diff --git a/app/api/repp/api.rb b/app/api/repp/api.rb index 7858cd625..e5bda46f5 100644 --- a/app/api/repp/api.rb +++ b/app/api/repp/api.rb @@ -4,7 +4,7 @@ module Repp prefix :repp http_basic do |username, password| - @current_user ||= ApiUser.find_by(username: username, password: password) + @current_user ||= ApiUser.find_by(username: username, plain_text_password: password) if @current_user true else diff --git a/app/controllers/admin/api_users_controller.rb b/app/controllers/admin/api_users_controller.rb index 84344c2e9..bbf0a8a4e 100644 --- a/app/controllers/admin/api_users_controller.rb +++ b/app/controllers/admin/api_users_controller.rb @@ -32,7 +32,10 @@ module Admin end def update - params[:api_user].delete(:password) if params[:api_user][:password].blank? + if params[:api_user][:plain_text_password].blank? + params[:api_user].delete(:plain_text_password) + end + if @api_user.update(api_user_params) flash[:notice] = I18n.t('record_updated') redirect_to [:admin, @api_user] @@ -59,7 +62,7 @@ module Admin end def api_user_params - params.require(:api_user).permit(:username, :password, :active, + params.require(:api_user).permit(:username, :plain_text_password, :active, :registrar_id, :registrar_typeahead, :identity_code, { roles: [] }) end diff --git a/app/controllers/admin/base_controller.rb b/app/controllers/admin/base_controller.rb index 7de43f7fc..17e75785a 100644 --- a/app/controllers/admin/base_controller.rb +++ b/app/controllers/admin/base_controller.rb @@ -1,10 +1,20 @@ module Admin class BaseController < ApplicationController - before_action :authenticate_user! + before_action :authenticate_admin_user! helper_method :head_title_sufix def head_title_sufix t(:admin_head_title_sufix) end + + private + + def current_ability + @current_ability ||= Ability.new(current_admin_user) + end + + def user_for_paper_trail + current_admin_user ? current_admin_user.id_role_username : 'anonymous' + end end -end +end \ No newline at end of file diff --git a/app/controllers/admin/dashboard_controller.rb b/app/controllers/admin/dashboard_controller.rb new file mode 100644 index 000000000..f48698780 --- /dev/null +++ b/app/controllers/admin/dashboard_controller.rb @@ -0,0 +1,7 @@ +module Admin + class DashboardController < BaseController + authorize_resource class: false + + def show; end + end +end \ No newline at end of file diff --git a/app/controllers/admin/dashboards_controller.rb b/app/controllers/admin/dashboards_controller.rb deleted file mode 100644 index 52d82ea0a..000000000 --- a/app/controllers/admin/dashboards_controller.rb +++ /dev/null @@ -1,9 +0,0 @@ -module Admin - class DashboardsController < BaseController - authorize_resource class: false - - def show - redirect_to [:admin, :domains] if can? :show, Domain - end - end -end diff --git a/app/controllers/admin/pending_deletes_controller.rb b/app/controllers/admin/pending_deletes_controller.rb index 86529da84..9cc8702c5 100644 --- a/app/controllers/admin/pending_deletes_controller.rb +++ b/app/controllers/admin/pending_deletes_controller.rb @@ -6,7 +6,7 @@ module Admin def update authorize! :update, :pending - if registrant_verification.domain_registrant_delete_confirm!("admin #{current_user.username}") + if registrant_verification.domain_registrant_delete_confirm!("admin #{current_admin_user.username}") redirect_to admin_domain_path(@domain.id), notice: t(:pending_applied) else redirect_to admin_domain_path(@domain.id), alert: t(:failure) @@ -16,7 +16,7 @@ module Admin def destroy authorize! :destroy, :pending - if registrant_verification.domain_registrant_delete_reject!("admin #{current_user.username}") + if registrant_verification.domain_registrant_delete_reject!("admin #{current_admin_user.username}") redirect_to admin_domain_path(@domain.id), notice: t(:pending_removed) else redirect_to admin_domain_path(@domain.id), alert: t(:failure) diff --git a/app/controllers/admin/pending_updates_controller.rb b/app/controllers/admin/pending_updates_controller.rb index e402227e0..4a2e5ec7c 100644 --- a/app/controllers/admin/pending_updates_controller.rb +++ b/app/controllers/admin/pending_updates_controller.rb @@ -6,7 +6,7 @@ module Admin def update authorize! :update, :pending - if registrant_verification.domain_registrant_change_confirm!("admin #{current_user.username}") + if registrant_verification.domain_registrant_change_confirm!("admin #{current_admin_user.username}") redirect_to admin_domain_path(@domain.id), notice: t(:pending_applied) else redirect_to edit_admin_domain_path(@domain.id), alert: t(:failure) @@ -15,7 +15,7 @@ module Admin def destroy authorize! :destroy, :pending - if registrant_verification.domain_registrant_change_reject!("admin #{current_user.username}") + if registrant_verification.domain_registrant_change_reject!("admin #{current_admin_user.username}") redirect_to admin_domain_path(@domain.id), notice: t(:pending_removed) else redirect_to admin_domain_path(@domain.id), alert: t(:failure) diff --git a/app/controllers/admin/sessions_controller.rb b/app/controllers/admin/sessions_controller.rb index 1bdcd30dc..57d702059 100644 --- a/app/controllers/admin/sessions_controller.rb +++ b/app/controllers/admin/sessions_controller.rb @@ -1,28 +1,17 @@ module Admin class SessionsController < Devise::SessionsController - skip_authorization_check only: :create + private - def login - @admin_user = AdminUser.new + def after_sign_in_path_for(_resource_or_scope) + admin_domains_path end - def create - if params[:admin_user].blank? - @admin_user = AdminUser.new - flash[:alert] = 'Something went wrong' - return render 'login' - end + def after_sign_out_path_for(_resource_or_scope) + new_admin_user_session_path + end - @admin_user = AdminUser.find_by(username: params[:admin_user][:username]) - @admin_user ||= AdminUser.new(username: params[:admin_user][:username]) - - if @admin_user.valid_password?(params[:admin_user][:password]) - sign_in @admin_user, event: :authentication - redirect_to admin_root_url, notice: I18n.t(:welcome) - else - flash[:alert] = 'Authorization error' - render 'login' - end + def user_for_paper_trail + current_admin_user ? current_admin_user.id_role_username : 'anonymous' end end -end +end \ No newline at end of file diff --git a/app/controllers/api/v1/registrant/contacts_controller.rb b/app/controllers/api/v1/registrant/contacts_controller.rb index de5ef9dcf..1be620ba4 100644 --- a/app/controllers/api/v1/registrant/contacts_controller.rb +++ b/app/controllers/api/v1/registrant/contacts_controller.rb @@ -35,7 +35,7 @@ module Api private def set_contacts_pool - country_code, ident = current_user.registrant_ident.to_s.split '-' + country_code, ident = current_registrant_user.registrant_ident.to_s.split '-' associated_domain_ids = begin BusinessRegistryCache.fetch_by_ident_and_cc(ident, country_code).associated_domain_ids end diff --git a/app/controllers/api/v1/registrant/domains_controller.rb b/app/controllers/api/v1/registrant/domains_controller.rb index 7209f8a10..97925701a 100644 --- a/app/controllers/api/v1/registrant/domains_controller.rb +++ b/app/controllers/api/v1/registrant/domains_controller.rb @@ -16,12 +16,12 @@ module Api status: :bad_request) && return end - @domains = associated_domains(current_user).limit(limit).offset(offset) + @domains = associated_domains(current_registrant_user).limit(limit).offset(offset) render json: @domains end def show - domain_pool = associated_domains(current_user) + domain_pool = associated_domains(current_registrant_user) @domain = domain_pool.find_by(uuid: params[:uuid]) if @domain diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 87dabad01..dec34acbf 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -12,63 +12,15 @@ class ApplicationController < ActionController::Base end rescue_from CanCan::AccessDenied do |exception| - redirect_to current_root_url, alert: exception.message + redirect_to root_url, alert: exception.message end - helper_method :registrant_request?, :registrar_request?, :admin_request?, :current_root_url helper_method :available_languages - def registrant_request? - request.path.match(/^\/registrant/) - end - - def registrar_request? - request.path.match(/^\/registrar/) - end - - def admin_request? - request.path.match(/^\/admin/) - end - - def current_root_url - if registrar_request? - registrar_root_url - elsif registrant_request? - registrant_login_url - elsif admin_request? - admin_root_url - end - end - - def after_sign_in_path_for(_resource) - rt = session[:user_return_to].to_s.presence - login_paths = [admin_login_path, registrar_login_path, '/login'] - return rt if rt && !login_paths.include?(rt) - current_root_url - end - - def after_sign_out_path_for(_resource) - if registrar_request? - registrar_login_url - elsif registrant_request? - registrant_login_url - elsif admin_request? - admin_login_url - end - end - def info_for_paper_trail { uuid: request.uuid } end - def user_for_paper_trail - user_log_str(current_user) - end - - def user_log_str(user) - user.nil? ? 'public' : user.id_role_username - end - def comma_support_for(parent_key, key) return if params[parent_key].blank? return if params[parent_key][key].blank? @@ -80,4 +32,4 @@ class ApplicationController < ActionController::Base def available_languages { en: 'English', et: 'Estonian' }.invert end -end +end \ No newline at end of file diff --git a/app/controllers/epp/sessions_controller.rb b/app/controllers/epp/sessions_controller.rb index e3e9f3114..05bbba9a8 100644 --- a/app/controllers/epp/sessions_controller.rb +++ b/app/controllers/epp/sessions_controller.rb @@ -81,7 +81,7 @@ class Epp::SessionsController < EppController if success if params[:parsed_frame].css('newPW').first - unless @api_user.update(password: params[:parsed_frame].css('newPW').first.text) + unless @api_user.update(plain_text_password: params[:parsed_frame].css('newPW').first.text) response.headers['X-EPP-Returncode'] = '2500' handle_errors(@api_user) and return end @@ -128,7 +128,7 @@ class Epp::SessionsController < EppController def login_params user = params[:parsed_frame].css('clID').first.text pw = params[:parsed_frame].css('pw').first.text - { username: user, password: pw } + { username: user, plain_text_password: pw } end private diff --git a/app/controllers/registrant/contacts_controller.rb b/app/controllers/registrant/contacts_controller.rb index 267b4d68d..9defa8bd6 100644 --- a/app/controllers/registrant/contacts_controller.rb +++ b/app/controllers/registrant/contacts_controller.rb @@ -3,7 +3,6 @@ class Registrant::ContactsController < RegistrantController def show @contact = Contact.where(id: contacts).find_by(id: params[:id]) - @current_user = current_user authorize! :read, @contact end @@ -22,7 +21,7 @@ class Registrant::ContactsController < RegistrantController def domain_ids @domain_ids ||= begin - ident_cc, ident = @current_user.registrant_ident.to_s.split '-' + ident_cc, ident = current_registrant_user.registrant_ident.to_s.split '-' BusinessRegistryCache.fetch_by_ident_and_cc(ident, ident_cc).associated_domain_ids end end diff --git a/app/controllers/registrant/domain_delete_confirms_controller.rb b/app/controllers/registrant/domain_delete_confirms_controller.rb index af8516462..d6e4666c7 100644 --- a/app/controllers/registrant/domain_delete_confirms_controller.rb +++ b/app/controllers/registrant/domain_delete_confirms_controller.rb @@ -19,7 +19,8 @@ class Registrant::DomainDeleteConfirmsController < RegistrantController domain_name: @domain.name, verification_token: params[:token]) - initiator = current_user ? current_user.username : t(:user_not_authenticated) + initiator = current_registrant_user ? current_registrant_user.username : + t(:user_not_authenticated) if params[:rejected] if @registrant_verification.domain_registrant_delete_reject!("email link #{initiator}") diff --git a/app/controllers/registrant/domain_update_confirms_controller.rb b/app/controllers/registrant/domain_update_confirms_controller.rb index 0d23943c9..413ac43ff 100644 --- a/app/controllers/registrant/domain_update_confirms_controller.rb +++ b/app/controllers/registrant/domain_update_confirms_controller.rb @@ -19,7 +19,8 @@ class Registrant::DomainUpdateConfirmsController < RegistrantController domain_name: @domain.name, verification_token: params[:token]) - initiator = current_user ? current_user.username : t(:user_not_authenticated) + initiator = current_registrant_user ? current_registrant_user.username : + t(:user_not_authenticated) if params[:rejected] if @registrant_verification.domain_registrant_change_reject!("email link, #{initiator}") diff --git a/app/controllers/registrant/domains_controller.rb b/app/controllers/registrant/domains_controller.rb index 0e2f6eeaf..06b24624d 100644 --- a/app/controllers/registrant/domains_controller.rb +++ b/app/controllers/registrant/domains_controller.rb @@ -54,13 +54,13 @@ class Registrant::DomainsController < RegistrantController end def domains - ident_cc, ident = @current_user.registrant_ident.split '-' + ident_cc, ident = current_registrant_user.registrant_ident.split '-' begin BusinessRegistryCache.fetch_associated_domains ident, ident_cc rescue Soap::Arireg::NotAvailableError => error flash[:notice] = I18n.t(error.json[:message]) Rails.logger.fatal("[EXCEPTION] #{error.to_s}") - current_user.domains + current_registrant_user.domains end end diff --git a/app/controllers/registrant/sessions_controller.rb b/app/controllers/registrant/sessions_controller.rb index 80a23eb0a..db403b2a5 100644 --- a/app/controllers/registrant/sessions_controller.rb +++ b/app/controllers/registrant/sessions_controller.rb @@ -1,8 +1,7 @@ class Registrant::SessionsController < Devise::SessionsController layout 'registrant/application' - def login - end + def new; end def id id_code, id_issuer = request.env['SSL_CLIENT_S_DN'], request.env['SSL_CLIENT_I_DN_O'] @@ -10,11 +9,10 @@ class Registrant::SessionsController < Devise::SessionsController @user = RegistrantUser.find_or_create_by_idc_data(id_code, id_issuer) if @user - sign_in(@user, event: :authentication) - redirect_to registrant_root_url + sign_in_and_redirect(:registrant_user, @user, event: :authentication) else flash[:alert] = t('login_failed_check_id_card') - redirect_to registrant_login_url + redirect_to new_registrant_user_session_url end end @@ -68,7 +66,7 @@ class Registrant::SessionsController < Devise::SessionsController when 'USER_AUTHENTICATED' @user = RegistrantUser.find_by(registrant_ident: "#{session[:user_country]}-#{session[:user_id_code]}") - sign_in @user + sign_in(:registrant_user, @user) flash[:notice] = t(:welcome) flash.keep(:notice) render js: "window.location = '#{registrant_root_path}'" @@ -97,4 +95,18 @@ class Registrant::SessionsController < Devise::SessionsController return User.new unless idc ApiUser.find_by(identity_code: idc) || User.new end -end + + private + + def after_sign_in_path_for(_resource_or_scope) + registrant_root_path + end + + def after_sign_out_path_for(_resource_or_scope) + new_registrant_user_session_path + end + + def user_for_paper_trail + current_registrant_user.present? ? current_registrant_user.id_role_username : 'anonymous' + end +end \ No newline at end of file diff --git a/app/controllers/registrant_controller.rb b/app/controllers/registrant_controller.rb index 72fb78a08..9e8c1998e 100644 --- a/app/controllers/registrant_controller.rb +++ b/app/controllers/registrant_controller.rb @@ -1,11 +1,22 @@ class RegistrantController < ApplicationController - before_action :authenticate_user! + before_action :authenticate_registrant_user! layout 'registrant/application' include Registrant::ApplicationHelper helper_method :head_title_sufix + def head_title_sufix t(:registrant_head_title_sufix) end -end + + private + + def current_ability + @current_ability ||= Ability.new(current_registrant_user, request.remote_ip) + end + + def user_for_paper_trail + current_registrant_user.present? ? current_registrant_user.id_role_username : 'anonymous' + end +end \ No newline at end of file diff --git a/app/controllers/registrar/account_activities_controller.rb b/app/controllers/registrar/account_activities_controller.rb index 0b95d0122..baa0256af 100644 --- a/app/controllers/registrar/account_activities_controller.rb +++ b/app/controllers/registrar/account_activities_controller.rb @@ -4,7 +4,7 @@ class Registrar def index params[:q] ||= {} - account = current_user.registrar.cash_account + account = current_registrar_user.registrar.cash_account ca_cache = params[:q][:created_at_lteq] begin diff --git a/app/controllers/registrar/base_controller.rb b/app/controllers/registrar/base_controller.rb index 90f2f5210..499d44594 100644 --- a/app/controllers/registrar/base_controller.rb +++ b/app/controllers/registrar/base_controller.rb @@ -2,7 +2,7 @@ class Registrar class BaseController < ApplicationController include Registrar::ApplicationHelper - before_action :authenticate_user! + before_action :authenticate_registrar_user! before_action :check_ip_restriction helper_method :depp_controller? helper_method :head_title_sufix @@ -10,21 +10,21 @@ class Registrar protected def current_ability - @current_ability ||= Ability.new(current_user, request.remote_ip) + @current_ability ||= Ability.new(current_registrar_user, request.remote_ip) end private def check_ip_restriction ip_restriction = Authorization::RestrictedIP.new(request.ip) - allowed = ip_restriction.can_access_registrar_area?(current_user.registrar) + allowed = ip_restriction.can_access_registrar_area?(current_registrar_user.registrar) return if allowed - sign_out current_user + sign_out current_registrar_user flash[:alert] = t('registrar.authorization.ip_not_allowed', ip: request.ip) - redirect_to registrar_login_url + redirect_to new_registrar_user_session_url end def depp_controller? @@ -34,5 +34,9 @@ class Registrar def head_title_sufix t(:registrar_head_title_sufix) end + + def user_for_paper_trail + current_registrar_user ? current_registrar_user.id_role_username : 'anonymous' + end end end diff --git a/app/controllers/registrar/bulk_change_controller.rb b/app/controllers/registrar/bulk_change_controller.rb index 562344a46..441127f6c 100644 --- a/app/controllers/registrar/bulk_change_controller.rb +++ b/app/controllers/registrar/bulk_change_controller.rb @@ -10,7 +10,7 @@ class Registrar private def available_contacts - current_user.registrar.contacts.order(:name).pluck(:name, :code) + current_registrar_user.registrar.contacts.order(:name).pluck(:name, :code) end def default_tab diff --git a/app/controllers/registrar/contacts_controller.rb b/app/controllers/registrar/contacts_controller.rb index cb059641e..f343f9bfb 100644 --- a/app/controllers/registrar/contacts_controller.rb +++ b/app/controllers/registrar/contacts_controller.rb @@ -21,11 +21,11 @@ class Registrar end if params[:statuses_contains] - contacts = current_user.registrar.contacts.includes(:registrar).where( + contacts = current_registrar_user.registrar.contacts.includes(:registrar).where( "contacts.statuses @> ?::varchar[]", "{#{params[:statuses_contains].join(',')}}" ) else - contacts = current_user.registrar.contacts.includes(:registrar) + contacts = current_registrar_user.registrar.contacts.includes(:registrar) end normalize_search_parameters do @@ -45,7 +45,7 @@ class Registrar @contacts = Contact.find_by(name: params[:q][:name_matches]) end - contacts = current_user.registrar.contacts.includes(:registrar) + contacts = current_registrar_user.registrar.contacts.includes(:registrar) contacts = contacts.filter_by_states(params[:statuses_contains]) if params[:statuses_contains] normalize_search_parameters do diff --git a/app/controllers/registrar/current_user_controller.rb b/app/controllers/registrar/current_user_controller.rb index 266e4b915..624ee294e 100644 --- a/app/controllers/registrar/current_user_controller.rb +++ b/app/controllers/registrar/current_user_controller.rb @@ -3,9 +3,9 @@ class Registrar skip_authorization_check def switch - raise 'Cannot switch to unlinked user' unless current_user.linked_with?(new_user) + raise 'Cannot switch to unlinked user' unless current_registrar_user.linked_with?(new_user) - sign_in(new_user) + sign_in(:registrar_user, new_user) redirect_to :back, notice: t('.switched', new_user: new_user) end diff --git a/app/controllers/registrar/dashboard_controller.rb b/app/controllers/registrar/dashboard_controller.rb deleted file mode 100644 index 80b3f530b..000000000 --- a/app/controllers/registrar/dashboard_controller.rb +++ /dev/null @@ -1,13 +0,0 @@ -class Registrar - class DashboardController < BaseController - authorize_resource class: false - - def show - if can?(:show, :poll) - redirect_to registrar_poll_url and return - elsif can?(:show, Invoice) - redirect_to registrar_invoices_url and return - end - end - end -end diff --git a/app/controllers/registrar/deposits_controller.rb b/app/controllers/registrar/deposits_controller.rb index 818e38c6d..0dcaf6830 100644 --- a/app/controllers/registrar/deposits_controller.rb +++ b/app/controllers/registrar/deposits_controller.rb @@ -7,7 +7,7 @@ class Registrar end def create - @deposit = Deposit.new(deposit_params.merge(registrar: current_user.registrar)) + @deposit = Deposit.new(deposit_params.merge(registrar: current_registrar_user.registrar)) @invoice = @deposit.issue_prepayment_invoice if @invoice diff --git a/app/controllers/registrar/depp_controller.rb b/app/controllers/registrar/depp_controller.rb index 234ab40b7..70fb01c4a 100644 --- a/app/controllers/registrar/depp_controller.rb +++ b/app/controllers/registrar/depp_controller.rb @@ -5,13 +5,13 @@ class Registrar rescue_from(Errno::ECONNRESET, Errno::ECONNREFUSED) do |exception| logger.error 'COULD NOT CONNECT TO REGISTRY' logger.error exception.backtrace.join("\n") - redirect_to registrar_login_url, alert: t(:no_connection_to_registry) + redirect_to new_registrar_user_session_url, alert: t(:no_connection_to_registry) end before_action :authenticate_user def authenticate_user - redirect_to registrar_login_url and return unless depp_current_user + redirect_to new_registrar_user_session_url and return unless depp_current_user end def depp_controller? @@ -19,10 +19,10 @@ class Registrar end def depp_current_user - return nil unless current_user + return nil unless current_registrar_user @depp_current_user ||= Depp::User.new( - tag: current_user.username, - password: current_user.password + tag: current_registrar_user.username, + password: current_registrar_user.plain_text_password ) end diff --git a/app/controllers/registrar/domain_transfers_controller.rb b/app/controllers/registrar/domain_transfers_controller.rb index 7c0925f03..acacc3ef4 100644 --- a/app/controllers/registrar/domain_transfers_controller.rb +++ b/app/controllers/registrar/domain_transfers_controller.rb @@ -21,7 +21,8 @@ class Registrar uri = URI.parse("#{ENV['repp_url']}domain_transfers") request = Net::HTTP::Post.new(uri, 'Content-Type' => 'application/json') request.body = { data: { domainTransfers: domain_transfers } }.to_json - request.basic_auth(current_user.username, current_user.password) + request.basic_auth(current_registrar_user.username, + current_registrar_user.plain_text_password) if Rails.env.test? diff --git a/app/controllers/registrar/domains_controller.rb b/app/controllers/registrar/domains_controller.rb index 7cb8fdfbe..d2969bb69 100644 --- a/app/controllers/registrar/domains_controller.rb +++ b/app/controllers/registrar/domains_controller.rb @@ -16,11 +16,11 @@ class Registrar end if params[:statuses_contains] - domains = current_user.registrar.domains.includes(:registrar, :registrant).where( + domains = current_registrar_user.registrar.domains.includes(:registrar, :registrant).where( "statuses @> ?::varchar[]", "{#{params[:statuses_contains].join(',')}}" ) else - domains = current_user.registrar.domains.includes(:registrar, :registrant) + domains = current_registrar_user.registrar.domains.includes(:registrar, :registrant) end normalize_search_parameters do @@ -142,7 +142,7 @@ class Registrar def search_contacts authorize! :create, Depp::Domain - scope = current_user.registrar.contacts.limit(10) + scope = current_registrar_user.registrar.contacts.limit(10) if params[:query].present? escaped_str = ActiveRecord::Base.connection.quote_string params[:query] scope = scope.where("name ilike '%#{escaped_str}%' OR code ilike '%#{escaped_str}%' ") @@ -159,7 +159,7 @@ class Registrar def contacts - current_user.registrar.contacts + current_registrar_user.registrar.contacts end def normalize_search_parameters diff --git a/app/controllers/registrar/invoices_controller.rb b/app/controllers/registrar/invoices_controller.rb index 735df91a3..c29558e0f 100644 --- a/app/controllers/registrar/invoices_controller.rb +++ b/app/controllers/registrar/invoices_controller.rb @@ -6,7 +6,8 @@ class Registrar def index params[:q] ||= {} - invoices = current_user.registrar.invoices.includes(:invoice_items, :account_activity) + invoices = current_registrar_user.registrar.invoices + .includes(:invoice_items, :account_activity) normalize_search_parameters do @q = invoices.search(params[:q]) diff --git a/app/controllers/registrar/nameservers_controller.rb b/app/controllers/registrar/nameservers_controller.rb index 3b70059a2..95da7e329 100644 --- a/app/controllers/registrar/nameservers_controller.rb +++ b/app/controllers/registrar/nameservers_controller.rb @@ -12,7 +12,8 @@ class Registrar attributes: { hostname: params[:new_hostname], ipv4: ipv4, ipv6: ipv6 } } }.to_json - request.basic_auth(current_user.username, current_user.password) + request.basic_auth(current_registrar_user.username, + current_registrar_user.plain_text_password) if Rails.env.test? response = Net::HTTP.start(uri.hostname, uri.port, diff --git a/app/controllers/registrar/profile_controller.rb b/app/controllers/registrar/profile_controller.rb index 5f202a894..1fe6d6a0b 100644 --- a/app/controllers/registrar/profile_controller.rb +++ b/app/controllers/registrar/profile_controller.rb @@ -5,13 +5,13 @@ class Registrar helper_method :linked_users def show - @user = current_user + @user = current_registrar_user end private def linked_users - current_user.linked_users + current_registrar_user.linked_users end end end diff --git a/app/controllers/registrar/sessions_controller.rb b/app/controllers/registrar/sessions_controller.rb index 11841481d..8f4db9fdd 100644 --- a/app/controllers/registrar/sessions_controller.rb +++ b/app/controllers/registrar/sessions_controller.rb @@ -3,12 +3,8 @@ class Registrar before_action :check_ip_restriction helper_method :depp_controller? - def login - @depp_user = Depp::User.new - end - def create - @depp_user = Depp::User.new(params[:depp_user].merge(pki: !(Rails.env.development? || Rails.env.test?))) + @depp_user = Depp::User.new(depp_user_params) if @depp_user.pki && request.env['HTTP_SSL_CLIENT_S_DN_CN'].blank? @depp_user.errors.add(:base, :webserver_missing_user_name_directive) @@ -26,11 +22,12 @@ class Registrar @depp_user.errors.add(:base, :webserver_client_cert_directive_should_be_required) end - @api_user = ApiUser.find_by(username: params[:depp_user][:tag], password: params[:depp_user][:password]) + @api_user = ApiUser.find_by(username: sign_in_params[:username], + plain_text_password: sign_in_params[:password]) unless @api_user @depp_user.errors.add(:base, t(:no_such_user)) - render 'login' and return + show_error and return end if @depp_user.pki @@ -41,14 +38,13 @@ class Registrar if @depp_user.errors.none? if @api_user.active? - sign_in @api_user - redirect_to registrar_root_url + sign_in_and_redirect(:registrar_user, @api_user) else @depp_user.errors.add(:base, :not_active) - render 'login' + show_error and return end else - render 'login' + show_error and return end end @@ -56,11 +52,10 @@ class Registrar @user = ApiUser.find_by_idc_data_and_allowed(request.env['SSL_CLIENT_S_DN'], request.ip) if @user - sign_in(@user, event: :authentication) - redirect_to registrar_root_url + sign_in_and_redirect(:registrar_user, @user, event: :authentication) else flash[:alert] = t('no_such_user') - redirect_to registrar_login_url + redirect_to new_registrar_user_session_url end end @@ -117,7 +112,7 @@ class Registrar render json: { message: t(:check_your_phone_for_confirmation_code) }, status: :ok when 'USER_AUTHENTICATED' @user = find_user_by_idc_and_allowed(session[:user_id_code]) - sign_in @user + sign_in(:registrar_user, @user) flash[:notice] = t(:welcome) flash.keep(:notice) render js: "window.location = '#{registrar_root_url}'" @@ -163,8 +158,6 @@ class Registrar end end - - def check_ip_restriction ip_restriction = Authorization::RestrictedIP.new(request.ip) allowed = ip_restriction.can_access_registrar_area_sign_in_page? @@ -173,5 +166,36 @@ class Registrar render text: t('registrar.authorization.ip_not_allowed', ip: request.ip) end + + def current_ability + @current_ability ||= Ability.new(current_registrar_user, request.remote_ip) + end + + def after_sign_in_path_for(_resource_or_scope) + if can?(:show, :poll) + registrar_root_path + else + registrar_profile_path + end + end + + def after_sign_out_path_for(_resource_or_scope) + new_registrar_user_session_path + end + + def user_for_paper_trail + current_registrar_user ? current_registrar_user.id_role_username : 'anonymous' + end + + def depp_user_params + params = sign_in_params + params[:tag] = params.delete(:username) + params.merge!(pki: !(Rails.env.development? || Rails.env.test?)) + params + end + + def show_error + redirect_to new_registrar_user_session_url, alert: @depp_user.errors.full_messages.first + end end -end +end \ No newline at end of file diff --git a/app/controllers/registrar/tech_contacts_controller.rb b/app/controllers/registrar/tech_contacts_controller.rb index 9d4568ad6..1d459ef0f 100644 --- a/app/controllers/registrar/tech_contacts_controller.rb +++ b/app/controllers/registrar/tech_contacts_controller.rb @@ -8,7 +8,8 @@ class Registrar request = Net::HTTP::Patch.new(uri) request.set_form_data(current_contact_id: params[:current_contact_id], new_contact_id: params[:new_contact_id]) - request.basic_auth(current_user.username, current_user.password) + request.basic_auth(current_registrar_user.username, + current_registrar_user.plain_text_password) if Rails.env.test? response = Net::HTTP.start(uri.hostname, uri.port, diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb index 8203a630f..6c19d3ac3 100644 --- a/app/helpers/application_helper.rb +++ b/app/helpers/application_helper.rb @@ -89,4 +89,8 @@ module ApplicationHelper types.delete('ddoc') ".#{types.join(',.')}" end -end + + def body_css_class + [controller_path.split('/').map!(&:dasherize), action_name.dasherize, 'page'].join('-') + end +end \ No newline at end of file diff --git a/app/models/ability.rb b/app/models/ability.rb index 97086110b..8ca94d89b 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -31,8 +31,6 @@ class Ability end def epp # Registrar/api_user dynamic role - can :view, :registrar_dashboard - if @user.registrar.api_ip_white?(@ip) can :manage, :poll can :manage, Depp::Contact @@ -71,7 +69,6 @@ class Ability end def billing # Registrar/api_user dynamic role - can :view, :registrar_dashboard can(:manage, Invoice) { |i| i.buyer_id == @user.registrar_id } can :manage, :deposit can :read, AccountActivity diff --git a/app/models/admin_user.rb b/app/models/admin_user.rb index d76c42dec..07686e921 100644 --- a/app/models/admin_user.rb +++ b/app/models/admin_user.rb @@ -9,7 +9,8 @@ class AdminUser < User ROLES = %w(user customer_service admin) # should not match to api_users roles - devise :database_authenticatable, :rememberable, :trackable, :validatable, :lockable + devise :database_authenticatable, :trackable, :validatable, :timeoutable, + authentication_keys: [:username] def self.min_password_length Devise.password_length.min diff --git a/app/models/api_user.rb b/app/models/api_user.rb index ce32c4045..a7c8c022d 100644 --- a/app/models/api_user.rb +++ b/app/models/api_user.rb @@ -2,11 +2,12 @@ require 'open3' class ApiUser < User include EppErrors + devise :database_authenticatable, :trackable, :timeoutable, authentication_keys: [:username] def epp_code_map { '2306' => [ # Parameter policy error - [:password, :blank] + %i[plain_text_password blank] ] } end @@ -19,8 +20,8 @@ class ApiUser < User belongs_to :registrar has_many :certificates - validates :username, :password, :registrar, :roles, presence: true - validates :password, length: { minimum: min_password_length } + validates :username, :plain_text_password, :registrar, :roles, presence: true + validates :plain_text_password, length: { minimum: min_password_length } validates :username, uniqueness: true delegate :code, :name, to: :registrar, prefix: true @@ -30,6 +31,7 @@ class ApiUser < User SUPER = 'super' EPP = 'epp' + BILLING = 'billing' ROLES = %w(super epp billing) # should not match to admin roles diff --git a/app/models/registrant_user.rb b/app/models/registrant_user.rb index 889f2ca4c..f47b924f6 100644 --- a/app/models/registrant_user.rb +++ b/app/models/registrant_user.rb @@ -2,6 +2,8 @@ class RegistrantUser < User ACCEPTED_ISSUER = 'AS Sertifitseerimiskeskus' attr_accessor :idc_data + devise :database_authenticatable, :trackable, :timeoutable + def ability @ability ||= Ability.new(self) end diff --git a/app/models/user.rb b/app/models/user.rb index b69e0250c..8968e2736 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -1,6 +1,5 @@ class User < ActiveRecord::Base include Versions # version/user_version.rb - devise :trackable, :timeoutable attr_accessor :phone diff --git a/app/views/admin/api_users/_form.haml b/app/views/admin/api_users/_form.haml index 9a26b9fc8..12ea322aa 100644 --- a/app/views/admin/api_users/_form.haml +++ b/app/views/admin/api_users/_form.haml @@ -11,9 +11,9 @@ = f.text_field :username, required: true, autofocus: true, class: 'form-control' .form-group .col-md-4.control-label - = f.label :password, nil, class: 'required' + = f.label :plain_text_password, nil, class: 'required' .col-md-7 - = f.text_field :password, required: true, class: 'form-control' + = f.text_field :plain_text_password, required: true, class: 'form-control' .form-group .col-md-4.control-label diff --git a/app/views/admin/api_users/show.haml b/app/views/admin/api_users/show.haml index 00e562c6d..2e13445d1 100644 --- a/app/views/admin/api_users/show.haml +++ b/app/views/admin/api_users/show.haml @@ -21,7 +21,7 @@ %dd= @api_user.username %dt= t(:password) - %dd= @api_user.password + %dd= @api_user.plain_text_password %dt= t(:registrar_name) %dd= link_to(@api_user.registrar, admin_registrar_path(@api_user.registrar)) diff --git a/app/views/admin/base/_menu.haml b/app/views/admin/base/_menu.haml index 7c813e43e..6c8e15201 100644 --- a/app/views/admin/base/_menu.haml +++ b/app/views/admin/base/_menu.haml @@ -39,6 +39,6 @@ %li= link_to t('.repp_log'), admin_repp_logs_path(created_after: 'today') %li= link_to t('.que'), '/admin/que' - - if signed_in? - %ul.nav.navbar-nav.navbar-right - %li= link_to t(:log_out, user: current_user), '/admin/logout' + %ul.nav.navbar-nav.navbar-right + %li= link_to t('.sign_out'), destroy_admin_user_session_path, method: :delete, + class: 'navbar-link' \ No newline at end of file diff --git a/app/views/admin/dashboards/show.haml b/app/views/admin/dashboard/show.html.erb similarity index 100% rename from app/views/admin/dashboards/show.haml rename to app/views/admin/dashboard/show.html.erb diff --git a/app/views/admin/sessions/_links.html.erb b/app/views/admin/sessions/_links.html.erb new file mode 100644 index 000000000..93dadb0d8 --- /dev/null +++ b/app/views/admin/sessions/_links.html.erb @@ -0,0 +1,29 @@ +<%- if controller_name != 'sessions' %> + <%= link_to "Log in", new_session_path(resource_name) %>
+<% end -%> + +<%- if devise_mapping.registerable? && controller_name != 'registrations' %> + <%= link_to "Sign up", new_registration_path(resource_name) %>
+<% end -%> + +<%- if devise_mapping.recoverable? && controller_name != 'passwords' && + controller_name != 'registrations' %> + <%= link_to "Forgot your password?", new_password_path(resource_name) %>
+<% end -%> + +<%- if devise_mapping.confirmable? && controller_name != 'confirmations' %> + <%= link_to "Didn't receive confirmation instructions?", new_confirmation_path(resource_name) %> +
+<% end -%> + +<%- if devise_mapping.lockable? && resource_class.unlock_strategy_enabled?(:email) && + controller_name != 'unlocks' %> + <%= link_to "Didn't receive unlock instructions?", new_unlock_path(resource_name) %>
+<% end -%> + +<%- if devise_mapping.omniauthable? %> + <%- resource_class.omniauth_providers.each do |provider| %> + <%= link_to "Sign in with #{OmniAuth::Utils.camelize(provider)}", + omniauth_authorize_path(resource_name, provider) %>
+ <% end -%> +<% end -%> diff --git a/app/views/admin/sessions/login.haml b/app/views/admin/sessions/login.haml deleted file mode 100644 index 1ecca10ae..000000000 --- a/app/views/admin/sessions/login.haml +++ /dev/null @@ -1,15 +0,0 @@ -.row - .form-signin.col-md-6.center-block.text-center - %h2.form-signin-heading.text-center Eesti Interneti SA - %hr - .form-signin - = form_for(@admin_user, url: admin_sessions_path, method: :create, html: {class: 'form-signin'}) do |f| - = render 'admin/shared/errors', object: f.object - - - error_class = f.object.errors.any? ? 'has-error' : '' - %div{class: error_class} - = f.text_field :username, class: 'form-control', placeholder: t(:username), required: true - = f.password_field :password, class: 'form-control', - autocomplete: 'off', placeholder: t(:password), required: true - %button.btn.btn-lg.btn-primary.btn-block{:type => 'submit'}= t(:log_in) - diff --git a/app/views/admin/sessions/new.html.erb b/app/views/admin/sessions/new.html.erb new file mode 100644 index 000000000..c875c00ce --- /dev/null +++ b/app/views/admin/sessions/new.html.erb @@ -0,0 +1,29 @@ +
+ <%= form_for resource, as: resource_name, url: session_path(resource_name), + html: { class: 'col-md-6 form-signin center-block text-center' } do |f| %> +

<%= t '.header_html' %>

+ +
+ + <%= f.label :username, class: 'sr-only' %> + <%= f.text_field :username, placeholder: AdminUser.human_attribute_name(:username), + required: true, + autofocus: true, + class: 'form-control' %> + + <%= f.label :password, class: 'sr-only' %> + <%= f.password_field :password, placeholder: AdminUser.human_attribute_name(:password), + required: true, + class: 'form-control' %> + + <% if devise_mapping.rememberable? -%> +
+ +
+ <% end -%> + + <%= f.submit t('.sign_in_btn'), class: 'btn btn-lg btn-primary btn-block' %> + <% end %> +
+ +<%= render 'links' %> \ No newline at end of file diff --git a/app/views/admin/shared/_errors.haml b/app/views/admin/shared/_errors.haml deleted file mode 100644 index 50eb6de12..000000000 --- a/app/views/admin/shared/_errors.haml +++ /dev/null @@ -1,5 +0,0 @@ -- if object.errors.any? - %p.text-danger - - object.errors.each do |attr, err| - = err - %br diff --git a/app/views/layouts/admin/base.haml b/app/views/layouts/admin/base.haml index 717c5015c..792a8cc0b 100644 --- a/app/views/layouts/admin/base.haml +++ b/app/views/layouts/admin/base.haml @@ -10,7 +10,7 @@ = csrf_meta_tags = stylesheet_link_tag 'admin-manifest', media: 'all' = favicon_link_tag 'favicon.ico' - %body{:style => env_style} + %body{:style => env_style, class: body_css_class} .navbar.navbar-inverse.navbar-static-top{role: "navigation"} .container .navbar-header @@ -19,7 +19,7 @@ %span.icon-bar %span.icon-bar %span.icon-bar - = link_to admin_dashboard_path, class: 'navbar-brand' do + = link_to admin_root_path, class: 'navbar-brand' do = ENV['app_name'] - if unstable_env.present? .text-center diff --git a/app/views/layouts/devise.haml b/app/views/layouts/devise.haml index 81248b86d..e6abcdcc0 100644 --- a/app/views/layouts/devise.haml +++ b/app/views/layouts/devise.haml @@ -9,7 +9,7 @@ = csrf_meta_tags = stylesheet_link_tag 'admin-manifest', media: 'all' = favicon_link_tag 'favicon.ico' - %body{:style => env_style} + %body{:style => env_style, class: body_css_class} .navbar.navbar-inverse.navbar-static-top{role: "navigation"} .container .navbar-header @@ -18,7 +18,7 @@ %span.icon-bar %span.icon-bar %span.icon-bar - = link_to admin_dashboard_path, class: 'navbar-brand' do + = link_to new_admin_user_session_path, class: 'navbar-brand' do = ENV['app_name'] - if unstable_env.present? .text-center diff --git a/app/views/layouts/registrant/application.html.erb b/app/views/layouts/registrant/application.html.erb index b5ddb5f0f..7873728d5 100644 --- a/app/views/layouts/registrant/application.html.erb +++ b/app/views/layouts/registrant/application.html.erb @@ -14,7 +14,7 @@ <%= stylesheet_link_tag 'registrant-manifest', media: 'all' %> <%= favicon_link_tag 'favicon.ico' %> - +