new
   <%= form_with model: user, url: lato.account_update_web3_action_path, data: { turbo_frame: '_self', controller: 'lato-form' } do |form| %>
     <%= lato_form_notices class: %w[mb-3] %>
     <%= lato_form_errors user, class: %w[mb-3] %>
+    <%= render 'lato/account/security-confirmation', form: form, user: user if session[:web3_nonce].blank? %>
 
     <% if user.web3_address %>
       <div class="row">
@@ -29,7 +30,7 @@ user ||= Lato::User.new
       </div>
     <% elsif session[:web3_nonce] %>
       <div class="alert alert-light mb-0">
-        <h4 class="alert-heading">Connecting..</h4>
+        <h4 class="alert-heading" role="status"><%= I18n.t('lato.connecting') %></h4>
         <div class="progress" role="progressbar" aria-valuenow="100" aria-valuemin="0" aria-valuemax="100">
           <div class="progress-bar progress-bar-striped progress-bar-animated" style="width: 100%"></div>
         </div>
@@ -38,13 +39,14 @@ user ||= Lato::User.new
       <span id="account_form-web3__nonce" style="display: none;"><%= session[:web3_nonce] %></span>
       <%= form.hidden_field :web3_address, id: 'account_form-web3__input-web3_address'  %>
       <%= form.hidden_field :web3_signed_nonce, id: 'account_form-web3__input-web3_signed_nonce' %>
-      <%= lato_form_submit form, 'Confirm', class: %w[btn-primary d-none], id: 'account_form-web3__submit' %>
+      <%= lato_form_submit form, I18n.t('lato.confirm'), class: %w[btn-primary d-none], id: 'account_form-web3__submit' %>
 
       <script>
         (async () => {
+          // Pinned exact version: dynamic import() can not carry an SRI hash (see README security checklist).
           const ethers = await import('https://cdnjs.cloudflare.com/ajax/libs/ethers/5.7.2/ethers.esm.min.js')
 
-          const nonce = document.getElementById('account_form-web3__nonce').innerText
+          const nonce = document.getElementById('account_form-web3__nonce').textContent
           const inputAddress = document.getElementById('account_form-web3__input-web3_address')
           const inputSignedNonce = document.getElementById('account_form-web3__input-web3_signed_nonce')
           const submitButton = document.getElementById('account_form-web3__submit')

data/app/views/lato/account/_form-webauthn.html.erb

@@ -16,6 +16,7 @@ end
   <%= form_with model: user, url: lato.account_update_webauthn_action_path, data: form_data do |form| %>
     <%= lato_form_notices class: %w[mb-3] %>
     <%= lato_form_errors user, class: %w[mb-3] %>
+    <%= render 'lato/account/security-confirmation', form: form, user: user if registration_options.blank? %>
 
     <% if user.webauthn_enabled? %>
       <div class="alert alert-success mb-3">

data/app/views/lato/account/_security-confirmation.html.erb

@@ -0,0 +1,12 @@
+<div class="mb-3" data-controller="lato-account-security" data-lato-account-security-challenge-url-value="<%= lato.account_security_challenge_path %>" data-lato-account-security-webauthn-value="<%= user.webauthn_enabled? && !user.authenticator_enabled? %>">
+  <%= form.label :current_password, I18n.t('lato.current_password'), class: "form-label" %>
+  <%= form.password_field :current_password, class: "form-control", autocomplete: "current-password" %>
+  <% if user.authenticator_enabled? %>
+    <%= form.label :current_authenticator_code, I18n.t('lato.current_authenticator_code'), class: "form-label mt-2" %>
+    <%= form.text_field :current_authenticator_code, value: nil, class: "form-control", autocomplete: "one-time-code", inputmode: "numeric" %>
+  <% elsif user.webauthn_enabled? %>
+    <%= form.hidden_field :current_webauthn_credential, value: nil, data: { lato_account_security_target: "credential" } %>
+    <p class="text-muted mt-2"><%= I18n.t('lato.security_key_confirmation_help') %></p>
+  <% end %>
+  <p class="text-danger mt-2" data-lato-account-security-target="error" role="alert"></p>
+</div>

data/app/views/lato/authentication/_fields-registration.html.erb

@@ -7,31 +7,32 @@ email_readonly ||= false
 <div class="row">
   <div class="col col-12 col-md-6 mb-3">
     <%= lato_form_item_label form, :first_name %>
-    <%= lato_form_item_input_text form, :first_name, required: true %>
+    <%= lato_form_item_input_text form, :first_name, required: true, autocomplete: 'given-name' %>
   </div>
 
   <div class="col col-12 col-md-6 mb-3">
     <%= lato_form_item_label form, :last_name %>
-    <%= lato_form_item_input_text form, :last_name, required: true %>
+    <%= lato_form_item_input_text form, :last_name, required: true, autocomplete: 'family-name' %>
   </div>
 
   <div class="col col-12 mb-3">
     <%= lato_form_item_label form, :email %>
-    <%= lato_form_item_input_email form, :email, required: true, readonly: email_readonly %>
+    <%= lato_form_item_input_email form, :email, required: true, readonly: email_readonly, autocomplete: 'email' %>
   </div>
 
   <div class="col col-12 col-md-6 mb-3">
     <%= lato_form_item_label form, :password %>
-    <%= lato_form_item_input_password form, :password, required: true %>
+    <%= lato_form_item_input_password form, :password, required: true, autocomplete: 'new-password', minlength: Lato.config.auth_password_min_length, aria: { describedby: form.field_id(:password, :help) } %>
+    <div class="form-text" id="<%= form.field_id(:password, :help) %>"><%= I18n.t('lato.password_requirements', count: Lato.config.auth_password_min_length) %></div>
   </div>
 
   <div class="col col-12 col-md-6 mb-3">
     <%= lato_form_item_label form, :password_confirmation %>
-    <%= lato_form_item_input_password form, :password_confirmation, required: true %>
+    <%= lato_form_item_input_password form, :password_confirmation, required: true, autocomplete: 'new-password' %>
   </div>
 </div>
 
 <div class="mb-3 text-muted" style="font-size: 14px;">
-  <%= lato_form_item_input_check form, :accepted_privacy_policy_version, I18n.t('lato.privacy_policy_checkbox', link: link_to(I18n.t('lato.privacy_policy'), Lato.config.legal_privacy_policy_url, target: '_blank')), required: true %>
-  <%= lato_form_item_input_check form, :accepted_terms_and_conditions_version, I18n.t('lato.terms_and_conditions_checkbox', link: link_to(I18n.t('lato.terms_and_conditions'), Lato.config.legal_terms_and_conditions_url, target: '_blank')), required: true %>
+  <%= lato_form_item_input_check form, :accepted_privacy_policy_version, I18n.t('lato.privacy_policy_checkbox', link: link_to(I18n.t('lato.privacy_policy'), Lato.config.legal_privacy_policy_url, target: '_blank')).html_safe, required: true %>
+  <%= lato_form_item_input_check form, :accepted_terms_and_conditions_version, I18n.t('lato.terms_and_conditions_checkbox', link: link_to(I18n.t('lato.terms_and_conditions'), Lato.config.legal_terms_and_conditions_url, target: '_blank')).html_safe, required: true %>
 </div>

data/app/views/lato/authentication/_form-authenticator.html.erb

@@ -10,11 +10,11 @@ user ||= Lato::User.new
     <%= lato_form_errors user, class: %w[mb-3] %>
 
     <div class="mb-3 text-center">
-      <p><%= raw I18n.t('lato.authenticator_code_help', email: h(user.email_protected)) %></p>
+      <%= form.label :authenticator_code, raw(I18n.t('lato.authenticator_code_help', email: h(user.email_protected))), class: 'form-label' %>
     </div>
     
     <div class="mb-3">
-      <%= lato_form_item_input_text form, :authenticator_code, required: true %>
+      <%= lato_form_item_input_text form, :authenticator_code, required: true, autocomplete: 'one-time-code', inputmode: 'numeric', pattern: '[0-9]{6}', maxlength: 6, autofocus: true %>
     </div>
 
     <div>

data/app/views/lato/authentication/_form-signin.html.erb

@@ -11,12 +11,12 @@ user ||= Lato::User.new
     
     <div class="mb-3">
       <%= lato_form_item_label form, :email %>
-      <%= lato_form_item_input_email form, :email, required: true %>
+      <%= lato_form_item_input_email form, :email, required: true, autocomplete: 'username' %>
     </div>
 
     <div class="mb-3">
       <%= lato_form_item_label form, :password %>
-      <%= lato_form_item_input_password form, :password, required: true %>
+      <%= lato_form_item_input_password form, :password, required: true, autocomplete: 'current-password' %>
     </div>
 
     <div>

data/app/views/lato/authentication/_form-verify-email.html.erb

@@ -10,13 +10,14 @@ code ||= nil
   <%= form_with model: user, url: lato.authentication_verify_email_action_path(id: user.id), class: 'text-center', data: { turbo_frame: '_self' } do |form| %>
     <% if code %>
       <%= form.hidden_field :code, value: code %>
-      <button type="submit" style="display: none;"></button>
+      <%# Visible fallback when JavaScript is disabled or blocked by CSP. %>
+      <button type="submit" class="btn btn-primary"><%= I18n.t('lato.verify_email') %></button>
       <script>document.getElementById('authentication_form_verify_email').querySelector('button[type="submit"]').click()</script>
     <% else %>
       <%= lato_form_notices class: %w[mb-3], fixed: true %>
       <%= lato_form_errors user, class: %w[mb-3], fixed: true %>
 
-      <%= link_to 'Torna all tuo account', lato.account_path, class: %w[btn btn-primary] %>
+      <%= link_to I18n.t('lato.back_to_account'), lato.account_path, class: %w[btn btn-primary] %>
     <% end %>
   <% end %>
 <% end %>