Add logic for asking for FOREM_OWNER_SECRET to be present on first user sign up if set by system (#10108)

* Add logic for requiring FOREM_OWNER_SECRET to be present

* Fix test logic

.env_sample

@@ -1,7 +1,9 @@
-# App domain + Protocol setting for development
+# App core values
 export APP_DOMAIN="localhost:3000"
 export APP_PROTOCOL="http://"
 export APP_NAME="forem_local"
+export FOREM_OWNER_SECRET="secret"
+
 
 # Openresty domain + Protocol setting for development
 export OPENRESTY_DOMAIN=""

app/controllers/application_controller.rb

@@ -17,7 +17,14 @@ class ApplicationController < ActionController::Base
     error_too_many_requests(exc)
   end
 
-  PUBLIC_CONTROLLERS = %w[shell async_info ga_events service_worker omniauth_callbacks registrations].freeze
+  PUBLIC_CONTROLLERS = %w[shell
+                          async_info
+                          ga_events
+                          service_worker
+                          omniauth_callbacks
+                          registrations
+                          confirmations
+                          passwords].freeze
   private_constant :PUBLIC_CONTROLLERS
 
   def verify_private_forem

app/controllers/registrations_controller.rb

@@ -13,6 +13,8 @@ class RegistrationsController < Devise::RegistrationsController
 
   def create
     not_authorized unless SiteConfig.allow_email_password_registration || SiteConfig.waiting_on_first_user
+    not_authorized if SiteConfig.waiting_on_first_user && ENV["FOREM_OWNER_SECRET"].present? &&
+      ENV["FOREM_OWNER_SECRET"] != params[:user][:forem_owner_secret]
 
     build_resource(sign_up_params)
     resource.saw_onboarding = false

app/views/shared/authentication/_email_registration_form.html.erb

@@ -48,6 +48,12 @@
       <%= f.password_field :password_confirmation, autocomplete: "current-password", class: "crayons-textfield", required: true %>
     </div>
 
+    <% if ENV["FOREM_OWNER_SECRET"].present? && SiteConfig.waiting_on_first_user %>
+      <div class="crayons-field mt-2">
+        <%= f.label :forem_owner_secret, "Few Forem Secret", class: "crayons-field__label" %>
+        <%= f.password_field :forem_owner_secret, autocomplete: "current-password", class: "crayons-textfield", required: true, placeholder: "As provided by your Forem host" %>
+      </div>
+    <% end %>
     <div class="actions pt-3">
       <%= f.submit "Sign up", class: "crayons-btn" %>
     </div>

spec/requests/registrations_spec.rb

@@ -108,13 +108,15 @@ RSpec.describe "Registrations", type: :request do
     context "when site is in waiting_on_first_user state" do
       before do
         SiteConfig.waiting_on_first_user = true
+        ENV["FOREM_OWNER_SECRET"] = nil
       end
 
       after do
         SiteConfig.waiting_on_first_user = false
+        ENV["FOREM_OWNER_SECRET"] = nil
       end
 
-      it "does not raise disallowed if community is set to allow email" do
+      it "does not raise disallowed" do
         expect { post "/users" }.not_to raise_error Pundit::NotAuthorizedError
       end
 
@@ -138,6 +140,33 @@ RSpec.describe "Registrations", type: :request do
         expect(User.first.has_role?(:super_admin)).to be true
         expect(User.first.has_role?(:single_resource_admin, Config)).to be true
       end
+
+      it "creates super admin with valid params in FOREM_OWNER_SECRET scenario" do
+        ENV["FOREM_OWNER_SECRET"] = "test"
+        post "/users", params:
+          { user: { name: "test #{rand(10)}",
+                    username: "haha_#{rand(10)}",
+                    email: "yoooo#{rand(100)}@yo.co",
+                    password: "PaSSw0rd_yo000",
+                    forem_owner_secret: "test",
+                    password_confirmation: "PaSSw0rd_yo000" } }
+        expect(User.first.has_role?(:super_admin)).to be true
+        expect(User.first.has_role?(:single_resource_admin, Config)).to be true
+      end
+
+      it "does not authorize request in FOREM_OWNER_SECRET scenario if not passed correct value" do
+        ENV["FOREM_OWNER_SECRET"] = "test"
+        expect do
+          post "/users", params:
+            { user: { name: "test #{rand(10)}",
+                      username: "haha_#{rand(10)}",
+                      email: "yoooo#{rand(100)}@yo.co",
+                      password: "PaSSw0rd_yo000",
+                      forem_owner_secret: "not_test",
+                      password_confirmation: "PaSSw0rd_yo000" } }
+          expect(User.first).to be nil
+        end.to raise_error Pundit::NotAuthorizedError
+      end
     end
   end
 end