pages_core 3.13.0 → 3.15.0

data/app/models/concerns/pages_core/page_model/templateable.rb

@@ -29,21 +29,6 @@ module PagesCore
           template
       end
 
-      def unconfigured_blocks
-        blocks = (localizations.where(locale:).pluck(:name)
-                               .map(&:to_sym) -
-                  configured_blocks) &
-                 PagesCore::Templates::TemplateConfiguration.all_blocks
-
-        if block_given?
-          blocks.each do |block_name|
-            yield block_name, template_config.block(block_name)
-          end
-        end
-
-        blocks
-      end
-
       private
 
       def configured_blocks
@@ -69,8 +54,9 @@ module PagesCore
       end
 
       def base_template
+        reject_words = %w[index list archive liste arkiv]
         template.split("_")
-                .reject { |w| %w[index list archive liste arkiv].include?(w) }
+                .reject { |w| reject_words.include?(w) }
                 .join(" ")
       end
 

data/app/models/invite.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 class Invite < ApplicationRecord
+  include PagesCore::Emailable
   include PagesCore::HasRoles
 
   belongs_to :user
@@ -8,11 +9,6 @@ class Invite < ApplicationRecord
 
   before_validation :ensure_token
 
-  validates :email,
-            presence: true,
-            format: { with: /\A([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})\Z/i },
-            uniqueness: { case_sensitive: false }
-
   validates :token, presence: true
 
   validate :user_already_exists
@@ -24,7 +20,7 @@ class Invite < ApplicationRecord
   end
 
   def user_already_exists
-    return unless User.find_by_email(email)
+    return unless User.find_by(email:)
 
     errors.add(:email, :taken)
   end

data/app/models/otp_secret.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+class OtpSecret
+  attr_reader :user, :secret
+
+  def initialize(user)
+    @user = user
+    @secret = user.otp_secret
+  end
+
+  def account_name
+    user.email
+  end
+
+  def disable!
+    user.update(otp_enabled: false,
+                otp_secret: nil,
+                last_otp_at: nil,
+                recovery_codes: [])
+  end
+
+  def enable!(recovery_codes)
+    user.update(otp_enabled: true,
+                otp_secret: secret,
+                last_otp_at: Time.zone.now,
+                recovery_codes:)
+  end
+
+  def generate
+    @secret = ROTP::Base32.random
+  end
+
+  def generate_recovery_codes
+    Array.new(10) { SecureRandom.alphanumeric(16) }
+  end
+
+  def provisioning_uri
+    totp.provisioning_uri(account_name)
+  end
+
+  def regenerate_recovery_codes!
+    generate_recovery_codes.tap do |recovery_codes|
+      user.update(recovery_codes:)
+    end
+  end
+
+  def signed_message
+    message_verifier.generate(
+      { user_id: user.id, secret: }, expires_in: 1.hour
+    )
+  end
+
+  def validate_otp!(code)
+    return false unless valid_otp?(code)
+
+    user.update(last_otp_at: Time.zone.now)
+    true
+  end
+
+  def validate_otp_or_recovery_code!(code)
+    if /^[\d]{6}$/.match?(code)
+      validate_otp!(code)
+    else
+      validate_recovery_code!(code)
+    end
+  end
+
+  def validate_recovery_code!(code)
+    user.use_recovery_code!(code)
+  end
+
+  def verify(params)
+    @secret = verify_secret(params[:signed_message])
+    valid_otp?(params[:otp])
+  end
+
+  private
+
+  def message_verifier
+    Rails.application.message_verifier(:otp_secret)
+  end
+
+  def totp
+    ROTP::TOTP.new(secret, issuer: PagesCore.config.site_name)
+  end
+
+  def valid_otp?(otp)
+    if user.otp_enabled?
+      totp.verify(otp, after: user.last_otp_at, drift_behind: 10)
+    else
+      totp.verify(otp, drift_behind: 10)
+    end
+  end
+
+  def verify_secret(signed)
+    payload = message_verifier.verify(signed).symbolize_keys
+    raise "Wrong user" unless payload[:user_id] == user.id
+
+    payload[:secret]
+  end
+end

data/app/models/page.rb

@@ -25,9 +25,6 @@ class Page < ApplicationRecord
              optional: true,
              inverse_of: :pages
 
-  has_many :page_categories, dependent: :destroy
-  has_many :categories, through: :page_categories
-
   validates(:unique_name,
             format: { with: /\A[\w\d_-]+\z/,
                       allow_blank: true },

data/app/models/user.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
 class User < ApplicationRecord
+  include PagesCore::AuthenticableUser
+  include PagesCore::Emailable
   include PagesCore::HasRoles
 
-  attr_accessor :password, :confirm_password
-
   belongs_to(:creator,
              class_name: "User",
              foreign_key: "created_by",
@@ -16,54 +16,18 @@ class User < ApplicationRecord
            dependent: :nullify,
            inverse_of: :creator)
   has_many :pages, dependent: :nullify
-  has_many :password_reset_tokens, dependent: :destroy
   has_many :roles, dependent: :destroy
   has_many :invites, dependent: :destroy
   belongs_to_image :image, foreign_key: :image_id, optional: true
 
-  serialize :persistent_data
-
   validates :name, presence: true
 
-  validates :email,
-            presence: true,
-            format: { with: /\A([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})\Z/i },
-            uniqueness: { case_sensitive: false }
-
-  validates :password, presence: true, on: :create
-  validates :password, length: { minimum: 8 }, allow_blank: true
-
-  validate :confirm_password_must_match
-
-  before_validation :hash_password
   before_create :ensure_first_user_has_all_roles
 
   scope :by_name,     -> { order("name ASC") }
   scope :activated,   -> { by_name.includes(:roles).where(activated: true) }
   scope :deactivated, -> { by_name.includes(:roles).where(activated: false) }
 
-  class << self
-    def authenticate(email, password:)
-      user = User.find_by_email(email)
-      user if user.try { |u| u.authenticate!(password) }
-    end
-
-    def find_by_email(str)
-      find_by("LOWER(email) = ?", str.to_s.downcase)
-    end
-  end
-
-  def authenticate!(password)
-    return false unless can_login? && valid_password?(password)
-
-    rehash_password!(password) if password_needs_rehash?
-    true
-  end
-
-  def can_login?
-    activated?
-  end
-
   def mark_active!
     return if last_login_at && last_login_at > 10.minutes.ago
 
@@ -84,16 +48,6 @@ class User < ApplicationRecord
 
   private
 
-  def confirm_password_must_match
-    return if password.blank? || password == confirm_password
-
-    errors.add(:confirm_password, "does not match")
-  end
-
-  def encrypt_password(password)
-    BCrypt::Password.create(password)
-  end
-
   def ensure_first_user_has_all_roles
     return if User.any?
 
@@ -102,24 +56,4 @@ class User < ApplicationRecord
       roles.new(name: r.name) unless role?(r.name)
     end
   end
-
-  def hash_password
-    self.hashed_password = encrypt_password(password) if password.present?
-  end
-
-  def password_needs_rehash?
-    hashed_password.length <= 40
-  end
-
-  def rehash_password!(password)
-    update(hashed_password: encrypt_password(password))
-  end
-
-  def valid_password?(password)
-    if hashed_password.length <= 40
-      hashed_password == Digest::SHA1.hexdigest(password)
-    else
-      BCrypt::Password.new(hashed_password) == password
-    end
-  end
 end

data/app/policies/page_policy.rb

@@ -18,7 +18,7 @@ class PagePolicy < Policy
   end
 
   def new?
-    user.role?(:pages)
+    user&.role?(:pages)
   end
 
   def show?
@@ -26,7 +26,11 @@ class PagePolicy < Policy
   end
 
   def edit?
-    user.role?(:pages)
+    user&.role?(:pages)
+  end
+
+  def edit2?
+    edit?
   end
 
   def move?

data/app/policies/user_policy.rb

@@ -48,4 +48,8 @@ class UserPolicy < Policy
   def change_password?
     user == record
   end
+
+  def otp?
+    user == record
+  end
 end

data/app/resources/admin/page_resource.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+module Admin
+  class PageResource
+    include Alba::Resource
+    include Rails.application.routes.url_helpers
+    include PagesCore::PagePathHelper
+    include DynamicImage::Helper
+
+    attributes :id, :starts_at, :ends_at, :all_day, :status, :published_at,
+               :pinned, :template, :unique_name, :feed_enabled, :news_page,
+               :parent_page_id, :user_id, :redirect_to
+
+    has_many :page_images, resource: Admin::PageImageResource
+    has_many :page_files, resource: Admin::PageFileResource
+
+    attribute :blocks do
+      PagesCore::Templates::TemplateConfiguration.all_blocks
+                                                 .index_with do |attr|
+        if object.template_config.block(attr)[:localized]
+          localized_attribute(object, attr)
+        else
+          object.send(attr)
+        end
+      end
+    end
+
+    attribute :errors do
+      object.errors.map do |e|
+        { attribute: e.attribute,
+          message: e.message }
+      end
+    end
+
+    attribute :urls do
+      if object.id?
+        localized_objects.filter(&:name?).each_with_object({}) do |p, obj|
+          obj[p.locale] = page_path(p.locale, p)
+          obj
+        end
+      else
+        {}
+      end
+    end
+
+    attribute :enabled_tags do
+      object.tags.map(&:name)
+    end
+
+    attribute :tags_and_suggestions do
+      Tag.tags_and_suggestions_for(object, limit: 20)
+         .map(&:name)
+    end
+
+    attribute :meta_image do
+      image_uploader(object.meta_image)
+    end
+
+    attribute :path_segment do
+      localized_attribute(object, :path_segment)
+    end
+
+    attribute :ancestors do
+      object.ancestors.map do |p|
+        { id: p.id,
+          name: localized_attribute(p, :name),
+          path_segment: localized_attribute(p, :path_segment) }
+      end
+    end
+
+    attribute :permissions do
+      [(:edit if Policy.for(params[:user], object).edit?),
+       (:create if Policy.for(params[:user], object).edit?)].compact
+    end
+
+    private
+
+    def image_uploader(image)
+      return { src: nil, image: nil } unless image
+
+      { src: dynamic_image_path(image, size: "500x"),
+        image: ::Admin::ImageResource.new(image).to_hash }
+    end
+
+    def localized_objects
+      object.locales.map { |l| object.localize(l) }
+    end
+
+    def localized_attribute(record, attr)
+      record.locales.index_with do |locale|
+        record.localize(locale).send(attr)
+      end
+    end
+  end
+end

data/app/resources/admin/page_tree_resource.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Admin
+  class PageTreeResource
+    include Alba::Resource
+
+    attributes :id, :parent_page_id, :status, :news_page, :pinned,
+               :published_at
+
+    attribute :blocks do
+      { name: localized_attribute(object, :name) }
+    end
+
+    attribute :permissions do
+      [(:edit if Policy.for(params[:user], object).edit?),
+       (:create if Policy.for(params[:user], object).edit?)].compact
+    end
+
+    private
+
+    def localized_attribute(record, attr)
+      record.locales.index_with do |locale|
+        record.localize(locale).send(attr)
+      end
+    end
+  end
+end

data/app/resources/admin/template_configuration_resource.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Admin
+  class TemplateConfigurationResource
+    include Alba::Resource
+
+    attributes :name, :template_name
+
+    attribute :blocks do
+      object.enabled_blocks.map do |block_name|
+        block(block_name)
+      end
+    end
+
+    attribute :metadata_blocks do
+      object.metadata_blocks.map do |block_name|
+        block(block_name)
+      end
+    end
+
+    attribute :images do
+      object.value(:images) || object.value(:image)
+    end
+
+    %i[dates tags files].each do |attr|
+      attribute attr do
+        object.value(attr)
+      end
+    end
+
+    private
+
+    def block(block_name)
+      reify_options(object.block(block_name).merge(name: block_name))
+    end
+
+    def reify_options(block)
+      return block unless block.key?(:options)
+
+      opts = block[:options]
+      opts = opts.call if opts.is_a?(Proc)
+      unless opts.present? && opts.first.is_a?(Array)
+        opts = opts.map { |v| [v, v] }
+      end
+      opts = ([["", nil]] + opts).uniq
+
+      block.merge(options: opts)
+    end
+  end
+end

data/app/views/admin/account_recoveries/new.html.erb

@@ -0,0 +1,22 @@
+<% content_for :page_title, "Account recovery" %>
+<% content_for :page_description, "Account recovery" %>
+
+<%= form_tag admin_account_recovery_path do %>
+  <h2>
+    Forgot your password or lost your authenticator?
+  </h2>
+  <p>
+    Don't worry, it happens.
+    Enter your email address below, and we'll send you a link where you
+    can recover your account.
+  </p>
+  <div class="field">
+    <label for="email">Email address</label>
+    <%= text_field_tag(:email, "", autocomplete: "email", autofocus: true) %>
+  </div>
+  <p>
+    <button type="submit">
+      Send
+    </button>
+  </p>
+<% end %>

data/app/views/admin/account_recoveries/show.html.erb

@@ -0,0 +1,37 @@
+<% content_for :page_title, "Account recovery" %>
+<% content_for :page_description, "Please choose a new password to proceed" %>
+<% content_for :body_class, "login" %>
+
+<div class="login-form">
+  <%= form_for(@user,
+               url: admin_account_recovery_path,
+               builder: PagesCore::Admin::FormBuilder,
+               class: 'form') do |f| %>
+    <%= hidden_field_tag :token, @token %>
+    <%= f.labelled_password_field(:password,
+                                  autofocus: true,
+                                  autocomplete: "new-password") %>
+    <%= f.labelled_password_field(:password_confirmation,
+                                  autocomplete: "new-password") %>
+
+    <% if @user.otp_enabled? %>
+      <div class="field">
+        <label for="otp">6 digit code or recovery code</label>
+        <%= text_field_tag(:otp, "",
+                           autocomplete: "one-time-code",
+                           size: 6) %>
+      </div>
+      <p>
+        Lost your authenticator device? You can use one of your
+        emergency recovery codes instead.
+      </p>
+    <% end %>
+
+    <p>
+      <button type="submit">
+        Change password
+      </button>
+      or <%= link_to "Return to login screen", admin_login_path %>
+    </p>
+  <% end %>
+</div>

data/app/views/admin/invites/show.html.erb

@@ -14,7 +14,7 @@
   <%= f.labelled_text_field :email, autocomplete: "email" %>
   <%= f.labelled_password_field(:password,
                                 autocomplete: "new-password") %>
-  <%= f.labelled_password_field(:confirm_password,
+  <%= f.labelled_password_field(:password_confirmation,
                                 autocomplete: "new-password") %>
   <p>
     <button type="submit">

data/app/views/admin/news/_sidebar.html.erb

@@ -19,9 +19,8 @@
     <h2>
       <%= link_to_unless_current(
         year,
-        admin_news_index_path(locale, year: year, category: category&.slug)
+        admin_news_index_path(locale, year: year)
       ) %>
-      <%= ": #{@category.name}" if @category %>
       <span class="count">
         (<%= year_count %>)
       </span>
@@ -37,8 +36,7 @@
           <% else %>
             <%= link_to(
               month_name(month),
-              admin_news_index_path(locale, year: year, month: month,
-                                    category: category&.slug)
+              admin_news_index_path(locale, year: year, month: month)
             ) %>
             <span class="count">
               (<%= page_count %>)

data/app/views/admin/news/index.html.erb

@@ -18,7 +18,6 @@
   <%= render(partial: "sidebar",
              locals: {
                locale: content_locale,
-               category: @category,
                news_pages: @news_pages,
                archive_finder: @archive_finder
              }) %>

data/app/views/admin/otp_secrets/create.html.erb

@@ -0,0 +1,7 @@
+<% content_for :page_title, "2FA enabled" %>
+<% content_for :page_description, "Two-factor authentication enabled" %>
+
+<div class="content">
+  <%= render(partial: "admin/recovery_codes/codes",
+             locals: { recovery_codes: @recovery_codes }) %>
+</div>

data/app/views/admin/otp_secrets/new.html.erb

@@ -0,0 +1,60 @@
+<% content_for :page_title, "Enable 2FA" %>
+<% content_for :page_description, "Enable two-factor authentication" %>
+
+<%= form_tag(admin_otp_secret_path, method: :post, class: "totp-enrollment") do |f| %>
+  <h2>
+    Scan the QR-code
+  </h2>
+  <p>
+    Use an authenticator app or browser extension to scan the QR code below.<br>
+    Don't have one? Some options are
+    <%= link_to("1Password", "https://1password.com/") %>,
+    <%= link_to("LastPass Authenticator", "https://www.lastpass.com/") %>,
+    <%= link_to("Microsoft Authenticator",
+                "https://www.microsoft.com/en-us/security/mobile-authenticator-app") %>
+    or
+    <%= link_to("Google Authenticator",
+                "https://support.google.com/accounts/answer/1066447") %>.
+  </p>
+
+
+  <div class="qr-code">
+    <%= qr_code(@otp_secret.provisioning_uri) %>
+  </div>
+
+  <p>
+    If you are unable to scan the code, you can enter the following
+    info instead:
+  </p>
+
+  <p>
+    <b>Account name:</b><br>
+    <%= @otp_secret.account_name %>
+  </p>
+  <p>
+    <b>Secret:</b><br>
+    <span class="otp-secret">
+      <%= @otp_secret.secret %>
+    </span>
+  </p>
+
+  <h2>
+    Enter the code from the app
+  </h2>
+
+  <div class="field">
+    <label for="otp">6 digit code</label>
+    <%= text_field_tag(:otp, "",
+                       autofocus: true,
+                       autocomplete: "one-time-code",
+                       size: 6) %>
+  </div>
+
+  <%= hidden_field_tag :signed_message, @otp_secret.signed_message %>
+
+  <p>
+    <button type="submit">
+      Verify
+    </button>
+  </p>
+<% end %>