trek 2.3.1 → 2.4.0

data/lib/generators/trek/install_generator.rb

@@ -12,25 +12,25 @@ module Trek
       source_root File.expand_path("templates", __dir__)
 
       def install_dotfiles_and_tooling
-        generate "trek:install:ruby"
-        generate "trek:install:package_json"
-        generate "trek:install:yarn"
-
-        generate "trek:install:brakeman"
-        generate "trek:install:bundler_audit"
-        generate "trek:install:editorconfig"
-        generate "trek:install:esbuild"
-        generate "trek:install:eslint"
-        generate "trek:install:lefthook"
-        generate "trek:install:postcss"
-        generate "trek:install:prettier"
-        generate "trek:install:procfiles"
-        generate "trek:install:prosopite"
-        generate "trek:install:rubocop"
-        generate "trek:install:slim_lint"
-        generate "trek:install:stylelint"
-        generate "trek:install:kaminari"
-        generate "trek:install:lookbook"
+        generate_inline "trek:install:ruby"
+        generate_inline "trek:install:package_json"
+        generate_inline "trek:install:yarn"
+
+        generate_inline "trek:install:brakeman"
+        generate_inline "trek:install:bundler_audit"
+        generate_inline "trek:install:editorconfig"
+        generate_inline "trek:install:esbuild"
+        generate_inline "trek:install:eslint"
+        generate_inline "trek:install:lefthook"
+        generate_inline "trek:install:postcss"
+        generate_inline "trek:install:prettier"
+        generate_inline "trek:install:procfiles"
+        generate_inline "trek:install:prosopite"
+        generate_inline "trek:install:rubocop"
+        generate_inline "trek:install:slim_lint"
+        generate_inline "trek:install:stylelint"
+        generate_inline "trek:install:kaminari"
+        generate_inline "trek:install:lookbook"
 
         run "yarn install", abort_on_failure: true
       end
@@ -60,100 +60,101 @@ module Trek
       end
 
       def setup_config
-        generate "trek:install:config"
+        generate_inline "trek:install:config"
+        generate_inline "trek:install:security_headers"
       end
 
       def install_specs
-        generate "trek:install:specs"
+        generate_inline "trek:install:specs"
       end
 
       def install_strip_attributes
-        generate "trek:install:strip_attributes"
+        generate_inline "trek:install:strip_attributes"
       end
 
       def install_emails
-        generate "trek:install:postmark"
-        generate "trek:install:mailer"
+        generate_inline "trek:install:postmark"
+        generate_inline "trek:install:mailer"
       end
 
       def install_monitoring
-        generate "trek:install:appsignal"
+        generate_inline "trek:install:appsignal"
       end
 
       def install_user
-        generate "trek:install:user"
+        generate_inline "trek:install:user"
       end
 
       def install_authentication
-        generate "trek:install:authentication"
+        generate_inline "trek:install:authentication"
       end
 
       def install_authorization
-        generate "trek:install:authorization"
+        generate_inline "trek:install:authorization"
       end
 
       def install_healthcheck
-        generate "trek:install:healthcheck"
+        generate_inline "trek:install:healthcheck"
       end
 
       def install_translations
-        generate "trek:install:translations"
+        generate_inline "trek:install:translations"
       end
 
       def add_locales_generator
-        generate "trek:install:locales"
+        generate_inline "trek:install:locales"
       end
 
       def install_attachments
-        generate "trek:install:attachments"
-        generate "trek:install:uploaders"
+        generate_inline "trek:install:attachments"
+        generate_inline "trek:install:uploaders"
       end
 
       def install_models
-        generate "trek:install:page"
-        generate "trek:install:current"
-        generate "trek:install:fragment"
-        generate "trek:install:menu_node"
-        generate "trek:install:external_link"
-        generate "trek:install:model_specs"
+        generate_inline "trek:install:page"
+        generate_inline "trek:install:current"
+        generate_inline "trek:install:fragment"
+        generate_inline "trek:install:menu_node"
+        generate_inline "trek:install:external_link"
+        generate_inline "trek:install:model_specs"
       end
 
       def install_ci
-        generate "trek:install:ci"
+        generate_inline "trek:install:ci"
       end
 
       def install_makefile
-        generate "trek:install:makefile"
+        generate_inline "trek:install:makefile"
       end
 
       def install_readme
-        generate "trek:install:readme"
+        generate_inline "trek:install:readme"
       end
 
       def install_agents
-        generate "trek:install:agents"
+        generate_inline "trek:install:agents"
       end
 
       def install_admin
-        generate "trek:install:admin"
-        generate "trek:install:admin:routes"
-        generate "trek:install:admin:fragments"
-        generate "trek:install:admin:pages"
-        generate "trek:install:admin:user_password_resets"
-        generate "trek:install:admin:user_sessions"
-        generate "trek:install:admin:users"
+        generate_inline "trek:install:admin"
+        generate_inline "trek:install:admin:routes"
+        generate_inline "trek:install:admin:fragments"
+        generate_inline "trek:install:admin:pages"
+        generate_inline "trek:install:admin:user_password_resets"
+        generate_inline "trek:install:admin:user_sessions"
+        generate_inline "trek:install:admin:users"
       end
 
       def install_assets
-        generate "trek:install:assets"
+        generate_inline "trek:install:assets"
       end
 
       def install_component_index
-        generate "trek:install:component"
+        generate_inline "trek:install:component"
       end
 
       def install_application_files
-        generate "trek:install:application"
+        generate_inline "trek:install:application"
       end
 
       def run_migrations
@@ -173,7 +174,7 @@ module Trek
         say ""
         say "Create an admin user with:"
         say ""
-        say "    rails g trek:admin:user --email admin@example.com --password azerty123"
+        say "    rails g trek:admin:user --email admin@example.com --password ************"
         say ""
         say "Then start the server:"
         say ""
@@ -183,6 +184,13 @@ module Trek
 
       private
 
+      # Runs a generator in this process rather than in a new `rails generate`, which boots the app
+      # again: for Trek's 50-odd generators, that took about two minutes. Other gems' generators keep
+      # their own process (`generate`), as they may need a gem this run just added to the Gemfile.
+      def generate_inline(name)
+        generate name, inline: true
+      end
+
       def ascii_art
         <<~ASCII
                 ██████▌                                     ██████▌

data/lib/generators/trek/taxonomies_generator.rb

@@ -44,6 +44,11 @@ module Trek
           "app/policies/admin/tag_category_policy.rb"
       end
 
+      def copy_model_specs
+        template "spec/models/tag_spec.rb",
+          "spec/models/tag_spec.rb"
+      end
+
       def copy_policy_specs
         template "spec/policies/admin/tag_policy_spec.rb",
           "spec/policies/admin/tag_policy_spec.rb"

data/lib/generators/trek/templates/.gitlab-ci.yml

@@ -158,6 +158,22 @@ bundler-audit:
   script:
     - bundle exec bundle-audit check --update
 
+# Software Bill of Materials (CycloneDX): the gems and npm packages in the lockfiles, with their licenses.
+# Uncomment the job when a client asks for one.
+# GitLab keeps each branch's latest one by default, past `expire_in`: hand over the one of the production branch.
+# cdxgen runs with an empty environment (env -i), so neither it nor its dependencies see the CI's tokens.
+# sbom:
+#   <<: *security_definition
+#   script:
+#     - env -i PATH="$PATH" HOME="$HOME" FETCH_LICENSE=true npx --yes @cyclonedx/cdxgen@12.8.6 --type ruby --type js --no-recurse --output sbom.cdx.json .
+#   artifacts:
+#     name: "sbom-${CI_COMMIT_REF_SLUG}"
+#     expire_in: 1 month
+#     paths:
+#       - sbom.cdx.json
+#     reports:
+#       cyclonedx: sbom.cdx.json
+
 #
 # Deploy
 #
@@ -173,7 +189,7 @@ bundler-audit:
 #     - main
 #   environment:
 #     name: qa
-#     url: https://qa.temoanadiving.com
+#     url: https://qa.example.com
 #   script:
 #     - curl $HATCHBOX_WEBHOOK_QA -X POST
 
@@ -183,6 +199,6 @@ bundler-audit:
 #     - production
 #   environment:
 #     name: preprod
-#     url: https://temoanadiving.com
+#     url: https://example.com
 #   script:
 #     - curl $HATCHBOX_WEBHOOK_PROD -X POST

data/lib/generators/trek/templates/controllers/admin/active_sessions_controller.rb

@@ -0,0 +1,21 @@
+module Admin
+  # Signs out browsers signed in as the current user, listed on their profile's sessions tab. Only
+  # theirs: every query goes through Current.user.sessions.
+  class ActiveSessionsController < Admin::BaseController
+    def destroy
+      Current.user.sessions.find(params[:id]).destroy
+      redirect_to sessions_tab, notice: t(".success")
+    end
+
+    def destroy_others
+      Current.user.sessions.where.not(id: Current.session.id).destroy_all
+      redirect_to sessions_tab, notice: t(".success")
+    end
+
+    private
+
+    def sessions_tab
+      admin_user_path(Current.user, anchor: "sessions")
+    end
+  end
+end

data/lib/generators/trek/templates/controllers/admin/audit_logs_controller.rb

@@ -0,0 +1,30 @@
+module Admin
+  class AuditLogsController < Trek::ResourceController
+    include Trek::Filters
+    include Trek::Pagination
+    include Trek::Scopes
+
+    helper Trek::AuditLogsHelper
+
+    def index
+      super
+      @objects = @objects.includes(:actor, :auditable)
+      apply_filters!
+      apply_scopes!
+    end
+
+    private
+
+    def model
+      AuditLog
+    end
+
+    def available_filters
+      %i[action actor_type actor_id auditable_type auditable_id]
+    end
+
+    def available_scopes
+      %i[failures]
+    end
+  end
+end

data/lib/generators/trek/templates/controllers/admin/passkey_sessions_controller.rb

@@ -0,0 +1,41 @@
+module Admin
+  # Signing in with a passkey instead of a password, from the sign-in form
+  class PasskeySessionsController < ApplicationController
+    include Trek::Authentication
+    include Trek::Passkeys
+
+    allow_unauthenticated_access
+    rate_limit to: 10, within: 3.minutes, only: :create, with: -> { redirect_to new_admin_user_session_path, alert: t("notices.rate_limited") }
+
+    # What the browser needs to offer the site's passkeys, fetched when the sign-in form opens
+    def options
+      render_passkey_options User.passkey_request_options(passkey_relying_party)
+    end
+
+    def create
+      @user = User.privileged.authenticate_by_passkey(passkey_relying_party, params[:credential], challenge: take_passkey_challenge)
+
+      if @user
+        # A passkey proves it's them: failed passwords no longer lock them out
+        @user.record_successful_sign_in!
+        start_new_session_for @user
+        record_sign_in_of @user
+        redirect_to after_authentication_url, notice: sign_in_notice(@user)
+      else
+        redirect_to new_admin_user_session_path, alert: t(".failure")
+      end
+    end
+
+    private
+
+    # In the user's language: this request isn't signed in yet, so it's still in the app's default one.
+    def sign_in_notice(user)
+      I18n.with_locale(user.locale || I18n.default_locale) { t("admin.user_sessions.create.success") }
+    end
+
+    # For the audit log (Trek::Auditable): the account signed in to
+    def audit_target
+      @user
+    end
+  end
+end

data/lib/generators/trek/templates/controllers/admin/passkeys_controller.rb

@@ -0,0 +1,37 @@
+module Admin
+  # Passkeys the current user adds and deletes, on their profile's passkeys tab. Only theirs: every
+  # query goes through Current.user.passkeys.
+  class PasskeysController < Admin::BaseController
+    include Trek::Passkeys
+
+    helper Trek::UserAgentsHelper
+
+    # What the browser needs to create a passkey, fetched when the user adds one
+    def options
+      render_passkey_options Current.user.passkey_creation_options(passkey_relying_party)
+    end
+
+    def create
+      # Shown when Trek doesn't know the passkey's provider
+      browser = helpers.user_agent_summary(request.user_agent)
+      passkey = Current.user.add_passkey(passkey_relying_party, params[:credential], challenge: take_passkey_challenge, name: browser)
+
+      if passkey
+        redirect_to passkeys_tab, notice: t(".success")
+      else
+        redirect_to passkeys_tab, alert: t(".failure")
+      end
+    end
+
+    def destroy
+      Current.user.passkeys.find(params[:id]).destroy
+      redirect_to passkeys_tab, notice: t(".success"), status: :see_other
+    end
+
+    private
+
+    def passkeys_tab
+      admin_user_path(Current.user, anchor: "passkeys")
+    end
+  end
+end

data/lib/generators/trek/templates/controllers/admin/user_password_resets_controller.rb

@@ -18,9 +18,9 @@ module Admin
     end
 
     def create
-      if user = User.privileged.find_by(email: params[:email])
-        Admin::PasswordsMailer.reset(user).deliver_later
-      end
+      # Queued whatever the email, and answered the same: the response doesn't tell whether an
+      # account exists.
+      Admin::PasswordResetJob.perform_later(params[:email].to_s)
 
       redirect_to new_admin_user_session_path, notice: t(".success")
     end
@@ -37,7 +37,7 @@ module Admin
       end
 
       @user.update!(params.permit(:password))
-      @user.user_sessions.destroy_all
+      @user.sessions.destroy_all
       redirect_to new_admin_user_session_path, notice: t(".success")
     rescue ActiveRecord::RecordInvalid
       redirect_to edit_admin_user_password_reset_path(@token), alert: @user.errors.full_messages.join(", ")

data/lib/generators/trek/templates/controllers/admin/user_sessions_controller.rb

@@ -2,8 +2,13 @@ module Admin
   class UserSessionsController < ApplicationController
     include Trek::Authentication
 
+    # Failed sign-ins from one IP address, whatever the account, over a longer window than
+    # rate_limit's. Counted in Rails.cache, as rate_limit is.
+    FAILED_SIGN_INS_PER_IP = 20
+    FAILED_SIGN_INS_WINDOW = 1.hour
+
     allow_unauthenticated_access only: %i[new create]
-    rate_limit to: 5, within: 3.minutes, only: :create, with: -> { redirect_to new_admin_user_session_path, alert: t("notices.rate_limited") }
+    rate_limit to: 5, within: 3.minutes, only: :create, with: -> { render_rate_limited }
 
     helper Trek::I18nHelper
     helper Trek::ThemeHelper
@@ -19,11 +24,22 @@ module Admin
     end
 
     def create
-      if user = User.privileged.authenticate_by(session_params)
+      return render_rate_limited if too_many_failed_sign_ins_from_ip?
+
+      # Hashes the password typed even when no user matches, so the response takes as long
+      user = User.privileged.authenticate_by(session_params)
+      @user = user || User.privileged.find_by(email: params[:email].to_s)
+
+      # A locked user is refused even with the right password, with the same answer as a wrong one
+      if user && !user.sign_in_locked?
+        user.record_successful_sign_in!
         start_new_session_for user
-        redirect_to after_authentication_url, notice: t(".success")
+        record_sign_in_of user
+        redirect_to after_authentication_url, notice: sign_in_notice(user)
       else
-        redirect_to new_admin_user_session_path, alert: t(".failure")
+        @user&.record_failed_sign_in!
+        count_failed_sign_in_from_ip
+        render_sign_in_form t(".failure"), status: :unprocessable_entity
       end
     end
 
@@ -34,8 +50,41 @@ module Admin
 
     private
 
+    # In the user's language: this request isn't signed in yet, so it's still in the app's default one.
+    def sign_in_notice(user)
+      I18n.with_locale(user.locale || I18n.default_locale) { t(".success") }
+    end
+
     def session_params
       params.permit(:email, :password)
     end
+
+    # Rendered rather than redirected to, so the audit log records the failure's status
+    def render_sign_in_form(alert, status:)
+      @email = params[:email].presence
+      flash.now[:alert] = alert
+      render :new, status:
+    end
+
+    def render_rate_limited
+      render_sign_in_form t("notices.rate_limited"), status: :too_many_requests
+    end
+
+    def too_many_failed_sign_ins_from_ip?
+      Rails.cache.read(failed_sign_ins_from_ip_key).to_i >= FAILED_SIGN_INS_PER_IP
+    end
+
+    def count_failed_sign_in_from_ip
+      Rails.cache.increment(failed_sign_ins_from_ip_key, 1, expires_in: FAILED_SIGN_INS_WINDOW)
+    end
+
+    def failed_sign_ins_from_ip_key
+      "admin/failed_sign_ins/#{request.remote_ip}"
+    end
+
+    # For the audit log (Trek::Auditable): the account signed in to, or tried
+    def audit_target
+      @user
+    end
   end
 end

data/lib/generators/trek/templates/controllers/admin/users_controller.rb

@@ -1,5 +1,17 @@
 module Admin
   class UsersController < Trek::ResourceController
+    helper Trek::UserAgentsHelper
+
+    # On their own profile, users also see the browsers signed in as them (the sessions tab), and
+    # their passkeys.
+    def show
+      super
+      return unless @object == Current.user
+
+      @sessions = Current.user.sessions.active.recent_first
+      @passkeys = Current.user.passkeys.order(:created_at)
+    end
+
     def new
       super
       @object.role = "editor"
@@ -12,6 +24,14 @@ module Admin
       @object.password = SecureRandom.alphanumeric(24) if @object.password.blank?
     end
 
+    # After a suspected compromise: every user, this admin included, must choose a new password at
+    # their next request.
+    def require_password_renewal
+      authorize! User, to: :require_password_renewal?
+      User.require_password_renewal!
+      redirect_to admin_users_path, notice: t(".success")
+    end
+
     def theme
       value = params[:theme].to_s
       Current.user.update!(theme: value) if User.themes.key?(value)

data/lib/generators/trek/templates/controllers/concerns/trek/authentication.rb

@@ -22,15 +22,32 @@ module Trek::Authentication
   end
 
   def require_authentication
-    resume_session || request_authentication
+    return request_authentication unless resume_session
+
+    renew_password if Current.user.try(:password_renewal_needed?)
+  end
+
+  # An expired password, or one an admin asked everyone to renew, must be changed before going on:
+  # signs out and opens the new password form.
+  def renew_password
+    token = Current.user.password_reset_token
+    terminate_session
+    redirect_to edit_admin_user_password_reset_path(token), alert: t("notices.password_renewal_needed")
   end
 
   def resume_session
     Current.session ||= find_session_by_cookie
   end
 
+  # A session past its idle timeout or lifetime is dropped: the user signs in again.
   def find_session_by_cookie
-    UserSession.find_by(id: cookies.signed[:session_id]) if cookies.signed[:session_id]
+    return unless cookies.signed[:session_id]
+
+    user_session = User::Session.find_by(id: cookies.signed[:session_id])
+    return user_session unless user_session&.expired?
+
+    user_session.destroy
+    nil
   end
 
   def request_authentication
@@ -43,20 +60,54 @@ module Trek::Authentication
   end
 
   def start_new_session_for(user)
-    user.user_sessions.create!(user_agent: request.user_agent).tap do |session|
+    user.sessions.create!(user_agent: request.user_agent, ip_address: request.remote_ip).tap do |session|
       Current.session = session
-      cookies.signed.permanent[:session_id] = { value: session.id, httponly: true, same_site: :lax }
+      # Its IP address's host name, for the active sessions list, without slowing the sign-in down
+      Trek::ResolveSessionHostnameJob.perform_later(session)
+      cookies.signed[:session_id] = {
+        value: session.id, expires: User::Session.lifetime.from_now, httponly: true, same_site: :lax
+      }
     end
   end
 
+  # Records the sign-in as the user's current one, and emails them when this browser never signed
+  # in as them before (unless it's their first sign-in, or the app turned it off).
+  def record_sign_in_of(user)
+    new_browser = !signed_in_from_this_browser?(user)
+    remember_sign_in_from_this_browser(user)
+    user.record_sign_in(ip: request.remote_ip, user_agent: request.user_agent)
+    return unless new_browser && user.last_sign_in_at && user.new_sign_in_email
+
+    AdminMailer.new_sign_in(
+      user, at: user.current_sign_in_at, ip: request.remote_ip, user_agent: request.user_agent
+    ).deliver_later
+  end
+
+  # The users who signed in from this browser, in a signed cookie kept for years
+  def signed_in_from_this_browser?(user)
+    Array(cookies.signed[:trek_known_users]).include?(user.id)
+  end
+
+  def remember_sign_in_from_this_browser(user)
+    user_ids = (Array(cookies.signed[:trek_known_users]) | [user.id]).last(20)
+    cookies.signed.permanent[:trek_known_users] = { value: user_ids, httponly: true, same_site: :lax }
+  end
+
   def terminate_session
     Current.session.destroy
     cookies.delete(:session_id)
   end
 
+  # At most once every User::Session.activity_interval (5 minutes), so browsing doesn't write on
+  # every page.
   def track_last_activity
-    # rubocop:disable Rails/SkipsModelValidations
-    Current.user&.update_columns(last_activity_at: Time.current)
-    # rubocop:enable Rails/SkipsModelValidations
+    # Not after signing out, which destroys the session
+    return unless Current.session&.persisted?
+
+    Current.session.record_activity
+    last_activity_at = Current.user.last_activity_at
+    return if last_activity_at && last_activity_at > User::Session.activity_interval.ago
+
+    Current.user.update_columns(last_activity_at: Time.current) # rubocop:disable Rails/SkipsModelValidations
   end
 end

data/lib/generators/trek/templates/helpers/application_helper.rb

@@ -3,10 +3,6 @@ module ApplicationHelper
   #   stylesheet_link_tag("https://fonts.googleapis.com/css2?family=Poppins:wght@400;500;600;700&display=swap")
   # end
 
-  def admin_webfonts_link_tag
-    stylesheet_link_tag("https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&display=swap")
-  end
-
   def admin_full_brand
     [
       t("admin.brand.title"),

data/lib/generators/trek/templates/initializers/audit_log.rb

@@ -0,0 +1,11 @@
+# Records an AuditLog row for each mutation in the admin (see Trek::Auditable), including sign-ins
+# and password resets. Include Trek::Auditable in another controller to audit it too.
+Rails.application.config.to_prepare do
+  [
+    Trek::BaseController,
+    Admin::BaseController,
+    Admin::UserSessionsController,
+    Admin::PasskeySessionsController,
+    Admin::UserPasswordResetsController
+  ].each { |controller| controller.include(Trek::Auditable) }
+end