Eugen Rochko
5 years ago
committed by
GitHub
parent
d0c2c52783
commit
e1066cd431
@ -0,0 +1,22 @@ |
||||
# frozen_string_literal: true |
||||
|
||||
class Auth::ChallengesController < ApplicationController |
||||
include ChallengableConcern |
||||
|
||||
layout 'auth' |
||||
|
||||
before_action :authenticate_user! |
||||
|
||||
skip_before_action :require_functional! |
||||
|
||||
def create |
||||
if challenge_passed? |
||||
session[:challenge_passed_at] = Time.now.utc |
||||
redirect_to challenge_params[:return_to] |
||||
else |
||||
@challenge = Form::Challenge.new(return_to: challenge_params[:return_to]) |
||||
flash.now[:alert] = I18n.t('challenge.invalid_password') |
||||
render_challenge |
||||
end |
||||
end |
||||
end |
||||
@ -0,0 +1,65 @@ |
||||
# frozen_string_literal: true |
||||
|
||||
# This concern is inspired by "sudo mode" on GitHub. It |
||||
# is a way to re-authenticate a user before allowing them |
||||
# to see or perform an action. |
||||
# |
||||
# Add `before_action :require_challenge!` to actions you |
||||
# want to protect. |
||||
# |
||||
# The user will be shown a page to enter the challenge (which |
||||
# is either the password, or just the username when no |
||||
# password exists). Upon passing, there is a grace period |
||||
# during which no challenge will be asked from the user. |
||||
# |
||||
# Accessing challenge-protected resources during the grace |
||||
# period will refresh the grace period. |
||||
module ChallengableConcern |
||||
extend ActiveSupport::Concern |
||||
|
||||
CHALLENGE_TIMEOUT = 1.hour.freeze |
||||
|
||||
def require_challenge! |
||||
return if skip_challenge? |
||||
|
||||
if challenge_passed_recently? |
||||
session[:challenge_passed_at] = Time.now.utc |
||||
return |
||||
end |
||||
|
||||
@challenge = Form::Challenge.new(return_to: request.url) |
||||
|
||||
if params.key?(:form_challenge) |
||||
if challenge_passed? |
||||
session[:challenge_passed_at] = Time.now.utc |
||||
return |
||||
else |
||||
flash.now[:alert] = I18n.t('challenge.invalid_password') |
||||
render_challenge |
||||
end |
||||
else |
||||
render_challenge |
||||
end |
||||
end |
||||
|
||||
def render_challenge |
||||
@body_classes = 'lighter' |
||||
render template: 'auth/challenges/new', layout: 'auth' |
||||
end |
||||
|
||||
def challenge_passed? |
||||
current_user.valid_password?(challenge_params[:current_password]) |
||||
end |
||||
|
||||
def skip_challenge? |
||||
current_user.encrypted_password.blank? |
||||
end |
||||
|
||||
def challenge_passed_recently? |
||||
session[:challenge_passed_at].present? && session[:challenge_passed_at] >= CHALLENGE_TIMEOUT.ago |
||||
end |
||||
|
||||
def challenge_params |
||||
params.require(:form_challenge).permit(:current_password, :return_to) |
||||
end |
||||
end |
||||
@ -0,0 +1,8 @@ |
||||
# frozen_string_literal: true |
||||
|
||||
class Form::Challenge |
||||
include ActiveModel::Model |
||||
|
||||
attr_accessor :current_password, :current_username, |
||||
:return_to |
||||
end |
||||
@ -0,0 +1,15 @@ |
||||
- content_for :page_title do |
||||
= t('challenge.prompt') |
||||
|
||||
= simple_form_for @challenge, url: request.get? ? auth_challenge_path : '' do |f| |
||||
= f.input :return_to, as: :hidden |
||||
|
||||
.field-group |
||||
= f.input :current_password, wrapper: :with_block_label, input_html: { :autocomplete => 'off', :autofocus => true }, label: t('challenge.prompt'), required: true |
||||
|
||||
.actions |
||||
= f.button :button, t('challenge.confirm'), type: :submit |
||||
|
||||
%p.hint.subtle-hint= t('challenge.hint_html') |
||||
|
||||
.form-footer= render 'auth/shared/links' |
||||
@ -0,0 +1,43 @@ |
||||
%table.email-table{ cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.email-body |
||||
.email-container |
||||
%table.content-section{ cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.content-cell.hero |
||||
.email-row |
||||
.col-6 |
||||
%table.column{ cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.column-cell.text-center.padded |
||||
%table.hero-icon.alert-icon{ align: 'center', cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td |
||||
= image_tag full_pack_url('media/images/mailer/icon_lock_open.png'), alt: '' |
||||
|
||||
%h1= t 'devise.mailer.two_factor_disabled.title' |
||||
%p.lead= t 'devise.mailer.two_factor_disabled.explanation' |
||||
|
||||
%table.email-table{ cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.email-body |
||||
.email-container |
||||
%table.content-section{ cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.content-cell.content-start |
||||
%table.column{ cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.column-cell.button-cell |
||||
%table.button{ align: 'center', cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.button-primary |
||||
= link_to edit_user_registration_url do |
||||
%span= t('settings.account_settings') |
||||
@ -0,0 +1,7 @@ |
||||
<%= t 'devise.mailer.two_factor_disabled.title' %> |
||||
|
||||
=== |
||||
|
||||
<%= t 'devise.mailer.two_factor_disabled.explanation' %> |
||||
|
||||
=> <%= edit_user_registration_url %> |
||||
@ -0,0 +1,43 @@ |
||||
%table.email-table{ cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.email-body |
||||
.email-container |
||||
%table.content-section{ cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.content-cell.hero |
||||
.email-row |
||||
.col-6 |
||||
%table.column{ cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.column-cell.text-center.padded |
||||
%table.hero-icon{ align: 'center', cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td |
||||
= image_tag full_pack_url('media/images/mailer/icon_lock_open.png'), alt: '' |
||||
|
||||
%h1= t 'devise.mailer.two_factor_enabled.title' |
||||
%p.lead= t 'devise.mailer.two_factor_enabled.explanation' |
||||
|
||||
%table.email-table{ cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.email-body |
||||
.email-container |
||||
%table.content-section{ cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.content-cell.content-start |
||||
%table.column{ cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.column-cell.button-cell |
||||
%table.button{ align: 'center', cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.button-primary |
||||
= link_to edit_user_registration_url do |
||||
%span= t('settings.account_settings') |
||||
@ -0,0 +1,7 @@ |
||||
<%= t 'devise.mailer.two_factor_enabled.title' %> |
||||
|
||||
=== |
||||
|
||||
<%= t 'devise.mailer.two_factor_enabled.explanation' %> |
||||
|
||||
=> <%= edit_user_registration_url %> |
||||
@ -0,0 +1,43 @@ |
||||
%table.email-table{ cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.email-body |
||||
.email-container |
||||
%table.content-section{ cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.content-cell.hero |
||||
.email-row |
||||
.col-6 |
||||
%table.column{ cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.column-cell.text-center.padded |
||||
%table.hero-icon.alert-icon{ align: 'center', cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td |
||||
= image_tag full_pack_url('media/images/mailer/icon_lock_open.png'), alt: '' |
||||
|
||||
%h1= t 'devise.mailer.two_factor_recovery_codes_changed.title' |
||||
%p.lead= t 'devise.mailer.two_factor_recovery_codes_changed.explanation' |
||||
|
||||
%table.email-table{ cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.email-body |
||||
.email-container |
||||
%table.content-section{ cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.content-cell.content-start |
||||
%table.column{ cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.column-cell.button-cell |
||||
%table.button{ align: 'center', cellspacing: 0, cellpadding: 0 } |
||||
%tbody |
||||
%tr |
||||
%td.button-primary |
||||
= link_to edit_user_registration_url do |
||||
%span= t('settings.account_settings') |
||||
@ -0,0 +1,7 @@ |
||||
<%= t 'devise.mailer.two_factor_recovery_codes_changed.title' %> |
||||
|
||||
=== |
||||
|
||||
<%= t 'devise.mailer.two_factor_recovery_codes_changed.explanation' %> |
||||
|
||||
=> <%= edit_user_registration_url %> |
||||
@ -0,0 +1,46 @@ |
||||
# frozen_string_literal: true |
||||
|
||||
require 'rails_helper' |
||||
|
||||
describe Auth::ChallengesController, type: :controller do |
||||
render_views |
||||
|
||||
let(:password) { 'foobar12345' } |
||||
let(:user) { Fabricate(:user, password: password) } |
||||
|
||||
before do |
||||
sign_in user |
||||
end |
||||
|
||||
describe 'POST #create' do |
||||
let(:return_to) { edit_user_registration_path } |
||||
|
||||
context 'with correct password' do |
||||
before { post :create, params: { form_challenge: { return_to: return_to, current_password: password } } } |
||||
|
||||
it 'redirects back' do |
||||
expect(response).to redirect_to(return_to) |
||||
end |
||||
|
||||
it 'sets session' do |
||||
expect(session[:challenge_passed_at]).to_not be_nil |
||||
end |
||||
end |
||||
|
||||
context 'with incorrect password' do |
||||
before { post :create, params: { form_challenge: { return_to: return_to, current_password: 'hhfggjjd562' } } } |
||||
|
||||
it 'renders challenge' do |
||||
expect(response).to render_template('auth/challenges/new') |
||||
end |
||||
|
||||
it 'displays error' do |
||||
expect(response.body).to include 'Invalid password' |
||||
end |
||||
|
||||
it 'does not set session' do |
||||
expect(session[:challenge_passed_at]).to be_nil |
||||
end |
||||
end |
||||
end |
||||
end |
||||
@ -0,0 +1,114 @@ |
||||
# frozen_string_literal: true |
||||
|
||||
require 'rails_helper' |
||||
|
||||
RSpec.describe ChallengableConcern, type: :controller do |
||||
controller(ApplicationController) do |
||||
include ChallengableConcern |
||||
|
||||
before_action :require_challenge! |
||||
|
||||
def foo |
||||
render plain: 'foo' |
||||
end |
||||
|
||||
def bar |
||||
render plain: 'bar' |
||||
end |
||||
end |
||||
|
||||
before do |
||||
routes.draw do |
||||
get 'foo' => 'anonymous#foo' |
||||
post 'bar' => 'anonymous#bar' |
||||
end |
||||
end |
||||
|
||||
context 'with a no-password user' do |
||||
let(:user) { Fabricate(:user, external: true, password: nil) } |
||||
|
||||
before do |
||||
sign_in user |
||||
end |
||||
|
||||
context 'for GET requests' do |
||||
before { get :foo } |
||||
|
||||
it 'does not ask for password' do |
||||
expect(response.body).to eq 'foo' |
||||
end |
||||
end |
||||
|
||||
context 'for POST requests' do |
||||
before { post :bar } |
||||
|
||||
it 'does not ask for password' do |
||||
expect(response.body).to eq 'bar' |
||||
end |
||||
end |
||||
end |
||||
|
||||
context 'with recent challenge in session' do |
||||
let(:password) { 'foobar12345' } |
||||
let(:user) { Fabricate(:user, password: password) } |
||||
|
||||
before do |
||||
sign_in user |
||||
end |
||||
|
||||
context 'for GET requests' do |
||||
before { get :foo, session: { challenge_passed_at: Time.now.utc } } |
||||
|
||||
it 'does not ask for password' do |
||||
expect(response.body).to eq 'foo' |
||||
end |
||||
end |
||||
|
||||
context 'for POST requests' do |
||||
before { post :bar, session: { challenge_passed_at: Time.now.utc } } |
||||
|
||||
it 'does not ask for password' do |
||||
expect(response.body).to eq 'bar' |
||||
end |
||||
end |
||||
end |
||||
|
||||
context 'with a password user' do |
||||
let(:password) { 'foobar12345' } |
||||
let(:user) { Fabricate(:user, password: password) } |
||||
|
||||
before do |
||||
sign_in user |
||||
end |
||||
|
||||
context 'for GET requests' do |
||||
before { get :foo } |
||||
|
||||
it 'renders challenge' do |
||||
expect(response).to render_template('auth/challenges/new') |
||||
end |
||||
|
||||
# See Auth::ChallengesControllerSpec |
||||
end |
||||
|
||||
context 'for POST requests' do |
||||
before { post :bar } |
||||
|
||||
it 'renders challenge' do |
||||
expect(response).to render_template('auth/challenges/new') |
||||
end |
||||
|
||||
it 'accepts correct password' do |
||||
post :bar, params: { form_challenge: { current_password: password } } |
||||
expect(response.body).to eq 'bar' |
||||
expect(session[:challenge_passed_at]).to_not be_nil |
||||
end |
||||
|
||||
it 'rejects wrong password' do |
||||
post :bar, params: { form_challenge: { current_password: 'dddfff888123' } } |
||||
expect(response.body).to render_template('auth/challenges/new') |
||||
expect(session[:challenge_passed_at]).to be_nil |
||||
end |
||||
end |
||||
end |
||||
end |
||||
Loading…
Reference in new issue