Vishnu NarayananandGitHub
92a1fb8ab7
## Description First PR of user_sessions feature - enforcement, impersonation and mfa will be handled separately. Adds an Active Sessions section under Profile where users can see every device currently logged in and revoke any session they don't recognize. Helps users lock down stale or unrecognized logins on their own without needing support. **Behavior at the limit, by client:** - **Browser:** returns 409 with a picker overlay; user picks a session to revoke or chooses "End all sessions" to clear them. - **Mobile / API client:** silently evicts the oldest session and proceeds with login (no picker UI to render). - **Pre-tracking users** (token rows without `user_sessions`, i.e. anyone already logged in before this ships): silent-evict any untracked token first, so freshly tracked sessions are never killed in favor of legacy ones. Sessions are stored in a new `user_sessions` table keyed on `(user_id, client_id)` with browser, platform, IP, last activity and (when configured) geo. Kept in sync with `user.tokens` via an after_save callback so revoking a token from any path cleans up the row. Fixes https://linear.app/chatwoot/issue/CW-7169 ## Type of change - [x] New feature (non-breaking change which adds functionality) ## How Has This Been Tested? - Added specs. - Manual local testing: browser picker fires at limit; pre-tracking user silent-evicts; mixed tracked/untracked correctly drops the untracked one first; profile page revoke succeeds; current session cannot be revoked from profile. ## Checklist - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [x] I have commented on my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] Any dependent changes have been merged and published in downstream modules
30 lines
751 B
Ruby
30 lines
751 B
Ruby
class ApplicationController < ActionController::Base
|
|
include DeviseTokenAuth::Concerns::SetUserByToken
|
|
include RequestExceptionHandler
|
|
include Pundit::Authorization
|
|
include SwitchLocale
|
|
include TrackSessionActivity
|
|
|
|
skip_before_action :verify_authenticity_token
|
|
|
|
before_action :set_current_user, unless: :devise_controller?
|
|
around_action :switch_locale
|
|
around_action :handle_with_exception, unless: :devise_controller?
|
|
|
|
private
|
|
|
|
def set_current_user
|
|
@user ||= current_user
|
|
Current.user = @user
|
|
end
|
|
|
|
def pundit_user
|
|
{
|
|
user: Current.user,
|
|
account: Current.account,
|
|
account_user: Current.account_user
|
|
}
|
|
end
|
|
end
|
|
ApplicationController.include_mod_with('Concerns::ApplicationControllerConcern')
|