1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
|
require 'digest/sha1'
class User < ApplicationRecord
has_secure_password(validations: false)
alias_method :authenticate_bcrypt, :authenticate
# Mixins and Plugins
include Authentication
include Authentication::ByPassword
# Associations
has_many :permissions
# Validations
validates_presence_of :login
validates_length_of :login, :within => 1..40
validates_uniqueness_of :login
validates_format_of :login, :with => Authentication.login_regex,
:message => Authentication.bad_login_message
validates_presence_of :email
validates_length_of :email, :within => 6..100 #r@a.wk
validates_uniqueness_of :email
validates_format_of :email, :with => Authentication.email_regex,
:message => Authentication.bad_email_message
# Authenticates a user by their login name and unencrypted password. Returns the user or nil.
def self.authenticate(login, password)
return if login.blank? || password.blank?
user = find_by(login: login)
return unless user
user&.authenticate(password)
end
def authenticate(password)
if password_digest.present?
return self if authenticate_bcrypt(password)
return nil
end
return nil unless authenticate_legacy(password)
transaction do
self.password = password
self.crypted_password = nil
self.salt = nil
save!(validate: false)
end
self
end
# TODO: Do we really want to have downcase logins only?
def login=(value)
write_attribute :login, (value ? value.downcase : nil)
end
def email=(value)
write_attribute :email, (value ? value.downcase : nil)
end
# Permission stuff
def grant(node)
set_permission(true, node)
end
def revoke(node)
set_permission(false, node)
end
def inherit(node)
permission = self.permissions.for_node(node).first
permission.destroy if permission
end
def get_permission_for(node)
permissions = {}
self.permissions.for_node(node).each do |permission|
permissions[permission.identifier.to_sym] = permission.granted
end
permissions
end
# Checks for permission on the node and if necessary ascends the
# nodetree until permission is found or returns false if it is not found
# at all.
def has_permission?(node)
node_permission = self.permissions.for_node(node)
return node_permission unless node_permission.nil?
node.ancestors.reverse.each do |p|
local_permission = self.get_permissions_for(p)[identifier]
unless local_permission.nil?
return local_permission
end
end
return false
end
def is_admin?
!!admin
end
# otp_secret present == enrolled. otp_pending_secret holds the secret
# between QR display and first-code confirmation. otp_consumed_timestep
# makes every accepted code single-use (replay guard within the drift
# window).
def otp_enrolled?
otp_secret.present?
end
# Starts (or restarts) enrollment. Returns the provisioning URI the QR
# encodes; otp_pending_secret itself doubles as the manual-entry string.
def begin_otp_enrollment!
update!(:otp_pending_secret => ROTP::Base32.random)
pending_otp_provisioning_uri
end
def pending_otp_provisioning_uri
return nil if otp_pending_secret.blank?
ROTP::TOTP.new(otp_pending_secret, :issuer => OTP_ISSUER)
.provisioning_uri(login)
end
# Confirms enrollment with the first generated code. Promotion and
# witnessing are one transaction; the consumed timestep is recorded so
# the confirmation code cannot be replayed at login.
def confirm_otp_enrollment!(code, actor: self)
return false if otp_pending_secret.blank?
timestep = ROTP::TOTP.new(otp_pending_secret)
.verify(code.to_s.strip,
:drift_behind => OTP_DRIFT,
:drift_ahead => OTP_DRIFT)
return false unless timestep
transaction do
update!(:otp_secret => otp_pending_secret,
:otp_pending_secret => nil,
:otp_consumed_timestep => timestep)
NodeAction.record!(:participants => [self], :user => actor,
:action => "otp_enroll", :target_login => login)
end
true
end
# Login-time verification. Each code is accepted at most once.
def verify_otp!(code)
return false unless otp_enrolled?
timestep = ROTP::TOTP.new(otp_secret)
.verify(code.to_s.strip,
:drift_behind => OTP_DRIFT,
:drift_ahead => OTP_DRIFT,
:after => otp_consumed_timestep)
return false unless timestep
update!(:otp_consumed_timestep => timestep)
true
end
# Self-service disable and administrative reset share one witnessed
# teardown; the verb records which of the two it was. The controller
# is responsible for the self-service guards (password + current code).
def disable_otp!(actor:)
verb = (actor == self) ? "otp_disable" : "otp_reset"
transaction do
update!(:otp_secret => nil, :otp_pending_secret => nil,
:otp_consumed_timestep => nil)
NodeAction.record!(:participants => [self], :user => actor,
:action => verb, :target_login => login)
end
true
end
private
def set_permission(granted, node)
permission = self.permissions.for_node(node).first
if permission
permission.granted = granted
else
self.permissions.create!( :node => node,
:granted => granted )
end
end
end
|
