trek 2.3.1 → 2.4.0

data/lib/generators/trek/templates/spec/requests/admin/password_renewal_spec.rb

@@ -0,0 +1,83 @@
+require "rails_helper"
+
+RSpec.describe "Admin password renewal", type: :request do
+  let(:admin) { users.create(role: :admin) }
+  let(:editor) { users.create(role: :editor) }
+
+  def sign_in(user, password: users.password)
+    post admin_user_session_path, params: { email: user.email, password: }
+  end
+
+  it "lets an admin ask every user to renew their password" do
+    editor
+    sign_in(admin)
+
+    post require_password_renewal_admin_users_path
+
+    expect(editor.reload.password_renewal_required).to be(true)
+  end
+
+  it "doesn't let an editor ask for it" do
+    admin
+    sign_in(editor)
+
+    post require_password_renewal_admin_users_path
+
+    expect(admin.reload.password_renewal_required).to be(false)
+  end
+
+  context "when the password must be renewed" do
+    before do
+      editor
+      User.require_password_renewal!
+    end
+
+    it "sends the user to the new password form after signing in" do
+      sign_in(editor)
+      follow_redirect!
+
+      expect(response).to redirect_to(%r{/admin/user_password_resets/[^/]+/edit\z})
+    end
+
+    it "keeps the user signed out until then" do
+      sign_in(editor)
+      follow_redirect!
+      get admin_root_path
+
+      expect(response).to redirect_to(new_admin_user_session_path)
+    end
+
+    it "lets the user back in with the new password" do
+      sign_in(editor)
+      follow_redirect!
+      patch response.location.delete_suffix("/edit"), params: { password: "a renewed passphrase here" }
+      sign_in(editor, password: "a renewed passphrase here")
+
+      expect(response).to redirect_to(admin_root_url)
+    end
+  end
+
+  context "when the password has expired" do
+    around do |example|
+      User.password_expires_after = 1.year
+      example.run
+    ensure
+      User.password_expires_after = nil
+    end
+
+    it "sends the user to the new password form after signing in" do
+      editor.update!(password_changed_at: 2.years.ago)
+      sign_in(editor)
+      follow_redirect!
+
+      expect(response).to redirect_to(%r{/admin/user_password_resets/[^/]+/edit\z})
+    end
+
+    it "lets a recent password through" do
+      sign_in(editor)
+      follow_redirect!
+
+      expect(response).to have_http_status(:ok)
+    end
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/sign_in_lockout_spec.rb

@@ -0,0 +1,95 @@
+require "rails_helper"
+
+RSpec.describe "Admin sign-in lockout", type: :request do
+  include ActiveSupport::Testing::TimeHelpers
+
+  let(:editor) { users.create(role: :editor) }
+
+  def sign_in(user = editor, password: users.password)
+    post admin_user_session_path, params: { email: user.email, password: }
+  end
+
+  def fail_sign_ins(count, user = editor)
+    count.times { sign_in(user, password: "not the password") }
+  end
+
+  def lock_then_extend
+    fail_sign_ins(User.sign_in_lockout_after)
+    travel(User.sign_in_lockout_duration + 1.second) { fail_sign_ins(1) }
+  end
+
+  describe "per account" do
+    it "refuses the right password once failures lock signing in" do
+      fail_sign_ins(User.sign_in_lockout_after)
+
+      sign_in
+
+      expect(response).to have_http_status(:unprocessable_entity)
+    end
+
+    it "answers a locked account as a wrong password, so it can't be told apart" do
+      fail_sign_ins(User.sign_in_lockout_after)
+      sign_in(password: "not the password")
+      wrong_password = [response.status, flash[:alert]]
+
+      sign_in
+
+      expect([response.status, flash[:alert]]).to eq(wrong_password)
+    end
+
+    it "lets the user in once the lock is over" do
+      fail_sign_ins(User.sign_in_lockout_after)
+
+      travel(User.sign_in_lockout_duration + 1.second) { sign_in }
+
+      expect(response).to redirect_to(admin_root_url)
+    end
+
+    it "lets the user in before failures lock signing in" do
+      fail_sign_ins(User.sign_in_lockout_after - 1)
+
+      sign_in
+
+      expect(response).to redirect_to(admin_root_url)
+    end
+
+    it "starts the count over after a successful sign-in" do
+      fail_sign_ins(User.sign_in_lockout_after - 1)
+      sign_in
+      delete admin_user_session_path
+
+      fail_sign_ins(1)
+
+      expect(editor.reload.sign_in_locked?).to be(false)
+    end
+
+    it "emails the user once when it locks, not on the failures that extend it" do
+      editor
+
+      expect { perform_enqueued_jobs { lock_then_extend } }.to change(ActionMailer::Base.deliveries, :size).by(1)
+    end
+  end
+
+  describe "per IP address, whatever the account" do
+    # The app's test cache is a null store, under which nothing is ever counted
+    before { allow(Rails).to receive(:cache).and_return(ActiveSupport::Cache::MemoryStore.new) }
+
+    let(:limit) { Admin::UserSessionsController::FAILED_SIGN_INS_PER_IP }
+
+    it "refuses any sign-in after too many failures" do
+      limit.times { |i| sign_in(users.create(email: "user#{i}@example.com", role: :editor), password: "wrong") }
+
+      sign_in
+
+      expect(response).to have_http_status(:too_many_requests)
+    end
+
+    it "lets sign-ins from the address in again after the window" do
+      limit.times { |i| sign_in(users.create(email: "user#{i}@example.com", role: :editor), password: "wrong") }
+
+      travel(Admin::UserSessionsController::FAILED_SIGN_INS_WINDOW + 1.second) { sign_in }
+
+      expect(response).to redirect_to(admin_root_url)
+    end
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/sign_in_notices_spec.rb

@@ -0,0 +1,93 @@
+require "rails_helper"
+
+RSpec.describe "Admin sign-in notices", type: :request do
+  include ActiveSupport::Testing::TimeHelpers
+
+  let(:editor) { users.create(role: :editor) }
+  let(:firefox) { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0" }
+
+  def sign_in(user, user_agent: firefox)
+    post admin_user_session_path, params: { email: user.email, password: users.password }, headers: { "User-Agent" => user_agent }
+  end
+
+  def sign_out
+    delete admin_user_session_path
+  end
+
+  describe "the previous sign-in" do
+    it "keeps the sign-in notice short" do
+      sign_in(editor)
+      sign_out
+
+      sign_in(editor)
+
+      expect(flash[:notice]).to eq(I18n.t("admin.user_sessions.create.success"))
+    end
+
+    it "speaks the user's language, not the app's default one" do
+      other_locale = (I18n.available_locales - [I18n.default_locale]).first
+      skip "the app has a single locale" unless other_locale
+      user = users.create(role: :editor, locale: other_locale)
+
+      sign_in(user)
+
+      expect(flash[:notice]).to eq(I18n.t("admin.user_sessions.create.success", locale: other_locale))
+    end
+
+    it "records the current sign-in as the previous one for the next" do
+      sign_in(editor)
+      travel 1.day
+      sign_in(editor)
+
+      expect(editor.reload.last_sign_in_at).to be < editor.current_sign_in_at
+    end
+
+    it "shows the previous sign-in's date, browser and address on the sessions tab" do
+      sign_in(editor)
+      sign_out
+      sign_in(editor)
+
+      get admin_user_path(editor)
+
+      expect(response.body).to include("Firefox on Windows").and include("127.0.0.1")
+    end
+  end
+
+  it "offers to change the password when the previous sign-in wasn't the user's" do
+    sign_in(editor)
+    sign_out
+    sign_in(editor)
+
+    get admin_user_path(editor)
+
+    expect(response.body).to include(new_admin_user_password_reset_path(email: editor.email))
+  end
+
+  describe "the email on a sign-in from a new browser" do
+    it "isn't sent on the very first sign-in" do
+      expect { sign_in(editor) }.not_to have_enqueued_mail(AdminMailer, :new_sign_in)
+    end
+
+    it "isn't sent from a browser already used to sign in" do
+      sign_in(editor)
+      sign_out
+
+      expect { sign_in(editor) }.not_to have_enqueued_mail(AdminMailer, :new_sign_in)
+    end
+
+    it "is sent from a browser never used to sign in" do
+      sign_in(editor)
+      cookies.delete("trek_known_users")
+
+      expect { sign_in(editor) }.to have_enqueued_mail(AdminMailer, :new_sign_in)
+    end
+
+    it "isn't sent when the app turns it off" do
+      allow(User).to receive(:new_sign_in_email).and_return(false)
+      sign_in(editor)
+      cookies.delete("trek_known_users")
+
+      expect { sign_in(editor) }.not_to have_enqueued_mail(AdminMailer, :new_sign_in)
+    end
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/user_password_resets_spec.rb

@@ -9,20 +9,48 @@ RSpec.describe "Admin password resets", type: :request do
     expect(response).to have_http_status(:ok)
   end
 
+  it "fills the reset request form with the email of the link" do
+    get new_admin_user_password_reset_path(email: "ada@example.com")
+
+    expect(response.body).to include('value="ada@example.com"')
+  end
+
+  it "keeps the reset request actions in the card, out of the sticky action bar" do
+    get new_admin_user_password_reset_path
+
+    expect(response.body).to include("c-trek--form--actions-aspect-seamless")
+  end
+
   it "emails a reset link to a privileged user" do
-    expect { post admin_user_password_resets_path, params: { email: editor.email } }
-      .to have_enqueued_mail(Admin::PasswordsMailer, :reset)
+    perform_enqueued_jobs { post admin_user_password_resets_path, params: { email: editor.email } }
+
+    expect(ActionMailer::Base.deliveries.last.to).to eq([editor.email])
   end
 
   it "sends nothing for an unknown email" do
-    expect { post admin_user_password_resets_path, params: { email: "nobody@example.com" } }
-      .not_to have_enqueued_mail
+    expect { perform_enqueued_jobs { post admin_user_password_resets_path, params: { email: "nobody@example.com" } } }
+      .not_to change(ActionMailer::Base.deliveries, :count)
+  end
+
+  it "sends nothing to a user who is not privileged" do
+    reader = users.create(role: :reader)
+
+    expect { perform_enqueued_jobs { post admin_user_password_resets_path, params: { email: reader.email } } }
+      .not_to change(ActionMailer::Base.deliveries, :count)
   end
 
   it "answers an unknown email as a known one, so it can't be used to find accounts" do
+    post admin_user_password_resets_path, params: { email: editor.email }
+    known = [response.location, flash[:notice]]
+
     post admin_user_password_resets_path, params: { email: "nobody@example.com" }
 
-    expect(response).to redirect_to(new_admin_user_session_path)
+    expect([response.location, flash[:notice]]).to eq(known)
+  end
+
+  it "queues the same job for an unknown email, so the response time doesn't tell it apart" do
+    expect { post admin_user_password_resets_path, params: { email: "nobody@example.com" } }
+      .to have_enqueued_job(Admin::PasswordResetJob).with("nobody@example.com")
   end
 
   it "renders the new password form from a reset link" do
@@ -31,6 +59,20 @@ RSpec.describe "Admin password resets", type: :request do
     expect(response).to have_http_status(:ok)
   end
 
+  it "states the password rules on the new password form" do
+    get edit_admin_user_password_reset_path(editor.password_reset_token)
+
+    rules = I18n.t("admin.user_password_resets.edit.rules", min: User.password_min_length, passphrase: User.passphrase_length)
+
+    expect(response.body).to include(CGI.escapeHTML(rules))
+  end
+
+  it "keeps the new password actions in the card, out of the sticky action bar" do
+    get edit_admin_user_password_reset_path(editor.password_reset_token)
+
+    expect(response.body).to include("c-trek--form--actions-aspect-seamless")
+  end
+
   it "renders the new password form from an invitation link" do
     get edit_admin_user_password_reset_path(editor.generate_token_for(:invite))
 
@@ -53,7 +95,7 @@ RSpec.describe "Admin password resets", type: :request do
     post admin_user_session_path, params: { email: editor.email, password: users.password }
     patch admin_user_password_reset_path(editor.password_reset_token), params: { password: "a brand new password" }
 
-    expect(editor.user_sessions).to be_empty
+    expect(editor.sessions).to be_empty
   end
 
   it "sends an empty password back to the form rather than pretending to change it" do
@@ -75,4 +117,11 @@ RSpec.describe "Admin password resets", type: :request do
 
     expect(editor.reload.authenticate(users.password)).to be_truthy
   end
+
+  it "sends a recent password back to the form, saying why" do
+    token = editor.password_reset_token
+    patch admin_user_password_reset_path(token), params: { password: users.password }
+
+    expect(flash[:alert]).to include(editor.errors.generate_message(:password, :recently_used, count: User.password_history_size))
+  end
 end

data/lib/generators/trek/templates/spec/requests/admin/user_sessions_spec.rb

@@ -9,6 +9,12 @@ RSpec.describe "Admin sign-in", type: :request do
     expect(response).to have_http_status(:ok)
   end
 
+  it "keeps the sign-in actions in the card, out of the sticky action bar" do
+    get new_admin_user_session_path
+
+    expect(response.body).to include("c-trek--form--actions-aspect-seamless")
+  end
+
   it "signs a privileged user in and opens the dashboard" do
     post admin_user_session_path, params: { email: editor.email, password: users.password }
     follow_redirect!
@@ -25,14 +31,37 @@ RSpec.describe "Admin sign-in", type: :request do
   it "refuses a wrong password" do
     post admin_user_session_path, params: { email: editor.email, password: "not the password" }
 
-    expect(response).to redirect_to(new_admin_user_session_path)
+    expect(response).to have_http_status(:unprocessable_entity)
+  end
+
+  it "keeps the email typed after a wrong password" do
+    post admin_user_session_path, params: { email: editor.email, password: "not the password" }
+
+    expect(response.body).to include(%(value="#{editor.email}"))
   end
 
   it "refuses a user who is not privileged" do
     reader = users.create(role: :reader)
     post admin_user_session_path, params: { email: reader.email, password: users.password }
 
-    expect(response).to redirect_to(new_admin_user_session_path)
+    expect(response).to have_http_status(:unprocessable_entity)
+  end
+
+  it "answers an unknown email as a wrong password, so it can't be used to find accounts" do
+    post admin_user_session_path, params: { email: editor.email, password: "not the password" }
+    wrong_password = [response.status, flash[:alert]]
+
+    post admin_user_session_path, params: { email: "nobody@example.com", password: "not the password" }
+
+    expect([response.status, flash[:alert]]).to eq(wrong_password)
+  end
+
+  it "still hashes the password typed with an unknown email, so it takes as long as a wrong password" do
+    allow(BCrypt::Password).to receive(:create).and_call_original
+
+    post admin_user_session_path, params: { email: "nobody@example.com", password: "not the password" }
+
+    expect(BCrypt::Password).to have_received(:create)
   end
 
   it "sends a signed-out visitor to the sign-in form" do

data/lib/generators/trek/templates/views/admin/audit_logs/index.html.slim

@@ -0,0 +1,35 @@
+= render Trek::HeadingComponent.new( \
+  title: model_name.human(count: 2),
+  intro: t(".intro"),
+) do |c|
+  ruby:
+    if scope_params&.dig(:failures).present?
+      c.with_button(
+        href: [:admin, :audit_logs, filters: filter_params],
+        text: t("admin.actions.all"),
+      )
+    else
+      c.with_button(
+        href: [
+          :admin, :audit_logs,
+          filters: filter_params, scopes: { failures: 1 }
+        ],
+        text: t(".failures", count: scope_counts[:failures]),
+      )
+    end
+
+= render Trek::EntriesComponent.new do |entries|
+  ruby:
+    @objects.each do |log|
+      entries.with_item(item: log, action: :show) do |entry|
+        entry.with_title(href: [:admin, log]) { log.action }
+        entry.with_detail { l(log.created_at, format: :long) }
+        entry.with_detail { log.actor.to_s } if log.actor
+        entry.with_detail { "#{log.http_method} #{log.http_status}".strip }
+        entry.with_detail { log.auditable.to_s } if log.auditable
+        entry.with_detail { log.error_class } if log.error_class
+      end
+    end
+
+= render Trek::PaginationComponent.new do
+  = paginate @objects

data/lib/generators/trek/templates/views/admin/audit_logs/show.html.slim

@@ -0,0 +1,50 @@
+= render Trek::HeadingComponent.new( \
+  title: @object.to_s,
+  intro: t(".intro"),
+) do |c|
+  - c.with_button(href: [:admin, :audit_logs], text: t("admin.actions.cancel"))
+
+= render Trek::PropertiesComponent.new(model:) do |p|
+  = p.with_item :created_at
+    = l(@object.created_at, format: :long)
+
+  - if @object.actor
+    = p.with_item :actor
+      = audit_log_record_link(@object.actor)
+
+  = p.with_item :action
+    = @object.action
+
+  = p.with_item :http_method
+    code = @object.http_method
+
+  = p.with_item :path
+    code = @object.path
+
+  - if @object.http_status
+    = p.with_item :http_status
+      = @object.http_status
+
+  - if @object.error_class
+    = p.with_item :error_class
+      code = @object.error_class
+
+  - if @object.auditable
+    = p.with_item :auditable
+      = audit_log_record_link(@object.auditable)
+
+  - if @object.ip_address
+    = p.with_item :ip_address
+      code = @object.ip_address
+
+  - if @object.user_agent
+    = p.with_item :user_agent
+      = @object.user_agent
+
+  - if @object.request_id
+    = p.with_item :request_id
+      code = @object.request_id
+
+  - if @object.params.present?
+    = p.with_item :params
+      pre = JSON.pretty_generate(@object.params)

data/lib/generators/trek/templates/views/admin/user_password_resets/edit.html.slim

@@ -1,13 +1,23 @@
 = render Trek::GateComponent.new
   = form_with url: admin_user_password_reset_path(@token), method: :put do |f|
-    = f.group :password, model_name: User.model_name
-      = f.password_field :password,
-          required: true,
-          autocomplete: "new-password",
-          maxlength: 72,
-          minlength: 8
+    ruby:
+      rules = t(
+        ".rules",
+        min: User.password_min_length,
+        passphrase: User.passphrase_length,
+      )
+    = f.group :password, model_name: User.model_name, hint: rules
+      = render Trek::Form::PasswordStrengthComponent.new( \
+          min_length: User.password_min_length,
+          passphrase_length: User.passphrase_length,
+        )
+        = f.password_field :password,
+            required: true,
+            autocomplete: "new-password",
+            maxlength: 72,
+            minlength: User.password_min_length
 
-    = render Trek::Form::ActionsComponent.new do |c|
+    = render Trek::Form::ActionsComponent.new(aspect: :seamless) do |c|
       ruby:
         c.with_button(
           type: "submit",

data/lib/generators/trek/templates/views/admin/user_password_resets/new.html.slim

@@ -4,9 +4,10 @@
       = f.email_field :email,
           required: true,
           autofocus: true,
-          autocomplete: "username"
+          autocomplete: "username",
+          value: params[:email]
 
-    = render Trek::Form::ActionsComponent.new do |c|
+    = render Trek::Form::ActionsComponent.new(aspect: :seamless) do |c|
       ruby:
         c.with_button(
           type: "submit",

data/lib/generators/trek/templates/views/admin/user_sessions/new.html.slim

@@ -1,10 +1,11 @@
 = render Trek::GateComponent.new
   = form_with url: admin_user_session_path do |f|
     = f.group :email, model_name: User.model_name
+      / "webauthn" offers the site's passkeys in the field's autofill
       = f.email_field :email,
           required: true,
           autofocus: @email.nil?,
-          autocomplete: "username",
+          autocomplete: "username webauthn",
           value: @email
 
     = f.group :password, model_name: User.model_name
@@ -15,7 +16,7 @@
           maxlength: 72,
           minlength: 8
 
-    = render Trek::Form::ActionsComponent.new do |c|
+    = render Trek::Form::ActionsComponent.new(aspect: :seamless) do |c|
       ruby:
         c.with_button(
           type: "submit",
@@ -27,3 +28,28 @@
           href: %i[new admin user_password_reset],
           text: t(".forgot_password"),
         )
+
+  / Shown by the passkey controller, in browsers that support passkeys
+  ruby:
+    passkey_form = {
+      url: admin_passkey_session_path,
+      hidden: true,
+      data: {
+        controller: "passkey",
+        passkey_options_url_value: options_admin_passkey_session_path,
+        passkey_conditional_value: true
+      }
+    }
+  = form_with(**passkey_form) do
+    = hidden_field_tag :credential, nil, data: { passkey_target: "credential" }
+    div(data-passkey-target="error" hidden)
+      = render Trek::Form::ErrorsComponent.new(errors: [t(".passkey_failure")])
+
+    = render Trek::Form::ActionsComponent.new(aspect: :seamless) do |c|
+      ruby:
+        c.with_button(
+          text: t(".passkey"),
+          data: { action: "passkey#get" },
+        ) do |b|
+          b.with_icon("trek/passkey")
+        end

data/lib/generators/trek/templates/views/admin/users/_passkeys.html.slim

@@ -0,0 +1,67 @@
+/ Shown by the passkey controller, in browsers that support passkeys: in the
+/ section while it's empty, below the list, in an actions bar, once it isn't.
+/ Submitting it creates the passkey on the device, then posts it.
+ruby:
+  passkey_form = {
+    url: admin_passkeys_path,
+    hidden: true,
+    data: {
+      controller: "passkey",
+      passkey_options_url_value: options_admin_passkeys_path,
+      action: "submit->passkey#submit"
+    }
+  }
+  aspect = passkeys.any? ? :default : :seamless
+- add_passkey = capture do
+  = form_with(**passkey_form) do
+    = hidden_field_tag :credential, nil, data: { passkey_target: "credential" }
+    div(data-passkey-target="error" hidden)
+      = render Trek::Form::ErrorsComponent.new(errors: [t(".failure")])
+    div(data-passkey-target="alreadyAdded" hidden)
+      = render Trek::Form::ErrorsComponent.new(errors: [t(".already_added")])
+
+    = render Trek::Form::ActionsComponent.new(aspect:) do |c|
+      ruby:
+        c.with_button(type: "submit", text: t(".add")) do |b|
+          b.with_icon("trek/passkey")
+        end
+
+= render Trek::SectionComponent.new(title: t(".title"), hint: t(".intro"))
+  - if passkeys.any?
+    = render Trek::EntriesComponent.new do |entries|
+      ruby:
+        passkeys.each do |passkey|
+          entries.with_item(item: passkey) do |entry|
+            entry.with_title(href: nil) { passkey.to_s }
+            entry.with_detail do
+              t(".added", date: l(passkey.created_at, format: :long))
+            end
+            entry.with_detail do
+              if passkey.last_used_at
+                time = time_ago_in_words(passkey.last_used_at)
+                t(".last_used", time:)
+              else
+                t(".never_used")
+              end
+            end
+            entry.with_status do
+              render Trek::ButtonComponent.new(
+                href: admin_passkey_path(passkey),
+                text: t(".delete"),
+                size: :narrow,
+                color: :tomato,
+                data: {
+                  turbo_method: :delete,
+                  turbo_confirm: t(".delete_confirm"),
+                  turbo_confirm_button: t(".delete"),
+                  turbo_confirm_color: "tomato"
+                },
+              )
+            end
+          end
+        end
+  - else
+    = add_passkey
+
+- if passkeys.any?
+  = add_passkey