lesli_shield 1.1.5 → 1.1.7

data/app/controllers/lesli_shield/profile/passwords_controller.rb

@@ -0,0 +1,119 @@
+module LesliShield
+    module Profile
+        class PasswordsController < ApplicationController
+            PASSWORD_CHANGE_RATE_LIMIT_WINDOW = 15.minutes
+
+            skip_before_action :authorize_request
+
+            rate_limit(
+                to: 10,
+                within: PASSWORD_CHANGE_RATE_LIMIT_WINDOW,
+                by: -> { current_user&.id || request.remote_ip },
+                with: :respond_to_password_change_rate_limit,
+                only: :update,
+                name: "profile-password-update"
+            )
+
+            def update
+                @active_profile_tab = "security"
+                @password = PasswordService
+                    .new(current_user)
+                    .update(
+                        password_params,
+                        current_session_id: session[:user_session_id]
+                    )
+                @user = @password.result
+
+                if @password.successful?
+                    bypass_sign_in(@user)
+                    record_password_event(
+                        operation: "password_change_succeeded",
+                        description: "Password changed successfully"
+                    )
+
+                    respond_with_lesli(
+                        turbo: [
+                            stream_notification_success(success_message),
+                            stream_redirection(profile_path(tab: "security"))
+                        ],
+                        json: { message: success_message },
+                        redirect: profile_path(tab: "security")
+                    )
+                else
+                    record_password_event(
+                        operation: "password_change_failed",
+                        description: "Password change failed validation"
+                    )
+
+                    respond_with_lesli(
+                        turbo: [
+                            stream_notification_danger(@password.errors_as_sentence),
+                            turbo_stream.replace(
+                                "shield-profile-password-form",
+                                partial: "lesli_shield/profiles/password-form",
+                                locals: { user: @user }
+                            )
+                        ],
+                        json: { errors: @password.errors },
+                        html: "lesli_shield/profiles/show",
+                        status: :unprocessable_content
+                    )
+                end
+            end
+
+            private
+
+            def password_params
+                params.require(:user).permit(
+                    :current_password,
+                    :password,
+                    :password_confirmation
+                )
+            end
+
+            def success_message
+                I18n.t("lesli_shield.profiles.password_updated")
+            end
+
+            def record_password_event(operation:, description:)
+                log(operation: operation, description: description)
+            rescue StandardError => exception
+                Rails.error.report(
+                    exception,
+                    handled: true,
+                    context: {
+                        controller: self.class.name,
+                        operation: operation
+                    }
+                )
+            end
+
+            def respond_to_password_change_rate_limit
+                @active_profile_tab = "security"
+                @user = current_user
+                message = I18n.t(
+                    "lesli_shield.profiles.password_too_many_attempts"
+                )
+
+                response.set_header(
+                    "Retry-After",
+                    PASSWORD_CHANGE_RATE_LIMIT_WINDOW.to_i.to_s
+                )
+
+                respond_with_lesli(
+                    turbo: [
+                        stream_notification_danger(message),
+                        turbo_stream.replace(
+                            "shield-profile-password-form",
+                            partial: "lesli_shield/profiles/password-form",
+                            locals: { user: @user }
+                        )
+                    ],
+                    json: { error: message },
+                    html: "lesli_shield/profiles/show",
+                    status: :too_many_requests
+                )
+            end
+        end
+    end
+end

data/app/controllers/lesli_shield/profiles_controller.rb

@@ -0,0 +1,63 @@
+module LesliShield
+    class ProfilesController < ApplicationController
+        PROFILE_FIELDS = %i[
+            id
+            uid
+            alias
+            title
+            email
+            first_name
+            last_name
+            telephone
+        ].freeze
+
+        skip_before_action :authorize_request
+        before_action :set_profile
+
+        def show
+            respond_with_lesli(json: profile_payload)
+        end
+
+        def update
+            @profile.update(profile_params)
+            @user = @profile.result
+
+            if @profile.successful?
+                respond_with_lesli(
+                    turbo: stream_notification_success("Profile updated successfully!"),
+                    json: profile_payload,
+                    redirect: profile_path
+                )
+            else
+                respond_with_lesli(
+                    turbo: stream_notification_danger(@profile.errors_as_sentence),
+                    json: { errors: @profile.errors },
+                    html: :show,
+                    status: :unprocessable_content
+                )
+            end
+        end
+
+        private
+
+        def set_profile
+            @profile = LesliShield::ProfileService.new(current_user)
+            @user = @profile.show
+        end
+
+        def profile_params
+            params.require(:user).permit(
+                :alias,
+                :title,
+                :email,
+                :first_name,
+                :last_name,
+                :telephone
+            )
+        end
+
+        def profile_payload
+            @user.as_json(only: PROFILE_FIELDS)
+        end
+    end
+end

data/app/controllers/lesli_shield/sessions_controller.rb

@@ -6,8 +6,7 @@ module LesliShield
         def index
             @sessions = respond_with_pagination(UserSessionService.new(current_user, query).index())
             respond_with_lesli(
-                :html => @sessions,
-                :json => @sessions
+                json: @sessions
             )
         end
 

data/app/controllers/lesli_shield/users_controller.rb

@@ -41,13 +41,9 @@ module LesliShield
 
         # GET /users/1
         def show
-            @user_roles = @user.result.roles
-            @activities = @user.result.logs
-                .order(id: :desc)
-                .select(:id, :operation, :description, Date2.new.db_column('created_at', as:'date'))
-                .limit(7)
-                .as_json
-            @sessions = @user.result.sessions
+            @user_roles = @user.roles
+            @activities = @user.logs
+            @sessions = @user.sessions
             @user = @user.show
         end
 

data/app/controllers/users/confirmations_controller.rb

@@ -29,73 +29,186 @@ Building a better future, one line of code at a time.
 @license  GPLv3 http://www.gnu.org/licenses/gpl-3.0.en.html
 
 // · ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~
-// · 
+// ·
 =end
-class Users::ConfirmationsController < Devise::ConfirmationsController
 
+class Users::ConfirmationsController < Devise::ConfirmationsController
+    CONFIRMATION_RATE_LIMIT_WINDOW = 1.hour
+
+    rate_limit(
+        to: 10,
+        within: CONFIRMATION_RATE_LIMIT_WINDOW,
+        by: -> { request.remote_ip },
+        with: :respond_to_confirmation_rate_limit,
+        only: :create,
+        name: "confirmation-request-ip"
+    )
+
+    rate_limit(
+        to: 3,
+        within: CONFIRMATION_RATE_LIMIT_WINDOW,
+        by: :confirmation_email_rate_limit_key,
+        with: :respond_to_confirmation_rate_limit,
+        only: :create,
+        name: "confirmation-request-email"
+    )
+
+    before_action :protect_confirmation_token, only: :show
+
+    # Devise validates and consumes the raw token. Account provisioning and the
+    # successful audit event share the same transaction so a partial account can
+    # never be left behind and a provisioning failure leaves the token reusable.
     def show
+        self.resource = confirm_user_and_provision_account
+
+        if resource.errors.empty?
+            send_welcome_email_safely(resource)
+            set_flash_message!(:notice, :confirmed)
+            respond_with_navigational(resource) do
+                redirect_to after_confirmation_path_for(resource_name, resource)
+            end
+        else
+            respond_with_navigational(
+                resource.errors,
+                status: :unprocessable_content
+            ) do
+                render :new, status: :unprocessable_content
+            end
+        end
+    end
+
+    protected
+
+    # Keep the user on the resend page so Devise's generic paranoid-mode notice
+    # is visible without disclosing whether the email exists or is confirmed.
+    def after_resending_confirmation_instructions_path_for(_resource_name)
+        new_user_confirmation_path
+    end
+
+    private
+
+    def confirm_user_and_provision_account
+        confirmed_user = nil
 
-        # delete all previus messages
-        flash.clear
+        resource_class.transaction do
+            confirmed_user = resource_class.confirm_by_token(
+                params[:confirmation_token]
+            )
 
-        # get the confirmation token sent through get params
-        token = params[:confirmation_token]
+            if confirmed_user.errors.empty?
+                LesliShield::UserRegistrationService
+                    .new(confirmed_user)
+                    .provision_account!
 
-        # validate that token were sent
-        if token.blank?
-            return flash[:danger] = I18n.t("core.users/confirmations.messages_warning_invalid_token")
+                confirmed_user.update!(confirmation_token: nil)
+                record_successful_confirmation!(confirmed_user)
+            end
         end
 
-        # check if token belongs to a unconfirmed user
-        user = Lesli::User.find_by(:confirmation_token => token, :confirmed_at => nil)
+        confirmed_user
+    rescue StandardError => exception
+        Rails.error.report(
+            exception,
+            handled: true,
+            context: {
+                controller: self.class.name,
+                operation: "user_confirmation_succeeded"
+            }
+        )
+
+        confirmation_failure_resource(confirmed_user)
+    end
 
-        # validate that user were found
-        if user.blank?
-            return flash[:danger] = I18n.t("core.users/confirmations.messages_warning_invalid_token")
+    def confirmation_failure_resource(user)
+        failed_resource = if user&.persisted?
+            resource_class.find_by(id: user.id)
         end
 
-        # register a log with a validation atempt for the user
-        log = user.log(engine: LesliShield, source: self.class.name, action: action_name, operation: "user_confirmation", description: "Confirmation process started")
-        
-        # create a new instance of the registration service
-        registration_service = LesliShield::UserRegistrationService.new(user)
+        failed_resource ||= resource_class.new
+        failed_resource.errors.add(
+            :base,
+            I18n.t(
+                "lesli_shield.devise/confirmations.message_confirmation_failed"
+            )
+        )
+        failed_resource
+    end
 
-        # confirm the user
-        registration_service.confirm
+    def record_successful_confirmation!(user)
+        user.log(
+            engine: LesliShield,
+            source: self.class.name,
+            action: action_name,
+            operation: "user_confirmation_succeeded",
+            description: "User confirmed successfully"
+        )
+    end
 
-        # send a welcome email to user as is confirmed
-        LesliShield::DeviseMailer.with(user: resource).welcome.deliver_later
+    def send_welcome_email_safely(user)
+        LesliShield::DeviseMailer.welcome(user).deliver_later
+    rescue StandardError => exception
+        Rails.error.report(
+            exception,
+            handled: true,
+            context: {
+                controller: self.class.name,
+                operation: "welcome_email_delivery"
+            }
+        )
+    end
 
-        # let the user knows that the confirmation is done
-        flash[:success] = I18n.t("core.users/confirmations.messages_success_email_updated")
-        
-        # setup the new account
-        registration_service.create_account if user.account.blank?
+    def confirmation_email_rate_limit_key
+        normalized_email = confirmation_request_params[:email]
+            .to_s
+            .strip
+            .downcase
+        identity = normalized_email.presence || "blank:#{request.remote_ip}"
+
+        OpenSSL::HMAC.hexdigest(
+            "SHA256",
+            Rails.application.secret_key_base,
+            identity
+        )
+    end
 
-        log.update(description: 'User confirmed successfully') if defined?(LesliAudit)
+    def confirmation_request_params
+        params
+            .fetch(resource_name, ActionController::Parameters.new)
+            .permit(:email)
     end
 
-    
-    # @controller_action_param :email [String] The registered user email
-    # @return [Json] Json that contains wheter the email confirmation was sent or not. 
-    #     If it is not successful, it returs an error message
-    # @description Resends a email confirmation an already registered user
-    # @example
-    #     # Executing this controller's action from javascript's frontend
-    #     let email = 'john.doe@email.com';
-    #     let data = {
-    #         user: {
-    #             email: email
-    #         }
-    #     };
-    #     this.http.post('127.0.0.1/conformation', data);
-    def create
-        super do |resource|
-            if successfully_sent?(resource)
-                return respond_with_successful
-            else
-                return respond_with_error(resource.errors.full_messages.to_sentence)
+    def respond_to_confirmation_rate_limit
+        message = I18n.t(
+            "lesli_shield.devise/confirmations.message_too_many_attempts"
+        )
+
+        response.set_header(
+            "Retry-After",
+            CONFIRMATION_RATE_LIMIT_WINDOW.to_i.to_s
+        )
+
+        respond_to do |format|
+            format.html { render_confirmation_rate_limit(message) }
+            format.json do
+                render json: { error: message }, status: :too_many_requests
             end
+            format.any { head :too_many_requests }
         end
     end
+
+    def render_confirmation_rate_limit(message)
+        flash.now[:alert] = message
+        self.resource = resource_class.new(
+            email: confirmation_request_params[:email]
+        )
+        render :new, status: :too_many_requests
+    end
+
+    def protect_confirmation_token
+        # Prevent the token in the query string from being sent to third-party
+        # origins while keeping a valid Origin for the resend form rendered when
+        # Devise rejects an invalid or expired token.
+        response.set_header("Referrer-Policy", "same-origin")
+        response.set_header("Cache-Control", "no-store")
+    end
 end