spree_cm_commissioner 2.1.7 → 2.1.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b7e5168cb588dc6b931bee2b2711b37886b364323bf2e7215390fde1e46479b8
-  data.tar.gz: ed7571aca12c59e7385bd7e34fcde1105b0c8c04484d652bc5c4974f4c90e2ca
+  metadata.gz: 36165e2d7e9f037f00a0590045ae9c6171825a79f0499ec4cb70af91a246b0d5
+  data.tar.gz: b6d46f79ab01845de456585f50881dbca8b0b28d208e2db386a1833a9dfe1b30
 SHA512:
-  metadata.gz: e744361324c16633f8e3648c90b5af642e9deae632e3e9d92681c6d05ffdeca616663b7c535f8ea0f530d640232d4498389f7109d668d92f0f3fcc21afc57038
-  data.tar.gz: c428e0893d04a933352fe9965f3f1f0e3b270715652f598bbcdf2b12dbf30cb15194eb5e3e5adff6e321d532d0faddae9e40f881060f3cc6cce403031bbbb457
+  metadata.gz: bd7ac99403f71109009b3d06dff1fc5a72b61b833d00e27f2a7513c552f7005782ff819a5e69ca67d64160865af6fabf4dd9554f7253b3cbd85ea4ba283b555a
+  data.tar.gz: f7d227c43eb5ecfc72eeebbf715e651f576f998a769106a1303e647680a9b4e82820b1e31e3c3b10299a1ee79fa6da9fde4fce5ea9ec62074b62d5b6e937d560

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.1.7)
+    spree_cm_commissioner (2.1.8)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront
@@ -44,6 +44,7 @@ PATH
       byebug
       connection_pool
       counter_culture (~> 3.2)
+      devise-two-factor
       dry-validation (~> 1.10)
       elasticsearch (~> 8.5)
       exception_notification
@@ -291,6 +292,11 @@ GEM
       warden (~> 1.2.3)
     devise-encryptable (0.2.0)
       devise (>= 2.1.0)
+    devise-two-factor (6.1.0)
+      activesupport (>= 7.0, < 8.1)
+      devise (~> 4.0)
+      railties (>= 7.0, < 8.1)
+      rotp (~> 6.0)
     diff-lcs (1.5.0)
     docile (1.4.0)
     domain_name (0.5.20190701)
@@ -701,6 +707,7 @@ GEM
       railties (>= 5.2)
     retriable (3.1.2)
     rexml (3.2.6)
+    rotp (6.3.0)
     rqrcode (2.2.0)
       chunky_png (~> 1.0)
       rqrcode_core (~> 1.0)

data/app/controllers/spree/admin/user_security_controller.rb

@@ -0,0 +1,25 @@
+module Spree
+  module Admin
+    class UserSecurityController < Spree::Admin::BaseController
+      before_action :load_user
+
+      def disable_authenticator
+        @user.otp_secret = nil
+        @user.otp_required_for_login = false
+        begin
+          @user.save!
+          flash[:success] = I18n.t('authenticator.success_disabled_2fa')
+        rescue StandardError => e
+          flash[:error] = "Failed to disable 2FA: #{e.message}"
+        end
+        redirect_to admin_user_security_path(@user)
+      end
+
+      private
+
+      def load_user
+        @user = Spree::User.find(params[:user_id])
+      end
+    end
+  end
+end

data/app/models/spree_cm_commissioner/user_decorator.rb

@@ -46,6 +46,10 @@ module SpreeCmCommissioner
       # Store has_incomplete_guest_info in public_metadata for easy frontend access
       base.store :public_metadata, accessors: [:has_incomplete_guest_info], coder: JSON
 
+      base.devise :two_factor_authenticatable
+
+      base.store :private_metadata, accessors: %i[otp_secret otp_required_for_login consumed_timestep], coder: JSON
+
       define_user_places(base)
 
       def base.end_users
@@ -63,6 +67,18 @@ module SpreeCmCommissioner
       end
     end
 
+    def otp_secret
+      private_metadata['otp_secret']
+    end
+
+    def otp_required_for_login
+      private_metadata['otp_required_for_login']
+    end
+
+    def consumed_timestep
+      private_metadata['consumed_timestep']
+    end
+
     def self.define_user_places(base)
       base.has_many :user_places, class_name: 'SpreeCmCommissioner::UserPlace'
       base.has_many :places, through: :user_places, class_name: 'SpreeCmCommissioner::Place'

data/app/overrides/spree/admin/users/_tabs/tabs.html.erb.deface

@@ -49,4 +49,10 @@
       admin_user_events_path(user_id: @user.id),
       class: "nav-link #{'active' if current == :user_events }" %>
   </li>
+  <li class="nav-item">
+    <%= link_to_with_icon 'shield-check.svg',
+      Spree.t(:security),
+      admin_user_security_path(@user),
+      class: "nav-link #{'active' if current == :security }" %>
+  </li>
 <% end %>

data/app/views/spree/admin/user_security/show.html.erb

@@ -0,0 +1,25 @@
+<%= render partial: 'spree/admin/users/tabs', locals: { current: :security } %>
+
+<div class="card shadow-sm">
+  <div class="card-header bg-light">
+    <h5 class="card-title mb-0 h6">
+      <%= Spree.t(:two_factor_authentication) %>
+    </h5>
+  </div>
+
+  <div class="card-body text-center">
+    <% if @user.otp_secret.present? && @user.otp_required_for_login == true %>
+      <p class="text-muted mb-3">
+        Two-factor authentication is currently active for this user.
+      </p>
+      <%= button_to disable_authenticator_admin_user_security_path, method: :delete, class: "btn btn-danger btn-md",
+                    data: { confirm: "Are you sure?" } do %>
+          Disable 2FA
+      <% end %>
+    <% else %>
+      <p class="text-muted mb-0">
+        Two-factor authentication is <strong>not enabled</strong> for this user.
+      </p>
+    <% end %>
+  </div>
+</div>

data/config/locales/en.yml

@@ -30,6 +30,7 @@ en:
     incorrect_password: "Incorrect password"
     invalid_or_missing_params: "Invalid or missing params"
     invalid_client_credentials: "Invalid client credentials"
+    success_disabled_2fa: "Successfully disabled 2FA"
 
   hello: "Hello world"
 

data/config/routes.rb

@@ -91,6 +91,11 @@ Spree::Core::Engine.add_routes do
     resources :users do
       resources :device_tokens
       resources :user_identity_providers
+      resource :security, controller: :user_security, only: %i[show] do
+        member do
+          delete :disable_authenticator
+        end
+      end
     end
 
     resources :s3_presigned_urls, only: %i[create new]

data/lib/spree_cm_commissioner/version.rb

@@ -1,5 +1,5 @@
 module SpreeCmCommissioner
-  VERSION = '2.1.7'.freeze
+  VERSION = '2.1.8'.freeze
 
   module_function
 

data/lib/spree_cm_commissioner.rb

@@ -46,6 +46,7 @@ require 'premailer/rails'
 require 'cm_app_logger'
 require 'counter_culture'
 require 'paper_trail'
+require 'devise-two-factor'
 
 require 'byebug' if Rails.env.development? || Rails.env.test?
 

data/spree_cm_commissioner.gemspec

@@ -55,6 +55,7 @@ Gem::Specification.new do |s|
   s.add_dependency "premailer-rails"
   s.add_dependency 'counter_culture', '~> 3.2'
   s.add_dependency 'paper_trail', '~> 16.0'
+  s.add_dependency 'devise-two-factor'
 
   # Redis
   s.add_dependency 'redis'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_cm_commissioner
 version: !ruby/object:Gem::Version
-  version: 2.1.7
+  version: 2.1.8
 platform: ruby
 authors:
 - You
@@ -478,6 +478,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '16.0'
+- !ruby/object:Gem::Dependency
+  name: devise-two-factor
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: redis
   requirement: !ruby/object:Gem::Requirement
@@ -851,6 +865,7 @@ files:
 - app/controllers/spree/admin/trip_blazer_queries_controller.rb
 - app/controllers/spree/admin/user_events_controller.rb
 - app/controllers/spree/admin/user_identity_providers_controller.rb
+- app/controllers/spree/admin/user_security_controller.rb
 - app/controllers/spree/admin/users_controller_decorator.rb
 - app/controllers/spree/admin/variant_guest_card_classes_controller.rb
 - app/controllers/spree/admin/vectors/icons_controller.rb
@@ -2085,6 +2100,7 @@ files:
 - app/views/spree/admin/user_identity_providers/edit.html.erb
 - app/views/spree/admin/user_identity_providers/index.html.erb
 - app/views/spree/admin/user_identity_providers/new.html.erb
+- app/views/spree/admin/user_security/show.html.erb
 - app/views/spree/admin/variant_guest_card_classes/_variant_guest_card_class.html.erb
 - app/views/spree/admin/variant_guest_card_classes/index.html.erb
 - app/views/spree/admin/variants/_date_field.html.erb