{"push_id":2478908301,"size":393,"distinct_size":0,"ref":"refs/heads/stages/crissupb","head":"002065ff1838aeb0b08ba64c06546ad4d7ee2339","before":"077ac73194b086364b8667ba5cc181bef8f83b12","commits":[{"sha":"0457edf4785665f1f95eb929ab5a392901654ec4","author":{"name":"Moncef Belyamani","email":"36ad201e2dc6811747e8f5e53a9e31df2465a10d@gsa.gov"},"message":"Redirect back to SP regardless of locale\n\n**Why**: Andrew found a bug where selecting Spanish during account\ncreation or authentication would not redirect you back to the SP.\n\nThe bug was in `SecureHeadersConcern`, which only allowed the redirect\nto happen if the redirect URI started with the OIDC endpoint. The\nproblem is the URL of the OIDC endpoint is dynamic depending on the\nlanguage. When the language is not English, the SP's redirect URI no\nlonger starts with the same set of characters as the OIDC endpoint,\ntherefore the condition will always be false, and the redirect will\nnot be allowed.\n\n**How**: Instead of determining whether or not to return early based on\nwhether or not the SP request URL is an OIDC URL, base it only on the\npresence of the request URL.\n\nI believe the original intent of the conditional in the first return\nstatement was for performance reasons, since SAML URLs do not need to\nbe added to CSP headers in the CompletionsController. The reason is\nthat CSP headers only matter on the last POST request before a redirect\nto an external URL. In the case of OIDC, clicking Continue on the\nCompletions page, or after 2FA authentication, is the last form that\nis submitted before the redirect back to the SP. However, for SAML,\nthere is an additional hidden form that is rendered and automatically\nsubmitted via JS. This happens in SamlIdpController, which is why it\nhas its own CSP override.\n\nThanks to our use of the Null Object pattern, passing in a SAML URL\nin `SecureHeadersConcern` allows the app to work as expected because\n`authorize_form.valid?` will return `false`.","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/0457edf4785665f1f95eb929ab5a392901654ec4"},{"sha":"b3fc8d4655a3d487349fb25c11fc49998ed6e3d1","author":{"name":"Moncef Belyamani","email":"456be21ad35d03a22d99faa01cd6f741a69beb75@users.noreply.github.com"},"message":"Merge pull request #1873 from 18F/mb-fix-redirect\n\nRedirect back to SP regardless of locale","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/b3fc8d4655a3d487349fb25c11fc49998ed6e3d1"},{"sha":"a551b831d03ae3a20246f1ea19d84f6609e0daee","author":{"name":"Moncef Belyamani","email":"36ad201e2dc6811747e8f5e53a9e31df2465a10d@gsa.gov"},"message":"Drop AppSettings table\n\n**Why**: It's no longer used. We removed the code earlier in #1805, and\nnow we are removing the table. This should be merged only after\nPR #1805 has been deployed.","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/a551b831d03ae3a20246f1ea19d84f6609e0daee"},{"sha":"2d7129a7f7d2a75b1ee116efb484774b41b63d6e","author":{"name":"Moncef Belyamani","email":"36ad201e2dc6811747e8f5e53a9e31df2465a10d@gsa.gov"},"message":"Skip handle_two_factor_authentication callback\n\n**Why**: We have our own `confirm_two_factor_authenticated` callback,\nand don't need the one provided by the `two_factor_authentication` gem.\nBy having it, the app makes unnecessary additional logic checks.","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/2d7129a7f7d2a75b1ee116efb484774b41b63d6e"},{"sha":"ea5bc52daee165ae27eefbf3e713d78e63ca8434","author":{"name":"Moncef Belyamani","email":"456be21ad35d03a22d99faa01cd6f741a69beb75@users.noreply.github.com"},"message":"Merge pull request #1827 from 18F/mb-remove-app-settings-table\n\nDrop AppSettings table","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/ea5bc52daee165ae27eefbf3e713d78e63ca8434"},{"sha":"16408c49187f9d731c4e5f78f7a1057b6e0178a5","author":{"name":"Moncef Belyamani","email":"36ad201e2dc6811747e8f5e53a9e31df2465a10d@gsa.gov"},"message":"Add totp_timestamp to Users table\n\n**Why**: To allow the `two_factor_authentication` gem to be updated\nto the latest version, and to be able to prevent TOTP reuse.\n\nNote that this PR must be merged on its own and deployed, after which\nwe can deploy a separate PR that updates the gem.","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/16408c49187f9d731c4e5f78f7a1057b6e0178a5"},{"sha":"be4ed6b0d5671d732db8d25c5b00b49cee8cc924","author":{"name":"Moncef Belyamani","email":"36ad201e2dc6811747e8f5e53a9e31df2465a10d@gsa.gov"},"message":"Don't use Devise's stored location\n\n**Why**: When a user tries to access a page that requires\nauthentication (such as their account page) while they are signed out,\nDevise automatically saves that URL as a \"stored location\", and when\nthe user signs in, it takes them to that page. From what I can tell,\nthis is only as a convenience to the user. For example, their session\nmight have timed out, but their browser still shows a form that\nrequires authentication. If they submit the form, they will be\nprompted to sign in, and once they do, they will be taken back to the\nform so they can continue what they were doing.\n\nIn our app, this Devise feature can cause more problems than it is\ntrying to solve. For example, if a user tries to visit their account\npage while signed out, they will be prompted to sign in. If they then\nvisit a Service Provider and initiate login, after they sign in, they\nwill end up on their account page instead of back at the SP. This is\nbecause in `after_sign_in_path_for(user)`, the order of lookup is the\nstored location, then the SP request URL. The reason for this lookup\norder is to support the reauthentication feature, where a user is\nprompted to enter their current password and go through 2FA when they\nare attempting to change their email, password, or phone (if enough\ntime has passed since they last authenticated). For example, if they\nwere trying to update their email, we store the location of the email\nupdate page so that we can take them there after they go through the\nreauthentication.\n\n**How**: In our app, there aren't that many pages a user would need to\naccess while authenticated. The account page is basically the only one.\nMoreover, we have callbacks on all controllers that will take the user\nto where they need to be. In other words, if a user loses their place\nduring account creation and they sign out or their session times out,\nthey will always end up back where they left off. This feature doesn't\ndepend on Devise.\n\n- Don't call `stored_location_for(user)`\n- In `ReauthnRequiredController`, don't use Devise's method for\nstoring the location. Instead, use our own custom method and store\nit in our own custom session key.\n- Remove unnecessary location storage in `SamlIdpController`\n- Add Devise's stored location to analytics in\n`Users::SessionsController` to see how often people attempt to visit\npages before signing in. I have a theory that this is the cause of some\nproduction errors I have seen.","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/be4ed6b0d5671d732db8d25c5b00b49cee8cc924"},{"sha":"4965bfc02484f781a5bd0deb82766d1cf0bfc039","author":{"name":"Moncef Belyamani","email":"456be21ad35d03a22d99faa01cd6f741a69beb75@users.noreply.github.com"},"message":"Merge pull request #1876 from 18F/mb-custom-stored-location\n\nDon't use Devise's stored location","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/4965bfc02484f781a5bd0deb82766d1cf0bfc039"},{"sha":"c5c4db248e76e227fa330aee61ed9ce79cdec248","author":{"name":"Moncef Belyamani","email":"456be21ad35d03a22d99faa01cd6f741a69beb75@users.noreply.github.com"},"message":"Merge pull request #1875 from 18F/mb-update-two-factor-auth\n\nAdd totp_timestamp to Users table","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/c5c4db248e76e227fa330aee61ed9ce79cdec248"},{"sha":"6240696ac6ec87076e14db03e28302dad2ffc617","author":{"name":"Moncef Belyamani","email":"456be21ad35d03a22d99faa01cd6f741a69beb75@users.noreply.github.com"},"message":"Merge pull request #1874 from 18F/mb-skip-handle-two-factor-auth\n\nSkip handle_two_factor_authentication callback","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/6240696ac6ec87076e14db03e28302dad2ffc617"},{"sha":"fc1d086cafa53c5a383353ae2da3ba6a458c08ac","author":{"name":"Moncef Belyamani","email":"36ad201e2dc6811747e8f5e53a9e31df2465a10d@gsa.gov"},"message":"Update PR checklist\n\n**Why**: We recently removed the call to skip the\n`handle_factor_authentication` callback from inside individual\ncontrollers, to ApplicationController. This means we now have\nto remember to call `confirm_two_factor_authenticated` if we\nadd a new controller that requires the user to be 2FA auth'd.","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/fc1d086cafa53c5a383353ae2da3ba6a458c08ac"},{"sha":"6b9311513a5848e02366cd107200068249c15c62","author":{"name":"Steve Urciuoli","email":"aad5a1b74053c82529449f168d6897f04cb4e0b2@gmail.com"},"message":"**Why**: The back button should be on the left in the enter your personal key modal\n\n**How** switched the cell contents of continue and back","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/6b9311513a5848e02366cd107200068249c15c62"},{"sha":"96551fc403d72c8ea6cbe905c379ee1ed999e307","author":{"name":"Jonathan Hooper","email":"d2633c6d2722023aa6c4467f4a67791994f6fcc0@gmail.com"},"message":"Merge pull request #1872 from 18F/stevegsa-personal-key-button-swap\n\nPut back button on left in the enter your personal key modal","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/96551fc403d72c8ea6cbe905c379ee1ed999e307"},{"sha":"5275dc66fe248d295d446870335178d98c3b79d0","author":{"name":"Steve Urciuoli","email":"aad5a1b74053c82529449f168d6897f04cb4e0b2@gmail.com"},"message":"**Why**: Links generated by presenters should preserve the current users locale\n\n**How** Fixed internationalized links throughout the application by adding a LinkLocaleResolver and using it on path helpers.","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/5275dc66fe248d295d446870335178d98c3b79d0"},{"sha":"e67ffec3ed0316bddee4dc4d85d78a0885274e8d","author":{"name":"Steve Urciuoli","email":"aad5a1b74053c82529449f168d6897f04cb4e0b2@gmail.com"},"message":"Merge pull request #1867 from 18F/stevegsa-fix-locale\n\nPreserve locale in presenter links","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/e67ffec3ed0316bddee4dc4d85d78a0885274e8d"},{"sha":"70d09d0315980161e2d8e8993084ffa61014ab1a","author":{"name":"Moncef Belyamani","email":"36ad201e2dc6811747e8f5e53a9e31df2465a10d@gsa.gov"},"message":"Update two_factor_authentication to version 2.0.1\n\n**Why**: To take advantage of the latest features.","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/70d09d0315980161e2d8e8993084ffa61014ab1a"},{"sha":"53a492b7715a98a241e8bd1605c90c3a6f7dfd8f","author":{"name":"Moncef Belyamani","email":"456be21ad35d03a22d99faa01cd6f741a69beb75@users.noreply.github.com"},"message":"Merge pull request #1877 from 18F/mb-update-checklist\n\nUpdate PR checklist","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/53a492b7715a98a241e8bd1605c90c3a6f7dfd8f"},{"sha":"7a457894d10381d776674e9039bbda7e3c4de933","author":{"name":"Jonathan Hooper","email":"aaa1ed0c88c184f7858a85d2e78f59e33f6abe05@gsa.gov"},"message":"Validate that config contains state id vendor\n\n**Why**: So the app will raise an error if it tries to start without a\nstate id vendor configured","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/7a457894d10381d776674e9039bbda7e3c4de933"},{"sha":"5dc1b6cb21245a20cbafa64a109c6ae5f5b4148c","author":{"name":"Jonathan Hooper","email":"d2633c6d2722023aa6c4467f4a67791994f6fcc0@gmail.com"},"message":"Merge pull request #1871 from 18F/jmhooper-state-id-config-validation\n\nValidate that config contains state id vendor","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/5dc1b6cb21245a20cbafa64a109c6ae5f5b4148c"},{"sha":"be4cbc06f97c510eb0d68b4d0a0cdc1c29b89e77","author":{"name":"Steve Urciuoli","email":"aad5a1b74053c82529449f168d6897f04cb4e0b2@gmail.com"},"message":"Allow cancel out of usps confirm screen\n\n**Why**: There is no option for the user to cancel or to go to their account\n\n**How** Added a cancel link on the bottom of the form that allows user to go back to their account (and logout, etc.)\n\nadded newline to end of file","distinct":false,"url":"https://api.github.com/repos/18F/identity-idp/commits/be4cbc06f97c510eb0d68b4d0a0cdc1c29b89e77"}]}
{"actor":{"display_login":"crissupb"}}