diff --git a/Gemfile b/Gemfile index 1d55613ef..109cc9cca 100644 --- a/Gemfile +++ b/Gemfile @@ -99,8 +99,8 @@ gem 'friendly_id', '~> 5.1.0' gem 'aasm' # Background job processing -gem 'sidekiq', '>= 3.4.2' gem 'redis-namespace' +gem 'sidekiq', '>= 3.4.2' gem 'sinatra', require: false # Recurring jobs for Sidekiq gem 'sidekiq-cron' @@ -150,3 +150,5 @@ gem 'rack-protection', '1.5.5' gem 'sys-filesystem' gem 'sha3' + +gem 'repost' diff --git a/Gemfile.lock b/Gemfile.lock index 13f3c98ac..18b226ff5 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -345,6 +345,7 @@ GEM redis-namespace (1.6.0) redis (>= 3.0.4) ref (2.0.0) + repost (0.2.9) responders (2.1.0) railties (>= 4.2.0, < 5) rolify (4.0.0) @@ -531,6 +532,7 @@ DEPENDENCIES rb-readline recurrence redis-namespace + repost responders (~> 2.0) rolify rubocop (~> 0.61.1) diff --git a/app/assets/javascripts/controllers/application.js.erb b/app/assets/javascripts/controllers/application.js.erb index 3bc0b452c..f048af8dd 100644 --- a/app/assets/javascripts/controllers/application.js.erb +++ b/app/assets/javascripts/controllers/application.js.erb @@ -82,6 +82,10 @@ Application.Controllers.controller('ApplicationController', ['$rootScope', '$sco */ $scope.signup = function (e) { if (e) { e.preventDefault(); } + <% active_provider = AuthProvider.active %> + <% if active_provider.providable_type != DatabaseProvider.name %> + $window.location.href = '/sso-redirect'; + <% else %> return $uibModal.open({ templateUrl: '<%= asset_path "shared/signupModal.html" %>', @@ -167,6 +171,7 @@ Application.Controllers.controller('ApplicationController', ['$rootScope', '$sco // when the account was created successfully, set the session to the newly created account $scope.setCurrentUser(user); }); + <% end %> }; /** @@ -351,8 +356,7 @@ Application.Controllers.controller('ApplicationController', ['$rootScope', '$sco var openLoginModal = function (toState, toParams, callback) { <% active_provider = AuthProvider.active %> <% if active_provider.providable_type != DatabaseProvider.name %> - - $window.location.href = '<%="/users/auth/#{active_provider.strategy_name}"%>'; + $window.location.href = '/sso-redirect'; <% else %> return $uibModal.open({ templateUrl: '<%= asset_path "shared/deviseModal.html" %>', diff --git a/app/assets/javascripts/services/auth.js b/app/assets/javascripts/services/auth.js.erb similarity index 81% rename from app/assets/javascripts/services/auth.js rename to app/assets/javascripts/services/auth.js.erb index 6eee18588..041082753 100644 --- a/app/assets/javascripts/services/auth.js +++ b/app/assets/javascripts/services/auth.js.erb @@ -1,6 +1,6 @@ 'use strict'; -Application.Services.factory('AuthService', ['Session', function (Session) { +Application.Services.factory('AuthService', ['Session', 'CSRF', function (Session, CSRF) { return { isAuthenticated () { return (Session.currentUser != null) && (Session.currentUser.id != null); diff --git a/app/assets/templates/shared/header.html.erb b/app/assets/templates/shared/header.html.erb index 1c1b23575..56a480048 100644 --- a/app/assets/templates/shared/header.html.erb +++ b/app/assets/templates/shared/header.html.erb @@ -46,18 +46,8 @@
  • {{ 'sign_out' | translate }}
    • - <% active_provider = AuthProvider.active %> - <% if active_provider.providable_type == DatabaseProvider.name %> -
  • {{ 'sign_up' | translate }}
    • -
  • - {{ 'sign_in' | translate }} -
    • - <% else %> -
  • " class="font-sbold label text-md"> {{ 'sign_up' | translate }}
    • -
  • - <%= link_to(raw(" {{ 'sign_in' | translate }}"), - "/users/auth/#{active_provider.strategy_name}", - { method: :post, class: 'font-sbold label text-md' }) %> -
    • - <% end %> +
  • {{ 'sign_up' | translate }}
    • +
  • + {{ 'sign_in' | translate }} +
    • diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 82bfcd3b8..1beb5c21e 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -19,6 +19,12 @@ class ApplicationController < ActionController::Base def index; end + def sso_redirect + @authorization_token = request.query_parameters[:auth_token] + @authentication_token = form_authenticity_token + @active_provider = AuthProvider.active + end + protected def set_csrf_cookie diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb index b3489560f..05a2eb171 100644 --- a/app/controllers/sessions_controller.rb +++ b/app/controllers/sessions_controller.rb @@ -6,7 +6,7 @@ class SessionsController < Devise::SessionsController def new active_provider = AuthProvider.active if active_provider.providable_type != DatabaseProvider.name - redirect_to "/users/auth/#{active_provider.strategy_name}" + redirect_post "/users/auth/#{active_provider.strategy_name}", params: { authenticity_token: form_authenticity_token } else super end diff --git a/app/controllers/users/omniauth_callbacks_controller.rb b/app/controllers/users/omniauth_callbacks_controller.rb index 9853b857b..f0a9ba7a5 100644 --- a/app/controllers/users/omniauth_callbacks_controller.rb +++ b/app/controllers/users/omniauth_callbacks_controller.rb @@ -17,7 +17,7 @@ class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController # unique random string, because: # - if it is the same user, his email will be filled from the SSO when he merge his accounts # - if it is not the same user, this will prevent the raise of PG::UniqueViolation - if active_provider.sso_fields.include?('user.email') and email_exists?(@user.email) + if active_provider.sso_fields.include?('user.email') && email_exists?(@user.email) old_mail = @user.email @user.email = "<#{old_mail}>#{Devise.friendly_token}-duplicate" flash[:alert] = t('omniauth.email_already_linked_to_another_account_please_input_your_authentication_code', OLD_MAIL: old_mail) diff --git a/app/mailers/notifications_mailer.rb b/app/mailers/notifications_mailer.rb index f30a17535..8ec5f7a89 100644 --- a/app/mailers/notifications_mailer.rb +++ b/app/mailers/notifications_mailer.rb @@ -1,5 +1,8 @@ +# frozen_string_literal: true + +# Handle most of the emails sent by the platform. Triggered by notifications class NotificationsMailer < NotifyWith::NotificationsMailer - default :from => ENV['DEFAULT_MAIL_FROM'] + default from: ENV['DEFAULT_MAIL_FROM'] layout 'notifications_mailer' helper :application @@ -9,15 +12,15 @@ class NotificationsMailer < NotifyWith::NotificationsMailer @recipient = notification.receiver @attached_object = notification.attached_object - if !respond_to?(notification.notification_type) - class_eval %Q{ + unless respond_to?(notification.notification_type) + class_eval %{ def #{notification.notification_type} mail to: @recipient.email, subject: t('notifications_mailer.#{notification.notification_type}.subject'), template_name: '#{notification.notification_type}', content_type: 'text/html' end - } + }, __FILE__, __LINE__ - 7 end send(notification.notification_type) @@ -29,11 +32,15 @@ class NotificationsMailer < NotifyWith::NotificationsMailer def notify_user_when_invoice_ready attachments[@attached_object.filename] = File.read(@attached_object.file) - mail(to: @recipient.email, subject: t('notifications_mailer.notify_member_invoice_ready.subject'), template_name: 'notify_member_invoice_ready') + mail(to: @recipient.email, + subject: t('notifications_mailer.notify_member_invoice_ready.subject'), + template_name: 'notify_member_invoice_ready') end def notify_user_when_avoir_ready attachments[@attached_object.filename] = File.read(@attached_object.file) - mail(to: @recipient.email, subject: t('notifications_mailer.notify_member_avoir_ready.subject'), template_name: 'notify_member_avoir_ready') + mail(to: @recipient.email, + subject: t('notifications_mailer.notify_member_avoir_ready.subject'), + template_name: 'notify_member_avoir_ready') end end diff --git a/app/mailers/users_mailer.rb b/app/mailers/users_mailer.rb index 1c38e2fc0..bb1fdb1ab 100644 --- a/app/mailers/users_mailer.rb +++ b/app/mailers/users_mailer.rb @@ -1,3 +1,6 @@ +# frozen_string_literal: true + +# Handle emails related to users accounts, at Devise level class UsersMailer < BaseMailer def notify_user_account_created(user, generated_password) @user = user diff --git a/app/views/api/auth_providers/active.json.jbuilder b/app/views/api/auth_providers/active.json.jbuilder index 1f35ece38..c9bade12f 100644 --- a/app/views/api/auth_providers/active.json.jbuilder +++ b/app/views/api/auth_providers/active.json.jbuilder @@ -4,9 +4,7 @@ json.link_to_sso_profile @provider.link_to_sso_profile if @provider.providable_type == DatabaseProvider.name json.link_to_sso_connect '/#' else - json.link_to_sso_connect "/users/auth/#{@provider.strategy_name}" + json.link_to_sso_connect '/sso-redirect' end -if @provider.providable_type == OAuth2Provider.name - json.domain @provider.providable.domain -end +json.domain @provider.providable.domain if @provider.providable_type == OAuth2Provider.name diff --git a/app/views/application/sso_redirect.html.erb b/app/views/application/sso_redirect.html.erb new file mode 100644 index 000000000..1d57b5c15 --- /dev/null +++ b/app/views/application/sso_redirect.html.erb @@ -0,0 +1,21 @@ + + + + + + Redirect to SSO + + + <% param = @authorization_token ? "?auth_token=#{@authorization_token}" : '' %> + <% url_path = File.join(root_url, "users/auth/#{@active_provider.strategy_name}#{param}") %> +
    + <%= hidden_field_tag :authenticity_token, @authentication_token %> + +
    + + + diff --git a/app/views/notifications_mailer/notify_user_auth_migration.html.erb b/app/views/notifications_mailer/notify_user_auth_migration.html.erb index d72a262e5..5cdca27f5 100644 --- a/app/views/notifications_mailer/notify_user_auth_migration.html.erb +++ b/app/views/notifications_mailer/notify_user_auth_migration.html.erb @@ -15,12 +15,7 @@ <% active_provider = AuthProvider.active %> <%= render 'notifications_mailer/shared/hello', recipient: @recipient %> <% - url_path = "/users/auth/#{active_provider.strategy_name}" - if url_path[0] == '/' and root_url[-1] == '/' - url_path = root_url + url_path[1..-1] - else - url_path = root_url + url_path - end + url_path = File.join(root_url, 'sso-redirect') %>

    <%= t(".body.the_platform") %> <%= Setting.find_by(name: 'fablab_name').value %> <%= t(".body.is_changing_its_auth_system_and_will_now_use") %> <%= active_provider.name %> <%= t(".body.instead_of") %> <%= AuthProvider.find_by(status: 'previous').name %>.

    diff --git a/app/views/users_mailer/notify_user_account_created.html.erb b/app/views/users_mailer/notify_user_account_created.html.erb index ed86379d1..d5f095603 100644 --- a/app/views/users_mailer/notify_user_account_created.html.erb +++ b/app/views/users_mailer/notify_user_account_created.html.erb @@ -36,11 +36,13 @@ <% else %> + <% url_path = File.join(root_url, 'sso-redirect') %> +

    - <%= t('.body.thanks_to_') %> - <%= link_to(t('.body.logon_or_login', PROVIDER: active_provider.name ), - "#{root_url}/users/auth/#{active_provider.strategy_name}?auth_token=#{@user.auth_token}", - { method: :post, target: '_blank' }) %> + <%= t('.body.to_use_platform') %> + " target="_blank"> + <%= t('.body.logon_or_login', PROVIDER: active_provider.name )%> +

    <%= t('.body.token_if_link_problem') %>

    diff --git a/config/application.yml.default b/config/application.yml.default index aad654cf9..b44a9b949 100644 --- a/config/application.yml.default +++ b/config/application.yml.default @@ -19,8 +19,8 @@ FABLAB_WITHOUT_INVOICES: 'false' DEFAULT_MAIL_FROM: Fab Manager Demo # For prod & staging env only -DEFAULT_HOST: fab-manager.com -DEFAULT_PROTOCOL: https +DEFAULT_HOST: 'localhost:5000' +DEFAULT_PROTOCOL: http DELIVERY_METHOD: smtp SMTP_ADDRESS: SMTP_PORT: '587' diff --git a/config/environments/development.rb b/config/environments/development.rb index 79305c1b6..0d041cbfb 100644 --- a/config/environments/development.rb +++ b/config/environments/development.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + Rails.application.configure do # Settings specified here will take precedence over those in config/application.rb. @@ -13,6 +15,11 @@ Rails.application.configure do config.consider_all_requests_local = true config.action_controller.perform_caching = true + config.action_controller.default_url_options = { + host: Rails.application.secrets.default_host, + protocol: Rails.application.secrets.default_protocol + } + # Don't care if the mailer can't send. config.action_mailer.raise_delivery_errors = false @@ -41,9 +48,12 @@ Rails.application.configure do # config.action_view.raise_on_missing_translations = true config.action_mailer.delivery_method = :smtp - config.action_mailer.smtp_settings = { :address => '127.0.0.1', :port => 1025 } + config.action_mailer.smtp_settings = { address: '127.0.0.1', port: 1025 } config.action_mailer.raise_delivery_errors = false - config.action_mailer.default_url_options = { :host => 'localhost:5000' } + config.action_mailer.default_url_options = { + host: Rails.application.secrets.default_host, + protocol: Rails.application.secrets.default_protocol + } config.log_level = Rails.application.secrets.log_level || :debug end diff --git a/config/environments/production.rb b/config/environments/production.rb index 50161662a..46ccc5963 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + Rails.application.configure do # Settings specified here will take precedence over those in config/application.rb. @@ -14,6 +16,11 @@ Rails.application.configure do config.consider_all_requests_local = false config.action_controller.perform_caching = true + config.action_controller.default_url_options = { + host: Rails.application.secrets.default_host, + protocol: Rails.application.secrets.default_protocol + } + # Enable Rack::Cache to put a simple HTTP cache in front of your application # Add `rack-cache` to your Gemfile before enabling this. # For large-scale production use, consider using a caching reverse proxy like nginx, varnish or squid. @@ -81,19 +88,22 @@ Rails.application.configure do # config.serve_static_assets = true - config.action_mailer.default_url_options = { :host => Rails.application.secrets.default_host, :protocol => Rails.application.secrets.default_protocol } + config.action_mailer.default_url_options = { + host: Rails.application.secrets.default_host, + protocol: Rails.application.secrets.default_protocol + } # config.action_mailer.perform_deliveries = true # config.action_mailer.raise_delivery_errors = false # config.action_mailer.default :charset => "utf-8" config.action_mailer.smtp_settings = { - :address => Rails.application.secrets.smtp_address, - :port => Rails.application.secrets.smtp_port, - :user_name => Rails.application.secrets.smtp_user_name, - :password => Rails.application.secrets.smtp_password, - :authentication => Rails.application.secrets.smtp_authentication, - :enable_starttls_auto => Rails.application.secrets.smtp_enable_starttls_auto, - :openssl_verify_mode => Rails.application.secrets.smtp_openssl_verify_mode, + address: Rails.application.secrets.smtp_address, + port: Rails.application.secrets.smtp_port, + user_name: Rails.application.secrets.smtp_user_name, + password: Rails.application.secrets.smtp_password, + authentication: Rails.application.secrets.smtp_authentication, + enable_starttls_auto: Rails.application.secrets.smtp_enable_starttls_auto, + openssl_verify_mode: Rails.application.secrets.smtp_openssl_verify_mode, } # use :smtp for switch prod diff --git a/config/environments/staging.rb b/config/environments/staging.rb index 28f695ebc..dea7214d9 100644 --- a/config/environments/staging.rb +++ b/config/environments/staging.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + Rails.application.configure do # Settings specified here will take precedence over those in config/application.rb. @@ -14,6 +16,11 @@ Rails.application.configure do config.consider_all_requests_local = false config.action_controller.perform_caching = true + config.action_controller.default_url_options = { + host: Rails.application.secrets.default_host, + protocol: Rails.application.secrets.default_protocol + } + # Enable Rack::Cache to put a simple HTTP cache in front of your application # Add `rack-cache` to your Gemfile before enabling this. # For large-scale production use, consider using a caching reverse proxy like nginx, varnish or squid. @@ -83,20 +90,23 @@ Rails.application.configure do # config.serve_static_assets = true - config.action_mailer.default_url_options = { :host => Rails.application.secrets.default_host, :protocol => Rails.application.secrets.default_protocol } + config.action_mailer.default_url_options = { + host: Rails.application.secrets.default_host, + protocol: Rails.application.secrets.default_protocol + } # config.action_mailer.perform_deliveries = true # config.action_mailer.raise_delivery_errors = false # config.action_mailer.default :charset => "utf-8" config.action_mailer.smtp_settings = { - :address => Rails.application.secrets.smtp_address, - :port => Rails.application.secrets.smtp_port, - :user_name => Rails.application.secrets.smtp_user_name, - :password => Rails.application.secrets.smtp_password, - :authentication => Rails.application.secrets.smtp_authentication, - :enable_starttls_auto => Rails.application.secrets.smtp_enable_starttls_auto, - :openssl_verify_mode => Rails.application.secrets.smtp_openssl_verify_mode, - } + address: Rails.application.secrets.smtp_address, + port: Rails.application.secrets.smtp_port, + user_name: Rails.application.secrets.smtp_user_name, + password: Rails.application.secrets.smtp_password, + authentication: Rails.application.secrets.smtp_authentication, + enable_starttls_auto: Rails.application.secrets.smtp_enable_starttls_auto, + openssl_verify_mode: Rails.application.secrets.smtp_openssl_verify_mode, + } # use :smtp for switch prod config.action_mailer.delivery_method = Rails.application.secrets.delivery_method.to_sym diff --git a/config/environments/test.rb b/config/environments/test.rb index 23135c381..b8e1a562c 100644 --- a/config/environments/test.rb +++ b/config/environments/test.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + Rails.application.configure do # Settings specified here will take precedence over those in config/application.rb. @@ -13,13 +15,18 @@ Rails.application.configure do config.eager_load = false # Configure static asset server for tests with Cache-Control for performance. - config.serve_static_files = true + config.serve_static_files = true config.static_cache_control = 'public, max-age=3600' # Show full error reports and disable caching. config.consider_all_requests_local = true config.action_controller.perform_caching = false + config.action_controller.default_url_options = { + host: Rails.application.secrets.default_host, + protocol: Rails.application.secrets.default_protocol + } + # Raise exceptions instead of rendering exception templates. config.action_dispatch.show_exceptions = false diff --git a/config/locales/mails.en.yml b/config/locales/mails.en.yml index 46e2c8b19..9aea143be 100644 --- a/config/locales/mails.en.yml +++ b/config/locales/mails.en.yml @@ -17,8 +17,8 @@ en: password: "Password:" temporary_password: "This is a temporary password, you can modify it in your «My account» screen." keep_advantages: "With this account, you keep all the advantages linked to your Fab Lab user profile (trainings, subscriptions plans)." - thanks_to_: "To use the website, please" - logon_or_login: "create a new account or log in by clicking here" + to_use_platform: "To use the website, please" + logon_or_login: "create a new account or log in by clicking here." token_if_link_problem: "If you experience issues with the link, you can enter the following code at your first connection attempt:" notifications_mailer: diff --git a/config/locales/mails.es.yml b/config/locales/mails.es.yml index a3f2c65df..98c80b22a 100644 --- a/config/locales/mails.es.yml +++ b/config/locales/mails.es.yml @@ -17,8 +17,8 @@ es: password: "Contraseña:" temporary_password: "Esta es una contraseña temporal, puede modificarla en la pantalla <>." keep_advantages: "Con esta cuenta, guarda todas las ventajas relacionadas con su perfil de usuario de Fab Lab (cursos, planes de suscripción)." - thanks_to_: "Para usar el sitio web, por favor" - logon_or_login: "crea una nueva cuenta o inicia sesión haciendo clic aquí" + to_use_platform: "Para usar el sitio web, por favor" + logon_or_login: "crea una nueva cuenta o inicia sesión haciendo clic aquí." token_if_link_problem: "Si experimenta problemas con el enlace, puede introducir el siguiente código en el primer intento de conexión:" notifications_mailer: diff --git a/config/locales/mails.fr.yml b/config/locales/mails.fr.yml index ef1f65d31..b70eaa751 100644 --- a/config/locales/mails.fr.yml +++ b/config/locales/mails.fr.yml @@ -17,8 +17,8 @@ fr: password: "Mot de passe :" temporary_password: "Ce mot de passe est temporaire, vous pourrez le modifier en accédant à l’espace « Mon compte »." keep_advantages: "Avec ce compte, vous conservez bien entendu tous les avantages liés à votre profil utilisateur Fab Lab (abonnement, formations)." - thanks_to_: "Pour pouvoir utiliser la plateforme, merci de vous" - logon_or_login: "créer un compte sur %{PROVIDER} ou utiliser un compte pré-existant en cliquant ici" + to_use_platform: "Pour pouvoir utiliser la plateforme, merci de vous" + logon_or_login: "créer un compte sur %{PROVIDER} ou utiliser un compte pré-existant en cliquant ici." token_if_link_problem: "En cas de problème avec le lien, vous pourrez saisir manuellement le code suivant lors de votre première connexion :" notifications_mailer: diff --git a/config/locales/mails.pt.yml b/config/locales/mails.pt.yml index 25359a37a..20db2994f 100755 --- a/config/locales/mails.pt.yml +++ b/config/locales/mails.pt.yml @@ -17,8 +17,8 @@ pt: password: "Senha:" temporary_password: "Essa é uma senha temporária, você pode modificar isso na página «Minha conta»." keep_advantages: "Com esta conta, você mantém todas as vantagens associadas ao seu perfil de usuário Fab Lab (treinamentos, planos de assinaturas)." - thanks_to_: "Para usar o site, por favor" - logon_or_login: "Criar uma nova conta ou fazer login clicando aqui" + to_use_platform: "Para usar o site, por favor" + logon_or_login: "criar uma nova conta ou fazer login clicando aqui." token_if_link_problem: "Se você tiver problemas com o link, você poderá inserir o código a seguir na primeira tentativa de conexão:" notifications_mailer: diff --git a/config/routes.rb b/config/routes.rb index 628586dfd..0609afaeb 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -15,6 +15,7 @@ Rails.application.routes.draw do registrations: 'registrations', sessions: 'sessions', confirmations: 'confirmations', passwords: 'passwords', omniauth_callbacks: 'users/omniauth_callbacks' } + get '/sso-redirect', to: 'application#sso_redirect', as: :sso_redirect end diff --git a/test/mailers/previews/notifications_mailer_preview.rb b/test/mailers/previews/notifications_mailer_preview.rb new file mode 100644 index 000000000..0831b8a47 --- /dev/null +++ b/test/mailers/previews/notifications_mailer_preview.rb @@ -0,0 +1,8 @@ +# frozen_string_literal: true + +class NotificationsMailerPreview < ActionMailer::Preview + def notify_user_auth_migration + notif = Notification.where(notification_type_id: NotificationType.find_by_name('notify_user_auth_migration')).first + NotificationsMailer.send_mail_by(notif) + end +end diff --git a/test/mailers/previews/users_mailer_preview.rb b/test/mailers/previews/users_mailer_preview.rb new file mode 100644 index 000000000..8bf6b700e --- /dev/null +++ b/test/mailers/previews/users_mailer_preview.rb @@ -0,0 +1,7 @@ +# frozen_string_literal: true + +class UsersMailerPreview < ActionMailer::Preview + def notify_user_account_created + UsersMailer.notify_user_account_created(User.first, 'test') + end +end