diff options
author | Claire <claire.github-309c@sitedethib.com> | 2021-06-23 12:49:09 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2021-06-23 12:49:09 +0200 |
commit | 776e00f19399875a135a64d8ad486f3578101cf9 (patch) | |
tree | ea846e21767b1cb2f9f277d3829fbade1f0e46a0 /app/controllers/auth/sessions_controller.rb | |
parent | a434f370f38ac66e05000545e36d7c696f4962d0 (diff) | |
parent | 979059fbc93664b38b720b369b31beaa89457879 (diff) |
Merge pull request #1551 from ClearlyClaire/glitch-soc/merge-upstream
Merge upstream changes
Diffstat (limited to 'app/controllers/auth/sessions_controller.rb')
-rw-r--r-- | app/controllers/auth/sessions_controller.rb | 44 |
1 files changed, 37 insertions, 7 deletions
diff --git a/app/controllers/auth/sessions_controller.rb b/app/controllers/auth/sessions_controller.rb index 548832b21..f07f38075 100644 --- a/app/controllers/auth/sessions_controller.rb +++ b/app/controllers/auth/sessions_controller.rb @@ -27,9 +27,11 @@ class Auth::SessionsController < Devise::SessionsController def create super do |resource| - resource.update_sign_in!(request, new_sign_in: true) - remember_me(resource) - flash.delete(:notice) + # We only need to call this if this hasn't already been + # called from one of the two-factor or sign-in token + # authentication methods + + on_authentication_success(resource, :password) unless @on_authentication_success_called end end @@ -44,10 +46,8 @@ class Auth::SessionsController < Devise::SessionsController def webauthn_options user = find_user - if user.webauthn_enabled? - options_for_get = WebAuthn::Credential.options_for_get( - allow: user.webauthn_credentials.pluck(:external_id) - ) + if user&.webauthn_enabled? + options_for_get = WebAuthn::Credential.options_for_get(allow: user.webauthn_credentials.pluck(:external_id)) session[:webauthn_challenge] = options_for_get.challenge @@ -142,4 +142,34 @@ class Auth::SessionsController < Devise::SessionsController session.delete(:attempt_user_id) session.delete(:attempt_user_updated_at) end + + def on_authentication_success(user, security_measure) + @on_authentication_success_called = true + + clear_attempt_from_session + + user.update_sign_in!(request, new_sign_in: true) + remember_me(user) + sign_in(user) + flash.delete(:notice) + + LoginActivity.create( + user: user, + success: true, + authentication_method: security_measure, + ip: request.remote_ip, + user_agent: request.user_agent + ) + end + + def on_authentication_failure(user, security_measure, failure_reason) + LoginActivity.create( + user: user, + success: false, + authentication_method: security_measure, + failure_reason: failure_reason, + ip: request.remote_ip, + user_agent: request.user_agent + ) + end end |