trek 2.3.1 → 2.4.0

data/lib/generators/trek/templates/views/admin/users/_properties.html.slim

@@ -0,0 +1,21 @@
+= render Trek::PropertiesComponent.new(model:) do |p|
+  - if @object.name?
+    = p.with_item :name
+      = @object.name
+
+  = p.with_item :role
+    = t("user.roles.#{@object.role}")
+
+  = p.with_item :email
+    = mail_to @object.email
+
+  = p.with_item :created_at
+    = l(@object.created_at, default: "")
+
+  - if policy_permitted_attribute?(:locale) && @object.locale?
+    = p.with_item :locale
+      = t("user.locale.#{@object.locale}")
+
+  - if policy_permitted_attribute?(:theme) && @object.theme?
+    = p.with_item :theme
+        = t("user.theme.#{@object.theme}")

data/lib/generators/trek/templates/views/admin/users/_sessions.html.slim

@@ -0,0 +1,70 @@
+- if @object.last_sign_in_at?
+  ruby:
+    change_password = link_to(
+      t(".change_password"),
+      new_admin_user_password_reset_path(email: @object.email),
+    )
+    not_you = t(".not_you_html", change_password:)
+    previous_sign_in = Trek::SectionComponent.new(
+      title: t(".previous_sign_in"),
+      hint: not_you,
+    )
+  = render previous_sign_in
+    = render Trek::EntriesComponent.new do |entries|
+      ruby:
+        entries.with_item(item: @object) do |entry|
+          browser = user_agent_summary(@object.last_sign_in_user_agent)
+          entry.with_title(href: nil) { browser }
+          entry.with_detail { @object.last_sign_in_ip }
+          entry.with_detail do
+            t(".signed_in", date: l(@object.last_sign_in_at, format: :long))
+          end
+        end
+
+= render Trek::SectionComponent.new(title: t(".title"), hint: t(".intro"))
+  = render Trek::EntriesComponent.new do |entries|
+    ruby:
+      sessions.each do |user_session|
+        entries.with_item(item: user_session) do |entry|
+          browser = user_agent_summary(user_session.user_agent)
+          entry.with_title(href: nil) { browser }
+          entry.with_detail do
+            ip = user_session.ip_address
+            hostname = user_session.ip_hostname
+            hostname ? tag.abbr(ip, title: hostname) : ip
+          end
+          entry.with_detail do
+            t(".signed_in", date: l(user_session.created_at, format: :long))
+          end
+          last_activity = time_ago_in_words(user_session.last_activity_at)
+          entry.with_detail { t(".last_activity", time: last_activity) }
+          entry.with_status do
+            if user_session == Current.session
+              t(".current")
+            else
+              render Trek::ButtonComponent.new(
+                href: admin_active_session_path(user_session),
+                text: t(".sign_out"),
+                size: :narrow,
+                data: { turbo_method: :delete },
+              )
+            end
+          end
+        end
+      end
+
+- if sessions.size > 1
+  = render Trek::Form::ActionsComponent.new do |c|
+    ruby:
+      c.with_button(
+        href: %i[others admin active_sessions],
+        text: t(".sign_out_others"),
+        data: {
+          turbo_method: :delete,
+          turbo_confirm: t(".sign_out_others_confirm"),
+          turbo_confirm_button: t(".sign_out_others"),
+          turbo_confirm_color: "amber"
+        },
+      ) do |b|
+        b.with_icon("trek/logout")
+      end

data/lib/generators/trek/templates/views/admin/users/index.html.slim

@@ -12,6 +12,19 @@
       end
     end
 
+    if allowed_to?(:require_password_renewal?, model)
+      c.with_button(
+        href: [:require_password_renewal, :admin, :users],
+        text: t(".require_password_renewal"),
+        data: {
+          turbo_method: :post,
+          turbo_confirm: t(".require_password_renewal_confirm"),
+          turbo_confirm_button: t(".require_password_renewal"),
+          turbo_confirm_color: "amber"
+        },
+      )
+    end
+
 = render Trek::ListComponent.new(action: :show) do |c|
   ruby:
     @objects.each do |object|

data/lib/generators/trek/templates/views/admin/users/show.html.slim

@@ -18,24 +18,13 @@
       end
     end
 
-= render Trek::PropertiesComponent.new(model:) do |p|
-  - if @object.name?
-    = p.with_item :name
-      = @object.name
-
-  = p.with_item :role
-    = t("user.roles.#{@object.role}")
-
-  = p.with_item :email
-    = mail_to @object.email
-
-  = p.with_item :created_at
-    = l(@object.created_at, default: "")
-
-  - if policy_permitted_attribute?(:locale) && @object.locale?
-    = p.with_item :locale
-      = t("user.locale.#{@object.locale}")
-
-  - if policy_permitted_attribute?(:theme) && @object.theme?
-    = p.with_item :theme
-        = t("user.theme.#{@object.theme}")
+- if @object == Current.user
+  = render Trek::TabsComponent.new do |c|
+    - c.with_item(id: :profile, label: t(".profile"))
+      = render "properties"
+    - c.with_item(id: :sessions, label: t(".active_sessions"))
+      = render "sessions", sessions: @sessions
+    - c.with_item(id: :passkeys, label: t(".passkeys"))
+      = render "passkeys", passkeys: @passkeys
+- else
+  = render "properties"

data/lib/generators/trek/templates/views/admin_mailer/new_sign_in.en.html.slim

@@ -0,0 +1,22 @@
+p Hello #{@user},
+p
+  | Your #{t("application_name")} account was just signed in to
+  |  from a browser it had never seen:
+ul
+  li = l(@at, format: :long)
+  li = user_agent_summary(@user_agent)
+  li = @ip
+p If it was you, there's nothing to do.
+p
+  | If it wasn't, change your password right away,
+  |  then sign out the browsers you don't recognize:
+ul
+  li = link_to "Change your password",
+      @reset_url,
+      target: "_blank",
+      rel: "noopener"
+  li = link_to "See your active sessions",
+      @sessions_url,
+      target: "_blank",
+      rel: "noopener"
+p The #{t("application_name")} team

data/lib/generators/trek/templates/views/admin_mailer/new_sign_in.en.text.erb

@@ -0,0 +1,16 @@
+Hello <%%= @user %>,
+
+Your <%%= t("application_name") %> account was just signed in to from a browser it had never seen:
+
+- <%%= l(@at, format: :long) %>
+- <%%= user_agent_summary(@user_agent) %>
+- <%%= @ip %>
+
+If it was you, there's nothing to do.
+
+If it wasn't, change your password right away, then sign out the browsers you don't recognize:
+
+- Change your password: <%%= @reset_url %>
+- See your active sessions: <%%= @sessions_url %>
+
+The <%%= t("application_name") %> team

data/lib/generators/trek/templates/views/admin_mailer/new_sign_in.fr.html.slim

@@ -0,0 +1,22 @@
+p Bonjour #{@user},
+p
+  | Votre compte #{t("application_name")} vient d'être connecté
+  |  depuis un navigateur jamais vu :
+ul
+  li = l(@at, format: :long)
+  li = user_agent_summary(@user_agent)
+  li = @ip
+p Si c'était vous, il n'y a rien à faire.
+p
+  | Sinon, changez votre mot de passe tout de suite,
+  |  puis déconnectez les navigateurs que vous ne reconnaissez pas :
+ul
+  li = link_to "Changer votre mot de passe",
+      @reset_url,
+      target: "_blank",
+      rel: "noopener"
+  li = link_to "Voir vos sessions actives",
+      @sessions_url,
+      target: "_blank",
+      rel: "noopener"
+p L'équipe #{t("application_name")}

data/lib/generators/trek/templates/views/admin_mailer/new_sign_in.fr.text.erb

@@ -0,0 +1,16 @@
+Bonjour <%%= @user %>,
+
+Votre compte <%%= t("application_name") %> vient d'être connecté depuis un navigateur jamais vu :
+
+- <%%= l(@at, format: :long) %>
+- <%%= user_agent_summary(@user_agent) %>
+- <%%= @ip %>
+
+Si c'était vous, il n'y a rien à faire.
+
+Sinon, changez votre mot de passe tout de suite, puis déconnectez les navigateurs que vous ne reconnaissez pas :
+
+- Changer votre mot de passe : <%%= @reset_url %>
+- Voir vos sessions actives : <%%= @sessions_url %>
+
+L'équipe <%%= t("application_name") %>

data/lib/generators/trek/templates/views/admin_mailer/sign_in_locked.en.html.slim

@@ -0,0 +1,17 @@
+p Hello #{@user},
+p
+  | Several attempts in a row to sign in to #{t("application_name")}
+    with your email failed, with a wrong password. To keep your account
+    safe, signing in is paused for a few minutes, a little longer after
+    each new failure.
+p
+  | If it was you, wait a few minutes before trying again, or
+  =< link_to "choose a new password",
+      @reset_url,
+      target: "_blank",
+      rel: "noopener"
+  | .
+p
+  | If it wasn't you, someone may be trying to guess your password: if
+    it's short or you use it elsewhere, choose a new one.
+p The #{t("application_name")} team

data/lib/generators/trek/templates/views/admin_mailer/sign_in_locked.en.text.erb

@@ -0,0 +1,10 @@
+Hello <%%= @user %>,
+
+Several attempts in a row to sign in to <%%= t("application_name") %> with your email failed, with a wrong password. To keep your account safe, signing in is paused for a few minutes, a little longer after each new failure.
+
+If it was you, wait a few minutes before trying again, or choose a new password:
+<%%= @reset_url %>
+
+If it wasn't you, someone may be trying to guess your password: if it's short or you use it elsewhere, choose a new one.
+
+The <%%= t("application_name") %> team

data/lib/generators/trek/templates/views/admin_mailer/sign_in_locked.fr.html.slim

@@ -0,0 +1,18 @@
+p Bonjour #{@user},
+p
+  | Plusieurs tentatives de connexion à #{t("application_name")}
+    avec votre adresse e-mail ont échoué d'affilée, avec un mauvais mot de
+    passe. Pour protéger votre compte, la connexion est suspendue quelques
+    minutes, un peu plus longtemps après chaque nouvel échec.
+p
+  | Si c'était vous, patientez quelques minutes avant de réessayer, ou
+  =< link_to "choisissez un nouveau mot de passe",
+      @reset_url,
+      target: "_blank",
+      rel: "noopener"
+  | .
+p
+  | Si ce n'était pas vous, quelqu'un essaie peut-être de deviner votre mot
+    de passe : s'il est court ou que vous l'utilisez ailleurs,
+    choisissez-en un nouveau.
+p L'équipe #{t("application_name")}

data/lib/generators/trek/templates/views/admin_mailer/sign_in_locked.fr.text.erb

@@ -0,0 +1,10 @@
+Bonjour <%%= @user %>,
+
+Plusieurs tentatives de connexion à <%%= t("application_name") %> avec votre adresse e-mail ont échoué d'affilée, avec un mauvais mot de passe. Pour protéger votre compte, la connexion est suspendue quelques minutes, un peu plus longtemps après chaque nouvel échec.
+
+Si c'était vous, patientez quelques minutes avant de réessayer, ou choisissez un nouveau mot de passe :
+<%%= @reset_url %>
+
+Si ce n'était pas vous, quelqu'un essaie peut-être de deviner votre mot de passe : s'il est court ou que vous l'utilisez ailleurs, choisissez-en un nouveau.
+
+L'équipe <%%= t("application_name") %>

data/lib/trek/admin_ip_allowlist.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+
+module Trek
+  # Restricts the admin (/admin and below, the sign-in page included) to the IP addresses and ranges in
+  # ADMIN_ALLOWED_IPS, separated by commas or spaces: "203.0.113.0/24, 2001:db8::/32, 198.51.100.7".
+  # From anywhere else, the admin doesn't exist: a 404, as for an unknown URL, rather than a redirect
+  # to the sign-in page. Off when ADMIN_ALLOWED_IPS is unset or empty; read when the app starts.
+  #
+  # The address is `request.remote_ip`: behind a proxy or a CDN, list its ranges in
+  # `config.action_dispatch.trusted_proxies`, or every request seems to come from it (docs: proxies).
+  #
+  # Inserted after ActionDispatch::DebugExceptions (Trek::Engine): after RemoteIp, which works out the
+  # address, and inside ShowExceptions, which turns the routing error into the app's 404 page.
+  class AdminIpAllowlist
+    PATH = %r{\A/admin(/|\z)}
+
+    def initialize(app, allowed = ENV.fetch("ADMIN_ALLOWED_IPS", nil))
+      @app = app
+      @ranges = parse(allowed)
+    end
+
+    def call(env)
+      if @ranges.any? && env["PATH_INFO"].to_s.match?(PATH) && !allowed?(ActionDispatch::Request.new(env).remote_ip)
+        # The same error, and log line, as for a URL no route matches
+        raise ActionController::RoutingError, "No route matches [#{env["REQUEST_METHOD"]}] #{env["PATH_INFO"].inspect}"
+      end
+
+      @app.call(env)
+    end
+
+    private
+
+    def parse(allowed)
+      allowed.to_s.split(/[\s,]+/).reject(&:empty?).map do |range|
+        IPAddr.new(range)
+      rescue IPAddr::Error
+        raise ArgumentError, "ADMIN_ALLOWED_IPS: #{range.inspect} is neither an IP address nor a range"
+      end
+    end
+
+    def allowed?(remote_ip)
+      ip = IPAddr.new(remote_ip.to_s)
+      # An IPv4 address may come as IPv6 ("::ffff:203.0.113.5")
+      ip = ip.native if ip.ipv4_mapped?
+      @ranges.any? { |range| range.family == ip.family && range.include?(ip) }
+    rescue IPAddr::Error
+      false
+    end
+  end
+end

data/lib/trek/csp_reports.rb

@@ -0,0 +1,99 @@
+# frozen_string_literal: true
+
+require "json"
+require "uri"
+
+module Trek
+  # A Content Security Policy violation, as an error for AppSignal (Trek::CspReportsController)
+  class CspViolation < StandardError; end
+
+  # The violations in a Content Security Policy report, as browsers send them to the policy's
+  # report-uri: `application/csp-report` (`{"csp-report": {…}}`), or the Reporting API's
+  # `application/reports+json` (`[{"type": "csp-violation", "body": {…}}]`).
+  #
+  # Kept: the app's own pages only (a report can claim any page), and not what browser extensions
+  # inject or load, which makes most reports and says nothing about the app. As anyone can forge a
+  # report, it must be plausible too: a known directive, and a keyword or a host name blocked.
+  #
+  # A violation keeps the page's path, without its query, which may carry a token, and the blocked
+  # resource's origin.
+  module CspReports
+    EXTENSION_SCHEMES = %w[chrome-extension moz-extension safari-extension safari-web-extension ms-browser-extension].freeze
+
+    # The directives a browser reports a violation of
+    DIRECTIVES = %w[
+      base-uri child-src connect-src default-src font-src form-action frame-ancestors frame-src img-src
+      manifest-src media-src object-src require-trusted-types-for script-src script-src-attr
+      script-src-elem style-src style-src-attr style-src-elem trusted-types worker-src
+    ].freeze
+    # What a browser reports as blocked instead of a URL
+    KEYWORDS = %w[inline eval wasm-eval data blob trusted-types-policy trusted-types-sink].freeze
+    # Schemes of a blocked URL, which keeps its origin
+    SCHEMES = %w[http https ws wss].freeze
+    HOST_NAME = /\A(?=.{1,253}\z)[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*\z/i
+
+    Violation = Struct.new(:directive, :blocked, :page, :disposition, keyword_init: true) do
+      def to_s
+        "#{directive} blocked #{blocked} on #{page} (#{disposition})"
+      end
+    end
+
+    # The violations about pages of `host`
+    def self.parse(body, host:)
+      reports = JSON.parse(body)
+      fields =
+        if reports.is_a?(Array)
+          reports.select { |report| report.is_a?(Hash) && report["type"] == "csp-violation" }.map { |report| report["body"] }
+        elsif reports.is_a?(Hash)
+          [reports["csp-report"]]
+        end
+      Array(fields).select { |field| field.is_a?(Hash) }.filter_map { |field| violation(field, host:) }
+    rescue JSON::ParserError
+      []
+    end
+
+    def self.violation(fields, host:)
+      page = parse_uri(fields["document-uri"] || fields["documentURL"])
+      return unless page&.host == host
+
+      blocked = fields["blocked-uri"] || fields["blockedURL"]
+      source = fields["source-file"] || fields["sourceFile"]
+      return if [blocked, source].any? { |uri| extension?(uri) }
+
+      directive = fields["effective-directive"] || fields["effectiveDirective"] || fields["violated-directive"].to_s.split.first
+      blocked = origin(blocked)
+      return unless DIRECTIVES.include?(directive) && blocked
+
+      Violation.new(
+        directive:,
+        blocked:,
+        page: page.path.presence || "/",
+        disposition: fields["disposition"] || "enforce"
+      )
+    end
+    private_class_method :violation
+
+    # A URL's origin, or the keyword a browser reports instead ("inline", "eval", "data"…); nil when
+    # it's neither
+    def self.origin(value)
+      uri = parse_uri(value)
+      return KEYWORDS.find { |keyword| keyword == (value.to_s.presence || "inline") } unless uri&.host
+      return unless SCHEMES.include?(uri.scheme) && uri.host.match?(HOST_NAME)
+
+      "#{uri.scheme}://#{uri.host}#{":#{uri.port}" unless uri.port == uri.default_port}"
+    end
+    private_class_method :origin
+
+    def self.extension?(value)
+      EXTENSION_SCHEMES.include?(value.to_s.split(":", 2).first)
+    end
+    private_class_method :extension?
+
+    def self.parse_uri(value)
+      URI.parse(value.to_s)
+    rescue URI::InvalidURIError
+      nil
+    end
+    private_class_method :parse_uri
+  end
+end