2018-09-23 19:44:14 +00:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2015-05-06 17:35:55 +00:00
|
|
|
class Profiles::TwoFactorAuthsController < Profiles::ApplicationController
|
2017-03-07 18:48:57 +00:00
|
|
|
skip_before_action :check_two_factor_requirement
|
2020-09-07 12:08:27 +00:00
|
|
|
before_action do
|
|
|
|
push_frontend_feature_flag(:webauthn)
|
|
|
|
end
|
2015-12-18 20:29:13 +00:00
|
|
|
|
2020-10-08 18:08:32 +00:00
|
|
|
feature_category :authentication_and_authorization
|
|
|
|
|
2016-06-06 04:44:51 +00:00
|
|
|
def show
|
2020-09-02 15:10:54 +00:00
|
|
|
unless current_user.two_factor_enabled?
|
2015-05-23 22:47:53 +00:00
|
|
|
current_user.otp_secret = User.generate_otp_secret(32)
|
2015-03-28 00:53:08 +00:00
|
|
|
end
|
2015-12-24 20:58:46 +00:00
|
|
|
|
2015-12-24 02:02:52 +00:00
|
|
|
unless current_user.otp_grace_period_started_at && two_factor_grace_period
|
|
|
|
current_user.otp_grace_period_started_at = Time.current
|
|
|
|
end
|
2015-12-24 20:58:46 +00:00
|
|
|
|
2017-09-27 09:48:33 +00:00
|
|
|
Users::UpdateService.new(current_user, user: current_user).execute!
|
2015-03-28 00:53:08 +00:00
|
|
|
|
2016-06-06 04:44:51 +00:00
|
|
|
if two_factor_authentication_required? && !current_user.two_factor_enabled?
|
2017-03-08 11:09:15 +00:00
|
|
|
two_factor_authentication_reason(
|
|
|
|
global: lambda do
|
|
|
|
flash.now[:alert] =
|
2019-05-17 05:59:31 +00:00
|
|
|
_('The global settings require you to enable Two-Factor Authentication for your account.')
|
2017-03-08 11:09:15 +00:00
|
|
|
end,
|
|
|
|
group: lambda do |groups|
|
2019-03-20 08:17:11 +00:00
|
|
|
flash.now[:alert] = groups_notification(groups)
|
2017-03-08 11:09:15 +00:00
|
|
|
end
|
|
|
|
)
|
|
|
|
|
|
|
|
unless two_factor_grace_period_expired?
|
2016-02-29 18:58:36 +00:00
|
|
|
grace_period_deadline = current_user.otp_grace_period_started_at + two_factor_grace_period.hours
|
2019-05-17 05:59:31 +00:00
|
|
|
flash.now[:alert] = flash.now[:alert] + _(" You need to do this before %{grace_period_deadline}.") % { grace_period_deadline: l(grace_period_deadline) }
|
2016-02-29 18:58:36 +00:00
|
|
|
end
|
2015-12-24 04:04:41 +00:00
|
|
|
end
|
|
|
|
|
2015-03-28 00:53:08 +00:00
|
|
|
@qr_code = build_qr_code
|
2016-10-17 14:39:14 +00:00
|
|
|
@account_string = account_string
|
2020-09-07 12:08:27 +00:00
|
|
|
|
|
|
|
if Feature.enabled?(:webauthn)
|
|
|
|
setup_webauthn_registration
|
|
|
|
else
|
|
|
|
setup_u2f_registration
|
|
|
|
end
|
2015-03-28 00:01:24 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def create
|
2020-10-16 18:09:04 +00:00
|
|
|
otp_validation_result =
|
|
|
|
::Users::ValidateOtpService.new(current_user).execute(params[:pin_code])
|
|
|
|
|
|
|
|
if otp_validation_result[:status] == :success
|
2020-09-02 15:10:54 +00:00
|
|
|
ActiveSession.destroy_all_but_current(current_user, session)
|
|
|
|
|
2017-09-27 09:48:33 +00:00
|
|
|
Users::UpdateService.new(current_user, user: current_user, otp_required_for_login: true).execute! do |user|
|
2017-06-23 17:00:22 +00:00
|
|
|
@codes = user.generate_otp_backup_codes!
|
2017-06-22 09:27:37 +00:00
|
|
|
end
|
2015-03-28 00:01:24 +00:00
|
|
|
|
2015-04-02 18:57:36 +00:00
|
|
|
render 'create'
|
2015-03-28 00:53:08 +00:00
|
|
|
else
|
2019-05-17 05:59:31 +00:00
|
|
|
@error = _('Invalid pin code')
|
2015-03-28 00:53:08 +00:00
|
|
|
@qr_code = build_qr_code
|
2020-09-07 12:08:27 +00:00
|
|
|
|
|
|
|
if Feature.enabled?(:webauthn)
|
|
|
|
setup_webauthn_registration
|
|
|
|
else
|
|
|
|
setup_u2f_registration
|
|
|
|
end
|
|
|
|
|
2016-06-06 04:44:51 +00:00
|
|
|
render 'show'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
# A U2F (universal 2nd factor) device's information is stored after successful
|
|
|
|
# registration, which is then used while 2FA authentication is taking place.
|
|
|
|
def create_u2f
|
2020-09-07 12:08:27 +00:00
|
|
|
@u2f_registration = U2fRegistration.register(current_user, u2f_app_id, device_registration_params, session[:challenges])
|
2015-05-22 22:33:44 +00:00
|
|
|
|
2016-06-06 04:44:51 +00:00
|
|
|
if @u2f_registration.persisted?
|
|
|
|
session.delete(:challenges)
|
2019-03-20 08:17:11 +00:00
|
|
|
redirect_to profile_two_factor_auth_path, notice: s_("Your U2F device was registered!")
|
2016-06-06 04:44:51 +00:00
|
|
|
else
|
|
|
|
@qr_code = build_qr_code
|
|
|
|
setup_u2f_registration
|
|
|
|
render :show
|
2015-03-28 00:53:08 +00:00
|
|
|
end
|
2015-03-28 00:01:24 +00:00
|
|
|
end
|
|
|
|
|
2020-09-07 12:08:27 +00:00
|
|
|
def create_webauthn
|
|
|
|
@webauthn_registration = Webauthn::RegisterService.new(current_user, device_registration_params, session[:challenge]).execute
|
|
|
|
if @webauthn_registration.persisted?
|
|
|
|
session.delete(:challenge)
|
|
|
|
|
|
|
|
redirect_to profile_two_factor_auth_path, notice: s_("Your WebAuthn device was registered!")
|
|
|
|
else
|
|
|
|
@qr_code = build_qr_code
|
|
|
|
|
|
|
|
setup_webauthn_registration
|
|
|
|
|
|
|
|
render :show
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2015-03-31 19:42:17 +00:00
|
|
|
def codes
|
2017-09-27 09:48:33 +00:00
|
|
|
Users::UpdateService.new(current_user, user: current_user).execute! do |user|
|
2017-06-22 09:27:37 +00:00
|
|
|
@codes = user.generate_otp_backup_codes!
|
|
|
|
end
|
2015-03-31 19:42:17 +00:00
|
|
|
end
|
|
|
|
|
2015-03-28 00:01:24 +00:00
|
|
|
def destroy
|
2020-08-20 15:10:18 +00:00
|
|
|
result = TwoFactor::DestroyService.new(current_user, user: current_user).execute
|
2015-03-28 00:01:24 +00:00
|
|
|
|
2020-08-20 15:10:18 +00:00
|
|
|
if result[:status] == :success
|
|
|
|
redirect_to profile_account_path, status: :found, notice: s_('Two-factor authentication has been disabled successfully!')
|
|
|
|
else
|
|
|
|
redirect_to profile_account_path, status: :found, alert: result[:message]
|
|
|
|
end
|
2015-03-28 00:01:24 +00:00
|
|
|
end
|
2015-03-28 00:53:08 +00:00
|
|
|
|
2015-12-24 02:02:52 +00:00
|
|
|
def skip
|
2015-12-24 04:04:41 +00:00
|
|
|
if two_factor_grace_period_expired?
|
2019-03-20 08:17:11 +00:00
|
|
|
redirect_to new_profile_two_factor_auth_path, alert: s_('Cannot skip two factor authentication setup')
|
2015-12-24 02:02:52 +00:00
|
|
|
else
|
2017-03-07 18:51:22 +00:00
|
|
|
session[:skip_two_factor] = current_user.otp_grace_period_started_at + two_factor_grace_period.hours
|
2015-12-24 02:02:52 +00:00
|
|
|
redirect_to root_path
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2015-03-28 00:53:08 +00:00
|
|
|
private
|
|
|
|
|
|
|
|
def build_qr_code
|
2016-10-17 14:39:14 +00:00
|
|
|
uri = current_user.otp_provisioning_uri(account_string, issuer: issuer_host)
|
2017-02-22 00:51:36 +00:00
|
|
|
RQRCode.render_qrcode(uri, :svg, level: :m, unit: 3)
|
2015-03-28 00:53:08 +00:00
|
|
|
end
|
2015-06-15 22:12:32 +00:00
|
|
|
|
2016-10-17 14:39:14 +00:00
|
|
|
def account_string
|
|
|
|
"#{issuer_host}:#{current_user.email}"
|
|
|
|
end
|
|
|
|
|
2015-06-15 22:12:32 +00:00
|
|
|
def issuer_host
|
|
|
|
Gitlab.config.gitlab.host
|
|
|
|
end
|
2016-06-06 04:44:51 +00:00
|
|
|
|
|
|
|
# Setup in preparation of communication with a U2F (universal 2nd factor) device
|
|
|
|
# Actual communication is performed using a Javascript API
|
|
|
|
def setup_u2f_registration
|
|
|
|
@u2f_registration ||= U2fRegistration.new
|
2020-09-07 12:08:27 +00:00
|
|
|
@registrations = u2f_registrations
|
2016-06-06 04:44:51 +00:00
|
|
|
u2f = U2F::U2F.new(u2f_app_id)
|
|
|
|
|
|
|
|
registration_requests = u2f.registration_requests
|
2020-09-07 12:08:27 +00:00
|
|
|
sign_requests = u2f.authentication_requests(current_user.u2f_registrations.map(&:key_handle))
|
2016-06-06 04:44:51 +00:00
|
|
|
session[:challenges] = registration_requests.map(&:challenge)
|
|
|
|
|
|
|
|
gon.push(u2f: { challenges: session[:challenges], app_id: u2f_app_id,
|
|
|
|
register_requests: registration_requests,
|
2016-07-11 07:30:22 +00:00
|
|
|
sign_requests: sign_requests })
|
2016-06-06 04:44:51 +00:00
|
|
|
end
|
2016-08-16 16:18:36 +00:00
|
|
|
|
2020-09-07 12:08:27 +00:00
|
|
|
def device_registration_params
|
|
|
|
params.require(:device_registration).permit(:device_response, :name)
|
|
|
|
end
|
|
|
|
|
|
|
|
def setup_webauthn_registration
|
|
|
|
@registrations = webauthn_registrations
|
|
|
|
@webauthn_registration ||= WebauthnRegistration.new
|
|
|
|
|
|
|
|
unless current_user.webauthn_xid
|
|
|
|
current_user.user_detail.update!(webauthn_xid: WebAuthn.generate_user_id)
|
|
|
|
end
|
|
|
|
|
|
|
|
options = webauthn_options
|
|
|
|
session[:challenge] = options.challenge
|
|
|
|
|
|
|
|
gon.push(webauthn: { options: options, app_id: u2f_app_id })
|
|
|
|
end
|
|
|
|
|
|
|
|
# Adds delete path to u2f registrations
|
|
|
|
# to reduce logic in view template
|
|
|
|
def u2f_registrations
|
|
|
|
current_user.u2f_registrations.map do |u2f_registration|
|
|
|
|
{
|
|
|
|
name: u2f_registration.name,
|
|
|
|
created_at: u2f_registration.created_at,
|
|
|
|
delete_path: profile_u2f_registration_path(u2f_registration)
|
|
|
|
}
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def webauthn_registrations
|
|
|
|
current_user.webauthn_registrations.map do |webauthn_registration|
|
|
|
|
{
|
|
|
|
name: webauthn_registration.name,
|
|
|
|
created_at: webauthn_registration.created_at,
|
|
|
|
delete_path: profile_webauthn_registration_path(webauthn_registration)
|
|
|
|
}
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def webauthn_options
|
|
|
|
WebAuthn::Credential.options_for_create(
|
|
|
|
user: { id: current_user.webauthn_xid, name: current_user.username },
|
|
|
|
exclude: current_user.webauthn_registrations.map { |c| c.credential_xid },
|
|
|
|
authenticator_selection: { user_verification: 'discouraged' },
|
|
|
|
rp: { name: 'GitLab' }
|
|
|
|
)
|
2016-08-16 16:18:36 +00:00
|
|
|
end
|
2019-03-20 08:17:11 +00:00
|
|
|
|
|
|
|
def groups_notification(groups)
|
|
|
|
group_links = groups.map { |group| view_context.link_to group.full_name, group_path(group) }.to_sentence
|
|
|
|
leave_group_links = groups.map { |group| view_context.link_to (s_("leave %{group_name}") % { group_name: group.full_name }), leave_group_members_path(group), remote: false, method: :delete}.to_sentence
|
|
|
|
|
|
|
|
s_(%{The group settings for %{group_links} require you to enable Two-Factor Authentication for your account. You can %{leave_group_links}.})
|
2020-09-07 12:08:27 +00:00
|
|
|
.html_safe % { group_links: group_links.html_safe, leave_group_links: leave_group_links.html_safe }
|
2019-03-20 08:17:11 +00:00
|
|
|
end
|
2015-03-28 00:01:24 +00:00
|
|
|
end
|