lato 3.26.1 → 3.27.0

data/app/assets/stylesheets/lato/application.scss

@@ -20,7 +20,7 @@ $gray-900: #1f262c !default;
 $tooltip-opacity: 1;
 $tooltip-max-width: 300px;
 
-@import url("https://cdn.jsdelivr.net/npm/bootstrap-icons@1.11.2/font/bootstrap-icons.css");
+@import "bootstrap-icons";
 @import "bootstrap";
 
 /** Turbo loading **/

data/app/controllers/concerns/lato/sessionable.rb

@@ -5,6 +5,7 @@ module Lato
     included do
       before_action do
         @session = Lato::Session.new(cookies.encrypted[:lato_session])
+        @session.track_activity
       end
     end
 

data/app/controllers/lato/authentication_controller.rb

@@ -188,6 +188,7 @@ module Lato
 
     def accept_invitation
       @user = Lato::User.new(email: @invitation.email)
+      @user.errors.add(:base, :invitation_expired) if @invitation.expired?
     end
 
     def accept_invitation_action

data/app/models/lato/invitation.rb

@@ -50,6 +50,14 @@ module Lato
       !!accepted_at
     end
 
+    # The lifetime counts from the last time the invitation email was sent (send_invite touches the record).
+    def expired?
+      lifetime = Lato.config.invitation_lifetime
+      return false if lifetime.blank? || accepted?
+
+      updated_at.present? && updated_at <= lifetime.ago
+    end
+
     # Operations
     ##
 
@@ -71,6 +79,7 @@ module Lato
       end
 
       c_email_invite_semaphore(true)
+      touch
 
       true
     end

data/app/models/lato/session.rb

@@ -69,6 +69,21 @@ module Lato
       end
     end
 
+    # Activity is written at most once per interval to avoid a database write on every request.
+    ACTIVITY_TOUCH_INTERVAL = 1.minute
+
+    # Revokes the session when idle for longer than Lato.config.session_idle_timeout, otherwise records the activity.
+    def track_activity
+      timeout = Lato.config.session_idle_timeout
+      return unless timeout && (current = unexpired_record)
+
+      if current.updated_at <= timeout.ago
+        current.destroy!
+      elsif current.updated_at <= [ACTIVITY_TOUCH_INTERVAL, timeout / 2].min.ago
+        current.touch
+      end
+    end
+
     def destroy
       record&.destroy!
       @session = nil
@@ -88,9 +103,23 @@ module Lato
 
     # Always query revocation state, including when a Session instance was already used.
     def record
+      scope = unexpired_record_scope
+      return unless scope
+
+      timeout = Lato.config.session_idle_timeout
+      scope = scope.where("updated_at > ?", timeout.ago) if timeout
+      scope.first
+    end
+
+    # Not expired record, ignoring the idle timeout.
+    def unexpired_record
+      unexpired_record_scope&.first
+    end
+
+    def unexpired_record_scope
       return unless @session&.dig(:token).is_a?(String) && @session[:token].present?
 
-      Lato::SessionRecord.where(lato_user_id: @session[:user_id], token_digest: Digest::SHA256.hexdigest(@session[:token])).where("expires_at > ?", Time.current).first
+      Lato::SessionRecord.where(lato_user_id: @session[:user_id], token_digest: Digest::SHA256.hexdigest(@session[:token])).where("expires_at > ?", Time.current)
     end
 
     def parse_session(session)

data/app/models/lato/user.rb

@@ -7,6 +7,9 @@ module Lato
 
     has_secure_password
 
+    # Evaluated when the class loads: Lato.config.encrypt_authenticator_secret must be set in an initializer.
+    encrypts :authenticator_secret if Lato.config.encrypt_authenticator_secret
+
     # Validations
     ##
 
@@ -333,6 +336,11 @@ module Lato
         return
       end
 
+      if invitation.expired?
+        errors.add(:base, :invitation_expired)
+        return
+      end
+
       ActiveRecord::Base.transaction do
         raise ActiveRecord::Rollback unless save && invitation.update(
           accepted_at: Time.now,
@@ -376,13 +384,15 @@ module Lato
           name: email,
           display_name: full_name
         },
-        exclude: webauthn_exclude_credentials.map { |cred| Base64.strict_encode64(cred) }
+        exclude: webauthn_exclude_credentials.map { |cred| Base64.strict_encode64(cred) },
+        authenticator_selection: { user_verification: Lato.config.webauthn_user_verification }
       )
     end
 
     def webauthn_authentication_options
       WebAuthn::Credential.options_for_get(
-        allow: webauthn_allow_credentials.map { |cred| Base64.strict_encode64(cred) }
+        allow: webauthn_allow_credentials.map { |cred| Base64.strict_encode64(cred) },
+        user_verification: Lato.config.webauthn_user_verification
       )
     end
 
@@ -399,7 +409,7 @@ module Lato
 
       parsed_payload = JSON.parse(credential_payload)
       credential = WebAuthn::Credential.from_create(parsed_payload)
-      credential.verify(Base64.strict_decode64(encoded_challenge))
+      credential.verify(Base64.strict_decode64(encoded_challenge), user_verification: webauthn_user_verification_required?)
 
       update(
         webauthn_id: Base64.strict_encode64(credential.raw_id),
@@ -440,7 +450,8 @@ module Lato
       credential.verify(
         encoded_challenge,
         public_key: webauthn_public_key,
-        sign_count: webauthn_sign_count.to_i
+        sign_count: webauthn_sign_count.to_i,
+        user_verification: webauthn_user_verification_required?
       )
       update_column(:webauthn_sign_count, credential.sign_count.to_i)
 
@@ -563,6 +574,11 @@ module Lato
       )
     end
 
+    # The client honours the requested level only as a hint: "required" must also be checked on the response.
+    def webauthn_user_verification_required?
+      Lato.config.webauthn_user_verification.to_s == 'required'
+    end
+
     def webauthn_user_handle
       Digest::SHA256.digest("lato-user-#{id}")
     end

data/app/views/lato/account/_form-web3.html.erb

@@ -36,41 +36,12 @@ user ||= Lato::User.new
         </div>
       </div>
       
-      <span id="account_form-web3__nonce" style="display: none;"><%= session[:web3_nonce] %></span>
-      <%= form.hidden_field :web3_address, id: 'account_form-web3__input-web3_address'  %>
-      <%= form.hidden_field :web3_signed_nonce, id: 'account_form-web3__input-web3_signed_nonce' %>
-      <%= lato_form_submit form, I18n.t('lato.confirm'), class: %w[btn-primary d-none], id: 'account_form-web3__submit' %>
-
-      <script>
-        (async () => {
-          // Pinned exact version: dynamic import() can not carry an SRI hash (see README security checklist).
-          const ethers = await import('https://cdnjs.cloudflare.com/ajax/libs/ethers/5.7.2/ethers.esm.min.js')
-
-          const nonce = document.getElementById('account_form-web3__nonce').textContent
-          const inputAddress = document.getElementById('account_form-web3__input-web3_address')
-          const inputSignedNonce = document.getElementById('account_form-web3__input-web3_signed_nonce')
-          const submitButton = document.getElementById('account_form-web3__submit')
-
-          let address = ''
-          let signedNonce = ''
-
-          try {
-            if (window.ethereum) {
-              const provider = new ethers.ethers.providers.Web3Provider(window.ethereum)
-              await provider.send('eth_requestAccounts', [])
-              const signer = provider.getSigner()
-              address = await signer.getAddress()
-              signedNonce = await signer.signMessage(nonce)
-            }
-          } catch (error) {
-            console.error(error)
-          }
-
-          inputAddress.value = address
-          inputSignedNonce.value = signedNonce
-          submitButton.click()
-        })()
-      </script>
+      <div data-controller="lato-web3-sign">
+        <span id="account_form-web3__nonce" style="display: none;" data-lato-web3-sign-target="nonce"><%= session[:web3_nonce] %></span>
+        <%= form.hidden_field :web3_address, id: 'account_form-web3__input-web3_address', data: { lato_web3_sign_target: 'address' } %>
+        <%= form.hidden_field :web3_signed_nonce, id: 'account_form-web3__input-web3_signed_nonce', data: { lato_web3_sign_target: 'signedNonce' } %>
+        <%= lato_form_submit form, I18n.t('lato.confirm'), class: %w[btn-primary d-none], id: 'account_form-web3__submit', data: { lato_web3_sign_target: 'submit' } %>
+      </div>
     <% else %>
       <div class="alert alert-light mb-0">
         <h3 class="alert-heading h4"><%= I18n.t('lato.account_web3_start_title') %></h3>

data/app/views/lato/authentication/_form-verify-email.html.erb

@@ -7,12 +7,11 @@ code ||= nil
 
 
 <%= turbo_frame_tag 'authentication_form_verify_email' do %>
-  <%= form_with model: user, url: lato.authentication_verify_email_action_path(id: user.id), class: 'text-center', data: { turbo_frame: '_self' } do |form| %>
+  <%= form_with model: user, url: lato.authentication_verify_email_action_path(id: user.id), class: 'text-center', data: { turbo_frame: '_self', controller: code ? 'lato-auto-submit' : nil } do |form| %>
     <% if code %>
       <%= form.hidden_field :code, value: code %>
       <%# Visible fallback when JavaScript is disabled or blocked by CSP. %>
       <button type="submit" class="btn btn-primary"><%= I18n.t('lato.verify_email') %></button>
-      <script>document.getElementById('authentication_form_verify_email').querySelector('button[type="submit"]').click()</script>
     <% else %>
       <%= lato_form_notices class: %w[mb-3], fixed: true %>
       <%= lato_form_errors user, class: %w[mb-3], fixed: true %>

data/app/views/lato/authentication/_form-web3-signin.html.erb

@@ -18,41 +18,12 @@ user ||= Lato::User.new
         </div>
       </div>
       
-      <span id="account_form-web3__nonce" style="display: none;"><%= session[:web3_nonce] %></span>
-      <%= form.hidden_field :web3_address, id: 'account_form-web3__input-web3_address'  %>
-      <%= form.hidden_field :web3_signed_nonce, id: 'account_form-web3__input-web3_signed_nonce' %>
-      <%= lato_form_submit form, I18n.t('lato.confirm'), class: %w[btn-primary d-none], id: 'account_form-web3__submit' %>
-
-      <script>
-        (async () => {
-          // Pinned exact version: dynamic import() can not carry an SRI hash (see README security checklist).
-          const ethers = await import('https://cdnjs.cloudflare.com/ajax/libs/ethers/5.7.2/ethers.esm.min.js')
-
-          const nonce = document.getElementById('account_form-web3__nonce').textContent
-          const inputAddress = document.getElementById('account_form-web3__input-web3_address')
-          const inputSignedNonce = document.getElementById('account_form-web3__input-web3_signed_nonce')
-          const submitButton = document.getElementById('account_form-web3__submit')
-
-          let address = ''
-          let signedNonce = ''
-
-          try {
-            if (window.ethereum) {
-              const provider = new ethers.ethers.providers.Web3Provider(window.ethereum)
-              await provider.send('eth_requestAccounts', [])
-              const signer = provider.getSigner()
-              address = await signer.getAddress()
-              signedNonce = await signer.signMessage(nonce)
-            }
-          } catch (error) {
-            console.error(error)
-          }
-
-          inputAddress.value = address
-          inputSignedNonce.value = signedNonce
-          submitButton.click()
-        })()
-      </script>
+      <div data-controller="lato-web3-sign">
+        <span id="account_form-web3__nonce" style="display: none;" data-lato-web3-sign-target="nonce"><%= session[:web3_nonce] %></span>
+        <%= form.hidden_field :web3_address, id: 'account_form-web3__input-web3_address', data: { lato_web3_sign_target: 'address' } %>
+        <%= form.hidden_field :web3_signed_nonce, id: 'account_form-web3__input-web3_signed_nonce', data: { lato_web3_sign_target: 'signedNonce' } %>
+        <%= lato_form_submit form, I18n.t('lato.confirm'), class: %w[btn-primary d-none], id: 'account_form-web3__submit', data: { lato_web3_sign_target: 'submit' } %>
+      </div>
 
     <% else %>
       <div class="text-center">

data/app/views/layouts/lato/application.html.erb

@@ -17,8 +17,8 @@
 
   <%= render 'layouts/lato/head_content' %>
 
-  <% # TEMPORARY FIX: Popper js not working using bootstrap-gem %>
-  <script src="https://cdn.jsdelivr.net/npm/@popperjs/core@2.9.2/dist/umd/popper.min.js" integrity="sha384-IQsoLXl5PILFhosVNubq5LC7Qb9DXgDA9i+tQ8Zj3iwWAwPtgFTxbJ8NT4GN1R8p" crossorigin="anonymous"></script>
+  <%# Popper UMD build from the popper_js gem (bootstrap dependency): Bootstrap reads it from window.Popper %>
+  <%= javascript_include_tag "popper" %>
   
   <%= stylesheet_link_tag Lato.config.assets_stylesheet_entry, media: "all" %>
   <%= javascript_importmap_tags Lato.config.assets_importmap_entry %>

data/config/importmap.rb

@@ -4,6 +4,7 @@ pin_all_from Lato::Engine.root.join("app/assets/javascripts/lato/controllers"),
 pin "@rails/activestorage", to: "activestorage.esm.js", preload: true
 
 pin "bootstrap", to: "bootstrap.js", preload: true
-# pin "@popperjs/core", to: "popper.js", preload: true
-pin "local-time", to: "https://ga.jspm.io/npm:local-time@3.0.3/app/assets/javascripts/local-time.es2017-esm.js"
-pin "lodash", to: "https://ga.jspm.io/npm:lodash@4.17.21/lodash.js"
+pin "local-time", to: "local-time.es2017-esm.js"
+pin "lato/debounce", to: "lato/debounce.js"
+# Vendored (verified against the cdnjs SRI hash) and loaded on demand by the web3 controller.
+pin "ethers", to: "lato/vendor/ethers.esm.min.js", preload: false

data/config/locales/en.yml

@@ -169,6 +169,7 @@ en:
               privacy_policy_invalid: To accept the privacy policy you must select the confirmation checkbox
               terms_and_conditions_invalid: To accept the terms and conditions you must select the confirmation checkbox
               invitation_invalid: Invalid invitation
+              invitation_expired: Invitation expired, ask for a new one
               web3_address_invalid: The address you send is not corretly signed
               web3_connection_error: Impossible to connect the wallet
               authenticator_code_invalid: The code you inserted is not correct

data/config/locales/fr.yml

@@ -176,6 +176,7 @@ fr:
               privacy_policy_invalid: Pour accepter la politique de confidentialité, vous devez cocher la case de confirmation
               terms_and_conditions_invalid: Pour accepter les conditions générales, vous devez cocher la case de confirmation
               invitation_invalid: Invitation non valide
+              invitation_expired: Invitation expirée, demandez-en une nouvelle
               web3_address_invalid: L'adresse envoyée n'est pas correctement signée
               web3_connection_error: Impossible de connecter le portefeuille
               authenticator_code_invalid: Le code saisi n'est pas correct

data/config/locales/it.yml

@@ -176,6 +176,7 @@ it:
               privacy_policy_invalid: Per accettare la privacy policy devi selezionare la checkbox di conferma
               terms_and_conditions_invalid: Per accettare i termini e condizioni devi selezionare la checkbox di conferma
               invitation_invalid: Invito non valido
+              invitation_expired: Invito scaduto, richiedine uno nuovo
               web3_address_invalid: L'inidirizzo inviato non è correttamente firmato
               web3_connection_error: Impossibile connettere il wallet
               authenticator_code_invalid: Il codice inserito non è corretto

data/config/locales/ro.yml

@@ -176,6 +176,7 @@ ro:
               privacy_policy_invalid: Pentru a accepta politica de confidențialitate trebuie să bifezi căsuța de confirmare
               terms_and_conditions_invalid: Pentru a accepta termenii și condițiile trebuie să bifezi căsuța de confirmare
               invitation_invalid: Invitație nevalidă
+              invitation_expired: Invitație expirată, solicită una nouă
               web3_address_invalid: Adresa trimisă nu este semnată corect
               web3_connection_error: Imposibil să se conecteze portofelul
               authenticator_code_invalid: Codul introdus nu este corect

data/lib/lato/config.rb

@@ -9,6 +9,9 @@ module Lato
     # Session configs
     attr_accessor :session_lifetime, :session_root_path
 
+    # Revoke sessions inactive for longer than this duration (nil disables the check)
+    attr_accessor :session_idle_timeout
+
     # Authentication configs
     attr_accessor :auth_disable_signup, :auth_disable_recover_password, :auth_disable_web3, :auth_disable_authenticator, :auth_disable_webauthn, :auth_disable_signin_success_mail
 
@@ -18,6 +21,9 @@ module Lato
     # Minimum password length, checked whenever a password is set
     attr_accessor :auth_password_min_length
 
+    # Invitations not accepted within this duration from the last invitation email expire (nil means they never expire)
+    attr_accessor :invitation_lifetime
+
     # Hcaptcha configs
     attr_accessor :hcaptcha_site_key, :hcaptcha_secret
 
@@ -37,6 +43,13 @@ module Lato
     # Webauth connection
     attr_accessor :webauthn_connection, :webauthn_origin, :webauthn_rp_name
 
+    # WebAuthn user verification: "discouraged", "preferred" or "required" (enforced server-side)
+    attr_accessor :webauthn_user_verification
+
+    # Encrypt Lato::User#authenticator_secret with Active Record encryption.
+    # Read when Lato::User is loaded: set it in an initializer.
+    attr_accessor :encrypt_authenticator_secret
+
     # Web3 connection
     # NOTE: It requires the gem 'eth' to be installed in the application Gemfile
     attr_accessor :web3_connection
@@ -66,6 +79,9 @@ module Lato
 
       @session_lifetime = 30.days
       @session_root_path = nil # :tutorial_path
+      @session_idle_timeout = nil
+
+      @invitation_lifetime = 30.days
 
       @email_from = 'lato@example.com'
 
@@ -79,6 +95,9 @@ module Lato
       @webauthn_connection = false
       @webauthn_origin = 'http://localhost:3000'
       @webauthn_rp_name = 'Lato Application'
+      @webauthn_user_verification = 'preferred'
+
+      @encrypt_authenticator_secret = false
     end
   end
 end

data/lib/lato/version.rb

@@ -1,3 +1,3 @@
 module Lato
-  VERSION = "3.26.1"
+  VERSION = "3.27.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lato
 version: !ruby/object:Gem::Version
-  version: 3.26.1
+  version: 3.27.0
 platform: ruby
 authors:
 - Gregorio Galante
@@ -186,6 +186,8 @@ files:
 - README.md
 - Rakefile
 - app/assets/config/lato_manifest.js
+- app/assets/fonts/lato/bootstrap-icons.woff
+- app/assets/fonts/lato/bootstrap-icons.woff2
 - app/assets/images/lato/user-150x150.jpg
 - app/assets/images/lato/user-300x300.jpg
 - app/assets/images/lato/user-600x600.jpg
@@ -198,6 +200,7 @@ files:
 - app/assets/javascripts/lato/controllers/lato_account_webauthn_controller.js
 - app/assets/javascripts/lato/controllers/lato_action_controller.js
 - app/assets/javascripts/lato/controllers/lato_aside_opener_controller.js
+- app/assets/javascripts/lato/controllers/lato_auto_submit_controller.js
 - app/assets/javascripts/lato/controllers/lato_confirm_controller.js
 - app/assets/javascripts/lato/controllers/lato_copyclip_controller.js
 - app/assets/javascripts/lato/controllers/lato_feedback_controller.js
@@ -214,7 +217,11 @@ files:
 - app/assets/javascripts/lato/controllers/lato_network_controller.js
 - app/assets/javascripts/lato/controllers/lato_operation_controller.js
 - app/assets/javascripts/lato/controllers/lato_tooltip_controller.js
+- app/assets/javascripts/lato/controllers/lato_web3_sign_controller.js
 - app/assets/javascripts/lato/controllers/lato_webauthn_auth_controller.js
+- app/assets/javascripts/lato/debounce.js
+- app/assets/javascripts/lato/vendor/ethers.esm.min.js
+- app/assets/stylesheets/lato/_bootstrap-icons.scss
 - app/assets/stylesheets/lato/application.scss
 - app/controllers/concerns/lato/componentable.rb
 - app/controllers/concerns/lato/layoutable.rb