Vishnu NarayananandGitHub
92a1fb8ab7
## Description First PR of user_sessions feature - enforcement, impersonation and mfa will be handled separately. Adds an Active Sessions section under Profile where users can see every device currently logged in and revoke any session they don't recognize. Helps users lock down stale or unrecognized logins on their own without needing support. **Behavior at the limit, by client:** - **Browser:** returns 409 with a picker overlay; user picks a session to revoke or chooses "End all sessions" to clear them. - **Mobile / API client:** silently evicts the oldest session and proceeds with login (no picker UI to render). - **Pre-tracking users** (token rows without `user_sessions`, i.e. anyone already logged in before this ships): silent-evict any untracked token first, so freshly tracked sessions are never killed in favor of legacy ones. Sessions are stored in a new `user_sessions` table keyed on `(user_id, client_id)` with browser, platform, IP, last activity and (when configured) geo. Kept in sync with `user.tokens` via an after_save callback so revoking a token from any path cleans up the row. Fixes https://linear.app/chatwoot/issue/CW-7169 ## Type of change - [x] New feature (non-breaking change which adds functionality) ## How Has This Been Tested? - Added specs. - Manual local testing: browser picker fires at limit; pre-tracking user silent-evicts; mixed tracked/untracked correctly drops the untracked one first; profile page revoke succeeds; current session cannot be revoked from profile. ## Checklist - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [x] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] Any dependent changes have been merged and published in downstream modules
83 lines
2.9 KiB
Ruby
83 lines
2.9 KiB
Ruby
require 'rails_helper'
|
|
|
|
RSpec.describe UserSessionTrackingService do
|
|
let(:user) { create(:user) }
|
|
let(:client_id) { 'client-abc' }
|
|
let(:request) do
|
|
instance_double(
|
|
ActionDispatch::Request,
|
|
user_agent: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2.1 Safari/605.1.15',
|
|
remote_ip: '8.8.8.8'
|
|
)
|
|
end
|
|
let(:service) { described_class.new(user: user, request: request, client_id: client_id) }
|
|
|
|
describe '#create_or_update!' do
|
|
it 'creates a new UserSession with the right client_id and timestamps' do
|
|
expect { service.create_or_update! }.to change(user.user_sessions, :count).by(1)
|
|
|
|
session = user.user_sessions.last
|
|
expect(session.client_id).to eq(client_id)
|
|
expect(session.last_activity_at).to be_within(1.second).of(Time.current)
|
|
end
|
|
|
|
it 'populates request and browser metadata synchronously', :aggregate_failures do
|
|
service.create_or_update!
|
|
|
|
session = user.user_sessions.last
|
|
expect(session.ip_address).to eq('8.8.8.8')
|
|
expect(session.browser_name).to eq('Safari')
|
|
expect(session.platform_name).to eq('macOS')
|
|
end
|
|
|
|
it 'does not call IpLookupService synchronously' do
|
|
expect(IpLookupService).not_to receive(:new)
|
|
|
|
service.create_or_update!
|
|
end
|
|
|
|
it 'enqueues UserSessionIpLookupJob to backfill geo data' do
|
|
expect { service.create_or_update! }.to have_enqueued_job(UserSessionIpLookupJob)
|
|
end
|
|
|
|
it 'updates an existing session when client_id matches' do
|
|
existing = user.user_sessions.create!(client_id: client_id, ip_address: '1.1.1.1', last_activity_at: 1.day.ago)
|
|
|
|
expect { service.create_or_update! }.not_to change(user.user_sessions, :count)
|
|
expect(existing.reload.ip_address).to eq('8.8.8.8')
|
|
expect(existing.last_activity_at).to be_within(1.second).of(Time.current)
|
|
end
|
|
end
|
|
|
|
describe '#update_activity!' do
|
|
it 'does nothing when no session exists for the client_id' do
|
|
expect { service.update_activity! }.not_to change(user.user_sessions, :count)
|
|
end
|
|
|
|
it 'does nothing when the session was recently active' do
|
|
session = user.user_sessions.create!(client_id: client_id, last_activity_at: 1.minute.ago)
|
|
before_ts = session.last_activity_at
|
|
|
|
service.update_activity!
|
|
|
|
expect(session.reload.last_activity_at).to be_within(1.second).of(before_ts)
|
|
end
|
|
|
|
it 'bumps last_activity_at when the session is stale' do
|
|
session = user.user_sessions.create!(client_id: client_id, last_activity_at: 10.minutes.ago)
|
|
|
|
service.update_activity!
|
|
|
|
expect(session.reload.last_activity_at).to be_within(1.second).of(Time.current)
|
|
end
|
|
|
|
it 'bumps last_activity_at when last_activity_at is nil' do
|
|
session = user.user_sessions.create!(client_id: client_id, last_activity_at: nil)
|
|
|
|
service.update_activity!
|
|
|
|
expect(session.reload.last_activity_at).to be_within(1.second).of(Time.current)
|
|
end
|
|
end
|
|
end
|