lesli_shield 1.1.5 → 1.1.7

data/app/controllers/users/sessions_controller.rb

@@ -2,7 +2,7 @@
 
 Lesli
 
-Copyright (c) 2025, Lesli Technologies, S. A.
+Copyright (c) 2026, Lesli Technologies, S. A.
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -30,109 +30,147 @@ Building a better future, one line of code at a time.
 // · 
 =end
 
-class Users::SessionsController < Devise::SessionsController
+require "openssl"
 
-    # Creates a new session for the user and allows them access to the platform.
-    #
-    # Devise provides extension points such as Warden hooks and a custom FailureApp
-    # to modify the authentication flow. However, in this case we need full and
-    # explicit control over each step of the login process, including validation,
-    # logging, session creation, and redirection.
-    #
-    # For that reason, the default Devise session logic is intentionally overridden
-    # and reimplemented here. While this approach is less conventional and may
-    # introduce compatibility risks with future Devise releases, it provides a
-    # predictable and fully controlled authentication pipeline, which is important
-    # for the needs of this framework.
-    #
-    # This trade-off is accepted as part of the framework’s lifecycle: any
-    # incompatibilities introduced by Devise updates will be addressed and
-    # maintained as needed.
+class Users::SessionsController < Devise::SessionsController
+    LOGIN_RATE_LIMIT_WINDOW = 15.minutes
+
+    rate_limit(
+        to: 20,
+        within: LOGIN_RATE_LIMIT_WINDOW,
+        by: -> { request.remote_ip },
+        with: :respond_to_login_rate_limit,
+        only: :create,
+        name: "login-ip"
+    )
+
+    rate_limit(
+        to: 10,
+        within: LOGIN_RATE_LIMIT_WINDOW,
+        by: :login_email_rate_limit_key,
+        with: :respond_to_login_rate_limit,
+        only: :create,
+        name: "login-email"
+    )
+
+    # Devise owns the authentication pipeline and yields only after credentials
+    # and active_for_authentication? have been accepted and the web session has
+    # been established. LesliShield adds its application session and audit event
+    # without reimplementing Devise's create action.
     def create
+        super do |user|
+            persist_application_session!(user)
+            record_successful_login_analytics
+        end
+    end
 
-        # Use guarden to check if the users credetials are valid 
-        self.resource = warden.authenticate(auth_options)
+    protected
 
-        # respond with a no valid credentials generic error if warden
-        # cannot validate the user
-        unless resource
-            danger(I18n.t("lesli_shield.devise/sessions.message_not_valid_credentials"))
-            redirect_to user_session_path(r: sign_in_params[:redirect]) and return
-        end
+    # Devise calls this method only after a successful authentication. url_from
+    # accepts local paths and URLs for the current host while rejecting external
+    # and protocol-relative URLs.
+    def after_sign_in_path_for(_user)
+        url_from(requested_redirect) || configured_after_sign_in_path
+    end
 
-        user = resource
+    private
+
+    # Devise has already established the web session when its create action
+    # yields. If either mandatory write fails, remove that session so the request
+    # cannot leave a partially completed login behind.
+    def persist_application_session!(user)
+        application_session_id = create_application_session_and_audit!(user)
+        session[:user_session_id] = application_session_id
+    rescue StandardError
+        rollback_web_session
+        raise
+    end
 
-        # check if user has a valid account
-        unless user.account
-            danger(I18n.t("lesli_shield.devise/sessions.message_not_confirmed_account"))
-            redirect_to user_session_path(r: sign_in_params[:redirect]) and return
+    # The LesliShield session and its single successful-login audit event are
+    # committed atomically.
+    def create_application_session_and_audit!(user)
+        Lesli::User.transaction do
+            application_session = LesliShield::UserSessionService
+                .new(user)
+                .create(request.remote_ip, detected_user_agent)
+                .result
+
+            user.log(
+                engine: LesliShield,
+                source: self.class.name,
+                action: action_name,
+                operation: "session_creation_succeeded",
+                description: "Session creation successful",
+                session_id: application_session.id
+            )
+
+            application_session.id
         end
+    end
 
-        log = nil 
+    def rollback_web_session
+        session.delete(:user_session_id)
+        sign_out(resource_name)
+    end
 
-        # Save a log for the current login attempt 
-        log = user.log(
-            engine: LesliShield,
-            source: self.class.name,
-            action: action_name,
-            operation: 'session_new',
-            description: 'Session creation attempt'
-        ) if defined?(LesliAudit)
+    # Request and device records are analytics, not additional authentication
+    # audit events.
+    def record_successful_login_analytics
+        log_requests if respond_to?(:log_requests)
+        log_devices if respond_to?(:log_devices)
+    end
 
-        # check if user meet requirements to create a new session
-        LesliShield::UserValidatorService.new(user).valid? do |valid, failures|
+    def detected_user_agent
+        get_user_agent if respond_to?(:get_user_agent)
+    end
 
-            # if user do not meet requirements to login
-            unless valid
+    def configured_after_sign_in_path
+        Lesli.config.shield.dig(:path_after_login) || root_path
+    end
 
-                failures_string = failures.join(", ")
-                danger(failures_string)
-                log.update(description: failures_string) if log
-                redirect_to user_session_path(r: sign_in_params[:redirect]) and return
-            end
-        end
+    def requested_redirect
+        login_request_params[:redirect]
+    end
 
-        # create a new session for the user
-        current_session = LesliShield::UserSessionService.new(user)
-        .create(request.remote_ip, (get_user_agent(false) if log))
-        .result
+    def login_request_params
+        params.fetch(:user, {}).permit(
+            :email,
+            :password,
+            :remember_me,
+            :redirect
+        )
+    end
 
-        # make session id globally available
-        session[:user_session_id] = current_session[:id]
+    def login_email_rate_limit_key
+        normalized_email = login_request_params[:email].to_s.strip.downcase
+        identity = normalized_email.presence || "blank:#{request.remote_ip}"
 
-        # do a user login
-        sign_in(resource_name, user)
+        OpenSSL::HMAC.hexdigest(
+            "SHA256",
+            Rails.application.secret_key_base,
+            identity
+        )
+    end
 
-        # update logs with a successful login
-        log.update(
-            description: "Session creation successful", 
-            session_id: current_session[:id]
-        ) if log
+    def respond_to_login_rate_limit
+        message = I18n.t("lesli_shield.devise/sessions.message_too_many_attempts")
+        response.set_header("Retry-After", LOGIN_RATE_LIMIT_WINDOW.to_i.to_s)
 
-        # respond successful and send the path user should go
-        # respond_with_successful({ default_path: user.has_role_with_default_path?() })
-        # respond_with_successful({ default_path: Lesli.config.path_after_login || "/" })
-        redirect_to safe_redirect_path(sign_in_params[:redirect])
+        respond_to do |format|
+            format.html do
+                self.resource = resource_class.new(
+                    email: login_request_params[:email]
+                )
 
-        # Save the user_agent for every new session
-        log_devices if log
-    end
+                flash.now[:alert] = message
+                render :new, status: :too_many_requests
+            end
 
-    private 
+            format.json do
+                render json: { error: message }, status: :too_many_requests
+            end
 
-    def safe_redirect_path redirect_path
-        if redirect_path.present?
-            uri = URI.parse(redirect_path)
-            # Ensures it's a local path
-            return redirect_path if uri.relative?  
+            format.any { head :too_many_requests }
         end
-        Lesli.config.shield.dig(:path_after_login) || root_path
-    rescue URI::InvalidURIError
-        # If the URL is invalid, fallback to root
-        root_path  
-    end
-
-    def sign_in_params
-        params.fetch(:user, {}).permit(:email, :password, :redirect)
     end
 end

data/app/interfaces/lesli_shield/authentication_interface.rb

@@ -39,13 +39,13 @@ module LesliShield
 
             # # check if user has an active session
             # if current_session.equal? nil or !current_session.active?
-            #     current_user.logs.create({ title: "system_session_logout", description: "session finished by the system"})
+            #     current_user.log(operation: "system_session_logout", description: "session finished by the system")
             #     sign_out current_user
             #     redirect_to "#{engine_path}/logout" and return
             # end
 
             # if !current_session.expiration_at.blank? && current_session.expiration_at < Time.current
-            #     current_user.logs.create({ title: "system_session_logout", description: "session expired by the system"})
+            #     current_user.log(operation: "system_session_logout", description: "session expired by the system")
             #     sign_out current_user
             #     redirect_to "#{engine_path}/logout" and return
             # end
@@ -53,7 +53,7 @@ module LesliShield
             # # check password expiration date
             # if current_user.has_expired_password?
             #     unless controller_name == "profiles"
-            #         current_user.logs.create({ description: "redirect_due_to_expired_password" })
+            #         current_user.log(operation: "redirect_due_to_expired_password")
             #         redirect_to "/administration/profile#force-password-reset", notice: I18n.t("core.users/sessions.messages_danger_password_expired")
             #         return
             #     end

data/app/interfaces/lesli_shield/authorization_interface.rb

@@ -31,7 +31,7 @@ module LesliShield
                     :operation => :authorize_request,
                     :description => "Privilege not found for: #{request.path}"
                 )
-                return respond_with_unauthorized({ controller: params[:controller], action: params[:action] })
+                return respond_with_forbidden({ controller: params[:controller], action: params[:action] })
             end
 
             unless granted
@@ -39,7 +39,7 @@ module LesliShield
                     :operation => :authorize_request,
                     :description => "Privilege not granted for: #{request.path}"
                 )
-                return respond_with_unauthorized({ controller: params[:controller], action: params[:action] })
+                return respond_with_forbidden({ controller: params[:controller], action: params[:action] })
             end
         end
     end

data/app/mailers/lesli_shield/devise_mailer.rb

@@ -32,34 +32,41 @@ Building a better future, one line of code at a time.
 module LesliShield
     class DeviseMailer < Lesli::ApplicationLesliMailer
 
+        default from: -> { configured_sender }
+
         # Sends an email with instructions to allow the user reset the password
         def reset_password_instructions(user, token, opts = {})
 
             # defaults for new accounts/users
             email_template = "devise/reset_password_instructions"
-            email_subject = I18n.t("core.users/confirmations.mailer_email_verification")
+            email_subject = I18n.t(
+                "lesli_shield.devise/passwords.mailer_subject"
+            )
 
             # email parameters
             params = {
-                url: build_url("/password/edit", { reset_password_token: token}),
+                url: password_reset_url(token),
                 full_name: user.full_name
             }
 
             # send email
-            email(
-                params,
+            send_email(
+                params: params,
+                options: opts,
                 to: user.email, 
                 subject: email_subject,
                 template_name: email_template
             )
-        end 
+        end
 
         # Sends an email to allow the user confirm the email address
         def confirmation_instructions(user, token, opts = {})
 
             # defaults for new accounts/users
             email_template = "devise/confirmation_instructions"
-            email_subject = I18n.t("core.users/confirmations.mailer_email_verification")
+            email_subject = I18n.t(
+                "lesli_shield.devise/confirmations.mailer_confirmation_subject"
+            )
 
             # # custom email and subject if user is changin his email address
             # if !record.unconfirmed_email.blank?
@@ -69,30 +76,79 @@ module LesliShield
 
             # Depending on wheter there is a new user or they are changing their email, 
             # one or another field will be used
-            email_recipient = user.unconfirmed_email || user.email
+            email_recipient = user.unconfirmed_email.presence || user.email
 
             # email parameters
             params = {
-                url: build_url("/confirmation", { confirmation_token: token})
+                url: account_confirmation_url(token)
             }
 
             # send email
-            email(
-                params,
+            send_email(
+                params: params,
+                options: opts,
                 to: email_recipient, 
                 subject: email_subject,
                 template_name: email_template
             )
         end
 
-        def welcome(user)
-            email_recipient = user.unconfirmed_email || user.email
-            email(
-                { :user => user },
-                to: email_recipient, 
-                subject: "test",
-                template_name: "devise/welcome"
+        def welcome(user, opts = {})
+            email_recipient = user.unconfirmed_email.presence || user.email
+            send_email(
+                params: { user: user },
+                options: opts,
+                to: email_recipient,
+                subject: I18n.t(
+                    "lesli_shield.devise/confirmations.mailer_welcome_subject"
+                ),
+                template_name: "lesli/welcome"
+            )
+        end
+
+        private
+
+        def send_email(params:, options:, to:, subject:, template_name:)
+            headers = { to: to, subject: subject }.merge(options)
+            headers.delete(:template_name)
+
+            @params = @params.merge(params)
+            build_app_from_params(params)
+
+            mail(
+                **headers,
+                template_name: template_name
             )
         end
+
+        def configured_sender
+            sender = Devise.mailer_sender
+            sender = sender.call(:user) if sender.respond_to?(:call)
+
+            sender.presence ||
+                Rails.application.config.action_mailer.default_options&.dig(:from).presence ||
+                "no-reply@lesli.dev"
+        end
+
+        # Use the host application's named route so password recovery continues
+        # to work when authentication is mounted under a custom path.
+        def password_reset_url(token)
+            Rails.application.routes.url_helpers.edit_user_password_url(
+                **action_mailer_url_options,
+                reset_password_token: token
+            )
+        end
+
+        def account_confirmation_url(token)
+            Rails.application.routes.url_helpers.user_confirmation_url(
+                **action_mailer_url_options,
+                confirmation_token: token
+            )
+        end
+
+        def action_mailer_url_options
+            options = Rails.application.config.action_mailer.default_url_options
+            (options || {}).to_h.symbolize_keys
+        end
     end
 end

data/app/models/concerns/lesli_shield/user_authentication.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+module LesliShield
+    # Installs Shield's Devise-based authentication implementation on the core
+    # user model. Lesli itself only consumes current_user and remains free of a
+    # direct dependency on this engine or on Devise.
+    module UserAuthentication
+        extend ActiveSupport::Concern
+
+        # This module is prepended after Devise installs its model modules so
+        # LesliShield can extend, rather than replace, Devise's eligibility
+        # checks. Calling super preserves confirmable, lockable, and any other
+        # authentication provider rules.
+        module LoginEligibility
+            def active_for_authentication?
+                super && lesli_shield_login_validation.valid?
+            end
+
+            def inactive_message
+                return super if lesli_shield_login_validation.valid?
+
+                :invalid
+            end
+
+            private
+
+            def lesli_shield_login_validation
+                return @lesli_shield_login_validation if defined?(
+                    @lesli_shield_login_validation
+                )
+
+                @lesli_shield_login_validation = LesliShield::UserValidatorService
+                    .new(self)
+                    .validate
+            end
+        end
+
+        DEVISE_MODULES = %i[
+            database_authenticatable
+            registerable
+            rememberable
+            recoverable
+            validatable
+            confirmable
+            trackable
+            lockable
+        ].freeze
+
+        included do
+            devise(*LesliShield::UserAuthentication::DEVISE_MODULES)
+            prepend LesliShield::UserAuthentication::LoginEligibility
+        end
+    end
+end

data/app/models/lesli_shield/account.rb

@@ -32,7 +32,10 @@ Building a better future, one line of code at a time.
 
 module LesliShield
     class Account < ApplicationRecord
-        belongs_to :account, class_name: "Lesli::Account"
+        belongs_to :account,
+            class_name: "Lesli::Account",
+            inverse_of: :shield
+        validates :account_id, uniqueness: true
         has_many :dashboards
         has_many :invites
 

data/app/models/lesli_shield/invite.rb

@@ -1,6 +1,6 @@
 module LesliShield
     class Invite < ApplicationRecord
-        belongs_to :account
+        belongs_to :account, class_name: "LesliShield::Account"
         belongs_to :user, class_name: "Lesli::User"
 
         validates :email, presence: true, on: :create

data/app/models/lesli_shield/user/role.rb

@@ -1,7 +1,7 @@
 module LesliShield
     class User::Role < ApplicationRecord
         self.table_name = 'lesli_shield_user_roles'
-        belongs_to :user
+        belongs_to :user, class_name: "Lesli::User"
         belongs_to :role, class_name: "Lesli::Role"
         has_many :roles
     end

data/app/models/lesli_shield/user.rb

@@ -1,5 +1,8 @@
 module LesliShield
-    class User < ::Lesli::User
-        #has_many :activities, class_name: "Lesli::Item::Activity"
+    # Namespace for Shield-owned records associated with Lesli::User, such as
+    # User::Role and User::Session. The authenticatable model remains
+    # Lesli::User; defining a second ActiveRecord subclass for the same table
+    # causes association type mismatches and can confuse Devise mappings.
+    module User
     end
 end

data/app/services/lesli_shield/profile/password_service.rb

@@ -0,0 +1,47 @@
+module LesliShield
+    module Profile
+        class PasswordService < Lesli::ApplicationLesliService
+            def initialize(user)
+                super(user)
+                self.resource = user
+            end
+
+            def update(params, current_session_id: nil)
+                password_updated = false
+
+                resource.transaction do
+                    password_updated = resource.update_with_password(params)
+
+                    if password_updated
+                        clear_password_expiration
+                        revoke_other_sessions(current_session_id)
+                    end
+                end
+
+                unless password_updated
+                    resource.errors.full_messages.each { |message| error(message) }
+                end
+
+                self
+            end
+
+            private
+
+            def clear_password_expiration
+                return unless resource.has_attribute?(:password_expiration_at)
+                return if resource.password_expiration_at.nil?
+
+                resource.update_column(:password_expiration_at, nil)
+            end
+
+            def revoke_other_sessions(current_session_id)
+                return if current_session_id.blank?
+
+                current_session = resource.sessions.find_by(id: current_session_id)
+                return unless current_session
+
+                resource.sessions.where.not(id: current_session.id).destroy_all
+            end
+        end
+    end
+end

data/app/services/lesli_shield/profile_service.rb

@@ -0,0 +1,24 @@
+module LesliShield
+    class ProfileService < Lesli::ApplicationLesliService
+        def initialize(user)
+            super(user)
+            self.resource = user
+        end
+
+        def show
+            resource
+        end
+
+        def update(params)
+            resource.assign_attributes(params)
+            resource.alias = resource.full_name_initials if resource.alias.blank?
+
+            unless resource.save
+                error(resource.errors.full_messages.to_sentence)
+                return self
+            end
+
+            self
+        end
+    end
+end