lesli 5.0.3 → 5.0.4

data/app/controllers/users/confirmations_controller.rb

@@ -1,30 +1,66 @@
 # frozen_string_literal: true
-
 class Users::ConfirmationsController < Devise::ConfirmationsController
-  # GET /resource/confirmation/new
-  # def new
-  #   super
-  # end
-
-  # POST /resource/confirmation
-  # def create
-  #   super
-  # end
-
-  # GET /resource/confirmation?confirmation_token=abcdef
-  # def show
-  #   super
-  # end
-
-  # protected
-
-  # The path used after resending confirmation instructions.
-  # def after_resending_confirmation_instructions_path_for(resource_name)
-  #   super(resource_name)
-  # end
-
-  # The path used after confirmation.
-  # def after_confirmation_path_for(resource_name, resource)
-  #   super(resource_name, resource)
-  # end
+
+    def show
+
+        # delete all previus messages
+        flash.clear
+
+        # get the confirmation token sent through get params
+        token = params[:confirmation_token]
+
+        # validate that token were sent
+        if token.blank?
+            return flash[:danger] = I18n.t("core.users/confirmations.messages_warning_invalid_token")
+        end
+
+        # check if token belongs to a unconfirmed user
+        user = Lesli::User.find_by(:confirmation_token => token, :confirmed_at => nil)
+
+        # validate that user were found
+        if user.blank?
+            return flash[:danger] = I18n.t("core.users/confirmations.messages_warning_invalid_token")
+        end
+
+        # register a log with a validation atempt for the user
+        log = user.logs.create({ description: "confirmation_atempt_successful" })
+
+        registration_operator = Lesli::User::RegistrationOperator.new(user)
+
+        # confirm the user
+        registration_operator.confirm
+
+        # let the user knows that the confirmation is done
+        flash[:success] = I18n.t("core.users/confirmations.messages_success_email_updated")
+        
+        # if new account, launch account onboarding in another thread, 
+        # so the user can continue with the registration process
+        registration_operator.create_account if user.account.blank?
+        #Thread.new { registration_operator.create_account } if user.account.blank?
+
+    end
+
+    
+    # @controller_action_param :email [String] The registered user email
+    # @return [Json] Json that contains wheter the email confirmation was sent or not. 
+    #     If it is not successful, it returs an error message
+    # @description Resends a email confirmation an already registered user
+    # @example
+    #     # Executing this controller's action from javascript's frontend
+    #     let email = 'john.doe@email.com';
+    #     let data = {
+    #         user: {
+    #             email: email
+    #         }
+    #     };
+    #     this.http.post('127.0.0.1/conformation', data);
+    def create
+        super do |resource|
+            if successfully_sent?(resource)
+                return respond_with_successful
+            else
+                return respond_with_error(resource.errors.full_messages.to_sentence)
+            end
+        end
+    end
 end

data/app/controllers/users/passwords_controller.rb

@@ -1,34 +1,74 @@
 # frozen_string_literal: true
 
 class Users::PasswordsController < Devise::PasswordsController
-  # GET /resource/password/new
-  # def new
-  #   super
-  # end
-
-  # POST /resource/password
-  # def create
-  #   super
-  # end
-
-  # GET /resource/password/edit?reset_password_token=abcdef
-  # def edit
-  #   super
-  # end
-
-  # PUT /resource/password
-  # def update
-  #   super
-  # end
-
-  # protected
-
-  # def after_resetting_password_path_for(resource)
-  #   super(resource)
-  # end
-
-  # The path used after sending reset password instructions
-  # def after_sending_reset_password_instructions_path_for(resource_name)
-  #   super(resource_name)
-  # end
+
+    # Sends an email with a token, so the user can reset their password
+    def create
+
+        if params[:user].blank?
+            #Account::Activity.log("core", "/password/create", "password_creation_failed", "no_valid_email")
+            return respond_with_error(I18n.t("core.shared.messages_warning_user_not_found"))
+        end
+
+        if params[:user][:email].blank?
+            #Account::Activity.log("core", "/password/create", "password_creation_failed", "no_valid_email")
+            return respond_with_error(I18n.t("core.shared.messages_warning_user_not_found"))
+        end
+
+        user = Lesli::User.find_by(:email => params[:user][:email])
+
+        if user.blank?
+            # Account::Activity.log("core", "/password/create", "password_creation_failed", "no_valid_email", {
+            #     email: (params[:user][:email] || "")
+            # })
+            return respond_with_error(I18n.t("core.shared.messages_warning_user_not_found"))
+        end
+
+        unless user.active
+            # user.logs.create({title: "password_creation_failed", description: "user_not_active"})
+            # Account::Activity.log("core", "/password/create", "password_creation_failed", "user_not_active")
+            return respond_with_error(I18n.t("core.users/passwords.messages_danger_inactive_user"))
+        end
+
+        token = user.generate_password_reset_token
+
+        #user.logs.create({ title: "password_creation_successful" })
+
+        # begin
+        #     #UserMailer.with(user: user, token: token).reset_password_instructions.deliver_now
+             #super()
+        Lesli::DeviseMailer.reset_password_instructions(user, token)
+        respond_with_successful
+        # rescue => exception
+        #     #Honeybadger.notify(exception)
+        #     respond_with_error(exception.message)
+        # end
+
+    end
+
+    def update
+        super do |resource|
+
+            # check if password update was ok
+            if resource.errors.empty?
+
+                # reset password expiration due the user just updated his password
+                if resource.has_expired_password?
+                    resource.update(password_expiration_at: nil)
+                end
+
+                resource.logs.create(title: "password_reset_successful")
+
+                return respond_with_successful
+
+            else
+
+                resource.logs.create(title: "password_reset_error") if resource.id
+
+                return respond_with_error(resource.errors.full_messages.to_sentence)
+
+            end
+
+        end
+    end
 end

data/app/controllers/users/sessions_controller.rb

@@ -89,7 +89,8 @@ class Users::SessionsController < Devise::SessionsController
 
 
         # create a new session for the user
-        current_session = Lesli::User::SessionService.new(user).create(get_user_agent, request.remote_ip)
+        current_session = Lesli::UserSessionService.new(user)
+        .create(get_user_agent(false), request.remote_ip)
 
         # make session id globally available
         session[:user_session_id] = current_session[:id]
@@ -109,9 +110,6 @@ class Users::SessionsController < Devise::SessionsController
         # respond successful and send the path user should go
         #respond_with_successful({ default_path: user.has_role_with_default_path?() })
         respond_with_successful({ default_path: "/" })
-
-        log_user_agent()
-
     end
 
     private 

data/app/lib/lesli/system.rb

@@ -17,17 +17,17 @@ GNU General Public License for more details.
 You should have received a copy of the GNU General Public License
 along with this program. If not, see http://www.gnu.org/licenses/.
 
-Lesli · Your Smart Business Assistant.
+Lesli · Ruby on Rails SaaS Development Framework.
 
 Made with ♥ by https://www.lesli.tech
 Building a better future, one line of code at a time.
 
 @contact  hello@lesli.tech
-@website  https://lesli.tech
+@website  https://www.lesli.tech
 @license  GPLv3 http://www.gnu.org/licenses/gpl-3.0.en.html
 
-// · ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~
-// ·
+// · ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~
+// · 
 =end
 
 module Lesli
@@ -81,6 +81,14 @@ module Lesli
             name.sub("Lesli", "")
         end
 
-        LESLI_ENGINES = ["Lesli", "LesliAdmin", "LesliBabel", "LesliAudit", "LesliBell", "LesliDriver"]
+        LESLI_ENGINES = [
+            "Lesli", 
+            "LesliAdmin", 
+            "LesliBabel", 
+            "LesliAudit", 
+            "LesliBell", 
+            "LesliDriver",
+            "LesliVault"
+        ]
     end
 end

data/app/mailers/lesli/application_lesli_mailer.rb

@@ -75,26 +75,27 @@ module Lesli
 =end
         #after_action :log_mail_requests
 
-        default(template_path: "lesli/emails/devise_mailer")
+        #default(template_path: "lesli/emails/devise_mailer")
 
         def initialize
 
             super
 
             # some @email data is defined on: LesliMails/src/partials/data.html
-            @custom = {}
+            
             @email = {}
-            @data = {}
-            @app = {}
+            @custom = {}
+            @params = {
+                :host => default_url_options[:host] || ""
+            }
 
         end
 
         protected
 
-        def email(data={}, to:, subject:, template_name:) 
+        def email(params={}, user:nil, to:, subject:, template_name:) 
 
-            @app[:host] = default_url_options[:host]
-            @data = @data.merge(data)
+            @params = @params.merge(params)
 
             mail(
                 to: to, 
@@ -106,18 +107,6 @@ module Lesli
 
         private
 
-
-        def build_data_from_params(params, data={})
-
-            # make custom data available in mailer method and mailer template
-            @data = @data.merge(data)
-
-            build_app_from_params(params)
-
-            build_customization_from_params(params)
-
-        end
-
         def build_app_from_params(params)
 
             @app[:host] = default_url_options[:host]

data/app/mailers/lesli/devise_mailer.rb

@@ -1,6 +1,32 @@
 module Lesli
     class DeviseMailer < ApplicationLesliMailer
-        def confirmation_instructions(record, token, opts = {})
+
+        default(template_path: "lesli/emails/devise_mailer")
+
+        # Sends an email with instructions to allow the user reset the password
+        def reset_password_instructions(user, token, opts = {})
+
+            # defaults for new accounts/users
+            email_template = "reset_password_instructions"
+            email_subject = I18n.t("core.users/confirmations.mailer_email_verification")
+
+            # email parameters
+            params = {
+                url: "/password/edit?reset_password_token=#{token}",
+                user_name: user.full_name
+            }
+
+            # send email
+            email(
+                params,
+                to: user.email, 
+                subject: email_subject,
+                template_name: email_template
+            )
+        end 
+
+        # Sends an email to allow the user confirm the email address
+        def confirmation_instructions(user, token, opts = {})
 
             # defaults for new accounts/users
             email_template = "confirmation_instructions"
@@ -14,9 +40,9 @@ module Lesli
 
             # Depending on wheter there is a new user or they are changing their email, 
             # one or another field will be used
-            email_recipient = record.unconfirmed_email || record.email
+            email_recipient = user.unconfirmed_email || user.email
 
-            # email custom data
+            # email parameters
             params = {
                 url: "/confirmation?confirmation_token=#{token}"
             }

data/app/models/concerns/account_initializer.rb

@@ -0,0 +1,91 @@
+=begin
+
+Lesli
+
+Copyright (c) 2023, Lesli Technologies, S. A.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see http://www.gnu.org/licenses/.
+
+Lesli · Ruby on Rails SaaS Development Framework.
+
+Made with ♥ by https://www.lesli.tech
+Building a better future, one line of code at a time.
+
+@contact  hello@lesli.tech
+@website  https://www.lesli.tech
+@license  GPLv3 http://www.gnu.org/licenses/gpl-3.0.en.html
+
+// · ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~
+// · 
+=end
+
+module AccountInitializer
+    extend ActiveSupport::Concern
+
+
+    # initialize minimum resources needed for the account
+    def initialize_account
+
+        # create initial descriptors
+        descriptor_owner = self.descriptors.find_or_create_by(name: "owner")
+        descriptor_sysadmin = self.descriptors.find_or_create_by(name: "sysadmin")
+        descriptor_profile = self.descriptors.find_or_create_by(name: "profile")
+
+        # create default roles for the new account
+        owner = self.roles.create({ name: "owner", active: true, object_level_permission: 2147483647 })
+
+        # platform administrator role
+        sysadmin = self.roles.create({ name: "sysadmin", active: true, object_level_permission: 100000 })
+
+        # access only to user profile
+        limited = self.roles.create({ name: "limited", active: true, object_level_permission: 10, path_default: "/administration/profile" })
+
+        # assign descriptors with appropriate privileges
+        owner.powers.create(:descriptor => descriptor_owner)
+        sysadmin.powers.create(:descriptor => descriptor_sysadmin)
+        limited.powers.create(:descriptor => descriptor_profile)
+    end
+
+
+    # initialize engines for new accounts
+    def initialize_engines
+
+        # 01.01 LesliAdmin - Lesli administration area
+        if defined? LesliAdmin
+            if self.admin.blank?
+                self.admin = LesliAdmin::Account.new
+                self.admin.account = self
+                self.admin.save!
+            end
+        end
+
+        # 03.01 LesliDriver - Unified calendar app
+        if defined? LesliDriver
+            if self.driver.blank?
+                self.driver = LesliDriver::Account.new
+                self.driver.account = self
+                self.driver.save!
+            end
+        end
+
+        # 08.03 LesliAudit - System analytics
+        if defined? LesliAudit
+            if self.audit.blank?
+                self.audit = LesliAudit::Account.new
+                self.audit.account = self
+                self.audit.save!
+            end
+        end
+    end
+end

data/app/models/concerns/{user_guard.rb → user_security.rb}

@@ -33,7 +33,7 @@ Building a better future, one line of code at a time.
 
 # User extension methods
 # Custom methods that belongs to a instance user
-module UserGuard
+module UserSecurity
     extend ActiveSupport::Concern
 
 
@@ -71,14 +71,13 @@ module UserGuard
     #     actions = ["index", "update"]
     #
     #     current_user.has_privileges?(controllers, actions)
-    def has_privileges?(controller, action)
+    def has_privileges_for?(controller, action)
         begin
-            !self.privileges
-            .where("role_privileges.controller = ?", controller)
-            .where("role_privileges.action = ?", action)
-            .first.blank?
+            return !self.privileges
+            .where("lesli_role_privileges.controller = ?", controller)
+            .where("lesli_role_privileges.action = ?", action)
+            .first.blank?            
         rescue => exception
-            #Honeybadger.notify(exception)
             return false
         end
     end
@@ -191,7 +190,7 @@ module UserGuard
         role = role.first
 
         # return the path of the role if is limited to a that specific path
-        return role.path_default_ if role.path_limited == true 
+        return role.path_default if role.path_limited == true 
 
         # return nil if role has no limits
         return nil

data/app/models/lesli/account.rb

@@ -33,6 +33,8 @@ Building a better future, one line of code at a time.
 module Lesli
     class Account < ApplicationLesliRecord
 
+        include AccountInitializer
+
 
         # accounts always belongs to a user
         belongs_to :user, optional: true
@@ -48,10 +50,13 @@ module Lesli
         has_many :locations
         has_many :feedbacks
         has_many :descriptors
-        has_many :activities, class_name: "Account::Activity"
-        has_many :currencies, class_name: "Account::Currency"
+        has_many :activities
+        has_many :currencies
         has_many :logs
 
+        has_one :audit, class_name: "LesliAudit::Account"
+        has_one :admin, class_name: "LesliAdmin::Account"
+        has_one :driver, class_name: "LesliDriver::Account"
 
 
         # account statuses
@@ -77,30 +82,7 @@ module Lesli
 
         # initializers for new accounts
         after_create :initialize_account
+        after_create :initialize_engines
 
-
-        def initialize_account
-
-            # create initial descriptors
-            descriptor_owner = self.descriptors.find_or_create_by(name: "owner")
-            descriptor_sysadmin = self.descriptors.find_or_create_by(name: "sysadmin")
-            descriptor_profile = self.descriptors.find_or_create_by(name: "profile")
-    
-    
-            # create default roles for the new account
-            owner = self.roles.create({ name: "owner", active: true, object_level_permission: 2147483647 })
-    
-            # platform administrator role
-            sysadmin = self.roles.create({ name: "sysadmin", active: true, object_level_permission: 100000 })
-    
-            # access only to user profile
-            limited = self.roles.create({ name: "limited", active: true, object_level_permission: 10, path_default: "/administration/profile" })
-    
-    
-            # assign descriptors with appropriate privileges
-            #owner.descriptors.create(:descriptor => descriptor_owner)
-            #sysadmin.descriptors.create(:descriptor => descriptor_sysadmin)
-            #limited.descriptors.create(:descriptor => descriptor_profile)
-        end
     end
 end

data/app/models/lesli/application_lesli_record.rb

@@ -33,5 +33,6 @@ Building a better future, one line of code at a time.
 module Lesli 
     class ApplicationLesliRecord < ApplicationRecord
         self.abstract_class = true
+        acts_as_paranoid
     end
 end

data/app/models/lesli/descriptor/privilege.rb

@@ -0,0 +1,38 @@
+=begin
+
+Lesli
+
+Copyright (c) 2023, Lesli Technologies, S. A.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see http://www.gnu.org/licenses/.
+
+Lesli · Ruby on Rails SaaS Development Framework.
+
+Made with ♥ by https://www.lesli.tech
+Building a better future, one line of code at a time.
+
+@contact  hello@lesli.tech
+@website  https://www.lesli.tech
+@license  GPLv3 http://www.gnu.org/licenses/gpl-3.0.en.html
+
+// · ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~
+// · 
+=end
+
+module Lesli
+    class Descriptor::Privilege < ApplicationLesliRecord
+        belongs_to :descriptor
+        belongs_to :action, class_name: "SystemController::Action"
+    end
+end

data/app/models/lesli/descriptor.rb

@@ -33,9 +33,26 @@ Building a better future, one line of code at a time.
 module Lesli
     class Descriptor < ApplicationLesliRecord
         belongs_to :account
-        #has_many :privileges
+        has_many :privileges
         #has_many :role_descriptors
+
+        # this scope is needed to allow to join with deleted descriptors
+        # join with deleted descriptors is needed to know which privileges we have to remove from the
+        # role_privileges table when a descriptor is removed from role_describers
+        has_many :role_descriptors_all, -> { with_deleted }, foreign_key: "descriptors_id", class_name: "Role::Descriptor"
         
         validates :name, presence: true
+
+        after_create :initialize_descriptor_privileges
+
+        def initialize_descriptor_privileges
+
+            descriptor_operator = DescriptorPrivilegeOperator.new(self)
+    
+            descriptor_operator.add_profile_privileges(self) if self.name == "profile"
+    
+            descriptor_operator.add_owner_privileges(self) if ["owner", "sysadmin"].include?(self.name)
+    
+        end
     end
 end