pages_core 3.12.7 → 3.14.0

data/app/services/pages_core/create_user_service.rb

@@ -11,7 +11,7 @@ module PagesCore
 
     class << self
       def call(attrs, invite: nil)
-        new(attrs, invite: invite).call
+        new(attrs, invite:).call
       end
     end
 
@@ -19,7 +19,7 @@ module PagesCore
       User.transaction do
         user = User.create(attributes.merge(invite_attributes))
         if user.valid?
-          PagesCore::PubSub.publish(:create_user, user: user, invite: invite)
+          PagesCore::PubSub.publish(:create_user, user:, invite:)
           invite&.destroy
         end
         user

data/app/services/pages_core/destroy_invite_service.rb

@@ -10,14 +10,14 @@ module PagesCore
 
     class << self
       def call(invite:)
-        new(invite: invite).call
+        new(invite:).call
       end
     end
 
     def call
       Invite.transaction do
         invite.destroy
-        PagesCore::PubSub.publish(:destroy_invite, invite: invite)
+        PagesCore::PubSub.publish(:destroy_invite, invite:)
         invite
       end
     end

data/app/services/pages_core/invite_service.rb

@@ -15,7 +15,7 @@ module PagesCore
 
     class << self
       def call(attrs, user:, host:, protocol: "http")
-        new(attrs, user: user, host: host, protocol: protocol).call
+        new(attrs, user:, host:, protocol:).call
       end
     end
 
@@ -36,7 +36,7 @@ module PagesCore
       AdminMailer.invite(
         invite,
         admin_invite_with_token_url(invite, invite.token,
-                                    host: host, protocol: protocol)
+                                    host:, protocol:)
       ).deliver_later
     end
   end

data/app/views/admin/account_recoveries/new.html.erb

@@ -0,0 +1,22 @@
+<% content_for :page_title, "Account recovery" %>
+<% content_for :page_description, "Account recovery" %>
+
+<%= form_tag admin_account_recovery_path do %>
+  <h2>
+    Forgot your password or lost your authenticator?
+  </h2>
+  <p>
+    Don't worry, it happens.
+    Enter your email address below, and we'll send you a link where you
+    can recover your account.
+  </p>
+  <div class="field">
+    <label for="email">Email address</label>
+    <%= text_field_tag(:email, "", autocomplete: "email", autofocus: true) %>
+  </div>
+  <p>
+    <button type="submit">
+      Send
+    </button>
+  </p>
+<% end %>

data/app/views/admin/account_recoveries/show.html.erb

@@ -0,0 +1,37 @@
+<% content_for :page_title, "Account recovery" %>
+<% content_for :page_description, "Please choose a new password to proceed" %>
+<% content_for :body_class, "login" %>
+
+<div class="login-form">
+  <%= form_for(@user,
+               url: admin_account_recovery_path,
+               builder: PagesCore::Admin::FormBuilder,
+               class: 'form') do |f| %>
+    <%= hidden_field_tag :token, @token %>
+    <%= f.labelled_password_field(:password,
+                                  autofocus: true,
+                                  autocomplete: "new-password") %>
+    <%= f.labelled_password_field(:password_confirmation,
+                                  autocomplete: "new-password") %>
+
+    <% if @user.otp_enabled? %>
+      <div class="field">
+        <label for="otp">6 digit code or recovery code</label>
+        <%= text_field_tag(:otp, "",
+                           autocomplete: "one-time-code",
+                           size: 6) %>
+      </div>
+      <p>
+        Lost your authenticator device? You can use one of your
+        emergency recovery codes instead.
+      </p>
+    <% end %>
+
+    <p>
+      <button type="submit">
+        Change password
+      </button>
+      or <%= link_to "Return to login screen", admin_login_path %>
+    </p>
+  <% end %>
+</div>

data/app/views/admin/invites/show.html.erb

@@ -14,7 +14,7 @@
   <%= f.labelled_text_field :email, autocomplete: "email" %>
   <%= f.labelled_password_field(:password,
                                 autocomplete: "new-password") %>
-  <%= f.labelled_password_field(:confirm_password,
+  <%= f.labelled_password_field(:password_confirmation,
                                 autocomplete: "new-password") %>
   <p>
     <button type="submit">

data/app/views/admin/otp_secrets/create.html.erb

@@ -0,0 +1,7 @@
+<% content_for :page_title, "2FA enabled" %>
+<% content_for :page_description, "Two-factor authentication enabled" %>
+
+<div class="content">
+  <%= render(partial: "admin/recovery_codes/codes",
+             locals: { recovery_codes: @recovery_codes }) %>
+</div>

data/app/views/admin/otp_secrets/new.html.erb

@@ -0,0 +1,60 @@
+<% content_for :page_title, "Enable 2FA" %>
+<% content_for :page_description, "Enable two-factor authentication" %>
+
+<%= form_tag(admin_otp_secret_path, method: :post, class: "totp-enrollment") do |f| %>
+  <h2>
+    Scan the QR-code
+  </h2>
+  <p>
+    Use an authenticator app or browser extension to scan the QR code below.<br>
+    Don't have one? Some options are
+    <%= link_to("1Password", "https://1password.com/") %>,
+    <%= link_to("LastPass Authenticator", "https://www.lastpass.com/") %>,
+    <%= link_to("Microsoft Authenticator",
+                "https://www.microsoft.com/en-us/security/mobile-authenticator-app") %>
+    or
+    <%= link_to("Google Authenticator",
+                "https://support.google.com/accounts/answer/1066447") %>.
+  </p>
+
+
+  <div class="qr-code">
+    <%= qr_code(@otp_secret.provisioning_uri) %>
+  </div>
+
+  <p>
+    If you are unable to scan the code, you can enter the following
+    info instead:
+  </p>
+
+  <p>
+    <b>Account name:</b><br>
+    <%= @otp_secret.account_name %>
+  </p>
+  <p>
+    <b>Secret:</b><br>
+    <span class="otp-secret">
+      <%= @otp_secret.secret %>
+    </span>
+  </p>
+
+  <h2>
+    Enter the code from the app
+  </h2>
+
+  <div class="field">
+    <label for="otp">6 digit code</label>
+    <%= text_field_tag(:otp, "",
+                       autofocus: true,
+                       autocomplete: "one-time-code",
+                       size: 6) %>
+  </div>
+
+  <%= hidden_field_tag :signed_message, @otp_secret.signed_message %>
+
+  <p>
+    <button type="submit">
+      Verify
+    </button>
+  </p>
+<% end %>

data/app/views/admin/pages/_edit_content.html.erb

@@ -1,4 +1,4 @@
-<% @page.template_config.enabled_blocks do |block_name, block_options| %>
+<% @page.enabled_blocks do |block_name, block_options| %>
   <%= page_block_field(f, block_name, block_options) %>
 <% end %>
 

data/app/views/admin/pages/_form.html.erb

@@ -2,6 +2,18 @@
   <%= render partial: "edit_content", locals: { f: f } %>
 <% end %>
 
+<% if @page.unconfigured_blocks.any? %>
+  <%= content_tab "Unconfigured content" do %>
+    <p>
+      This page has additional content fields not enabled by the
+      selected template.
+    </p>
+    <% @page.unconfigured_blocks do |block_name, block_options| %>
+      <%= page_block_field(f, block_name, block_options) %>
+    <% end %>
+  <% end %>
+<% end %>
+
 <% if @page.template_config.value(:images) || @page.template_config.value(:image) %>
   <%= content_tab "Images" do %>
     <%= render partial: "edit_images", locals: { f: f } %>

data/app/views/admin/recovery_codes/_codes.html.erb

@@ -0,0 +1,14 @@
+<h2>
+  Recovery codes
+</h2>
+<p>
+  Please save the recovery codes below in a safe place, ideally
+  using a secure password manager.<br>
+  Without them, you will lose access to your account if you lose your device.
+</p>
+
+<ul class="recovery-codes">
+  <% recovery_codes.each do |c| %>
+    <li><%= c %></li>
+  <% end %>
+</ul>

data/app/views/admin/recovery_codes/create.html.erb

@@ -0,0 +1,7 @@
+<% content_for :page_title, "New recovery codes" %>
+<% content_for :page_description, "Recovery codes updated" %>
+
+<div class="content">
+  <%= render(partial: "admin/recovery_codes/codes",
+             locals: { recovery_codes: @recovery_codes }) %>
+</div>

data/app/views/admin/recovery_codes/new.html.erb

@@ -0,0 +1,11 @@
+<% content_for :page_title, "New recovery codes" %>
+<% content_for :page_description, "Generate new recovery codes" %>
+
+<%= form_tag(admin_recovery_codes_path, method: :post) do |f| %>
+  <%= render(partial: "admin/sessions/otp_form") %>
+  <p>
+    <button type="submit">
+      Verify
+    </button>
+  </p>
+<% end %>

data/app/views/admin/sessions/_otp_form.html.erb

@@ -0,0 +1,13 @@
+<h2>
+  Two-factor authentication
+</h2>
+<p>
+  Enter a one-time code from your authenticator app to proceed.
+</p>
+<div class="field">
+  <label for="otp">6 digit code</label>
+  <%= text_field_tag(:otp, "",
+                     autofocus: true,
+                     autocomplete: "one-time-code",
+                     size: 6) %>
+</div>

data/app/views/admin/sessions/new.html.erb

@@ -0,0 +1,33 @@
+<% content_for :page_title, "Sign in" %>
+<% content_for(:page_description,
+               "Please enter your email address and password to sign in") %>
+<% content_for :body_class, "login" %>
+
+<% content_for :sidebar do %>
+  <h2>Please note</h2>
+  <p>
+    Please contact support if you experience problems logging in or using Pages.
+  </p>
+<% end %>
+
+<div class="login-form">
+  <%= form_tag admin_session_path do %>
+    <p>
+      <label>Email address</label>
+      <%= text_field_tag(:email, "", autocomplete: "email") %>
+    </p>
+    <p>
+      <label>Password</label>
+      <%= password_field_tag(:password, "", autocomplete: "current-password") %>
+    </p>
+    <p>
+      <button type="submit">Sign in</button>
+    </p>
+    <ul>
+      <li>
+        <%= link_to("<b>Help!</b> I forgot my password!".html_safe,
+                    new_admin_account_recovery_path) %>
+      </li>
+    </ul>
+  <% end %>
+</div>

data/app/views/admin/sessions/verify_otp.html.erb

@@ -0,0 +1,19 @@
+<% content_for :page_title, "Two-factor authentication" %>
+<% content_for :page_description, "Two-factor authentication" %>
+
+<%= form_tag(verify_otp_admin_session_path, method: :post) do |f| %>
+  <%= hidden_field_tag :signed_user_id, @signed_user_id %>
+  <%= render(partial: "admin/sessions/otp_form") %>
+
+  <p>
+    <button type="submit">
+      Verify
+    </button>
+  </p>
+
+  <p>
+    Lost your authenticator device?
+    <%= link_to("Recover your account here",
+                new_admin_account_recovery_path) %>.
+  </p>
+<% end %>

data/app/views/admin/users/edit.html.erb

@@ -31,12 +31,42 @@
   <% if policy(@user).change_password? %>
     <h2>Password</h2>
     <%= f.labelled_password_field :password, 'Change password' %>
-    <%= f.labelled_password_field :confirm_password, 'Confirm password' %>
+    <%= f.labelled_password_field :password_confirmation, 'Confirm password' %>
     <p>
       Leave the password blank if you do not wish to change the password.
     </p>
   <% end %>
 
+  <% if policy(@user).otp? %>
+    <h2>Two-factor authentication</h2>
+    <% if @user.otp_enabled? %>
+      <p>
+        Two-factor authentication has been enabled.
+        <%= link_to("Disable",
+                    admin_otp_secret_path,
+                    class: :delete,
+                    method: :delete,
+                    data: { confirm: "Are you sure you want to disable 2FA?" }) %>
+      </p>
+      <p>
+
+        You have
+        <%= t("pages_core.recovery_codes",
+              count: @user.hashed_recovery_codes.length) %>
+        remaining.
+        <%= link_to("Generate new codes", new_admin_recovery_codes_path) %>
+      </p>
+    <% else %>
+      <p>
+        Protect your account with an additional layer of security by
+        requiring an authentication app to sign in.
+      </p>
+      <p>
+        <%= link_to("Enable 2FA", new_admin_otp_secret_path) %>
+      </p>
+    <% end %>
+  <% end %>
+
   <%= render partial: "access_control", locals: { user: @user, f: f } %>
 
   <p>

data/app/views/admin/users/new.html.erb

@@ -11,7 +11,7 @@
   <%= f.labelled_text_field(:email, autocomplete: "email") %>
   <%= f.labelled_password_field(:password,
                                 autocomplete: "new-password") %>
-  <%= f.labelled_password_field(:confirm_password,
+  <%= f.labelled_password_field(:password_confirmation,
                                 autocomplete: "new-password") %>
 
   <p>

data/app/views/admin_mailer/account_recovery.text.erb

@@ -0,0 +1,10 @@
+Hi, <%= @user.name %>!
+
+We've received a request to recover your account on <%= PagesCore.config(:site_name) %>.
+
+Please click the following link to continue:
+<%= @url %>
+
+The link will expire in 24 hours.
+
+If you do not want to recover your password, please ignore this email.

data/app/views/layouts/admin/_header.html.erb

@@ -10,7 +10,7 @@
   <% if logged_in? %>
     <div class="user">
       Hello, <%= link_to(current_user.name, admin_user_url(current_user)) %>
-      <%= link_to("Log out", session_path, method: "delete") %>
+      <%= link_to("Log out", admin_session_path, method: "delete") %>
     </div>
   <% end %>
   <nav class="tabs">

data/app/views/layouts/admin/_toast.html.erb

@@ -0,0 +1,12 @@
+<%= react_component "Toast", { notice: flash[:notice], error: flash[:error] } %>
+<% if Rails.env.test? && flash.any? %>
+  <div class="flash-test-helper">
+    <% %i[notice error].each do |type| %>
+      <% if flash[type] || true %>
+        <div class="<%= type %>">
+          <%= flash[type] %>
+        </div>
+      <% end %>
+    <% end %>
+  </div>
+<% end %>

data/app/views/layouts/admin.html.erb

@@ -58,6 +58,6 @@
       <% end %>
     </div>
     <%= react_component "Modal", {} %>
-    <%= react_component "Toast", { notice: flash[:notice], error: flash[:error] } %>
+    <%= render(partial: "layouts/admin/toast") %>
   </body>
 </html>

data/config/locales/en.yml

@@ -28,13 +28,21 @@ en:
       The provided email address and password combination was not valid
     invite_expired: This invite is no longer valid.
     logged_out: You have been logged out
-    password_reset:
+    otp:
+      already_enabled: 2FA has already been enabled
+      disabled: 2FA has been disabled
+      invalid_code: Invalid 2FA code
+      required: 2FA is required for this
+    account_recovery:
       changed: Your password has been changed
-      expired: Your password reset link has expired
-      invalid_request: Invalid password reset request
+      invalid_request: This link is no longer valid
       not_found: Couldn't find a user with that email address
       sent: An email with further instructions has been sent
       problems_saving: There were problems saving your changes
+    recovery_codes:
+      zero: "no recovery codes"
+      one: "one recovery code"
+      other: "%{count} recovery codes"
   templates:
     default:
       blocks:

data/config/routes.rb

@@ -33,9 +33,6 @@ Rails.application.routes.draw do
   get "pages/:locale/*glob" => redirect("/%{locale}/pages/%{glob}"),
       locale: /\w\w\w/
 
-  # Authentication
-  resource :session, only: %i[create destroy]
-
   # Sitemap
   resource :sitemap, only: [:show]
 
@@ -51,9 +48,9 @@ Rails.application.routes.draw do
     end
 
     # Password resets
-    resources :password_resets, only: %i[create show update]
-    controller :password_resets do
-      get "/password_resets/:id/:token" => :show, as: :password_reset_with_token
+    resource :account_recovery
+    controller :account_recoveries do
+      get "/account_recovery/:token" => :show, as: :account_recovery_with_token
     end
 
     # Attachments
@@ -76,6 +73,14 @@ Rails.application.routes.draw do
     # Categories
     resources :categories
 
+    # Authentication
+    resource :session, only: %i[create destroy] do
+      member { post :verify_otp }
+    end
+    resource :otp_secret, only: %i[new create destroy]
+    resource :recovery_codes, only: %i[new create]
+    get "login" => "sessions#new", as: "login"
+
     # Pages
     scope ":locale" do
       resources :news,

data/db/migrate/20111219033112_create_pages_tables.rb

@@ -21,20 +21,6 @@ class CreatePagesTables < ActiveRecord::Migration[5.0]
       t.index :slug
     end
 
-    create_table :delayed_jobs do |t|
-      t.integer :priority, default: 0
-      t.integer :attempts, default: 0
-      t.text :handler
-      t.text :last_error
-      t.datetime :run_at
-      t.datetime :locked_at
-      t.datetime :failed_at
-      t.string :locked_by
-      t.datetime :created_at, null: false
-      t.datetime :updated_at, null: false
-      t.string :queue
-    end
-
     create_table :images do |t|
       t.string :filename, null: false
       t.string :content_type, null: false

data/db/migrate/20240126160700_add_2fa_fields.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+class Add2faFields < ActiveRecord::Migration[7.0]
+  def change
+    change_table :users do |t|
+      t.boolean :otp_enabled, null: false, default: false
+      t.string :otp_secret
+      t.datetime :last_otp_at
+      t.jsonb :hashed_recovery_codes, null: false, default: []
+      t.string :session_token
+    end
+
+    rename_column :users, :hashed_password, :password_digest
+
+    reversible do |dir|
+      dir.up do
+        User.find_each { |u| u.update(session_token: SecureRandom.hex(32)) }
+        change_column_null :users, :session_token, false
+      end
+    end
+  end
+end

data/db/migrate/20240129201300_remove_password_reset_tokens.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class RemovePasswordResetTokens < ActiveRecord::Migration[7.0]
+  def change
+    drop_table :password_reset_tokens do |t|
+      t.integer :user_id
+      t.string :token
+      t.datetime :expires_at
+      t.datetime :created_at
+      t.datetime :updated_at
+    end
+  end
+end

data/lib/pages_core/cache_sweeper.rb

@@ -5,15 +5,15 @@ module PagesCore
     class << self
       attr_accessor :enabled
 
-      def disable(&_block)
+      def disable(&)
         old_value = enabled
         self.enabled = false
         yield if block_given?
         self.enabled = old_value
       end
 
-      def once(&block)
-        disable(&block)
+      def once(&)
+        disable(&)
         PagesCore::StaticCache.handler.sweep!
       end
     end

data/lib/pages_core/extensions/string_extensions.rb

@@ -4,7 +4,7 @@ module PagesCore
   module Extensions
     module StringExtensions
       def to_html_with(append, options = {})
-        to_html(options.merge(append: append))
+        to_html(options.merge(append:))
       end
 
       def to_html(options = {})

data/lib/pages_core/templates/configuration.rb

@@ -149,7 +149,7 @@ module PagesCore
       def template_config(setting, value, options)
         value = true if value == :enabled
         value = false if value == :disabled
-        { setting => { value: value, options: options } }
+        { setting => { value:, options: } }
       end
 
       def template_path(name)

data/lib/pages_core/templates/template_configuration.rb

@@ -106,7 +106,7 @@ module PagesCore
     end
 
     class << self
-      def configure(options = {}, &_block)
+      def configure(options = {}, &)
         case options[:reset]
         when :defaults
           load_default_configuration

data/lib/pages_core.rb

@@ -21,7 +21,6 @@ require "acts_as_list"
 require "alba"
 require "bcrypt"
 require "country_select"
-require "delayed_job_active_record"
 require "dis"
 require "dynamic_image"
 require "healthcheck"
@@ -33,6 +32,8 @@ require "pg_search"
 require "progress_bar"
 require "rails_i18n"
 require "RedCloth"
+require "rotp"
+require "rqrcode"
 require "sass-rails"
 require "typhoeus"
 require "will_paginate"
@@ -71,7 +72,7 @@ module PagesCore
       Pathname.new(File.dirname(__FILE__)).join("..").expand_path
     end
 
-    def configure(_options = {}, &_block)
+    def configure(_options = {}, &)
       yield configuration if block_given?
     end
 
@@ -84,5 +85,9 @@ module PagesCore
       end
     end
     alias config configuration
+
+    def reset_configuration!
+      @configuration = PagesCore::Configuration::Pages.new
+    end
   end
 end