lesli_shield 1.1.6 → 1.1.7

data/app/controllers/users/registrations_controller.rb

@@ -4,7 +4,7 @@
 
 Lesli
 
-Copyright (c) 2025, Lesli Technologies, S. A.
+Copyright (c) 2026, Lesli Technologies, S. A.
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -33,98 +33,123 @@ Building a better future, one line of code at a time.
 =end
 
 class Users::RegistrationsController < Devise::RegistrationsController
-    before_action :configure_sign_up_params, only: [:create]
-    # before_action :configure_account_update_params, only: [:update]
+    REGISTRATION_RATE_LIMIT_WINDOW = 1.hour
+
+    before_action :ensure_registration_allowed!, only: %i[new create]
+
+    rate_limit(
+        to: 10,
+        within: REGISTRATION_RATE_LIMIT_WINDOW,
+        by: -> { request.remote_ip },
+        with: :respond_to_registration_rate_limit,
+        only: :create,
+        name: "registration-ip"
+    )
+
+    rate_limit(
+        to: 3,
+        within: REGISTRATION_RATE_LIMIT_WINDOW,
+        by: :registration_email_rate_limit_key,
+        with: :respond_to_registration_rate_limit,
+        only: :create,
+        name: "registration-email"
+    )
+
+    # Devise owns user construction, validation, persistence, confirmation
+    # delivery, password cleanup, and the active/inactive response flow.
+    def create
+        super do |user|
+            record_user_creation_safely(user)
+        end
+    end
 
-    # GET /resource/sign_up
-    # def new
-    #   super
-    # end
+    protected
 
-    def create
-        begin
+    # Standalone registrations remain inactive until confirmation creates the
+    # account and role. Preserve the existing UX by returning to the form with
+    # Devise's success notice instructing the user to check their email.
+    def after_inactive_sign_up_path_for(_user)
+        new_user_registration_path
+    end
 
-            # Check if instance allow multi-account
-            if !Lesli.config.security.dig(:allow_registration)
-                raise(I18n.t("core.users/registrations.messages_error_registration_not_allowed"))
-            end
+    private
 
-            # build new user
-            user = build_resource(sign_up_params)
+    def ensure_registration_allowed!
+        return if Lesli.config.security.dig(:allow_registration)
 
-            # persist new user
-            if user.save
-                user.log(engine: LesliShield, source: self.class.name, action: action_name, operation: 'user_creation', description: 'User creation successfully')
-                success("Account created, check your email")
-            else
-                raise(user.errors.full_messages.to_sentence)
-            end
-        rescue => exception
-            #Honeybadger.notify(exception)
-            danger(exception.message)
-        end
-        redirect_to(new_user_registration_path)
+        redirect_to(
+            new_user_session_path,
+            alert: I18n.t(
+                "lesli_shield.devise/registrations.message_registration_not_allowed"
+            ),
+            status: request.post? ? :see_other : :found
+        )
     end
 
-    # GET /resource/edit
-    # def edit
-    #   super
-    # end
-
-    # PUT /resource
-    # def update
-    #   super
-    # end
-
-    # DELETE /resource
-    # def destroy
-    #   super
-    # end
-
-    # GET /resource/cancel
-    # Forces the session data which is usually expired after sign
-    # in to be expired now. This is useful if the user wants to
-    # cancel oauth signing in/up in the middle of the process,
-    # removing all OAuth session data.
-    # def cancel
-    #   super
-    # end
+    def registration_email_rate_limit_key
+        normalized_email = registration_params[:email].to_s.strip.downcase
+        identity = normalized_email.presence || "blank:#{request.remote_ip}"
 
-    protected
+        OpenSSL::HMAC.hexdigest(
+            "SHA256",
+            Rails.application.secret_key_base,
+            identity
+        )
+    end
+
+    def registration_params
+        params
+            .fetch(resource_name, ActionController::Parameters.new)
+            .permit(:email)
+    end
+
+    def respond_to_registration_rate_limit
+        message = I18n.t(
+            "lesli_shield.devise/registrations.message_too_many_attempts"
+        )
+
+        response.set_header(
+            "Retry-After",
+            REGISTRATION_RATE_LIMIT_WINDOW.to_i.to_s
+        )
+
+        respond_to do |format|
+            format.html { render_registration_rate_limit(message) }
+            format.json do
+                render json: { error: message }, status: :too_many_requests
+            end
+            format.any { head :too_many_requests }
+        end
+    end
 
-    # If you have extra params to permit, append them to the sanitizer.
-    # def configure_account_update_params
-    #   devise_parameter_sanitizer.permit(:account_update, keys: [:attribute])
-    # end
-
-    # If you have extra params to permit, append them to the sanitizer.
-    def configure_sign_up_params
-        devise_parameter_sanitizer.permit(:sign_up, keys: [
-            :email, 
-            :password, 
-            :password_confirmation
-        ])
+    def render_registration_rate_limit(message)
+        flash.now[:alert] = message
+        self.resource = resource_class.new(email: registration_params[:email])
+        set_minimum_password_length
+        render :new, status: :too_many_requests
     end
 
-    # The path used after sign up.
-    # def after_sign_up_path_for(resource)
-    #   super(resource)
-    # end
-
-    # The path used after sign up for inactive accounts.
-    # def after_inactive_sign_up_path_for(resource)
-    #   super(resource)
-    # end
-
-    # def sign_up_params
-    #     params.permit(:sign_up, keys: [
-    #         :email, 
-    #         :password, 
-    #         :password_confirmation
-    #     ])
-    # end
-
-    def sign_up_params
-        params.fetch(:user, {}).permit(:email, :password, :password_confirmation)
+    # A standalone signup has no tenant yet, so its durable audit event belongs
+    # to the later confirmation transaction. Keep support for pre-associated
+    # resources without allowing an optional audit failure to undo registration.
+    def record_user_creation_safely(user)
+        return unless user.persisted? && user.account.present?
+
+        user.log(
+            engine: LesliShield,
+            source: self.class.name,
+            action: action_name,
+            operation: "user_creation_succeeded",
+            description: "User created successfully"
+        )
+    rescue StandardError => exception
+        Rails.error.report(
+            exception,
+            handled: true,
+            context: {
+                controller: self.class.name,
+                operation: "user_creation_succeeded"
+            }
+        )
     end
 end

data/app/controllers/users/sessions_controller.rb

@@ -2,7 +2,7 @@
 
 Lesli
 
-Copyright (c) 2025, Lesli Technologies, S. A.
+Copyright (c) 2026, Lesli Technologies, S. A.
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -30,109 +30,147 @@ Building a better future, one line of code at a time.
 // · 
 =end
 
-class Users::SessionsController < Devise::SessionsController
+require "openssl"
 
-    # Creates a new session for the user and allows them access to the platform.
-    #
-    # Devise provides extension points such as Warden hooks and a custom FailureApp
-    # to modify the authentication flow. However, in this case we need full and
-    # explicit control over each step of the login process, including validation,
-    # logging, session creation, and redirection.
-    #
-    # For that reason, the default Devise session logic is intentionally overridden
-    # and reimplemented here. While this approach is less conventional and may
-    # introduce compatibility risks with future Devise releases, it provides a
-    # predictable and fully controlled authentication pipeline, which is important
-    # for the needs of this framework.
-    #
-    # This trade-off is accepted as part of the framework’s lifecycle: any
-    # incompatibilities introduced by Devise updates will be addressed and
-    # maintained as needed.
+class Users::SessionsController < Devise::SessionsController
+    LOGIN_RATE_LIMIT_WINDOW = 15.minutes
+
+    rate_limit(
+        to: 20,
+        within: LOGIN_RATE_LIMIT_WINDOW,
+        by: -> { request.remote_ip },
+        with: :respond_to_login_rate_limit,
+        only: :create,
+        name: "login-ip"
+    )
+
+    rate_limit(
+        to: 10,
+        within: LOGIN_RATE_LIMIT_WINDOW,
+        by: :login_email_rate_limit_key,
+        with: :respond_to_login_rate_limit,
+        only: :create,
+        name: "login-email"
+    )
+
+    # Devise owns the authentication pipeline and yields only after credentials
+    # and active_for_authentication? have been accepted and the web session has
+    # been established. LesliShield adds its application session and audit event
+    # without reimplementing Devise's create action.
     def create
+        super do |user|
+            persist_application_session!(user)
+            record_successful_login_analytics
+        end
+    end
 
-        # Use guarden to check if the users credetials are valid 
-        self.resource = warden.authenticate(auth_options)
+    protected
 
-        # respond with a no valid credentials generic error if warden
-        # cannot validate the user
-        unless resource
-            danger(I18n.t("lesli_shield.devise/sessions.message_not_valid_credentials"))
-            redirect_to user_session_path(r: sign_in_params[:redirect]) and return
-        end
+    # Devise calls this method only after a successful authentication. url_from
+    # accepts local paths and URLs for the current host while rejecting external
+    # and protocol-relative URLs.
+    def after_sign_in_path_for(_user)
+        url_from(requested_redirect) || configured_after_sign_in_path
+    end
 
-        user = resource
+    private
+
+    # Devise has already established the web session when its create action
+    # yields. If either mandatory write fails, remove that session so the request
+    # cannot leave a partially completed login behind.
+    def persist_application_session!(user)
+        application_session_id = create_application_session_and_audit!(user)
+        session[:user_session_id] = application_session_id
+    rescue StandardError
+        rollback_web_session
+        raise
+    end
 
-        # check if user has a valid account
-        unless user.account
-            danger(I18n.t("lesli_shield.devise/sessions.message_not_confirmed_account"))
-            redirect_to user_session_path(r: sign_in_params[:redirect]) and return
+    # The LesliShield session and its single successful-login audit event are
+    # committed atomically.
+    def create_application_session_and_audit!(user)
+        Lesli::User.transaction do
+            application_session = LesliShield::UserSessionService
+                .new(user)
+                .create(request.remote_ip, detected_user_agent)
+                .result
+
+            user.log(
+                engine: LesliShield,
+                source: self.class.name,
+                action: action_name,
+                operation: "session_creation_succeeded",
+                description: "Session creation successful",
+                session_id: application_session.id
+            )
+
+            application_session.id
         end
+    end
 
-        log = nil 
+    def rollback_web_session
+        session.delete(:user_session_id)
+        sign_out(resource_name)
+    end
 
-        # Save a log for the current login attempt 
-        log = user.log(
-            engine: LesliShield,
-            source: self.class.name,
-            action: action_name,
-            operation: 'session_new',
-            description: 'Session creation attempt'
-        ) if defined?(LesliAudit)
+    # Request and device records are analytics, not additional authentication
+    # audit events.
+    def record_successful_login_analytics
+        log_requests if respond_to?(:log_requests)
+        log_devices if respond_to?(:log_devices)
+    end
 
-        # check if user meet requirements to create a new session
-        LesliShield::UserValidatorService.new(user).valid? do |valid, failures|
+    def detected_user_agent
+        get_user_agent if respond_to?(:get_user_agent)
+    end
 
-            # if user do not meet requirements to login
-            unless valid
+    def configured_after_sign_in_path
+        Lesli.config.shield.dig(:path_after_login) || root_path
+    end
 
-                failures_string = failures.join(", ")
-                danger(failures_string)
-                log.update(description: failures_string) if log
-                redirect_to user_session_path(r: sign_in_params[:redirect]) and return
-            end
-        end
+    def requested_redirect
+        login_request_params[:redirect]
+    end
 
-        # create a new session for the user
-        current_session = LesliShield::UserSessionService.new(user)
-        .create(request.remote_ip, (get_user_agent(false) if log))
-        .result
+    def login_request_params
+        params.fetch(:user, {}).permit(
+            :email,
+            :password,
+            :remember_me,
+            :redirect
+        )
+    end
 
-        # make session id globally available
-        session[:user_session_id] = current_session[:id]
+    def login_email_rate_limit_key
+        normalized_email = login_request_params[:email].to_s.strip.downcase
+        identity = normalized_email.presence || "blank:#{request.remote_ip}"
 
-        # do a user login
-        sign_in(resource_name, user)
+        OpenSSL::HMAC.hexdigest(
+            "SHA256",
+            Rails.application.secret_key_base,
+            identity
+        )
+    end
 
-        # update logs with a successful login
-        log.update(
-            description: "Session creation successful", 
-            session_id: current_session[:id]
-        ) if log
+    def respond_to_login_rate_limit
+        message = I18n.t("lesli_shield.devise/sessions.message_too_many_attempts")
+        response.set_header("Retry-After", LOGIN_RATE_LIMIT_WINDOW.to_i.to_s)
 
-        # respond successful and send the path user should go
-        # respond_with_successful({ default_path: user.has_role_with_default_path?() })
-        # respond_with_successful({ default_path: Lesli.config.path_after_login || "/" })
-        redirect_to safe_redirect_path(sign_in_params[:redirect])
+        respond_to do |format|
+            format.html do
+                self.resource = resource_class.new(
+                    email: login_request_params[:email]
+                )
 
-        # Save the user_agent for every new session
-        log_devices if log
-    end
+                flash.now[:alert] = message
+                render :new, status: :too_many_requests
+            end
 
-    private 
+            format.json do
+                render json: { error: message }, status: :too_many_requests
+            end
 
-    def safe_redirect_path redirect_path
-        if redirect_path.present?
-            uri = URI.parse(redirect_path)
-            # Ensures it's a local path
-            return redirect_path if uri.relative?  
+            format.any { head :too_many_requests }
         end
-        Lesli.config.shield.dig(:path_after_login) || root_path
-    rescue URI::InvalidURIError
-        # If the URL is invalid, fallback to root
-        root_path  
-    end
-
-    def sign_in_params
-        params.fetch(:user, {}).permit(:email, :password, :redirect)
     end
 end

data/app/interfaces/lesli_shield/authorization_interface.rb

@@ -31,7 +31,7 @@ module LesliShield
                     :operation => :authorize_request,
                     :description => "Privilege not found for: #{request.path}"
                 )
-                return respond_with_unauthorized({ controller: params[:controller], action: params[:action] })
+                return respond_with_forbidden({ controller: params[:controller], action: params[:action] })
             end
 
             unless granted
@@ -39,7 +39,7 @@ module LesliShield
                     :operation => :authorize_request,
                     :description => "Privilege not granted for: #{request.path}"
                 )
-                return respond_with_unauthorized({ controller: params[:controller], action: params[:action] })
+                return respond_with_forbidden({ controller: params[:controller], action: params[:action] })
             end
         end
     end

data/app/mailers/lesli_shield/devise_mailer.rb

@@ -32,34 +32,41 @@ Building a better future, one line of code at a time.
 module LesliShield
     class DeviseMailer < Lesli::ApplicationLesliMailer
 
+        default from: -> { configured_sender }
+
         # Sends an email with instructions to allow the user reset the password
         def reset_password_instructions(user, token, opts = {})
 
             # defaults for new accounts/users
             email_template = "devise/reset_password_instructions"
-            email_subject = I18n.t("core.users/confirmations.mailer_email_verification")
+            email_subject = I18n.t(
+                "lesli_shield.devise/passwords.mailer_subject"
+            )
 
             # email parameters
             params = {
-                url: build_url("/password/edit", { reset_password_token: token}),
+                url: password_reset_url(token),
                 full_name: user.full_name
             }
 
             # send email
-            email(
-                params,
+            send_email(
+                params: params,
+                options: opts,
                 to: user.email, 
                 subject: email_subject,
                 template_name: email_template
             )
-        end 
+        end
 
         # Sends an email to allow the user confirm the email address
         def confirmation_instructions(user, token, opts = {})
 
             # defaults for new accounts/users
             email_template = "devise/confirmation_instructions"
-            email_subject = I18n.t("core.users/confirmations.mailer_email_verification")
+            email_subject = I18n.t(
+                "lesli_shield.devise/confirmations.mailer_confirmation_subject"
+            )
 
             # # custom email and subject if user is changin his email address
             # if !record.unconfirmed_email.blank?
@@ -69,30 +76,79 @@ module LesliShield
 
             # Depending on wheter there is a new user or they are changing their email, 
             # one or another field will be used
-            email_recipient = user.unconfirmed_email || user.email
+            email_recipient = user.unconfirmed_email.presence || user.email
 
             # email parameters
             params = {
-                url: build_url("/confirmation", { confirmation_token: token})
+                url: account_confirmation_url(token)
             }
 
             # send email
-            email(
-                params,
+            send_email(
+                params: params,
+                options: opts,
                 to: email_recipient, 
                 subject: email_subject,
                 template_name: email_template
             )
         end
 
-        def welcome(user)
-            email_recipient = user.unconfirmed_email || user.email
-            email(
-                { :user => user },
-                to: email_recipient, 
-                subject: "test",
-                template_name: "devise/welcome"
+        def welcome(user, opts = {})
+            email_recipient = user.unconfirmed_email.presence || user.email
+            send_email(
+                params: { user: user },
+                options: opts,
+                to: email_recipient,
+                subject: I18n.t(
+                    "lesli_shield.devise/confirmations.mailer_welcome_subject"
+                ),
+                template_name: "lesli/welcome"
+            )
+        end
+
+        private
+
+        def send_email(params:, options:, to:, subject:, template_name:)
+            headers = { to: to, subject: subject }.merge(options)
+            headers.delete(:template_name)
+
+            @params = @params.merge(params)
+            build_app_from_params(params)
+
+            mail(
+                **headers,
+                template_name: template_name
             )
         end
+
+        def configured_sender
+            sender = Devise.mailer_sender
+            sender = sender.call(:user) if sender.respond_to?(:call)
+
+            sender.presence ||
+                Rails.application.config.action_mailer.default_options&.dig(:from).presence ||
+                "no-reply@lesli.dev"
+        end
+
+        # Use the host application's named route so password recovery continues
+        # to work when authentication is mounted under a custom path.
+        def password_reset_url(token)
+            Rails.application.routes.url_helpers.edit_user_password_url(
+                **action_mailer_url_options,
+                reset_password_token: token
+            )
+        end
+
+        def account_confirmation_url(token)
+            Rails.application.routes.url_helpers.user_confirmation_url(
+                **action_mailer_url_options,
+                confirmation_token: token
+            )
+        end
+
+        def action_mailer_url_options
+            options = Rails.application.config.action_mailer.default_url_options
+            (options || {}).to_h.symbolize_keys
+        end
     end
 end

data/app/models/concerns/lesli_shield/user_authentication.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+module LesliShield
+    # Installs Shield's Devise-based authentication implementation on the core
+    # user model. Lesli itself only consumes current_user and remains free of a
+    # direct dependency on this engine or on Devise.
+    module UserAuthentication
+        extend ActiveSupport::Concern
+
+        # This module is prepended after Devise installs its model modules so
+        # LesliShield can extend, rather than replace, Devise's eligibility
+        # checks. Calling super preserves confirmable, lockable, and any other
+        # authentication provider rules.
+        module LoginEligibility
+            def active_for_authentication?
+                super && lesli_shield_login_validation.valid?
+            end
+
+            def inactive_message
+                return super if lesli_shield_login_validation.valid?
+
+                :invalid
+            end
+
+            private
+
+            def lesli_shield_login_validation
+                return @lesli_shield_login_validation if defined?(
+                    @lesli_shield_login_validation
+                )
+
+                @lesli_shield_login_validation = LesliShield::UserValidatorService
+                    .new(self)
+                    .validate
+            end
+        end
+
+        DEVISE_MODULES = %i[
+            database_authenticatable
+            registerable
+            rememberable
+            recoverable
+            validatable
+            confirmable
+            trackable
+            lockable
+        ].freeze
+
+        included do
+            devise(*LesliShield::UserAuthentication::DEVISE_MODULES)
+            prepend LesliShield::UserAuthentication::LoginEligibility
+        end
+    end
+end