lato 3.26.0 → 3.27.0

data/app/assets/stylesheets/lato/application.scss

@@ -20,7 +20,7 @@ $gray-900: #1f262c !default;
 $tooltip-opacity: 1;
 $tooltip-max-width: 300px;
 
-@import url("https://cdn.jsdelivr.net/npm/bootstrap-icons@1.11.2/font/bootstrap-icons.css");
+@import "bootstrap-icons";
 @import "bootstrap";
 
 /** Turbo loading **/
@@ -38,6 +38,20 @@ $tooltip-max-width: 300px;
   margin: 0 4px;
 }
 
+// WCAG 2.2 target size (2.5.8): interactive targets of at least 24x24px.
+.pagination > span > a {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  min-width: 24px;
+  min-height: 24px;
+}
+
+// Bootstrap's pink code color fails contrast on tinted alert backgrounds.
+.alert code {
+  color: inherit;
+}
+
 .pagination .current {
   font-weight: bold;
 }
@@ -143,6 +157,9 @@ main, aside {
   .btn {
     font-size: 12px;
     padding: 0.15rem 0.3rem;
+    // 25px: btn-group overlaps adjacent buttons by 1px, the visible target must stay >= 24px (WCAG 2.5.8)
+    min-width: 25px;
+    min-height: 24px;
   }
 }
 

data/app/controllers/concerns/lato/sessionable.rb

@@ -5,6 +5,7 @@ module Lato
     included do
       before_action do
         @session = Lato::Session.new(cookies.encrypted[:lato_session])
+        @session.track_activity
       end
     end
 

data/app/controllers/lato/authentication_controller.rb

@@ -188,6 +188,7 @@ module Lato
 
     def accept_invitation
       @user = Lato::User.new(email: @invitation.email)
+      @user.errors.add(:base, :invitation_expired) if @invitation.expired?
     end
 
     def accept_invitation_action

data/app/helpers/lato/components_helper.rb

@@ -284,11 +284,20 @@ module Lato
       form.submit label, options
     end
 
+    # Kaminari labels every paginator "pager": several index tables on one page would expose
+    # identical navigation landmarks, so each one gets a label from its index key (unique per page).
+    def lato_index_paginate(collection, key, **options)
+      name = key.to_s == 'default' ? collection.model.model_name.human(count: 2) : key.to_s.humanize
+      label = I18n.t('lato.pagination_label', name: name)
+      paginate(collection, param_name: "#{key}_page", **options)
+        .to_str.sub('aria-label="pager"', "aria-label=\"#{ERB::Util.html_escape(label)}\"").html_safe
+    end
+
     # Data
     ##
 
     def lato_data_badge(label, color = 'primary')
-      content_tag :span, label, class: "badge rounded-pill bg-#{color}"
+      content_tag :span, label, class: "badge rounded-pill text-bg-#{color}"
     end
 
     def lato_data_user(label, image_url = nil)

data/app/models/lato/invitation.rb

@@ -50,6 +50,14 @@ module Lato
       !!accepted_at
     end
 
+    # The lifetime counts from the last time the invitation email was sent (send_invite touches the record).
+    def expired?
+      lifetime = Lato.config.invitation_lifetime
+      return false if lifetime.blank? || accepted?
+
+      updated_at.present? && updated_at <= lifetime.ago
+    end
+
     # Operations
     ##
 
@@ -71,6 +79,7 @@ module Lato
       end
 
       c_email_invite_semaphore(true)
+      touch
 
       true
     end

data/app/models/lato/session.rb

@@ -69,6 +69,21 @@ module Lato
       end
     end
 
+    # Activity is written at most once per interval to avoid a database write on every request.
+    ACTIVITY_TOUCH_INTERVAL = 1.minute
+
+    # Revokes the session when idle for longer than Lato.config.session_idle_timeout, otherwise records the activity.
+    def track_activity
+      timeout = Lato.config.session_idle_timeout
+      return unless timeout && (current = unexpired_record)
+
+      if current.updated_at <= timeout.ago
+        current.destroy!
+      elsif current.updated_at <= [ACTIVITY_TOUCH_INTERVAL, timeout / 2].min.ago
+        current.touch
+      end
+    end
+
     def destroy
       record&.destroy!
       @session = nil
@@ -88,9 +103,23 @@ module Lato
 
     # Always query revocation state, including when a Session instance was already used.
     def record
+      scope = unexpired_record_scope
+      return unless scope
+
+      timeout = Lato.config.session_idle_timeout
+      scope = scope.where("updated_at > ?", timeout.ago) if timeout
+      scope.first
+    end
+
+    # Not expired record, ignoring the idle timeout.
+    def unexpired_record
+      unexpired_record_scope&.first
+    end
+
+    def unexpired_record_scope
       return unless @session&.dig(:token).is_a?(String) && @session[:token].present?
 
-      Lato::SessionRecord.where(lato_user_id: @session[:user_id], token_digest: Digest::SHA256.hexdigest(@session[:token])).where("expires_at > ?", Time.current).first
+      Lato::SessionRecord.where(lato_user_id: @session[:user_id], token_digest: Digest::SHA256.hexdigest(@session[:token])).where("expires_at > ?", Time.current)
     end
 
     def parse_session(session)

data/app/models/lato/user.rb

@@ -7,6 +7,9 @@ module Lato
 
     has_secure_password
 
+    # Evaluated when the class loads: Lato.config.encrypt_authenticator_secret must be set in an initializer.
+    encrypts :authenticator_secret if Lato.config.encrypt_authenticator_secret
+
     # Validations
     ##
 
@@ -333,6 +336,11 @@ module Lato
         return
       end
 
+      if invitation.expired?
+        errors.add(:base, :invitation_expired)
+        return
+      end
+
       ActiveRecord::Base.transaction do
         raise ActiveRecord::Rollback unless save && invitation.update(
           accepted_at: Time.now,
@@ -376,13 +384,15 @@ module Lato
           name: email,
           display_name: full_name
         },
-        exclude: webauthn_exclude_credentials.map { |cred| Base64.strict_encode64(cred) }
+        exclude: webauthn_exclude_credentials.map { |cred| Base64.strict_encode64(cred) },
+        authenticator_selection: { user_verification: Lato.config.webauthn_user_verification }
       )
     end
 
     def webauthn_authentication_options
       WebAuthn::Credential.options_for_get(
-        allow: webauthn_allow_credentials.map { |cred| Base64.strict_encode64(cred) }
+        allow: webauthn_allow_credentials.map { |cred| Base64.strict_encode64(cred) },
+        user_verification: Lato.config.webauthn_user_verification
       )
     end
 
@@ -399,7 +409,7 @@ module Lato
 
       parsed_payload = JSON.parse(credential_payload)
       credential = WebAuthn::Credential.from_create(parsed_payload)
-      credential.verify(Base64.strict_decode64(encoded_challenge))
+      credential.verify(Base64.strict_decode64(encoded_challenge), user_verification: webauthn_user_verification_required?)
 
       update(
         webauthn_id: Base64.strict_encode64(credential.raw_id),
@@ -440,7 +450,8 @@ module Lato
       credential.verify(
         encoded_challenge,
         public_key: webauthn_public_key,
-        sign_count: webauthn_sign_count.to_i
+        sign_count: webauthn_sign_count.to_i,
+        user_verification: webauthn_user_verification_required?
       )
       update_column(:webauthn_sign_count, credential.sign_count.to_i)
 
@@ -563,6 +574,11 @@ module Lato
       )
     end
 
+    # The client honours the requested level only as a hint: "required" must also be checked on the response.
+    def webauthn_user_verification_required?
+      Lato.config.webauthn_user_verification.to_s == 'required'
+    end
+
     def webauthn_user_handle
       Digest::SHA256.digest("lato-user-#{id}")
     end

data/app/views/lato/account/_form-web3.html.erb

@@ -30,50 +30,21 @@ user ||= Lato::User.new
       </div>
     <% elsif session[:web3_nonce] %>
       <div class="alert alert-light mb-0">
-        <h4 class="alert-heading" role="status"><%= I18n.t('lato.connecting') %></h4>
+        <h3 class="alert-heading h4" role="status"><%= I18n.t('lato.connecting') %></h3>
         <div class="progress" role="progressbar" aria-valuenow="100" aria-valuemin="0" aria-valuemax="100">
           <div class="progress-bar progress-bar-striped progress-bar-animated" style="width: 100%"></div>
         </div>
       </div>
       
-      <span id="account_form-web3__nonce" style="display: none;"><%= session[:web3_nonce] %></span>
-      <%= form.hidden_field :web3_address, id: 'account_form-web3__input-web3_address'  %>
-      <%= form.hidden_field :web3_signed_nonce, id: 'account_form-web3__input-web3_signed_nonce' %>
-      <%= lato_form_submit form, I18n.t('lato.confirm'), class: %w[btn-primary d-none], id: 'account_form-web3__submit' %>
-
-      <script>
-        (async () => {
-          // Pinned exact version: dynamic import() can not carry an SRI hash (see README security checklist).
-          const ethers = await import('https://cdnjs.cloudflare.com/ajax/libs/ethers/5.7.2/ethers.esm.min.js')
-
-          const nonce = document.getElementById('account_form-web3__nonce').textContent
-          const inputAddress = document.getElementById('account_form-web3__input-web3_address')
-          const inputSignedNonce = document.getElementById('account_form-web3__input-web3_signed_nonce')
-          const submitButton = document.getElementById('account_form-web3__submit')
-
-          let address = ''
-          let signedNonce = ''
-
-          try {
-            if (window.ethereum) {
-              const provider = new ethers.ethers.providers.Web3Provider(window.ethereum)
-              await provider.send('eth_requestAccounts', [])
-              const signer = provider.getSigner()
-              address = await signer.getAddress()
-              signedNonce = await signer.signMessage(nonce)
-            }
-          } catch (error) {
-            console.error(error)
-          }
-
-          inputAddress.value = address
-          inputSignedNonce.value = signedNonce
-          submitButton.click()
-        })()
-      </script>
+      <div data-controller="lato-web3-sign">
+        <span id="account_form-web3__nonce" style="display: none;" data-lato-web3-sign-target="nonce"><%= session[:web3_nonce] %></span>
+        <%= form.hidden_field :web3_address, id: 'account_form-web3__input-web3_address', data: { lato_web3_sign_target: 'address' } %>
+        <%= form.hidden_field :web3_signed_nonce, id: 'account_form-web3__input-web3_signed_nonce', data: { lato_web3_sign_target: 'signedNonce' } %>
+        <%= lato_form_submit form, I18n.t('lato.confirm'), class: %w[btn-primary d-none], id: 'account_form-web3__submit', data: { lato_web3_sign_target: 'submit' } %>
+      </div>
     <% else %>
       <div class="alert alert-light mb-0">
-        <h4 class="alert-heading"><%= I18n.t('lato.account_web3_start_title') %></h4>
+        <h3 class="alert-heading h4"><%= I18n.t('lato.account_web3_start_title') %></h3>
         <p>
           <%= raw I18n.t('lato.account_web3_start_description') %>
         </p>

data/app/views/lato/account/_form-webauthn.html.erb

@@ -20,7 +20,7 @@ end
 
     <% if user.webauthn_enabled? %>
       <div class="alert alert-success mb-3">
-        <h4 class="alert-heading"><%= I18n.t('lato.account_webauthn_ready_title') %></h4>
+        <h3 class="alert-heading h4"><%= I18n.t('lato.account_webauthn_ready_title') %></h3>
         <p class="mb-0">
           <%= raw I18n.t('lato.account_webauthn_ready_description') %>
         </p>
@@ -36,7 +36,7 @@ end
       <%= form.hidden_field :webauthn_credential, data: { lato_account_webauthn_target: 'credentialInput' } %>
 
       <div class="alert alert-light mb-3" data-lato-account-webauthn-target="status">
-        <h4 class="alert-heading"><%= I18n.t('lato.account_webauthn_in_progress_title') %></h4>
+        <h3 class="alert-heading h4"><%= I18n.t('lato.account_webauthn_in_progress_title') %></h3>
         <p class="mb-0">
           <%= raw I18n.t('lato.account_webauthn_in_progress_description') %>
         </p>
@@ -53,7 +53,7 @@ end
       </div>
     <% else %>
       <div class="alert alert-light mb-0">
-        <h4 class="alert-heading"><%= I18n.t('lato.account_webauthn_start_title') %></h4>
+        <h3 class="alert-heading h4"><%= I18n.t('lato.account_webauthn_start_title') %></h3>
         <p>
           <%= raw I18n.t('lato.account_webauthn_start_description') %>
         </p>

data/app/views/lato/account/_security-confirmation.html.erb

@@ -1,9 +1,12 @@
+<%# Rendered in several account forms on the same page: suffix ids so each label targets its own field. %>
+<% password_id = form.field_id(:current_password, form.object_id) %>
+<% code_id = form.field_id(:current_authenticator_code, form.object_id) %>
 <div class="mb-3" data-controller="lato-account-security" data-lato-account-security-challenge-url-value="<%= lato.account_security_challenge_path %>" data-lato-account-security-webauthn-value="<%= user.webauthn_enabled? && !user.authenticator_enabled? %>">
-  <%= form.label :current_password, I18n.t('lato.current_password'), class: "form-label" %>
-  <%= form.password_field :current_password, class: "form-control", autocomplete: "current-password" %>
+  <%= form.label :current_password, I18n.t('lato.current_password'), class: "form-label", for: password_id %>
+  <%= form.password_field :current_password, id: password_id, class: "form-control", autocomplete: "current-password" %>
   <% if user.authenticator_enabled? %>
-    <%= form.label :current_authenticator_code, I18n.t('lato.current_authenticator_code'), class: "form-label mt-2" %>
-    <%= form.text_field :current_authenticator_code, value: nil, class: "form-control", autocomplete: "one-time-code", inputmode: "numeric" %>
+    <%= form.label :current_authenticator_code, I18n.t('lato.current_authenticator_code'), class: "form-label mt-2", for: code_id %>
+    <%= form.text_field :current_authenticator_code, id: code_id, value: nil, class: "form-control", autocomplete: "one-time-code", inputmode: "numeric" %>
   <% elsif user.webauthn_enabled? %>
     <%= form.hidden_field :current_webauthn_credential, value: nil, data: { lato_account_security_target: "credential" } %>
     <p class="text-muted mt-2"><%= I18n.t('lato.security_key_confirmation_help') %></p>

data/app/views/lato/account/index.html.erb

@@ -60,7 +60,7 @@
   </div>
   <div class="card-body">
     <div class="alert alert-warning">
-      <h4 class="alert-heading"><%= I18n.t('lato.warning') %></h4>
+      <h3 class="alert-heading h4"><%= I18n.t('lato.warning') %></h3>
       <p>
         <%= raw I18n.t('lato.account_delete_details') %>
       </p>

data/app/views/lato/authentication/_form-verify-email.html.erb

@@ -7,12 +7,11 @@ code ||= nil
 
 
 <%= turbo_frame_tag 'authentication_form_verify_email' do %>
-  <%= form_with model: user, url: lato.authentication_verify_email_action_path(id: user.id), class: 'text-center', data: { turbo_frame: '_self' } do |form| %>
+  <%= form_with model: user, url: lato.authentication_verify_email_action_path(id: user.id), class: 'text-center', data: { turbo_frame: '_self', controller: code ? 'lato-auto-submit' : nil } do |form| %>
     <% if code %>
       <%= form.hidden_field :code, value: code %>
       <%# Visible fallback when JavaScript is disabled or blocked by CSP. %>
       <button type="submit" class="btn btn-primary"><%= I18n.t('lato.verify_email') %></button>
-      <script>document.getElementById('authentication_form_verify_email').querySelector('button[type="submit"]').click()</script>
     <% else %>
       <%= lato_form_notices class: %w[mb-3], fixed: true %>
       <%= lato_form_errors user, class: %w[mb-3], fixed: true %>

data/app/views/lato/authentication/_form-web3-signin.html.erb

@@ -18,41 +18,12 @@ user ||= Lato::User.new
         </div>
       </div>
       
-      <span id="account_form-web3__nonce" style="display: none;"><%= session[:web3_nonce] %></span>
-      <%= form.hidden_field :web3_address, id: 'account_form-web3__input-web3_address'  %>
-      <%= form.hidden_field :web3_signed_nonce, id: 'account_form-web3__input-web3_signed_nonce' %>
-      <%= lato_form_submit form, I18n.t('lato.confirm'), class: %w[btn-primary d-none], id: 'account_form-web3__submit' %>
-
-      <script>
-        (async () => {
-          // Pinned exact version: dynamic import() can not carry an SRI hash (see README security checklist).
-          const ethers = await import('https://cdnjs.cloudflare.com/ajax/libs/ethers/5.7.2/ethers.esm.min.js')
-
-          const nonce = document.getElementById('account_form-web3__nonce').textContent
-          const inputAddress = document.getElementById('account_form-web3__input-web3_address')
-          const inputSignedNonce = document.getElementById('account_form-web3__input-web3_signed_nonce')
-          const submitButton = document.getElementById('account_form-web3__submit')
-
-          let address = ''
-          let signedNonce = ''
-
-          try {
-            if (window.ethereum) {
-              const provider = new ethers.ethers.providers.Web3Provider(window.ethereum)
-              await provider.send('eth_requestAccounts', [])
-              const signer = provider.getSigner()
-              address = await signer.getAddress()
-              signedNonce = await signer.signMessage(nonce)
-            }
-          } catch (error) {
-            console.error(error)
-          }
-
-          inputAddress.value = address
-          inputSignedNonce.value = signedNonce
-          submitButton.click()
-        })()
-      </script>
+      <div data-controller="lato-web3-sign">
+        <span id="account_form-web3__nonce" style="display: none;" data-lato-web3-sign-target="nonce"><%= session[:web3_nonce] %></span>
+        <%= form.hidden_field :web3_address, id: 'account_form-web3__input-web3_address', data: { lato_web3_sign_target: 'address' } %>
+        <%= form.hidden_field :web3_signed_nonce, id: 'account_form-web3__input-web3_signed_nonce', data: { lato_web3_sign_target: 'signedNonce' } %>
+        <%= lato_form_submit form, I18n.t('lato.confirm'), class: %w[btn-primary d-none], id: 'account_form-web3__submit', data: { lato_web3_sign_target: 'submit' } %>
+      </div>
 
     <% else %>
       <div class="text-center">

data/app/views/lato/components/_form_item_input_signature.html.erb

@@ -102,7 +102,7 @@ default_tab = existing_url ? 'current' : 'draw'
   <%# Clear button (solo nelle tab di editing) %>
   <div class="d-flex justify-content-end mt-2" data-lato-input-signature-target="clearRow">
     <button type="button"
-            class="btn btn-outline-secondary btn-sm"
+            class="btn btn-outline-primary btn-sm"
             style="font-size: 0.75rem;"
             data-action="click->lato-input-signature#clearSignature">
       <i class="bi bi-eraser"></i> <%= I18n.t('lato.signature_clear') %>

data/app/views/lato/components/_index.html.erb

@@ -99,7 +99,7 @@ total_pages = collection.empty? ? params["#{key}_page"]&.to_i : 999_999_999 if s
           <span class="text-muted"><%= collection_total %> <%= I18n.t('lato.total_results').downcase %></span>
         <% end %>
         <% if collection.respond_to?(:total_pages) %>
-          <div class="mt-3"><%= paginate(collection, param_name: "#{key}_page", total_pages: total_pages, window: 1) %></div>
+          <div class="mt-3"><%= lato_index_paginate(collection, key, total_pages: total_pages, window: 1) %></div>
         <% end %>
       </div>
 
@@ -161,7 +161,7 @@ total_pages = collection.empty? ? params["#{key}_page"]&.to_i : 999_999_999 if s
               <td colspan="<%= columns.length %>">
                 <div class="d-flex justify-content-between align-items-center">
                   <% if collection.respond_to?(:total_pages) %>
-                    <div><%= paginate(collection, param_name: "#{key}_page", total_pages: total_pages) %></div>
+                    <div><%= lato_index_paginate(collection, key, total_pages: total_pages) %></div>
                   <% else %>
                     <div></div>
                   <% end %>

data/app/views/lato/components/_operation.html.erb

@@ -29,7 +29,7 @@
 
     <% if operation.completed_status? %>
       <div class="text-center">
-        <div class="fs-1 text-success">
+        <div class="fs-1 text-success-emphasis">
           <i class="bi bi-check-circle"></i>
         </div>
         <h2><%= I18n.t('lato.operation_completed_title') %></h2>
@@ -40,7 +40,7 @@
         <% end %>
 
         <% if operation.output_message? %>
-          <p class="text-success fw-bold">
+          <p class="text-success-emphasis fw-bold">
             <%= operation.output_message %>
           </p>
         <% end %>

data/app/views/layouts/lato/application.html.erb

@@ -17,8 +17,8 @@
 
   <%= render 'layouts/lato/head_content' %>
 
-  <% # TEMPORARY FIX: Popper js not working using bootstrap-gem %>
-  <script src="https://cdn.jsdelivr.net/npm/@popperjs/core@2.9.2/dist/umd/popper.min.js" integrity="sha384-IQsoLXl5PILFhosVNubq5LC7Qb9DXgDA9i+tQ8Zj3iwWAwPtgFTxbJ8NT4GN1R8p" crossorigin="anonymous"></script>
+  <%# Popper UMD build from the popper_js gem (bootstrap dependency): Bootstrap reads it from window.Popper %>
+  <%= javascript_include_tag "popper" %>
   
   <%= stylesheet_link_tag Lato.config.assets_stylesheet_entry, media: "all" %>
   <%= javascript_importmap_tags Lato.config.assets_importmap_entry %>

data/config/importmap.rb

@@ -4,6 +4,7 @@ pin_all_from Lato::Engine.root.join("app/assets/javascripts/lato/controllers"),
 pin "@rails/activestorage", to: "activestorage.esm.js", preload: true
 
 pin "bootstrap", to: "bootstrap.js", preload: true
-# pin "@popperjs/core", to: "popper.js", preload: true
-pin "local-time", to: "https://ga.jspm.io/npm:local-time@3.0.3/app/assets/javascripts/local-time.es2017-esm.js"
-pin "lodash", to: "https://ga.jspm.io/npm:lodash@4.17.21/lodash.js"
+pin "local-time", to: "local-time.es2017-esm.js"
+pin "lato/debounce", to: "lato/debounce.js"
+# Vendored (verified against the cdnjs SRI hash) and loaded on demand by the web3 controller.
+pin "ethers", to: "lato/vendor/ethers.esm.min.js", preload: false

data/config/locales/en.yml

@@ -5,6 +5,7 @@ en:
     alert_title: "Error"
     sort_ascending: "Sort by %{column} ascending"
     sort_descending: "Sort by %{column} descending"
+    pagination_label: "Pagination: %{name}"
     password_requirements: "At least %{count} characters."
     too_many_requests: "Too many requests, please wait %{minutes} minutes to retry."
     hcaptcha_missing: "Please complete the captcha verification."
@@ -168,6 +169,7 @@ en:
               privacy_policy_invalid: To accept the privacy policy you must select the confirmation checkbox
               terms_and_conditions_invalid: To accept the terms and conditions you must select the confirmation checkbox
               invitation_invalid: Invalid invitation
+              invitation_expired: Invitation expired, ask for a new one
               web3_address_invalid: The address you send is not corretly signed
               web3_connection_error: Impossible to connect the wallet
               authenticator_code_invalid: The code you inserted is not correct

data/config/locales/fr.yml

@@ -7,6 +7,7 @@ fr:
     alert_title: "Erreur"
     sort_ascending: "Trier par %{column} croissant"
     sort_descending: "Trier par %{column} d\u00E9croissant"
+    pagination_label: "Pagination : %{name}"
     password_requirements: "Au moins %{count} caract\u00E8res."
     too_many_requests: "Trop de requ\u00EAtes, veuillez attendre %{minutes} minutes avant de r\u00E9essayer."
     hcaptcha_missing: "Veuillez compl\u00E9ter la v\u00E9rification captcha."
@@ -175,6 +176,7 @@ fr:
               privacy_policy_invalid: Pour accepter la politique de confidentialité, vous devez cocher la case de confirmation
               terms_and_conditions_invalid: Pour accepter les conditions générales, vous devez cocher la case de confirmation
               invitation_invalid: Invitation non valide
+              invitation_expired: Invitation expirée, demandez-en une nouvelle
               web3_address_invalid: L'adresse envoyée n'est pas correctement signée
               web3_connection_error: Impossible de connecter le portefeuille
               authenticator_code_invalid: Le code saisi n'est pas correct

data/config/locales/it.yml

@@ -7,6 +7,7 @@ it:
     alert_title: "Errore"
     sort_ascending: "Ordina per %{column} crescente"
     sort_descending: "Ordina per %{column} decrescente"
+    pagination_label: "Paginazione: %{name}"
     password_requirements: "Almeno %{count} caratteri."
     too_many_requests: "Troppe richieste, attendi %{minutes} minuti prima di riprovare."
     hcaptcha_missing: "Completa la verifica captcha."
@@ -175,6 +176,7 @@ it:
               privacy_policy_invalid: Per accettare la privacy policy devi selezionare la checkbox di conferma
               terms_and_conditions_invalid: Per accettare i termini e condizioni devi selezionare la checkbox di conferma
               invitation_invalid: Invito non valido
+              invitation_expired: Invito scaduto, richiedine uno nuovo
               web3_address_invalid: L'inidirizzo inviato non è correttamente firmato
               web3_connection_error: Impossibile connettere il wallet
               authenticator_code_invalid: Il codice inserito non è corretto

data/config/locales/ro.yml

@@ -7,6 +7,7 @@ ro:
     alert_title: "Eroare"
     sort_ascending: "Sorteaz\u0103 dup\u0103 %{column} cresc\u0103tor"
     sort_descending: "Sorteaz\u0103 dup\u0103 %{column} descresc\u0103tor"
+    pagination_label: "Paginare: %{name}"
     password_requirements: "Cel pu\u021Bin %{count} caractere."
     too_many_requests: "Prea multe cereri, a\u0219tepta\u021Bi %{minutes} minute \u00EEnainte de a re\u00EEncerca."
     hcaptcha_missing: "Completa\u021Bi verificarea captcha."
@@ -175,6 +176,7 @@ ro:
               privacy_policy_invalid: Pentru a accepta politica de confidențialitate trebuie să bifezi căsuța de confirmare
               terms_and_conditions_invalid: Pentru a accepta termenii și condițiile trebuie să bifezi căsuța de confirmare
               invitation_invalid: Invitație nevalidă
+              invitation_expired: Invitație expirată, solicită una nouă
               web3_address_invalid: Adresa trimisă nu este semnată corect
               web3_connection_error: Imposibil să se conecteze portofelul
               authenticator_code_invalid: Codul introdus nu este corect

data/lib/lato/config.rb

@@ -9,6 +9,9 @@ module Lato
     # Session configs
     attr_accessor :session_lifetime, :session_root_path
 
+    # Revoke sessions inactive for longer than this duration (nil disables the check)
+    attr_accessor :session_idle_timeout
+
     # Authentication configs
     attr_accessor :auth_disable_signup, :auth_disable_recover_password, :auth_disable_web3, :auth_disable_authenticator, :auth_disable_webauthn, :auth_disable_signin_success_mail
 
@@ -18,6 +21,9 @@ module Lato
     # Minimum password length, checked whenever a password is set
     attr_accessor :auth_password_min_length
 
+    # Invitations not accepted within this duration from the last invitation email expire (nil means they never expire)
+    attr_accessor :invitation_lifetime
+
     # Hcaptcha configs
     attr_accessor :hcaptcha_site_key, :hcaptcha_secret
 
@@ -37,6 +43,13 @@ module Lato
     # Webauth connection
     attr_accessor :webauthn_connection, :webauthn_origin, :webauthn_rp_name
 
+    # WebAuthn user verification: "discouraged", "preferred" or "required" (enforced server-side)
+    attr_accessor :webauthn_user_verification
+
+    # Encrypt Lato::User#authenticator_secret with Active Record encryption.
+    # Read when Lato::User is loaded: set it in an initializer.
+    attr_accessor :encrypt_authenticator_secret
+
     # Web3 connection
     # NOTE: It requires the gem 'eth' to be installed in the application Gemfile
     attr_accessor :web3_connection
@@ -66,6 +79,9 @@ module Lato
 
       @session_lifetime = 30.days
       @session_root_path = nil # :tutorial_path
+      @session_idle_timeout = nil
+
+      @invitation_lifetime = 30.days
 
       @email_from = 'lato@example.com'
 
@@ -79,6 +95,9 @@ module Lato
       @webauthn_connection = false
       @webauthn_origin = 'http://localhost:3000'
       @webauthn_rp_name = 'Lato Application'
+      @webauthn_user_verification = 'preferred'
+
+      @encrypt_authenticator_secret = false
     end
   end
 end

data/lib/lato/version.rb

@@ -1,3 +1,3 @@
 module Lato
-  VERSION = "3.26.0"
+  VERSION = "3.27.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lato
 version: !ruby/object:Gem::Version
-  version: 3.26.0
+  version: 3.27.0
 platform: ruby
 authors:
 - Gregorio Galante
@@ -186,6 +186,8 @@ files:
 - README.md
 - Rakefile
 - app/assets/config/lato_manifest.js
+- app/assets/fonts/lato/bootstrap-icons.woff
+- app/assets/fonts/lato/bootstrap-icons.woff2
 - app/assets/images/lato/user-150x150.jpg
 - app/assets/images/lato/user-300x300.jpg
 - app/assets/images/lato/user-600x600.jpg
@@ -198,6 +200,7 @@ files:
 - app/assets/javascripts/lato/controllers/lato_account_webauthn_controller.js
 - app/assets/javascripts/lato/controllers/lato_action_controller.js
 - app/assets/javascripts/lato/controllers/lato_aside_opener_controller.js
+- app/assets/javascripts/lato/controllers/lato_auto_submit_controller.js
 - app/assets/javascripts/lato/controllers/lato_confirm_controller.js
 - app/assets/javascripts/lato/controllers/lato_copyclip_controller.js
 - app/assets/javascripts/lato/controllers/lato_feedback_controller.js
@@ -214,7 +217,11 @@ files:
 - app/assets/javascripts/lato/controllers/lato_network_controller.js
 - app/assets/javascripts/lato/controllers/lato_operation_controller.js
 - app/assets/javascripts/lato/controllers/lato_tooltip_controller.js
+- app/assets/javascripts/lato/controllers/lato_web3_sign_controller.js
 - app/assets/javascripts/lato/controllers/lato_webauthn_auth_controller.js
+- app/assets/javascripts/lato/debounce.js
+- app/assets/javascripts/lato/vendor/ethers.esm.min.js
+- app/assets/stylesheets/lato/_bootstrap-icons.scss
 - app/assets/stylesheets/lato/application.scss
 - app/controllers/concerns/lato/componentable.rb
 - app/controllers/concerns/lato/layoutable.rb