trek 2.3.2 → 2.4.0

data/app/controllers/concerns/trek/auditable.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+module Trek
+  # Records an AuditLog row for each request: who (`audit_actor`), what (`controller#action`, the
+  # HTTP method, path and parameter names), on which record (`audit_target`), and how it ended (the
+  # status, or the class of the error raised).
+  #
+  # Only mutations are recorded: GET and HEAD are skipped, unless a controller sets
+  # `self.audit_reads = true`. A read on sensitive data can be logged explicitly with `audit!`.
+  #
+  # Auditing never breaks the request: a failed write is reported through `Rails.error`.
+  # FEATURE_AUDIT_LOG=false switches it off, read on each request.
+  module Auditable
+    extend ActiveSupport::Concern
+
+    included do
+      class_attribute :audit_reads, default: false
+      # The parameters whose values are recorded, at any depth; the others are recorded by name only,
+      # so the log doesn't copy the data the forms send. `config.filter_parameters` still applies.
+      class_attribute :audit_param_values, default: %w[id role]
+
+      # Prepended so it wraps authentication too: requests refused or redirected by
+      # `require_authentication`, and failed sign-ins, are recorded as well.
+      prepend_around_action :record_audit_log
+    end
+
+    private
+
+    # Records `name` on `target` now, whatever the HTTP method, e.g. `audit!(:show_answers, @object)`
+    # in a GET action showing sensitive data.
+    def audit!(name, target = audit_target)
+      write_audit_log(action: name, target:) if Trek::Feature.audit_log?
+    end
+
+    def record_audit_log
+      return yield unless Trek::Feature.audit_log?
+      return yield if read_only_request? && !audit_reads
+
+      error = nil
+      begin
+        yield
+      rescue StandardError => e
+        error = e
+        raise
+      ensure
+        write_audit_log(status: (response.status unless error), error:)
+      end
+    end
+
+    # Rails answers `get?` with false for a HEAD, which uptime monitors use.
+    def read_only_request?
+      request.get? || request.head?
+    end
+
+    def write_audit_log(action: action_name, target: audit_target, status: nil, error: nil)
+      ::AuditLog.create!(
+        actor: audit_actor,
+        auditable: target,
+        action: "#{controller_path}##{action}",
+        http_method: request.request_method,
+        path: request.path,
+        http_status: status,
+        params: audit_params,
+        ip_address: request.remote_ip,
+        user_agent: request.user_agent,
+        request_id: request.request_id,
+        error_class: error&.class&.name,
+        **audit_attributes
+      )
+    rescue StandardError => e
+      Rails.error.report(e, handled: true, context: { action: "#{controller_path}##{action}" })
+    end
+
+    # Who made the request; nil when nobody is signed in.
+    def audit_actor
+      Current.user
+    end
+
+    # The record the action worked on: `@object`, as Trek::ResourceController sets it, once saved
+    # (not after a failed create) or destroyed. Override for other controllers.
+    def audit_target
+      @object if @object.is_a?(ActiveRecord::Base) && (@object.persisted? || @object.destroyed?)
+    end
+
+    # The request's parameter names, with the values of `audit_param_values` only.
+    def audit_params
+      redact_audit_values(request.filtered_parameters.except("controller", "action"))
+    end
+
+    def redact_audit_values(value, key = nil)
+      case value
+      when Hash then value.to_h { |k, v| [k, redact_audit_values(v, k)] }
+      when Array then value.map { |v| redact_audit_values(v, key) }
+      else audit_param_values.map(&:to_s).include?(key.to_s) ? value : "[FILTERED]"
+      end
+    end
+
+    # Values for the app's own columns, e.g. `{ event: audit_target.try(:event) }`.
+    def audit_attributes
+      {}
+    end
+  end
+end

data/app/controllers/concerns/trek/filters.rb

@@ -20,6 +20,8 @@ module Trek
       # rubocop:disable Rails/LexicallyScopedActionFilter
       after_action :ensure_filters_applied, only: :index
       # rubocop:enable Rails/LexicallyScopedActionFilter
+
+      helper_method :filter_params
     end
 
     def apply_filters(scope, filters)

data/app/controllers/concerns/trek/passkeys.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Trek
+  # The WebAuthn relying party and challenges, for controllers adding passkeys or signing in with one
+  # (Trek::Users::Passkeys).
+  module Passkeys
+    extend ActiveSupport::Concern
+
+    # How long the browser has to answer, and the user to touch their authenticator
+    CHALLENGE_LIFETIME = 5.minutes
+
+    private
+
+    # Passkeys belong to a domain: the request's, so they work on any environment without
+    # configuration, each with its own passkeys. Behind a proxy, it must pass the original host and
+    # scheme on (see the docs on proxies).
+    def passkey_relying_party
+      @passkey_relying_party ||= WebAuthn::RelyingParty.new(
+        id: request.host,
+        allowed_origins: [request.base_url],
+        name: t("application_name")
+      )
+    end
+
+    # Renders the options as JSON for the browser, keeping their challenge for the answer
+    def render_passkey_options(options)
+      session[:passkey_challenge] = { "value" => options.challenge, "at" => Time.current.to_i }
+      render json: options
+    end
+
+    # The challenge the browser was given, once only, and while it's fresh
+    def take_passkey_challenge
+      challenge = session.delete(:passkey_challenge) || {}
+      challenge["value"] if challenge["at"].to_i > CHALLENGE_LIFETIME.ago.to_i
+    end
+  end
+end

data/app/controllers/trek/csp_reports_controller.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module Trek
+  # Receives the reports browsers send about Content Security Policy violations, at the policy's
+  # report-uri (`post "csp-reports"`, from `trek:install:security_headers`). Each violation is logged,
+  # and reported to AppSignal when the app uses it: in a "csp" namespace, as one incident per
+  # directive and blocked origin, so a new violation is notified once.
+  #
+  # Anyone can send reports, so a flood mustn't bury the real violations in AppSignal: it gets each
+  # violation once an hour at most, and NEW_VIOLATIONS_PER_HOUR different ones at most, the others
+  # being logged only. Requests are rate-limited per IP address, and for all of them together. The
+  # counters are in Rails.cache: a cache per process or server counts on its own.
+  #
+  # Browsers send no CSRF token nor session: the endpoint needs neither, sets no cookie, and answers
+  # 204 (429 past the rate limits).
+  class CspReportsController < ActionController::Base # rubocop:disable Rails/ApplicationController
+    # A report is a few hundred bytes; the Reporting API may group a few
+    MAX_BODY = 64.kilobytes
+    NEW_VIOLATIONS_PER_HOUR = 20
+
+    # Browsers send no CSRF token; the endpoint only logs and reports, with no session nor user
+    skip_forgery_protection
+    # Rails 7.2+
+    if respond_to?(:rate_limit)
+      rate_limit to: 60, within: 1.minute, with: -> { head :too_many_requests }
+      # Against a flood from many addresses
+      rate_limit to: 600, within: 1.minute, by: -> { "all" }, with: -> { head :too_many_requests }
+    end
+
+    def create
+      body = request.body.read(MAX_BODY + 1).to_s
+      CspReports.parse(body, host: request.host).each { |violation| report(violation) } if body.bytesize <= MAX_BODY
+
+      head :no_content
+    end
+
+    private
+
+    def report(violation)
+      logger.warn("[CSP] #{violation}")
+      return unless defined?(::Appsignal) && ::Appsignal.respond_to?(:report_error) && first_this_hour?(violation)
+
+      ::Appsignal.report_error(CspViolation.new(violation.to_s)) do
+        ::Appsignal.set_namespace("csp")
+        ::Appsignal.set_action(incident(violation))
+        ::Appsignal.add_tags(page: violation.page, disposition: violation.disposition)
+      end
+    end
+
+    # AppSignal groups the violations by action: the directive and the blocked origin
+    def incident(violation)
+      "#{violation.directive} #{violation.blocked}"
+    end
+
+    # Not reported yet this hour, and among the hour's first new violations
+    def first_this_hour?(violation)
+      return false unless Rails.cache.write("trek/csp_reports/#{incident(violation)}", true, expires_in: 1.hour, unless_exist: true)
+
+      Rails.cache.increment("trek/csp_reports/new", 1, expires_in: 1.hour).to_i <= NEW_VIOLATIONS_PER_HOUR
+    end
+  end
+end

data/app/controllers/trek/resource_controller.rb

@@ -62,7 +62,13 @@ module Trek
     end
 
     def destroy
-      @object.destroy
+      # Refused by the model, e.g. with `dependent: :restrict_with_error`: says why
+      unless @object.destroy
+        return respond_to do |format|
+          format.html { redirect_back_or_to [:admin, @object], alert: @object.errors.full_messages.to_sentence }
+          format.json { render json: @object.errors, status: :unprocessable_entity }
+        end
+      end
 
       destroy_hook
 

data/app/helpers/trek/audit_logs_helper.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Trek
+  module AuditLogsHelper
+    # A record's name, linked to its admin page when the viewer may open it. Records without an
+    # admin page, or deleted since, show their name only.
+    def audit_log_record_link(record)
+      return if record.nil?
+      return record.to_s unless allowed_to?(:show?, record)
+
+      link_to record.to_s, [:admin, record]
+    rescue ActionPolicy::NotFound, NoMethodError, ActionController::UrlGenerationError
+      record.to_s
+    end
+
+    # The audit log of a record, for a button on its admin page.
+    def audit_log_path_for(record)
+      admin_audit_logs_path(filters: { auditable_type: record.class.polymorphic_name, auditable_id: record.id })
+    end
+  end
+end

data/app/helpers/trek/user_agents_helper.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Trek
+  module UserAgentsHelper
+    # Checked in order: Edge and Opera also name Chrome, Chrome also names Safari.
+    BROWSERS = {
+      "Edge" => %r{Edg/},
+      "Opera" => %r{OPR/},
+      "Firefox" => %r{Firefox/},
+      "Chrome" => %r{Chrome/},
+      "Safari" => %r{Safari/}
+    }.freeze
+
+    # Checked in order: an iPad also names Mac OS X, Android also names Linux.
+    SYSTEMS = {
+      "iOS" => /iPhone|iPad/,
+      "Android" => /Android/,
+      "macOS" => /Mac OS X/,
+      "Windows" => /Windows/,
+      "Linux" => /Linux/
+    }.freeze
+
+    # The browser and system a User-Agent header names, e.g. "Firefox on Windows"
+    def user_agent_summary(user_agent)
+      user_agent = user_agent.to_s
+      browser = BROWSERS.find { |_name, pattern| user_agent.match?(pattern) }&.first
+      system = SYSTEMS.find { |_name, pattern| user_agent.match?(pattern) }&.first
+
+      if browser && system
+        t("trek.user_agents.browser_on_system", browser:, system:)
+      else
+        browser || system || t("trek.user_agents.unknown")
+      end
+    end
+  end
+end

data/app/javascript/controllers/index.js

@@ -7,6 +7,9 @@ import { application } from "./application";
 import ElementController from "./element_controller";
 application.register("element", ElementController);
 
+import PasskeyController from "./passkey_controller";
+application.register("passkey", PasskeyController);
+
 import RemovableElementController from "./removable_element_controller";
 application.register("removable-element", RemovableElementController);
 

data/app/javascript/controllers/passkey_controller.js

@@ -0,0 +1,118 @@
+import { Controller } from "@hotwired/stimulus";
+
+// Undefined in browsers without WebAuthn, and unknown to ESLint's browser globals
+const { PublicKeyCredential } = window;
+
+// Adds a passkey, or signs in with one, from a form posting the credential: fetches the options
+// from the server, lets the browser create or get the credential, then submits the form with it.
+//
+// Its element stays hidden in browsers without WebAuthn's JSON methods (Safari before 18.4…), so
+// it also hides a link leading to passkeys, without any action. With `conditional`, the site's
+// passkeys are also offered in the autofill of the email field (`autocomplete="username webauthn"`).
+export default class extends Controller {
+  static targets = ["credential", "error", "alreadyAdded"];
+  static values = { optionsUrl: String, conditional: Boolean };
+
+  connect() {
+    if (!supported()) return;
+
+    this.element.hidden = false;
+    if (this.conditionalValue) this.offerInAutofill();
+  }
+
+  disconnect() {
+    this.autofill?.abort();
+  }
+
+  // Submitting the form (its button, or Enter in a field) creates the passkey first
+  submit(event) {
+    if (this.credentialTarget.value) return;
+
+    event.preventDefault();
+    this.create();
+  }
+
+  create() {
+    this.run((options) =>
+      navigator.credentials.create({
+        publicKey: PublicKeyCredential.parseCreationOptionsFromJSON(options),
+      })
+    );
+  }
+
+  get() {
+    // The button replaces the pending autofill request: the browser runs one at a time
+    this.autofill?.abort();
+    this.run((options) =>
+      navigator.credentials.get({
+        publicKey: PublicKeyCredential.parseRequestOptionsFromJSON(options),
+      })
+    );
+  }
+
+  async offerInAutofill() {
+    if (!(await PublicKeyCredential.isConditionalMediationAvailable?.())) {
+      return;
+    }
+
+    this.autofill = new AbortController();
+    const { signal } = this.autofill;
+    // The user asked for nothing yet: a failure here stays silent
+    this.run(
+      (options) =>
+        navigator.credentials.get({
+          publicKey: PublicKeyCredential.parseRequestOptionsFromJSON(options),
+          mediation: "conditional",
+          signal,
+        }),
+      { silent: true }
+    );
+  }
+
+  async run(ceremony, { silent = false } = {}) {
+    if (!silent) this.hideError();
+
+    try {
+      const credential = await ceremony(await this.fetchOptions());
+      this.credentialTarget.value = JSON.stringify(credential.toJSON());
+      this.element.requestSubmit();
+    } catch (error) {
+      if (!silent) this.showError(error);
+    }
+  }
+
+  async fetchOptions() {
+    const response = await fetch(this.optionsUrlValue, {
+      headers: { Accept: "application/json" },
+    });
+    if (!response.ok) throw new Error(`Passkey options: ${response.status}`);
+
+    return response.json();
+  }
+
+  showError(error) {
+    // Cancelled by the user, timed out, or replaced by another request: nothing to say
+    if (["NotAllowedError", "AbortError"].includes(error.name)) return;
+    // The authenticator already holds one of the user's passkeys
+    if (error.name === "InvalidStateError" && this.hasAlreadyAddedTarget) {
+      this.alreadyAddedTarget.hidden = false;
+    } else if (this.hasErrorTarget) {
+      this.errorTarget.hidden = false;
+    } else {
+      throw error;
+    }
+  }
+
+  hideError() {
+    [...this.errorTargets, ...this.alreadyAddedTargets].forEach((target) => {
+      target.hidden = true;
+    });
+  }
+}
+
+function supported() {
+  return (
+    PublicKeyCredential !== undefined &&
+    "parseCreationOptionsFromJSON" in PublicKeyCredential
+  );
+}

data/app/javascript/trek.js

@@ -1,5 +1,9 @@
 import "@hotwired/turbo-rails";
 import "./controllers";
 import "normalize.css";
+// The admin's font, served by the app rather than Google Fonts
+import "@fontsource/inter/400.css";
+import "@fontsource/inter/500.css";
+import "@fontsource/inter/600.css";
 import "../assets/stylesheets/trek/base.css";
 import "../components";

data/app/jobs/trek/audit_log/purge_job.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Trek
+  module AuditLog
+    # Deletes the audit log rows older than the retention window: 6 months by default, the low end of
+    # the CNIL's recommendation for logs (6 months to 1 year). Schedule it daily with the app's Active
+    # Job backend, e.g. a GoodJob cron entry.
+    # rubocop:disable Rails/ApplicationJob -- the gem can't rely on the host app's ApplicationJob
+    class PurgeJob < ActiveJob::Base
+      class_attribute :retention, default: 6.months
+
+      def perform(retention: self.class.retention)
+        ::AuditLog.older_than(retention.ago).in_batches(of: 1000).delete_all
+      end
+    end
+    # rubocop:enable Rails/ApplicationJob
+  end
+end

data/app/jobs/trek/purge_expired_sessions_job.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Trek
+  # Deletes the signed-in browsers past their idle timeout or lifetime (Trek::Users::SessionLifetime):
+  # they can't sign anyone in anymore. Schedule it daily with the app's Active Job backend, e.g. a
+  # GoodJob cron entry.
+  # rubocop:disable Rails/ApplicationJob -- the gem can't rely on the host app's ApplicationJob
+  class PurgeExpiredSessionsJob < ActiveJob::Base
+    def perform
+      ::User::Session.expired.in_batches(of: 1000).delete_all
+    end
+  end
+  # rubocop:enable Rails/ApplicationJob
+end

data/app/jobs/trek/resolve_session_hostname_job.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Trek
+  # Records the host name of the IP address a session signed in from (Trek::ReverseDns), after the
+  # sign-in rather than during it: the lookup can take up to a second.
+  # rubocop:disable Rails/ApplicationJob -- the gem can't rely on the host app's ApplicationJob
+  class ResolveSessionHostnameJob < ActiveJob::Base
+    # The session may be gone by then: signed out, or purged
+    discard_on ActiveJob::DeserializationError
+
+    def perform(session)
+      hostname = ReverseDns.hostname(session.ip_address)
+      session.update_column(:ip_hostname, hostname) if hostname # rubocop:disable Rails/SkipsModelValidations
+    end
+  end
+  # rubocop:enable Rails/ApplicationJob
+end

data/app/models/concerns/trek/audit_log.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Trek
+  # One row per audited request, written by Trek::Auditable. Append-only: rows are never updated,
+  # only purged after the retention window by Trek::AuditLog::PurgeJob.
+  module AuditLog
+    extend ActiveSupport::Concern
+
+    included do
+      belongs_to :actor, polymorphic: true, optional: true
+      belongs_to :auditable, polymorphic: true, optional: true
+
+      scope :for_actor, ->(actor) { where(actor:) }
+      scope :for_auditable, ->(auditable) { where(auditable:) }
+      scope :failures, -> { where(http_status: 400..).or(where.not(error_class: nil)) }
+      scope :recent, -> { order(created_at: :desc) }
+      scope :ordered, -> { recent }
+      scope :older_than, ->(time) { where(created_at: ...time) }
+    end
+
+    # Rows can't be changed once written; the purge uses delete_all, which skips this.
+    def readonly?
+      persisted? || super
+    end
+
+    def to_s
+      [created_at&.iso8601, action, http_status].compact.join(" – ")
+    end
+  end
+end

data/app/models/concerns/trek/users/passkeys.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module Trek
+  module Users
+    # Passkeys (WebAuthn credentials) a user signs in with instead of their password, through the
+    # webauthn gem. The authenticator must verify the user (fingerprint, face, PIN…), so a passkey is
+    # two factors in itself: something they have, and something they are or know.
+    #
+    # The relying party, which ties passkeys to the site's domain, comes from the controller
+    # (Trek::Passkeys), as does the challenge each ceremony signs.
+    #
+    # Needs the `user_passkeys` table (User::Passkey) and the users' `webauthn_id` column.
+    module Passkeys
+      extend ActiveSupport::Concern
+
+      included do
+        has_many :passkeys, dependent: :destroy
+      end
+
+      class_methods do
+        # Asks for any passkey of the site, so the user picks theirs without typing their email
+        def passkey_request_options(relying_party)
+          relying_party.options_for_authentication(user_verification: "required")
+        end
+
+        # The user whose passkey signed the challenge, among this scope (e.g. User.privileged), or nil
+        def authenticate_by_passkey(relying_party, credential, challenge:)
+          credential, passkey = relying_party.verify_authentication(
+            JSON.parse(credential.to_s), challenge.to_s, user_verification: true
+          ) { |webauthn_credential| User::Passkey.find_by!(external_id: webauthn_credential.id) }
+          user = find_by(id: passkey.user_id)
+          # The id the passkey was created for, as the authenticator returns it with the signature
+          return unless user && credential.user_handle == user.webauthn_id
+
+          passkey.update!(sign_count: credential.sign_count, last_used_at: Time.current)
+          user
+        rescue WebAuthn::Error, ActiveRecord::RecordNotFound, JSON::ParserError
+          nil
+        end
+      end
+
+      # Asks the browser for a passkey the authenticator keeps (a "resident" one, which signing in
+      # without an email needs), and verifies the user. The user's passkeys are excluded, so an
+      # authenticator already holding one says so rather than adding another.
+      def passkey_creation_options(relying_party)
+        update!(webauthn_id: WebAuthn.generate_user_id) unless webauthn_id
+
+        relying_party.options_for_registration(
+          user: { id: webauthn_id, name: email, display_name: to_s },
+          exclude: passkeys.pluck(:external_id),
+          authenticator_selection: { resident_key: "required", user_verification: "required" }
+        )
+      end
+
+      # The passkey the browser created for the challenge, or nil when it doesn't verify. `name`, e.g.
+      # the browser it was added from, shows when its provider is unknown (User::Passkey#to_s).
+      def add_passkey(relying_party, credential, challenge:, name:)
+        credential = relying_party.verify_registration(
+          JSON.parse(credential.to_s), challenge.to_s, user_verification: true
+        )
+
+        passkeys.create!(
+          name:,
+          external_id: credential.id,
+          public_key: credential.public_key,
+          sign_count: credential.sign_count,
+          transports: Array(credential.response.transports),
+          aaguid: credential.response.aaguid
+        )
+      rescue WebAuthn::Error, JSON::ParserError
+        nil
+      end
+    end
+  end
+end

data/app/models/concerns/trek/users/password_history.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Trek
+  module Users
+    # Refuses a password among the user's last `password_history_size` ones (5 by default): the
+    # current one, and the previous ones, whose digests are kept as User::PreviousPassword records.
+    # Set the size in the model, e.g. `self.password_history_size = 10`; 0 turns the check off.
+    # Assumes the including model has has_secure_password.
+    module PasswordHistory
+      extend ActiveSupport::Concern
+
+      included do
+        class_attribute :password_history_size, default: 5
+
+        has_many :previous_passwords, dependent: :delete_all
+
+        validate :password_not_recently_used, if: -> { password.present? && password_digest_changed? }
+        after_update :remember_previous_password, if: :saved_change_to_password_digest?
+      end
+
+      private
+
+      def password_not_recently_used
+        return unless recent_password_digests.any? { |digest| password_digest_matches?(digest) }
+
+        errors.add(:password, :recently_used, count: password_history_size)
+      end
+
+      # The current password's digest and the previous ones, password_history_size in all
+      def recent_password_digests
+        return [] unless password_history_size.positive?
+
+        previous = previous_passwords.order(id: :desc).limit(password_history_size - 1).pluck(:password_digest)
+        [password_digest_was, *previous].compact_blank
+      end
+
+      # Checked the way has_secure_password checks the current password
+      def password_digest_matches?(digest)
+        BCrypt::Password.new(digest).is_password?(password)
+      end
+
+      def remember_previous_password
+        return unless password_history_size > 1
+
+        previous_passwords.create!(password_digest: password_digest_before_last_save) if password_digest_before_last_save.present?
+        kept = previous_passwords.order(id: :desc).limit(password_history_size - 1).select(:id)
+        previous_passwords.where.not(id: kept).delete_all
+      end
+    end
+  end
+end