58 Commits (58bfe8c43a952ea945c8fde63289967ec086f077)

Author	SHA1	Message	Date
Matt Jankowski	6c0e3f490a	Fix RSpec/MissingExampleGroupArgument cop (#25310)	2 years ago
Matt Jankowski	c42591356d	Fix `RSpec/DescribedClass` cop (#25104)	2 years ago
Matt Jankowski	b896b16cb3	Fix RSpec/PredicateMatcher cop (#25102)	2 years ago
Matt Jankowski	c97b611b6b	Fix RSpec/InferredSpecType cop (#24736)	2 years ago
Matt Jankowski	4cfe52635c	Add pending spec for User.those_who_can (#24724)	2 years ago
Nick Schonning	a3393d0d07	Autofix Rubocop RSpec/MatchArray (#24050)	2 years ago
Eugen Rochko	a9b5598c97	Change user settings to be stored in a more optimal way (#23630) ... Co-authored-by: Claire <claire.github-309c@sitedethib.com>	2 years ago
Nick Schonning	84cc805cae	Enable Style/FrozenStringLiteralComment for specs (#23790)	2 years ago
Nick Schonning	5116347eb7	Autofix Rubocop RSpec/BeEq (#23740)	2 years ago
Nick Schonning	4552685f6b	Autofix Rubocop RSpec/LeadingSubject (#23670)	2 years ago
Nick Schonning	bd1d57c230	Autofix Rubocop RSpec/EmptyLineAfterSubject (#23719)	2 years ago
Nick Schonning	65ba0d92ef	Enable Rubocop RSpec/NotToNot (#23723)	2 years ago
Nick Schonning	ac3561098e	Autofix Rubocop RSpec/LetBeforeExamples (#23671)	2 years ago
Nick Schonning	c0a645f647	Autofix Rubocop RSpec/ExampleWording (#23667)	2 years ago
Nick Schonning	54318dcd6d	Autofix Rubocop RSpec/ClassCheck (#23685)	2 years ago
Nick Schonning	68b1071f86	Autofix Rubocop RSpec/BeNil (#23653)	2 years ago
Claire	6883fddb19	Fix account activation being triggered before email confirmation (#23245) ... * Add tests * Fix account activation being triggered before email confirmation Fixes #23098	2 years ago
Eugen Rochko	44b2ee3485	Add customizable user roles (#18641) ... * Add customizable user roles * Various fixes and improvements * Add migration for old settings and fix tootctl role management	3 years ago
Jeong Arm	2fd2666eea	Add test for user matching ip (#17572)	3 years ago
Claire	e38fc319dc	Refactor and improve tests (#17386) ... * Change account and user fabricators to simplify and improve tests - `Fabricate(:account)` implicitly fabricates an associated `user` if no `domain` attribute is given (an account with `domain: nil` is considered a local account, but no user record was created), unless `user: nil` is passed - `Fabricate(:account, user: Fabricate(:user))` should still be possible but is discouraged. * Fix and refactor tests - avoid passing unneeded attributes to `Fabricate(:user)` or `Fabricate(:account)` - avoid embedding `Fabricate(:user)` into a `Fabricate(:account)` or the other way around - prefer `Fabricate(:user, account_attributes: …)` to `Fabricate(:user, account: Fabricate(:account, …)` - also, some tests were using remote accounts with local user records, which is not representative of production code.	3 years ago
Eugen Rochko	771c9d4ba8	Add ability to skip sign-in token authentication for specific users (#16427) ... Remove "active within last two weeks" exception for sign in token requirement Change admin reset password to lock access until the password is reset	4 years ago
Claire	cbd0ee1d07	Update Mastodon to Rails 6.1 (#15910) ... * Update devise-two-factor to unreleased fork for Rails 6 support Update tests to match new `rotp` version. * Update nsa gem to unreleased fork for Rails 6 support * Update rails to 6.1.3 and rails-i18n to 6.0 * Update to unreleased fork of pluck_each for Ruby 6 support * Run "rails app:update" * Add missing ActiveStorage config file * Use config.ssl_options instead of removed ApplicationController#force_ssl Disabled force_ssl-related tests as they do not seem to be easily testable anymore. * Fix nonce directives by removing Rails 5 specific monkey-patching * Fix fixture_file_upload deprecation warning * Fix yield-based test failing with Rails 6 * Use Rails 6's index_with when possible * Use ActiveRecord::Cache::Store#delete_multi from Rails 6 This will yield better performances when deleting an account * Disable Rails 6.1's automatic preload link headers Since Rails 6.1, ActionView adds preload links for javascript files in the Links header per default. In our case, that will bloat headers too much and potentially cause issues with reverse proxies. Furhermore, we don't need those links, as we already output them as HTML link tags. * Switch to Rails 6.0 default config * Switch to Rails 6.1 default config * Do not include autoload paths in the load path	4 years ago
Claire	051efed5ed	Bypass MX validation for explicitly allowed domains (#15930) ... * Bypass MX validation for explicitly allowed domains This spares some lookups and prevent issues in some edge cases with local domains. * Add tests * Fix test	4 years ago
santiagorodriguez96	e8d41bc2fe	Add WebAuthn as an alternative 2FA method (#14466) ... * feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>	5 years ago
Eugen Rochko	71921f6bc3	Fix user disabling changing activity timestamps, fix nil error (#12943)	5 years ago
Eugen Rochko	964ae8eee5	Change unconfirmed user login behaviour (#11375) ... Allow access to account settings, 2FA, authorized applications, and account deletions to unconfirmed and pending users, as well as users who had their accounts disabled. Suspended users cannot update their e-mail or password or delete their account. Display account status on account settings page, for example, when an account is frozen, limited, unconfirmed or pending review. After sign up, login users straight away and show a simple page that tells them the status of their account with links to account settings and logout, to reduce onboarding friction and allow users to correct wrongly typed e-mail addresses. Move the final sign-up step of SSO integrations to be the same as above to reduce code duplication.	6 years ago
Eugen Rochko	5d2fc6de32	Add REST API for creating an account (#9572) ... * Add REST API for creating an account The method is available to apps with a token obtained via the client credentials grant. It creates a user and account records, as well as an access token for the app that initiated the request. The user is unconfirmed, and an e-mail is sent as usual. The method returns the access token, which the app should save for later. The REST API is not available to users with unconfirmed accounts, so the app must be smart to wait for the user to click a link in their e-mail inbox. The method is rate-limited by IP to 5 requests per 30 minutes. * Redirect users back to app from confirmation if they were created with an app * Add tests * Return 403 on the method if registrations are not open * Require agreement param to be true in the API when creating an account	6 years ago
Eugen Rochko	73faadad28	Redesign admin accounts index (#9340) ... * Improve overview of accounts in admin UI - Display suspended status, role, last activity and IP prominently - Default to showing local accounts - Default to not showing suspended accounts * Remove unused strings * Fix tests * Allow filtering accounts by IP mask	6 years ago
ashleyhull-versent	f194857ac9	rubocop issues - Cleaning up (#8912) ... * cleanup pass * undo mistakes * fixed. * revert	6 years ago
aus-social	0a4739c732	lint pass 2 (#8878) ... * Code quality pass * Typofix * Update applications_controller_spec.rb * Update applications_controller_spec.rb	7 years ago
Eugen Rochko	2f34b747b3	Allow mods to disable login, improve message when login disabled (#8329) ... * Allow moderators to disable/enable login * Instead of rejecting login, show forbidden error when login disabled Avoid confusion because when login is rejected, the message is that the account is not activated, which is wrong. * Fix tests	7 years ago
Eugen Rochko	7eec279c7f	Change language opt-out to language opt-in (#7823) ... * Switch filtered_languages to chosen_languages * Adjust interface * Remove unused translations	7 years ago
Eugen Rochko	c73ce7b695	Store home feeds for 7 days instead of 14 (#7354) ... * Store home feeds for 7 days instead of 14 Reduces workload for status fan-out to active followers * Fix test for user model	7 years ago
Shuhei Kitagawa	6c40e567aa	Add missing tests for user.rb (#7306)	7 years ago
Patrick Figel	5ec25ff3e1	Fix email confirmation link not updating email (#6187) ... A change introduced in #6125 prevents `Devise::Models::Confirmable#confirm` from being called for existing users, which in turn leads to `email` not being set to `unconfirmed_email`, breaking email updates. This also adds a test that would've caught this issue.	7 years ago
Eugen Rochko	740f8a95a9	Add consumable invites (#5814) ... * Add consumable invites * Add UI for generating invite codes * Add tests * Display max uses and expiration in invites table, delete invite * Remove unused column and redundant validator - Default follows not used, probably bad idea - InviteCodeValidator is redundant because RegistrationsController checks invite code validity * Add admin setting to disable invites * Add admin UI for invites, configurable role for invite creation - Admin UI that lists everyone's invites, always available - Admin setting min_invite_role to control who can invite people - Non-admin invite UI only visible if users are allowed to * Do not remove invites from database, expire them instantly	7 years ago
ysksn	19e8b861a2	Delegate some methods of User to @settings (#5706) ... * Move some tests of User into Settings::ScopedSettings * Add a test for User@settings	7 years ago
Colin Mitchell	871c0d251a	Application prefs section (#2758) ... * Add code for creating/managing apps to settings section * Add specs for app changes * Fix controller spec * Fix view file I pasted over by mistake * Add locale strings. Add 'my apps' to nav * Add Client ID/Secret to App page. Add some visual separation * Fix rubocop warnings * Fix embarrassing typo I lost an `end` statement while fixing a merge conflict. * Add code for creating/managing apps to settings section - Add specs for app changes - Add locale strings. Add 'my apps' to nav - Add Client ID/Secret to App page. Add some visual separation - Fix some bugs/warnings * Update to match code standards * Trigger notification * Add warning about not sharing API secrets * Tweak spec a bit * Cleanup fixture creation by using let! * Remove unused key * Add foreign key for application<->user	8 years ago
Yamagishi Kazutoshi	3267e4a785	Add unfollow modal (optional) (#4246) ... * Add unfollow modal * unfollowing someone * remove unnecessary prop	8 years ago
Damien Erambert	18d3fa953b	Add a setting allowing the use of system's default font in Web UI (#4033) ... * add a system_font_ui setting on the server * Plug the system_font_ui on the front-end * add EN/FR locales for the new setting * put Roboto after all other fonts * remove trailing whitespace so CodeClimate is happy * fix user_spec.rb * correctly write user_spect this time * slightly better way of adding the classes * add comments to the system-font stack for clarification * use .system-font for the class instead * don't use multiple lines for comments * remove trailing whitespace * use the classnames module for consistency * use `mastodon-font-sans-serif` instead of Roboto directly	8 years ago
Eugen Rochko	c207b4bb33	Fix db:seed - only run some validations when the field was changed (#3592) ... * Fix db:seed - only run some validations when the field was changed * Add tests	8 years ago
Yamagishi Kazutoshi	0a0b9a271a	Improve RuboCop rules (compatibility to Code Climate) (#3636) ... 08f8de84eb/Gemfile.lock (L38) Code Climate is using RuboCop v0.46.0. Change several rules to maintain compatibility.	8 years ago
unarist	0f1b1d78b1	Use "match_array" only for order independent assertions (#3626)	8 years ago
Akihiko Odaki (@fn_aki@pawoo.net)	42844df966	Spec ScopedSettings (#3559)	8 years ago
Akihiko Odaki	7db98aa70e	Refactor User and spec (#3431) ... * Protect send_devise_notification of User * Improve spec for User	8 years ago
Matt Jankowski	8f4b7c1820	Filter languages with opt out (#3175) ... * Remove allowed_languages and add filtered_languages * Use filtered_languages instead of allowed_languages	8 years ago
Matt Jankowski	bba537a7be	Improve allowed language handling (#2897) ... * Dont allow empty value in user allowed languages * Sanitize language input to reject blank values in array	8 years ago
Kaylee	7880671f35	Add option to disable two factor auth in admin accounts panel. (#2584) ... * Add option to disable two factor auth in admin accounts panel. Closes #2578 * Add @mjankowski's suggestions. * Moves destroy actions behind User#disable_two_factor! * Adds spec coverage for Admin:TwoFactorAuthenticationsController and User#disable_two_factor!	8 years ago
Guillaume Lo Re	7177e37b99	Stricter whitelist rules (#2213) ... * Stricter whitelist rules * Linting * Added spec for blacklisting * Test subdomain blacklist on domain whitelist * No need to split * Change spec name	8 years ago
Ash Furrow	723f25a999	Admin UI for confirming users (#2245) ... * Shows confirmed status in list. * Adds ability to confirm users in admin UI. * Added new english translations. * Addresses feedback from #2245. * More feedback.	8 years ago