pages_core 3.12.7 → 3.14.0

data/app/assets/builds/pages_core/admin.css

@@ -8370,10 +8370,6 @@ main .login-form ul li {
       font-size: 1.2em;
     }
 
-.login-tab.hidden {
-    display: none;
-  }
-
 body.modal > .wrapper {
     transition: filter 1000ms linear;
     filter: blur(10px);
@@ -9081,6 +9077,33 @@ textarea.rich {
     box-shadow: 0px 1px 1px #fff;
   }
 
+.totp-enrollment .qr-code {
+    width: 20rem;
+    height: 20rem;
+    border: 1px solid #ddd;
+    border: 1px solid var(--border-color);
+    padding: 1rem;
+    border-radius: 5px;
+  }
+
+.totp-enrollment .qr-code svg {
+      width: 100%;
+      height: 100%;
+    }
+
+ul.recovery-codes {
+  list-style-type: none;
+  padding: 0rem;
+  margin: 2rem 0rem;
+  font-family: monospace;
+  display: flex;
+  flex-direction: column;
+  align-items: flex-start;
+  gap: 1rem;
+  font-size: 1.2em;
+  font-weight: bold;
+}
+
 .drag-handle {
   cursor: pointer;
   float: left;

data/app/assets/stylesheets/pages_core/admin/components/login.css

@@ -25,9 +25,3 @@ main .login-form {
     }
   }
 }
-
-.login-tab {
-  &.hidden {
-    display: none;
-  }
-}

data/app/assets/stylesheets/pages_core/admin/components/totp.css

@@ -0,0 +1,26 @@
+.totp-enrollment {
+  .qr-code {
+    width: 20rem;
+    height: 20rem;
+    border: 1px solid var(--border-color);
+    padding: 1rem;
+    border-radius: 5px;
+    svg {
+      width: 100%;
+      height: 100%;
+    }
+  }
+}
+
+ul.recovery-codes {
+  list-style-type: none;
+  padding: 0rem;
+  margin: 2rem 0rem;
+  font-family: monospace;
+  display: flex;
+  flex-direction: column;
+  align-items: flex-start;
+  gap: 1rem;
+  font-size: 1.2em;
+  font-weight: bold;
+}

data/app/controllers/admin/account_recoveries_controller.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+module Admin
+  class AccountRecoveriesController < Admin::AdminController
+    before_action :require_authentication, except: %i[new create show update]
+    before_action :find_by_token, only: %i[show update]
+    around_action :validate_otp, only: %i[update]
+
+    def show; end
+
+    def new; end
+
+    def create
+      @user = User.find_by_email(params[:email])
+      if @user
+        deliver_account_recovery(@user)
+        flash[:notice] = t("pages_core.account_recovery.sent")
+      else
+        flash[:notice] = t("pages_core.account_recovery.not_found")
+      end
+      redirect_to admin_login_url
+    end
+
+    def update
+      if user_params[:password].present? && @user.update(user_params)
+        authenticate!(@user)
+        flash[:notice] = t("pages_core.account_recovery.changed")
+        redirect_to admin_login_url
+      else
+        render action: :show
+      end
+    end
+
+    private
+
+    def deliver_account_recovery(user)
+      AdminMailer.account_recovery(
+        user,
+        admin_account_recovery_with_token_url(recovery_token(user))
+      ).deliver_later
+    end
+
+    def fail_recovery(message)
+      flash[:notice] = message
+      redirect_to new_admin_account_recovery_url
+    end
+
+    def find_by_token
+      @token = params[:token]
+      @user = User.find(message_verifier.verify(@token)[:id])
+      return if @user
+
+      fail_recovery(t("pages_core.account_recovery.invalid_request"))
+    rescue ActiveSupport::MessageVerifier::InvalidSignature
+      fail_recovery(t("pages_core.account_recovery.invalid_request"))
+    end
+
+    def message_verifier
+      Rails.application.message_verifier(:account_recovery)
+    end
+
+    def recovery_token(user)
+      message_verifier.generate({ id: user.id }, expires_in: 24.hours)
+    end
+
+    def user_params
+      params.require(:user).permit(:password, :password_confirmation)
+    end
+
+    def validate_otp
+      User.transaction do
+        if valid_otp(@user, params[:otp])
+          yield
+        else
+          flash.now[:notice] = t("pages_core.otp.invalid_code")
+          render action: :show
+        end
+      end
+    end
+
+    def valid_otp(user, otp)
+      return true unless user.otp_enabled?
+
+      OtpSecret.new(user).validate_otp_or_recovery_code!(otp)
+    end
+  end
+end

data/app/controllers/admin/invites_controller.rb

@@ -62,11 +62,12 @@ module Admin
       return if @invite && secure_compare(@invite.token, params[:token])
 
       flash[:notice] = t("pages_core.invite_expired")
-      redirect_to(login_admin_users_url) && return
+      redirect_to(admin_login_url)
     end
 
     def user_params
-      params.require(:user).permit(:name, :email, :password, :confirm_password)
+      params.require(:user)
+            .permit(:name, :email, :password, :password_confirmation)
     end
 
     def invite_params

data/app/controllers/admin/otp_secrets_controller.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Admin
+  class OtpSecretsController < Admin::AdminController
+    before_action :require_otp_disabled, only: %i[new create]
+    before_action :find_otp_secret
+
+    def new
+      @otp_secret.generate
+    end
+
+    def create
+      if @otp_secret.verify(otp_secret_params)
+        @recovery_codes = @otp_secret.generate_recovery_codes
+        @otp_secret.enable!(@recovery_codes)
+      else
+        flash[:error] = t("pages_core.otp.invalid_code")
+        redirect_to new_admin_otp_secret_path
+      end
+    end
+
+    def destroy
+      @otp_secret.disable!
+      flash[:notice] = t("pages_core.otp.disabled")
+      redirect_to edit_admin_user_path(current_user)
+    end
+
+    private
+
+    def find_otp_secret
+      @otp_secret = OtpSecret.new(current_user)
+    end
+
+    def otp_secret_params
+      params.permit(:signed_message, :otp)
+    end
+
+    def require_otp_disabled
+      return unless current_user.otp_enabled?
+
+      flash[:notice] = t("pages_core.otp.already_enabled")
+      redirect_to edit_admin_user_path(current_user)
+    end
+  end
+end

data/app/controllers/admin/pages_controller.rb

@@ -64,7 +64,7 @@ module Admin
 
     def move
       parent = params[:parent_id] ? Page.find(params[:parent_id]) : nil
-      @page.update(parent: parent, position: params[:position])
+      @page.update(parent:, position: params[:position])
       respond_with_page(@page) { redirect_to admin_pages_url(content_locale) }
     end
 

data/app/controllers/admin/recovery_codes_controller.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module Admin
+  class RecoveryCodesController < Admin::AdminController
+    before_action :require_otp_enabled
+    before_action :find_otp_secret
+
+    def new; end
+
+    def create
+      if @otp_secret.validate_otp!(params[:otp])
+        @recovery_codes = @otp_secret.regenerate_recovery_codes!
+      else
+        flash[:error] = t("pages_core.otp.invalid_code")
+        redirect_to new_admin_recovery_codes_path
+      end
+    end
+
+    private
+
+    def find_otp_secret
+      @otp_secret = OtpSecret.new(current_user)
+    end
+
+    def require_otp_enabled
+      return if current_user.otp_enabled?
+
+      flash[:notice] = t("pages_core.otp.required")
+      redirect_to edit_admin_user_path(current_user)
+    end
+  end
+end

data/app/controllers/admin/sessions_controller.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module Admin
+  class SessionsController < Admin::AdminController
+    before_action :require_authentication, only: %i[destroy]
+    before_action :find_user, only: %i[create]
+    before_action :find_signed_user, only: %i[verify_otp]
+    before_action :require_user, only: %i[create verify_otp]
+
+    def new
+      redirect_to admin_default_url if logged_in?
+    end
+
+    def create
+      if @user.otp_enabled?
+        @signed_user_id = message_verifier.generate(
+          @user.id, expires_in: 1.hour
+        )
+        render template: "admin/sessions/verify_otp"
+      else
+        authenticate!(@user)
+        redirect_to admin_default_url
+      end
+    end
+
+    def destroy
+      flash[:notice] = t("pages_core.logged_out")
+      deauthenticate!
+      redirect_to admin_login_url
+    end
+
+    def verify_otp
+      @otp_secret = OtpSecret.new(@user)
+      if @otp_secret.validate_otp!(params[:otp])
+        authenticate!(@user)
+        redirect_to admin_default_url
+      else
+        flash[:notice] = t("pages_core.otp.invalid_code")
+        render template: "admin/sessions/verify_otp"
+      end
+    end
+
+    private
+
+    def find_signed_user
+      @signed_user_id = params[:signed_user_id]
+      @user = User.find(message_verifier.verify(@signed_user_id))
+    end
+
+    def find_user
+      @user = User.authenticate(params[:email], password: params[:password])
+    end
+
+    def message_verifier
+      Rails.application.message_verifier(:session)
+    end
+
+    def require_user
+      return if @user
+
+      flash[:notice] = t("pages_core.invalid_login")
+      redirect_to admin_login_url
+    end
+  end
+end

data/app/controllers/admin/users_controller.rb

@@ -2,7 +2,7 @@
 
 module Admin
   class UsersController < Admin::AdminController
-    before_action :require_authentication, except: %i[new create login]
+    before_action :require_authentication, except: %i[new create]
     before_action :require_no_users, only: %i[new create]
     before_action(
       :find_user,
@@ -11,7 +11,7 @@ module Admin
 
     def index
       @users = User.activated
-      @invites = Invite.all.order("created_at DESC")
+      @invites = Invite.order("created_at DESC")
     end
 
     def deactivated
@@ -19,12 +19,6 @@ module Admin
       @invites = []
     end
 
-    def login
-      return unless logged_in?
-
-      redirect_to admin_default_url
-    end
-
     def show; end
 
     def new
@@ -81,7 +75,7 @@ module Admin
                              { role_names: [] }]
       end
       if User.none? || (@user && policy(@user).change_password?)
-        permitted_params += %i[password confirm_password]
+        permitted_params += %i[password password_confirmation]
       end
       params.require(:user).permit(permitted_params)
     end

data/app/controllers/concerns/pages_core/authentication.rb

@@ -35,20 +35,22 @@ module PagesCore
       @current_user = user
     end
 
-    def start_authenticated_session
-      if session[:current_user_id]
-        user = User.where(id: session[:current_user_id]).first
-      end
-
-      return unless user&.can_login?
+    def finalize_authenticated_session
+      return unless logged_in?
 
-      authenticated(user)
+      session[:current_user] =
+        { id: current_user.id, token: current_user.session_token }
     end
 
-    def finalize_authenticated_session
-      return unless current_user
+    def start_authenticated_session
+      user_session = session.fetch(:current_user, nil)&.symbolize_keys
+
+      return unless user_session
 
-      session[:current_user_id] = current_user.id
+      user = User.find_by(id: user_session[:id])
+      return unless user && user.session_token == user_session[:token]
+
+      authenticated(user)
     end
   end
 end

data/app/controllers/concerns/pages_core/error_reporting.rb

@@ -5,34 +5,24 @@ module PagesCore
     extend ActiveSupport::Concern
 
     included do
-      before_action :configure_sentry_context
+      before_action :configure_sentry_scope
     end
 
     protected
 
-    def configure_sentry_context
-      return if Rails.env.test?
+    def configure_sentry_scope
+      return if Rails.env.test? || !Object.const_defined?("Sentry")
 
-      if Object.const_defined?("Sentry")
-        Sentry.set_user(current_user_context)
-        Sentry.set_tags(locale: params[:locale] || I18n.default_locale.to_s)
-        Sentry.set_extras(params: params.to_unsafe_h)
-      elsif Object.const_defined?("Raven")
-        configure_legacy_sentry_context
-      end
-    end
-
-    def configure_legacy_sentry_context
-      Raven.user_context(current_user_context)
-      Raven.tags_context(locale: params[:locale] || I18n.default_locale.to_s)
-      Raven.extra_context(params: params.to_unsafe_h)
+      Sentry.set_context("params", params.to_unsafe_h)
+      Sentry.set_tags(locale: params[:locale] || I18n.default_locale.to_s)
+      Sentry.set_user(current_user_context)
     end
 
     def current_user_context
-      return { user_id: :guest } unless logged_in?
+      return {} unless logged_in?
 
-      { user_id: current_user.id,
-        user_email: current_user.email }
+      { id: current_user.id,
+        email: current_user.email }
     end
   end
 end

data/app/controllers/concerns/pages_core/static_cache_controller.rb

@@ -4,10 +4,13 @@ module PagesCore
   module StaticCacheController
     extend ActiveSupport::Concern
 
+    included do
+      helper_method :static_cached?
+    end
+
     module ClassMethods
       def static_cache(*actions, permanent: false)
-        return unless perform_caching
-
+        before_action :prepare_static_cache
         if permanent
           after_action :cache_static_page_permanently, only: actions
         else
@@ -22,6 +25,10 @@ module PagesCore
       @static_cache_disabled = true
     end
 
+    def static_cached?
+      !@static_cache_disabled && @static_cached ? true : false
+    end
+
     private
 
     def cache_static_page
@@ -40,6 +47,10 @@ module PagesCore
       )
     end
 
+    def prepare_static_cache
+      @static_cached = true
+    end
+
     def static_cache_allowed?
       (request.get? || request.head?) && response.status == 200 &&
         perform_caching && !@static_cache_disabled

data/app/controllers/pages_core/admin_controller.rb

@@ -48,7 +48,7 @@ module PagesCore
       if User.count < 1
         redirect_to(new_admin_user_url)
       else
-        redirect_to(login_admin_users_url)
+        redirect_to(admin_login_url)
       end
     end
 

data/app/controllers/pages_core/attachments_controller.rb

@@ -31,7 +31,7 @@ module PagesCore
       send_ranged_data(@attachment.data,
                        filename: @attachment.filename,
                        type: @attachment.content_type,
-                       disposition: disposition)
+                       disposition:)
     end
 
     def verify_signed_params

data/app/controllers/pages_core/frontend/pages_controller.rb

@@ -121,7 +121,7 @@ module PagesCore
       def redirect_page(page)
         return false unless page.redirects?
 
-        redirect_to(page.redirect_path(locale: locale), allow_other_host: true)
+        redirect_to(page.redirect_path(locale:), allow_other_host: true)
       end
 
       def require_page

data/app/controllers/pages_core/frontend_controller.rb

@@ -22,21 +22,12 @@ module PagesCore
 
     private
 
-    def legacy_locales
-      { "nor" => "nb",
-        "eng" => "en" }
-    end
-
     def page_param
       params[:page].is_a?(String) ? params[:page] : 1
     end
 
     def set_i18n_locale
-      locale_param = content_locale
-      if legacy_locales[locale_param]
-        locale_param = legacy_locales[locale_param]
-      end
-      I18n.locale = locale_param
+      I18n.locale = content_locale
     rescue I18n::InvalidLocale
       raise if Rails.application.config.consider_all_requests_local
 

data/app/formatters/pages_core/image_embedder.rb

@@ -23,7 +23,7 @@ module PagesCore
     def embed_image(id, size:, class_name:, link:)
       image_figure(
         Image.find(id).localize(I18n.locale),
-        size: size, class_name: class_name, link: link
+        size:, class_name:, link:
       )
     rescue ActiveRecord::RecordNotFound
       nil
@@ -44,8 +44,8 @@ module PagesCore
       link = (Regexp.last_match(1) if options =~ /link="([^"]+)"/)
       embed_image(id,
                   size: embed_image_size(options),
-                  class_name: class_name,
-                  link: link)
+                  class_name:,
+                  link:)
     end
 
     def parse_images(string)

data/app/helpers/admin/pages_helper.rb

@@ -39,12 +39,12 @@ module Admin
       ([page.author] + User.activated).uniq
     end
 
-    def page_list_row(page, &block)
+    def page_list_row(page, &)
       classes = [page.status_label.downcase]
       classes << "autopublish" if page.autopublish?
       classes << "pinned" if page.pinned?
 
-      tag.tr(capture(&block), class: classes.join(" "))
+      tag.tr(capture(&), class: classes.join(" "))
     end
 
     def page_name(page, options = {})

data/app/helpers/pages_core/admin/admin_helper.rb

@@ -14,7 +14,7 @@ module PagesCore
       def rich_text_area_tag(name, content = nil, options = {})
         react_component("RichTextArea",
                         options.merge(id: sanitize_to_id(name),
-                                      name: name,
+                                      name:,
                                       value: content))
       end
 
@@ -33,6 +33,17 @@ module PagesCore
         %w[January February March April May June July August September October
            November December][month - 1]
       end
+
+      def qr_code(url)
+        ActiveSupport::SafeBuffer.new(
+          RQRCode::QRCode.new(url)
+                         .as_svg({ color: "000",
+                                   shape_rendering: "crispEdges",
+                                   module_size: 10,
+                                   use_path: true,
+                                   viewbox: true })
+        )
+      end
     end
   end
 end

data/app/helpers/pages_core/admin/content_tabs_helper.rb

@@ -11,14 +11,14 @@ module PagesCore
         content_tabs.any?
       end
 
-      def content_tab(name, options = {}, &block)
+      def content_tab(name, options = {}, &)
         return unless block_given?
 
         tab = {
           name: name.to_s.humanize,
           key: options[:key] || name.to_s.underscore.gsub(/\s+/, "_"),
-          options: options,
-          content: capture(&block)
+          options:,
+          content: capture(&)
         }
         content_tabs.push(tab)
         content_tab_tag(tab[:key], tab[:content])

data/app/helpers/pages_core/admin/form_builder.rb

@@ -38,7 +38,7 @@ module PagesCore
 
       def foreign_key(attr)
         object.class.reflections[attr.to_s].options[:foreign_key] ||
-          "#{attr}_id".to_sym
+          :"#{attr}_id"
       end
     end
   end

data/app/helpers/pages_core/admin/image_uploads_helper.rb

@@ -9,10 +9,10 @@ module PagesCore
         react_component("EditableImage",
                         editable_image_options(
                           image,
-                          width: width,
-                          caption: caption,
-                          locale: locale
-                        ).merge(width: width))
+                          width:,
+                          caption:,
+                          locale:
+                        ).merge(width:))
       end
 
       def image_uploader_tag(name, image, options = {})
@@ -36,8 +36,8 @@ module PagesCore
 
       def editable_image_options(image, width: 250, caption: false, locale: nil)
         editable_image_src_options(image, width).merge(
-          width: width,
-          caption: caption,
+          width:,
+          caption:,
           locale: locale || I18n.default_locale,
           locales: locales_with_dir
         )

data/app/helpers/pages_core/admin/labelled_field_helper.rb

@@ -24,7 +24,7 @@ module PagesCore
             [labelled_field_label(label, options),
              labelled_field_description(options[:description]),
              field,
-             (options[:check_box_description] || "")]
+             options[:check_box_description] || ""]
           )
         end
       end