trek 2.3.1 → 2.4.0

data/config/locales/trek.en.yml

@@ -1,20 +1,20 @@
 ---
 en:
   activerecord:
-    models:
-      fragment:
-        gender: "n"
-        one: Fragment
-        other: Fragments
-      page:
-        gender: "n"
-        one: Page
-        other: Pages
-      user:
-        gender: "n"
-        one: User
-        other: Users
     attributes:
+      audit_log:
+        action: Action
+        actor: Author
+        auditable: Target
+        created_at: Date
+        error_class: Error
+        http_method: Method
+        http_status: Status
+        ip_address: IP address
+        params: Parameters
+        path: Path
+        request_id: Request ID
+        user_agent: User agent
       fragment:
         content: Content
         key: Key
@@ -30,6 +30,41 @@ en:
         role: Role
         send_invite: Send invitation by email
         theme: Theme
+      user/passkey:
+        name: Name
+    errors:
+      models:
+        user:
+          attributes:
+            password:
+              common: is among the most common passwords, choose a less predictable one
+              digit_and_symbol: must contain a digit and a symbol, unless it is at least %{count} characters long
+              personal: must not contain your name or email
+              pwned: appears in known data breaches, choose another one
+              recently_used:
+                one: is your current password, choose another one
+                other: is one of your last %{count} passwords, choose another one
+              sequence: must not contain a sequence such as 12345, azerty or aaaaa
+    models:
+      audit_log:
+        gender: "n"
+        one: Audit log
+        other: Audit logs
+      fragment:
+        gender: "n"
+        one: Fragment
+        other: Fragments
+      page:
+        gender: "n"
+        one: Page
+        other: Pages
+      user:
+        gender: "n"
+        one: User
+        other: Users
+      user/passkey:
+        one: Passkey
+        other: Passkeys
   admin:
     actions:
       all: All
@@ -40,18 +75,30 @@ en:
       logout: Log out
       manage: Manage
       new_resource:
-        n: New %{resource}
-      reorder_resource:
-        n: Reorder %{resources}
+        "n": New %{resource}
       remove: Remove
+      reorder_resource:
+        "n": Reorder %{resources}
       replace: Replace
       search_resource:
-        n: Search for a %{resource}
-      see_website: See website
+        "n": Search for a %{resource}
       see_on_website: See on website
+      see_original: See original
+      see_website: See website
       validate: Validate
       write: Write
+    active_sessions:
+      destroy:
+        success: Session signed out
+      destroy_others:
+        success: Signed out everywhere else
     attachments: Attachments
+    audit_logs:
+      index:
+        failures: Failures (%{count})
+        intro: Changes made in the admin, by whom and on what
+      show:
+        intro: Audit log entry
     authentication:
       not_authenticated: Please log in
       not_authorized: You are not authorized to perform this action
@@ -59,8 +106,8 @@ en:
       "false": "No"
       "true": "Yes"
     brand:
-      title: Admin panel
       subtitle: Trek v%{version}
+      title: Admin panel
     content: Content
     content_editor:
       link:
@@ -149,6 +196,15 @@ en:
           success: Action added
         form:
           title: Action
+    passkey_sessions:
+      create:
+        failure: Signing in with this passkey didn't work, please try again
+    passkeys:
+      create:
+        failure: The passkey couldn't be added, please try again
+        success: Passkey added
+      destroy:
+        success: Passkey deleted
     passwords_mailer:
       reset:
         subject: Reset your password
@@ -166,21 +222,25 @@ en:
     seo: SEO
     settings: Settings
     user_password_resets:
-      not_found: Invalid or expired password reset link.
       create:
-        success: A password recovery email has been sent to you
+        success: A link to choose a new password has been sent to you (unless no account matches this email)
+      edit:
+        rules: At least %{min} characters with a digit and a symbol, or at least %{passphrase} characters.
       new:
         remembered_password: I found my password!
+      not_found: Invalid or expired password reset link.
       update:
         success: Your password has been changed
     user_sessions:
       create:
-        failure: Connection failure, please check your credentials
-        success: You are now logged in
+        failure: Wrong email or password. After several failures in a row, signing in is paused for a few minutes.
+        success: You're signed in, welcome!
       destroy:
         success: You are now logged out
       new:
         forgot_password: I forgot my password
+        passkey: Sign in with a passkey
+        passkey_failure: Signing in with a passkey didn't work, please try again.
     users:
       create:
         success: User added
@@ -191,24 +251,61 @@ en:
         intro: Updating the user
       index:
         intro: Management of admin panel users
+        require_password_renewal: Ask everyone for a new password
+        require_password_renewal_confirm: Every user, you included, will have to choose a new password at their next action. Use it when a compromise is suspected.
       new:
         intro: Adding a user to the admin panel
+      passkeys:
+        add: Add a passkey
+        added: Added on %{date}
+        already_added: This device or password manager already has a passkey for your account.
+        delete: Delete
+        delete_confirm: You won't be able to sign in with this passkey anymore. Also delete it from your device or password manager.
+        failure: The passkey couldn't be added, please try again.
+        intro: Sign in with your fingerprint, face or device PIN instead of your password. The passkey stays on your device or in your password manager.
+        last_used: Last used %{time} ago
+        never_used: Never used
+        title: Sign in without a password
+      require_password_renewal:
+        success: Every user will have to choose a new password
       search:
         alert: No user found with email
+      sessions:
+        change_password: Change your password
+        current: This browser
+        intro: Sign out any you don't recognize.
+        last_activity: Last activity %{time} ago
+        not_you_html: Not you? %{change_password}.
+        previous_sign_in: Previous sign-in
+        sign_out: Sign out
+        sign_out_others: Sign out everywhere else
+        sign_out_others_confirm: Every other browser signed in to your account will be signed out.
+        signed_in: Signed in on %{date}
+        title: Browsers currently signed in to this account
       show:
+        active_sessions: Active sessions
         intro: User profile
-        profil: Profile
+        passkeys: Passkeys
+        profile: Profile
         subscription: Subscription
       update:
         success: User updated
-  application_name: "Trek"
-  views:
-    pagination:
-      first: First
-      last: Last
-      next: Next
-      prev: Prev
-      truncate: …
+  admin_mailer:
+    invite:
+      subject: Your invitation
+    new_sign_in:
+      subject: New sign-in to your account
+    sign_in_locked:
+      subject: Signing in to your account is paused
+  application_name: Trek
+  errors:
+    messages:
+      disposable: is a disposable email address, use a permanent one
+  notices:
+    authentication_needed: Please log in
+    password_renewal_needed: "Your password must be renewed: choose a new one"
+    rate_limited: Too many attempts, please try again later
+    unauthorized: You are not allowed to do that
   trek:
     dialog_component:
       text: This action cannot be undone.
@@ -241,9 +338,17 @@ en:
           list: List
     list_component:
       empty: No item.
+    password_strength:
+      fair: Fair
+      strong: Strong
+      too_short: Too short
+      weak: Weak
     search_component:
       reset: Reset search
       search: Search
+    user_agents:
+      browser_on_system: "%{browser} on %{system}"
+      unknown: Unknown browser
   user:
     locale:
       en: English
@@ -258,10 +363,10 @@ en:
       auto: auto
       dark: dark
       light: light
-  admin_mailer:
-    invite:
-      subject: Your invitation
-  notices:
-    authentication_needed: Please log in
-    rate_limited: Too many attempts, please try again later
-    unauthorized: You are not allowed to do that
+  views:
+    pagination:
+      first: First
+      last: Last
+      next: Next
+      prev: Prev
+      truncate: "…"

data/config/locales/trek.fr.yml

@@ -1,20 +1,20 @@
 ---
 fr:
   activerecord:
-    models:
-      fragment:
-        gender: m
-        one: Fragment
-        other: Fragments
-      page:
-        gender: f
-        one: Page
-        other: Pages
-      user:
-        gender: m_alt
-        one: Utilisateur
-        other: Utilisateurs
     attributes:
+      audit_log:
+        action: Action
+        actor: Auteur
+        auditable: Cible
+        created_at: Date
+        error_class: Erreur
+        http_method: Méthode
+        http_status: Statut
+        ip_address: Adresse IP
+        params: Paramètres
+        path: Chemin
+        request_id: Identifiant de requête
+        user_agent: Agent utilisateur
       fragment:
         content: Contenu
         key: Clé
@@ -30,6 +30,41 @@ fr:
         role: Rôle
         send_invite: Envoyer une invitation par e-mail
         theme: Thème
+      user/passkey:
+        name: Nom
+    errors:
+      models:
+        user:
+          attributes:
+            password:
+              common: fait partie des mots de passe les plus courants, choisissez-en un moins prévisible
+              digit_and_symbol: doit contenir un chiffre et un caractère spécial, sauf s'il fait au moins %{count} caractères
+              personal: ne doit pas contenir votre nom ni votre adresse e-mail
+              pwned: figure dans des fuites de données connues, choisissez-en un autre
+              recently_used:
+                one: est votre mot de passe actuel, choisissez-en un autre
+                other: fait partie de vos %{count} derniers mots de passe, choisissez-en un autre
+              sequence: ne doit pas contenir de suite comme 12345, azerty ou aaaaa
+    models:
+      audit_log:
+        gender: f
+        one: Entrée d'audit
+        other: Entrées d'audit
+      fragment:
+        gender: m
+        one: Fragment
+        other: Fragments
+      page:
+        gender: f
+        one: Page
+        other: Pages
+      user:
+        gender: m_alt
+        one: Utilisateur
+        other: Utilisateurs
+      user/passkey:
+        one: Clé d'accès
+        other: Clés d'accès
   admin:
     actions:
       all: Tout
@@ -40,27 +75,39 @@ fr:
       logout: Se déconnecter
       manage: Gérer
       new_resource:
-        "n": Nouveau ou nouvelle %{resource}
         f: Nouvelle %{resource}
         m: Nouveau %{resource}
         m_alt: Nouvel %{resource}
+        "n": Nouveau ou nouvelle %{resource}
+      remove: Enlever
       reorder_resource:
-        "n": Réorganiser les %{resources}
         f: Réorganiser les %{resources}
         m: Réorganiser les %{resources}
         m_alt: Réorganiser les %{resources}
-      remove: Enlever
+        "n": Réorganiser les %{resources}
       replace: Remplacer
       search_resource:
-        "n": Rechercher un·e %{resources}
         f: Rechercher une %{resource}
         m: Rechercher un %{resource}
         m_alt: Rechercher un %{resource}
-      see_website: Voir le site
+        "n": Rechercher un·e %{resources}
       see_on_website: Voir sur le site
+      see_original: Voir l'original
+      see_website: Voir le site
       validate: Valider
       write: Écrire
+    active_sessions:
+      destroy:
+        success: Session déconnectée
+      destroy_others:
+        success: Déconnecté partout ailleurs
     attachments: Fichiers attachés
+    audit_logs:
+      index:
+        failures: Échecs (%{count})
+        intro: Modifications faites dans l'admin, par qui et sur quoi
+      show:
+        intro: Entrée du journal d'audit
     authentication:
       not_authenticated: Veuillez vous connecter
       not_authorized: Vous n'avez pas le droit d'effectuer cette action
@@ -68,8 +115,8 @@ fr:
       "false": Non
       "true": Oui
     brand:
-      title: Espace d'administration
       subtitle: Trek v%{version}
+      title: Espace d'administration
     content: Contenu
     content_editor:
       link:
@@ -117,8 +164,8 @@ fr:
         intro: Fragment
       update:
         success: Fragment mis à jour
-    navigation: Navigation
     metadata: Métadonnées
+    navigation: Navigation
     pages:
       create:
         success: Page ajoutée
@@ -158,6 +205,15 @@ fr:
           success: Action ajoutée
         form:
           title: Action
+    passkey_sessions:
+      create:
+        failure: La connexion avec cette clé d'accès n'a pas fonctionné, veuillez réessayer
+    passkeys:
+      create:
+        failure: La clé d'accès n'a pas pu être ajoutée, veuillez réessayer
+        success: Clé d'accès ajoutée
+      destroy:
+        success: Clé d'accès supprimée
     passwords_mailer:
       reset:
         subject: Nouveau mot de passe
@@ -175,21 +231,25 @@ fr:
     seo: SEO
     settings: Paramètres
     user_password_resets:
-      not_found: Lien de réinitialisation de mot de passe invalide ou expiré.
       create:
-        success: Un e-mail de récupération de mot de passe vous a été envoyé
+        success: Un lien pour choisir un nouveau mot de passe vous a été envoyé (sauf si aucun compte ne correspond à cette adresse e-mail)
+      edit:
+        rules: Au moins %{min} caractères avec un chiffre et un caractère spécial, ou au moins %{passphrase} caractères.
       new:
         remembered_password: J'ai retrouvé mon mot de passe !
+      not_found: Lien de réinitialisation de mot de passe invalide ou expiré.
       update:
         success: Votre mot de passe a été modifié
     user_sessions:
       create:
-        failure: Erreur de connexion, vérifiez vos identifiants
-        success: Vous êtes maintenant connecté·e
+        failure: Adresse e-mail ou mot de passe incorrect. Après plusieurs échecs d'affilée, la connexion est suspendue quelques minutes.
+        success: Vous êtes connecté·e, bienvenue !
       destroy:
         success: Vous êtes maintenant déconnecté·e
       new:
         forgot_password: J'ai oublié mon mot de passe
+        passkey: Se connecter avec une clé d'accès
+        passkey_failure: La connexion avec une clé d'accès n'a pas fonctionné, veuillez réessayer.
     users:
       create:
         success: Utilisateur ajouté
@@ -200,24 +260,61 @@ fr:
         intro: Mise à jour de l'utilisateur
       index:
         intro: Gestion des utilisateurs de l'espace d'administration
+        require_password_renewal: Demander un nouveau mot de passe à tous
+        require_password_renewal_confirm: Chaque utilisateur, vous compris, devra choisir un nouveau mot de passe à sa prochaine action. À utiliser en cas de compromission suspectée.
       new:
         intro: Ajout d'un utilisateur à l'espace d'administration
+      passkeys:
+        add: Ajouter une clé d'accès
+        added: Ajoutée le %{date}
+        already_added: Cet appareil ou ce gestionnaire de mots de passe a déjà une clé d'accès pour votre compte.
+        delete: Supprimer
+        delete_confirm: Vous ne pourrez plus vous connecter avec cette clé d'accès. Supprimez-la aussi de votre appareil ou de votre gestionnaire de mots de passe.
+        failure: La clé d'accès n'a pas pu être ajoutée, veuillez réessayer.
+        intro: Connectez-vous avec votre empreinte, votre visage ou le code de votre appareil plutôt qu'avec votre mot de passe. La clé d'accès reste sur votre appareil ou dans votre gestionnaire de mots de passe.
+        last_used: Utilisée il y a %{time}
+        never_used: Jamais utilisée
+        title: Se connecter sans mot de passe
+      require_password_renewal:
+        success: Chaque utilisateur devra choisir un nouveau mot de passe
       search:
         alert: Utilisateur non trouvé avec cette adresse e-mail
+      sessions:
+        change_password: Changez votre mot de passe
+        current: Ce navigateur
+        intro: Déconnectez ceux que vous ne reconnaissez pas.
+        last_activity: Dernière activité il y a %{time}
+        not_you_html: Ce n'était pas vous ? %{change_password}.
+        previous_sign_in: Connexion précédente
+        sign_out: Déconnecter
+        sign_out_others: Déconnecter partout ailleurs
+        sign_out_others_confirm: Tous les autres navigateurs connectés à votre compte seront déconnectés.
+        signed_in: Connexion le %{date}
+        title: Navigateurs actuellement connectés à ce compte
       show:
+        active_sessions: Sessions actives
         intro: Profil de l'utilisateur
-        profil: Profil
+        passkeys: Clés d'accès
+        profile: Profil
         subscription: Abonnement
       update:
         success: Utilisateur mis à jour
-  application_name: "Trek"
-  views:
-    pagination:
-      first: Première page
-      last: Dernière page
-      next: Suivant
-      prev: Précédent
-      truncate: …
+  admin_mailer:
+    invite:
+      subject: Votre invitation
+    new_sign_in:
+      subject: Nouvelle connexion à votre compte
+    sign_in_locked:
+      subject: La connexion à votre compte est suspendue
+  application_name: Trek
+  errors:
+    messages:
+      disposable: est une adresse e-mail jetable, utilisez-en une permanente
+  notices:
+    authentication_needed: Veuillez vous connecter
+    password_renewal_needed: "Votre mot de passe doit être renouvelé : choisissez-en un nouveau"
+    rate_limited: Trop de tentatives, veuillez réessayer plus tard
+    unauthorized: Vous n'êtes pas autorisé·e à faire cela
   trek:
     dialog_component:
       text: Cette action ne peut pas être annulée.
@@ -250,9 +347,17 @@ fr:
           list: Liste
     list_component:
       empty: Aucun élément
+    password_strength:
+      fair: Moyen
+      strong: Fort
+      too_short: Trop court
+      weak: Faible
     search_component:
       reset: Réinitialiser la recherche
       search: Rechercher
+    user_agents:
+      browser_on_system: "%{browser} sur %{system}"
+      unknown: Navigateur inconnu
   user:
     locale:
       en: anglais
@@ -267,10 +372,10 @@ fr:
       auto: auto
       dark: sombre
       light: clair
-  admin_mailer:
-    invite:
-      subject: Votre invitation
-  notices:
-    authentication_needed: Veuillez vous connecter
-    rate_limited: Trop de tentatives, veuillez réessayer plus tard
-    unauthorized: Vous n'êtes pas autorisé·e à faire cela
+  views:
+    pagination:
+      first: Première page
+      last: Dernière page
+      next: Suivant
+      prev: Précédent
+      truncate: "…"

data/docs/.vitepress/config.mjs

@@ -53,7 +53,9 @@ export default defineConfig({
           text: 'Guides',
           items: [
             { text: 'How to customize Trek', link: '/customize' },
-            { text: 'Deploying to Scalingo', link: '/deploy' }
+            { text: 'Deploying to Scalingo', link: '/deploy' },
+            { text: 'IP addresses behind a proxy', link: '/proxies' },
+            { text: 'Security and compliance', link: '/security' }
           ]
         },
         {
@@ -73,7 +75,9 @@ export default defineConfig({
             { text: 'Installer', link: '/reference/generators/install' },
             { text: 'Admin user', link: '/reference/generators/admin-user' },
             { text: 'Scaffold', link: '/reference/generators/scaffold' },
-            { text: 'Taxonomies', link: '/reference/generators/taxonomies' }
+            { text: 'Taxonomies', link: '/reference/generators/taxonomies' },
+            { text: 'Audit log', link: '/reference/generators/audit-log' },
+            { text: 'Security headers', link: '/reference/generators/security-headers' }
           ]
         },
         {
@@ -120,7 +124,8 @@ export default defineConfig({
             { text: 'Forms', link: '/reference/forms' },
             { text: 'Formatters', link: '/reference/formatters' },
             { text: 'Policies', link: '/reference/policies' },
-            { text: 'Uploaders', link: '/reference/uploaders' }
+            { text: 'Uploaders', link: '/reference/uploaders' },
+            { text: 'Validators', link: '/reference/validators' }
           ]
         },
         {

data/docs/deploy.md

@@ -44,6 +44,8 @@ production:
 
 Provision a PostgreSQL addon (`scalingo --app <app> addons-add postgresql <plan>`), push, and the app boots with `RAILS_ENV`, `RAILS_LOG_TO_STDOUT` and `RAILS_SERVE_STATIC_FILES` already set by the buildpack.
 
+Before going live, check what Trek expects from the hosting: backups, a shared cache store, the scheduled purges (see [Security and compliance](/security#what-trek-expects-from-the-hosting)).
+
 ## Options
 
 | Variable | Effect |

data/docs/proxies.md

@@ -0,0 +1,53 @@
+# Visitors' IP addresses behind a proxy
+
+Trek relies on `request.remote_ip`, the visitor's IP address as Rails works it out, in four places:
+
+- the **active sessions** list, on each user's profile;
+- the **audit log** (`ip_address`), when installed;
+- the **rate limits** on signing in and on password reset requests (5 attempts in 3 minutes per address);
+- the **admin's allowed addresses**, when set (see [below](#restricting-the-admin-to-ip-addresses)).
+
+## How Rails finds the address
+
+Requests rarely reach the app directly: a hosting platform's load balancer or router forwards them, and adds the visitor's address to the `X-Forwarded-For` header. Rails only believes that header when it comes from a proxy it trusts, by default local and private addresses (`ActionDispatch::RemoteIp::TRUSTED_PROXIES`). Platform routers usually connect from such private addresses, so `remote_ip` is the visitor's.
+
+## Behind a CDN or a web application firewall
+
+A CDN or a firewall in front of the app (Cloudflare, Imperva, Bunny…) adds another hop, from public addresses Rails doesn't trust. `remote_ip` is then the CDN's address for every request:
+
+- every session and every audit log row shows the same IP;
+- everyone shares one rate limit: a few failed sign-ins anywhere lock everyone out for 3 minutes.
+
+List the CDN's address ranges, which it publishes, in `config/application.rb`:
+
+```ruby
+# The CDN's ranges, from its documentation (e.g. https://www.cloudflare.com/ips/): without them,
+# remote_ip is the CDN's address instead of the visitor's.
+config.action_dispatch.trusted_proxies =
+  ActionDispatch::RemoteIp::TRUSTED_PROXIES + %w[
+    203.0.113.0/24
+    2001:db8::/32
+  ].map { |range| IPAddr.new(range) }
+```
+
+Keep Rails' own `TRUSTED_PROXIES` in the list. Only trust ranges you know: a trusted proxy is believed about the address it forwards, so a range too wide would let anyone choose the IP Trek records. When the CDN changes its ranges, update the list.
+
+## Checking
+
+Sign in from your own connection, then compare the address on your profile's **Active sessions** tab with the one a service such as `https://ifconfig.me` shows you. If it's your platform's or your CDN's address instead, add their ranges as above.
+
+## Passkeys
+
+A passkey is tied to the site's domain, and the browser signs the origin it was used on. Trek takes both from the request (`request.host` and `request.base_url`), so Rails must see the address the visitor typed: the original `Host` header, and `https`. Most platforms forward them (`X-Forwarded-Host`, `X-Forwarded-Proto`). If adding a passkey or signing in with one fails behind a proxy that terminates TLS without saying so, set `config.assume_ssl = true` in `config/environments/production.rb`.
+
+## Restricting the admin to IP addresses
+
+Some clients require the back office to be reachable from their network only. List the addresses and ranges allowed in `ADMIN_ALLOWED_IPS`, separated by commas or spaces:
+
+```sh
+ADMIN_ALLOWED_IPS="203.0.113.0/24, 2001:db8::/32, 198.51.100.7"
+```
+
+From anywhere else, `/admin` and everything below it, the sign-in page included, answers like an unknown URL: the app's 404 page, rather than a redirect to the sign-in page, so it doesn't even show there's an admin. The rest of the site is unaffected. Unset or empty, the admin is open to all, as by default. The variable is read when the app starts: restart it after a change. An entry that's neither an address nor a range stops it from starting.
+
+`Trek::AdminIpAllowlist`, a middleware Trek's engine adds, checks `request.remote_ip`: behind a CDN or a firewall, add their ranges to `trusted_proxies` first ([above](#behind-a-cdn-or-a-web-application-firewall)), or every request seems to come from the CDN, and the admin is closed to everyone, or open to all if the CDN's range is allowed. Check the address Rails sees as [above](#checking), from an allowed network, before setting the variable.

data/docs/reference/components.md

@@ -20,6 +20,7 @@ The main building blocks, all in the `Trek::` namespace:
 | `PaginationComponent` | Kaminari-backed pagination |
 | `ToasterComponent` / `ToastComponent` | flash notifications |
 | `HeadingComponent` | headings |
+| `SectionComponent` | a titled section of a page, with an optional hint under its heading |
 | `GateComponent` | authorization-based visibility gate |
 | `IconComponent` | SVG [icon](/reference/icons) renderer |
 | `Dashboard::SectionComponent` / `Dashboard::TileComponent` | dashboard sections of shortcut tiles |

data/docs/reference/controllers.md

@@ -75,7 +75,7 @@ with the chosen filter:
 ### Scopes
 
 `Trek::Scopes` filters by **named model scopes** rather than raw attributes. Declare the allowed scopes via
-`available_scopes`, then call `apply_scopes!` in your `index`. It also exposes `scope_counts` and
+`available_scopes`, then call `apply_scopes!` in your `index`; any other name in `params[:scopes]` is ignored. It also exposes `scope_counts` and
 `unscoped_objects` helpers (the per-scope match counts and the pre-scope collection) for building scope tabs:
 
 ```ruby