trek 2.3.2 → 2.4.0

data/app/models/concerns/trek/users/password_policy.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+module Trek
+  module Users
+    # Password rules from the ANSSI's guide on passwords (v2.0, 2021, co-signed by the CNIL), at the
+    # "medium to high" level a back office calls for. Checked when a password is assigned.
+    #
+    # - At least `password_min_length` characters (R21), 12 by default.
+    # - Below `passphrase_length` characters (20 by default), a digit and a symbol (R23); a longer
+    #   passphrase needs neither.
+    # - Not a common password, nor a keyboard, alphabet or number sequence, nor the user's name or
+    #   email (R27).
+    # - With `password_check_pwned = true`, not in a known data breach (Have I Been Pwned). Off by
+    #   default: the ANSSI warns against sending password data to an outside service, even hashed.
+    #
+    # The maximum is bcrypt's 72 bytes, which has_secure_password enforces.
+    module PasswordPolicy
+      extend ActiveSupport::Concern
+
+      COMMON_PASSWORDS_PATH = Trek::Engine.root.join("lib/trek/data/common_passwords.txt")
+
+      # Keyboard rows (AZERTY and QWERTY), the alphabet and the digits: 5 characters in a row of one
+      # of them, either way, make a sequence.
+      SEQUENCES = %w[azertyuiop qsdfghjklm wxcvbn qwertyuiop asdfghjkl zxcvbnm abcdefghijklmnopqrstuvwxyz 01234567890].freeze
+      SEQUENCE_LENGTH = 5
+
+      # Names and email parts shorter than this are too likely to show up by chance.
+      PERSONAL_MIN_LENGTH = 4
+
+      included do
+        class_attribute :password_min_length, default: 12
+        class_attribute :passphrase_length, default: 20
+        class_attribute :password_check_pwned, default: false
+
+        validates :password, length: { minimum: ->(user) { user.password_min_length } }, allow_nil: true
+        validate :password_follows_policy, if: -> { password.present? }
+      end
+
+      class_methods do
+        def common_passwords
+          @common_passwords ||= File.foreach(COMMON_PASSWORDS_PATH, chomp: true).reject { |line| line.start_with?("#") }.to_set
+        end
+      end
+
+      # Lower case, without accents, letters and digits only: how passwords are compared to the lists.
+      def self.normalize(string)
+        string.unicode_normalize(:nfkd).gsub(/\p{Mn}/, "").downcase.gsub(/[^a-z0-9]/, "")
+      end
+
+      def self.sequences
+        @sequences ||= (SEQUENCES + SEQUENCES.map(&:reverse)).flat_map do |row|
+          row.chars.each_cons(SEQUENCE_LENGTH).map(&:join)
+        end.to_set
+      end
+
+      private
+
+      def password_follows_policy
+        normalized = PasswordPolicy.normalize(password)
+
+        errors.add(:password, :digit_and_symbol, count: passphrase_length) unless passphrase_or_complex?
+        errors.add(:password, :common) if self.class.common_passwords.include?(normalized)
+        errors.add(:password, :sequence) if sequence?(normalized)
+        errors.add(:password, :personal) if personal?(normalized)
+        errors.add(:password, :pwned) if password_check_pwned && Trek::PwnedPasswords.include?(password)
+      end
+
+      def passphrase_or_complex?
+        password.length >= passphrase_length || (password.match?(/\d/) && password.match?(/[^[:alnum:][:space:]]/))
+      end
+
+      def sequence?(normalized)
+        normalized.match?(/(.)\1{#{SEQUENCE_LENGTH - 1}}/) ||
+          normalized.chars.each_cons(SEQUENCE_LENGTH).any? { |chars| PasswordPolicy.sequences.include?(chars.join) }
+      end
+
+      def personal?(normalized)
+        parts = [try(:name), email.to_s.split("@").first].compact.flat_map { |value| value.split(/[^[:alnum:]]+/) }
+        parts.map { |part| PasswordPolicy.normalize(part) }
+          .select { |part| part.length >= PERSONAL_MIN_LENGTH }
+          .any? { |part| normalized.include?(part) }
+      end
+    end
+  end
+end

data/app/models/concerns/trek/users/password_renewal.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Trek
+  module Users
+    # When a user must choose a new password before going on (ANSSI guide on passwords, R24 to R26):
+    #
+    # - after `password_expires_after` (nil by default: passwords don't expire, R24). The ANSSI
+    #   suggests 1 to 3 years for privileged accounts without a second factor (R25), e.g.
+    #   `self.password_expires_after = 1.year`;
+    # - after `User.require_password_renewal!`, for everyone at once when a compromise is suspected
+    #   (R26); the admin's users list offers it.
+    #
+    # Needs the `password_changed_at` and `password_renewal_required_at` columns.
+    module PasswordRenewal
+      extend ActiveSupport::Concern
+
+      included do
+        class_attribute :password_expires_after, default: nil
+
+        # password_renewal_required, password_renewal_required? and its setter, from the
+        # password_renewal_required_at time
+        time_for_a_boolean :password_renewal_required
+
+        before_save :renew_password, if: :password_digest_changed?
+      end
+
+      class_methods do
+        def require_password_renewal!
+          update_all(password_renewal_required_at: Time.current) # rubocop:disable Rails/SkipsModelValidations
+        end
+      end
+
+      def password_renewal_needed?
+        password_renewal_required? || password_expired?
+      end
+
+      def password_expired?
+        return false unless password_expires_after
+
+        (password_changed_at || created_at) < password_expires_after.ago
+      end
+
+      private
+
+      def renew_password
+        self.password_changed_at = Time.current
+        self.password_renewal_required = false
+      end
+    end
+  end
+end

data/app/models/concerns/trek/users/session_lifetime.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Trek
+  module Users
+    # How long a signed-in browser (User::Session) stays signed in (ANSSI guide on passwords, R12):
+    #
+    # - `idle_timeout` without a request, 48 hours by default;
+    # - `lifetime` since signing in, whatever the activity, 30 days by default.
+    #
+    # The last request is the session's `last_activity_at`, written at most every
+    # `activity_interval` (5 minutes by default), so browsing doesn't write on every page.
+    module SessionLifetime
+      extend ActiveSupport::Concern
+
+      included do
+        class_attribute :idle_timeout, default: 48.hours
+        class_attribute :lifetime, default: 30.days
+        class_attribute :activity_interval, default: 5.minutes
+
+        attribute :last_activity_at, default: -> { Time.current }
+
+        scope :active, -> { where(last_activity_at: idle_timeout.ago..).where(created_at: lifetime.ago..) }
+        scope :expired, -> { where(last_activity_at: ...idle_timeout.ago).or(where(created_at: ...lifetime.ago)) }
+        scope :recent_first, -> { order(last_activity_at: :desc) }
+      end
+
+      def expired?
+        last_activity_at < idle_timeout.ago || created_at < lifetime.ago
+      end
+
+      # Records a request: at most once every activity_interval, without touching updated_at.
+      def record_activity
+        return if last_activity_at > activity_interval.ago
+
+        update_column(:last_activity_at, Time.current) # rubocop:disable Rails/SkipsModelValidations -- a timestamp only
+      end
+    end
+  end
+end

data/app/models/concerns/trek/users/sign_in_lockout.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+module Trek
+  module Users
+    # Locks signing in for a while after failed sign-ins in a row, whatever the IP address they come
+    # from, against password guessing spread over many addresses (ANSSI guide on passwords, R10):
+    # after `sign_in_lockout_after` failures (5), for `sign_in_lockout_duration` (1 minute), doubled
+    # on each further failure up to `sign_in_lockout_max` (1 hour). Never for good, so knowing an
+    # email isn't enough to keep its user out.
+    #
+    # While locked, signing in fails even with the right password, and the attempts don't count. A
+    # successful sign-in or a new password (e.g. through a reset) unlocks it. The user is emailed
+    # when it first locks (`sign_in_lockout_email`).
+    #
+    # Needs the `failed_sign_in_count` and `sign_in_locked_until` columns.
+    module SignInLockout
+      extend ActiveSupport::Concern
+
+      included do
+        class_attribute :sign_in_lockout_after, default: 5
+        class_attribute :sign_in_lockout_duration, default: 1.minute
+        class_attribute :sign_in_lockout_max, default: 1.hour
+        class_attribute :sign_in_lockout_email, default: true
+
+        before_save :unlock_sign_in, if: :password_digest_changed?
+      end
+
+      def sign_in_locked?
+        sign_in_locked_until.present? && sign_in_locked_until.future?
+      end
+
+      # Counts a wrong password, unless signing in is already locked
+      def record_failed_sign_in!
+        return if sign_in_locked?
+
+        # In the database, then read back with the failures counted in parallel
+        increment!(:failed_sign_in_count) # rubocop:disable Rails/SkipsModelValidations
+        reload
+        return if failed_sign_in_count < sign_in_lockout_after
+
+        update_column(:sign_in_locked_until, sign_in_lockout_delay.from_now) # rubocop:disable Rails/SkipsModelValidations
+        # Once per series of failures, not on each failure that extends it
+        first_lockout = failed_sign_in_count == sign_in_lockout_after
+        AdminMailer.sign_in_locked(self).deliver_later if sign_in_lockout_email && first_lockout
+      end
+
+      def record_successful_sign_in!
+        return unless failed_sign_in_count.positive? || sign_in_locked_until
+
+        update_columns(failed_sign_in_count: 0, sign_in_locked_until: nil) # rubocop:disable Rails/SkipsModelValidations
+      end
+
+      private
+
+      def sign_in_lockout_delay
+        # Capped before raising 2 to it, as the count may grow for as long as the guessing goes on
+        doublings = [failed_sign_in_count - sign_in_lockout_after, 20].min
+        [sign_in_lockout_duration * (2**doublings), sign_in_lockout_max].min
+      end
+
+      def unlock_sign_in
+        self.failed_sign_in_count = 0
+        self.sign_in_locked_until = nil
+      end
+    end
+  end
+end

data/app/models/concerns/trek/users/sign_ins.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Trek
+  module Users
+    # The user's current and previous sign-ins (date, IP address, browser), shown after signing in
+    # and on their profile to help them spot one that wasn't theirs. Kept on the user, as sessions
+    # are deleted when they end. Needs the `{current,last}_sign_in_{at,ip,user_agent}` columns.
+    #
+    # `new_sign_in_email` (true by default) emails the user when they sign in from a browser that
+    # never signed in as them.
+    module SignIns
+      extend ActiveSupport::Concern
+
+      included do
+        class_attribute :new_sign_in_email, default: true
+      end
+
+      # The current sign-in becomes the previous one.
+      def record_sign_in(ip:, user_agent:)
+        update_columns( # rubocop:disable Rails/SkipsModelValidations -- tracking only
+          last_sign_in_at: current_sign_in_at,
+          last_sign_in_ip: current_sign_in_ip,
+          last_sign_in_user_agent: current_sign_in_user_agent,
+          current_sign_in_at: Time.current,
+          current_sign_in_ip: ip,
+          current_sign_in_user_agent: user_agent
+        )
+      end
+    end
+  end
+end

data/app/models/concerns/trek/users/validations.rb

@@ -3,6 +3,9 @@ module Trek
     module Validations
       extend ActiveSupport::Concern
 
+      # The password rules (length, complexity, common passwords…)
+      include Trek::Users::PasswordPolicy
+
       included do
         # Also applies to lookups (`find_by(email:)`, `authenticate_by`), so signing in and asking
         # for a password reset work whatever the case typed.
@@ -12,8 +15,6 @@ module Trek
           presence: true,
           uniqueness: { case_sensitive: false },
           email: { mode: :strict }
-        # Only when a password was assigned: `password` is nil otherwise.
-        validates :password, length: { minimum: 8 }, allow_nil: true
         validate :password_not_only_spaces
       end
 

data/app/models/trek/feature.rb

@@ -3,5 +3,11 @@ module Trek
     def self.reorder?
       ENV.fetch("TREK_FEATURE_REORDER", "false") == "true"
     end
+
+    # On by default; FEATURE_AUDIT_LOG=false is a kill switch, e.g. if writing the rows slows down
+    # a busy app.
+    def self.audit_log?
+      ENV.fetch("FEATURE_AUDIT_LOG", "true") != "false"
+    end
   end
 end

data/app/models/trek/pwned_passwords.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require "digest"
+require "net/http"
+
+module Trek
+  # Checks a password against Have I Been Pwned's breached passwords, with its k-anonymity API: only
+  # the first 5 characters of the password's SHA-1 leave the app, padded so the response size tells
+  # nothing either. See https://haveibeenpwned.com/API/v3#PwnedPasswords
+  #
+  # Fails open: when the service can't be reached, the password is accepted and the error reported,
+  # so an outage never blocks a password change.
+  module PwnedPasswords
+    RANGE_URL = "https://api.pwnedpasswords.com/range/"
+    TIMEOUT = 3
+
+    def self.include?(password)
+      hash = Digest::SHA1.hexdigest(password).upcase
+      prefix, suffix = hash[0, 5], hash[5..]
+
+      range(prefix).each_line.any? do |line|
+        line_suffix, count = line.strip.split(":")
+        line_suffix == suffix && count.to_i.positive?
+      end
+    rescue StandardError => e
+      Rails.error.report(e, handled: true, context: { service: "pwnedpasswords" })
+      false
+    end
+
+    def self.range(prefix)
+      uri = URI("#{RANGE_URL}#{prefix}")
+      Net::HTTP.start(uri.host, uri.port, use_ssl: true, open_timeout: TIMEOUT, read_timeout: TIMEOUT) do |http|
+        request = Net::HTTP::Get.new(uri, "Add-Padding" => "true", "User-Agent" => "Trek")
+        response = http.request(request)
+        response.value # raises unless 2xx
+        response.body
+      end
+    end
+  end
+end

data/app/models/trek/user_session.rb

@@ -1,8 +1,18 @@
 module Trek
+  # The email and password typed in a sign-in form. Deprecated: Trek's generated sign-in controller
+  # passes the params to `User.authenticate_by` instead. Removed in Trek 3.
   class UserSession
     extend ActiveModel::Translation
     include ActiveModel::Model
 
     attr_accessor :email, :password
+
+    def initialize(...)
+      Trek.deprecator.warn(<<~MSG.squish)
+        Trek::UserSession is deprecated and will be removed in Trek 3. Pass the sign-in params to
+        `User.authenticate_by(email:, password:)`, as Trek's generated Admin::UserSessionsController does.
+      MSG
+      super
+    end
   end
 end

data/app/policies/trek/audit_log_policy.rb

@@ -0,0 +1,34 @@
+module Trek
+  # Audit logs are read by admins only, and never created, edited or deleted from the admin.
+  class AuditLogPolicy < Trek::ApplicationPolicy
+    def index?
+      user.admin?
+    end
+
+    def show?
+      user.admin?
+    end
+
+    def create?
+      false
+    end
+
+    def manage?
+      false
+    end
+
+    def destroy?
+      false
+    end
+
+    def permitted_attributes
+      []
+    end
+
+    relation_scope do |relation|
+      next relation if user.admin?
+
+      relation.none
+    end
+  end
+end

data/app/policies/trek/user_policy.rb

@@ -30,6 +30,11 @@ module Trek
       user.admin?
     end
 
+    # Every user's password, after a suspected compromise
+    def require_password_renewal?
+      user.admin?
+    end
+
     def permitted_attributes
       if user.admin?
         %i[email name role locale theme].tap do |attrs|

data/app/validators/not_disposable_validator.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# Refuses an email address from a disposable (throwaway) email provider, or a subdomain of one:
+#
+#   validates :email, not_disposable: true
+#
+# The domains come from the valid_email2 gem, whose maintainers keep the list up to date: updating
+# the gem updates it (see Trek::DisposableEmailDomains). Only the list is checked, without looking up
+# the domain's mail servers. An app can let a domain through in config/allow_listed_email_domains.yml
+# (valid_email2's file).
+# A blank value is left to the presence validation.
+class NotDisposableValidator < ActiveModel::EachValidator
+  def validate_each(record, attribute, value)
+    return if value.blank? || !Trek::DisposableEmailDomains.include?(value.to_s.split("@").last)
+
+    record.errors.add(attribute, :disposable, **options.except(:allow_nil, :allow_blank, :if, :unless, :on))
+  end
+end

data/config/brakeman.ignore

@@ -21,6 +21,28 @@
         352
       ],
       "note": ""
+    },
+    {
+      "warning_type": "Cross-Site Request Forgery",
+      "warning_code": 7,
+      "fingerprint": "ad2a1ba1d260a5401928b050fe86d5f219d91a240b06abe0e0da3f346d744f3e",
+      "check_name": "ForgerySetting",
+      "message": "`protect_from_forgery` should be called in `Trek::CspReportsController`",
+      "file": "app/controllers/trek/csp_reports_controller.rb",
+      "line": 11,
+      "link": "https://brakemanscanner.org/docs/warning_types/cross-site_request_forgery/",
+      "code": null,
+      "render_path": null,
+      "location": {
+        "type": "controller",
+        "controller": "Trek::CspReportsController"
+      },
+      "user_input": null,
+      "confidence": "High",
+      "cwe_id": [
+        352
+      ],
+      "note": "Browsers send CSP reports without a CSRF token; the endpoint only logs and reports them, with no session nor user."
     }
   ],
   "brakeman_version": "7.0.0"

data/config/i18n-tasks.yml

@@ -13,6 +13,13 @@ locales:
 data:
   read:
     - config/locales/trek.%{locale}.yml
+  # `i18n-tasks normalize` sorts the keys, then rewrites the files with Ruby's YAML writer, which
+  # splits values longer than 80 characters over several lines. Prettier, run next, fixes the
+  # writer's quotes but keeps those split lines, so don't split any (-1). `make i18n-normalize`
+  # runs both.
+  yaml:
+    write:
+      line_width: -1
 
 # The gendered resource-label variants (f/m/m_alt) only exist in locales whose
 # models declare a gender; English always resolves to `n` (see i18n_model_gender),