lesli_shield 1.1.6 → 1.1.7

data/app/controllers/lesli_shield/profile/passwords_controller.rb

@@ -0,0 +1,119 @@
+module LesliShield
+    module Profile
+        class PasswordsController < ApplicationController
+            PASSWORD_CHANGE_RATE_LIMIT_WINDOW = 15.minutes
+
+            skip_before_action :authorize_request
+
+            rate_limit(
+                to: 10,
+                within: PASSWORD_CHANGE_RATE_LIMIT_WINDOW,
+                by: -> { current_user&.id || request.remote_ip },
+                with: :respond_to_password_change_rate_limit,
+                only: :update,
+                name: "profile-password-update"
+            )
+
+            def update
+                @active_profile_tab = "security"
+                @password = PasswordService
+                    .new(current_user)
+                    .update(
+                        password_params,
+                        current_session_id: session[:user_session_id]
+                    )
+                @user = @password.result
+
+                if @password.successful?
+                    bypass_sign_in(@user)
+                    record_password_event(
+                        operation: "password_change_succeeded",
+                        description: "Password changed successfully"
+                    )
+
+                    respond_with_lesli(
+                        turbo: [
+                            stream_notification_success(success_message),
+                            stream_redirection(profile_path(tab: "security"))
+                        ],
+                        json: { message: success_message },
+                        redirect: profile_path(tab: "security")
+                    )
+                else
+                    record_password_event(
+                        operation: "password_change_failed",
+                        description: "Password change failed validation"
+                    )
+
+                    respond_with_lesli(
+                        turbo: [
+                            stream_notification_danger(@password.errors_as_sentence),
+                            turbo_stream.replace(
+                                "shield-profile-password-form",
+                                partial: "lesli_shield/profiles/password-form",
+                                locals: { user: @user }
+                            )
+                        ],
+                        json: { errors: @password.errors },
+                        html: "lesli_shield/profiles/show",
+                        status: :unprocessable_content
+                    )
+                end
+            end
+
+            private
+
+            def password_params
+                params.require(:user).permit(
+                    :current_password,
+                    :password,
+                    :password_confirmation
+                )
+            end
+
+            def success_message
+                I18n.t("lesli_shield.profiles.password_updated")
+            end
+
+            def record_password_event(operation:, description:)
+                log(operation: operation, description: description)
+            rescue StandardError => exception
+                Rails.error.report(
+                    exception,
+                    handled: true,
+                    context: {
+                        controller: self.class.name,
+                        operation: operation
+                    }
+                )
+            end
+
+            def respond_to_password_change_rate_limit
+                @active_profile_tab = "security"
+                @user = current_user
+                message = I18n.t(
+                    "lesli_shield.profiles.password_too_many_attempts"
+                )
+
+                response.set_header(
+                    "Retry-After",
+                    PASSWORD_CHANGE_RATE_LIMIT_WINDOW.to_i.to_s
+                )
+
+                respond_with_lesli(
+                    turbo: [
+                        stream_notification_danger(message),
+                        turbo_stream.replace(
+                            "shield-profile-password-form",
+                            partial: "lesli_shield/profiles/password-form",
+                            locals: { user: @user }
+                        )
+                    ],
+                    json: { error: message },
+                    html: "lesli_shield/profiles/show",
+                    status: :too_many_requests
+                )
+            end
+        end
+    end
+end

data/app/controllers/lesli_shield/profiles_controller.rb

@@ -0,0 +1,63 @@
+module LesliShield
+    class ProfilesController < ApplicationController
+        PROFILE_FIELDS = %i[
+            id
+            uid
+            alias
+            title
+            email
+            first_name
+            last_name
+            telephone
+        ].freeze
+
+        skip_before_action :authorize_request
+        before_action :set_profile
+
+        def show
+            respond_with_lesli(json: profile_payload)
+        end
+
+        def update
+            @profile.update(profile_params)
+            @user = @profile.result
+
+            if @profile.successful?
+                respond_with_lesli(
+                    turbo: stream_notification_success("Profile updated successfully!"),
+                    json: profile_payload,
+                    redirect: profile_path
+                )
+            else
+                respond_with_lesli(
+                    turbo: stream_notification_danger(@profile.errors_as_sentence),
+                    json: { errors: @profile.errors },
+                    html: :show,
+                    status: :unprocessable_content
+                )
+            end
+        end
+
+        private
+
+        def set_profile
+            @profile = LesliShield::ProfileService.new(current_user)
+            @user = @profile.show
+        end
+
+        def profile_params
+            params.require(:user).permit(
+                :alias,
+                :title,
+                :email,
+                :first_name,
+                :last_name,
+                :telephone
+            )
+        end
+
+        def profile_payload
+            @user.as_json(only: PROFILE_FIELDS)
+        end
+    end
+end

data/app/controllers/lesli_shield/sessions_controller.rb

@@ -6,8 +6,7 @@ module LesliShield
         def index
             @sessions = respond_with_pagination(UserSessionService.new(current_user, query).index())
             respond_with_lesli(
-                :html => @sessions,
-                :json => @sessions
+                json: @sessions
             )
         end
 

data/app/controllers/users/confirmations_controller.rb

@@ -29,73 +29,186 @@ Building a better future, one line of code at a time.
 @license  GPLv3 http://www.gnu.org/licenses/gpl-3.0.en.html
 
 // · ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~
-// · 
+// ·
 =end
-class Users::ConfirmationsController < Devise::ConfirmationsController
 
+class Users::ConfirmationsController < Devise::ConfirmationsController
+    CONFIRMATION_RATE_LIMIT_WINDOW = 1.hour
+
+    rate_limit(
+        to: 10,
+        within: CONFIRMATION_RATE_LIMIT_WINDOW,
+        by: -> { request.remote_ip },
+        with: :respond_to_confirmation_rate_limit,
+        only: :create,
+        name: "confirmation-request-ip"
+    )
+
+    rate_limit(
+        to: 3,
+        within: CONFIRMATION_RATE_LIMIT_WINDOW,
+        by: :confirmation_email_rate_limit_key,
+        with: :respond_to_confirmation_rate_limit,
+        only: :create,
+        name: "confirmation-request-email"
+    )
+
+    before_action :protect_confirmation_token, only: :show
+
+    # Devise validates and consumes the raw token. Account provisioning and the
+    # successful audit event share the same transaction so a partial account can
+    # never be left behind and a provisioning failure leaves the token reusable.
     def show
+        self.resource = confirm_user_and_provision_account
+
+        if resource.errors.empty?
+            send_welcome_email_safely(resource)
+            set_flash_message!(:notice, :confirmed)
+            respond_with_navigational(resource) do
+                redirect_to after_confirmation_path_for(resource_name, resource)
+            end
+        else
+            respond_with_navigational(
+                resource.errors,
+                status: :unprocessable_content
+            ) do
+                render :new, status: :unprocessable_content
+            end
+        end
+    end
+
+    protected
+
+    # Keep the user on the resend page so Devise's generic paranoid-mode notice
+    # is visible without disclosing whether the email exists or is confirmed.
+    def after_resending_confirmation_instructions_path_for(_resource_name)
+        new_user_confirmation_path
+    end
+
+    private
+
+    def confirm_user_and_provision_account
+        confirmed_user = nil
 
-        # delete all previus messages
-        flash.clear
+        resource_class.transaction do
+            confirmed_user = resource_class.confirm_by_token(
+                params[:confirmation_token]
+            )
 
-        # get the confirmation token sent through get params
-        token = params[:confirmation_token]
+            if confirmed_user.errors.empty?
+                LesliShield::UserRegistrationService
+                    .new(confirmed_user)
+                    .provision_account!
 
-        # validate that token were sent
-        if token.blank?
-            return flash[:danger] = I18n.t("core.users/confirmations.messages_warning_invalid_token")
+                confirmed_user.update!(confirmation_token: nil)
+                record_successful_confirmation!(confirmed_user)
+            end
         end
 
-        # check if token belongs to a unconfirmed user
-        user = Lesli::User.find_by(:confirmation_token => token, :confirmed_at => nil)
+        confirmed_user
+    rescue StandardError => exception
+        Rails.error.report(
+            exception,
+            handled: true,
+            context: {
+                controller: self.class.name,
+                operation: "user_confirmation_succeeded"
+            }
+        )
+
+        confirmation_failure_resource(confirmed_user)
+    end
 
-        # validate that user were found
-        if user.blank?
-            return flash[:danger] = I18n.t("core.users/confirmations.messages_warning_invalid_token")
+    def confirmation_failure_resource(user)
+        failed_resource = if user&.persisted?
+            resource_class.find_by(id: user.id)
         end
 
-        # register a log with a validation atempt for the user
-        log = user.log(engine: LesliShield, source: self.class.name, action: action_name, operation: "user_confirmation", description: "Confirmation process started")
-        
-        # create a new instance of the registration service
-        registration_service = LesliShield::UserRegistrationService.new(user)
+        failed_resource ||= resource_class.new
+        failed_resource.errors.add(
+            :base,
+            I18n.t(
+                "lesli_shield.devise/confirmations.message_confirmation_failed"
+            )
+        )
+        failed_resource
+    end
 
-        # confirm the user
-        registration_service.confirm
+    def record_successful_confirmation!(user)
+        user.log(
+            engine: LesliShield,
+            source: self.class.name,
+            action: action_name,
+            operation: "user_confirmation_succeeded",
+            description: "User confirmed successfully"
+        )
+    end
 
-        # send a welcome email to user as is confirmed
-        LesliShield::DeviseMailer.with(user: resource).welcome.deliver_later
+    def send_welcome_email_safely(user)
+        LesliShield::DeviseMailer.welcome(user).deliver_later
+    rescue StandardError => exception
+        Rails.error.report(
+            exception,
+            handled: true,
+            context: {
+                controller: self.class.name,
+                operation: "welcome_email_delivery"
+            }
+        )
+    end
 
-        # let the user knows that the confirmation is done
-        flash[:success] = I18n.t("core.users/confirmations.messages_success_email_updated")
-        
-        # setup the new account
-        registration_service.create_account if user.account.blank?
+    def confirmation_email_rate_limit_key
+        normalized_email = confirmation_request_params[:email]
+            .to_s
+            .strip
+            .downcase
+        identity = normalized_email.presence || "blank:#{request.remote_ip}"
+
+        OpenSSL::HMAC.hexdigest(
+            "SHA256",
+            Rails.application.secret_key_base,
+            identity
+        )
+    end
 
-        log.update(description: 'User confirmed successfully') if defined?(LesliAudit)
+    def confirmation_request_params
+        params
+            .fetch(resource_name, ActionController::Parameters.new)
+            .permit(:email)
     end
 
-    
-    # @controller_action_param :email [String] The registered user email
-    # @return [Json] Json that contains wheter the email confirmation was sent or not. 
-    #     If it is not successful, it returs an error message
-    # @description Resends a email confirmation an already registered user
-    # @example
-    #     # Executing this controller's action from javascript's frontend
-    #     let email = 'john.doe@email.com';
-    #     let data = {
-    #         user: {
-    #             email: email
-    #         }
-    #     };
-    #     this.http.post('127.0.0.1/conformation', data);
-    def create
-        super do |resource|
-            if successfully_sent?(resource)
-                return respond_with_successful
-            else
-                return respond_with_error(resource.errors.full_messages.to_sentence)
+    def respond_to_confirmation_rate_limit
+        message = I18n.t(
+            "lesli_shield.devise/confirmations.message_too_many_attempts"
+        )
+
+        response.set_header(
+            "Retry-After",
+            CONFIRMATION_RATE_LIMIT_WINDOW.to_i.to_s
+        )
+
+        respond_to do |format|
+            format.html { render_confirmation_rate_limit(message) }
+            format.json do
+                render json: { error: message }, status: :too_many_requests
             end
+            format.any { head :too_many_requests }
         end
     end
+
+    def render_confirmation_rate_limit(message)
+        flash.now[:alert] = message
+        self.resource = resource_class.new(
+            email: confirmation_request_params[:email]
+        )
+        render :new, status: :too_many_requests
+    end
+
+    def protect_confirmation_token
+        # Prevent the token in the query string from being sent to third-party
+        # origins while keeping a valid Origin for the resend form rendered when
+        # Devise rejects an invalid or expired token.
+        response.set_header("Referrer-Policy", "same-origin")
+        response.set_header("Cache-Control", "no-store")
+    end
 end

data/app/controllers/users/passwords_controller.rb

@@ -34,49 +34,232 @@ Building a better future, one line of code at a time.
 
 class Users::PasswordsController < Devise::PasswordsController
 
+    PASSWORD_RESET_RATE_LIMIT_WINDOW = 15.minutes
+
+    rate_limit(
+        to: 20,
+        within: PASSWORD_RESET_RATE_LIMIT_WINDOW,
+        by: -> { request.remote_ip },
+        with: :respond_to_password_reset_rate_limit,
+        only: :create,
+        name: "password-reset-request-ip"
+    )
+
+    rate_limit(
+        to: 5,
+        within: PASSWORD_RESET_RATE_LIMIT_WINDOW,
+        by: :password_reset_email_rate_limit_key,
+        with: :respond_to_password_reset_rate_limit,
+        only: :create,
+        name: "password-reset-request-email"
+    )
+
+    rate_limit(
+        to: 20,
+        within: PASSWORD_RESET_RATE_LIMIT_WINDOW,
+        by: -> { request.remote_ip },
+        with: :respond_to_password_reset_rate_limit,
+        only: :update,
+        name: "password-reset-update-ip"
+    )
+
+    before_action :protect_password_reset_token, only: %i[edit update]
+
     # Sends an email with a token, so the user can reset their password
     def create
-        self.resource = resource_class.send_reset_password_instructions(resource_params)
+        super do |user|
+            record_activity_safely(
+                user,
+                operation: "password_reset_requested",
+                description: "Password reset requested"
+            )
+        end
+    end
 
-        user = self.resource
+    def update
+        password_reset_succeeded = false
 
-        if successfully_sent?(resource)
+        super do |user|
+            password_reset_succeeded = user.errors.empty?
 
-            user.log(
-                :engine => LesliShield, 
-                :source => self.class.name, 
-                :action => action_name, 
-                :operation => 'password_reset', 
-                :description => 'Reset password instructions sent'
-            )
+            if password_reset_succeeded && user.has_expired_password?
+                user.update!(password_expiration_at: nil)
+            end
+        end
 
-            success(I18n.t("core.users/passwords.messages_success"))
-            redirect_to(new_user_password_path)
+        if password_reset_succeeded
+            complete_successful_password_reset!(resource)
         else
-            #respond_with(resource)
-            danger("Error sending reset password instructions")
-            redirect_to(new_user_password_path)
+            record_activity_safely(
+                resource,
+                operation: "password_reset_failed",
+                description: "Password reset failed validation"
+            )
         end
     end
 
-    def update
-        super do |user|
+    protected
+
+    # Preserve the current UX: after requesting a reset, show the same page with
+    # Devise's generic paranoid-mode confirmation instead of revealing whether
+    # the submitted email belongs to an account.
+    def after_sending_reset_password_instructions_path_for(_resource_name)
+        new_user_password_path
+    end
+
+    # Devise resets the password even when the account cannot authenticate. Only
+    # create a web session when the user also passes LesliShield's account, role,
+    # confirmation, and lock checks.
+    def sign_in_after_reset_password?
+        super && resource.active_for_authentication?
+    end
+
+    private
 
-            logs = user.log(engine: LesliShield, source: self.class.name, action: action_name, operation: 'password_update', description:"Password update attempt")
+    def complete_successful_password_reset!(user)
+        unless user_signed_in?
+            record_activity_safely(
+                user,
+                operation: "password_reset_succeeded",
+                description: "Password reset successful"
+            )
+            return
+        end
 
-            # check if password update was ok
-            if user.errors.empty?
+        session[:user_session_id] = create_application_session_and_audit!(user)
+        record_successful_password_reset_analytics
+    rescue StandardError
+        rollback_web_session
+        raise
+    end
 
-                # reset password expiration due the user just updated his password
-                if user.has_expired_password?
-                    user.update(password_expiration_at: nil)
-                end
+    # The password has already been committed by Devise at this point. This
+    # transaction makes the application session and its single audit event
+    # atomic without wrapping Devise's sign-in or response handling.
+    def create_application_session_and_audit!(user)
+        resource_class.transaction do
+            application_session = LesliShield::UserSessionService
+                .new(user)
+                .create(
+                    request.remote_ip,
+                    detected_user_agent
+                )
+                .result
 
-                logs&.update(description: "Password update successful")
-            else
-                danger(user.errors.full_messages.to_sentence)
-                logs&.update(description: resource.errors.full_messages.to_sentence)
+            record_activity(
+                user,
+                operation: "password_reset_succeeded",
+                description: "Password reset successful",
+                session_id: application_session.id
+            )
+
+            application_session.id
+        end
+    end
+
+    def rollback_web_session
+        session.delete(:user_session_id)
+        sign_out(resource_name)
+    end
+
+    def record_successful_password_reset_analytics
+        log_requests if respond_to?(:log_requests)
+        log_devices if respond_to?(:log_devices)
+    end
+
+    def detected_user_agent
+        get_user_agent if respond_to?(:get_user_agent)
+    end
+
+    def password_reset_email_rate_limit_key
+        normalized_email = password_reset_request_params[:email].to_s.strip.downcase
+        identity = normalized_email.presence || "blank:#{request.remote_ip}"
+
+        OpenSSL::HMAC.hexdigest(
+            "SHA256",
+            Rails.application.secret_key_base,
+            identity
+        )
+    end
+
+    def password_reset_request_params
+        params.fetch(resource_name, {}).permit(:email)
+    end
+
+    def respond_to_password_reset_rate_limit
+        message = I18n.t(
+            "lesli_shield.devise/passwords.message_too_many_attempts"
+        )
+
+        response.set_header(
+            "Retry-After",
+            PASSWORD_RESET_RATE_LIMIT_WINDOW.to_i.to_s
+        )
+
+        respond_to do |format|
+            format.html { render_password_reset_rate_limit(message) }
+            format.json do
+                render json: { error: message }, status: :too_many_requests
             end
+            format.any { head :too_many_requests }
         end
     end
+
+    def render_password_reset_rate_limit(message)
+        flash.now[:alert] = message
+
+        if action_name == "update"
+            self.resource = resource_class.new(
+                reset_password_token: resource_params[:reset_password_token]
+            )
+            set_minimum_password_length
+            render :edit, status: :too_many_requests
+        else
+            self.resource = resource_class.new(
+                email: password_reset_request_params[:email]
+            )
+            render :new, status: :too_many_requests
+        end
+    end
+
+    def protect_password_reset_token
+        # `no-referrer` makes some browsers submit the form with `Origin: null`,
+        # which Rails correctly rejects when origin-based CSRF protection is
+        # enabled. `same-origin` keeps the reset token away from third-party
+        # origins while preserving a verifiable origin for the form submission.
+        response.set_header("Referrer-Policy", "same-origin")
+        response.set_header("Cache-Control", "no-store")
+    end
+
+    def record_activity_safely(user, operation:, description:)
+        record_activity(
+            user,
+            operation: operation,
+            description: description
+        )
+    rescue StandardError => exception
+        Rails.error.report(
+            exception,
+            handled: true,
+            context: {
+                controller: self.class.name,
+                operation: operation
+            }
+        )
+    end
+
+    # Invalid or unknown reset tokens can produce a resource without a tenant.
+    # Those attempts cannot be written to tenant-scoped Audit tables.
+    def record_activity(user, operation:, description:, session_id: nil)
+        return unless user&.account
+
+        user.log(
+            engine: LesliShield,
+            source: self.class.name,
+            action: action_name,
+            operation: operation,
+            description: description,
+            session_id: session_id
+        )
+    end
 end