Class: SessionController

# File 'app/controllers/session_controller.rb', line 105

def become
  raise Discourse::InvalidAccess if Rails.env.production?
  raise Discourse::ReadOnly if @readonly_mode

  if ENV["DISCOURSE_DEV_ALLOW_ANON_TO_IMPERSONATE"] != "1"
    render(content_type: "text/plain", inline: <<~TEXT)
      To enable impersonating any user without typing passwords set the following ENV var

      export DISCOURSE_DEV_ALLOW_ANON_TO_IMPERSONATE=1

      You can do that in your bashrc of bash profile file or the script you use to launch the web server
    TEXT

    return
  end

  user = User.find_by_username(params[:session_id])
  raise "User #{params[:session_id]} not found" if user.blank?

  log_on_user(user)

  if params[:redirect] == "false"
    render plain: "Signed in to #{params[:session_id]} successfully"
  else
    redirect_to path("/")
  end
end

#create ⇒ `Object`

Raises:

(Discourse::ReadOnly)

# File 'app/controllers/session_controller.rb', line 288

def create
  params.require(:login)
  params.require(:password)

  return invalid_credentials if params[:password].length > User.max_password_length

  user = User.find_by_username_or_email(normalized_login_param)

  raise Discourse::ReadOnly if staff_writes_only_mode? && !user&.staff?

  rate_limit_second_factor!(user)

  if user.present?
    # If their password is correct
    unless user.confirm_password?(params[:password])
      invalid_credentials
      return
    end

    # If the site requires user approval and the user is not approved yet
    if login_not_approved_for?(user)
      render json: login_not_approved
      return
    end

    # User signed on with username and password, so let's prevent the invite link
    # from being used to log in (if one exists).
    Invite.invalidate_for_email(user.email)
  else
    invalid_credentials
    return
  end

  if payload = login_error_check(user)
    return render json: payload
  end

  second_factor_auth_result = authenticate_second_factor(user)
  return render(json: @second_factor_failure_payload) if !second_factor_auth_result.ok

  if user.active && user.email_confirmed?
    login(user, second_factor_auth_result)
  else
    not_activated(user)
  end
end

#csrf ⇒ `Object`



20
21
22

# File 'app/controllers/session_controller.rb', line 20

def csrf
  render json: { csrf: form_authenticity_token }
end

#current ⇒ `Object`

# File 'app/controllers/session_controller.rb', line 576

def current
  if current_user.present?
    render_serialized(current_user, CurrentUserSerializer)
  else
    render body: nil, status: 404
  end
end

#destroy ⇒ `Object`

# File 'app/controllers/session_controller.rb', line 584

def destroy
  redirect_url = params[:return_url].presence || SiteSetting.logout_redirect.presence

  sso = SiteSetting.enable_discourse_connect
  only_one_authenticator =
    !SiteSetting.enable_local_logins && Discourse.enabled_authenticators.length == 1
  if SiteSetting.login_required && (sso || only_one_authenticator)
    # In this situation visiting most URLs will start the auth process again
    # Go to the `/login` page to avoid an immediate redirect
    redirect_url ||= path("/login")
  end

  redirect_url ||= path("/")

  event_data = {
    redirect_url: redirect_url,
    user: current_user,
    client_ip: request&.ip,
    user_agent: request&.user_agent,
  }
  DiscourseEvent.trigger(:before_session_destroy, event_data, **Discourse::Utils::EMPTY_KEYWORDS)
  redirect_url = event_data[:redirect_url]

  reset_session
  log_off_user
  if request.xhr?
    render json: { redirect_url: redirect_url }
  else
    redirect_to redirect_url, allow_other_host: true
  end
end

#email_login ⇒ `Object`

# File 'app/controllers/session_controller.rb', line 371

def email_login
  token = params[:token]
  matched_token = EmailToken.confirmable(token, scope: EmailToken.scopes[:email_login])
  user = matched_token&.user

  check_local_login_allowed(user: user, check_login_via_email: true)

  rate_limit_second_factor!(user)

  if user.present? && !authenticate_second_factor(user).ok
    return render(json: @second_factor_failure_payload)
  end

  if user = EmailToken.confirm(token, scope: EmailToken.scopes[:email_login])
    if login_not_approved_for?(user)
      return render json: login_not_approved
    elsif payload = login_error_check(user)
      return render json: payload
    else
      raise Discourse::ReadOnly if staff_writes_only_mode? && !user&.staff?
      user.update_timezone_if_missing(params[:timezone])
      log_on_user(user)
      return render json: success_json
    end
  end

  render json: { error: I18n.t("email_login.invalid_token", base_url: Discourse.base_url) }
end

#email_login_info ⇒ `Object`

# File 'app/controllers/session_controller.rb', line 335

def email_login_info
  token = params[:token]
  matched_token = EmailToken.confirmable(token, scope: EmailToken.scopes[:email_login])
  user = matched_token&.user

  check_local_login_allowed(user: user, check_login_via_email: true)

  if matched_token
    response = { can_login: true, token: token, token_email: matched_token.email }

    matched_user = matched_token.user
    if matched_user&.totp_enabled?
      response.merge!(
        second_factor_required: true,
        backup_codes_enabled: matched_user&.backup_codes_enabled?,
      )
    end

    if matched_user&.security_keys_enabled?
      DiscourseWebauthn.stage_challenge(matched_user, secure_session)
      response.merge!(
        DiscourseWebauthn.allowed_credentials(matched_user, secure_session).merge(
          security_key_required: true,
        ),
      )
    end

    render json: response
  else
    render json: {
             can_login: false,
             error: I18n.t("email_login.invalid_token", base_url: Discourse.base_url),
           }
  end
end

#forgot_password ⇒ `Object`

# File 'app/controllers/session_controller.rb', line 530

def forgot_password
  params.require(:login)

  if ScreenedIpAddress.should_block?(request.remote_ip)
    return render_json_error(I18n.t("login.reset_not_allowed_from_ip_address"))
  end

  RateLimiter.new(nil, "forgot-password-hr-#{request.remote_ip}", 6, 1.hour).performed!
  RateLimiter.new(nil, "forgot-password-min-#{request.remote_ip}", 3, 1.minute).performed!

  user =
    if SiteSetting.hide_email_address_taken && !current_user&.staff?
      if !EmailAddressValidator.valid_value?(normalized_login_param)
        raise Discourse::InvalidParameters.new(:login)
      end
      User.real.where(staged: false).find_by_email(Email.downcase(normalized_login_param))
    else
      User.real.where(staged: false).find_by_username_or_email(normalized_login_param)
    end

  if user
    RateLimiter.new(nil, "forgot-password-login-day-#{user.username}", 6, 1.day).performed!
    email_token =
      user.email_tokens.create!(email: user.email, scope: EmailToken.scopes[:password_reset])
    Jobs.enqueue(
      :critical_user_email,
      type: "forgot_password",
      user_id: user.id,
      email_token: email_token.token,
    )
  else
    RateLimiter.new(
      nil,
      "forgot-password-login-hour-#{normalized_login_param}",
      5,
      1.hour,
    ).performed!
  end

  json = success_json
  json[:user_found] = user.present? if !SiteSetting.hide_email_address_taken
  render json: json
rescue RateLimiter::LimitExceeded
  render_json_error(I18n.t("rate_limiter.slow_down"))
end

#get_honeypot_value ⇒ `Object`

# File 'app/controllers/session_controller.rb', line 616

def get_honeypot_value
  secure_session.set(HONEYPOT_KEY, honeypot_value, expires: 1.hour)
  secure_session.set(CHALLENGE_KEY, challenge_value, expires: 1.hour)

  render json: {
           value: honeypot_value,
           challenge: challenge_value,
           expires_in: SecureSession.expiry,
         }
end

#login_sso_user(sso, user) ⇒ `Object`

# File 'app/controllers/session_controller.rb', line 281

def login_sso_user(sso, user)
  connect_verbose_warn do
    "Verbose SSO log: User was logged on #{user.username}\n\n#{sso.diagnostics}"
  end
  log_on_user(user) if user.id != current_user&.id
end

#one_time_password ⇒ `Object`

# File 'app/controllers/session_controller.rb', line 400

def one_time_password
  @otp_username = otp_username = Discourse.redis.get "otp_#{params[:token]}"

  if otp_username && user = User.find_by_username(otp_username)
    if current_user&.username == otp_username
      Discourse.redis.del "otp_#{params[:token]}"
      return redirect_to path("/")
    elsif request.post?
      log_on_user(user)
      Discourse.redis.del "otp_#{params[:token]}"
      return redirect_to path("/")
    else
      # Display the form
    end
  else
    @error = I18n.t("user_api_key.invalid_token")
  end

  render layout: "no_ember", locals: { hide_auth_buttons: true }
end

#scopes ⇒ `Object`

# File 'app/controllers/session_controller.rb', line 627

def scopes
  if is_api?
    key = request.env[Auth::DefaultCurrentUserProvider::HEADER_API_KEY]
    api_key = ApiKey.active.with_key(key).first
    render_serialized(api_key.api_key_scopes, ApiKeyScopeSerializer, root: "scopes")
  else
    render body: nil, status: 404
  end
end

#second_factor_auth_perform ⇒ `Object`

# File 'app/controllers/session_controller.rb', line 464

def second_factor_auth_perform
  nonce = params.require(:nonce)
  challenge = nil
  error_key = nil
  status_code = 200
  begin
    challenge = SecondFactor::AuthManager.find_second_factor_challenge(nonce, secure_session)
  rescue SecondFactor::BadChallenge => exception
    error_key = exception.error_translation_key
    status_code = exception.status_code
  end

  if error_key
    json =
      failed_json.merge(
        ok: false,
        error: I18n.t(error_key),
        reason: "challenge_not_found_or_expired",
      )
    render json: failed_json.merge(json), status: status_code
    return
  end

  # no proper error messages for these cases because the only way they can
  # happen is if someone is messing with us.
  # the first one can only happen if someone disables a 2FA method after
  # they're redirected to the 2fa page and then uses the same method they've
  # disabled.
  second_factor_method = params[:second_factor_method].to_i
  if !current_user.valid_second_factor_method_for_user?(second_factor_method)
    raise Discourse::InvalidAccess.new
  end
  # and this happens if someone tries to use a 2FA method that's not accepted
  # for the action they're trying to perform. e.g. using backup codes to
  # grant someone admin status.
  if !challenge[:allowed_methods].include?(second_factor_method)
    raise Discourse::InvalidAccess.new
  end

  if !challenge[:successful]
    rate_limit_second_factor!(current_user)
    second_factor_auth_result = current_user.authenticate_second_factor(params, secure_session)
    if second_factor_auth_result.ok
      challenge[:successful] = true
      challenge[:generated_at] += 1.minute.to_i
      secure_session["current_second_factor_auth_challenge"] = challenge.to_json
    else
      error_json =
        second_factor_auth_result
          .to_h
          .deep_symbolize_keys
          .slice(:ok, :error, :reason)
          .merge(failed_json)
      render json: error_json, status: 400
      return
    end
  end
  render json: {
           ok: true,
           callback_method: challenge[:callback_method],
           callback_path: challenge[:callback_path],
           redirect_url: challenge[:redirect_url],
         },
         status: 200
end

#second_factor_auth_show ⇒ `Object`

# File 'app/controllers/session_controller.rb', line 421

def second_factor_auth_show
  user = current_user

  nonce = params.require(:nonce)
  challenge = nil
  error_key = nil
  status_code = 200
  begin
    challenge = SecondFactor::AuthManager.find_second_factor_challenge(nonce, secure_session)
  rescue SecondFactor::BadChallenge => exception
    error_key = exception.error_translation_key
    status_code = exception.status_code
  end

  json = {}
  if challenge
    json.merge!(
      totp_enabled: user.totp_enabled?,
      backup_enabled: user.backup_codes_enabled?,
      allowed_methods: challenge[:allowed_methods],
    )
    if user.security_keys_enabled?
      DiscourseWebauthn.stage_challenge(user, secure_session)
      json.merge!(DiscourseWebauthn.allowed_credentials(user, secure_session))
      json[:security_keys_enabled] = true
    else
      json[:security_keys_enabled] = false
    end
    json[:description] = challenge[:description] if challenge[:description]
  else
    json[:error] = I18n.t(error_key)
  end

  respond_to do |format|
    format.html do
      store_preloaded("2fa_challenge_data", MultiJson.dump(json))
      raise ApplicationController::RenderEmpty.new
    end

    format.json { render json: json, status: status_code }
  end
end

#sso ⇒ `Object`

Raises:

(Discourse::NotFound)

# File 'app/controllers/session_controller.rb', line 24

def sso
  raise Discourse::NotFound unless SiteSetting.enable_discourse_connect?

  destination_url = cookies[:destination_url] || session[:destination_url]
  return_path = params[:return_path] || path("/")

  if destination_url && return_path == path("/")
    uri = URI.parse(destination_url)
    return_path = "#{uri.path}#{uri.query ? "?#{uri.query}" : ""}"
  end

  session.delete(:destination_url)
  cookies.delete(:destination_url)

  sso = DiscourseConnect.generate_sso(return_path, secure_session: secure_session)
  connect_verbose_warn { "Verbose SSO log: Started SSO process\n\n#{sso.diagnostics}" }
  redirect_to sso_url(sso), allow_other_host: true
end

#sso_login ⇒ `Object`

Raises:

(Discourse::NotFound)

# File 'app/controllers/session_controller.rb', line 134

def sso_login
  raise Discourse::NotFound unless SiteSetting.enable_discourse_connect
  raise Discourse::ReadOnly if @readonly_mode && !staff_writes_only_mode?

  params.require(:sso)
  params.require(:sig)

  begin
    sso = DiscourseConnect.parse(request.query_string, secure_session: secure_session)
  rescue DiscourseConnect::ParseError => e
    connect_verbose_warn do
      "Verbose SSO log: Signature parse error\n\n#{e.message}\n\n#{sso&.diagnostics}"
    end

    # Do NOT pass the error text to the client, it would give them the correct signature
    return render_sso_error(text: I18n.t("discourse_connect.login_error"), status: 422)
  end

  if !sso.nonce_valid?
    connect_verbose_warn { "Verbose SSO log: #{sso.nonce_error}\n\n#{sso.diagnostics}" }
    return render_sso_error(text: I18n.t("discourse_connect.timeout_expired"), status: 419)
  end

  if ScreenedIpAddress.should_block?(request.remote_ip)
    connect_verbose_warn do
      "Verbose SSO log: IP address is blocked #{request.remote_ip}\n\n#{sso.diagnostics}"
    end
    return render_sso_error(text: I18n.t("discourse_connect.unknown_error"), status: 500)
  end

  return_path = sso.return_path
  sso.expire_nonce!

  begin
    invite = validate_invitiation!(sso)

    if user = sso.lookup_or_create_user(request.remote_ip)
      raise Discourse::ReadOnly if staff_writes_only_mode? && !user&.staff?

      if user.suspended?
        render_sso_error(text: failed_to_login(user)[:error], status: 403)
        return
      end

      if SiteSetting.must_approve_users? && !user.approved?
        redeem_invitation(invite, sso, user) if invite.present? && user.invited_user.blank?

        if SiteSetting.discourse_connect_not_approved_url.present?
          redirect_to SiteSetting.discourse_connect_not_approved_url, allow_other_host: true
        else
          render_sso_error(text: I18n.t("discourse_connect.account_not_approved"), status: 403)
        end
        return

        # we only want to redeem the invite if
        # the user has not already redeemed an invite
        # (covers the same SSO user visiting an invite link)
      elsif invite.present? && user.invited_user.blank?
        redeem_invitation(invite, sso, user)

        # we directly call user.activate here instead of going
        # through the UserActivator path because we assume the account
        # is valid from the SSO provider's POV and do not need to
        # send an activation email to the user
        user.activate
        login_sso_user(sso, user)

        topic = invite.topics.first
        return_path = topic.present? ? path(topic.relative_url) : path("/")
      elsif !user.active?
        activation = UserActivator.new(user, request, session, cookies)
        activation.finish
        session["user_created_message"] = activation.message
        return redirect_to(users_account_created_path)
      else
        login_sso_user(sso, user)
      end

      # If it's not a relative URL check the host
      if return_path !~ %r{\A/[^/]}
        begin
          uri = URI(return_path)
          if (uri.hostname == Discourse.current_hostname)
            return_path = uri.to_s
          elsif !domain_redirect_allowed?(uri.hostname)
            return_path = path("/")
          end
        rescue StandardError
          return_path = path("/")
        end
      end

      # this can be done more surgically with a regex
      # but it the edge case of never supporting redirects back to
      # any url with `/session/sso` in it anywhere is reasonable
      return_path = path("/") if return_path.include?(path("/session/sso"))

      redirect_to return_path, allow_other_host: true
    else
      render_sso_error(text: I18n.t("discourse_connect.not_found"), status: 500)
    end
  rescue ActiveRecord::RecordInvalid => e
    connect_verbose_warn { <<~TEXT }
      Verbose SSO log: Record was invalid: #{e.record.class.name} #{e.record.id}
      #{e.record.errors.to_h}

      Attributes:
      #{e.record.attributes.slice(*DiscourseConnectBase::ACCESSORS.map(&:to_s))}

      SSO Diagnostics:
      #{sso.diagnostics}
    TEXT

    text = nil

    # If there's a problem with the email we can explain that
    if (e.record.is_a?(User) && e.record.errors[:primary_email].present?)
      if e.record.email.blank?
        text = I18n.t("discourse_connect.no_email")
      else
        text =
          I18n.t("discourse_connect.email_error", email: ERB::Util.html_escape(e.record.email))
      end
    end

    render_sso_error(text: text || I18n.t("discourse_connect.unknown_error"), status: 500)
  rescue DiscourseConnect::BlankExternalId
    render_sso_error(text: I18n.t("discourse_connect.blank_id_error"), status: 500)
  rescue Invite::ValidationFailed => e
    render_sso_error(text: e.message, status: 400)
  rescue Invite::RedemptionFailed => e
    render_sso_error(text: I18n.t("discourse_connect.invite_redeem_failed"), status: 412)
  rescue Invite::UserExists => e
    render_sso_error(text: e.message, status: 412)
  rescue => e
    message = +"Failed to create or lookup user: #{e}."
    message << "  "
    message << "  #{sso.diagnostics}"
    message << "  "
    message << "  #{e.backtrace.join("\n")}"

    Rails.logger.error(message)

    render_sso_error(text: I18n.t("discourse_connect.unknown_error"), status: 500)
  end
end

#sso_provider(payload = nil, confirmed_2fa_during_login = false) ⇒ `Object`

# File 'app/controllers/session_controller.rb', line 43

def sso_provider(payload = nil, confirmed_2fa_during_login = false)
  raise Discourse::NotFound unless SiteSetting.enable_discourse_connect_provider

  result =
    run_second_factor!(
      SecondFactor::Actions::DiscourseConnectProvider,
      payload: payload,
      confirmed_2fa_during_login: confirmed_2fa_during_login,
    )

  if result.second_factor_auth_skipped?
    data = result.data
    if data[:logout]
      params[:return_url] = data[:return_sso_url]
      destroy
      return
    end

    if data[:no_current_user]
      if data[:prompt] == "none"
        redirect_to data[:sso_redirect_url], allow_other_host: true
        return
      else
        cookies[:sso_payload] = payload || request.query_string
        redirect_to path("/login")
        return
      end
    end

    if request.xhr?
      # for the login modal
      cookies[:sso_destination_url] = data[:sso_redirect_url]
    else
      redirect_to data[:sso_redirect_url], allow_other_host: true
    end
  elsif result.no_second_factors_enabled?
    if request.xhr?
      # for the login modal
      cookies[:sso_destination_url] = result.data[:sso_redirect_url]
    else
      redirect_to result.data[:sso_redirect_url], allow_other_host: true
    end
  elsif result.second_factor_auth_completed?
    redirect_url = result.data[:sso_redirect_url]
    render json: success_json.merge(redirect_url: redirect_url)
  end
rescue DiscourseConnectProvider::BlankSecret
  render plain: I18n.t("discourse_connect.missing_secret"), status: 400
rescue DiscourseConnectProvider::ParseError
  # Do NOT pass the error text to the client, it would give them the correct signature
  render plain: I18n.t("discourse_connect.login_error"), status: 422
rescue DiscourseConnectProvider::BlankReturnUrl
  render plain: "return_sso_url is blank, it must be provided", status: 400
rescue DiscourseConnectProvider::InvalidParameterValueError => e
  render plain: I18n.t("discourse_connect.invalid_parameter_value", param: e.param), status: 400
end

Class: SessionController

Constant Summary collapse

Constants inherited from ApplicationController

Constants included from CanonicalURL::ControllerExtensions

Instance Attribute Summary

Attributes inherited from ApplicationController

Instance Method Summary collapse

Methods inherited from ApplicationController

Methods included from VaryHeader

Methods included from ReadOnlyMixin

Methods included from Hijack

Methods included from GlobalPath

Methods included from JsonError

Methods included from CanonicalURL::ControllerExtensions

Methods included from CurrentUser

Instance Method Details

#become ⇒ Object

#create ⇒ Object

#csrf ⇒ Object

#current ⇒ Object

#destroy ⇒ Object

#email_login ⇒ Object

#email_login_info ⇒ Object

#forgot_password ⇒ Object

#get_honeypot_value ⇒ Object

#login_sso_user(sso, user) ⇒ Object

#one_time_password ⇒ Object

#scopes ⇒ Object

#second_factor_auth_perform ⇒ Object

#second_factor_auth_show ⇒ Object

#sso ⇒ Object

#sso_login ⇒ Object

#sso_provider(payload = nil, confirmed_2fa_during_login = false) ⇒ Object

#become ⇒ `Object`

#create ⇒ `Object`

#csrf ⇒ `Object`

#current ⇒ `Object`

#destroy ⇒ `Object`

#email_login ⇒ `Object`

#email_login_info ⇒ `Object`

#forgot_password ⇒ `Object`

#get_honeypot_value ⇒ `Object`

#login_sso_user(sso, user) ⇒ `Object`

#one_time_password ⇒ `Object`

#scopes ⇒ `Object`

#second_factor_auth_perform ⇒ `Object`

#second_factor_auth_show ⇒ `Object`

#sso ⇒ `Object`

#sso_login ⇒ `Object`

#sso_provider(payload = nil, confirmed_2fa_during_login = false) ⇒ `Object`