1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
|
require 'digest/sha1'
class User < ApplicationRecord
has_secure_password(validations: false)
alias_method :authenticate_bcrypt, :authenticate
# Mixins and Plugins
include Authentication
include Authentication::ByPassword
ROLES = %w[redaktion admin alumni].freeze
# Validations
validates_presence_of :login
validates_length_of :login, :within => 1..40
validates_uniqueness_of :login
validates_format_of :login, :with => Authentication.login_regex,
:message => Authentication.bad_login_message
validates_presence_of :email
validates_length_of :email, :within => 6..100 #r@a.wk
validates_uniqueness_of :email
validates_format_of :email, :with => Authentication.email_regex,
:message => Authentication.bad_email_message
validate :roles_are_known
# Authenticates a user by their login name and unencrypted password. Returns the user or nil.
def self.authenticate(login, password)
return if login.blank? || password.blank?
user = find_by(login: login)
return unless user
user&.authenticate(password)
end
def authenticate(password)
if password_digest.present?
return self if authenticate_bcrypt(password)
return nil
end
return nil unless authenticate_legacy(password)
transaction do
self.password = password
self.crypted_password = nil
self.salt = nil
save!(validate: false)
end
self
end
# TODO: Do we really want to have downcase logins only?
def login=(value)
write_attribute :login, (value ? value.downcase : nil)
end
def email=(value)
write_attribute :email, (value ? value.downcase : nil)
end
def is_admin?
roles.include?("admin")
end
# Compatibility shims for the users form, which posts user[admin] as a
# checkbox. Goes away when that form learns about roles.
def admin
is_admin?
end
def admin?
is_admin?
end
def admin=(value)
if ActiveModel::Type::Boolean.new.cast(value)
self.roles = (roles | ["admin"])
else
self.roles = (roles - ["admin"])
end
end
def redaktion?
roles.include?("redaktion")
end
def alumni?
roles.include?("alumni")
end
def role_group
return :alumni if alumni?
return :admin if is_admin?
return :redaktion if redaktion?
:editor
end
# Human-readable role names, for the list and the forms.
def role_labels
roles.map { |r| I18n.t("users.roles.#{r}", :default => r) }
end
def deactivate!(actor:)
return false if alumni?
transaction do
update_column(:roles, (roles | ["alumni"]).sort)
NodeAction.record!(:participants => [self], :user => actor,
:action => "user_deactivate", :target_login => login)
end
true
end
def reactivate!(actor:)
return false unless alumni?
transaction do
update_column(:roles, (roles - ["alumni"]).sort)
NodeAction.record!(:participants => [self], :user => actor,
:action => "user_reactivate", :target_login => login)
end
true
end
# otp_secret present == enrolled. otp_pending_secret holds the secret
# between QR display and first-code confirmation. otp_consumed_timestep
# makes every accepted code single-use (replay guard within the drift
# window).
def otp_enrolled?
otp_secret.present?
end
# Starts (or restarts) enrollment. Returns the provisioning URI the QR
# encodes; otp_pending_secret itself doubles as the manual-entry string.
def begin_otp_enrollment!
update!(:otp_pending_secret => ROTP::Base32.random)
pending_otp_provisioning_uri
end
def pending_otp_provisioning_uri
return nil if otp_pending_secret.blank?
ROTP::TOTP.new(otp_pending_secret, :issuer => OTP_ISSUER)
.provisioning_uri(login)
end
# Confirms enrollment with the first generated code. Promotion and
# witnessing are one transaction; the consumed timestep is recorded so
# the confirmation code cannot be replayed at login.
def confirm_otp_enrollment!(code, actor: self)
return false if otp_pending_secret.blank?
timestep = ROTP::TOTP.new(otp_pending_secret)
.verify(code.to_s.strip,
:drift_behind => OTP_DRIFT,
:drift_ahead => OTP_DRIFT)
return false unless timestep
transaction do
update!(:otp_secret => otp_pending_secret,
:otp_pending_secret => nil,
:otp_consumed_timestep => timestep)
NodeAction.record!(:participants => [self], :user => actor,
:action => "otp_enroll", :target_login => login)
end
true
end
# Login-time verification. Each code is accepted at most once.
def verify_otp!(code)
return false unless otp_enrolled?
timestep = ROTP::TOTP.new(otp_secret)
.verify(code.to_s.strip,
:drift_behind => OTP_DRIFT,
:drift_ahead => OTP_DRIFT,
:after => otp_consumed_timestep)
return false unless timestep
update!(:otp_consumed_timestep => timestep)
true
end
# Self-service disable and administrative reset share one witnessed
# teardown; the verb records which of the two it was. The controller
# is responsible for the self-service guards (password + current code).
def disable_otp!(actor:)
verb = (actor == self) ? "otp_disable" : "otp_reset"
transaction do
update!(:otp_secret => nil, :otp_pending_secret => nil,
:otp_consumed_timestep => nil)
NodeAction.record!(:participants => [self], :user => actor,
:action => verb, :target_login => login)
end
true
end
private
def roles_are_known
unknown = roles.to_a - ROLES
errors.add(:roles, :unknown, :list => unknown.join(", ")) if unknown.any?
end
end
|
