aikotoba 0.1.1 → 0.3.0

data/app/controllers/aikotoba/application_controller.rb

@@ -3,11 +3,18 @@
 module Aikotoba
   class ApplicationController < Aikotoba.parent_controller.constantize
     include EnabledFeatureCheckable
+    include Scopable
 
-    helper_method :confirmable?, :lockable?, :recoverable?, :registerable?
+    helper_method :confirmable?, :lockable?, :recoverable?, :registerable?, :magic_link_authenticatable?, :aikotoba_scoped_path, :aikotoba_scope, :aikotoba_scope_registerable?
 
     def aikotoba_controller?
       true
     end
+
+    private
+
+    def aikotoba_scope_registerable?
+      registerable? && aikotoba_scope_config.registerable?
+    end
   end
 end

data/app/controllers/aikotoba/confirms_controller.rb

@@ -2,9 +2,14 @@
 
 module Aikotoba
   class ConfirmsController < ApplicationController
-    include Protection::TimingAtack
+    include Protection::RateLimiting
 
-    before_action :prevent_timing_atack, only: [:update]
+    def self.confirmation_rate_limit_options
+      Aikotoba.confirmation_rate_limit_options
+    end
+    private_class_method :confirmation_rate_limit_options
+
+    rate_limit(**confirmation_rate_limit_options)
 
     def new
       @account = build_account({email: "", password: ""})
@@ -15,12 +20,11 @@ module Aikotoba
       before_send_confirmation_token_process
       send_token_account!(account)
       after_send_confirmation_token_process
-      redirect_to success_send_confirmation_token_path, flash: {notice: success_send_confirmation_token_message}
     rescue ActiveRecord::RecordNotFound => e
       failed_send_confirmation_token_process(e)
-      @account = build_account({email: "", password: ""})
-      flash[:alert] = failed_send_confirmation_token_message
-      render :new, status: :unprocessable_entity
+    ensure
+      # NOTE: Always show success message to avoid account enumeration.
+      redirect_to success_send_confirmation_token_path, flash: {notice: success_send_confirmation_token_message}
     end
 
     def update
@@ -42,30 +46,30 @@ module Aikotoba
     end
 
     def find_by_send_token_account!(params)
-      Account.unconfirmed.find_by!(email: params[:email])
+      Account.for_target_type(aikotoba_authenticate_target).unconfirmed.find_by!(email: params[:email])
     end
 
     def send_token_account!(account)
-      Account::Service::Confirmation.create_token!(account: account, notify: true)
+      Account::Confirmation.create_token!(account: account, notify: true)
     end
 
     def find_by_has_token_account!(params)
-      Account::ConfirmationToken.active.find_by!(token: params[:token]).account
+      Account::ConfirmationToken.active.for_target_type(aikotoba_authenticate_target).find_by!(token: params[:token]).account
     end
 
     def confirm_account!(account)
       # NOTE: Confirmation is done using URL tokens, so it is done in the writing role.
       ActiveRecord::Base.connected_to(role: :writing) do
-        Account::Service::Confirmation.confirm!(account: account)
+        Account::Confirmation.confirm!(account: account)
       end
     end
 
     def after_confirmed_path
-      aikotoba.new_session_path
+      aikotoba_scoped_path(:new_session_path)
     end
 
     def success_send_confirmation_token_path
-      aikotoba.new_session_path
+      aikotoba_scoped_path(:new_session_path)
     end
 
     def confirmed_message
@@ -76,10 +80,6 @@ module Aikotoba
       I18n.t(".aikotoba.messages.confirmation.sent")
     end
 
-    def failed_send_confirmation_token_message
-      I18n.t(".aikotoba.messages.confirmation.failed")
-    end
-
     # NOTE: Methods to override if you want to do something before send confirm token.
     def before_send_confirmation_token_process
     end

data/app/controllers/aikotoba/magic_links_controller.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+module Aikotoba
+  class MagicLinksController < ApplicationController
+    include Authenticatable
+    include Protection::RateLimiting
+
+    def self.magic_link_rate_limit_options
+      Aikotoba.magic_link_rate_limit_options
+    end
+    private_class_method :magic_link_rate_limit_options
+
+    rate_limit(**magic_link_rate_limit_options)
+
+    def new
+      @account = build_account({email: ""})
+    end
+
+    def create
+      account = find_by_send_token_account!(magic_link_accounts_params)
+      before_send_magic_link_token_process
+      send_magic_link_token!(account)
+      after_send_magic_link_token_process
+    rescue ActiveRecord::RecordNotFound => e
+      failed_send_magic_link_token_process(e)
+    ensure
+      # NOTE: Always show success message to avoid account enumeration.
+      redirect_to success_send_magic_link_token_path, flash: {notice: success_send_magic_link_token_message}
+    end
+
+    def update
+      # NOTE: Sign-in is done using a URL token (a GET request), so both consuming the
+      #       token and establishing the session are done in the writing role -- unlike
+      #       Confirm/Unlock, which only flip a boolean flag, this also creates an
+      #       Account::Session record via aikotoba_sign_in.
+      ActiveRecord::Base.connected_to(role: :writing) do
+        account = authenticate_account!(params[:token])
+        before_sign_in_process
+        aikotoba_sign_in(account)
+        after_sign_in_process
+      end
+      redirect_to after_sign_in_path, flash: {notice: successed_message}
+    end
+
+    private
+
+    def magic_link_accounts_params
+      params.require(:account).permit(:email)
+    end
+
+    def build_account(params)
+      Account.new(params)
+    end
+
+    def find_by_send_token_account!(params)
+      Account.for_target_type(aikotoba_authenticate_target).find_by!(email: params[:email])
+    end
+
+    def send_magic_link_token!(account)
+      Account::MagicLink.create_token!(account: account, notify: true)
+    end
+
+    def authenticate_account!(token)
+      Account::MagicLink.authenticate_by(token: token, target_type_name: aikotoba_authenticate_target) || raise(ActiveRecord::RecordNotFound)
+    end
+
+    def after_sign_in_path
+      aikotoba_after_authentication_path
+    end
+
+    def success_send_magic_link_token_path
+      aikotoba_scoped_path(:new_session_path)
+    end
+
+    def successed_message
+      I18n.t(".aikotoba.messages.authentication.success")
+    end
+
+    def success_send_magic_link_token_message
+      I18n.t(".aikotoba.messages.magic_link.sent")
+    end
+
+    # NOTE: Methods to override if you want to do something before send magic link token.
+    def before_send_magic_link_token_process
+    end
+
+    # NOTE: Methods to override if you want to do something after send magic link token.
+    def after_send_magic_link_token_process
+    end
+
+    # NOTE: Methods to override if you want to do something failed send magic link token.
+    def failed_send_magic_link_token_process(e)
+    end
+
+    # NOTE: Methods to override if you want to do something before sign in.
+    def before_sign_in_process
+    end
+
+    # NOTE: Methods to override if you want to do something after sign in.
+    def after_sign_in_process
+    end
+  end
+end

data/app/controllers/aikotoba/recoveries_controller.rb

@@ -2,9 +2,14 @@
 
 module Aikotoba
   class RecoveriesController < ApplicationController
-    include Protection::TimingAtack
+    include Protection::RateLimiting
 
-    before_action :prevent_timing_atack, only: [:edit, :update]
+    def self.recovery_rate_limit_options
+      Aikotoba.recovery_rate_limit_options
+    end
+    private_class_method :recovery_rate_limit_options
+
+    rate_limit(**recovery_rate_limit_options)
 
     def new
       @account = build_account({email: "", password: ""})
@@ -15,12 +20,11 @@ module Aikotoba
       before_send_recovery_token_process
       send_recovery_token!(account)
       after_send_recovery_token_process
-      redirect_to success_send_recovery_token_path, flash: {notice: success_send_recovery_token_message}
     rescue ActiveRecord::RecordNotFound => e
       failed_send_recovery_token_process(e)
-      @account = build_account({email: "", password: ""})
-      flash[:alert] = failed_send_recovery_token_message
-      render :new, status: :unprocessable_entity
+    ensure
+      # NOTE: Always show success message to avoid account enumeration.
+      redirect_to success_send_recovery_token_path, flash: {notice: success_send_recovery_token_message}
     end
 
     def edit
@@ -54,27 +58,27 @@ module Aikotoba
     end
 
     def find_by_send_token_account!(params)
-      Account.find_by!(email: params[:email])
+      Account.for_target_type(aikotoba_authenticate_target).find_by!(email: params[:email])
     end
 
     def find_by_has_token_account!(params)
-      Account::RecoveryToken.active.find_by!(token: params[:token]).account
+      Account::RecoveryToken.active.for_target_type(aikotoba_authenticate_target).find_by!(token: params[:token]).account
     end
 
     def send_recovery_token!(account)
-      Account::Service::Recovery.create_token!(account: account, notify: true)
+      Account::Recovery.create_token!(account: account, notify: true)
     end
 
     def recover_account!(account, new_password)
-      Account::Service::Recovery.recover!(account: account, new_password: new_password)
+      Account::Recovery.recover!(account: account, new_password: new_password)
     end
 
     def success_recovered_path
-      aikotoba.new_session_path
+      aikotoba_scoped_path(:new_session_path)
     end
 
     def success_send_recovery_token_path
-      aikotoba.new_session_path
+      aikotoba_scoped_path(:new_session_path)
     end
 
     def failed_message
@@ -89,10 +93,6 @@ module Aikotoba
       I18n.t(".aikotoba.messages.recovery.sent")
     end
 
-    def failed_send_recovery_token_message
-      I18n.t(".aikotoba.messages.recovery.sent_failed")
-    end
-
     # NOTE: Methods to override if you want to do something before send recover token.
     def before_send_recovery_token_process
     end

data/app/controllers/aikotoba/sessions_controller.rb

@@ -40,15 +40,15 @@ module Aikotoba
     end
 
     def authenticate_account(params)
-      Account.authenticate_by(attributes: params)
+      Account::PasswordHash.authenticate_by(attributes: params, target_type_name: aikotoba_authenticate_target)
     end
 
     def after_sign_in_path
-      Aikotoba.after_sign_in_path
+      aikotoba_after_authentication_path
     end
 
     def after_sign_out_path
-      Aikotoba.after_sign_out_path
+      aikotoba_scope_config[:after_sign_out_path]
     end
 
     def successed_message

data/app/controllers/aikotoba/unlocks_controller.rb

@@ -2,9 +2,14 @@
 
 module Aikotoba
   class UnlocksController < ApplicationController
-    include Protection::TimingAtack
+    include Protection::RateLimiting
 
-    before_action :prevent_timing_atack, only: [:update]
+    def self.unlock_rate_limit_options
+      Aikotoba.unlock_rate_limit_options
+    end
+    private_class_method :unlock_rate_limit_options
+
+    rate_limit(**unlock_rate_limit_options)
 
     def new
       @account = build_account({email: "", password: ""})
@@ -15,12 +20,11 @@ module Aikotoba
       before_send_unlock_token_process
       send_token_account!(account)
       after_send_unlock_token_process
-      redirect_to success_send_unlock_token_path, flash: {notice: success_send_unlock_token_message}
     rescue ActiveRecord::RecordNotFound => e
       failed_send_unlock_token_process(e)
-      @account = build_account({email: "", password: ""})
-      flash[:alert] = failed_send_unlock_token_message
-      render :new, status: :unprocessable_entity
+    ensure
+      # NOTE: Always show success message to avoid account enumeration.
+      redirect_to success_send_unlock_token_path, flash: {notice: success_send_unlock_token_message}
     end
 
     def update
@@ -42,30 +46,30 @@ module Aikotoba
     end
 
     def find_by_send_token_account!(params)
-      Account.locked.find_by!(email: params[:email])
+      Account.for_target_type(aikotoba_authenticate_target).locked.find_by!(email: params[:email])
     end
 
     def send_token_account!(account)
-      Account::Service::Lock.create_unlock_token!(account: account, notify: true)
+      Account::Lock.create_unlock_token!(account: account, notify: true)
     end
 
     def find_by_has_token_account!(params)
-      Account::UnlockToken.active.find_by!(token: params[:token]).account
+      Account::UnlockToken.active.for_target_type(aikotoba_authenticate_target).find_by!(token: params[:token]).account
     end
 
     def unlock_account!(account)
       # NOTE: Unlocking is done using URL tokens, so it is done in the writing role.
       ActiveRecord::Base.connected_to(role: :writing) do
-        Account::Service::Lock.unlock!(account: account)
+        Account::Lock.unlock!(account: account)
       end
     end
 
     def after_unlocked_path
-      aikotoba.new_session_path
+      aikotoba_scoped_path(:new_session_path)
     end
 
     def success_send_unlock_token_path
-      aikotoba.new_session_path
+      aikotoba_scoped_path(:new_session_path)
     end
 
     def unlocked_message
@@ -76,10 +80,6 @@ module Aikotoba
       I18n.t(".aikotoba.messages.unlocking.sent")
     end
 
-    def failed_send_unlock_token_message
-      I18n.t(".aikotoba.messages.unlocking.failed")
-    end
-
     # NOTE: Methods to override if you want to do something before send unlock token.
     def before_send_unlock_token_process
     end

data/app/controllers/concerns/aikotoba/authenticatable.rb

@@ -2,39 +2,94 @@ module Aikotoba
   module Authenticatable
     extend ActiveSupport::Concern
     include Protection::SessionFixationAttack
+    include Scopable
+    include RequestBackable
+
+    included do
+      helper_method :aikotoba_current_account
+    end
 
     def aikotoba_current_account
-      unless defined?(@aikotoba_current_account)
-        @aikotoba_current_account ||= aikotoba_authenticate_by_session
-      end
-      @aikotoba_current_account
+      @aikotoba_current_account ||= aikotoba_current_session&.account
     end
 
     def aikotoba_sign_in(account)
-      prevent_session_fixation_attack
-      session[aikotoba_session_key] = account.id
+      start_new_aikotoba_session_for(account)
     end
 
     def aikotoba_sign_out
-      @aikotoba_current_account = nil
-      reset_session
+      terminate_aikotoba_session
     end
 
-    # NOTE: Even if there is already a session, verify that it can be authenticated, and if not, reset the session,
-    # in case the session is created and then locked by another browser etc.
-    def aikotoba_authenticate_by_session
-      account = Account.authenticatable.find_by(id: session[aikotoba_session_key])
-      account.tap { |account| reset_aikotoba_session unless account }
+    private
+
+    def aikotoba_current_session
+      unless defined?(@aikotoba_current_session)
+        @aikotoba_current_session ||= resume_aikotoba_session
+      end
+      @aikotoba_current_session
     end
 
-    private
+    def resume_aikotoba_session
+      account_session = find_aikotoba_session_by_cookie
+      unless account_session
+        # NOTE: NOTE: Even if there is already a session, verify that it can be authenticated, and if not, reset the session,
+        # in case the session is created and then locked by another browser etc.
+        #
+        # Although the session record in DB should be deleted ideally,
+        # deleting it issues a DELETE statement that causes an error due to Rails' multi-DB automatic switching feature,
+        # so the session record deletion is not performed here.
+        # Deleting only the cookie will require explicit re-login, and the situation where only the DB session remains can also occur
+        # when the cookie is directly deleted on the browser side, so we decided to allow it.
+        terminate_aikotoba_session(only_cookie: true)
+      end
+      account_session
+    end
 
-    def reset_aikotoba_session
-      session[aikotoba_session_key] = nil
+    def find_aikotoba_session_by_cookie
+      token = cookies.signed[aikotoba_session_key]
+      aikotoba_session_find_by(token) if token.present?
+    end
+
+    def start_new_aikotoba_session_for(account)
+      prevent_session_fixation_attack
+      @aikotoba_current_session = Aikotoba::Account::Session.start!(account: account, **aikotoba_session_meta_from_request)
+      set_aikotoba_session_cookie(@aikotoba_current_session)
+      @aikotoba_current_session
+    end
+
+    def terminate_aikotoba_session(only_cookie: false)
+      # NOTE: If you call `aikotoba_current_session` method, `aikotoba_current_session` will be regenerated, so refer to the instance variable directly.
+      @aikotoba_current_session&.revoke! unless only_cookie
+      cookies.delete(aikotoba_session_key)
+      @aikotoba_current_session = nil
+      @aikotoba_current_account = nil
+    end
+
+    def set_aikotoba_session_cookie(account_session)
+      cookies.signed[aikotoba_session_key] = {
+        value: account_session.token,
+        httponly: true,
+        same_site: :lax,
+        # NOTE: Set the secure attribute except in the development and test environment
+        secure: !Rails.env.local?,
+        expires: Aikotoba.session_expiry.from_now
+      }
     end
 
     def aikotoba_session_key
-      Aikotoba.session_key
+      aikotoba_scope_config[:session_key]
+    end
+
+    def aikotoba_session_meta_from_request
+      {
+        ip_address: request.remote_ip,
+        user_agent: request.user_agent
+      }
+    end
+
+    def aikotoba_session_find_by(token)
+      Account::Session.find_by_token(token, target_type_name: aikotoba_authenticate_target)
     end
   end
 end

data/app/controllers/concerns/aikotoba/protection/rate_limiting.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+# Rate limiting protection for email-sending endpoints to prevent email bombing attacks.
+# Uses Rails' built-in rate_limit feature.
+#
+# Usage:
+#   class MyController < ApplicationController
+#     include Protection::RateLimiting
+#     rate_limit(to: 10, within: 1.minute, by: -> { request.remote_ip })
+#   end
+module Aikotoba
+  module Protection::RateLimiting
+    extend ActiveSupport::Concern
+
+    module ClassMethods
+      def rate_limit(**options)
+        return if options.empty? # Allow empty config (disabled by default)
+
+        super
+      end
+    end
+  end
+end

data/app/controllers/concerns/aikotoba/request_backable.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module Aikotoba
+  module RequestBackable
+    extend ActiveSupport::Concern
+    include Scopable
+
+    # NOTE: Modeled on the Rails authentication generator's
+    # `request_authentication` / `after_authentication_url` pair. Call this
+    # from the host app's own `authenticate_account!`-style before_action
+    # instead of a bare `redirect_to` to the sign in page. The engine can't
+    # capture the destination on its own: the host owns that redirect, and the
+    # `Referer` the browser sends to `GET /sign_in` is the page that *linked*
+    # to the protected page, not the protected page itself (a redirect never
+    # updates the Referer).
+    def aikotoba_request_authentication(**redirect_options)
+      aikotoba_store_return_to_path
+      redirect_to aikotoba_scoped_path(:new_session_path), **redirect_options
+    end
+
+    private
+
+    # NOTE: Not session[key] -- deleting makes this single-use, so a stale
+    # return_to can't be replayed on a later sign in.
+    def aikotoba_after_authentication_path
+      session.delete(aikotoba_return_to_session_key) || aikotoba_scope_config[:after_sign_in_path]
+    end
+
+    # NOTE: Unlike the Rails generator, which stores `request.url`, store only
+    # the host-less `fullpath`, so the stored value can never point at
+    # another host.
+    def aikotoba_store_return_to_path
+      path = request.fullpath
+      session[aikotoba_return_to_session_key] = path if aikotoba_storable_return_to_path?(path)
+    end
+
+    # NOTE: Only a page the browser can be sent back to with a plain GET is
+    # stored -- redirecting back to a POST/XHR/JSON endpoint after sign in
+    # would replay it as a GET and fail. `fullpath` never carries a host, but
+    # a request for "//evil.example.com/x" (or "/\evil.example.com/x", which
+    # browsers treat the same) still yields a protocol-relative URL once
+    # redirected to -- Rails only started guarding against this in
+    # redirect_to itself in 7.1, and this gem supports Rails >= 6.1.4.
+    def aikotoba_storable_return_to_path?(path)
+      return false unless request.get? && !request.xhr? && request.format.html?
+      path.start_with?("/") && !path.start_with?("//", "/\\")
+    end
+
+    def aikotoba_return_to_session_key
+      "#{aikotoba_scope_config[:session_key]}_return_to_after_authenticating"
+    end
+  end
+end

data/app/controllers/concerns/aikotoba/scopable.rb

@@ -0,0 +1,36 @@
+module Aikotoba
+  module Scopable
+    extend ActiveSupport::Concern
+
+    def aikotoba_scope_config
+      Aikotoba.scopes[aikotoba_scope]
+    end
+
+    def aikotoba_scoped_path(path, *params)
+      return aikotoba.public_send(path, *params) if aikotoba_scope.default?
+
+      aikotoba.public_send("#{aikotoba_scope}_#{path}", *params)
+    end
+
+    def aikotoba_scope
+      @aikotoba_scope ||= aikotoba_calc_scope_from(request.path).to_s.inquiry
+    end
+
+    private
+
+    def aikotoba_authenticate_target
+      aikotoba_scope_config.authenticate_for
+    end
+
+    def aikotoba_calc_scope_from(request_path)
+      scope = :default
+      Aikotoba.scopes.except(:default).each do |name, config|
+        if config.covers?(request_path)
+          scope = name
+          break # NOTE: Adopt the first matching scope
+        end
+      end
+      scope
+    end
+  end
+end

data/app/mailers/aikotoba/account_mailer.rb

@@ -1,24 +1,56 @@
 module Aikotoba
+  # NOTE: These run from deliver_later, so the token is read when the job runs, not when
+  #       it was enqueued. Reading the account's current token is deliberate: issuing a new
+  #       token destroys the previous one, so the latest is the only link that still works.
+  #       It can also be gone by then (used, or cleared by unlock!), in which case nothing is
+  #       sent -- returning without calling `mail` makes the delivery a no-op.
   class AccountMailer < ApplicationMailer
     def confirm
       @account = params[:account]
       @token = @account.confirmation_token
-      @confirm_url = aikotoba.confirm_account_url(token: @token.token)
+      return unless @token
+
+      @confirm_url = aikotoba_scoped_url(:confirm_account_url, token: @token.token)
       mail(to: @account.email, subject: I18n.t(".aikotoba.mailers.confirm.subject"))
     end
 
     def unlock
       @account = params[:account]
       @token = @account.unlock_token
-      @unlock_url = aikotoba.unlock_account_url(token: @token.token)
+      return unless @token
+
+      @unlock_url = aikotoba_scoped_url(:unlock_account_url, token: @token.token)
       mail(to: @account.email, subject: I18n.t(".aikotoba.mailers.unlock.subject"))
     end
 
     def recover
       @account = params[:account]
       @token = @account.recovery_token
-      @recover_url = aikotoba.edit_account_password_url(token: @token.token)
+      return unless @token
+
+      @recover_url = aikotoba_scoped_url(:edit_account_password_url, token: @token.token)
       mail(to: @account.email, subject: I18n.t(".aikotoba.mailers.recover.subject"))
     end
+
+    def magic_link
+      @account = params[:account]
+      @token = @account.magic_link_token
+      return unless @token
+
+      @magic_link_url = aikotoba_scoped_url(:authenticate_via_magic_link_url, token: @token.token)
+      mail(to: @account.email, subject: I18n.t(".aikotoba.mailers.magic_link.subject"))
+    end
+
+    private
+
+    def aikotoba_scoped_url(route, **params)
+      scope = Aikotoba.scopes.name_for(@account.authenticate_target_type)
+      name = (scope == "default") ? route : :"#{scope}_#{route}"
+      # NOTE: The name is built from config, never from request input, but only ever
+      #       public_send an engine route helper, not other public methods on the proxy.
+      raise ArgumentError, "not an Aikotoba route helper: #{name}" unless Aikotoba::Engine.routes.named_routes.route_defined?(name)
+
+      aikotoba.public_send(name, **params)
+    end
   end
 end

data/app/models/aikotoba/account/{service/confirmation.rb → confirmation.rb}

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Aikotoba
-  class Account::Service::Confirmation
+  class Account::Confirmation
     def self.create_token!(account:, notify: false)
       new(account: account).create_token!(notify: notify)
     end