lesli_shield 1.1.6 → 1.1.7

data/app/models/lesli_shield/account.rb

@@ -32,7 +32,10 @@ Building a better future, one line of code at a time.
 
 module LesliShield
     class Account < ApplicationRecord
-        belongs_to :account, class_name: "Lesli::Account"
+        belongs_to :account,
+            class_name: "Lesli::Account",
+            inverse_of: :shield
+        validates :account_id, uniqueness: true
         has_many :dashboards
         has_many :invites
 

data/app/models/lesli_shield/invite.rb

@@ -1,6 +1,6 @@
 module LesliShield
     class Invite < ApplicationRecord
-        belongs_to :account
+        belongs_to :account, class_name: "LesliShield::Account"
         belongs_to :user, class_name: "Lesli::User"
 
         validates :email, presence: true, on: :create

data/app/models/lesli_shield/user/role.rb

@@ -1,7 +1,7 @@
 module LesliShield
     class User::Role < ApplicationRecord
         self.table_name = 'lesli_shield_user_roles'
-        belongs_to :user
+        belongs_to :user, class_name: "Lesli::User"
         belongs_to :role, class_name: "Lesli::Role"
         has_many :roles
     end

data/app/models/lesli_shield/user.rb

@@ -1,5 +1,8 @@
 module LesliShield
-    class User < ::Lesli::User
-        #has_many :activities, class_name: "Lesli::Item::Activity"
+    # Namespace for Shield-owned records associated with Lesli::User, such as
+    # User::Role and User::Session. The authenticatable model remains
+    # Lesli::User; defining a second ActiveRecord subclass for the same table
+    # causes association type mismatches and can confuse Devise mappings.
+    module User
     end
 end

data/app/services/lesli_shield/profile/password_service.rb

@@ -0,0 +1,47 @@
+module LesliShield
+    module Profile
+        class PasswordService < Lesli::ApplicationLesliService
+            def initialize(user)
+                super(user)
+                self.resource = user
+            end
+
+            def update(params, current_session_id: nil)
+                password_updated = false
+
+                resource.transaction do
+                    password_updated = resource.update_with_password(params)
+
+                    if password_updated
+                        clear_password_expiration
+                        revoke_other_sessions(current_session_id)
+                    end
+                end
+
+                unless password_updated
+                    resource.errors.full_messages.each { |message| error(message) }
+                end
+
+                self
+            end
+
+            private
+
+            def clear_password_expiration
+                return unless resource.has_attribute?(:password_expiration_at)
+                return if resource.password_expiration_at.nil?
+
+                resource.update_column(:password_expiration_at, nil)
+            end
+
+            def revoke_other_sessions(current_session_id)
+                return if current_session_id.blank?
+
+                current_session = resource.sessions.find_by(id: current_session_id)
+                return unless current_session
+
+                resource.sessions.where.not(id: current_session.id).destroy_all
+            end
+        end
+    end
+end

data/app/services/lesli_shield/profile_service.rb

@@ -0,0 +1,24 @@
+module LesliShield
+    class ProfileService < Lesli::ApplicationLesliService
+        def initialize(user)
+            super(user)
+            self.resource = user
+        end
+
+        def show
+            resource
+        end
+
+        def update(params)
+            resource.assign_attributes(params)
+            resource.alias = resource.full_name_initials if resource.alias.blank?
+
+            unless resource.save
+                error(resource.errors.full_messages.to_sentence)
+                return self
+            end
+
+            self
+        end
+    end
+end

data/app/services/lesli_shield/user_registration_service.rb

@@ -33,96 +33,63 @@ Building a better future, one line of code at a time.
 module LesliShield
     class UserRegistrationService < Lesli::ApplicationLesliService
 
-        def initialize(current_user)
-            @resource = current_user
-            @current_user = current_user
+        def initialize(user)
+            super(user)
+            self.resource = user
         end
 
-        def confirm
-
-            # confirm the user
-            current_user.confirm
-
-
-            # force token deletion so we are sure nobody 
-            # will be able to use the token again
-            current_user.update(confirmation_token: nil)
-
-            # Minimum security settings required
-            #self.settings.create_with(:value => false).find_or_create_by(:name => "mfa_enabled")
-            #self.settings.create_with(:value => :email).find_or_create_by(:name => "mfa_method")
+        # Devise owns confirmation. This service performs only the Lesli account
+        # provisioning that must happen after Devise accepts the token.
+        def provision_account!
+            assign_account! if resource.account.blank?
+            assign_initial_role! unless resource.user_roles.exists?
+            synchronize_role_privileges!
 
+            resource
         end
 
-        def create_account
-
-            add_account() if resource.account.blank?
-            add_role() if resource.user_roles.empty?
+        private
 
-            # Synchronize roles for the very first time
-            resource.roles.each do |role|
-                LesliShield::RolePrivilegeService.new(nil).synchronize(role)
+        def assign_account!
+            account = if multiaccount?
+                create_owned_account!
+            else
+                Lesli::Account.first!
             end
 
-            # update user :)
-            resource.save
-
-            # # initialize user dependencies
-            # def after_account_assignation
-            # return unless self.account
-
-            # #Courier::One::Firebase::User.sync_user(self)
-            # # Lesli::Courier.new(:lesli_calendar).from(:calendar_service, self).create({
-            # #     name: "Personal Calendar", 
-            # #     default: true
-            # # })
-            # end
-
+            resource.update!(account: account)
         end
 
-        private 
-
-        # check if instance is for multi-account
-        ALLOW_MULTI_ACCOUNT = Lesli.config.security.dig(:allow_multiaccount)
-
-        # This is necessary when user is creating a brand new account
-        # and the platform is configured to create new Lesli accounts for every user
-        # The platform use the same account when the platform is not saas but
-        # proprietary instance (only one company is using the platform)
-        # Another scenario where it is not needed to create a new account for the 
-        # user is when the user is confirming the account through an invitation
-        def add_account
-
-            if ALLOW_MULTI_ACCOUNT === true
-                # create new account for the new user only if multi-account is allowed
-                account = Lesli::Account.create!({
-                    user: resource,     # set user as owner of his just created account
-                    name: "Lesli",      # temporary company name
-                    email: resource.email,
-                    status: :active     # account is active due user already confirmed his email
-                })
-            else
-                # if multi-account is not allowed user belongs to the first account in instance
-                account = Lesli::Account.first
-            end
+        def create_owned_account!
+            Lesli::Account.create!(
+                user: resource,
+                name: "Lesli",
+                email: resource.email,
+                status: :active
+            )
+        end
 
-            # add user to his own account
-            resource.account = account
+        def assign_initial_role!
+            role = resource.account.roles.find_by!(name: initial_role_name)
+            resource.user_roles.create!(role: role)
         end
 
-        def add_role
-            if ALLOW_MULTI_ACCOUNT == true
-                # add owner role to user only if multi-account is allowed
-                resource.user_roles.create({ role: account.roles.find_by(name: "owner") })
-            else
-                # Assigning default role if defined in account settings
-                # Otherwise, the default role is "limited"
-                default_role_name = Lesli.config.shield.dig(:default_role) || "guest"
+        def initial_role_name
+            return "owner" if multiaccount?
 
-                default_role = resource.account.roles.find_by(name: default_role_name)
+            Lesli.config.shield.dig(:default_role).presence || "guest"
+        end
 
-                resource.user_roles.create({ role: default_role })
+        def synchronize_role_privileges!
+            resource.roles.find_each do |role|
+                LesliShield::RolePrivilegeService.new(nil).synchronize(role)
             end
         end
+
+        # Read the setting at execution time. Applications and tests can change
+        # Lesli configuration after this service class has been loaded.
+        def multiaccount?
+            Lesli.config.security.dig(:allow_multiaccount) == true
+        end
     end
 end

data/app/services/lesli_shield/user_session_service.rb

@@ -55,7 +55,7 @@ module LesliShield
         def create(remote_ip, user_agent=nil, session_source="devise_standard_session")
 
             # register a new unique session
-            current_session = current_user.sessions.create({
+            current_session = current_user.sessions.create!({
                 :remote => remote_ip,
 
                 :agent_os => user_agent&.dig(:os) || "unknown",

data/app/services/lesli_shield/user_validator_service.rb

@@ -33,11 +33,17 @@ Building a better future, one line of code at a time.
 module LesliShield
     class UserValidatorService < Lesli::ApplicationLesliService
 
-        def validate 
+        def initialize(user)
+            raise ArgumentError, "user is required" unless user
+
+            super(user)
+        end
+
+        def validate
+            account_present?()
             active?()
-            confirmed?()
-            roles_empty?()
-            active_roles?()
+            active_roles?() unless roles_empty?()
+            self
         end
 
 
@@ -69,10 +75,10 @@ module LesliShield
             password_settings = []
 
             # get password settings from the database
-            if @resource.account
+            if current_user.account
 
                 # if user is already registered
-                password_settings = @resource.account.settings.where(password_values.join(" or "))
+                password_settings = current_user.account.settings.where(password_values.join(" or "))
 
             elseif Account.first
 
@@ -85,7 +91,7 @@ module LesliShield
 
                 # exit validations if password complexity is not enabled
                 if settings[:name] == 'password_enforce_complexity' && settings[:value] != "1"
-                    failures = []
+                    failures.clear
                     break
                 end
 
@@ -147,42 +153,40 @@ module LesliShield
 
         private
 
-
-        # check if user is able to create a new session
-        def active?
-
-            unless @resource.active? && @resource.locked_until != nil
-
-                # save a locked log for the requested user
-                log_failure("user_locked")
+        # Devise owns password, confirmation, and failed-attempt locking. This
+        # service contains only the additional access rules defined by Shield.
+        def account_present?
+            unless current_user.account.present?
+                log_failure("user_has_no_account")
 
                 return false
-
             end
 
-            return true
+            true
         end
 
-        def confirmed?
 
-            # check if user is already confirmed
-            unless @resource.confirmed?
+        # check if user is able to create a new session
+        def active?
+            temporarily_locked = current_user.locked_until.present? &&
+                current_user.locked_until > Time.current
 
-                # save a invalid credentials log for the requested user
-                log_failure("email_not_confirmed")
+            unless current_user.active? && !temporarily_locked
+
+                # save a locked log for the requested user
+                log_failure("user_locked")
 
                 return false
 
             end
 
             return true
-
         end
 
         def roles_empty?
 
             # check if user has roles assigned
-            if @resource.roles.empty?
+            unless current_user.roles.exists?
 
                 log_failure("user_has_no_assigned_role")
 
@@ -197,7 +201,7 @@ module LesliShield
         def active_roles?
 
             # check user has at least one active role before authorize the sign-in request
-            unless (@resource.roles.map {|role| role.active}.include? true)
+            unless current_user.roles.exists?(active: true)
                 log_failure("user_has_no_active_role")
 
                 return false
@@ -207,13 +211,7 @@ module LesliShield
         end
 
         def log_failure(description)
-            @resource.log(
-                engine: LesliShield,
-                source: self.class.name,
-                action: "validate",
-                operation: "session_creation_failed",
-                description: description
-            )
+            failures.push(description) unless failures.include?(description)
         end
     end
 end

data/app/views/devise/confirmations/new.html.erb

@@ -1,16 +1,62 @@
-<h2>Resend confirmation instructions</h2>
+<%= render(
+    "devise/shared/application-devise-simple",
+    title: I18n.t("lesli_shield.devise/confirmations.view_title")
+) do %>
 
-<%= form_for(resource, as: resource_name, url: confirmation_path(resource_name), html: { method: :post }) do |f| %>
-  <%= render "devise/shared/error_messages", resource: resource %>
+    <%= form_for(
+        resource,
+        as: resource_name,
+        url: user_confirmation_path,
+        html: { method: :post, class: "text-left" },
+        builder: LesliView::Forms::Builder
+    ) do |form| %>
 
-  <div class="field">
-    <%= f.label :email %><br />
-    <%= f.email_field :email, autofocus: true, autocomplete: "email", value: (resource.pending_reconfirmation? ? resource.unconfirmed_email : resource.email) %>
-  </div>
+        <p class="mb-6 text-center text-sm leading-6 text-slate-600">
+            <%= I18n.t(
+                "lesli_shield.devise/confirmations.view_description"
+            ) %>
+        </p>
 
-  <div class="actions">
-    <%= f.submit "Resend confirmation instructions" %>
-  </div>
-<% end %>
+        <%= render "devise/shared/error_messages", resource: resource %>
+
+        <%= form.field_control_email(
+            :email,
+            icon: "mail",
+            label: I18n.t(
+                "lesli_shield.devise/confirmations.field_email"
+            ),
+            message: resource.errors[:email].to_sentence.presence,
+            category: resource.errors[:email].any? ? :danger : nil,
+            value: resource.pending_reconfirmation? ?
+                resource.unconfirmed_email : resource.email,
+            required: true,
+            autofocus: true,
+            autocomplete: "email",
+            autocapitalize: "none",
+            spellcheck: false
+        ) %>
 
-<%= render "devise/shared/links" %>
+        <%= form.field_control_button(
+            I18n.t(
+                "lesli_shield.devise/confirmations.button_send_instructions"
+            ),
+            {
+                class: "w-full",
+                data: {
+                    turbo_submits_with: I18n.t(
+                        "lesli_shield.devise/confirmations.button_sending"
+                    )
+                }
+            },
+            icon: "mark_email_unread"
+        ) %>
+    <% end %>
+
+    <%= render(
+        "devise/shared/links",
+        login: true,
+        password_reset: false,
+        magic_link: false,
+        otp: false
+    ) %>
+<% end %>

data/app/views/devise/confirmations/show.html.erb

@@ -1,61 +1,28 @@
-<%
-=begin
-
-Lesli
-
-Copyright (c) 2023, Lesli Technologies, S. A.
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License
-along with this program. If not, see http://www.gnu.org/licenses/.
-
-Lesli · Ruby on Rails SaaS Development Framework.
-
-Made with ♥ by https://www.lesli.tech
-Building a better future, one line of code at a time.
-
-@contact  hello@lesli.tech
-@website  https://www.lesli.tech
-@license  GPLv3 http://www.gnu.org/licenses/gpl-3.0.en.html
-
-// · ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~
-// · 
-=end
-%>
-
-<% content_for :application_custom_assets do %>
-<script>
-    //setTimeout(() => { window.location.href = "/"; }, 10000)
-</script>
-<% end %>
-
-<%= render("devise/shared/application-devise-simple", title:"Account confirmation") do %>
-
-    <% if flash[:danger] %>
-        <% flash.each do |type, msg| %>
-            <div class="notification is-<%= type %>">
-                <%= msg %>
-            </div>
-        <% end %>
-    <% end %>
-
-    <% if flash[:success] %>
-        <div class="confirmation-message">
-            <p>Your account has been successfully verified</p>
-        </div>
-    <% end %>
-
-    <%= render("devise/shared/links", login:true) %>  
-
+<%= render(
+    "devise/shared/application-devise-simple",
+    title: I18n.t("lesli_shield.devise/confirmations.view_success_title")
+) do %>
+    <section
+        class="my-8 w-full max-w-lg rounded-xl border border-emerald-200 bg-white p-8 text-center shadow-sm"
+        role="status"
+    >
+        <span
+            class="material-symbols-outlined text-5xl text-emerald-600"
+            aria-hidden="true"
+        >
+            verified
+        </span>
+
+        <p class="mt-4 text-sm leading-6 text-slate-600">
+            <%= I18n.t(
+                "lesli_shield.devise/confirmations.view_success_description"
+            ) %>
+        </p>
+
+        <%= link_to(
+            I18n.t("lesli_shield.devise/shared.button_login"),
+            new_user_session_path,
+            class: "mt-6 inline-flex min-h-11 items-center justify-center rounded-lg bg-[var(--lesli-color-primary)] px-5 py-2.5 text-sm font-semibold text-white transition-opacity hover:opacity-90 focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[var(--lesli-color-primary)]"
+        ) %>
+    </section>
 <% end %>
-
-                

data/app/views/devise/passwords/edit.html.erb

@@ -1,36 +1,70 @@
-<%= render("devise/shared/application-devise-simple", title:"Password update") do %>
+<%= render(
+    "devise/shared/application-devise-simple",
+    title: I18n.t("lesli_shield.devise/passwords.view_update_title")
+) do %>
 
     <%= form_for(
-        resource, 
-        as: resource_name, 
-        url: user_password_path(reset_password_token: params[:reset_password_token]),
-        html: { class: "has-text-centered", method: :put },
+        resource,
+        as: resource_name,
+        url: user_password_path,
+        html: { class: "text-left", method: :put },
         builder: LesliView::Forms::Builder
-        ) do |form| %>
+    ) do |form| %>
 
-            <%= render "devise/shared/error_messages", resource: resource %>
+        <p class="mb-6 text-center text-sm leading-6 text-slate-600">
+            <%= I18n.t("lesli_shield.devise/passwords.view_update_description") %>
+        </p>
 
-            <%= form.field_control_builder(
-                label_html:form.label(:password), 
-                control_html:form.password_field(:password, autocomplete: "current-password", placeholder: "* * * * * *"),
-                message_text: flash.first&.second,
-                category: flash.first&.first,
-                icon: "key"
-            ) %>
+        <%= render "devise/shared/error_messages", resource: resource %>
 
-            <%= form.field_control_builder(
-                label_html:form.label(:password_confirmation), 
-                control_html:form.password_field(:password_confirmation, autocomplete: "current-password", placeholder: "* * * * * *"),
-                message_text: flash.first&.second,
-                category: flash.first&.first,
-                icon: "key"
-            ) %>
+        <%= form.hidden_field :reset_password_token %>
 
-            <input type="hidden" name="user[reset_password_token]" value="<%= params[:reset_password_token] %>">
+        <%= form.field_control_password(
+            :password,
+            icon: "key",
+            label: I18n.t("lesli_shield.devise/passwords.field_password"),
+            message: I18n.t(
+                "lesli_shield.devise/passwords.field_password_hint",
+                count: @minimum_password_length
+            ),
+            required: true,
+            autofocus: true,
+            autocomplete: "new-password",
+            minlength: @minimum_password_length,
+            value: ""
+        ) %>
 
-            <%= form.field_control_button("Cambiar contraseña", icon:"key") %>
+        <%= form.field_control_password(
+            :password_confirmation,
+            icon: "key",
+            label: I18n.t(
+                "lesli_shield.devise/passwords.field_password_confirmation"
+            ),
+            required: true,
+            autocomplete: "new-password",
+            minlength: @minimum_password_length,
+            value: ""
+        ) %>
 
-        <% end %>
+        <%= form.field_control_button(
+            I18n.t("lesli_shield.devise/passwords.button_update_password"),
+            {
+                class: "is-fullwidth",
+                data: {
+                    turbo_submits_with: I18n.t(
+                        "lesli_shield.devise/passwords.button_updating"
+                    )
+                }
+            },
+            icon: "key"
+        ) %>
+    <% end %>
 
-    <%= render("devise/shared/links", login:true, password_reset:false, magic_link:false, otp:false) %>  
+    <%= render(
+        "devise/shared/links",
+        login: true,
+        password_reset: false,
+        magic_link: false,
+        otp: false
+    ) %>
 <% end %>