card 1.98.0 → 1.99.1

data/mod/account/set/right/account/events.rb

@@ -0,0 +1,98 @@
+#### ON CREATE
+
+event :set_default_salt, :prepare_to_validate, on: :create do
+  add_subfield(:salt).generate
+end
+
+event :set_default_status, :prepare_to_validate, on: :create do
+  add_subfield :status, content: (accounted&.try(:default_account_status) || "active")
+end
+
+# ON UPDATE
+
+# reset password emails contain a link to update the +*account card
+# and trigger this event
+event :reset_password, :prepare_to_validate, on: :update, trigger: :required do
+  verifying_token :reset_password_success, :reset_password_failure
+end
+
+event :verify_and_activate, :prepare_to_validate, on: :update, trigger: :required do
+  activatable do
+    verifying_token :verify_and_activate_success, :verify_and_activate_failure
+    add_subcard(accounted)&.try :activate_accounted
+  end
+end
+
+event :password_redirect, :finalize, on: :update, when: :password_redirect? do
+  success << { id: name, view: "edit" }
+end
+
+# INTEGRATION
+
+%i[password_reset_email verification_email welcome_email].each do |email|
+  event "send_#{email}".to_sym, :integrate, trigger: :required do
+    send_account_email email
+  end
+end
+
+## EVENT HELPERS
+
+def activatable
+  abort :failure, "no field manipulation mid-activation" if subcards.present?
+  # above is necessary because activation uses super user (Decko Bot),
+  # so allowing subcards would be unsafe
+  yield
+end
+
+# note: this only works in the context of an action.
+# if run independently, it will not activate an account
+event :activate_account do
+  add_subfield :status, content: "active"
+  trigger_event! :send_welcome_email
+end
+
+def verifying_token success, failure
+  requiring_token do |token|
+    result = Auth::Token.decode token
+    if result.is_a?(String)
+      aborting { send failure, result }
+    else
+      send success
+    end
+  end
+end
+
+def requiring_token
+  if !(token = Env.params[:token])
+    aborting { errors.add :token, "is required" }
+  else
+    yield token
+  end
+end
+
+def password_redirect?
+  Auth.current_id == accounted_id && password.blank?
+end
+
+def verify_and_activate_success
+  Auth.signin accounted_id
+  Auth.as_bot # use admin permissions for rest of action
+  activate_account
+  success << ""
+end
+
+def verify_and_activate_failure error_message
+  send_verification_email
+  errors.add "Sorry, #{error_message}. Please check your email for a new activation link."
+end
+
+def reset_password_success
+  Auth.signin accounted_id
+  success << { id: name, view: :edit }
+  abort :success
+end
+
+def reset_password_failure error_message
+  Auth.as_bot { send_password_reset_email }
+  errors.add tr(:sorry_email_reset, error_msg: error_message)
+end

data/mod/account/set/right/account/views.rb

@@ -0,0 +1,65 @@
+format do
+  view :verify_url, cache: :never do
+    raise Error::PermissionDenied unless card.ok?(:create) || card.action
+
+    token_url :verify_and_activate, anonymous: true
+  end
+
+  view :reset_password_url do
+    raise Error::PermissionDenied unless card.password_card.ok? :update
+
+    token_url :reset_password
+  end
+
+  view :token_expiry do
+    "(#{token_expiry_sentence}"
+  end
+
+  view :token_days do
+    Card.config.token_expiry / 1.day
+  end
+
+  # DEPRECATED
+  view :verify_days, :token_days
+  view :reset_password_days, :token_days
+
+  def token_url trigger, extra_payload={}
+    card_url path(action: :update,
+                  card: { trigger: trigger },
+                  token: new_token(extra_payload))
+  end
+
+  def token_expiry_sentence
+    "Link will expire in #{render_token_days} days"
+  end
+
+  def new_token extra_payload
+    Auth::Token.encode card.accounted_id, extra_payload
+  end
+end
+
+format :html do
+  view :core do
+    [account_field_nest(:email, "email"),
+     account_field_nest(:password, "password")]
+  end
+
+  def account_field_nest field, title
+    field_nest field, title: title, view: :labeled
+    # edit: :inline, hide: [:help_link, :bridge_link]
+  end
+
+  before :content_formgroups do
+    voo.edit_structure = [[:email, "email"], [:password, "password"]]
+  end
+
+  view :token_expiry do
+    "<p><em>#{token_expiry_sentence}</em></p>"
+  end
+end
+
+format :email do
+  def mail context, fields
+    super context, fields.reverse_merge(to: card.email)
+  end
+end

data/mod/account/set/right/api_key.rb

@@ -0,0 +1,48 @@
+include_set Abstract::AccountField
+
+# DURATIONS = "second|minute|hour|day|week|month|year".freeze
+
+def history?
+  false
+end
+
+view :raw do
+  tr :private_data
+end
+
+def validate! api_key
+  error =
+    case
+    when !real?             then [:token_not_found, tr(:error_token_not_found)]
+    # when expired?           then [:token_expired, tr(:error_token_expired)]
+    when content != api_key then [:incorrect_token, tr(:error_incorrect_token)]
+    end
+  errors.add(*error) if error
+  error.nil?
+end
+
+# def expired?
+#   !permanent? && updated_at <= term.ago
+# end
+#
+# def permanent?
+#   term == "permanent"
+# end
+
+# def term
+#   @term ||=
+#     if expiration.present?
+#       term_from_string expiration
+#     else
+#       Card.config.token_expiry
+#     end
+# end
+
+# def term_from_string string
+#   string.strip!
+#   return "permanent" if string == "none"
+#   re_match = /^(\d+)[\.\s]*(#{DURATIONS})s?$/.match(string)
+#   number, unit = re_match.captures if re_match
+#   raise Card::Open::Error, tr(:exception_bad_expiration, example: '2 days') unless unit
+#   number.to_i.send unit
+# end

data/mod/account/set/right/email.rb

@@ -1,4 +1,4 @@
-include All::Permissions::Accounts
+include_set Abstract::AccountField
 
 event :validate_email, :validate, on: :save do
   if content? && content !~ /^([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})$/i
@@ -25,7 +25,7 @@ event :downcase_email, :prepare_to_validate, on: :save do
 end
 
 def email_required?
-  !built_in?
+  !left.system?
 end
 
 def ok_to_read

data/mod/account/set/right/password.rb

@@ -1,4 +1,4 @@
-include All::Permissions::Accounts
+include_set Abstract::AccountField
 
 def history?
   false
@@ -13,8 +13,6 @@ event :encrypt_password, :store,
       when: proc { !Card::Env[:no_password_encryptions] } do
   # no_password_encryptions = hack for import - fix with api for ignoring events
   salt = left&.salt
-  # HACK: fix with better ORM handling
-  salt = Card::Env[:salt] unless salt.present?
   self.content = Auth.encrypt content, salt
 
   # errors.add :password, 'need a valid salt'
@@ -22,11 +20,10 @@ event :encrypt_password, :store,
   # not sure when that broke??
 end
 
-event :validate_password, :validate,
-      on: :save do
-  unless content.length > 3
-    errors.add :password, tr(:password_length)
-  end
+event :validate_password, :validate, on: :save do
+  return if content.length > 3
+
+  errors.add :password, tr(:password_length)
 end
 
 event :validate_password_present, :prepare_to_validate, on: :update do
@@ -42,7 +39,7 @@ format :html do
     render_raw
   end
 
-  view :editor do
+  view :input do
     card.content = ""
     password_field :content, class: "d0-card-content", autocomplete: autocomplete?
   end

data/mod/account/set/right/salt.rb

@@ -1,4 +1,8 @@
-include All::Permissions::Accounts
+include_set Abstract::AccountField
+
+def generate
+  self.content = Digest::SHA1.hexdigest "--#{Time.zone.now}--"
+end
 
 def history?
   false

data/mod/account/set/right/status.rb

@@ -1,4 +1,13 @@
-include All::Permissions::Accounts
+include_set Abstract::AccountField
+include_set Abstract::Pointer
+
+def input_type
+  :radio
+end
+
+def option_names
+  %w[unapproved unverified active blocked system]
+end
 
 def ok_to_update
   if own_account? && !Auth.always_ok?

data/mod/account/set/self/signin.rb

@@ -71,7 +71,7 @@ def send_reset_password_email_or_fail email
     break errors.add :email, i18n_signin(:error_blank) if email.blank?
 
     if (account = Auth.find_account_by_email(email))&.active?
-      account.send_reset_password_token
+      Auth.as_bot { account.send_password_reset_email }
     elsif account
       errors.add :account, i18n_signin(:error_not_active)
     else
@@ -86,7 +86,7 @@ format :html do
     with_nest_mode :edit do
       card_form :update, recaptcha: :off, success: signin_success do
         [
-          _render_content_formgroup,
+          _render_content_formgroups,
           _render_signin_buttons
         ]
       end
@@ -110,7 +110,7 @@ format :html do
     _render_core
   end
 
-  view :closed_content do
+  view :one_line_content do
     ""
   end
 

data/mod/account/set/type/role.rb

@@ -14,4 +14,8 @@ format :html do
        render_link]
     end
   end
+
+  def related_by_content_items
+    super.unshift ["members", :members]
+  end
 end

data/mod/account/set/type/signup.rb

@@ -1,182 +1,53 @@
-format :html do
-  def invitation?
-    return @invitation unless @invitation.nil?
-    @invitation = Auth.signed_in? &&
-                  (card.fetch trait: :account, new: {}).can_approve?
-    # consider making account a card_accessor?
-  end
-
-  view :new do
-    voo.title = invitation? ? tr(:invite) : tr(:sign_up)
-    super()
-  end
+include_set Abstract::Accounted
 
-  before :name_formgroup do
-    voo.help = tr :first_last_help
-  end
-
-  view :content_formgroup do
-    [account_formgroups, (card.structure ? edit_slot : "")].join
-  end
-
-  def hidden_success override=nil
-    override = card.rule(:thanks) unless invitation?
-    super override
-  end
-
-  view :new_buttons do
-    button_formgroup do
-      [standard_create_button, invite_button].compact
-    end
-  end
-
-  def invite_button
-    return unless invitation?
-    button_tag "Send Invitation", situation: "primary"
-  end
-
-  def account_formgroups
-    account = card.fetch trait: :account, new: {}
-    Auth.as_bot do
-      subformat(account)._render :content_formgroup, structure: true
-    end
-  end
-
-  view :core, template: :haml do
-    @lines = [signup_line] + account_lines
-    @body = process_content _render_raw
-  end
-
-  def signup_line
-    [ "<strong>#{safe_name}</strong>",
-      ("was" unless anonymous_signup?),
-      "signed up on #{format_date card.created_at}"
-    ].compact.join " "
-  end
-
-  def anonymous_signup?
-    card.creator_id == AnonymousID
-  end
-
-  def account_lines
-    if card.account
-      verification_lines
-    else
-      [tr(:missing_account)]
-    end
-  end
-
-  def verification_lines
-    [ verification_sent_line, verification_link_line].compact
-  end
-
-  def verification_sent_line
-    account = card.account
-    return unless account.token.present? && account.email_card.ok?(:read)
-    "A verification email has been sent to #{account.email}"
-  end
-
-  def verification_link_line
-    links = verification_links
-    return if links.empty?
-    links.join " "
-  end
-
-  def verification_links
-    [approve_with_token_link, approve_without_token_link, deny_link].compact
-  end
-
-  def approve_with_token_link
-    return unless card.account.can_approve?
-    token_action = card.account.token.present? ? "Resend" : "Send"
-    link_to_card card, "#{token_action} verification email",
-                 path: { action: :update, approve_with_token: true }
-  end
-
-  def approve_without_token_link
-    return unless card.account.can_approve?
-    link_to_card card, "Approve without verification",
-                 path: { action: :update, approve_without_token: true }
-  end
-
-  def deny_link
-    return unless card.ok? :delete
-    link_to_card card, "Deny and delete", path: { action: :delete }
-  end
-end
+require_field :account
 
 def default_account_status
-  "pending"
+  can_approve? ? "unverified" : "unapproved"
 end
 
-event :activate_by_token, :validate, on: :update,
-                                     when: proc { |c| c.has_token? } do
-  abort :failure, "no field manipulation mid-activation" if subcards.present?
-  # necessary because this performs actions as Wagn Bot
-  abort :failure, "no account associated with #{name}" unless account
-
-  account.validate_token! @env_token
-
-  if account.errors.empty?
-    account.token_card.used!
-    activate_account
-    Auth.signin id
-    Auth.as_bot # use admin permissions for rest of action
-    success << ""
-  else
-    resend_activation_token
-    abort :success
-  end
-end
-
-def has_token?
-  @env_token = Env.params[:token]
+def can_approve?
+  Card.new(type_id: Card.default_accounted_type_id).ok? :create
 end
 
-event :activate_account do
-  # FIXME: -- sends email before account is fully activated
-  add_subfield :account
-  subfield(:account).add_subfield :status, content: "active"
+def activate_accounted
   self.type_id = Card.default_accounted_type_id
-  account.send_welcome_email
 end
 
-event :approve_with_token, :validate,
-      on: :update,
-      when: proc { Env.params[:approve_with_token] } do
-  abort :failure, "illegal approval" unless account.can_approve?
-  account.reset_token
-  account.send_account_verification_email
+event :auto_approve_with_verification, :validate, on: :create, when: :can_approve? do
+  request_verification
 end
 
-event :approve_without_token, :validate,
-      on: :update,
-      when: proc { Env.params[:approve_without_token] } do
-  abort :failure, "illegal approval" unless account.can_approve?
-  activate_account
+event :approve_with_verification, :validate, on: :update, trigger: :required do
+  approvable { request_verification }
 end
 
-event :resend_activation_token do
-  account.reset_token
-  account.send_account_verification_email
-  message = "Please check your email for a new password reset link."
-  if account.errors.any?
-    message = "Sorry, #{account.errors.first.last}. #{message}"
+event :approve_without_verification, :validate, on: :update, trigger: :required do
+  # TODO: if validated here, add trigger and activate in storage phase
+  approvable do
+    activate_accounted
+    account_subfield.activate_account
   end
-  success << { id: "_self", view: "message", message: message }
 end
 
-def signed_in_as_me_without_password?
-  Auth.signed_in? && Auth.current_id == id && account.password.blank?
+event :act_as_current_for_integrate_stage, :integrate, on: :create do
+  Auth.current_id = id
 end
 
-event :redirect_to_edit_password, :finalize,
-      on: :update,
-      when: proc { |c| c.signed_in_as_me_without_password? } do
-  Env.params[:success] = account.edit_password_success_args
+def account_subfield
+  subfield(:account) || add_subfield(:account)
 end
 
-event :act_as_current_for_integrate_stage, :integrate,
-      on: :create do
-  Auth.current_id = id
+def request_verification
+  acct = account_subfield
+  acct.add_subfield :status, content: "unverified"
+  acct.trigger_event! :send_verification_email
+end
+
+def approvable
+  if can_approve?
+    yield
+  else
+    abort :failure, "illegal approval" # raise permission denied?
+  end
 end