users: track logins, signups, and other user events.

Add tracking of certain important user actions. These events include:

* Logins
* Logouts
* Failed login attempts
* Account creations
* Account deletions
* Password reset requests
* Password changes
* Email address changes

This is similar to the mod actions log, except for account activity
related to a single user.

The information tracked includes the user, the event type (login,
logout, etc), the timestamp, the user's IP address, IP geolocation
information, the user's browser user agent, and the user's session ID
from their session cookie. This information is visible to mods only.

This is done with three models. The UserEvent model tracks the event
type (login, logout, password change, etc) and the user. The UserEvent
is tied to a UserSession, which contains the user's IP address and
browser metadata. Finally, the IpGeolocation model contains the
geolocation information for IPs, including the city, country, ISP, and
whether the IP is a proxy.

This tracking will be used for a few purposes:

* Letting users view their account history, to detect things like logins
  from unrecognized IPs, failed logins attempts, password changes, etc.
* Rate limiting failed login attempts.
* Detecting sockpuppet accounts using their login history.
* Detecting unauthorized account sharing.
This commit is contained in:
evazion
2021-01-07 20:06:59 -06:00
parent 94e125709c
commit 65adcd09c2
39 changed files with 856 additions and 28 deletions

View File

@@ -1,23 +1,26 @@
class UserDeletion
include ActiveModel::Validations
attr_reader :user, :password
attr_reader :user, :password, :request
validate :validate_deletion
def initialize(user, password)
def initialize(user, password, request)
@user = user
@password = password
@request = request
end
def delete!
return false if invalid?
clear_user_settings
remove_favorites
clear_saved_searches
rename
reset_password
create_mod_action
create_user_event
user
end
@@ -27,6 +30,10 @@ class UserDeletion
ModAction.log("user ##{user.id} deleted", :user_delete)
end
def create_user_event
UserEvent.create_from_request!(user, :user_deletion, request)
end
def clear_saved_searches
SavedSearch.where(user_id: user.id).destroy_all
end