lato 3.26.1 → 3.27.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 59109ceb11a3fb4c78126d99664864266b1d25ac77ff36ef8f6cf3bc5a66ab18
-  data.tar.gz: 7ca6befa9186b81529841c3b25409396beb26b154f99c605557c0b1106e32594
+  metadata.gz: ca0108e01aa5bff67ba259b762e004d4ec95615bbd4faf091c0087a4d8bc3cdc
+  data.tar.gz: feee33ccb082d681bc490a05ec77bdca6d55375c02d7f9d3807b1cd377ef19a6
 SHA512:
-  metadata.gz: 33934d542029ce620a7ff4e06c03a2eab2bc7fff362d07237641329724cdac95541b6ea98fb0ad171d84a007705593896a796d2e7648387c4269b22c6812665c
-  data.tar.gz: 5797d50477282510f006e201009aa8c0e7b21dd6c7cadf5e80c0dfbbda8eabbadf88669a06f7425d1d95953ac8ffa2a8ae809dd1333959849805491d3cec6bf8
+  metadata.gz: 05a6b79b4b4e5d91d431f0840607ed6abd23c7ae34f5dda501b5c8a417a03a056abacac65bc61044bf9831389755d367da3f099b64220e3e021a7f71f3db7cbe
+  data.tar.gz: f4a331bea0a0c6d9f1bafb16de41644fceb8bc34bf3f2aa8c627b9afec69d0742dfecf29a848cb0f0abb5d21ae7c55e4294041d28225d8c96f00ff931f57f67c

data/README.md

@@ -143,43 +143,25 @@ rails lato:install:migrations
 rails db:migrate
 ```
 
-### Upgrading to the latest release
+Read [UPGRADING.md](UPGRADING.md) for the changes and extra steps required by each version.
 
-- Run `rails lato:install:migrations && rails db:migrate`: the release adds `authenticator_last_used_at` and `webauthn_sign_count` to `lato_users`.
-- `lato_page_head(title)` now escapes the title. Pass an `html_safe` string to render HTML.
-- `lato_form_item_input_check` escapes the label unless it is `html_safe`.
-- `data-turbo-confirm` messages and `data-action-title` are rendered as plain text.
-- New config `Lato.config.auth_password_min_length` (default 8), checked whenever a password is set.
-- Rate limits are stricter: `limit_requests` allows exactly `limit` requests per IP and action, signin is also limited per email (10 failed attempts in 15 minutes) and second factor attempts are counted per user. The pending second factor step expires after 10 minutes or 5 wrong codes.
-- TOTP codes can be used only once and the WebAuthn signature counter is enforced.
-- Web3 signin uses a message bound to host, nonce and issue time (single use, 5 minutes) and requires `gem "eth"`.
-- `switch_locale` redirects only to same-host referers. The GET route `switch_locale_get` is deprecated: use POST `lato.switch_locale_path(locale:)`.
-- `Lato::Operation#start` only starts classes inheriting from `Lato::ApplicationJob`.
-- Schedule the maintenance jobs `Lato::LatoOperationsCleanerJob` and `Lato::ActiveStorageCleanerJob` (see the operations documentation).
+## Security recommendations for your application
 
-### Upgrading to 3.25
-
-Lato 3.25 requires Rails >= 8.1.3.1 and < 8.2. Install the new session migration before serving requests (`rails lato:install:migrations && rails db:migrate`).
-
-Sessions are stored as revocable token hashes in the database. Existing cookies require a fresh sign-in after upgrading (global logout). Signing out revokes the current device; changing or recovering a password revokes all devices. Password recovery preserves existing second factors and does not disable them.
-
-Account password, email, authentication factor, wallet, and account deletion changes require the current password plus an enrolled authenticator or security key. Authenticator enrollment requires confirmation with a valid code; an active authenticator's secret is never displayed again. API clients submit `user[current_password]` and, when enrolled, `user[current_authenticator_code]`. Security key clients first POST to `account/security_challenge`, then submit the assertion as `user[current_webauthn_credential]`. Enrollment continuations expire after five minutes and can only be used once.
-
-Extensions updating session attributes must call `session_update(extra_params)` to preserve the revocable session and secure cookie attributes.
-
-## Production security checklist
+Lato ships secure defaults, but some settings belong to the Rails application that uses it. These recommendations help applications using Lato reach a higher security level in production:
 
 - Set `config.force_ssl = true`: the session cookie is `secure` only when the request is SSL.
-- Use a persistent `Rails.cache` shared across processes (Redis, Solid Cache, Memcached). Recovery codes, verification codes and all rate limits depend on it; Lato logs a warning at boot in production if it is a `NullStore`.
+- Use a persistent `Rails.cache` shared across processes (Redis, Solid Cache, Memcached). Recovery codes, verification codes and rate limits depend on it.
 - Set `config.action_controller.raise_on_open_redirects = true`.
-- Content Security Policy: the Web3 and verify-email views use inline scripts, so those pages need `unsafe-inline` or nonces. `ethers` 5.7.2 is loaded from cdnjs with a dynamic `import()`: pinned to an exact version but without SRI. Vendor it if you need strict supply-chain control.
-- `session_lifetime` (default 30 days) is an absolute lifetime of cookie and database record, with no sliding renewal or idle timeout.
-- WebAuthn: use HTTPS in `webauthn_origin` (a string or an array of origins). There is one credential per user, no backup codes, and user verification is not required.
-- hCaptcha is optional (`hcaptcha_site_key`, `hcaptcha_secret`) and protects signup and password recovery.
-- Schedule `Lato::LatoOperationsCleanerJob` and `Lato::ActiveStorageCleanerJob`, they are not scheduled automatically.
-- Invitations do not expire: destroy pending ones that are no longer needed.
-- `authenticator_secret` is stored in clear in the database: consider Active Record encryption.
-- Signin per-email limiting can be used to temporarily lock a known email: monitor failed signins.
+- Enable a Content Security Policy. Lato views need no inline scripts: enable nonces for the importmap tags (`config.content_security_policy_nonce_generator` and `content_security_policy_nonce_directives = %w[script-src]`) instead of `'unsafe-inline'`. Lato serves all its scripts, stylesheets and fonts through the asset pipeline, so `script-src`, `style-src` and `font-src` need no third-party CDN. Only these extra sources are needed:
+  - `hcaptcha.com` and `*.hcaptcha.com` (only with hCaptcha enabled): `script-src`, `frame-src`, `style-src` and `connect-src`.
+  - `data:` in `img-src` for the authenticator QR code. Views use inline `style` attributes, so `style-src` still needs `'unsafe-inline'`.
+- Set `Lato.config.session_idle_timeout` (e.g. `30.minutes`) and review `session_lifetime` (default 30 days, absolute).
+- Review `Lato.config.invitation_lifetime` (default 30 days) and destroy pending invitations that are no longer needed.
+- WebAuthn: use HTTPS origins in `webauthn_origin`. Set `webauthn_user_verification = "required"` if all your users have authenticators with biometrics or PIN.
+- Encrypt authenticator secrets: configure Active Record encryption keys (`bin/rails db:encryption:init`) and set `Lato.config.encrypt_authenticator_secret = true` in an initializer. With existing plaintext secrets, set `config.active_record.encryption.support_unencrypted_data = true` until they are re-encrypted.
+- Configure hCaptcha (`hcaptcha_site_key`, `hcaptcha_secret`) to protect signup and password recovery.
+- Schedule `Lato::LatoOperationsCleanerJob` and `Lato::ActiveStorageCleanerJob`: they are not scheduled automatically.
+- Monitor failed signins: the per-email signin limit can be used to temporarily lock out a known email.
 
 ## Development
 

data/app/assets/config/lato_manifest.js

@@ -1,5 +1,7 @@
 //= link_directory ../stylesheets/lato .css
 //= link_directory ../images/lato .jpg
 //= link_tree ../javascripts/lato .js
-//#= link popper.js
+//= link_tree ../fonts/lato
+//= link popper.js
+//= link local-time.es2017-esm.js
 //= link bootstrap.js

data/app/assets/javascripts/lato/controllers/lato_account_webauthn_controller.js

@@ -54,7 +54,7 @@ export default class extends Controller {
       authenticatorSelection: {
         authenticatorAttachment: 'platform',
         requireResidentKey: false,
-        userVerification: 'preferred'
+        userVerification: options.authenticatorSelection?.userVerification || 'preferred'
       },
       attestation: 'none'
     }

data/app/assets/javascripts/lato/controllers/lato_auto_submit_controller.js

@@ -0,0 +1,8 @@
+import { Controller } from "@hotwired/stimulus"
+
+// Submits the form as soon as it is rendered. Keep a visible submit button as fallback when JavaScript is disabled.
+export default class extends Controller {
+  connect() {
+    this.element.requestSubmit()
+  }
+}

data/app/assets/javascripts/lato/controllers/lato_input_autocomplete2_controller.js

@@ -1,5 +1,5 @@
 import { Controller } from "@hotwired/stimulus"
-import _ from 'lodash'
+import debounce from 'lato/debounce'
 
 export default class extends Controller {
   static values = {
@@ -11,7 +11,7 @@ export default class extends Controller {
    */
 
   connect() {
-    this.search = _.debounce(this.search, 500)
+    this.search = debounce(this.search, 500)
 
     this.realInput = document.createElement('input')
     this.realInput.type = 'hidden'

data/app/assets/javascripts/lato/controllers/lato_input_autocomplete_controller.js

@@ -1,5 +1,5 @@
 import { Controller } from "@hotwired/stimulus"
-import _ from 'lodash'
+import debounce from 'lato/debounce'
 
 export default class extends Controller {
   static values = {
@@ -11,7 +11,7 @@ export default class extends Controller {
    */
 
   connect() {
-    this.search = _.debounce(this.search, 500)
+    this.search = debounce(this.search, 500)
     this.datalist = document.createElement('datalist')
     this.datalist.id = Math.random().toString(36)
     this.element.setAttribute('list', this.datalist.id)

data/app/assets/javascripts/lato/controllers/lato_web3_sign_controller.js

@@ -0,0 +1,30 @@
+import { Controller } from "@hotwired/stimulus"
+
+// Asks the browser wallet to sign the server nonce, then submits the form with address and signature.
+// Empty values are submitted when no wallet is available or the user rejects the request: the server handles the error.
+export default class extends Controller {
+  static targets = ['nonce', 'address', 'signedNonce', 'submit']
+
+  async connect() {
+    const { ethers } = await import('ethers')
+
+    let address = ''
+    let signedNonce = ''
+
+    try {
+      if (window.ethereum) {
+        const provider = new ethers.providers.Web3Provider(window.ethereum)
+        await provider.send('eth_requestAccounts', [])
+        const signer = provider.getSigner()
+        address = await signer.getAddress()
+        signedNonce = await signer.signMessage(this.nonceTarget.textContent)
+      }
+    } catch (error) {
+      console.error(error)
+    }
+
+    this.addressTarget.value = address
+    this.signedNonceTarget.value = signedNonce
+    this.submitTarget.click()
+  }
+}

data/app/assets/javascripts/lato/debounce.js

@@ -0,0 +1,8 @@
+// Delays fn until wait ms have passed without new calls.
+export default function debounce (fn, wait) {
+  let timeout
+  return function (...args) {
+    clearTimeout(timeout)
+    timeout = setTimeout(() => fn.apply(this, args), wait)
+  }
+}