trek 2.3.2 → 2.4.0

data/lib/generators/trek/templates/spec/models/user_spec.rb

@@ -47,15 +47,15 @@ RSpec.describe User do
       expect(user).to be_invalid
     end
 
-    it "requires a password of at least 8 characters on creation" do
-      user.password = "short"
+    it "requires a password of at least 12 characters on creation" do
+      user.password = "Sh0rt-but-1"
 
       expect(user).to be_invalid
     end
 
-    it "requires a password of at least 8 characters when changing it" do
+    it "requires a password of at least 12 characters when changing it" do
       user = users.create
-      user.password = "short"
+      user.password = "Sh0rt-but-1"
 
       expect(user).to be_invalid
     end
@@ -68,6 +68,144 @@ RSpec.describe User do
     end
   end
 
+  describe "previous passwords" do
+    let(:user) { users.create }
+
+    it "refuses the current password" do
+      user.password = users.password
+
+      expect(user).to be_invalid
+    end
+
+    it "refuses one of the last passwords" do
+      %w[second-password-2! third-password-3! fourth-password-4! fifth-password-5!].each { |password| user.update!(password:) }
+      user.password = users.password
+
+      expect(user).to be_invalid
+    end
+
+    it "accepts a password older than the last ones" do
+      %w[second-password-2! third-password-3! fourth-password-4! fifth-password-5! sixth-password-6!].each { |password| user.update!(password:) }
+      user.password = users.password
+
+      expect(user).to be_valid
+    end
+
+    it "keeps no more digests than needed" do
+      %w[second-password-2! third-password-3! fourth-password-4! fifth-password-5! sixth-password-6!].each { |password| user.update!(password:) }
+
+      expect(user.previous_passwords.count).to eq(described_class.password_history_size - 1)
+    end
+
+    it "deletes the digests with the user" do
+      user.update!(password: "second-password-2!")
+
+      expect { user.destroy }.to change(User::PreviousPassword, :count).by(-1)
+    end
+  end
+
+  describe "sign-in lockout" do
+    include ActiveSupport::Testing::TimeHelpers
+
+    let(:user) { users.create }
+
+    def fail_sign_ins(count)
+      count.times { user.record_failed_sign_in! }
+    end
+
+    # Each failure once the previous lock is over, as while locked they don't count
+    def fail_sign_ins_after_locks(count)
+      count.times do
+        travel_to(user.sign_in_locked_until + 1.second) if user.sign_in_locked?
+        user.record_failed_sign_in!
+      end
+    end
+
+    it "locks signing in after the failures allowed" do
+      fail_sign_ins(described_class.sign_in_lockout_after)
+
+      expect(user.sign_in_locked_until).to be_within(1.second).of(described_class.sign_in_lockout_duration.from_now)
+    end
+
+    it "doesn't lock before" do
+      fail_sign_ins(described_class.sign_in_lockout_after - 1)
+
+      expect(user.sign_in_locked?).to be(false)
+    end
+
+    it "doubles the lock on each further failure" do
+      fail_sign_ins_after_locks(described_class.sign_in_lockout_after + 2)
+
+      expect(user.sign_in_locked_until).to be_within(1.second).of((described_class.sign_in_lockout_duration * 4).from_now)
+    end
+
+    it "never locks for longer than the maximum" do
+      fail_sign_ins_after_locks(described_class.sign_in_lockout_after + 30)
+
+      expect(user.sign_in_locked_until).to be_within(1.second).of(described_class.sign_in_lockout_max.from_now)
+    end
+
+    it "doesn't count failures while locked" do
+      fail_sign_ins(described_class.sign_in_lockout_after + 3)
+
+      expect(user.failed_sign_in_count).to eq(described_class.sign_in_lockout_after)
+    end
+
+    it "unlocks with a new password" do
+      fail_sign_ins(described_class.sign_in_lockout_after)
+
+      user.update!(password: "second-password-2!")
+
+      expect([user.sign_in_locked?, user.failed_sign_in_count]).to eq([false, 0])
+    end
+
+    it "starts the count over after a successful sign-in" do
+      fail_sign_ins(described_class.sign_in_lockout_after - 1)
+
+      user.record_successful_sign_in!
+
+      expect(user.reload.failed_sign_in_count).to eq(0)
+    end
+  end
+
+  describe "password policy" do
+    def password_errors(password, **attributes)
+      users.new(password:, **attributes).tap(&:validate).errors.details[:password].pluck(:error)
+    end
+
+    it "accepts a short password with a digit and a symbol" do
+      expect(password_errors("Brume-de-l1n")).to be_empty
+    end
+
+    it "requires a digit and a symbol in a password shorter than a passphrase" do
+      expect(password_errors("brumedelinxyz")).to include(:digit_and_symbol)
+    end
+
+    it "accepts a long passphrase made of letters only" do
+      expect(password_errors("velo orange sous la pluie")).to be_empty
+    end
+
+    it "refuses a common password, whatever its case and punctuation" do
+      expect(password_errors("Password123!")).to include(:common)
+    end
+
+    it "refuses a password built on a keyboard or number sequence" do
+      expect(password_errors("Azerty-2026!x")).to include(:sequence)
+    end
+
+    it "refuses a password repeating a character" do
+      expect(password_errors("Gaaaaa-2026!x")).to include(:sequence)
+    end
+
+    it "refuses a password containing the user's email" do
+      expect(password_errors("Lovelace-1815!", email: "ada.lovelace@example.com")).to include(:personal)
+    end
+
+    it "refuses a password containing the user's name" do
+      expect(password_errors("Byron-1815!xyz", name: "Ada Byron")).to include(:personal)
+    end
+  end
+
   describe "email" do
     it "is stored in lower case, without surrounding spaces" do
       expect(users.create(email: " Ada@Example.com ").email).to eq("ada@example.com")

data/lib/generators/trek/templates/spec/requests/admin/active_sessions_spec.rb

@@ -0,0 +1,119 @@
+require "rails_helper"
+
+RSpec.describe "Admin active sessions", type: :request do
+  include ActiveSupport::Testing::TimeHelpers
+
+  let(:editor) { users.create(role: :editor) }
+  let(:safari) { "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15" }
+  let(:firefox) { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0" }
+
+  def sign_in(user)
+    post admin_user_session_path, params: { email: user.email, password: users.password }, headers: { "User-Agent" => safari }
+  end
+
+  def come_back_after(duration)
+    travel duration
+    get admin_root_path
+  end
+
+  it "looks the host name of the address up after signing in, not during it" do
+    expect { sign_in(editor) }.to have_enqueued_job(Trek::ResolveSessionHostnameJob)
+  end
+
+  it "records the host name of the address signing in" do
+    allow(Trek::ReverseDns).to receive(:hostname).and_return("host.example.net")
+
+    perform_enqueued_jobs { sign_in(editor) }
+
+    expect(editor.sessions.last.ip_hostname).to eq("host.example.net")
+  end
+
+  describe "expiry" do
+    it "signs the user out after idle_timeout without a request" do
+      sign_in(editor)
+      travel User::Session.idle_timeout + 1.minute
+
+      get admin_root_path
+
+      expect(response).to redirect_to(new_admin_user_session_path)
+    end
+
+    it "keeps the user signed in while requests come in" do
+      sign_in(editor)
+      come_back_after(User::Session.idle_timeout - 1.hour)
+
+      come_back_after(User::Session.idle_timeout - 1.hour)
+
+      expect(response).to have_http_status(:ok)
+    end
+
+    it "records the activity at most once every activity_interval" do
+      sign_in(editor)
+      get admin_root_path
+      travel 1.minute
+
+      expect { get admin_root_path }.not_to(change { editor.reload.last_activity_at })
+    end
+  end
+
+  describe "the sessions tab of the user's profile" do
+    let!(:other_session) { editor.sessions.create!(user_agent: firefox, ip_address: "203.0.113.7") }
+
+    before { sign_in(editor) }
+
+    it "lists the user's sessions with their browser and IP address" do
+      get admin_user_path(editor)
+
+      expect(response.body).to include("Safari on macOS").and include("Firefox on Windows").and include("203.0.113.7")
+    end
+
+    it "shows an IP address's host name on hover" do
+      other_session.update!(ip_hostname: "host.example.net")
+
+      get admin_user_path(editor)
+
+      expect(response.body).to include('<abbr title="host.example.net">203.0.113.7</abbr>')
+    end
+
+    it "leaves out other users' sessions" do
+      users.create(role: :editor).sessions.create!(user_agent: firefox, ip_address: "198.51.100.9")
+
+      get admin_user_path(editor)
+
+      expect(response.body).not_to include("198.51.100.9")
+    end
+
+    it "signs another session out" do
+      expect { delete admin_active_session_path(other_session) }.to change(User::Session, :count).by(-1)
+    end
+
+    it "goes back to the sessions tab" do
+      delete admin_active_session_path(other_session)
+
+      expect(response).to redirect_to(admin_user_path(editor, anchor: "sessions"))
+    end
+
+    it "doesn't sign out another user's session" do
+      stranger = users.create(role: :editor).sessions.create!
+
+      delete admin_active_session_path(stranger)
+
+      expect(User::Session.exists?(stranger.id)).to be(true)
+    end
+
+    it "signs out every other session, and keeps this one" do
+      delete others_admin_active_sessions_path
+      get admin_root_path
+
+      expect([editor.sessions.count, response.status]).to eq([1, 200])
+    end
+  end
+
+  it "shows no sessions tab on another user's profile" do
+    sign_in(users.create(role: :admin))
+
+    get admin_user_path(editor)
+
+    expect(response.body).not_to include('href="#sessions"')
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/audit_logs_spec.rb

@@ -0,0 +1,149 @@
+require "rails_helper"
+
+RSpec.describe "Admin audit log", type: :request do
+  let(:admin) { users.create(role: :admin) }
+
+  before { seed "cases/page_tree" }
+
+  def sign_in(user)
+    post admin_user_session_path, params: { email: user.email, password: users.password }
+  end
+
+  describe "recording" do
+    before { sign_in(admin) }
+
+    it "records a change with its author, request, target and status" do
+      patch admin_page_path(pages.team), params: { page: { title: "The team" } }
+
+      expect(AuditLog.recent.first).to have_attributes(
+        actor: admin, action: "admin/pages#update", http_method: "PATCH", path: admin_page_path(pages.team),
+        auditable: pages.team, http_status: 302, error_class: nil
+      )
+    end
+
+    it "records the parameters by name, without the values the form sent" do
+      patch admin_page_path(pages.team), params: { page: { title: "The team" } }
+
+      expect(AuditLog.recent.first.params).to include("id" => pages.team.id.to_s, "page" => { "title" => "[FILTERED]" })
+    end
+
+    it "records the value of a role change" do
+      editor = users.create(role: :editor)
+
+      patch admin_user_path(editor), params: { user: { role: "admin" } }
+
+      expect(AuditLog.recent.first.params).to include("user" => { "role" => "admin" })
+    end
+
+    it "records a deleted record as the target" do
+      page = pages.team
+
+      delete admin_page_path(page)
+
+      expect(AuditLog.recent.first).to have_attributes(auditable_type: "Page", auditable_id: page.id)
+    end
+
+    it "records the error a failed request raised" do
+      patch admin_page_path(id: 0), params: { page: { title: "Missing" } }
+
+      expect(AuditLog.recent.first).to have_attributes(error_class: "ActiveRecord::RecordNotFound", http_status: nil)
+    end
+
+    it "records nothing for a read" do
+      expect { get admin_pages_path }.not_to change(AuditLog, :count)
+    end
+
+    it "records nothing for a HEAD request either" do
+      expect { head admin_pages_path }.not_to change(AuditLog, :count)
+    end
+
+    it "records nothing when switched off with FEATURE_AUDIT_LOG=false" do
+      allow(ENV).to receive(:fetch).and_call_original
+      allow(ENV).to receive(:fetch).with("FEATURE_AUDIT_LOG", "true").and_return("false")
+
+      expect { patch admin_page_path(pages.team), params: { page: { title: "The team" } } }
+        .not_to change(AuditLog, :count)
+    end
+
+    context "when the row can't be written" do
+      before do
+        allow(AuditLog).to receive(:create!).and_raise(ActiveRecord::StatementInvalid)
+        allow(Rails.error).to receive(:report)
+        patch admin_page_path(pages.team), params: { page: { title: "The team" } }
+      end
+
+      it "still completes the request" do
+        expect(pages.team.reload.title).to eq("The team")
+      end
+
+      it "reports the failure" do
+        expect(Rails.error).to have_received(:report).with(an_instance_of(ActiveRecord::StatementInvalid), anything)
+      end
+    end
+  end
+
+  describe "recording sign-ins" do
+    it "records a failed sign-in, without its password" do
+      post admin_user_session_path, params: { email: admin.email, password: "wrong" }
+
+      expect(AuditLog.recent.first).to have_attributes(
+        actor: nil, action: "admin/user_sessions#create", params: hash_including("password" => "[FILTERED]")
+      )
+    end
+
+    it "records a failed sign-in as a failure, on the account tried" do
+      post admin_user_session_path, params: { email: admin.email, password: "wrong" }
+
+      expect(AuditLog.failures.for_auditable(admin)).to exist
+    end
+
+    it "records a change attempted without signing in" do
+      patch admin_page_path(pages.team), params: { page: { title: "Hacked" } }
+
+      expect(AuditLog.recent.first).to have_attributes(actor: nil, action: "admin/pages#update", http_status: 302)
+    end
+  end
+
+  describe "listing" do
+    before { sign_in(admin) }
+
+    it "lists the rows" do
+      get admin_audit_logs_path
+
+      expect(response.body).to include("admin/user_sessions#create")
+    end
+
+    it "filters the rows on a record", :aggregate_failures do
+      AuditLog.create!(action: "admin/pages#update", http_method: "PATCH", path: "/", auditable: pages.team)
+      AuditLog.create!(action: "admin/pages#destroy", http_method: "DELETE", path: "/", auditable: pages.company)
+
+      get admin_audit_logs_path(filters: { auditable_type: "Page", auditable_id: pages.team.id })
+
+      expect(response.body).to include("admin/pages#update")
+      expect(response.body).not_to include("admin/pages#destroy")
+    end
+
+    it "lists the failures only", :aggregate_failures do
+      AuditLog.create!(action: "admin/pages#update", http_method: "PATCH", path: "/", http_status: 422)
+
+      get admin_audit_logs_path(scopes: { failures: 1 })
+
+      expect(response.body).to include("admin/pages#update")
+      expect(response.body).not_to include("admin/user_sessions#create")
+    end
+
+    it "shows a row" do
+      get admin_audit_log_path(AuditLog.recent.first)
+
+      expect(response.body).to include("admin/user_sessions#create")
+    end
+  end
+
+  it "is closed to an editor" do
+    sign_in(users.create(role: :editor))
+
+    get admin_audit_logs_path
+
+    expect(response).to redirect_to(admin_root_path)
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/passkey_sessions_spec.rb

@@ -0,0 +1,103 @@
+require "rails_helper"
+# Not loaded with the gem: it stands in for a browser with an authenticator
+require "webauthn/fake_client"
+
+RSpec.describe "Admin sign-in with a passkey", type: :request do
+  let(:editor) { users.create(role: :editor) }
+  # A browser with an authenticator, on the app's test host
+  let(:client) { WebAuthn::FakeClient.new("http://www.example.com") }
+
+  # The passkey the editor added from their profile, then signed out
+  before do
+    post admin_user_session_path, params: { email: editor.email, password: users.password }
+    get options_admin_passkeys_path, as: :json
+    credential = client.create(challenge: response.parsed_body["challenge"], user_verified: true)
+    post admin_passkeys_path, params: { credential: credential.to_json }
+    delete admin_user_session_path
+  end
+
+  def request_challenge
+    get options_admin_passkey_session_path, as: :json
+    response.parsed_body["challenge"]
+  end
+
+  # The bytes the passkey was created for, which the browser sends back encoded
+  def sign_in(challenge: request_challenge, user_verified: true, user_handle: WebAuthn.standard_encoder.decode(editor.reload.webauthn_id))
+    credential = client.get(challenge:, user_verified:, user_handle:)
+    post admin_passkey_session_path, params: { credential: credential.to_json }
+  end
+
+  it "asks for any of the site's passkeys, verifying the user" do
+    get options_admin_passkey_session_path, as: :json
+
+    expect(response.parsed_body).to include("allowCredentials" => [], "userVerification" => "required")
+  end
+
+  it "signs the user in" do
+    sign_in
+
+    expect(response).to redirect_to(admin_root_url)
+  end
+
+  # A passkey can't be guessed: failed passwords don't keep its owner out
+  it "lets in a user whose password sign-in is locked, and unlocks it" do
+    User.sign_in_lockout_after.times do
+      post admin_user_session_path, params: { email: editor.email, password: "not the password" }
+    end
+
+    sign_in
+
+    expect([response.location, editor.reload.sign_in_locked?, editor.failed_sign_in_count]).to eq([admin_root_url, false, 0])
+  end
+
+  it "records the passkey's use" do
+    sign_in
+
+    expect(editor.passkeys.sole.last_used_at).to be_present
+  end
+
+  it "refuses a passkey that doesn't verify the user" do
+    sign_in(user_verified: false)
+
+    expect(response).to redirect_to(new_admin_user_session_path)
+  end
+
+  it "refuses a signature of another challenge" do
+    request_challenge
+    sign_in(challenge: WebAuthn.generate_user_id)
+
+    expect(response).to redirect_to(new_admin_user_session_path)
+  end
+
+  it "refuses to reuse a challenge" do
+    challenge = request_challenge
+    sign_in(challenge:)
+    delete admin_user_session_path
+
+    sign_in(challenge:)
+
+    expect(response).to redirect_to(new_admin_user_session_path)
+  end
+
+  it "refuses a passkey created for another user than the one it's stored for" do
+    sign_in(user_handle: WebAuthn.standard_encoder.decode(WebAuthn.generate_user_id))
+
+    expect(response).to redirect_to(new_admin_user_session_path)
+  end
+
+  it "refuses a deleted passkey" do
+    editor.passkeys.destroy_all
+
+    sign_in
+
+    expect(response).to redirect_to(new_admin_user_session_path)
+  end
+
+  it "refuses a user who is no longer privileged" do
+    editor.update!(role: :reader)
+
+    sign_in
+
+    expect(response).to redirect_to(new_admin_user_session_path)
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/passkeys_spec.rb

@@ -0,0 +1,104 @@
+require "rails_helper"
+# Not loaded with the gem: it stands in for a browser with an authenticator
+require "webauthn/fake_client"
+
+RSpec.describe "Admin passkeys", type: :request do
+  let(:editor) { users.create(role: :editor) }
+  # A browser with an authenticator, on the app's test host
+  let(:client) { WebAuthn::FakeClient.new("http://www.example.com") }
+  let(:safari) { "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15" }
+
+  before { post admin_user_session_path, params: { email: editor.email, password: users.password } }
+
+  def creation_options
+    get options_admin_passkeys_path, as: :json
+    response.parsed_body
+  end
+
+  def add_passkey(user_verified: true)
+    challenge = creation_options["challenge"]
+    credential = client.create(challenge:, user_verified:).to_json
+    post admin_passkeys_path, params: { credential: }, headers: { "User-Agent" => safari }
+  end
+
+  it "asks the authenticator to keep the passkey and verify the user" do
+    expect(creation_options["authenticatorSelection"]).to include("residentKey" => "required", "userVerification" => "required")
+  end
+
+  it "excludes the user's passkeys, so an authenticator holding one says so" do
+    add_passkey
+
+    expect(creation_options["excludeCredentials"].pluck("id")).to eq(editor.passkeys.pluck(:external_id))
+  end
+
+  it "adds a passkey, with its transports and the AAGUID saying what keeps it" do
+    add_passkey
+
+    expect(editor.passkeys.sole).to have_attributes(transports: ["internal"], aaguid: match(/\A\h{8}-\h{4}-\h{4}-\h{4}-\h{12}\z/))
+  end
+
+  it "shows it under its password manager's name" do
+    allow(Trek::PasskeyProviders).to receive(:[]).and_return("Passwords")
+
+    add_passkey
+
+    expect(editor.passkeys.sole.to_s).to eq("Passwords")
+  end
+
+  it "shows it under the browser it was added from when its password manager is unknown" do
+    allow(Trek::PasskeyProviders).to receive(:[]).and_return(nil)
+
+    add_passkey
+
+    expect(editor.passkeys.sole.to_s).to eq(I18n.t("trek.user_agents.browser_on_system", browser: "Safari", system: "macOS"))
+  end
+
+  it "goes back to the passkeys tab once added" do
+    add_passkey
+
+    expect(response).to redirect_to(admin_user_path(editor, anchor: "passkeys"))
+  end
+
+  it "refuses a passkey that doesn't verify the user" do
+    add_passkey(user_verified: false)
+
+    expect(editor.passkeys).to be_empty
+  end
+
+  it "refuses a passkey created for another challenge" do
+    creation_options
+    post admin_passkeys_path, params: { credential: client.create(challenge: WebAuthn.generate_user_id).to_json }
+
+    expect(editor.passkeys).to be_empty
+  end
+
+  it "refuses to reuse a challenge" do
+    challenge = creation_options["challenge"]
+    post admin_passkeys_path, params: { credential: client.create(challenge:, user_verified: true).to_json }
+    post admin_passkeys_path, params: { credential: client.create(challenge:, user_verified: true).to_json }
+
+    expect(editor.passkeys.count).to eq(1)
+  end
+
+  it "deletes a passkey" do
+    add_passkey
+
+    expect { delete admin_passkey_path(editor.passkeys.sole) }.to change(User::Passkey, :count).by(-1)
+  end
+
+  it "doesn't touch another user's passkey" do
+    other = users.create(role: :editor).passkeys.create!(name: "Theirs", external_id: "theirs", public_key: "key")
+
+    delete admin_passkey_path(other)
+
+    expect(response).to have_http_status(:not_found)
+  end
+
+  it "lists the passkeys on the user's profile" do
+    add_passkey
+
+    get admin_user_path(editor)
+
+    expect(response.body).to include(editor.passkeys.sole.to_s)
+  end
+end