Commit Graph

285 Commits

Author SHA1 Message Date
Angus McLeod
cb4b8146a3
Add dedicated user_api_key_clients table to allow for 1:many use cases () 2024-11-08 12:05:03 -05:00
Natalie Tay
6c36af9f62
DEV: Add verbose logging for google oauth () 2024-11-08 11:03:17 +08:00
Alan Guo Xiang Tan
322a3be2db
DEV: Remove logical OR assignment of constants ()
Constants should always be only assigned once. The logical OR assignment
of a constant is a relic of the past before we used zeitwerk for
autoloading and had bugs where a file could be loaded twice resulting in
constant redefinition warnings.
2024-10-16 10:09:07 +08:00
Natalie Tay
6bb8ac54cb
DEV: Include a basic oauth faraday formatter in core for usage in managed authenticators ()
We currently have some occurrences of ____FaradayFormatter for OAuth logs. This commit creates a generic formatter so that any new authenticators can use it.
2024-09-05 22:29:29 +08:00
锦心
ac365a86a2
FIX: Trigger user_logged_out event when the user logs out ()
What did this fix?
===============

Previously, we only triggered this event in the `user.logged_out` method.
This resulted in the event being triggered only when the user was logged
out by the administrator or the site had strict logout mode enabled.
This bug affected customers who managed user status via webhooks.

meta topic: https://meta.discourse.org/t/user-log-out-event-not-triggered-in-webhooks/249464
2024-08-22 21:48:27 +08:00
Krzysztof Kotlarek
b64d01bc10
FIX: store information about the login method in the database. ()
Previously in these 2 PRs, we introduced a new site setting `SiteSetting.enforce_second_factor_on_external_auth`.

https://github.com/discourse/discourse/pull/27547
https://github.com/discourse/discourse/pull/27674

When disabled, it should enforce 2FA for local login with username and password and skip the requirement when authenticating with oauth2.

We stored information about the login method in a secure session but it is not reliable. Therefore, information about the login method is moved to the database.
2024-07-24 17:19:58 +10:00
Natalie Tay
751750c7f8
FIX: Do not schedule avatar download if image is '' () 2024-07-03 19:50:31 +08:00
Daniel Waterworth
0a881a59d3
DEV: Don't enforce per ip rate limits for admin api requests () 2024-06-17 13:21:11 -05:00
Loïc Guitaut
2a28cda15c DEV: Update to lastest rubocop-discourse 2024-05-27 18:06:14 +02:00
Ted Johansson
32aaf2e8d3
DEV: Remove deprecated AuthProvider#enabled_setting= ()
AuthProvider#enabled_setting=, used primarily by plugins, has been deprecated since version 2.9, in favour of Authenticator#enabled?. This PR confirms we are seeing no more usage and removes the method.
2024-05-20 18:10:15 +08:00
Ted Johansson
9e31135eca
FEATURE: Allow users to sign in using LinkedIn OpenID Connect ()
LinkedIn has grandfathered its old OAuth2 provider. This can only be used by existing apps. New apps have to use the new OIDC provider.

This PR adds a linkedin_oidc provider to core. This will exist alongside the discourse-linkedin-auth plugin, which will be kept for those still using the deprecated provider.
2024-04-19 18:47:30 +08:00
Ted Johansson
ed2496c59d
FEATURE: Add scheduled Twitter login problem check - Part 1 ()
This PR adds a new scheduled problem check that simply tries to connect to Twitter OAuth endpoint to check that it's working. It is using the default retry strategy of 2 retries 30 seconds apart.
2024-02-26 12:08:12 +08:00
David Taylor
59c2407e18
FEATURE: add username header to global-rate-limited responses ()
This will make it easier to analyze rate limiting in reverse-proxy logs. To make this possible without a database lookup, we add the username to the encrypted `_t` cookie data.
2024-01-15 19:50:37 +00:00
Kelv
2477bcc32e
DEV: lint against Layout/EmptyLineBetweenDefs () 2023-12-15 23:46:04 +08:00
David Taylor
6417173082
DEV: Apply syntax_tree formatting to lib/* 2023-01-09 12:10:19 +00:00
Osama Sayegh
bbcdf74c58
DEV: Flip primary_email_verified? default to false ()
This commit changes the default return value of `Auth::ManagedAuthenticator#primary_email_verified?` to false. We're changing the default to force developers to think about email verification when building a new authentication method. All existing authenticators (in core and official plugins) have been updated to explicitly define the `primary_email_verified?` method in their subclass of `Auth::ManagedAuthenticator` (example commit 65f57a4d05).

Internal topic: t/82084.
2023-01-04 10:51:10 +03:00
Osama Sayegh
65f57a4d05
DEV: Explicitly define primary_email_verified? method for managed authenticators ()
We're going to change the default return value of the `primary_email_verified?` method of `Auth::ManagedAuthenticator` to false, so we need to explicitly define the method on authenticators to return true where it makes sense to do so.

Internal topic: t/82084.
2022-11-24 06:46:06 +03:00
David Taylor
e0a6d12c55
Use service account credentials for fetching google hd groups ()
The previous implementation would attempt to fetch groups using the end-user's Google auth token. This only worked for admin accounts, or users with 'delegated' access to the `admin.directory.group.readonly` API.

This commit changes the approach to use a single 'service account' for fetching the groups. This removes the need to add permissions to all regular user accounts. I'll be updating the [meta docs](https://meta.discourse.org/t/226850) with instructions on setting up the service account.

This is technically a breaking change in behavior, but the existing implementation was marked experimental, and is currently unusable in production google workspace environments.
2022-10-13 16:04:42 +01:00
Jacob Michalskie
36f7fbebdc
DEV: Allow ManagedAuthenticator classes to match by username () 2022-10-11 11:25:13 +01:00
Martin Brennan
6d7abc1c85
FIX: Make sure first admin users are added to auto groups ()
When a user with an email matching those inside the
DISCOURSE_DEVELOPER_EMAILS env var log in, we make
them into admin users if they are not already. This
is used when setting up the first admin user for
self-hosters, since the discourse-setup script sets
the provided admin emails into DISCOURSE_DEVELOPER_EMAILS.

The issue being fixed here is that the new admins were
not being automatically added to the staff and admins
automatic groups, which was causing issues with the site
settings that are group_list based that don't have an explicit
staff override. All we need to do is refresh the automatic
staff, admin groups when admin is granted for the user.
2022-10-06 15:16:38 +10:00
Gerhard Schlager
8bdbefe0e0
FIX: Logout could fail due to cached user ()
Logging out failed when the current user was cached by an instance of `Auth::DefaultCurrentUserProvider` and `#log_off_user` was called on a different instance of that class.

Co-authored-by: Sam <sam.saffron@gmail.com>
2022-07-04 17:01:19 +02:00
Jarek Radosz
1a5dbbf430
FIX: Correctly handle invalid auth cookies ()
Previously it would blow up on invalid utf byte sequences. This was a source of spec flakiness.
2022-06-07 13:00:25 +02:00
David Taylor
485fc4636a
FEATURE: Add fallback to suggested value when auth_overrides_username ()
If the identity provider does not provide a precise username value, then we should use our UserNameSuggester to generate one and use it for the override. This makes the override consistent with initial account creation.
2022-05-04 11:22:09 +01:00
Sam
616de83232
FIX: avoid concurrent usage of AR models ()
Flagged by the truffle team at: https://meta.discourse.org/t/thread-unsafe-current-user-usage-in-auth-defaultcurrentuserprovider/225671

This usage of AR is unsafe currently, as AR models are not safe for concurrent usage

Introduces a new query potentially every minute which should be acceptable.
2022-05-03 08:50:56 +10:00
David Taylor
0f772bdf5b
FEATURE: Optionally skip using full_name when suggesting usernames ()
This commit introduces a new site setting: `use_name_for_username_suggestions` (default true)

Admins can disable it if they want to stop using Name values when generating usernames for users. This can be useful if you want to keep real names private-by-default or, when used in conjunction with the `use_email_for_username_and_name_suggestions` setting, you would prefer to use email-based username suggestions.
2022-04-29 14:00:13 +01:00
Loïc Guitaut
008b700a3f DEV: Upgrade to Rails 7
This patch upgrades Rails to version 7.0.2.4.
2022-04-28 11:51:03 +02:00
David Taylor
1551eaab01
FIX: Do not error when json-serialized cookies are used ()
We intend to switch to the `:json` serializer, which will stringify all keys. However, we need a clean revert path. This commit ensures that our `_t` cookie handling works with both marshal (the current default) and json (the new default) serialization.
2022-04-20 19:15:40 +01:00
Rafael dos Santos Silva
1203121ac1
PERF: Throttle updates to API key last_used_at ()
Co-authored-by: David Taylor <david@taylorhq.com>
2022-04-06 11:01:52 -03:00
David Taylor
a48231041b
DEV: Update Discord API domain ()
`discordapp.com` is being deprecated in favour of `discord.com`: https://github.com/discord/discord-api-docs/discussions/4510
2022-02-15 10:25:42 +00:00
Andrei Prigorshnev
404f882e5c
FEATURE: in result.rb don't use email for username suggestions until enabled in settings () 2022-02-07 16:02:26 +04:00
David Taylor
78d0ec35a5
DEV: Deprecate OAuth2Authenticator and OAuth2UserInfo ()
These have been superseded by ManagedAuthenticator and UserAssociatedAccount. For more information, see https://meta.discourse.org/t/106695
2022-01-06 16:50:18 +00:00
David Taylor
4f06c24a57
DEV: Do not log API key scope and/or source-ip mismatches ()
Using an incorrectly-scoped API key is something which should be fixed by the client - no need to log errors on the server-side.
2021-12-29 12:22:21 +00:00
David Taylor
cdf4d7156e
DEV: Introduce Auth::Result API for overrides_* ()
This allows authenticators to instruct the Auth::Result to override attributes without using the general site settings. This provides an easy migration path for auth plugins which offer their own "overrides email", "overrides username" or "overrides name" settings. With this new api, they can set `overrides_*` on the result object, and the attribute will be overriden regardless of the general site setting.

ManagedAuthenticator is updated to use this new API. Plugins which consume ManagedAuthenticator will instantly take advantage of this change.
2021-12-23 10:53:17 +00:00
Andrei Prigorshnev
c202252190
FEATURE: when suggesting usernames skip input that consist entirely of disallowed characters () 2021-12-21 21:13:05 +04:00
David Taylor
e42f33b6ba
FIX: Allow OAuth2Authenticator to handle existing associations ()
OAuth2Authenticator is considered deprecated, and isn't used in core. However, some plugins still depend on it, and this was breaking the signup of previously-staged users. There is no easy way to make an end-end test of this in core, but I will be adding an integration test in the SAML plugin.
2021-12-10 19:53:14 +00:00
Angus McLeod
df3886d6e5
FEATURE: Experimental support for group membership via google auth ()
This commit introduces a new site setting "google_oauth2_hd_groups". If enabled, group information will be fetched from Google during authentication, and stored in the Discourse database. These 'associated groups' can be connected to a Discourse group via the "Membership" tab of the group preferences UI. 

The majority of the implementation is generic, so we will be able to add support to more authentication methods in the near future.

https://meta.discourse.org/t/managing-group-membership-via-authentication/175950
2021-12-09 12:30:27 +00:00
Andrei Prigorshnev
10cc082560
FIX: when using external auth disallowed characters weren't removed from username () 2021-12-06 15:06:35 +04:00
Andrei Prigorshnev
1c0022c195
FIX: extract and fix overriding of usernames by external auth () 2021-12-02 17:42:23 +04:00
Osama Sayegh
b86127ad12
FEATURE: Apply rate limits per user instead of IP for trusted users ()
Currently, Discourse rate limits all incoming requests by the IP address they
originate from regardless of the user making the request. This can be
frustrating if there are multiple users using Discourse simultaneously while
sharing the same IP address (e.g. employees in an office).

This commit implements a new feature to make Discourse apply rate limits by
user id rather than IP address for users at or higher than the configured trust
level (1 is the default).

For example, let's say a Discourse instance is configured to allow 200 requests
per minute per IP address, and we have 10 users at trust level 4 using
Discourse simultaneously from the same IP address. Before this feature, the 10
users could only make a total of 200 requests per minute before they got rate
limited. But with the new feature, each user is allowed to make 200 requests
per minute because the rate limits are applied on user id rather than the IP
address.

The minimum trust level for applying user-id-based rate limits can be
configured by the `skip_per_ip_rate_limit_trust_level` global setting. The
default is 1, but it can be changed by either adding the
`DISCOURSE_SKIP_PER_IP_RATE_LIMIT_TRUST_LEVEL` environment variable with the
desired value to your `app.yml`, or changing the setting's value in the
`discourse.conf` file.

Requests made with API keys are still rate limited by IP address and the
relevant global settings that control API keys rate limits.

Before this commit, Discourse's auth cookie (`_t`) was simply a 32 characters
string that Discourse used to lookup the current user from the database and the
cookie contained no additional information about the user. However, we had to
change the cookie content in this commit so we could identify the user from the
cookie without making a database query before the rate limits logic and avoid
introducing a bottleneck on busy sites.

Besides the 32 characters auth token, the cookie now includes the user id,
trust level and the cookie's generation date, and we encrypt/sign the cookie to
prevent tampering.

Internal ticket number: t54739.
2021-11-17 23:27:30 +03:00
Daniel Waterworth
e7c0bbb9c0
DEV: Let's always give a drop_from param to deprecate ()
So that we know when deprecations can be removed in the future.
2021-11-12 08:52:59 -06:00
Andrei Prigorshnev
19d95c64af
DEV: simplify username suggester ()
This PR doesn't change any behavior, but just removes code that wasn't in use. This is a pretty dangerous place to change, since it gets called during user's registration. At the same time the refactoring is very straightforward, it's clear that this code wasn't doing any work (it still needs to be double-checked during review though). Also, the test coverage of UserNameSuggester is good.
2021-10-27 14:41:24 +04:00
Osama Sayegh
70fa67a9e1
FIX: Don't leak unhashed user API keys to redis ()
User API keys (not the same thing as admin API keys) are currently
leaked to redis when rate limits are applied to them since redis is the
backend for rate limits in Discourse and the API keys are included in
the redis keys that are used to track usage of user API keys in the last
24 hours.

This commit stops the leak by using a SHA-256 representation of the user
API key instead of the key itself to form the redis key.

We don't need to manually delete the existing redis keys that contain
unhashed user API keys because they're not long-lived and will be
automatically deleted within 48 hours after this commit is deployed to
your Discourse instance.
2021-10-21 19:43:26 +03:00
Andrei Prigorshnev
1a8c949900
UX: suspend forever time period messages ()
When the Forever option is selected for suspending a user, the user is suspended for 1000 years. Without customizing the site’s text, this time period is displayed to the user in the suspension email that is sent to the user, and if the user attempts to log back into the site. Telling someone that they have been suspended for 1000 years seems likely to come across as a bad attempt at humour.

This PR special case messages when a user suspended or silenced forever.
2021-07-20 14:42:08 +04:00
Dan Ungureanu
49090c3524
FIX: Suggest current username for staged users ()
If user had a staged account and logged in using a third party service
a different username was suggested. This change will try to use the
username given by the authentication provider first, then the current
staged username and last suggest a new one.
2021-07-13 09:15:06 +10:00
David Taylor
4134173bbf
FEATURE: Add global admin api key rate limiter () 2021-06-03 10:52:43 +01:00
Josh Soref
13d40ead97
DEV: Correct spelling mistakes in comments 2021-05-21 13:37:17 +10:00
Martin Brennan
5f7bef6d20
FEATURE: Add email_encoded parameter to accept inbound base64 encoded emails ()
We have found when receiving and posting inbound emails to the handle_mail route, it is better to POST the payload as a base64 encoded string to avoid strange encoding issues. This introduces a new param of `email_encoded` and maintains the legacy param of email, showing a deprecation warning. Eventually the old param of `email` will be dropped and the new one `email_encoded` will be the only way to handle_mail.
2021-05-06 12:59:52 +10:00
David Taylor
f637bf1b58
DEV: Deprecate message parameter in auth provider plugin API ()
This has been unused since d2bceff133
2021-03-25 13:23:48 +00:00
Alan Guo Xiang Tan
3fc72543de DEV: Avoid duplicating method attributes in Auth::Result.
This ensures that within the class, we have a consistent order of
attributes that is passed to `UsernameSuggester`.
2021-02-26 10:20:31 +08:00
David Taylor
a040f72f96
FIX: Make email_valid handling consistent ()
Previously we were checking truthiness in some places, and `== true` in
others. That can lead to some inconsistent UX where the interface says
the email is valid, but account creation fails.

This commit ensures values are boolean when set, and raises an error for
other value types.

If this safety check is triggered, it means the specific auth provider
needs to be updated to pass booleans.
2021-02-22 12:05:36 +00:00