lato 3.24.0 → 3.25.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '09a445f7a4001cf512ef060934adeea3a0fd7620ebc7a8334bb95ea3e637939f'
-  data.tar.gz: aac7020d5b8ae8698a46249870543cb25cb193b2e1d910f856381fd5d1945f72
+  metadata.gz: 737de7ae597862df18ec4aa38fce9ac511c884398349122005f9107b2c8904d8
+  data.tar.gz: 2aa2e54234a0cccf18be9343e1132c6d04036126e1fe5ff6b0b0e2c0bdda1729
 SHA512:
-  metadata.gz: eeaccec11e915e024139107529d49d3878b341de85ecebb9551ce7367cbacc591362d93da08f6760eb5372eb844277e0d31c835923a20b82d240d926b4e599ba
-  data.tar.gz: a4864739c065fe216835e04b509620c7748fff88a51e8dc57849f9f7515518f0fdb3ab5e9b69f30adefb2680a48e9a149b630674f31dfeae442b919c13997a5f
+  metadata.gz: e08b461f1c18d60decbd7599f009fc90d87f94cb625b987202734f466b3182b997a14a4fc4b200e16daa5f13923fa5237f2004210776d88f9badeccdf3ce2544
+  data.tar.gz: bc865b8d9043e7a07978f8e7a8609244d5189abd7660acf306ecf9d82026c764cd09c4b98304452dfe680822108b42aca8c399ec3d660ef81b04f3bc448f3c77

data/README.md

@@ -13,10 +13,25 @@ The gem is **agnostic to the application stack**. You can use it with different
 
 The gem is designed to be easily **customizable and extendable**. You can fully customize the UI and the functionalities of the panel. You can also add new functionalities and components to the panel on the main application or develop new engines to extend the panel.
 
-The gem is ready to be used with the **latest Rails 7+** features like **[ESM import maps](https://github.com/rails/importmap-rails)**, **[Turbo](https://turbo.hotwired.dev/)** and **[Stimulus](https://stimulus.hotwired.dev)**. The front-end is designed to be responsive, mobile friendly and accessible.
+The gem is ready to be used with the **Rails 8.1.3.1 or later within the 8.1 series** features like **[ESM import maps](https://github.com/rails/importmap-rails)**, **[Turbo](https://turbo.hotwired.dev/)** and **[Stimulus](https://stimulus.hotwired.dev)**. The front-end is designed to be responsive, mobile friendly and accessible.
 
 <img src="./preview.gif" alt="Lato preview" width="100%">
 
+## Security upgrade
+
+Lato 3.25 requires Rails >= 8.1.3.1 and < 8.2. Install the new session migration before serving requests:
+
+```bash
+bundle exec rails lato:install:migrations
+bundle exec rails db:migrate
+```
+
+Sessions are stored as revocable token hashes in the database. Existing cookies require a fresh sign-in after upgrading. Signing out revokes the current device; changing or recovering a password revokes all devices. Password recovery preserves existing second factors.
+
+Account password, email, authentication factor, wallet, and account deletion changes require the current password plus an enrolled authenticator or security key. Authenticator enrollment requires confirmation with a valid code; an active authenticator's secret is never displayed again. API clients submit `user[current_password]` and, when enrolled, `user[current_authenticator_code]`. Security key clients first POST to `account/security_challenge`, then submit the assertion as `user[current_webauthn_credential]`. Enrollment continuations expire after five minutes and can only be used once.
+
+Extensions updating session attributes must call `session_update(extra_params)` to preserve the revocable session and secure cookie attributes.
+
 ## Full documentation
 
 The full documentation is available here: 👉 👉 [DOCUMENTATION](https://lato-oss.gregoriogalante.com) 👈 👈

data/app/assets/javascripts/lato/controllers/lato_account_security_controller.js

@@ -0,0 +1,51 @@
+import { Controller } from '@hotwired/stimulus'
+
+export default class extends Controller {
+  static targets = ['credential', 'error']
+  static values = { challengeUrl: String, webauthn: Boolean }
+
+  connect () {
+    this.form = this.element.closest('form')
+    this.onSubmit = this.confirm.bind(this)
+    this.form.addEventListener('submit', this.onSubmit)
+  }
+
+  disconnect () {
+    this.form.removeEventListener('submit', this.onSubmit)
+  }
+
+  async confirm (event) {
+    if (!this.webauthnValue || this.confirmed) return
+    event.preventDefault()
+    event.stopImmediatePropagation()
+    this.errorTarget.textContent = ''
+    try {
+      const response = await fetch(this.challengeUrlValue, {
+        method: 'POST',
+        headers: { Accept: 'application/json', 'X-CSRF-Token': document.querySelector('meta[name="csrf-token"]').content }
+      })
+      if (!response.ok) throw new Error('Unable to request security key confirmation.')
+      const publicKey = await response.json()
+      const decode = value => Uint8Array.from(atob(value.replace(/-/g, '+').replace(/_/g, '/')), c => c.charCodeAt(0))
+      publicKey.challenge = decode(publicKey.challenge)
+      publicKey.allowCredentials = publicKey.allowCredentials.map(credential => ({ ...credential, id: decode(credential.id) }))
+      const credential = await navigator.credentials.get({ publicKey })
+      const encode = buffer => btoa(String.fromCharCode(...new Uint8Array(buffer)))
+      this.credentialTarget.value = JSON.stringify({
+        id: credential.id,
+        rawId: encode(credential.rawId),
+        type: credential.type,
+        response: {
+          clientDataJSON: encode(credential.response.clientDataJSON),
+          authenticatorData: encode(credential.response.authenticatorData),
+          signature: encode(credential.response.signature),
+          userHandle: credential.response.userHandle ? encode(credential.response.userHandle) : null
+        }
+      })
+      this.confirmed = true
+      this.form.requestSubmit(event.submitter)
+    } catch (error) {
+      this.errorTarget.textContent = 'Security key confirmation failed. Try again.'
+    }
+  }
+}

data/app/controllers/concerns/lato/sessionable.rb

@@ -47,20 +47,33 @@ module Lato
     end
 
     def session_create(user_id)
-      # httponly keeps the cookie out of reach of injected scripts; secure avoids leaking it over plain HTTP.
+      @session&.destroy
+      reset_session
+      write_session_cookie(Lato::Session.generate_session_per_user(user_id))
+    end
+
+    def session_update(extra_params)
+      value = @session.update(extra_params)
+      return false unless value
+
+      write_session_cookie(value)
+    end
+
+    def write_session_cookie(value)
+      @session = Lato::Session.new(value)
       cookies.encrypted[:lato_session] = {
-        value: Lato::Session.generate_session_per_user(user_id),
-        expires: Lato.config.session_lifetime.from_now,
+        value: value,
+        expires: @session.expires_at,
         httponly: true,
         secure: request.ssl?
       }
-      @session = Lato::Session.new(cookies.encrypted[:lato_session])
-
       true
     end
 
     def session_destroy
-      cookies.encrypted[:lato_session] = nil
+      @session&.destroy
+      cookies.delete(:lato_session)
+      reset_session
 
       true
     end

data/app/controllers/lato/account_controller.rb

@@ -3,8 +3,20 @@ module Lato
     before_action :authenticate_session
     before_action { active_navbar(:account) }
 
+    before_action :discard_expired_security_enrollment
+    before_action :limit_requests, only: %i[update_user_action update_password_action update_authenticator_action update_webauthn_action update_web3_action destroy_action security_challenge]
+    before_action :reauthenticate_sensitive_action, only: %i[update_user_action update_password_action update_authenticator_action update_webauthn_action update_web3_action destroy_action]
+
     def index; end
 
+    def security_challenge
+      return head :not_found unless @session.user.webauthn_enabled?
+
+      options = @session.user.webauthn_authentication_options
+      @session.set_security_challenge(options.challenge)
+      render json: options.as_json
+    end
+
     def update_user_action
       respond_to do |format|
         if @session.user.update(params.require(:user).permit(:first_name, :last_name, :email))
@@ -20,25 +32,31 @@ module Lato
     def update_authenticator_action
       return respond_to_with_not_found unless Lato.config.authenticator_connection
 
-      if @session.user.authenticator_secret
-        respond_to do |format|
-          if @session.user.remove_authenticator_secret
-            format.html { redirect_to lato.account_path }
-            format.json { render json: @session.user }
-          else
-            format.html { render :index, status: :unprocessable_entity }
-            format.json { render json: @session.user.errors, status: :unprocessable_entity }
-          end
-        end
+      user = @session.user
+      if user.authenticator_enabled?
+        success = user.remove_authenticator_secret
+      elsif params.dig(:user, :authenticator_command) == "confirm"
+        pending = session.delete(:pending_authenticator_secret)
+        success = pending.present? && ROTP::TOTP.new(pending).verify(params.dig(:user, :authenticator_code).to_s)
+        success = user.update(authenticator_secret: pending) if success
+        user.errors.add(:base, :authenticator_code_invalid) unless success
+        @session.clear_security_continuation
       else
-        respond_to do |format|
-          if @session.user.generate_authenticator_secret
-            format.html { redirect_to lato.account_path }
-            format.json { render json: @session.user }
-          else
-            format.html { render :index, status: :unprocessable_entity }
-            format.json { render json: @session.user.errors, status: :unprocessable_entity }
-          end
+        session[:pending_authenticator_secret] = ROTP::Base32.random
+        grant_security_continuation
+        return respond_to do |format|
+          format.html { redirect_to lato.account_path }
+          format.json { render json: { secret: session[:pending_authenticator_secret] } }
+        end
+      end
+
+      respond_to do |format|
+        if success
+          format.html { redirect_to lato.account_path }
+          format.json { render json: user }
+        else
+          format.html { render :index, status: :unprocessable_entity }
+          format.json { render json: user.errors, status: :unprocessable_entity }
         end
       end
     end
@@ -76,6 +94,7 @@ module Lato
             format.json { render json: @session.user.errors, status: :unprocessable_entity }
           end
         else
+          grant_security_continuation
           options = @session.user.webauthn_registration_options
           session[:webauthn_registration_challenge] = Base64.strict_encode64(options.challenge)
           session[:webauthn_registration_options] = options.as_json
@@ -119,6 +138,7 @@ module Lato
         end
       else
         respond_to do |format|
+          grant_security_continuation
           if session[:web3_nonce] = SecureRandom.hex(32)
             format.html { redirect_to lato.account_path }
             format.json { render json: @session.user }
@@ -145,8 +165,9 @@ module Lato
     def update_password_action
       respond_to do |format|
         if @session.user.update(params.require(:user).permit(:password, :password_confirmation))
-          format.html { redirect_to lato.account_path, notice: I18n.t('lato.account_controller.update_password_action_notice') }
-          format.json { render json: @session.user }
+          session_destroy
+          format.html { redirect_to lato.authentication_signin_path, notice: I18n.t('lato.account_controller.update_password_action_notice') }
+          format.json { render json: {} }
         else
           format.html { render :index, status: :unprocessable_entity }
           format.json { render json: @session.user.errors, status: :unprocessable_entity }
@@ -194,7 +215,58 @@ module Lato
 
     private
 
+    def discard_expired_security_enrollment
+      action = @session.security_continuation_action
+      session.delete(:pending_authenticator_secret) unless action == "update_authenticator_action"
+      unless action == "update_webauthn_action"
+        session.delete(:webauthn_registration_challenge)
+        session.delete(:webauthn_registration_options)
+      end
+      session.delete(:web3_nonce) unless action == "update_web3_action"
+    end
+
+    def reauthenticate_sensitive_action
+      if action_name == "update_user_action"
+        email = params.dig(:user, :email)
+        return if email.nil? || email.to_s.downcase.strip == @session.user.email
+      end
+      return if action_name == "update_webauthn_action" && params.dig(:user, :webauthn_command) == "cancel"
+
+      continuation = case action_name
+      when "update_authenticator_action"
+        params.dig(:user, :authenticator_command) == "confirm"
+      when "update_webauthn_action"
+        params.dig(:user, :webauthn_command) == "complete"
+      when "update_web3_action"
+        session[:web3_nonce].present?
+      end
+      return if continuation && @session.consume_security_continuation(action_name)
+
+      user = @session.user
+      password_valid = user.authenticate(params.dig(:user, :current_password).to_s)
+      factor_valid = if user.authenticator_enabled?
+        user.authenticator(authenticator_code: params.dig(:user, :current_authenticator_code).to_s)
+      elsif user.webauthn_enabled?
+        challenge = @session.take_security_challenge
+        user.webauthn_authentication({ webauthn_credential: params.dig(:user, :current_webauthn_credential) }, challenge)
+      else
+        true
+      end
+      return if password_valid && factor_valid
+
+      user.errors.add(:base, "Confirm your current password and enabled second factor to continue.")
+      respond_to do |format|
+        format.html { render :index, status: :unprocessable_entity }
+        format.json { render json: user.errors, status: :unprocessable_entity }
+      end
+    end
+
+    def grant_security_continuation
+      @session.grant_security_continuation(action_name)
+    end
+
     def reset_webauthn_registration_state
+      @session.clear_security_continuation
       session[:webauthn_registration_challenge] = nil
       session[:webauthn_registration_options] = nil
     end

data/app/models/lato/session.rb

@@ -4,48 +4,102 @@ module Lato
       @session = parse_session(session)
     end
 
-    # Questions
-    ##
-
     def valid?
-      !@session.blank?
+      record.present?
     end
 
     def really_valid?
-      !!user
+      valid? && user.present?
     end
 
-    # Helpers
-    ##
-
     def user
-      @user ||= Lato::User.find_by(id: user_id)
+      @user ||= record&.user if valid?
     end
 
     def user_id
-      @session&.dig(:user_id)
+      record&.lato_user_id
     end
 
     def get(key)
-      @session&.dig(key)
+      @session&.dig(key) if valid?
+    end
+
+    def expires_at
+      record&.expires_at
+    end
+
+    def update(extra_params)
+      return unless valid?
+
+      @session.merge!(extra_params.to_h.except(:user_id, :token, "user_id", "token"))
+      @session.to_json
     end
 
-    # Class
-    ##
+    def grant_security_continuation(action)
+      record.update!(security_grant_action: action, security_grant_expires_at: 5.minutes.from_now)
+    end
+
+    def security_continuation_action
+      current = record
+      current.security_grant_action if current&.security_grant_expires_at&.future?
+    end
+
+    def consume_security_continuation(action)
+      return false unless (current = record)
+
+      Lato::SessionRecord.where(id: current.id, security_grant_action: action).where("security_grant_expires_at > ?", Time.current).update_all(security_grant_action: nil, security_grant_expires_at: nil) == 1
+    end
+
+    def clear_security_continuation
+      record&.update!(security_grant_action: nil, security_grant_expires_at: nil)
+    end
+
+    def set_security_challenge(challenge)
+      record.update!(security_challenge: challenge, security_challenge_expires_at: 5.minutes.from_now)
+    end
+
+    def take_security_challenge
+      current = record
+      return unless current
+
+      current.with_lock do
+        challenge = current.security_challenge if current.security_challenge_expires_at&.future?
+        current.update!(security_challenge: nil, security_challenge_expires_at: nil)
+        challenge
+      end
+    end
+
+    def destroy
+      record&.destroy!
+      @session = nil
+    end
 
     def self.generate_session_per_user(user_id, extra_params = {})
-      extra_params.merge(user_id: user_id).to_json
+      user = Lato::User.find(user_id)
+      token = SecureRandom.hex(32)
+      user.with_lock do
+        user.lato_session_records.where("expires_at <= ?", Time.current).delete_all
+        user.lato_session_records.create!(token_digest: Digest::SHA256.hexdigest(token), expires_at: Lato.config.session_lifetime.from_now)
+      end
+      extra_params.to_h.except(:user_id, :token, "user_id", "token").merge(user_id: user.id, token: token).to_json
     end
 
     private
 
+    # Always query revocation state, including when a Session instance was already used.
+    def record
+      return unless @session&.dig(:token).is_a?(String) && @session[:token].present?
+
+      Lato::SessionRecord.where(lato_user_id: @session[:user_id], token_digest: Digest::SHA256.hexdigest(@session[:token])).where("expires_at > ?", Time.current).first
+    end
+
     def parse_session(session)
-      return nil if session.blank?
+      return if session.blank?
 
-      (session.is_a?(String) ? JSON.parse(session) : session).with_indifferent_access
-    rescue StandardError => e
-      Rails.logger.error "Lato::Session.parse_session: #{e.message}"
+      parsed = session.is_a?(String) ? JSON.parse(session) : session
+      parsed.with_indifferent_access if parsed.is_a?(Hash)
+    rescue JSON::ParserError
       nil
     end
   end
-end
+end

data/app/models/lato/session_record.rb

@@ -0,0 +1,5 @@
+module Lato
+  class SessionRecord < ApplicationRecord
+    belongs_to :user, class_name: "Lato::User", foreign_key: :lato_user_id
+  end
+end

data/app/models/lato/user.rb

@@ -21,6 +21,8 @@ module Lato
     # Relations
     ##
 
+    has_many :lato_session_records, class_name: "Lato::SessionRecord", foreign_key: :lato_user_id, dependent: :delete_all
+
     has_many :lato_operations, class_name: 'Lato::Operation', foreign_key: :lato_user_id, dependent: :nullify
     has_many :lato_invitations, class_name: 'Lato::Invitation', foreign_key: :lato_user_id, dependent: :nullify
     has_many :lato_invitations_as_inviter, class_name: 'Lato::Invitation', foreign_key: :inviter_lato_user_id, dependent: :nullify
@@ -46,6 +48,16 @@ module Lato
       self.accepted_terms_and_conditions_version = Lato.config.legal_terms_and_conditions_version if accepted_terms_and_conditions_version_changed?
     end
 
+    after_update do
+      lato_session_records.delete_all if saved_change_to_password_digest?
+      if saved_change_to_email?
+        saved_change_to_email.each do |address|
+          Rails.cache.delete("Lato::User/c_email_verification_code/#{id}/#{Digest::SHA256.hexdigest(address.to_s)}")
+        end
+        c_email_verification_semaphore(false)
+      end
+    end
+
     # Questions
     ##
 
@@ -86,17 +98,17 @@ module Lato
 
     def email_protected
       return email unless email.include?('@')
-  
+
       local_part, domain = email.split('@', 2)
-      
+
       # Keep first 2 characters of local part
       chars_to_keep = [local_part.length, 2].min
       protected_local = local_part[0, chars_to_keep] + '*' * [local_part.length - chars_to_keep, 0].max
-      
+
       # Keep domain as is or partially protect it
       chars_to_keep = [domain.length, 2].min
       protected_domain = domain[0, chars_to_keep] + '*' * [domain.length - chars_to_keep, 0].max
-      
+
       "#{protected_local}@#{protected_domain}"
     end
 
@@ -104,8 +116,8 @@ module Lato
       @gravatar_image_url ||= "https://www.gravatar.com/avatar/#{Digest::MD5.hexdigest(email)}?s=#{size}"
     end
 
-    def authenticator_qr_code_base64(size = 200)
-      "data:image/png;base64,#{Base64.strict_encode64(RQRCode::QRCode.new(ROTP::TOTP.new(authenticator_secret, :issuer => Lato.config.application_title).provisioning_uri(email).to_s).as_png(size: size, border_modules: 0).to_s)}"
+    def authenticator_qr_code_base64(size = 200, secret: authenticator_secret)
+      "data:image/png;base64,#{Base64.strict_encode64(RQRCode::QRCode.new(ROTP::TOTP.new(secret, :issuer => Lato.config.application_title).provisioning_uri(email).to_s).as_png(size: size, border_modules: 0).to_s)}"
     end
 
     # Operations
@@ -228,8 +240,10 @@ module Lato
       c_email_verification_code('')
       c_email_verification_semaphore(false)
 
-      update_column(:email_verified_at, Time.now)
-      true
+      # A token for a stale model instance must never verify a concurrently changed address.
+      verified = self.class.where(id: id, email: email).update_all(email_verified_at: Time.current) == 1
+      errors.add(:base, :email_verification_code_invalid) unless verified
+      verified
     end
 
     # NOTE: Always succeeds for a well formed email, registered or not, so the response can not be used to enumerate users.
@@ -275,11 +289,7 @@ module Lato
       c_password_update_code('')
       c_password_update_semaphore(false)
 
-      update(params.permit(:password, :password_confirmation).merge(
-        authenticator_secret: nil, # Reset authenticator secret when password is updated
-        webauthn_id: nil,          # Reset webauthn credential when password is updated
-        webauthn_public_key: nil   # Reset webauthn credential when password is updated
-      ))
+      update(params.permit(:password, :password_confirmation))
     end
 
     def update_accepted_privacy_policy_version(params)
@@ -403,16 +413,16 @@ module Lato
       end
 
       parsed_payload = JSON.parse(params[:webauthn_credential])
-      
+
       # Converti i campi da base64url a base64 standard per il gem webauthn
       parsed_payload['rawId'] = base64url_to_base64(parsed_payload['rawId'])
       parsed_payload['response']['clientDataJSON'] = base64url_to_base64(parsed_payload['response']['clientDataJSON'])
       parsed_payload['response']['authenticatorData'] = base64url_to_base64(parsed_payload['response']['authenticatorData'])
       parsed_payload['response']['signature'] = base64url_to_base64(parsed_payload['response']['signature'])
       parsed_payload['response']['userHandle'] = base64url_to_base64(parsed_payload['response']['userHandle']) if parsed_payload['response']['userHandle']
-      
+
       credential = WebAuthn::Credential.from_get(parsed_payload)
-      
+
       credential.verify(
         encoded_challenge,
         public_key: webauthn_public_key,
@@ -480,7 +490,7 @@ module Lato
     end
 
     def c_email_verification_code(value = nil)
-      cache_key = "Lato::User/c_email_verification_code/#{id}"
+      cache_key = "Lato::User/c_email_verification_code/#{id}/#{Digest::SHA256.hexdigest(email.to_s)}"
       return Rails.cache.read(cache_key) if value.nil?
 
       Rails.cache.write(cache_key, value, expires_in: 30.minutes)

data/app/views/lato/account/_form-authenticator.html.erb

@@ -1,42 +1,24 @@
-<%
-
-user ||= Lato::User.new
-
-%>
-
+<% user ||= Lato::User.new %>
 <%= turbo_frame_tag 'account_form-authenticator' do %>
   <%= form_with model: user, url: lato.account_update_authenticator_action_path, data: { turbo_frame: '_self', controller: 'lato-form' } do |form| %>
     <%= lato_form_notices class: %w[mb-3] %>
     <%= lato_form_errors user, class: %w[mb-3] %>
-
-    <% if user.authenticator_secret %>
-      <div class="d-block d-md-flex align-items-stretch">
-        <div class="text-center mb-3 mb-md-0 me-md-3">
-          <img class="shadow-sm rounded" src="<%= user.authenticator_qr_code_base64 %>" />
-        </div>
-        <div class="d-flex flex-column justify-content-between w-100">
-          <div class="alert alert-success">
-            <h4 class="alert-heading"><%= I18n.t('lato.account_authenticator_ready_title') %></h4>
-            <p class="mb-0">
-              <%= raw I18n.t('lato.account_authenticator_ready_qr') %>
-            </p>
-          </div>
-
-          <div class="d-flex justify-content-end">
-            <%= lato_form_submit form, I18n.t('lato.account_authenticator_disable'), class: %w[btn-danger] %>
-          </div>
-        </div>
+    <% if user.authenticator_enabled? %>
+      <div class="alert alert-success"><%= I18n.t('lato.account_authenticator_ready_title') %></div>
+      <%= render 'lato/account/security-confirmation', form: form, user: user %>
+      <%= lato_form_submit form, I18n.t('lato.account_authenticator_disable'), class: %w[btn-danger] %>
+    <% elsif session[:pending_authenticator_secret].present? %>
+      <div class="text-center mb-3">
+        <img class="shadow-sm rounded" alt="Authenticator enrollment QR code" src="<%= user.authenticator_qr_code_base64(secret: session[:pending_authenticator_secret]) %>" />
       </div>
+      <%= form.hidden_field :authenticator_command, value: "confirm" %>
+      <%= form.label :authenticator_code, "Confirm authenticator code", class: "form-label" %>
+      <%= form.text_field :authenticator_code, value: nil, required: true, class: "form-control mb-3", autocomplete: "one-time-code", inputmode: "numeric" %>
+      <%= lato_form_submit form, "Confirm", class: %w[btn-primary] %>
     <% else %>
-      <div class="alert alert-light mb-0">
-        <h4 class="alert-heading"><%= I18n.t('lato.account_authenticator_start_title') %></h4>
-        <p>
-          <%= raw I18n.t('lato.account_authenticator_start_description') %>
-        </p>
-        <p class="mb-0">
-          <%= lato_form_submit form, I18n.t('lato.account_authenticator_generate_qr_code'), class: %w[btn-primary] %>
-        </p>
-      </div>
+      <div class="alert alert-light"><%= raw I18n.t('lato.account_authenticator_start_description') %></div>
+      <%= render 'lato/account/security-confirmation', form: form, user: user %>
+      <%= lato_form_submit form, I18n.t('lato.account_authenticator_generate_qr_code'), class: %w[btn-primary] %>
     <% end %>
   <% end %>
 <% end %>

data/app/views/lato/account/_form-destroy.html.erb

@@ -8,6 +8,7 @@ user ||= Lato::User.new
   <%= form_with model: user, url: lato.account_destroy_action_path, method: :delete, data: { turbo_frame: '_self', controller: 'lato-form' } do |form| %>
     <%= lato_form_notices class: %w[mb-3] %>
     <%= lato_form_errors user, class: %w[mb-3] %>
+    <%= render 'lato/account/security-confirmation', form: form, user: user %>
     
     <div class="mb-3">
       <%= lato_form_item_label form, :email_confirmation, I18n.t('lato.signup_email') %>

data/app/views/lato/account/_form-password.html.erb

@@ -8,6 +8,7 @@ user ||= Lato::User.new
   <%= form_with model: user, url: lato.account_update_password_action_path, data: { turbo_frame: '_self', controller: 'lato-form' } do |form| %>
     <%= lato_form_notices class: %w[mb-3] %>
     <%= lato_form_errors user, class: %w[mb-3] %>
+    <%= render 'lato/account/security-confirmation', form: form, user: user %>
     
     <div class="row">
       <div class="col col-12 col-lg-6 mb-3">

data/app/views/lato/account/_form-user.html.erb

@@ -8,6 +8,7 @@ user ||= Lato::User.new
   <%= form_with model: user, url: lato.account_update_user_action_path, data: { turbo_frame: '_self', controller: 'lato-form lato-account-form-user' } do |form| %>
     <%= lato_form_notices class: %w[mb-3] %>
     <%= lato_form_errors user, class: %w[mb-3] %>
+    <%= render 'lato/account/security-confirmation', form: form, user: user %>
 
     <div class="row">
       <div class="col col-12 col-lg-4 mb-3">

data/app/views/lato/account/_form-web3.html.erb

@@ -8,6 +8,7 @@ user ||= Lato::User.new
   <%= form_with model: user, url: lato.account_update_web3_action_path, data: { turbo_frame: '_self', controller: 'lato-form' } do |form| %>
     <%= lato_form_notices class: %w[mb-3] %>
     <%= lato_form_errors user, class: %w[mb-3] %>
+    <%= render 'lato/account/security-confirmation', form: form, user: user if session[:web3_nonce].blank? %>
 
     <% if user.web3_address %>
       <div class="row">

data/app/views/lato/account/_form-webauthn.html.erb

@@ -16,6 +16,7 @@ end
   <%= form_with model: user, url: lato.account_update_webauthn_action_path, data: form_data do |form| %>
     <%= lato_form_notices class: %w[mb-3] %>
     <%= lato_form_errors user, class: %w[mb-3] %>
+    <%= render 'lato/account/security-confirmation', form: form, user: user if registration_options.blank? %>
 
     <% if user.webauthn_enabled? %>
       <div class="alert alert-success mb-3">

data/app/views/lato/account/_security-confirmation.html.erb

@@ -0,0 +1,12 @@
+<div class="mb-3" data-controller="lato-account-security" data-lato-account-security-challenge-url-value="<%= lato.account_security_challenge_path %>" data-lato-account-security-webauthn-value="<%= user.webauthn_enabled? && !user.authenticator_enabled? %>">
+  <%= form.label :current_password, "Current password", class: "form-label" %>
+  <%= form.password_field :current_password, class: "form-control", autocomplete: "current-password" %>
+  <% if user.authenticator_enabled? %>
+    <%= form.label :current_authenticator_code, "Current authenticator code", class: "form-label mt-2" %>
+    <%= form.text_field :current_authenticator_code, value: nil, class: "form-control", autocomplete: "one-time-code", inputmode: "numeric" %>
+  <% elsif user.webauthn_enabled? %>
+    <%= form.hidden_field :current_webauthn_credential, value: nil, data: { lato_account_security_target: "credential" } %>
+    <p class="text-muted mt-2">Confirm with your registered security key when submitting.</p>
+  <% end %>
+  <p class="text-danger mt-2" data-lato-account-security-target="error" role="alert"></p>
+</div>

data/config/routes.rb

@@ -40,6 +40,7 @@ Lato::Engine.routes.draw do
 
   scope :account do
     get '', to: 'account#index', as: :account
+    post 'security_challenge', to: 'account#security_challenge', as: :account_security_challenge
     patch 'update_user_action', to: 'account#update_user_action', as: :account_update_user_action
     patch 'update_authenticator_action', to: 'account#update_authenticator_action', as: :account_update_authenticator_action
     patch 'update_webauthn_action', to: 'account#update_webauthn_action', as: :account_update_webauthn_action

data/db/migrate/20261024000000_create_lato_session_records.rb

@@ -0,0 +1,16 @@
+class CreateLatoSessionRecords < ActiveRecord::Migration[7.1]
+  def change
+    create_table :lato_session_records do |t|
+      t.references :lato_user, null: false, foreign_key: true
+      t.string :token_digest, null: false
+      t.datetime :expires_at, null: false
+      t.string :security_grant_action
+      t.datetime :security_grant_expires_at
+      t.string :security_challenge
+      t.datetime :security_challenge_expires_at
+      t.timestamps
+    end
+    add_index :lato_session_records, :token_digest, unique: true
+    add_index :lato_session_records, :expires_at
+  end
+end

data/lib/lato/engine.rb

@@ -12,6 +12,10 @@ module Lato
       app.config.assets.precompile << "lato_manifest.js"
     end
 
+    initializer "lato.filter_credentials" do |app|
+      app.config.filter_parameters += %i[current_password current_authenticator_code current_webauthn_credential authenticator_code authenticator_secret webauthn_credential web3_signed_nonce code accepted_code]
+    end
+
     config.after_initialize do
       if Lato.config.webauthn_connection
         WebAuthn.configure do |config|

data/lib/lato/version.rb

@@ -1,3 +1,3 @@
 module Lato
-  VERSION = "3.24.0"
+  VERSION = "3.25.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lato
 version: !ruby/object:Gem::Version
-  version: 3.24.0
+  version: 3.25.0
 platform: ruby
 authors:
 - Gregorio Galante
@@ -15,14 +15,20 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 7.0.4
+        version: 8.1.3.1
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '8.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 7.0.4
+        version: 8.1.3.1
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '8.2'
 - !ruby/object:Gem::Dependency
   name: rails-i18n
   requirement: !ruby/object:Gem::Requirement
@@ -182,6 +188,7 @@ files:
 - app/assets/javascripts/lato/controllers/application.js
 - app/assets/javascripts/lato/controllers/index.js
 - app/assets/javascripts/lato/controllers/lato_account_form_user_controller.js
+- app/assets/javascripts/lato/controllers/lato_account_security_controller.js
 - app/assets/javascripts/lato/controllers/lato_account_webauthn_controller.js
 - app/assets/javascripts/lato/controllers/lato_action_controller.js
 - app/assets/javascripts/lato/controllers/lato_aside_opener_controller.js
@@ -226,6 +233,7 @@ files:
 - app/models/lato/log/user_signup.rb
 - app/models/lato/operation.rb
 - app/models/lato/session.rb
+- app/models/lato/session_record.rb
 - app/models/lato/user.rb
 - app/views/lato/account/_alert-accepted-privacy-policy-version.html.erb
 - app/views/lato/account/_alert-accepted-terms-and-conditions-version.html.erb
@@ -235,6 +243,7 @@ files:
 - app/views/lato/account/_form-user.html.erb
 - app/views/lato/account/_form-web3.html.erb
 - app/views/lato/account/_form-webauthn.html.erb
+- app/views/lato/account/_security-confirmation.html.erb
 - app/views/lato/account/index.html.erb
 - app/views/lato/authentication/_fields-registration.html.erb
 - app/views/lato/authentication/_form-accept-invitation.html.erb
@@ -312,6 +321,7 @@ files:
 - db/migrate/20240318074025_add_authenticator_secret_to_user.rb
 - db/migrate/20251206170443_add_webauthn_id_to_user.rb
 - db/migrate/20251218192614_add_logs_on_lato_operation.rb
+- db/migrate/20261024000000_create_lato_session_records.rb
 - lib/lato.rb
 - lib/lato/btstrap.rb
 - lib/lato/config.rb