From 56483f38886f5840b202e5af9d6d2ec3a71ee186 Mon Sep 17 00:00:00 2001 From: Fabian Neumann Date: Fri, 25 May 2018 16:09:38 +0200 Subject: [PATCH 1/6] Add missing translations (en/de) for plugins ignore-user and local-auth. --- plugins/talk-plugin-ignore-user/client/translations.yml | 1 + .../client/components/ChangePassword.js | 8 +++++--- .../client/components/ChangeUsernameContentDialog.js | 2 +- plugins/talk-plugin-local-auth/translations.yml | 8 ++++++++ 4 files changed, 15 insertions(+), 4 deletions(-) diff --git a/plugins/talk-plugin-ignore-user/client/translations.yml b/plugins/talk-plugin-ignore-user/client/translations.yml index 84a4ca11c..fdf2b1daf 100644 --- a/plugins/talk-plugin-ignore-user/client/translations.yml +++ b/plugins/talk-plugin-ignore-user/client/translations.yml @@ -39,6 +39,7 @@ en: confirmation_title: Ignore {0}? de: talk-plugin-ignore-user: + blank_info: Sie ignorieren derzeit keine Nutzer section_title: Ignorierte Nutzer section_info: Weil Sie die folgenden Nutzer ignorieren, sind deren Kommentare versteckt. stop_ignoring: Ignorieren beenden diff --git a/plugins/talk-plugin-local-auth/client/components/ChangePassword.js b/plugins/talk-plugin-local-auth/client/components/ChangePassword.js index 010df0826..cae112203 100644 --- a/plugins/talk-plugin-local-auth/client/components/ChangePassword.js +++ b/plugins/talk-plugin-local-auth/client/components/ChangePassword.js @@ -185,7 +185,7 @@ class ChangePassword extends React.Component { > Date: Fri, 25 May 2018 16:31:07 +0200 Subject: [PATCH 2/6] One more missing German translation --- plugins/talk-plugin-local-auth/translations.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/plugins/talk-plugin-local-auth/translations.yml b/plugins/talk-plugin-local-auth/translations.yml index c4dd56061..ec5bc90d7 100644 --- a/plugins/talk-plugin-local-auth/translations.yml +++ b/plugins/talk-plugin-local-auth/translations.yml @@ -98,6 +98,7 @@ de: forgot_password_sent: "Passwort vergessen - Wir haben Ihnen eine E-Mail zum Zurücksetzen des Passwortes geschickt" change_username: change_username_note: "Nutzernamen können nur alle 14 Tage geändert werden. Ihr Nutzername ist zur Zeit nicht editierbar." + is_not_eligible: "Sie können Ihren Benutzernamen derzeit nicht ändern." save: "Speichern" edit_profile: "Profil ändern" cancel: "Abbrechen" From 325e763fd0f8417b49879afd4df8f089b6755f6c Mon Sep 17 00:00:00 2001 From: Fabian Neumann Date: Fri, 25 May 2018 16:34:29 +0200 Subject: [PATCH 3/6] Remove redundancy --- plugins/talk-plugin-local-auth/translations.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/plugins/talk-plugin-local-auth/translations.yml b/plugins/talk-plugin-local-auth/translations.yml index ec5bc90d7..fa9515432 100644 --- a/plugins/talk-plugin-local-auth/translations.yml +++ b/plugins/talk-plugin-local-auth/translations.yml @@ -97,8 +97,8 @@ de: changed_password_msg: "Passwort geändert - Ihr Passwort wurde erfolgreich geändert" forgot_password_sent: "Passwort vergessen - Wir haben Ihnen eine E-Mail zum Zurücksetzen des Passwortes geschickt" change_username: - change_username_note: "Nutzernamen können nur alle 14 Tage geändert werden. Ihr Nutzername ist zur Zeit nicht editierbar." - is_not_eligible: "Sie können Ihren Benutzernamen derzeit nicht ändern." + change_username_note: "Nutzernamen können nur alle 14 Tage geändert werden." + is_not_eligible: "Sie können Ihren Nutzernamen derzeit nicht ändern." save: "Speichern" edit_profile: "Profil ändern" cancel: "Abbrechen" From b7d2621cb89f510c16b2b4f2d0e8af0e2dfa1f8f Mon Sep 17 00:00:00 2001 From: Fabian Neumann Date: Fri, 25 May 2018 17:19:43 +0200 Subject: [PATCH 4/6] Remove redundant period. It's in the translation strings already. --- services/mailer/templates/password-reset.txt.ejs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/services/mailer/templates/password-reset.txt.ejs b/services/mailer/templates/password-reset.txt.ejs index 2b5e60a9b..577f23bec 100644 --- a/services/mailer/templates/password-reset.txt.ejs +++ b/services/mailer/templates/password-reset.txt.ejs @@ -1,3 +1,3 @@ -<%= t('email.password_reset.we_received_a_request') %>. <%= t('email.password_reset.if_you_did') %> <%= t('email.password_reset.please_click') %>: +<%= t('email.password_reset.we_received_a_request') %> <%= t('email.password_reset.if_you_did') %> <%= t('email.password_reset.please_click') %>: <%= BASE_URL %>account/password/reset#<%= token %> From e1d77daf47afceddcf73a3d9ae4f9bc920caccb6 Mon Sep 17 00:00:00 2001 From: Wyatt Johnson Date: Fri, 25 May 2018 11:16:24 -0600 Subject: [PATCH 5/6] enhanced docs around jwt's --- docs/source/02-01-required-configuration.md | 2 +- docs/source/integrating/authentication.md | 31 +++++++++++++++------ docs/themes/coral/source/css/talk.scss | 5 ++-- 3 files changed, 26 insertions(+), 12 deletions(-) diff --git a/docs/source/02-01-required-configuration.md b/docs/source/02-01-required-configuration.md index be1e1d0b2..a4a26b73d 100644 --- a/docs/source/02-01-required-configuration.md +++ b/docs/source/02-01-required-configuration.md @@ -81,4 +81,4 @@ TALK_JWT_SECRET=jX9y8G2ApcVLwyL{$6s3 Be default, we sign our tokens with HMAC using a SHA-256 hash algorithm. If you want to change the signing algorithm, or use multiple signing/verifying keys, -refer to our [Advanced Configuration](/talk/advanced-configuration/) documentation. +refer to our [Advanced Configuration](/talk/advanced-configuration/#talk-jwt-secret) documentation. diff --git a/docs/source/integrating/authentication.md b/docs/source/integrating/authentication.md index 5b19768fe..77315a9d8 100644 --- a/docs/source/integrating/authentication.md +++ b/docs/source/integrating/authentication.md @@ -25,9 +25,10 @@ state (you don't use the auth anywhere else now). A great example of this is our You can integrate Talk with any authentication service to enable single sign-on for users. The steps to do that are: -1. Create a service that generates [JWT tokens](https://jwt.io). +1. Create a service that generates [JWT tokens](https://jwt.io/introduction/). 2. Push the token into the embed. -3. Implement the `tokenUserNotFound` hook to process the token. +3. Implement the [`tokenUserNotFound`](#implement-tokenusernotfound) hook to + process the token. ### Create JWT Token @@ -39,7 +40,20 @@ Using that demo application, you'll see how you can: 1. Create a node application that can issue JWT's that are compatible with Talk. 2. Provide a validation endpoint that can be used by Talk to validate the token - and get the user via the `tokenUserNotFound` hook. + and get the user via the [`tokenUserNotFound`](#implement-tokenusernotfound) + hook. + +It's also important to note a few requirements for proper integration with Talk. +The generated JWT must contain the following claims: + +- [`jti`](https://tools.ietf.org/html/rfc7519#section-4.1.7): a unique identifier for the token (like a uuid/v4) +- [`exp`](https://tools.ietf.org/html/rfc7519#section-4.1.4): the expiry date of the token as a unix timestamp +- [`sub`](https://tools.ietf.org/html/rfc7519#section-4.1.2): the user identifier that can be used to lookup the user in the mongo + database + - The user may not yet exist in the database, but that's the responsibility + of the [`tokenUserNotFound`](#implement-tokenusernotfound) hook. +- [`iss`](https://tools.ietf.org/html/rfc7519#section-4.1.1): the issuer for the token must match the value of `TALK_JWT_ISSUER` +- [`aud`](https://tools.ietf.org/html/rfc7519#section-4.1.3): the audience for the token must match the value of `TALK_JWT_AUDIENCE` ### Push token into embed @@ -47,7 +61,8 @@ We're assuming that your CMS is capable of authenticating a user account, or at least having the user's details available to send off to the token creation service we created/used in the previous step. -Using the token that was created for the user, you simply have to ammend the template where Talk is rendering to read as the following: +Using the token that was created for the user, you simply have to amend the +template where Talk is rendering to read as the following: ```js Coral.Talk.render(document.getElementById('coralStreamEmbed'), { @@ -72,12 +87,12 @@ example issuer and Talk must match: | Talk | Token Issuer Example | |------|----------------------| -|`JWT_ISSUER`|`JWT_ISSUER`| -|`JWT_AUDIENCE`|`JWT_AUDIENCE`| -|`SECRET`|`JWT_SECRET`*| +|[`TALK_JWT_ISSUER`](/talk/advanced-configuration/#talk-jwt-issuer)|`JWT_ISSUER`| +|[`TALK_JWT_AUDIENCE`](/talk/advanced-configuration/#talk-jwt-audience)|`JWT_AUDIENCE`| +|[`TALK_JWT_SECRET`](/talk/advanced-configuration/#talk-jwt-secret)|`JWT_SECRET`*| \* Note that secrets is a pretty complex topic, refer to the -[TALK-JWT-SECRET](/talk/advanced-configuration/#TALK-JWT-SECRET) configuration +[TALK_JWT_SECRET](/talk/advanced-configuration/#talk-jwt-secret) configuration reference, the basic takeaway is that the secret used to sign the tokens issued by the issuer must be able to be verified by Talk. diff --git a/docs/themes/coral/source/css/talk.scss b/docs/themes/coral/source/css/talk.scss index afbd6f3af..f3b0c24e8 100644 --- a/docs/themes/coral/source/css/talk.scss +++ b/docs/themes/coral/source/css/talk.scss @@ -291,11 +291,10 @@ pre { .content { article { - p a:not(.plain-link) { - @extend .coral-link; - } + p a:not(.plain-link), ul:not(.toc__menu) li a, ol li a, + td a, dd > a { @extend .coral-link; } From 3a79cc684b9bf6df799bfef8aebe1ae3fce8c282 Mon Sep 17 00:00:00 2001 From: Wyatt Johnson Date: Fri, 25 May 2018 11:19:02 -0600 Subject: [PATCH 6/6] added missing translation --- locales/en.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/locales/en.yml b/locales/en.yml index 534593679..950f4bbd2 100644 --- a/locales/en.yml +++ b/locales/en.yml @@ -227,6 +227,7 @@ en: embedlink: copy: "Copy to Clipboard" error: + AUTHENTICATION: "An error occurred trying to authenticate your account." PASSWORD_INCORRECT: "Your current password was entered incorrectly" COMMENT_PARENT_NOT_VISIBLE: "The comment that you're replying to has been removed or doesn't exist." EMAIL_VERIFICATION_TOKEN_INVALID: "Email verification token is invalid."