lesli_shield 1.1.5 → 1.1.7

data/app/controllers/users/passwords_controller.rb

@@ -34,49 +34,232 @@ Building a better future, one line of code at a time.
 
 class Users::PasswordsController < Devise::PasswordsController
 
+    PASSWORD_RESET_RATE_LIMIT_WINDOW = 15.minutes
+
+    rate_limit(
+        to: 20,
+        within: PASSWORD_RESET_RATE_LIMIT_WINDOW,
+        by: -> { request.remote_ip },
+        with: :respond_to_password_reset_rate_limit,
+        only: :create,
+        name: "password-reset-request-ip"
+    )
+
+    rate_limit(
+        to: 5,
+        within: PASSWORD_RESET_RATE_LIMIT_WINDOW,
+        by: :password_reset_email_rate_limit_key,
+        with: :respond_to_password_reset_rate_limit,
+        only: :create,
+        name: "password-reset-request-email"
+    )
+
+    rate_limit(
+        to: 20,
+        within: PASSWORD_RESET_RATE_LIMIT_WINDOW,
+        by: -> { request.remote_ip },
+        with: :respond_to_password_reset_rate_limit,
+        only: :update,
+        name: "password-reset-update-ip"
+    )
+
+    before_action :protect_password_reset_token, only: %i[edit update]
+
     # Sends an email with a token, so the user can reset their password
     def create
-        self.resource = resource_class.send_reset_password_instructions(resource_params)
+        super do |user|
+            record_activity_safely(
+                user,
+                operation: "password_reset_requested",
+                description: "Password reset requested"
+            )
+        end
+    end
 
-        user = self.resource
+    def update
+        password_reset_succeeded = false
 
-        if successfully_sent?(resource)
+        super do |user|
+            password_reset_succeeded = user.errors.empty?
 
-            user.log(
-                :engine => LesliShield, 
-                :source => self.class.name, 
-                :action => action_name, 
-                :operation => 'password_reset', 
-                :description => 'Reset password instructions sent'
-            )
+            if password_reset_succeeded && user.has_expired_password?
+                user.update!(password_expiration_at: nil)
+            end
+        end
 
-            success(I18n.t("core.users/passwords.messages_success"))
-            redirect_to(new_user_password_path)
+        if password_reset_succeeded
+            complete_successful_password_reset!(resource)
         else
-            #respond_with(resource)
-            danger("Error sending reset password instructions")
-            redirect_to(new_user_password_path)
+            record_activity_safely(
+                resource,
+                operation: "password_reset_failed",
+                description: "Password reset failed validation"
+            )
         end
     end
 
-    def update
-        super do |user|
+    protected
+
+    # Preserve the current UX: after requesting a reset, show the same page with
+    # Devise's generic paranoid-mode confirmation instead of revealing whether
+    # the submitted email belongs to an account.
+    def after_sending_reset_password_instructions_path_for(_resource_name)
+        new_user_password_path
+    end
+
+    # Devise resets the password even when the account cannot authenticate. Only
+    # create a web session when the user also passes LesliShield's account, role,
+    # confirmation, and lock checks.
+    def sign_in_after_reset_password?
+        super && resource.active_for_authentication?
+    end
+
+    private
 
-            logs = user.log(engine: LesliShield, source: self.class.name, action: action_name, operation: 'password_update', description:"Password update attempt")
+    def complete_successful_password_reset!(user)
+        unless user_signed_in?
+            record_activity_safely(
+                user,
+                operation: "password_reset_succeeded",
+                description: "Password reset successful"
+            )
+            return
+        end
 
-            # check if password update was ok
-            if user.errors.empty?
+        session[:user_session_id] = create_application_session_and_audit!(user)
+        record_successful_password_reset_analytics
+    rescue StandardError
+        rollback_web_session
+        raise
+    end
 
-                # reset password expiration due the user just updated his password
-                if user.has_expired_password?
-                    user.update(password_expiration_at: nil)
-                end
+    # The password has already been committed by Devise at this point. This
+    # transaction makes the application session and its single audit event
+    # atomic without wrapping Devise's sign-in or response handling.
+    def create_application_session_and_audit!(user)
+        resource_class.transaction do
+            application_session = LesliShield::UserSessionService
+                .new(user)
+                .create(
+                    request.remote_ip,
+                    detected_user_agent
+                )
+                .result
 
-                logs&.update(description: "Password update successful")
-            else
-                danger(user.errors.full_messages.to_sentence)
-                logs&.update(description: resource.errors.full_messages.to_sentence)
+            record_activity(
+                user,
+                operation: "password_reset_succeeded",
+                description: "Password reset successful",
+                session_id: application_session.id
+            )
+
+            application_session.id
+        end
+    end
+
+    def rollback_web_session
+        session.delete(:user_session_id)
+        sign_out(resource_name)
+    end
+
+    def record_successful_password_reset_analytics
+        log_requests if respond_to?(:log_requests)
+        log_devices if respond_to?(:log_devices)
+    end
+
+    def detected_user_agent
+        get_user_agent if respond_to?(:get_user_agent)
+    end
+
+    def password_reset_email_rate_limit_key
+        normalized_email = password_reset_request_params[:email].to_s.strip.downcase
+        identity = normalized_email.presence || "blank:#{request.remote_ip}"
+
+        OpenSSL::HMAC.hexdigest(
+            "SHA256",
+            Rails.application.secret_key_base,
+            identity
+        )
+    end
+
+    def password_reset_request_params
+        params.fetch(resource_name, {}).permit(:email)
+    end
+
+    def respond_to_password_reset_rate_limit
+        message = I18n.t(
+            "lesli_shield.devise/passwords.message_too_many_attempts"
+        )
+
+        response.set_header(
+            "Retry-After",
+            PASSWORD_RESET_RATE_LIMIT_WINDOW.to_i.to_s
+        )
+
+        respond_to do |format|
+            format.html { render_password_reset_rate_limit(message) }
+            format.json do
+                render json: { error: message }, status: :too_many_requests
             end
+            format.any { head :too_many_requests }
         end
     end
+
+    def render_password_reset_rate_limit(message)
+        flash.now[:alert] = message
+
+        if action_name == "update"
+            self.resource = resource_class.new(
+                reset_password_token: resource_params[:reset_password_token]
+            )
+            set_minimum_password_length
+            render :edit, status: :too_many_requests
+        else
+            self.resource = resource_class.new(
+                email: password_reset_request_params[:email]
+            )
+            render :new, status: :too_many_requests
+        end
+    end
+
+    def protect_password_reset_token
+        # `no-referrer` makes some browsers submit the form with `Origin: null`,
+        # which Rails correctly rejects when origin-based CSRF protection is
+        # enabled. `same-origin` keeps the reset token away from third-party
+        # origins while preserving a verifiable origin for the form submission.
+        response.set_header("Referrer-Policy", "same-origin")
+        response.set_header("Cache-Control", "no-store")
+    end
+
+    def record_activity_safely(user, operation:, description:)
+        record_activity(
+            user,
+            operation: operation,
+            description: description
+        )
+    rescue StandardError => exception
+        Rails.error.report(
+            exception,
+            handled: true,
+            context: {
+                controller: self.class.name,
+                operation: operation
+            }
+        )
+    end
+
+    # Invalid or unknown reset tokens can produce a resource without a tenant.
+    # Those attempts cannot be written to tenant-scoped Audit tables.
+    def record_activity(user, operation:, description:, session_id: nil)
+        return unless user&.account
+
+        user.log(
+            engine: LesliShield,
+            source: self.class.name,
+            action: action_name,
+            operation: operation,
+            description: description,
+            session_id: session_id
+        )
+    end
 end

data/app/controllers/users/registrations_controller.rb

@@ -4,7 +4,7 @@
 
 Lesli
 
-Copyright (c) 2025, Lesli Technologies, S. A.
+Copyright (c) 2026, Lesli Technologies, S. A.
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -33,98 +33,123 @@ Building a better future, one line of code at a time.
 =end
 
 class Users::RegistrationsController < Devise::RegistrationsController
-    before_action :configure_sign_up_params, only: [:create]
-    # before_action :configure_account_update_params, only: [:update]
+    REGISTRATION_RATE_LIMIT_WINDOW = 1.hour
+
+    before_action :ensure_registration_allowed!, only: %i[new create]
+
+    rate_limit(
+        to: 10,
+        within: REGISTRATION_RATE_LIMIT_WINDOW,
+        by: -> { request.remote_ip },
+        with: :respond_to_registration_rate_limit,
+        only: :create,
+        name: "registration-ip"
+    )
+
+    rate_limit(
+        to: 3,
+        within: REGISTRATION_RATE_LIMIT_WINDOW,
+        by: :registration_email_rate_limit_key,
+        with: :respond_to_registration_rate_limit,
+        only: :create,
+        name: "registration-email"
+    )
+
+    # Devise owns user construction, validation, persistence, confirmation
+    # delivery, password cleanup, and the active/inactive response flow.
+    def create
+        super do |user|
+            record_user_creation_safely(user)
+        end
+    end
 
-    # GET /resource/sign_up
-    # def new
-    #   super
-    # end
+    protected
 
-    def create
-        begin
+    # Standalone registrations remain inactive until confirmation creates the
+    # account and role. Preserve the existing UX by returning to the form with
+    # Devise's success notice instructing the user to check their email.
+    def after_inactive_sign_up_path_for(_user)
+        new_user_registration_path
+    end
 
-            # Check if instance allow multi-account
-            if !Lesli.config.security.dig(:allow_registration)
-                raise(I18n.t("core.users/registrations.messages_error_registration_not_allowed"))
-            end
+    private
 
-            # build new user
-            user = build_resource(sign_up_params)
+    def ensure_registration_allowed!
+        return if Lesli.config.security.dig(:allow_registration)
 
-            # persist new user
-            if user.save
-                user.log(engine: LesliShield, source: self.class.name, action: action_name, operation: 'user_creation', description: 'User creation successfully')
-                success("Account created, check your email")
-            else
-                raise(user.errors.full_messages.to_sentence)
-            end
-        rescue => exception
-            #Honeybadger.notify(exception)
-            danger(exception.message)
-        end
-        redirect_to(new_user_registration_path)
+        redirect_to(
+            new_user_session_path,
+            alert: I18n.t(
+                "lesli_shield.devise/registrations.message_registration_not_allowed"
+            ),
+            status: request.post? ? :see_other : :found
+        )
     end
 
-    # GET /resource/edit
-    # def edit
-    #   super
-    # end
-
-    # PUT /resource
-    # def update
-    #   super
-    # end
-
-    # DELETE /resource
-    # def destroy
-    #   super
-    # end
-
-    # GET /resource/cancel
-    # Forces the session data which is usually expired after sign
-    # in to be expired now. This is useful if the user wants to
-    # cancel oauth signing in/up in the middle of the process,
-    # removing all OAuth session data.
-    # def cancel
-    #   super
-    # end
+    def registration_email_rate_limit_key
+        normalized_email = registration_params[:email].to_s.strip.downcase
+        identity = normalized_email.presence || "blank:#{request.remote_ip}"
 
-    protected
+        OpenSSL::HMAC.hexdigest(
+            "SHA256",
+            Rails.application.secret_key_base,
+            identity
+        )
+    end
+
+    def registration_params
+        params
+            .fetch(resource_name, ActionController::Parameters.new)
+            .permit(:email)
+    end
+
+    def respond_to_registration_rate_limit
+        message = I18n.t(
+            "lesli_shield.devise/registrations.message_too_many_attempts"
+        )
+
+        response.set_header(
+            "Retry-After",
+            REGISTRATION_RATE_LIMIT_WINDOW.to_i.to_s
+        )
+
+        respond_to do |format|
+            format.html { render_registration_rate_limit(message) }
+            format.json do
+                render json: { error: message }, status: :too_many_requests
+            end
+            format.any { head :too_many_requests }
+        end
+    end
 
-    # If you have extra params to permit, append them to the sanitizer.
-    # def configure_account_update_params
-    #   devise_parameter_sanitizer.permit(:account_update, keys: [:attribute])
-    # end
-
-    # If you have extra params to permit, append them to the sanitizer.
-    def configure_sign_up_params
-        devise_parameter_sanitizer.permit(:sign_up, keys: [
-            :email, 
-            :password, 
-            :password_confirmation
-        ])
+    def render_registration_rate_limit(message)
+        flash.now[:alert] = message
+        self.resource = resource_class.new(email: registration_params[:email])
+        set_minimum_password_length
+        render :new, status: :too_many_requests
     end
 
-    # The path used after sign up.
-    # def after_sign_up_path_for(resource)
-    #   super(resource)
-    # end
-
-    # The path used after sign up for inactive accounts.
-    # def after_inactive_sign_up_path_for(resource)
-    #   super(resource)
-    # end
-
-    # def sign_up_params
-    #     params.permit(:sign_up, keys: [
-    #         :email, 
-    #         :password, 
-    #         :password_confirmation
-    #     ])
-    # end
-
-    def sign_up_params
-        params.fetch(:user, {}).permit(:email, :password, :password_confirmation)
+    # A standalone signup has no tenant yet, so its durable audit event belongs
+    # to the later confirmation transaction. Keep support for pre-associated
+    # resources without allowing an optional audit failure to undo registration.
+    def record_user_creation_safely(user)
+        return unless user.persisted? && user.account.present?
+
+        user.log(
+            engine: LesliShield,
+            source: self.class.name,
+            action: action_name,
+            operation: "user_creation_succeeded",
+            description: "User created successfully"
+        )
+    rescue StandardError => exception
+        Rails.error.report(
+            exception,
+            handled: true,
+            context: {
+                controller: self.class.name,
+                operation: "user_creation_succeeded"
+            }
+        )
     end
 end