1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
|
require 'digest/sha1'
class User < ApplicationRecord
has_secure_password(validations: false)
alias_method :authenticate_bcrypt, :authenticate
# Mixins and Plugins
include Authentication
include Authentication::ByPassword
# Validations
validates_presence_of :login
validates_length_of :login, :within => 1..40
validates_uniqueness_of :login
validates_format_of :login, :with => Authentication.login_regex,
:message => Authentication.bad_login_message
validates_presence_of :email
validates_length_of :email, :within => 6..100 #r@a.wk
validates_uniqueness_of :email
validates_format_of :email, :with => Authentication.email_regex,
:message => Authentication.bad_email_message
# Authenticates a user by their login name and unencrypted password. Returns the user or nil.
def self.authenticate(login, password)
return if login.blank? || password.blank?
user = find_by(login: login)
return unless user
user&.authenticate(password)
end
def authenticate(password)
if password_digest.present?
return self if authenticate_bcrypt(password)
return nil
end
return nil unless authenticate_legacy(password)
transaction do
self.password = password
self.crypted_password = nil
self.salt = nil
save!(validate: false)
end
self
end
# TODO: Do we really want to have downcase logins only?
def login=(value)
write_attribute :login, (value ? value.downcase : nil)
end
def email=(value)
write_attribute :email, (value ? value.downcase : nil)
end
def is_admin?
!!admin
end
# otp_secret present == enrolled. otp_pending_secret holds the secret
# between QR display and first-code confirmation. otp_consumed_timestep
# makes every accepted code single-use (replay guard within the drift
# window).
def otp_enrolled?
otp_secret.present?
end
# Starts (or restarts) enrollment. Returns the provisioning URI the QR
# encodes; otp_pending_secret itself doubles as the manual-entry string.
def begin_otp_enrollment!
update!(:otp_pending_secret => ROTP::Base32.random)
pending_otp_provisioning_uri
end
def pending_otp_provisioning_uri
return nil if otp_pending_secret.blank?
ROTP::TOTP.new(otp_pending_secret, :issuer => OTP_ISSUER)
.provisioning_uri(login)
end
# Confirms enrollment with the first generated code. Promotion and
# witnessing are one transaction; the consumed timestep is recorded so
# the confirmation code cannot be replayed at login.
def confirm_otp_enrollment!(code, actor: self)
return false if otp_pending_secret.blank?
timestep = ROTP::TOTP.new(otp_pending_secret)
.verify(code.to_s.strip,
:drift_behind => OTP_DRIFT,
:drift_ahead => OTP_DRIFT)
return false unless timestep
transaction do
update!(:otp_secret => otp_pending_secret,
:otp_pending_secret => nil,
:otp_consumed_timestep => timestep)
NodeAction.record!(:participants => [self], :user => actor,
:action => "otp_enroll", :target_login => login)
end
true
end
# Login-time verification. Each code is accepted at most once.
def verify_otp!(code)
return false unless otp_enrolled?
timestep = ROTP::TOTP.new(otp_secret)
.verify(code.to_s.strip,
:drift_behind => OTP_DRIFT,
:drift_ahead => OTP_DRIFT,
:after => otp_consumed_timestep)
return false unless timestep
update!(:otp_consumed_timestep => timestep)
true
end
# Self-service disable and administrative reset share one witnessed
# teardown; the verb records which of the two it was. The controller
# is responsible for the self-service guards (password + current code).
def disable_otp!(actor:)
verb = (actor == self) ? "otp_disable" : "otp_reset"
transaction do
update!(:otp_secret => nil, :otp_pending_secret => nil,
:otp_consumed_timestep => nil)
NodeAction.record!(:participants => [self], :user => actor,
:action => verb, :target_login => login)
end
true
end
end
|
