lato 3.25.0 → 3.26.0

data/app/controllers/lato/authentication_controller.rb

@@ -1,13 +1,13 @@
 module Lato
   class AuthenticationController < ApplicationController
-    before_action :limit_requests, only: %i[signin_action signup_action accept_invitation_action recover_password_action update_password_action verify_email_action authenticator_action webauthn_action]
-    before_action :not_authenticate_session, only: %i[signin signin_action signup signup_action accept_invitation accept_invitation_action]
+    before_action :limit_requests, only: %i[signin_action signup_action accept_invitation_action recover_password_action update_password_action verify_email_action authenticator_action webauthn_action web3_signin_action]
+    before_action :not_authenticate_session, only: %i[signin signin_action web3_signin web3_signin_action signup signup_action accept_invitation accept_invitation_action]
     before_action :authenticate_session, only: %i[signout signout_action]
 
     before_action :find_user, only: %i[verify_email verify_email_action]
     before_action :find_recover_password_user, only: %i[update_password update_password_action]
     before_action :find_invitation, only: %i[accept_invitation accept_invitation_action]
-    before_action :find_authentication_user, only: %i[authentication_method authentication_method_action webauthn webauthn_action]
+    before_action :find_authentication_user, only: %i[authentication_method authentication_method_action authenticator authenticator_action webauthn webauthn_action]
 
     before_action :lock_signup_if_disabled, only: %i[signup signup_action]
     before_action :lock_recover_password_if_disabled, only: %i[recover_password recover_password_action update_password update_password_action]
@@ -26,12 +26,15 @@ module Lato
 
     def signin_action
       @user = Lato::User.new
+      signin_params = params.require(:user).permit(:email, :password)
+      return if account_limit_reached?(signin_params[:email])
 
       respond_to do |format|
-        if @user.signin(params.require(:user).permit(:email, :password).merge(
+        if @user.signin(signin_params.merge(
           ip_address: request.remote_ip,
           user_agent: request.user_agent
         ))
+          account_limit_reset(signin_params[:email])
           redirect_path = determine_authentication_redirect(@user)
           if redirect_path
             # Second factor still pending: expose only where to continue, not user data.
@@ -43,6 +46,7 @@ module Lato
             format.json { render json: @user }
           end
         else
+          account_limit_track_failure(signin_params[:email])
           format.html { render :signin, status: :unprocessable_entity }
           format.json { render json: @user.errors, status: :unprocessable_entity }
         end
@@ -51,7 +55,7 @@ module Lato
 
     def web3_signin
       @user = Lato::User.new
-      session[:web3_nonce] = SecureRandom.hex(32)
+      web3_message_generate('sign in')
     end
 
     def web3_signin_action
@@ -61,20 +65,18 @@ module Lato
         if @user.web3_signin(params.require(:user).permit(:web3_address, :web3_signed_nonce).merge(
           ip_address: request.remote_ip,
           user_agent: request.user_agent,
-          web3_nonce: session[:web3_nonce]
+          web3_nonce: web3_message_consume
         ))
-          session[:web3_nonce] = nil
           redirect_path = determine_authentication_redirect(@user)
           if redirect_path
             format.html { redirect_to redirect_path }
-            format.json { render json: @user }
+            format.json { render json: { redirect: redirect_path } }
           else
             session_create(@user.id)
             format.html { redirect_to lato.root_path }
             format.json { render json: @user }
           end
         else
-          session[:web3_nonce] = nil
           format.html { render :web3_signin, status: :unprocessable_entity }
           format.json { render json: @user.errors, status: :unprocessable_entity }
         end
@@ -232,22 +234,19 @@ module Lato
     # Authenticator
     ##
 
-    def authenticator
-      @user = Lato::User.find_by_id(session[:authentication_user_id])
-      return respond_to_with_not_found unless @user
-    end
+    def authenticator; end
 
     def authenticator_action
-      @user = Lato::User.find_by_id(session[:authentication_user_id])
-
       respond_to do |format|
         if @user.authenticator(params.require(:user).permit(:authenticator_code))
+          account_limit_reset(authentication_limit_identifier)
           clear_authentication_session
           session_create(@user.id)
 
           format.html { redirect_to lato.root_path }
           format.json { render json: @user }
         else
+          track_authentication_failure
           format.html { render :authenticator, status: :unprocessable_entity }
           format.json { render json: @user.errors, status: :unprocessable_entity }
         end
@@ -265,12 +264,14 @@ module Lato
     def webauthn_action
       respond_to do |format|
         if @user.webauthn_authentication(params.require(:user).permit(:webauthn_credential), session[:webauthn_challenge])
+          account_limit_reset(authentication_limit_identifier)
           clear_authentication_session
           session_create(@user.id)
 
           format.html { redirect_to lato.root_path }
           format.json { render json: @user }
         else
+          track_authentication_failure
           @options = @user.webauthn_authentication_options
           session[:webauthn_challenge] = @options.challenge
           format.html { render :webauthn, status: :unprocessable_entity }
@@ -305,9 +306,30 @@ module Lato
       respond_to_with_not_found unless @invitation
     end
 
+    # Pending second factor state lives in the session cookie: it expires and allows a few attempts only.
+    AUTHENTICATION_PENDING_LIFETIME = 10.minutes
+    AUTHENTICATION_PENDING_MAX_ATTEMPTS = 5
+
     def find_authentication_user
-      @user = Lato::User.find_by_id(session[:authentication_user_id])
-      respond_to_with_not_found unless @user
+      expired = session[:authentication_expires_at].to_i < Time.current.to_i
+      @user = Lato::User.find_by_id(session[:authentication_user_id]) unless expired
+      unless @user
+        clear_authentication_session
+        return respond_to_with_not_found
+      end
+
+      account_limit_reached?(authentication_limit_identifier)
+    end
+
+    def authentication_limit_identifier
+      "second_factor/#{@user.id}"
+    end
+
+    # Counted both in the session and per user in cache, so replaying an older cookie does not reset the budget.
+    def track_authentication_failure
+      account_limit_track_failure(authentication_limit_identifier)
+      session[:authentication_attempts] = session[:authentication_attempts].to_i + 1
+      clear_authentication_session if session[:authentication_attempts] >= AUTHENTICATION_PENDING_MAX_ATTEMPTS
     end
 
     def determine_authentication_redirect(user)
@@ -317,6 +339,8 @@ module Lato
       return nil unless authenticator_enabled || webauthn_enabled
 
       session[:authentication_user_id] = user.id
+      session[:authentication_expires_at] = AUTHENTICATION_PENDING_LIFETIME.from_now.to_i
+      session[:authentication_attempts] = 0
 
       if authenticator_enabled && webauthn_enabled
         lato.authentication_authentication_method_path
@@ -329,6 +353,8 @@ module Lato
 
     def clear_authentication_session
       session[:authentication_user_id] = nil
+      session[:authentication_expires_at] = nil
+      session[:authentication_attempts] = nil
       session[:authentication_method] = nil
       session[:webauthn_challenge] = nil
     end
@@ -372,35 +398,44 @@ module Lato
 
       hcaptcha_response = params["h-captcha-response"]
       if hcaptcha_response.blank?
-        @user.errors.add(:base, "hCaptcha response is missing")
-        respond_to do |format|
-          format.html { render render_key, status: :unprocessable_entity }
-          format.json { render json: @user.errors, status: :unprocessable_entity }
-        end
-        return false
+        return respond_to_hcaptcha_error(render_key, I18n.t('lato.hcaptcha_missing'))
       end
 
+      unless hcaptcha_verified?(hcaptcha_response)
+        return respond_to_hcaptcha_error(render_key, I18n.t('lato.hcaptcha_failed'))
+      end
+
+      true
+    end
+
+    # Short timeouts: a slow hCaptcha must not hold server threads. Any network or parsing error counts as failure.
+    def hcaptcha_verified?(hcaptcha_response)
       require 'net/http'
-      require 'uri'
       require 'json'
+
       uri = URI.parse("https://hcaptcha.com/siteverify")
-      response = Net::HTTP.post_form(uri, {
-        "secret" => Lato.config.hcaptcha_secret,
-        "response" => hcaptcha_response,
-        "remoteip" => request.remote_ip
-      })
-      result = JSON.parse(response.body)
-      Rails.logger.info("[hCaptcha] Verification result: #{result}")
-      unless result["success"]
-        @user.errors.add(:base, "hCaptcha verification failed")
-        respond_to do |format|
-          format.html { render render_key, status: :unprocessable_entity }
-          format.json { render json: @user.errors, status: :unprocessable_entity }
-        end
-        return false
+      response = Net::HTTP.start(uri.host, uri.port, use_ssl: true, open_timeout: 3, read_timeout: 5) do |http|
+        http.post(uri.path, URI.encode_www_form(
+          "secret" => Lato.config.hcaptcha_secret,
+          "response" => hcaptcha_response,
+          "remoteip" => request.remote_ip
+        ), "Content-Type" => "application/x-www-form-urlencoded")
       end
+      result = JSON.parse(response.body)
+      Rails.logger.info("[hCaptcha] Verification success: #{result['success'].inspect}")
+      result["success"] == true
+    rescue StandardError => e
+      Rails.logger.error("[hCaptcha] Verification error: #{e.class}")
+      false
+    end
 
-      true
+    def respond_to_hcaptcha_error(render_key, message)
+      @user.errors.add(:base, message)
+      respond_to do |format|
+        format.html { render render_key, status: :unprocessable_entity }
+        format.json { render json: @user.errors, status: :unprocessable_entity }
+      end
+      false
     end
   end
 end

data/app/helpers/lato/components_helper.rb

@@ -106,7 +106,12 @@ module Lato
       # setup classes
       options[:class] ||= []
       options[:class].push(classes)
-      options[:class].push('is-invalid') if form.object && form.object.errors[key] && form.object.errors[key].any?
+      if _lato_form_errors?(form, key)
+        options[:class].push('is-invalid')
+        options[:aria] ||= {}
+        options[:aria][:invalid] = true
+        options[:aria][:describedby] = [options[:aria][:describedby], _lato_form_feedback_id(form, key)].compact.join(' ')
+      end
 
       # setup stimulus
       options[:data] ||= {}
@@ -115,6 +120,25 @@ module Lato
       options[:data][:lato_form_target] = 'input'
     end
 
+    def _lato_form_errors?(form, key)
+      form.object.respond_to?(:errors) && form.object.errors[key].any?
+    end
+
+    def _lato_form_feedback_id(form, key)
+      form.field_id(key, :feedback)
+    end
+
+    # Inline error message linked to the input through aria-describedby.
+    def _lato_form_input_feedback(form, key)
+      return ''.html_safe unless _lato_form_errors?(form, key)
+
+      content_tag :div, form.object.errors[key].to_sentence, id: _lato_form_feedback_id(form, key), class: 'invalid-feedback'
+    end
+
+    def _lato_form_input_with_feedback(form, key)
+      yield + _lato_form_input_feedback(form, key)
+    end
+
     def lato_form_notices(options = {})
       return unless notice
 
@@ -134,6 +158,7 @@ module Lato
       options[:class] ||= []
       options[:class] += %w[alert alert-danger]
       options[:class] += %w[alert-dismissible fade show] unless options[:fixed]
+      options[:role] ||= 'alert'
 
       errors_list = content_tag(:ul, class: %w[mb-0 ps-3]) do
         instance.errors.collect do |error|
@@ -158,48 +183,48 @@ module Lato
     def lato_form_item_input_text(form, key, options = {})
       _lato_form_input_options(form, key, options, :keyup, 'form-control')
 
-      form.text_field key, options
+      _lato_form_input_with_feedback(form, key) { form.text_field key, options }
     end
 
     def lato_form_item_input_number(form, key, options = {})
       _lato_form_input_options(form, key, options, :keyup, 'form-control')
 
-      form.number_field key, options
+      _lato_form_input_with_feedback(form, key) { form.number_field key, options }
     end
 
     def lato_form_item_input_email(form, key, options = {})
       _lato_form_input_options(form, key, options, :keyup, 'form-control')
 
-      form.email_field key, options
+      _lato_form_input_with_feedback(form, key) { form.email_field key, options }
     end
 
     def lato_form_item_input_password(form, key, options = {})
       _lato_form_input_options(form, key, options, :keyup, 'form-control')
 
-      form.password_field key, options
+      _lato_form_input_with_feedback(form, key) { form.password_field key, options }
     end
 
     def lato_form_item_input_check(form, key, label, options = {})
       _lato_form_input_options(form, key, options, :change, 'form-check-input')
 
-      # TO-DO: Trovare il modo di calcolare l'id dato da rails a check_input_tag e metterlo nell'attributo :for di check_label_tag
-
+      # The label is escaped unless the caller passes an html_safe string (e.g. a translation with a trusted link).
       content_tag :div, class: 'form-check' do
         concat form.check_box(key, options)
-        concat label_tag(key, raw(label), class: 'form-check-label')
+        concat form.label(key, label, class: 'form-check-label', for: options[:id] || form.field_id(key))
+        concat _lato_form_input_feedback(form, key)
       end
     end
 
     def lato_form_item_input_select(form, key, select_options = [], options = {})
       _lato_form_input_options(form, key, options, :change, 'form-control')
 
-      form.select key, select_options, {}, options
+      _lato_form_input_with_feedback(form, key) { form.select key, select_options, {}, options }
     end
 
     def lato_form_item_input_file(form, key, options = {})
       _lato_form_input_options(form, key, options, :change, 'form-control')
 
-      form.file_field key, options
+      _lato_form_input_with_feedback(form, key) { form.file_field key, options }
     end
 
     def lato_form_item_input_file_dropzone(form, key, options = {})
@@ -211,25 +236,25 @@ module Lato
     def lato_form_item_input_textarea(form, key, options = {})
       _lato_form_input_options(form, key, options, :keyup, 'form-control')
 
-      form.text_area key, options
+      _lato_form_input_with_feedback(form, key) { form.text_area key, options }
     end
 
     def lato_form_item_input_date(form, key, options = {})
       _lato_form_input_options(form, key, options, :change, 'form-control')
 
-      form.date_field key, options
+      _lato_form_input_with_feedback(form, key) { form.date_field key, options }
     end
 
     def lato_form_item_input_datetime(form, key, options = {})
       _lato_form_input_options(form, key, options, :change, 'form-control')
 
-      form.datetime_field key, options
+      _lato_form_input_with_feedback(form, key) { form.datetime_field key, options }
     end
 
     def lato_form_item_input_time(form, key, options = {})
       _lato_form_input_options(form, key, options, :change, 'form-control')
 
-      form.time_field key, options
+      _lato_form_input_with_feedback(form, key) { form.time_field key, options }
     end
 
     def lato_form_item_input_color(form, key, options = {})
@@ -237,7 +262,7 @@ module Lato
       options[:class] ||= []
       options[:class].push('lato-form-item-input-color')
       
-      form.color_field key, options
+      _lato_form_input_with_feedback(form, key) { form.color_field key, options }
     end
 
     def lato_form_item_input_list(form, key, partial, partial_params = {})
@@ -270,7 +295,8 @@ module Lato
       image_url ||= image_path('lato/user-150x150.jpg')
 
       content_tag :div, class: 'd-flex align-items-center' do
-        concat content_tag :div, '', class: 'border border-2 rounded-circle me-2', style: "background-position: center; background-size: cover; background-repeat: no-repeat; background-image: url(#{image_url}); width: 30px; height: 30px;"
+        # An img attribute is escaped, while a url() inside inline CSS could be broken out of by a crafted image URL.
+        concat image_tag(image_url, alt: '', width: 30, height: 30, class: 'border border-2 rounded-circle me-2', style: 'object-fit: cover;')
         concat content_tag :small, label, class: 'text-black'
       end
     end

data/app/jobs/lato/active_storage_cleaner_job.rb

@@ -3,23 +3,22 @@ module Lato
     def perform(params = {})
       update_operation_percentage(0)
 
-      # delete all active storage blobs that are not attached to any record with more than 12 hours of life
+      # delete all active storage blobs that are not attached to any record older than the minimum age (default 12 hours)
+      min_age_hours = (params[:min_age_hours] || params['min_age_hours'] || 12).to_i
       query = ActiveStorage::Blob.joins("LEFT JOIN active_storage_attachments ON active_storage_attachments.blob_id = active_storage_blobs.id")
                                  .where("active_storage_attachments.blob_id IS NULL")
-                                 .where("active_storage_blobs.created_at < ?", 12.hours.ago)
+                                 .where("active_storage_blobs.created_at < ?", min_age_hours.hours.ago)
       totals = query.count
       runned = 0
       query.find_in_batches do |blobs|
         blobs.each(&:purge_later)
         runned += blobs.size
-        update_operation_percentage((runned.to_f / totals * 100).round)
+        update_operation_percentage((runned.to_f / totals * 100).round) if totals.positive?
       end
 
       # delete all empty folders in active storage local service (if exists)
-      if ActiveStorage::Blob.service.class.to_s == 'ActiveStorage::Service::DiskService'
-        storage_folder = ActiveStorage::Blob.service.root
-        return unless File.directory?(storage_folder)
-
+      storage_folder = ActiveStorage::Blob.service.root if ActiveStorage::Blob.service.class.to_s == 'ActiveStorage::Service::DiskService'
+      if storage_folder && File.directory?(storage_folder)
         Dir.foreach(storage_folder) do |folder|
           next if folder == '.' || folder == '..'
 
@@ -27,6 +26,8 @@ module Lato
           FileUtils.rm_rf(folder_path) if File.directory?(folder_path) && Dir.empty?(folder_path)
         end
       end
+
+      update_operation_percentage(100)
     end
   end
 end

data/app/models/lato/invitation.rb

@@ -23,7 +23,7 @@ module Lato
     # be sure that email is not already used by another user
     before_create do
       if Lato::User.find_by(email: email)
-        errors.add(:email, 'is already used by another user')
+        errors.add(:email, :taken)
         throw :abort
       end
     end

data/app/models/lato/operation.rb

@@ -73,9 +73,13 @@ module Lato
 
     def start
       begin
-        active_job_name.constantize.perform_later(active_job_input.merge(_operation_id: id))
+        # Only operation jobs can be started: active_job_name may come from request params in host apps.
+        job_class = active_job_name.to_s.safe_constantize
+        raise ArgumentError, "#{active_job_name} is not a Lato::ApplicationJob" unless job_class.is_a?(Class) && job_class < Lato::ApplicationJob
+
+        job_class.perform_later(active_job_input.merge(_operation_id: id))
       rescue StandardError
-        errors.add(:base, 'Impossibile eseguire il job')
+        errors.add(:base, :start_error)
         return false
       end
 

data/app/models/lato/user.rb

@@ -17,6 +17,7 @@ module Lato
     validates :accepted_terms_and_conditions_version, presence: true
     validates :web3_address, uniqueness: true, allow_blank: true
     validates :webauthn_id, uniqueness: true, allow_blank: true
+    validate :validate_password_length, unless: -> { password.nil? }
 
     # Relations
     ##
@@ -174,16 +175,22 @@ module Lato
 
       self.web3_address = params[:web3_address]
 
-      user = Lato::User.find_by(web3_address: params[:web3_address].downcase)
+      user = Lato::User.find_by(web3_address: params[:web3_address].to_s.downcase)
       unless user
         errors.add(:web3_address, :not_correct)
         return
       end
 
+      # Missing or expired challenge message.
+      if params[:web3_nonce].blank?
+        errors.add(:base, :web3_address_invalid)
+        return
+      end
+
       signature_pubkey = Eth::Signature.personal_recover(params[:web3_nonce], params[:web3_signed_nonce])
       signature_address = Eth::Util.public_key_to_address signature_pubkey
       unless signature_address.to_s.downcase == params[:web3_address].downcase
-        errors.add(:web3_signed_nonce, :not_correct)
+        errors.add(:base, :web3_address_invalid)
         return
       end
 
@@ -339,6 +346,11 @@ module Lato
     def add_web3_connection(params)
       depends_on('eth')
 
+      if params[:web3_nonce].blank?
+        errors.add(:base, :web3_address_invalid)
+        return
+      end
+
       signature_pubkey = Eth::Signature.personal_recover(params[:web3_nonce], params[:web3_signed_nonce])
       signature_address = Eth::Util.public_key_to_address signature_pubkey
       unless signature_address.to_s.downcase == params[:web3_address].downcase
@@ -391,7 +403,8 @@ module Lato
 
       update(
         webauthn_id: Base64.strict_encode64(credential.raw_id),
-        webauthn_public_key: credential.public_key
+        webauthn_public_key: credential.public_key,
+        webauthn_sign_count: credential.sign_count.to_i
       )
     rescue JSON::ParserError, WebAuthn::Error => e
       Rails.logger.error(e)
@@ -423,11 +436,13 @@ module Lato
 
       credential = WebAuthn::Credential.from_get(parsed_payload)
 
+      # A counter that does not grow (raises SignCountVerificationError) reveals a cloned authenticator.
       credential.verify(
         encoded_challenge,
         public_key: webauthn_public_key,
-        sign_count: 0
+        sign_count: webauthn_sign_count.to_i
       )
+      update_column(:webauthn_sign_count, credential.sign_count.to_i)
 
       true
     rescue JSON::ParserError, WebAuthn::Error => e
@@ -440,28 +455,38 @@ module Lato
     def remove_webauthn_credential
       update(
         webauthn_id: nil,
-        webauthn_public_key: nil
+        webauthn_public_key: nil,
+        webauthn_sign_count: 0
       )
     end
 
     def generate_authenticator_secret
-      update(authenticator_secret: ROTP::Base32.random)
+      update(authenticator_secret: ROTP::Base32.random, authenticator_last_used_at: nil)
     end
 
     def remove_authenticator_secret
-      update(authenticator_secret: nil)
+      update(authenticator_secret: nil, authenticator_last_used_at: nil)
     end
 
     def authenticator(params)
       return false unless authenticator_enabled?
 
       totp = ROTP::TOTP.new(authenticator_secret)
-      result = totp.verify(params[:authenticator_code])
-      unless result
+      # after: rejects codes of an already used time step, so an observed code can not be replayed.
+      used_at = totp.verify(params[:authenticator_code].to_s, after: authenticator_last_used_at&.to_i, drift_behind: 15)
+      used_at = Time.at(used_at) if used_at
+
+      # Conditional update: of two concurrent requests with the same code only one can claim it.
+      claimed = used_at && self.class.where(id: id)
+        .where('authenticator_last_used_at IS NULL OR authenticator_last_used_at < ?', used_at)
+        .update_all(authenticator_last_used_at: used_at) == 1
+      unless claimed
         errors.add(:base, :authenticator_code_invalid)
         return
       end
 
+      self.authenticator_last_used_at = used_at
+      clear_attribute_change(:authenticator_last_used_at)
       true
     end
 
@@ -515,6 +540,11 @@ module Lato
 
     private
 
+    def validate_password_length
+      minimum = Lato.config.auth_password_min_length.to_i
+      errors.add(:password, :too_short, count: minimum) if password.to_s.length < minimum
+    end
+
     def normalize_email(value)
       value.to_s.downcase.strip
     end

data/app/views/lato/account/_alert-accepted-privacy-policy-version.html.erb

@@ -11,7 +11,7 @@
       <% end %>
       <%= form_with model: @session.user, url: lato.account_update_accepted_privacy_policy_version_action_path, data: { turbo_frame: '_self' } do |form| %>
         <%= lato_form_errors @session.user, class: %w[mb-3] %>
-        <%= lato_form_item_input_check form, :confirm, I18n.t('lato.privacy_policy_checkbox', link: link_to(I18n.t('lato.privacy_policy'), Lato.config.legal_privacy_policy_url, target: '_blank')), checked: false, required: true %>
+        <%= lato_form_item_input_check form, :confirm, I18n.t('lato.privacy_policy_checkbox', link: link_to(I18n.t('lato.privacy_policy'), Lato.config.legal_privacy_policy_url, target: '_blank')).html_safe, checked: false, required: true %>
 
         <div class="mt-3">
           <%= lato_form_submit form, I18n.t('lato.confirm') %>

data/app/views/lato/account/_alert-accepted-terms-and-conditions-version.html.erb

@@ -11,7 +11,7 @@
       <% end %>
       <%= form_with model: @session.user, url: lato.account_update_accepted_terms_and_conditions_version_action_path, data: { turbo_frame: '_self' } do |form| %>
         <%= lato_form_errors @session.user, class: %w[mb-3] %>
-        <%= lato_form_item_input_check form, :confirm, I18n.t('lato.terms_and_conditions_checkbox', link: link_to(I18n.t('lato.terms_and_conditions'), Lato.config.legal_terms_and_conditions_url)), checked: false, required: true %>
+        <%= lato_form_item_input_check form, :confirm, I18n.t('lato.terms_and_conditions_checkbox', link: link_to(I18n.t('lato.terms_and_conditions'), Lato.config.legal_terms_and_conditions_url)).html_safe, checked: false, required: true %>
 
         <div class="mt-3">
           <%= lato_form_submit form, I18n.t('lato.confirm') %>

data/app/views/lato/account/_form-authenticator.html.erb

@@ -9,12 +9,16 @@
       <%= lato_form_submit form, I18n.t('lato.account_authenticator_disable'), class: %w[btn-danger] %>
     <% elsif session[:pending_authenticator_secret].present? %>
       <div class="text-center mb-3">
-        <img class="shadow-sm rounded" alt="Authenticator enrollment QR code" src="<%= user.authenticator_qr_code_base64(secret: session[:pending_authenticator_secret]) %>" />
+        <img class="shadow-sm rounded" alt="<%= I18n.t('lato.authenticator_qr_code_alt') %>" src="<%= user.authenticator_qr_code_base64(secret: session[:pending_authenticator_secret]) %>" />
+      </div>
+      <div class="mb-3">
+        <label class="form-label" for="account_form-authenticator__manual-key"><%= I18n.t('lato.authenticator_manual_key') %></label>
+        <input type="text" class="form-control font-monospace" id="account_form-authenticator__manual-key" value="<%= session[:pending_authenticator_secret] %>" readonly>
       </div>
       <%= form.hidden_field :authenticator_command, value: "confirm" %>
-      <%= form.label :authenticator_code, "Confirm authenticator code", class: "form-label" %>
+      <%= form.label :authenticator_code, I18n.t('lato.confirm_authenticator_code'), class: "form-label" %>
       <%= form.text_field :authenticator_code, value: nil, required: true, class: "form-control mb-3", autocomplete: "one-time-code", inputmode: "numeric" %>
-      <%= lato_form_submit form, "Confirm", class: %w[btn-primary] %>
+      <%= lato_form_submit form, I18n.t('lato.confirm'), class: %w[btn-primary] %>
     <% else %>
       <div class="alert alert-light"><%= raw I18n.t('lato.account_authenticator_start_description') %></div>
       <%= render 'lato/account/security-confirmation', form: form, user: user %>

data/app/views/lato/account/_form-password.html.erb

@@ -13,12 +13,13 @@ user ||= Lato::User.new
     <div class="row">
       <div class="col col-12 col-lg-6 mb-3">
         <%= lato_form_item_label form, :password, I18n.t('lato.new_password') %>
-        <%= lato_form_item_input_password form, :password, required: true %>
+        <%= lato_form_item_input_password form, :password, required: true, autocomplete: 'new-password', minlength: Lato.config.auth_password_min_length, aria: { describedby: form.field_id(:password, :help) } %>
+        <div class="form-text" id="<%= form.field_id(:password, :help) %>"><%= I18n.t('lato.password_requirements', count: Lato.config.auth_password_min_length) %></div>
       </div>
 
       <div class="col col-12 col-lg-6 mb-3">
         <%= lato_form_item_label form, :password_confirmation, I18n.t('lato.confirm_new_password') %>
-        <%= lato_form_item_input_password form, :password_confirmation, required: true %>
+        <%= lato_form_item_input_password form, :password_confirmation, required: true, autocomplete: 'new-password' %>
       </div>
     </div>
 

data/app/views/lato/account/_form-web3.html.erb

@@ -30,7 +30,7 @@ user ||= Lato::User.new
       </div>
     <% elsif session[:web3_nonce] %>
       <div class="alert alert-light mb-0">
-        <h4 class="alert-heading">Connecting..</h4>
+        <h4 class="alert-heading" role="status"><%= I18n.t('lato.connecting') %></h4>
         <div class="progress" role="progressbar" aria-valuenow="100" aria-valuemin="0" aria-valuemax="100">
           <div class="progress-bar progress-bar-striped progress-bar-animated" style="width: 100%"></div>
         </div>
@@ -39,13 +39,14 @@ user ||= Lato::User.new
       <span id="account_form-web3__nonce" style="display: none;"><%= session[:web3_nonce] %></span>
       <%= form.hidden_field :web3_address, id: 'account_form-web3__input-web3_address'  %>
       <%= form.hidden_field :web3_signed_nonce, id: 'account_form-web3__input-web3_signed_nonce' %>
-      <%= lato_form_submit form, 'Confirm', class: %w[btn-primary d-none], id: 'account_form-web3__submit' %>
+      <%= lato_form_submit form, I18n.t('lato.confirm'), class: %w[btn-primary d-none], id: 'account_form-web3__submit' %>
 
       <script>
         (async () => {
+          // Pinned exact version: dynamic import() can not carry an SRI hash (see README security checklist).
           const ethers = await import('https://cdnjs.cloudflare.com/ajax/libs/ethers/5.7.2/ethers.esm.min.js')
 
-          const nonce = document.getElementById('account_form-web3__nonce').innerText
+          const nonce = document.getElementById('account_form-web3__nonce').textContent
           const inputAddress = document.getElementById('account_form-web3__input-web3_address')
           const inputSignedNonce = document.getElementById('account_form-web3__input-web3_signed_nonce')
           const submitButton = document.getElementById('account_form-web3__submit')