lato 3.5.3 → 3.5.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 610cd08cd020b1b26a751748428a2f3d67bad1e3aac70ff532d4ace4b12ee018
-  data.tar.gz: afa483e3d08332a1ba970a0688f9a71a920fd9b6918a900a7a0df073a77c6113
+  metadata.gz: f4dc0f435932a6eb561b49dc030c8d331ac306331ca42e9ea65a37418820c682
+  data.tar.gz: 6cfd69cae2762adbd4790af754f9b30e4f7f621f46f0f41ab5906f7c35c43b17
 SHA512:
-  metadata.gz: 74c33bc114d471e79cff2828221b86d3af314e247be371c4278c57f147e9a7fbe3f2f630c305e967c615af234374c65526bd89e3a99ee62ce35b62b3ae7083fc
-  data.tar.gz: b56cac710dc65f72d779a990588d364c2904d5ab972410b0955817ccb8b2d0654b98ed0172640fc367f31dee9702f4ed87f1cc72d44f24edf2efbde58db368c1
+  metadata.gz: b4738ffe8f9a83428305903f6253bdf844f7e64b87aa12f061597f579b558236e14357f51f091f646010186bd8d6dcf84348de019b16e512e53fcd8040295945
+  data.tar.gz: 645f8fad8ddcc489f954ddf704c44fa8ad1a088f20d768c9a0ce0524e19c227b62528701eabdb5ab3201e5576674873006ba3ac3ff7358c60b6ff88ed5bb5e28

data/app/controllers/lato/account_controller.rb

@@ -20,7 +20,7 @@ module Lato
     def update_web3_action
       return respond_to_with_not_found unless Lato.config.web3_connection
 
-      if @session.user.web3_connection_completed?
+      if @session.user.web3_address
         respond_to do |format|
           if @session.user.remove_web3_connection
             format.html { redirect_to lato.account_path }
@@ -30,19 +30,21 @@ module Lato
             format.json { render json: @session.user.errors, status: :unprocessable_entity }
           end
         end
-      elsif @session.user.web3_connection_started?
+      elsif session[:web3_nonce]
         respond_to do |format|
-          if @session.user.complete_web3_connection(params.require(:user).permit(:web3_address, :web3_signed_nonce))
+          if @session.user.add_web3_connection(params.require(:user).permit(:web3_address, :web3_signed_nonce).merge(web3_nonce: session[:web3_nonce]))
+            session[:web3_nonce] = nil
             format.html { redirect_to lato.account_path }
             format.json { render json: @session.user }
           else
+            session[:web3_nonce] = nil
             format.html { render :index, status: :unprocessable_entity }
             format.json { render json: @session.user.errors, status: :unprocessable_entity }
           end
         end
       else
         respond_to do |format|
-          if @session.user.start_web3_connection
+          if session[:web3_nonce] = SecureRandom.hex(32)
             format.html { redirect_to lato.account_path }
             format.json { render json: @session.user }
           else

data/app/controllers/lato/authentication_controller.rb

@@ -40,27 +40,26 @@ module Lato
     end
 
     def web3_signin
-      session[:web3_signin_id] = SecureRandom.hex
-
       @user = Lato::User.new
-      @user.id = session[:web3_signin_id] # This is a temporary id to identify the user
-      @user.start_web3_signin
+      session[:web3_nonce] = SecureRandom.hex(32)
     end
 
     def web3_signin_action
       @user = Lato::User.new
-      @user.id = session[:web3_signin_id] # This is a temporary id to identify the user
 
       respond_to do |format|
         if @user.web3_signin(params.require(:user).permit(:web3_address, :web3_signed_nonce).merge(
           ip_address: request.remote_ip,
-          user_agent: request.user_agent
+          user_agent: request.user_agent,
+          web3_nonce: session[:web3_nonce]
         ))
+          session[:web3_nonce] = nil
           session_create(@user.id)
 
           format.html { redirect_to lato.root_path }
           format.json { render json: @user }
         else
+          session[:web3_nonce] = nil
           format.html { render :web3_signin, status: :unprocessable_entity }
           format.json { render json: @user.errors, status: :unprocessable_entity }
         end

data/app/models/lato/user.rb

@@ -29,6 +29,7 @@ module Lato
 
     before_validation do
       self.email = email&.downcase&.strip
+      self.web3_address = web3_address&.downcase&.strip
     end
 
     before_create do
@@ -39,7 +40,6 @@ module Lato
       self.email_verified_at = nil if email_changed?
       self.accepted_privacy_policy_version = Lato.config.legal_privacy_policy_version if accepted_privacy_policy_version_changed?
       self.accepted_terms_and_conditions_version = Lato.config.legal_terms_and_conditions_version if accepted_terms_and_conditions_version_changed?
-      self.web3_address = web3_address&.downcase&.strip if web3_address_changed?
     end
 
     # Questions
@@ -53,14 +53,6 @@ module Lato
       @valid_accepted_terms_and_conditions_version ||= accepted_terms_and_conditions_version >= Lato.config.legal_terms_and_conditions_version
     end
 
-    def web3_connection_completed?
-      @web3_connection_completed ||= !web3_address.blank?
-    end
-
-    def web3_connection_started?
-      @web3_connection_started ||= !c_web3_nonce.blank?
-    end
-
     # Helpers
     ##
 
@@ -119,10 +111,6 @@ module Lato
       true
     end
 
-    def start_web3_signin
-      c_web3_nonce(SecureRandom.hex(32))
-    end
-
     def web3_signin(params)
       self.web3_address = params[:web3_address]
 
@@ -132,7 +120,7 @@ module Lato
         return
       end
 
-      signature_pubkey = Eth::Signature.personal_recover(c_web3_nonce, params[:web3_signed_nonce])
+      signature_pubkey = Eth::Signature.personal_recover(params[:web3_nonce], params[:web3_signed_nonce])
       signature_address = Eth::Util.public_key_to_address signature_pubkey
       unless signature_address.to_s.downcase == params[:web3_address].downcase
         errors.add(:web3_signed_nonce, :not_correct)
@@ -151,8 +139,10 @@ module Lato
         Rails.logger.error(e)
       end
 
-      c_web3_nonce__clear
       true
+    rescue StandardError => e
+      errors.add(:base, :web3_connection_error)
+      false
     end
 
     def request_verify_email
@@ -278,23 +268,8 @@ module Lato
       end
     end
 
-    def start_web3_connection
-      update(web3_address: nil)
-      c_web3_nonce(SecureRandom.hex(32))
-
-      true
-    end
-
-    def complete_web3_connection(params)
-      nonce = c_web3_nonce
-      c_web3_nonce__clear # Important to rollback to status 0 of web3 connection
-
-      unless nonce
-        errors.add(:base, :web3_nonce_expired)
-        return
-      end
-
-      signature_pubkey = Eth::Signature.personal_recover(nonce, params[:web3_signed_nonce])
+    def add_web3_connection(params)
+      signature_pubkey = Eth::Signature.personal_recover(params[:web3_nonce], params[:web3_signed_nonce])
       signature_address = Eth::Util.public_key_to_address signature_pubkey
       unless signature_address.to_s.downcase == params[:web3_address].downcase
         errors.add(:base, :web3_address_invalid)
@@ -303,14 +278,12 @@ module Lato
 
       update(web3_address: params[:web3_address])
     rescue StandardError => e
-      c_web3_nonce__clear # Important to rollback to status 0 of web3 connection
       errors.add(:base, :web3_connection_error)
       false
     end
 
     def remove_web3_connection
       update(web3_address: nil)
-      c_web3_nonce__clear
       true
     end
 
@@ -340,21 +313,5 @@ module Lato
       Rails.cache.write(cache_key, value, expires_in: 30.minutes)
       value
     end
-
-    def c_web3_nonce(value = nil)
-      cache_key = "Lato::User/c_web3_nonce/#{id}"
-      return Rails.cache.read(cache_key) if value.nil?
-
-      Rails.cache.write(cache_key, value, expires_in: 1.minutes)
-      @web3_connection_started = nil # HARD FIX: reset web3 connection status
-      value
-    end
-
-    def c_web3_nonce__clear
-      cache_key = "Lato::User/c_web3_nonce/#{id}"
-      Rails.cache.delete(cache_key)
-      @web3_connection_started = nil # HARD FIX: reset web3 connection status
-      true
-    end
   end
 end

data/app/views/lato/account/_form-web3.html.erb

@@ -9,12 +9,12 @@ user ||= Lato::User.new
     <%= lato_form_notices class: %w[mb-3] %>
     <%= lato_form_errors user, class: %w[mb-3] %>
 
-    <% if user.web3_connection_completed? %>
+    <% if user.web3_address %>
       <div class="row">
         <div class="col col-12 mb-3">
           <%= lato_form_item_label form, :web3_address %>
           <div class="input-group">
-            <%= lato_form_item_input_text form, :web3_address, required: true, readonly: true %>
+            <input value="<%= user.web3_address %>" class="form-control" readonly>
             <button class="btn btn-outline-success" style="pointer-events: none"><%= I18n.t('lato.connected_wallet') %></button>
           </div>
         </div>
@@ -23,7 +23,7 @@ user ||= Lato::User.new
       <div class="d-flex justify-content-end">
         <%= lato_form_submit form, I18n.t('lato.disconnect_wallet'), class: %w[btn-danger] %>
       </div>
-    <% elsif user.web3_connection_started? %>
+    <% elsif session[:web3_nonce] %>
       <div class="alert alert-light mb-0">
         <h4 class="alert-heading">Connecting..</h4>
         <div class="progress" role="progressbar" aria-valuenow="100" aria-valuemin="0" aria-valuemax="100">
@@ -31,7 +31,7 @@ user ||= Lato::User.new
         </div>
       </div>
       
-      <span id="account_form-web3__nonce" style="display: none;"><%= user.c_web3_nonce %></span>
+      <span id="account_form-web3__nonce" style="display: none;"><%= session[:web3_nonce] %></span>
       <%= form.hidden_field :web3_address, id: 'account_form-web3__input-web3_address'  %>
       <%= form.hidden_field :web3_signed_nonce, id: 'account_form-web3__input-web3_signed_nonce' %>
       <%= lato_form_submit form, 'Confirm', class: %w[btn-primary d-none], id: 'account_form-web3__submit' %>
@@ -48,12 +48,16 @@ user ||= Lato::User.new
           let address = ''
           let signedNonce = ''
 
-          if (window.ethereum) {
-            const provider = new ethers.ethers.providers.Web3Provider(window.ethereum)
-            await provider.send('eth_requestAccounts', [])
-            const signer = provider.getSigner()
-            address = await signer.getAddress()
-            signedNonce = await signer.signMessage(nonce)
+          try {
+            if (window.ethereum) {
+              const provider = new ethers.ethers.providers.Web3Provider(window.ethereum)
+              await provider.send('eth_requestAccounts', [])
+              const signer = provider.getSigner()
+              address = await signer.getAddress()
+              signedNonce = await signer.signMessage(nonce)
+            }
+          } catch (error) {
+            console.error(error)
           }
 
           inputAddress.value = address

data/app/views/lato/authentication/_form-web3-signin.html.erb

@@ -8,43 +8,59 @@ user ||= Lato::User.new
   <%= form_with model: user, url: lato.authentication_web3_signin_action_path, data: { turbo_frame: '_self', controller: 'lato-form' } do |form| %>
     <%= lato_form_notices class: %w[mb-3] %>
     <%= lato_form_errors user, class: %w[mb-3] %>
+
+    <% if session[:web3_nonce] %>
     
-    <div class="alert alert-light mb-0 text-center">
-      <h4 class="alert-heading">Connecting..</h4>
-      <div class="progress" role="progressbar" aria-valuenow="100" aria-valuemin="0" aria-valuemax="100">
-        <div class="progress-bar progress-bar-striped progress-bar-animated" style="width: 100%"></div>
+      <div class="alert alert-light mb-0 text-center">
+        <h4 class="alert-heading">Connecting..</h4>
+        <div class="progress" role="progressbar" aria-valuenow="100" aria-valuemin="0" aria-valuemax="100">
+          <div class="progress-bar progress-bar-striped progress-bar-animated" style="width: 100%"></div>
+        </div>
       </div>
-    </div>
-    
-    <span id="account_form-web3__nonce" style="display: none;"><%= user.c_web3_nonce %></span>
-    <%= form.hidden_field :web3_address, id: 'account_form-web3__input-web3_address'  %>
-    <%= form.hidden_field :web3_signed_nonce, id: 'account_form-web3__input-web3_signed_nonce' %>
-    <%= lato_form_submit form, 'Confirm', class: %w[btn-primary d-none], id: 'account_form-web3__submit' %>
-
-    <script>
-      (async () => {
-        const ethers = await import('https://cdnjs.cloudflare.com/ajax/libs/ethers/5.7.2/ethers.esm.min.js')
-
-        const nonce = document.getElementById('account_form-web3__nonce').innerText
-        const inputAddress = document.getElementById('account_form-web3__input-web3_address')
-        const inputSignedNonce = document.getElementById('account_form-web3__input-web3_signed_nonce')
-        const submitButton = document.getElementById('account_form-web3__submit')
-
-        let address = ''
-        let signedNonce = ''
-
-        if (window.ethereum) {
-          const provider = new ethers.ethers.providers.Web3Provider(window.ethereum)
-          await provider.send('eth_requestAccounts', [])
-          const signer = provider.getSigner()
-          address = await signer.getAddress()
-          signedNonce = await signer.signMessage(nonce)
-        }
-
-        inputAddress.value = address
-        inputSignedNonce.value = signedNonce
-        submitButton.click()
-      })()
-    </script>
+      
+      <span id="account_form-web3__nonce" style="display: none;"><%= session[:web3_nonce] %></span>
+      <%= form.hidden_field :web3_address, id: 'account_form-web3__input-web3_address'  %>
+      <%= form.hidden_field :web3_signed_nonce, id: 'account_form-web3__input-web3_signed_nonce' %>
+      <%= lato_form_submit form, 'Confirm', class: %w[btn-primary d-none], id: 'account_form-web3__submit' %>
+
+      <script>
+        (async () => {
+          const ethers = await import('https://cdnjs.cloudflare.com/ajax/libs/ethers/5.7.2/ethers.esm.min.js')
+
+          const nonce = document.getElementById('account_form-web3__nonce').innerText
+          const inputAddress = document.getElementById('account_form-web3__input-web3_address')
+          const inputSignedNonce = document.getElementById('account_form-web3__input-web3_signed_nonce')
+          const submitButton = document.getElementById('account_form-web3__submit')
+
+          let address = ''
+          let signedNonce = ''
+
+          try {
+            if (window.ethereum) {
+              const provider = new ethers.ethers.providers.Web3Provider(window.ethereum)
+              await provider.send('eth_requestAccounts', [])
+              const signer = provider.getSigner()
+              address = await signer.getAddress()
+              signedNonce = await signer.signMessage(nonce)
+            }
+          } catch (error) {
+            console.error(error)
+          }
+
+          inputAddress.value = address
+          inputSignedNonce.value = signedNonce
+          submitButton.click()
+        })()
+      </script>
+
+    <% else %>
+      <div class="text-center">
+        <%= link_to I18n.t('lato.retry'), lato.authentication_web3_signin_path, class: %w[btn btn-primary], data: { turbo_frame: '_self' } %>
+
+        <div class="mt-3">
+          <%= I18n.t('lato.or').downcase %> <%= link_to I18n.t('lato.back').downcase, lato.authentication_signin_path %>
+        </div>
+      </div>
+    <% end %>
   <% end %>
 <% end %>

data/config/locales/en.yml

@@ -47,6 +47,8 @@ en:
     disconnect_wallet: Disconnect
     connected_wallet: Connected
     web3_signin: Web3 Login
+    retry: Retry
+    back: Go back
 
     account_controller:
       update_user_action_notice: Account information properly updated
@@ -79,7 +81,6 @@ en:
               privacy_policy_invalid: To accept the privacy policy you must select the confirmation checkbox
               terms_and_conditions_invalid: To accept the terms and conditions you must select the confirmation checkbox
               web3_address_invalid: The address you send is not corretly signed
-              web3_nonce_expired: The nonce used to sign the address is expired
               web3_connection_error: Impossible to connect the wallet
             password:
               not_correct: not correct

data/config/locales/it.yml

@@ -49,6 +49,8 @@ it:
     disconnect_wallet: Disconnetti
     connected_wallet: Connesso
     web3_signin: Accedi con Web3
+    retry: Riprova
+    back: Torna indietro
 
     account_controller:
       update_user_action_notice: Informazioni account aggiornate correttamente
@@ -87,7 +89,6 @@ it:
               terms_and_conditions_invalid: Per accettare i termini e condizioni devi selezionare la checkbox di conferma
               invitation_invalid: Invito non valido
               web3_address_invalid: L'inidirizzo inviato non è correttamente firmato
-              web3_nonce_expired: Il nonce utilizzato per firmare l'indirizzo è scaduto
               web3_connection_error: Impossibile connettere il wallet
             password:
               not_correct: non corretta

data/lib/lato/version.rb

@@ -1,3 +1,3 @@
 module Lato
-  VERSION = "3.5.3"
+  VERSION = "3.5.5"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lato
 version: !ruby/object:Gem::Version
-  version: 3.5.3
+  version: 3.5.5
 platform: ruby
 authors:
 - Gregorio Galante