|
- # frozen_string_literal: true
-
- class Auth::SessionsController < Devise::SessionsController
- include Devise::Controllers::Rememberable
-
- layout 'auth'
-
- skip_before_action :require_no_authentication, only: [:create]
- skip_before_action :require_functional!
-
- before_action :set_instance_presenter, only: [:new]
- before_action :set_body_classes
-
- def new
- Devise.omniauth_configs.each do |provider, config|
- return redirect_to(omniauth_authorize_path(resource_name, provider)) if config.strategy.redirect_at_sign_in
- end
-
- super
- end
-
- def create
- self.resource = begin
- if user_params[:email].blank? && session[:otp_user_id].present?
- User.find(session[:otp_user_id])
- else
- warden.authenticate!(auth_options)
- end
- end
-
- if resource.otp_required_for_login?
- if user_params[:otp_attempt].present? && session[:otp_user_id].present?
- authenticate_with_two_factor_via_otp(resource)
- else
- prompt_for_two_factor(resource)
- end
- else
- authenticate_and_respond(resource)
- end
- end
-
- def destroy
- tmp_stored_location = stored_location_for(:user)
- super
- session.delete(:challenge_passed_at)
- flash.delete(:notice)
- store_location_for(:user, tmp_stored_location) if continue_after?
- end
-
- protected
-
- def user_params
- params.require(:user).permit(:email, :password, :otp_attempt)
- end
-
- def after_sign_in_path_for(resource)
- last_url = stored_location_for(:user)
-
- if home_paths(resource).include?(last_url)
- root_path
- else
- last_url || root_path
- end
- end
-
- def after_sign_out_path_for(_resource_or_scope)
- Devise.omniauth_configs.each_value do |config|
- return root_path if config.strategy.redirect_at_sign_in
- end
-
- super
- end
-
- def valid_otp_attempt?(user)
- user.validate_and_consume_otp!(user_params[:otp_attempt]) ||
- user.invalidate_otp_backup_code!(user_params[:otp_attempt])
- rescue OpenSSL::Cipher::CipherError
- false
- end
-
- def authenticate_with_two_factor_via_otp(user)
- if valid_otp_attempt?(user)
- session.delete(:otp_user_id)
- authenticate_and_respond(user)
- else
- flash.now[:alert] = I18n.t('users.invalid_otp_token')
- prompt_for_two_factor(user)
- end
- end
-
- def prompt_for_two_factor(user)
- session[:otp_user_id] = user.id
- render :two_factor
- end
-
- def authenticate_and_respond(user)
- sign_in(user)
- remember_me(user)
-
- respond_with user, location: after_sign_in_path_for(user)
- end
-
- private
-
- def set_instance_presenter
- @instance_presenter = InstancePresenter.new
- end
-
- def set_body_classes
- @body_classes = 'lighter'
- end
-
- def home_paths(resource)
- paths = [about_path]
-
- if single_user_mode? && resource.is_a?(User)
- paths << short_account_path(username: resource.account)
- end
-
- paths
- end
-
- def continue_after?
- truthy_param?(:continue)
- end
- end
|