Merge branch 'master' of github.com:domify/registry

app/controllers/registrant/sessions_controller.rb

@@ -45,6 +45,17 @@ class Registrant::SessionsController < ::SessionsController
   # rubocop:enable Metrics/CyclomaticComplexity
   # rubocop:enable Metrics/PerceivedComplexity
 
+  def id
+    @user = RegistrantUser.find_or_create_by_idc_data(request.env['SSL_CLIENT_S_DN'])
+    if @user
+      sign_in(@user, event: :authentication)
+      redirect_to registrant_root_url
+    else
+      flash[:alert] = t('login_failed_check_id_card')
+      redirect_to registrant_login_url
+    end
+  end
+
   def login_mid
     @user = User.new
   end
@@ -55,7 +66,7 @@ class Registrant::SessionsController < ::SessionsController
 
     if Rails.env.test? && phone == "123"
       @user = ApiUser.find_by(identity_code: "14212128025")
-      sign_in(@user, event: :authentication) 
+      sign_in(@user, event: :authentication)
       return redirect_to registrant_root_url
     end
 

app/mailers/domain_mailer.rb

@@ -6,13 +6,13 @@ class DomainMailer < ApplicationMailer
     return if @domain.deliver_emails != true
     if @domain.registrant_verification_token.blank?
       logger.warn "EMAIL DID NOT DELIVERED: registrant_verification_token is missing for #{@domain.name}"
-      return 
+      return
     end
 
     @old_registrant = Registrant.find(@domain.registrant_id_was)
     @verification_url = "#{ENV['registrant_url']}/etc/"
 
-    mail(to: @old_registrant.email, 
+    mail(to: @old_registrant.email,
          subject: "#{I18n.t(:domain_registrant_update_subject, name: @domain.name)} [#{@domain.name}]")
   end
 end

app/models/ability.rb

@@ -13,7 +13,9 @@ class Ability
     when 'ApiUser'
       epp
       registrar
-      registrant # refactor 
+      registrant # refactor
+    when 'RegistrantUser'
+      registrant
     end
 
     can :show, :dashboard
@@ -65,7 +67,8 @@ class Ability
   end
 
   def registrant
-    can :manage, :registrant_whois
+    can :manage, Registrant::Whois
+    can :manage, Depp::Domain
   end
 
   def user

app/models/domain.rb

@@ -60,7 +60,7 @@ class Domain < ActiveRecord::Base
   def manage_statuses
     return unless registrant_id_changed?
     if registrant_verification_asked_at.present?
-      domain_statuses.build(value: DomainStatus::PENDING_UPDATE) 
+      domain_statuses.build(value: DomainStatus::PENDING_UPDATE)
       DomainMailer.registrant_updated(self).deliver_now
     end
     true
@@ -141,8 +141,8 @@ class Domain < ActiveRecord::Base
     def included
       includes(
         :registrant,
-        :registrar, 
+        :registrar,
-        :nameservers, 
+        :nameservers,
         :whois_record,
         { tech_contacts: :registrar },
         { admin_contacts: :registrar }
@@ -254,7 +254,7 @@ class Domain < ActiveRecord::Base
     end
 
     # otherwise domain_statuses are in old state for domain object
-    domain_statuses.reload 
+    domain_statuses.reload
   end
 
   def children_log

app/models/registrant_user.rb

@@ -1,46 +1,22 @@
-require 'open3'
+class RegistrantUser < User
-
+  attr_accessor :idc_data
-# rubocop: disable Metrics/ClassLength
-class ApiUser < User
-  include EppErrors
-  def epp_code_map # rubocop:disable Metrics/MethodLength
-    {
-      '2306' => [ # Parameter policy error
-        [:password, :blank]
-      ]
-    }
-  end
-
-  # TODO: should have max request limit per day
-  belongs_to :registrar
-  has_many :certificates
-
-  validates :username, :password, :registrar, presence: true
-  validates :username, uniqueness: true
-
-  attr_accessor :registrar_typeahead
 
   def ability
     @ability ||= Ability.new(self)
   end
   delegate :can?, :cannot?, to: :ability
 
-  after_initialize :set_defaults
-  def set_defaults
-    return unless new_record?
-    self.active = true unless active_changed?
-  end
-
-  def registrar_typeahead
-    @registrar_typeahead || registrar || nil
-  end
-
   def to_s
-    username
+    registrant_ident
   end
 
-  def queued_messages
+  class << self
-    registrar.messages.queued
+    def find_or_create_by_idc_data(idc_data)
+      return false if idc_data.blank?
+      identity_code = idc_data.scan(/serialNumber=(\d+)/).flatten.first
+      country = idc_data.scan(/^\/C=(.{2})/).flatten.first
+
+      where(registrant_ident: "#{country}-#{identity_code}").first_or_create
+    end
   end
 end
-# rubocop: enable Metrics/ClassLength

app/views/registrant/sessions/login.haml

@@ -2,15 +2,8 @@
   .form-signin.col-md-6.center-block.text-center
     %h2.form-signin-heading.text-center= t(:log_in)
     %hr
-    = form_for @depp_user, url: registrant_sessions_path, html: {class: 'form-signin'} do |f|
+    = link_to '/registrant/id', method: :post do
-      = render 'registrar/shared/errors', object: f.object
+      = image_tag 'id_card.gif'
-
-      - error_class = f.object.errors.any? ? 'has-error' : ''
-      %div{class: error_class}
-        = f.text_field :tag, class: 'form-control', placeholder: t(:username), required: true
-        = f.password_field :password, class: 'form-control', placeholder: t(:password), required: true
-
-      %button.btn.btn-lg.btn-primary.btn-block{:type => 'submit'}= t(:log_in)
 
     %hr
     -# = link_to '/regisrant/login/mid' do

config/locales/en.yml

@@ -767,3 +767,4 @@ en:
   object_status_prohibits_operation: 'Object status prohibits operation'
   domain_registrant_update_subject: "Kinnitustaotlus domeeni %{name} registreerija vahetuseks / Application for approval for registrant chache of %{name}"
   whois: WHOIS
+  login_failed_check_id_card: 'Log in failed, check ID card'

config/routes.rb

@@ -111,6 +111,7 @@ Rails.application.routes.draw do
 
       post 'sessions' => 'sessions#create'
       post 'mid' => 'sessions#mid'
+      post 'id' => 'sessions#id'
       get 'logout' => '/devise/sessions#destroy'
     end
 
@@ -127,7 +128,6 @@ Rails.application.routes.draw do
     end
 
     resources :whois
-
     # resources :contacts do
       # member do
         # get 'delete'

db/migrate/20150514132606_add_registrant_ident_to_users.rb

@@ -0,0 +1,5 @@
+class AddRegistrantIdentToUsers < ActiveRecord::Migration
+  def change
+    add_column :users, :registrant_ident, :string
+  end
+end

db/schema.rb

@@ -11,7 +11,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20150513080013) do
+ActiveRecord::Schema.define(version: 20150514132606) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -908,6 +908,7 @@ ActiveRecord::Schema.define(version: 20150513080013) do
     t.text     "csr"
     t.text     "crt"
     t.string   "type"
+    t.string   "registrant_ident"
   end
 
   add_index "users", ["identity_code"], name: "index_users_on_identity_code", using: :btree

doc/certificates.md

@@ -187,6 +187,40 @@ Download CRT file and create p12 file.
 
 Add api_user.p12 to your browser.
 
+ID card login
+---------------
+
+Download SK certificates:
+
+    wget https://sk.ee/upload/files/Juur-SK.pem.crt
+    wget https://sk.ee/upload/files/EE_Certification_Centre_Root_CA.pem.crt
+    wget https://sk.ee/upload/files/ESTEID-SK_2007.pem.crt
+    wget https://sk.ee/upload/files/ESTEID-SK_2011.pem.crt
+
+Merge them into the existing ca file:
+
+    cat EE_Certification_Centre_Root_CA.pem.crt ESTEID-SK_2007.pem.crt ESTEID-SK_2011.pem.crt Juur-SK.pem.crt > id.crt
+
+Download CLR-s:
+
+    wget https://sk.ee/crls/esteid/esteid2007.crl
+    wget https://sk.ee/crls/juur/crl.crl
+    wget https://sk.ee/crls/eeccrca/eeccrca.crl
+    wget https://sk.ee/repository/crls/esteid2011.crl
+
+Convert to PEM:
+
+    openssl crl -in esteid2007.crl -out esteid2007.crl -inform DER
+    openssl crl -in crl.crl -out crl.crl -inform DER
+    openssl crl -in eeccrca.crl -out eeccrca.crl -inform DER
+    openssl crl -in esteid2011.crl -out esteid2011.crl -inform DER
+
+Make symlinks:
+
+    ln -s crl.crl `openssl crl -hash -noout -in crl.crl`.r0
+    ln -s esteid2007.crl `openssl crl -hash -noout -in esteid2007.crl`.r0
+    ln -s eeccrca.crl `openssl crl -hash -noout -in eeccrca.crl`.r0
+    ln -s esteid2011.crl `openssl crl -hash -noout -in esteid2011.crl`.r0
 
 Development env
 ---------------

spec/mailers/domain_mailer_spec.rb

@@ -31,7 +31,10 @@ describe DomainMailer do
       @new_registrant = Fabricate(:registrant, email: 'test@example.org')
       @domain = Fabricate(:domain, registrant: @registrant)
       @domain.deliver_emails = true
+<<<<<<< HEAD
+=======
       @domain.registrant_verification_token = '123'
+>>>>>>> 0ddd2b6f32fa7e9abec8b2e7c88173585a78f3dd
       @domain.registrant = @new_registrant
       @mail = DomainMailer.registrant_updated(@domain)
     end