about summary refs log tree commit diff
path: root/spec/controllers/settings
AgeCommit message (Collapse)Author
2020-09-11Refactor settings controllers (#14767)Eugen Rochko
- Disallow suspended accounts from revoking sessions and apps - Allow suspended accounts to access exports
2020-08-24Add WebAuthn as an alternative 2FA method (#14466)santiagorodriguez96
* feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>
2020-05-10Add ability to remove identity proofs from account (#13682)Eugen Rochko
Fix #12613
2019-12-17Fixes featured hashtag setting page erroring out instead of rejecting ↵ThibG
invalid tags (#12436) * Revert "Fix ignoring whole status because of one invalid hashtag (#11621)" This reverts commit dff46b260b2f7d765d254c84a4b89105c7de5e97. * Fix statuses being rejected because of invalid hashtag names * Add spec for invalid hashtag names in statuses * Add test for featured tags controller
2019-09-19Add account migration UI (#11846)Eugen Rochko
Fix #10736 - Change data export to be available for non-functional accounts - Change non-functional accounts to include redirecting accounts
2019-09-18Add password challenge to 2FA settings, e-mail notifications (#11878)Eugen Rochko
Fix #3961
2019-09-18Fix TOTP codes not being filtered from logs during enabling/disabling (#11877)Eugen Rochko
Not a serious issue because they are meaningless past single use
2019-08-30Fix uncaught parameter missing exceptions and missing error templates (#11702)Eugen Rochko
2019-08-06Bump faker from 1.9.6 to 2.1.0 and update faker api (#11489)Yusuke Nakamura
* Bump faker from 1.9.6 to 2.1.0 Bumps [faker](https://github.com/stympy/faker) from 1.9.6 to 2.1.0. - [Release notes](https://github.com/stympy/faker/releases) - [Changelog](https://github.com/stympy/faker/blob/master/CHANGELOG.md) - [Commits](https://github.com/stympy/faker/compare/1.9.6...v2.1.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> * Use faker api v2 https://github.com/stympy/faker/releases/tag/2.0
2019-07-22Change unconfirmed user login behaviour (#11375)Eugen Rochko
Allow access to account settings, 2FA, authorized applications, and account deletions to unconfirmed and pending users, as well as users who had their accounts disabled. Suspended users cannot update their e-mail or password or delete their account. Display account status on account settings page, for example, when an account is frozen, limited, unconfirmed or pending review. After sign up, login users straight away and show a simple page that tells them the status of their account with links to account settings and logout, to reduce onboarding friction and allow users to correct wrongly typed e-mail addresses. Move the final sign-up step of SSO integrations to be the same as above to reduce code duplication.
2019-06-07Change /settings/preferences to redirect to appearance, add ↵Eugen Rochko
/settings/preferences/other (#10988)
2019-06-07Change preferences page into appearance, notifications, and other (#10977)Eugen Rochko
2019-04-10compare usernames case-insensitively on new proof creation flow (#10544)Alex Gessner
* compare usernames case-insensitively on new proof creation flow * Fix code style issue
2019-04-08Export and import show_reblogs together with following list (#10495)ThibG
* Refactor imports * Export show_reblogs when exporting list of followed users * Add support for importing show_reblogs with following collection * Fix tests
2019-04-03Export and import `hide_notifications` alongside user mutes (#10335)ThibG
* Export hide_notifications along with user mutes * Import hide_notifications along with muted users list * Add headers for CSV exports
2019-03-28squashed identity proof updates (#10375)Alex Gessner
2019-03-18Add Keybase integration (#10297)Eugen Rochko
* create account_identity_proofs table * add endpoint for keybase to check local proofs * add async task to update validity and liveness of proofs from keybase * first pass keybase proof CRUD * second pass keybase proof creation * clean up proof list and add badges * add avatar url to keybase api * Always highlight the “Identity Proofs” navigation item when interacting with proofs. * Update translations. * Add profile URL. * Reorder proofs. * Add proofs to bio. * Update settings/identity_proofs front-end. * Use `link_to`. * Only encode query params if they exist. URLs without params had a trailing `?`. * Only show live proofs. * change valid to active in proof list and update liveness before displaying * minor fixes * add keybase config at well-known path * extremely naive feature flagging off the identity proof UI * fixes for rubocop * make identity proofs page resilient to potential keybase issues * normalize i18n * tweaks for brakeman * remove two unused translations * cleanup and add more localizations * make keybase_contacts an admin setting * fix ExternalProofService my_domain * use Addressable::URI in identity proofs * use active model serializer for keybase proof config * more cleanup of keybase proof config * rename proof is_valid and is_live to proof_valid and proof_live * cleanup * assorted tweaks for more robust communication with keybase * Clean up * Small fixes * Display verified identity identically to verified links * Clean up unused CSS * Add caching for Keybase avatar URLs * Remove keybase_contacts setting
2019-03-16Add relationship manager UI (#10268)Eugen Rochko
2018-12-14Error message for avatar image that's too large. #9204 (#9518)Sumit Khanna
* Error message for avatar image that's too large. #9204 * Code climate/formatting * Removed avatar error message * Moved valid image dimentions check to update service * removed unnescessary begin block * code climate formatting * code climate indent fix
2018-12-13Add spec for Settings::ExportsController#create (#9512)ysksn
2018-10-04lint pass 2 (#8878)aus-social
* Code quality pass * Typofix * Update applications_controller_spec.rb * Update applications_controller_spec.rb
2018-10-04Lint pass (#8876)aus-social
2018-06-17Change language opt-out to language opt-in (#7823)Eugen Rochko
* Switch filtered_languages to chosen_languages * Adjust interface * Remove unused translations
2018-06-06Add missing tests for sessions controller (#7744)Shuhei Kitagawa
2018-06-02Add tests for migrations_controller (#7707)Shuhei Kitagawa
2018-04-21Use raw status code on have_http_status (#7214)Yamagishi Kazutoshi
2018-01-22Rename ResolveRemoteAccountService to ResolveAccountService (#6327)Akihiko Odaki
The service used to be named ResolveRemoteAccountService resolves local accounts as well.
2018-01-21Redirect to 2FA creation page when otp_secret is not available (#6314)Aboobacker MK
2017-11-17Remove empty strings (#5732)ysksn
2017-10-04Separate notifications preferences from general preferences (#4447)Yamagishi Kazutoshi
* Separate notifications preferences from general preferences * Refine settings/notifications/show * remove preferences.notifications
2017-09-30Fix order of paginated accounts in FollowerDomainsController and spec (#3357)Akihiko Odaki
* Fix order of paginated accounts in FollowerDomainsController Unordered pagination could result in unexpected behavior. * Cover Settings::FollowerDomainsController more
2017-08-23Use checkboxes for application scope setting (#4671)nullkal
2017-08-23Fix up the applications area (#4664)Eugen Rochko
- Section it into "Development" area - Improve UI of application form, index, and details
2017-08-22Application prefs section (#2758)Colin Mitchell
* Add code for creating/managing apps to settings section * Add specs for app changes * Fix controller spec * Fix view file I pasted over by mistake * Add locale strings. Add 'my apps' to nav * Add Client ID/Secret to App page. Add some visual separation * Fix rubocop warnings * Fix embarrassing typo I lost an `end` statement while fixing a merge conflict. * Add code for creating/managing apps to settings section - Add specs for app changes - Add locale strings. Add 'my apps' to nav - Add Client ID/Secret to App page. Add some visual separation - Fix some bugs/warnings * Update to match code standards * Trigger notification * Add warning about not sharing API secrets * Tweak spec a bit * Cleanup fixture creation by using let! * Remove unused key * Add foreign key for application<->user
2017-08-13ActivityPub delivery (#4566)Eugen Rochko
* Deliver ActivityPub Like * Deliver ActivityPub Undo-Like * Deliver ActivityPub Create/Announce activities * Deliver ActivityPub creates from mentions * Deliver ActivityPub Block/Undo-Block * Deliver ActivityPub Accept/Reject-Follow * Deliver ActivityPub Undo-Follow * Deliver ActivityPub Follow * Deliver ActivityPub Delete activities Incidentally fix #889 * Adjust BatchedRemoveStatusService for ActivityPub * Add tests for ActivityPub workers * Add tests for FollowService * Add tests for FavouriteService, UnfollowService and PostStatusService * Add tests for ReblogService, BlockService, UnblockService, ProcessMentionsService * Add tests for AuthorizeFollowService, RejectFollowService, RemoveStatusService * Add tests for BatchedRemoveStatusService * Deliver updates to a local account to ActivityPub followers * Minor adjustments
2017-06-25Fix #3910 - Require OTP authentication to disable 2FA (#3935)Eugen Rochko
* Fix #3910 - Require OTP authentication to disable 2FA. Also, remove ability to generate new OTP backup codes *after* initial backup codes were handed out during activation * Restore recovery code re-generation * Improve display of some 2FA elements
2017-06-19setting-for-account-deletable (#3852)masarakki
2017-06-19Rename FollowRemoteAccountService to ResolveRemoteAccountService (#3847)Eugen Rochko
Rename Activitypub to ActivityPub
2017-06-14Fix account delete form not accepting password, update suspended (#3745)Eugen Rochko
account before removing content for quicker feedback to end-users
2017-06-14Account deletion (#3728)Eugen Rochko
* Add form for account deletion * If avatar or header are gone from source, remove them * Add option to have SuspendAccountService remove user record, add tests * Exclude suspended accounts from search
2017-05-30Remove exports/base controller in favor of shared concern (#3444)Matt Jankowski
2017-05-29Cover Settings::ExportsController more (#3358)Akihiko Odaki
2017-05-29Cover Settings::TwoFactorAuthenticationsController more (#3376)Akihiko Odaki
2017-05-29Cover Settings::TwoFactorAuthentication::RecoveryCodesController more (#3383)Akihiko Odaki
2017-05-29Spec Settings::Exports (#3384)Akihiko Odaki
* Spec output of Settings::Exports::BlockedAccountsController * Spec output of Settings::Exports::FollowingAccountsController * Spec output of Settings::Exports::MutedAccountsController * Spec Settings::Exports::BaseController This commit removes duplicate specs in classes inheriting Settings::Exports::BaseController as well.
2017-05-29Cover Settings::TwoFactorAuthentication::ConfirmationsController more (#3386)Akihiko Odaki
2017-05-29Add preference setting for delete toot modal (#3368)Atsushi Yamamoto
* Set delete_modal preference to true by default * Does not show confirmation modal if delete_modal is false * Add ja translation for preference setting page
2017-05-20Filter languages with opt out (#3175)Matt Jankowski
* Remove allowed_languages and add filtered_languages * Use filtered_languages instead of allowed_languages
2017-05-08Improve allowed language handling (#2897)Matt Jankowski
* Dont allow empty value in user allowed languages * Sanitize language input to reject blank values in array
2017-05-01Filter on allowed user language preferences (#2361)Matt Jankowski
* Naive approached to timeline filtering * Convert allowed_languages into a db column * Allow users to choose languages to see statuses in * Style list items as two columns * Add a hint to explain language filtering preference
generated by cgit-pink (git 2.37.1) at 2024-07-01 10:11:33 +0000