Add ability to require approval when users sign up using specific email domains (#28468)

This commit is contained in:
Claire 2024-01-04 10:07:05 +01:00 committed by GitHub
parent 195b89d336
commit dfdadb92e8
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
13 changed files with 84 additions and 16 deletions

View file

@ -40,7 +40,7 @@ module Admin
(@email_domain_block.other_domains || []).uniq.each do |domain|
next if EmailDomainBlock.where(domain: domain).exists?
other_email_domain_block = EmailDomainBlock.create!(domain: domain, parent: @email_domain_block)
other_email_domain_block = EmailDomainBlock.create!(domain: domain, allow_with_approval: @email_domain_block.allow_with_approval, parent: @email_domain_block)
log_action :create, other_email_domain_block
end
end
@ -65,7 +65,7 @@ module Admin
end
def resource_params
params.require(:email_domain_block).permit(:domain, other_domains: [])
params.require(:email_domain_block).permit(:domain, :allow_with_approval, other_domains: [])
end
def form_email_domain_block_batch_params

View file

@ -55,7 +55,7 @@ class Api::V1::Admin::EmailDomainBlocksController < Api::BaseController
end
def resource_params
params.permit(:domain)
params.permit(:domain, :allow_with_approval)
end
def insert_pagination_headers

View file

@ -4,11 +4,12 @@
#
# Table name: email_domain_blocks
#
# id :bigint(8) not null, primary key
# domain :string default(""), not null
# created_at :datetime not null
# updated_at :datetime not null
# parent_id :bigint(8)
# id :bigint(8) not null, primary key
# domain :string default(""), not null
# created_at :datetime not null
# updated_at :datetime not null
# parent_id :bigint(8)
# allow_with_approval :boolean default(FALSE), not null
#
class EmailDomainBlock < ApplicationRecord
@ -42,8 +43,8 @@ class EmailDomainBlock < ApplicationRecord
@attempt_ip = attempt_ip
end
def match?
blocking? || invalid_uri?
def match?(...)
blocking?(...) || invalid_uri?
end
private
@ -52,8 +53,8 @@ class EmailDomainBlock < ApplicationRecord
@uris.any?(&:nil?)
end
def blocking?
blocks = EmailDomainBlock.where(domain: domains_with_variants).order(Arel.sql('char_length(domain) desc'))
def blocking?(allow_with_approval: false)
blocks = EmailDomainBlock.where(domain: domains_with_variants, allow_with_approval: allow_with_approval).order(Arel.sql('char_length(domain) desc'))
blocks.each { |block| block.history.add(@attempt_ip) } if @attempt_ip.present?
blocks.any?
end
@ -86,4 +87,8 @@ class EmailDomainBlock < ApplicationRecord
def self.block?(domain_or_domains, attempt_ip: nil)
Matcher.new(domain_or_domains, attempt_ip: attempt_ip).match?
end
def self.requires_approval?(domain_or_domains, attempt_ip: nil)
Matcher.new(domain_or_domains, attempt_ip: attempt_ip).match?(allow_with_approval: true)
end
end

View file

@ -418,7 +418,7 @@ class User < ApplicationRecord
def set_approved
self.approved = begin
if sign_up_from_ip_requires_approval?
if sign_up_from_ip_requires_approval? || sign_up_email_requires_approval?
false
else
open_registrations? || valid_invitation? || external?
@ -430,6 +430,12 @@ class User < ApplicationRecord
!sign_up_ip.nil? && IpBlock.where(severity: :sign_up_requires_approval).where('ip >>= ?', sign_up_ip.to_s).exists?
end
def sign_up_email_requires_approval?
return false unless email.present? || unconfirmed_email.present?
EmailDomainBlock.requires_approval?(email.presence || unconfirmed_email, attempt_ip: sign_up_ip)
end
def open_registrations?
Setting.registrations_mode == 'open'
end

View file

@ -1,7 +1,7 @@
# frozen_string_literal: true
class REST::Admin::EmailDomainBlockSerializer < ActiveModel::Serializer
attributes :id, :domain, :created_at, :history
attributes :id, :domain, :created_at, :history, :allow_with_approval
def id
object.id.to_s

View file

@ -12,3 +12,7 @@
·
= t('admin.email_domain_blocks.attempts_over_week', count: email_domain_block.history.reduce(0) { |sum, day| sum + day.accounts })
- if email_domain_block.allow_with_approval?
·
= t('admin.email_domain_blocks.allow_registrations_with_approval')

View file

@ -7,6 +7,9 @@
.fields-group
= f.input :domain, wrapper: :with_block_label, label: t('admin.email_domain_blocks.domain'), input_html: { readonly: defined?(@resolved_records) }
.fields-group
= f.input :allow_with_approval, wrapper: :with_label, hint: false, label: I18n.t('admin.email_domain_blocks.allow_registrations_with_approval')
- if defined?(@resolved_records)
%p.hint= t('admin.email_domain_blocks.resolved_dns_records_hint_html')

View file

@ -425,6 +425,7 @@ en:
view: View domain block
email_domain_blocks:
add_new: Add new
allow_registrations_with_approval: Allow registrations with approval
attempts_over_week:
one: "%{count} attempt over the last week"
other: "%{count} sign-up attempts over the last week"

View file

@ -0,0 +1,7 @@
# frozen_string_literal: true
class AddAllowWithApprovalToEmailDomainBlocks < ActiveRecord::Migration[7.1]
def change
add_column :email_domain_blocks, :allow_with_approval, :boolean, default: false, null: false
end
end

View file

@ -10,7 +10,7 @@
#
# It's strongly recommended that you check this file into your version control system.
ActiveRecord::Schema[7.1].define(version: 2023_12_12_073317) do
ActiveRecord::Schema[7.1].define(version: 2023_12_22_100226) do
# These are extensions that must be enabled in order to support this database
enable_extension "plpgsql"
@ -435,6 +435,7 @@ ActiveRecord::Schema[7.1].define(version: 2023_12_12_073317) do
t.datetime "created_at", precision: nil, null: false
t.datetime "updated_at", precision: nil, null: false
t.bigint "parent_id"
t.boolean "allow_with_approval", default: false, null: false
t.index ["domain"], name: "index_email_domain_blocks_on_domain", unique: true
end

View file

@ -12,13 +12,14 @@ RSpec.describe Admin::EmailDomainBlocksController do
describe 'GET #index' do
around do |example|
default_per_page = EmailDomainBlock.default_per_page
EmailDomainBlock.paginates_per 1
EmailDomainBlock.paginates_per 2
example.run
EmailDomainBlock.paginates_per default_per_page
end
it 'returns http success' do
2.times { Fabricate(:email_domain_block) }
Fabricate(:email_domain_block, allow_with_approval: true)
get :index, params: { page: 2 }
expect(response).to have_http_status(200)
end

View file

@ -135,6 +135,25 @@ RSpec.describe Auth::RegistrationsController do
end
end
context 'when user has an email address requiring approval' do
subject do
Setting.registrations_mode = 'open'
Fabricate(:email_domain_block, allow_with_approval: true, domain: 'example.com')
request.headers['Accept-Language'] = accept_language
post :create, params: { user: { account_attributes: { username: 'test' }, email: 'test@example.com', password: '12345678', password_confirmation: '12345678', agreement: 'true' } }
end
it 'creates unapproved user and redirects to setup' do
subject
expect(response).to redirect_to auth_setup_path
user = User.find_by(email: 'test@example.com')
expect(user).to_not be_nil
expect(user.locale).to eq(accept_language)
expect(user.approved).to be(false)
end
end
context 'with Approval-based registrations without invite' do
subject do
Setting.registrations_mode = 'approved'

View file

@ -27,6 +27,27 @@ RSpec.describe AppSignUpService, type: :service do
end
end
context 'when the email address requires approval' do
before do
Setting.registrations_mode = 'open'
Fabricate(:email_domain_block, allow_with_approval: true, domain: 'email.com')
end
it 'creates an unapproved user', :aggregate_failures do
access_token = subject.call(app, remote_ip, params)
expect(access_token).to_not be_nil
expect(access_token.scopes.to_s).to eq 'read write'
user = User.find_by(id: access_token.resource_owner_id)
expect(user).to_not be_nil
expect(user.confirmed?).to be false
expect(user.approved?).to be false
expect(user.account).to_not be_nil
expect(user.invite_request).to be_nil
end
end
context 'when registrations are closed' do
before do
Setting.registrations_mode = 'none'