aikotoba 0.2.0 → 0.3.0

data/app/models/aikotoba/account/recovery_token.rb

@@ -9,6 +9,7 @@ module Aikotoba
     validates :expired_at, presence: true
 
     scope :active, ->(now: Time.current) { where("expired_at >= ?", now) }
+    scope :for_target_type, ->(target_type_name) { joins(:account).merge(Account.for_target_type(target_type_name)) }
 
     after_initialize do |record|
       token = Account::Token.new(expiry: Aikotoba.recovery_token_expiry)
@@ -16,8 +17,12 @@ module Aikotoba
       record.expired_at ||= token.expired_at
     end
 
+    # NOTE: Waits for every open transaction (including callers' outer ones) to commit,
+    #       and is dropped on rollback, so a sent link never points at a missing token.
     def notify
-      AccountMailer.with(account: account).recover.deliver_now
+      ActiveRecord.after_all_transactions_commit do
+        AccountMailer.with(account: account).recover.deliver_later
+      end
     end
   end
 end

data/app/models/aikotoba/account/session.rb

@@ -15,9 +15,11 @@ module Aikotoba
     scope :active, ->(now: Time.current) { where("expired_at >= ?", now) }
 
     after_initialize do |record|
-      token = Account::Token.new(expiry: Aikotoba.session_expiry)
-      record.token ||= token.value
-      record.expired_at ||= token.expired_at
+      if record.token.nil? || record.expired_at.nil?
+        token = Account::Token.new(expiry: Aikotoba.session_expiry)
+        record.token ||= token.value
+        record.expired_at ||= token.expired_at
+      end
     end
 
     def revoke!

data/app/models/aikotoba/account/unlock_token.rb

@@ -9,6 +9,7 @@ module Aikotoba
     validates :expired_at, presence: true
 
     scope :active, ->(now: Time.current) { where("expired_at >= ?", now) }
+    scope :for_target_type, ->(target_type_name) { joins(:account).merge(Account.for_target_type(target_type_name)) }
 
     after_initialize do |record|
       token = Account::Token.new(expiry: Aikotoba.unlock_token_expiry)
@@ -16,8 +17,12 @@ module Aikotoba
       record.expired_at ||= token.expired_at
     end
 
+    # NOTE: Waits for every open transaction (including callers' outer ones) to commit,
+    #       and is dropped on rollback, so a sent link never points at a missing token.
     def notify
-      AccountMailer.with(account: account).unlock.deliver_now
+      ActiveRecord.after_all_transactions_commit do
+        AccountMailer.with(account: account).unlock.deliver_later
+      end
     end
   end
 end

data/app/models/aikotoba/account.rb

@@ -3,6 +3,7 @@
 module Aikotoba
   class Account < ApplicationRecord
     include EnabledFeatureCheckable
+    include OptionalAssociation
 
     # NOTE: (RFC5321) Path: The maximum total length of a reverse-path or forward-path is 256 octets.
     # https://datatracker.ietf.org/doc/html/rfc5321#section-4.5.3.1.3
@@ -14,8 +15,6 @@ module Aikotoba
     attribute :max_failed_attempts, :integer, default: -> { Aikotoba.max_failed_attempts }
 
     validates :email, presence: true, uniqueness: {case_sensitive: false}, format: EMAIL_REGEXP, length: {maximum: EMAIL_MAXIMUM_LENGTH}
-    validates :password, presence: true, length: {in: Password::LENGTH_RANGE}, on: [:create, :recover]
-    validates :password_digest, presence: true
     validates :confirmed, inclusion: [true, false]
     validates :failed_attempts, presence: true, numericality: {only_integer: true, greater_than_or_equal_to: 0}
     validates :max_failed_attempts, numericality: {only_integer: true, greater_than: 0}
@@ -35,14 +34,6 @@ module Aikotoba
       end
     end
 
-    attr_reader :password
-
-    def password=(value)
-      new_password = Password.new(value: value)
-      @password = new_password.value
-      assign_attributes(password_digest: new_password.digest)
-    end
-
     concerning :Authenticatable do
       included do
         has_many :sessions,
@@ -50,11 +41,15 @@ module Aikotoba
           dependent: :destroy,
           foreign_key: "aikotoba_account_id"
 
+        # NOTE: The accounts a scope handles: all of them when it has no authenticate_for,
+        #       otherwise only that target type. A Class passed to authenticate_for is
+        #       converted to a string for searching.
+        scope :for_target_type, ->(target_type_name) {
+          target_type_name.present? ? where(authenticate_target_type: target_type_name.to_s) : all
+        }
+
         scope :authenticatable, ->(target_type_name: nil) {
-          result = all
-          # NOTE: To ensure that authentication works even if a Class is passed to authenticate_for,
-          #       convert it to a string for searching.
-          result = result.where(authenticate_target_type: target_type_name.to_s) if target_type_name.present?
+          result = for_target_type(target_type_name)
           result = result.confirmed if confirmable?
           result = result.unlocked if lockable?
           result
@@ -62,39 +57,9 @@ module Aikotoba
       end
 
       class_methods do
-        def authenticate_by(attributes:, target_type_name: nil)
-          email, password = attributes.values_at(:email, :password)
-          account = find_by_identifier(email, target_type_name: target_type_name)
-          return prevent_timing_atack(email, password) unless account
-
-          account.authenticate(password).tap do |result|
-            ActiveRecord::Base.transaction do
-              if result
-                account.authentication_success!
-              else
-                account.authentication_failed!
-                Lock.lock!(account: account, notify: true) if lockable? && account.should_lock?
-              end
-            end
-          end
-        end
-
-        private
-
         def find_by_identifier(email, target_type_name: nil)
           authenticatable(target_type_name: target_type_name).find_by(email: email)
         end
-
-        # NOTE: Verify passwords even when accounts are not found to prevent timing attacks.
-        def prevent_timing_atack(email, password)
-          account = build_by(attributes: {email: email, password: password})
-          account.password_match?(password)
-          nil
-        end
-      end
-
-      def authenticate(input_password)
-        password_match?(input_password) ? self : nil
       end
 
       def authentication_failed!
@@ -104,20 +69,66 @@ module Aikotoba
       def authentication_success!
         update!(failed_attempts: 0)
       end
+    end
 
-      def password_match?(input_password)
-        Password.new(value: input_password).match?(digest: password_digest)
+    concerning :PasswordAuthenticatable do
+      included do
+        has_one :password_hash,
+          class_name: "Aikotoba::Account::PasswordHash",
+          dependent: :destroy,
+          foreign_key: "aikotoba_account_id",
+          autosave: true,
+          inverse_of: :account
       end
     end
 
     concerning :Registrable do
       class_methods do
+        # NOTE: This is one of the two places (see #update_by below) Account is allowed
+        #       to know :password is a valid registration attribute (unlike the removed
+        #       password/password=/password_digest delegators, which made Account speak
+        #       password as its own API). It exists so callers can keep submitting a flat
+        #       account[password] param instead of Rails' nested_attributes shape.
+        #       Extracting a Registration class wouldn't remove this knowledge, only
+        #       relocate it, so this is left as the accepted minimal seam.
         def build_by(attributes:)
-          email, password = attributes.values_at(:email, :password)
-          new(email: email).tap { |account| account.password = password }
+          attrs, has_password, password = extract_password_attribute(attributes)
+          new(attrs).tap { |account| account.build_password_hash.generate(password) if has_password }
+        end
+
+        def create_by!(attributes:)
+          build_by(attributes: attributes).tap(&:save!)
+        end
+
+        private
+
+        # NOTE: Shared by .build_by and #update_by so the :password-key-splitting
+        #       logic exists exactly once. has_password is returned separately from
+        #       password because a present-but-nil password must still reach
+        #       PasswordHash#generate (so its presence validation can reject it),
+        #       while an absent :password key must build no password_hash at all.
+        def extract_password_attribute(attributes)
+          attrs = attributes.to_h.symbolize_keys
+          has_password = attrs.key?(:password)
+          password = attrs.delete(:password)
+          [attrs, has_password, password]
         end
       end
 
+      # NOTE: The update-side counterpart to .build_by above -- account.update!(password:)
+      #       can't work here any more than Account.new(password:) can, since Account has
+      #       no password= for mass-assignment to land on.
+      def update_by(attributes:)
+        attrs, has_password, password = self.class.send(:extract_password_attribute, attributes)
+        assign_attributes(attrs)
+        (password_hash || build_password_hash).generate(password) if has_password
+        self
+      end
+
+      def update_by!(attributes:)
+        update_by(attributes: attributes).tap(&:save!)
+      end
+
       def register!
         ActiveRecord::Base.transaction do
           save!
@@ -128,9 +139,12 @@ module Aikotoba
 
     concerning :Confirmable do
       included do
-        has_one :confirmation_token,
-          dependent: :destroy,
-          foreign_key: "aikotoba_account_id"
+        # NOTE: optional_has_one rather than has_one -- this table may legitimately not
+        #       exist, so its dependent: :destroy callback has to be gated on that.
+        #       See OptionalAssociation.
+        optional_has_one :confirmation_token,
+          foreign_key: "aikotoba_account_id",
+          dependent: :destroy
         scope :confirmed, -> { where(confirmed: true) }
         scope :unconfirmed, -> { where(confirmed: false) }
       end
@@ -142,9 +156,10 @@ module Aikotoba
 
     concerning :Lockable do
       included do
-        has_one :unlock_token,
-          dependent: :destroy,
-          foreign_key: "aikotoba_account_id"
+        # NOTE: See the comment on Confirmable's association above -- same reasoning.
+        optional_has_one :unlock_token,
+          foreign_key: "aikotoba_account_id",
+          dependent: :destroy
         scope :locked, -> { where(locked: true) }
         scope :unlocked, -> { where(locked: false) }
       end
@@ -164,14 +179,19 @@ module Aikotoba
 
     concerning :Recoverable do
       included do
-        has_one :recovery_token,
-          dependent: :destroy,
-          foreign_key: "aikotoba_account_id"
+        # NOTE: See the comment on Confirmable's association above -- same reasoning.
+        optional_has_one :recovery_token,
+          foreign_key: "aikotoba_account_id",
+          dependent: :destroy
       end
+    end
 
-      def recover!(new_password:)
-        self.password = new_password
-        save!(context: :recover)
+    concerning :MagicLinkAuthenticatable do
+      included do
+        # NOTE: See the comment on Confirmable's association above -- same reasoning.
+        optional_has_one :magic_link_token,
+          foreign_key: "aikotoba_account_id",
+          dependent: :destroy
       end
     end
   end

data/app/models/concerns/aikotoba/enabled_feature_checkable.rb

@@ -20,6 +20,10 @@ module Aikotoba
       def recoverable?
         Aikotoba.recoverable
       end
+
+      def magic_link_authenticatable?
+        Aikotoba.magic_link_authenticatable
+      end
     end
 
     def registerable?
@@ -37,5 +41,9 @@ module Aikotoba
     def recoverable?
       self.class.recoverable?
     end
+
+    def magic_link_authenticatable?
+      self.class.magic_link_authenticatable?
+    end
   end
 end

data/app/models/concerns/aikotoba/optional_association.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+module Aikotoba
+  # NOTE: Support for has_one associations whose table is optional -- a host app that
+  #       never enables the owning feature may legitimately never run its migration (see
+  #       the README's Getting Start section). `dependent: :destroy` can't be used for
+  #       those, because it registers an unconditional callback that loads the association
+  #       on every parent destroy; that is what raised PG::UndefinedTable for host apps
+  #       with a feature off and its table never created.
+  module OptionalAssociation
+    extend ActiveSupport::Concern
+
+    module ClassMethods
+      SUPPORTED_DEPENDENT_OPTIONS = [nil, :destroy].freeze
+
+      # NOTE: Declares a has_one whose table may not exist. Behaves like plain `has_one`
+      #       in every respect except one: with `dependent: :destroy`, the callback that
+      #       cleans the child up is gated on the table actually existing.
+      #
+      #       That gate is the whole point. Rails' own `dependent: :destroy` callback is
+      #       unconditional -- it loads the association on every parent destroy whether or
+      #       not the table is there -- which is what raised PG::UndefinedTable. Gating on
+      #       the table's existence (rather than on the owning feature's flag) keeps
+      #       destroy working in *both* directions: no table means the reader is never
+      #       called and the table is never queried, while a table left behind after a
+      #       flag was switched off still gets cleaned up instead of stranding the row and
+      #       raising ActiveRecord::InvalidForeignKey.
+      #
+      #       Only `dependent: :destroy` (or no :dependent at all) is supported. The other
+      #       values would have to be forwarded to has_one to work, which would register
+      #       the unconditional callback this exists to avoid, so they raise rather than
+      #       silently doing nothing.
+      def optional_has_one(name, **options)
+        dependent = options.delete(:dependent)
+        unless SUPPORTED_DEPENDENT_OPTIONS.include?(dependent)
+          raise ArgumentError,
+            "optional_has_one supports dependent: :destroy only, got #{dependent.inspect}"
+        end
+
+        has_one(name, **options)
+        return if dependent.nil?
+
+        # NOTE: `dependent: :destroy` does two separate jobs and we want exactly one of
+        #       them, so it is deliberately withheld from has_one above and set here
+        #       instead. Order matters:
+        #
+        #       - Withheld: has_one reads :dependent at *declaration* time to register the
+        #         unconditional before_destroy. Never passing it means that callback is
+        #         never created, and setting the option afterwards cannot retroactively
+        #         create it. The guarded equivalent is registered below.
+        #       - Restored: HasOneAssociation#remove_target! reads :dependent out of the
+        #         reflection at *runtime*, to clear the previous record when a new one
+        #         replaces it. Without it, `build_<name>` + `save!` would try to nullify
+        #         the old row's NOT NULL foreign key and raise
+        #         ActiveRecord::RecordNotSaved, so every caller would need to hand-roll a
+        #         destroy first.
+        reflect_on_association(name).options[:dependent] = dependent
+
+        before_destroy do
+          # NOTE: Resolved per call rather than at declaration time to avoid autoloading
+          #       the associated model while this one is still being defined. It reads
+          #       table_name off the class, which is derived from the class name and so
+          #       needs no database access of its own.
+          table_name = self.class.reflect_on_association(name).klass.table_name
+          public_send(name)&.destroy if self.class.table_exists_in_schema_cache?(table_name)
+        end
+      end
+
+      # NOTE: Served from the schema cache -- negative results are cached too -- so this
+      #       costs at most one query per process rather than one per destroy. Like
+      #       anything schema-cached, a process that was already running when the
+      #       migration was applied needs a restart to notice the new table.
+      #       connection_pool#schema_cache is the current home for it; older supported
+      #       Rails versions keep it on the connection, hence the fallback.
+      def table_exists_in_schema_cache?(table_name)
+        pool = connection_pool
+        cache = pool.respond_to?(:schema_cache) ? pool.schema_cache : connection.schema_cache
+        cache.data_source_exists?(table_name)
+      end
+    end
+  end
+end

data/app/models/concerns/aikotoba/token_encryptable.rb

@@ -5,23 +5,13 @@ module Aikotoba
     extend ActiveSupport::Concern
 
     included do
-      if enabled_aikotoba_enctypted_token?
-        if available_active_record_encryption?
-          encrypts :token, deterministic: true
-        else
-          raise Errors::NotAvailableException, "You need to be able to encrypt the token using Active Record Encryption."
-        end
-      end
+      encrypts :token, deterministic: true if enabled_aikotoba_enctypted_token?
     end
 
     module ClassMethods
       def enabled_aikotoba_enctypted_token?
         Aikotoba.encrypted_token
       end
-
-      def available_active_record_encryption?
-        ActiveRecord::VERSION::MAJOR >= 7
-      end
     end
   end
 end

data/app/views/aikotoba/account_mailer/magic_link.html.erb

@@ -0,0 +1,3 @@
+Sign in url: <%= @magic_link_url %>
+<br>
+The url expires at <%= I18n.l(@token.expired_at, format: :long) %>

data/app/views/aikotoba/magic_links/new.html.erb

@@ -0,0 +1,14 @@
+<div class="aikotoba-magic-links-new">
+  <%= render "aikotoba/common/message" %>
+  <h1><%= I18n.t(".aikotoba.magic_links.new") %></h1>
+  <%= form_with model: @account, method: :post, url: aikotoba_scoped_path(:create_magic_link_path) do |f| %>
+    <p>
+      <%= f.label :email %>
+      <%= f.email_field :email, required: true, autocomplete: :email %>
+    </p>
+    <%= f.submit I18n.t(".aikotoba.magic_links.new") %>
+  <% end %>
+  <p>
+    <%= link_to I18n.t(".aikotoba.sessions.new"), aikotoba_scoped_path(:new_session_path) %>
+  </p>
+</div>

data/app/views/aikotoba/sessions/_links.html.erb

@@ -1,4 +1,4 @@
-<% if registerable? %>
+<% if aikotoba_scope_registerable? %>
   <p>
     <%= link_to I18n.t(".aikotoba.accounts.new"), aikotoba_scoped_path(:new_account_path) %>
   </p>
@@ -18,3 +18,8 @@
     <%= link_to I18n.t(".aikotoba.recoveries.new"), aikotoba_scoped_path(:new_recovery_token_path) %>
   </p>
 <% end %>
+<% if magic_link_authenticatable? %>
+  <p>
+    <%= link_to I18n.t(".aikotoba.magic_links.new"), aikotoba_scoped_path(:new_magic_link_path) %>
+  </p>
+<% end %>

data/config/locales/en.yml

@@ -4,6 +4,9 @@ en:
       aikotoba/account:
         email: Email
         password: Password
+        password_hash: Password
+      aikotoba/account/password_hash:
+        plaintext: Password
     models:
       aikotoba/account: Account
   aikotoba:
@@ -18,6 +21,8 @@ en:
     recoveries:
       new: Send password reset token
       edit: Password reset
+    magic_links:
+      new: Send sign in link
     mailers:
       confirm:
         subject: "Confirmation instructions"
@@ -25,6 +30,8 @@ en:
         subject: "Unlock instructions"
       recover:
         subject: "Password reset instructions"
+      magic_link:
+        subject: "Your sign in link"
 
     messages:
       authentication:
@@ -46,3 +53,6 @@ en:
         sent: Password reset url has been sent to your email address (if user with that email address exists).
         success: Password reset you account successfully.
         failed: Oops. Password reset failed.
+      magic_link:
+        sent: Sign in url has been sent to your email address (if user with that email address exists).
+        failed: Oops. Sign in link is invalid or has expired.

data/config/routes.rb

@@ -4,36 +4,45 @@ require "aikotoba/constraints/registerable_constraint"
 require "aikotoba/constraints/confirmable_constraint"
 require "aikotoba/constraints/lockable_constraint"
 require "aikotoba/constraints/recoverable_constraint"
+require "aikotoba/constraints/magic_link_authenticatable_constraint"
 
 Aikotoba::Engine.routes.draw do
   Aikotoba.scopes.each do |scope_name, config|
     scope as: ((scope_name == "default") ? nil : scope_name) do
-      get(config[:sign_in_path], to: "sessions#new", as: :new_session)
-      post(config[:sign_in_path], to: "sessions#create", as: :create_session)
-      delete(config[:sign_out_path], to: "sessions#destroy", as: :destroy_session)
+      get(config.route_path(:sign_in_path), to: "sessions#new", as: :new_session)
+      post(config.route_path(:sign_in_path), to: "sessions#create", as: :create_session)
+      delete(config.route_path(:sign_out_path), to: "sessions#destroy", as: :destroy_session)
 
-      constraints(Aikotoba::RegisterableConstraint) do
-        get(config[:sign_up_path], to: "accounts#new", as: :new_account)
-        post(config[:sign_up_path], to: "accounts#create", as: :create_account)
+      if config.registerable?
+        constraints(Aikotoba::RegisterableConstraint) do
+          get(config.route_path(:sign_up_path), to: "accounts#new", as: :new_account)
+          post(config.route_path(:sign_up_path), to: "accounts#create", as: :create_account)
+        end
       end
 
       constraints(Aikotoba::ConfirmableConstraint) do
-        get(config[:confirm_path], to: "confirms#new", as: :new_confirmation_token)
-        post(config[:confirm_path], to: "confirms#create", as: :create_confirmation_token)
-        get(File.join(config[:confirm_path], ":token"), to: "confirms#update", as: :confirm_account)
+        get(config.route_path(:confirm_path), to: "confirms#new", as: :new_confirmation_token)
+        post(config.route_path(:confirm_path), to: "confirms#create", as: :create_confirmation_token)
+        get(File.join(config.route_path(:confirm_path), ":token"), to: "confirms#update", as: :confirm_account)
       end
 
       constraints(Aikotoba::LockableConstraint) do
-        get(config[:unlock_path], to: "unlocks#new", as: :new_unlock_token)
-        post(config[:unlock_path], to: "unlocks#create", as: :create_unlock_token)
-        get(File.join(config[:unlock_path], ":token"), to: "unlocks#update", as: :unlock_account)
+        get(config.route_path(:unlock_path), to: "unlocks#new", as: :new_unlock_token)
+        post(config.route_path(:unlock_path), to: "unlocks#create", as: :create_unlock_token)
+        get(File.join(config.route_path(:unlock_path), ":token"), to: "unlocks#update", as: :unlock_account)
       end
 
       constraints(Aikotoba::RecoverableConstraint) do
-        get(config[:recover_path], to: "recoveries#new", as: :new_recovery_token)
-        post(config[:recover_path], to: "recoveries#create", as: :create_recovery_token)
-        get(File.join(config[:recover_path], ":token"), to: "recoveries#edit", as: :edit_account_password)
-        patch(File.join(config[:recover_path], ":token"), to: "recoveries#update", as: :update_account_password)
+        get(config.route_path(:recover_path), to: "recoveries#new", as: :new_recovery_token)
+        post(config.route_path(:recover_path), to: "recoveries#create", as: :create_recovery_token)
+        get(File.join(config.route_path(:recover_path), ":token"), to: "recoveries#edit", as: :edit_account_password)
+        patch(File.join(config.route_path(:recover_path), ":token"), to: "recoveries#update", as: :update_account_password)
+      end
+
+      constraints(Aikotoba::MagicLinkAuthenticatableConstraint) do
+        get(config.route_path(:magic_link_path), to: "magic_links#new", as: :new_magic_link)
+        post(config.route_path(:magic_link_path), to: "magic_links#create", as: :create_magic_link)
+        get(File.join(config.route_path(:magic_link_path), ":token"), to: "magic_links#update", as: :authenticate_via_magic_link)
       end
     end
   end