LG-13497: Fix Session Logout Message

app/controllers/users/sessions_controller.rb

@@ -74,10 +74,20 @@ def increment_session_bad_password_count
     def process_locked_out_session
       warden.logout(:user)
       warden.lock!
-      flash[:error] = t('errors.sign_in.bad_password_limit')
+
+      flash[:error] = t(
+        'errors.sign_in.bad_password_limit',
+        time_left: locked_out_time_remaining,
+      )
       redirect_to root_url
     end
 
+    def locked_out_time_remaining
+      locked_at = session[:max_bad_passwords_at]
+      window = IdentityConfig.store.max_bad_passwords_window_in_seconds.seconds
+      distance_of_time_in_words(Time.zone.now, (locked_at + window), true, except: :seconds)
+    end
+
     def valid_captcha_result?
       return @valid_captcha_result if defined?(@valid_captcha_result)
       @valid_captcha_result = SignInRecaptchaForm.new(**recaptcha_form_args).submit(

config/locales/en.yml

@@ -744,7 +744,7 @@ errors.messages.wrong_length.one: is the wrong length (should be 1 character)
 errors.messages.wrong_length.other: is the wrong length (should be %{count} characters)
 errors.piv_cac_setup.unique_name: That name is already taken. Please choose a different name.
 errors.registration.terms: Before you can continue, you must give us permission. Please check the box below and then click continue.
-errors.sign_in.bad_password_limit: You have exceeded the maximum sign in attempts.
+errors.sign_in.bad_password_limit: You have exceeded the maximum sign in attempts. You must wait %{time_left} before trying again.
 errors.two_factor_auth_setup.must_select_additional_option: Select an additional authentication method.
 errors.two_factor_auth_setup.must_select_option: Select an authentication method.
 errors.verify_personal_key.rate_limited: You tried too many times, please try again in %{timeout}.

config/locales/es.yml

@@ -755,7 +755,7 @@ errors.messages.wrong_length.one: tiene la longitud incorrecta (debe ser de 1 c
 errors.messages.wrong_length.other: tiene la longitud incorrecta (debe ser de %{count} caracteres)
 errors.piv_cac_setup.unique_name: Ese nombre ya fue seleccionado. Elija un nombre diferente.
 errors.registration.terms: Antes de continuar, debe darnos permiso. Marque la casilla a continuación y luego haga clic en continuar.
-errors.sign_in.bad_password_limit: Superó el número máximo de intentos de inicio de sesión.
+errors.sign_in.bad_password_limit: Superó el número máximo de intentos de inicio de sesión. Debe esperar %{time_left} antes de volver a intentarlo.
 errors.two_factor_auth_setup.must_select_additional_option: Seleccione un método de autenticación adicional.
 errors.two_factor_auth_setup.must_select_option: Seleccione un método de autenticación.
 errors.verify_personal_key.rate_limited: Lo intentó demasiadas veces; vuelva a intentarlo en %{timeout}.

config/locales/fr.yml

@@ -744,7 +744,7 @@ errors.messages.wrong_length.one: n’est pas de la bonne longueur (devrait êtr
 errors.messages.wrong_length.other: n’est pas de la bonne longueur (devrait être de %{count} caractères)
 errors.piv_cac_setup.unique_name: Ce nom est déjà pris. Veuillez choisir un autre nom.
 errors.registration.terms: Avant de pouvoir continuer, vous devez nous donner la permission. Veuillez cocher la case ci-dessous, puis cliquez sur Suite.
-errors.sign_in.bad_password_limit: Vous avez dépassé le nombre maximal de tentatives de connexion.
+errors.sign_in.bad_password_limit: Vous avez dépassé le nombre maximal de tentatives de connexion. Vous devez attendre %{time_left} avant de réessayer.
 errors.two_factor_auth_setup.must_select_additional_option: Sélectionnez une méthode d’authentification supplémentaire.
 errors.two_factor_auth_setup.must_select_option: Sélectionnez une méthode d’authentification.
 errors.verify_personal_key.rate_limited: Vous avez essayé trop de fois, veuillez réessayer dans %{timeout}.

config/locales/zh.yml

@@ -755,7 +755,7 @@ errors.messages.wrong_length.one: 长度不对（应当是 1 个字符）
 errors.messages.wrong_length.other: 长度不对（应当是 %{count} 个字符）
 errors.piv_cac_setup.unique_name: 这个名字已被使用。请选择一个不同的名字。
 errors.registration.terms: 在你能继续之前，你必须授予我们你的同意。请在下面的框打勾然后点击继续。
-errors.sign_in.bad_password_limit: 你已超出登录尝试允许最多次数。
+errors.sign_in.bad_password_limit: 你已超出登录尝试允许最多次数。你必须等待 %{time_left} 才能重试。
 errors.two_factor_auth_setup.must_select_additional_option: 请选择一个额外的身份证实方法。
 errors.two_factor_auth_setup.must_select_option: 选择一个身份证实方法。
 errors.verify_personal_key.rate_limited: 你尝试了太多次。请在 %{timeout}后再试。

spec/controllers/users/sessions_controller_spec.rb

@@ -116,6 +116,27 @@
       end
     end
 
+    context 'locked out session' do
+      let(:locked_at) { Time.zone.now }
+      let(:user) { create(:user, :fully_registered) }
+
+      before do
+        allow(subject).to receive(:session_bad_password_count_max_exceeded?).
+          and_return(true)
+        allow(subject).to receive(:clear_session_bad_password_count_if_window_expired).
+          and_return(nil)
+        allow(IdentityConfig.store).to receive(:max_bad_passwords_window_in_seconds).and_return(600)
+      end
+
+      it 'renders an error letting user know they are locked out for a period of time' do
+        session[:max_bad_passwords_at] = locked_at
+        post :create, params: { user: { email: user.email.upcase, password: user.password } }
+
+        expect(response).to redirect_to root_url
+        expect(flash[:error]).to be_truthy
+      end
+    end
+
     it 'tracks the unsuccessful authentication for existing user' do
       user = create(:user, :fully_registered)