card 1.98.3 → 1.99.0

data/mod/account/set/abstract/accounted.rb

@@ -0,0 +1,15 @@
+def account
+  fetch trait: :account, new: {}
+end
+
+def default_account_status
+  "active"
+end
+
+format :html do
+  def account_formgroups
+    Auth.as_bot do
+      subformat(card.account)._render :content_formgroups, structure: true
+    end
+  end
+end

data/mod/account/set/all/account.rb

@@ -8,10 +8,6 @@ def account
   fetch trait: :account
 end
 
-def accountable?
-  Card.toggle(rule(:accountable))
-end
-
 def parties
   @parties ||= (all_enabled_roles << id).flatten.reject(&:blank?)
 end

data/mod/account/set/right/account.rb

@@ -1,140 +1,32 @@
 # -*- encoding : utf-8 -*-
 
-include All::Permissions::Accounts
-
 card_accessor :email
 card_accessor :password
 card_accessor :salt
 card_accessor :status
-card_accessor :token
-
-#### ON CREATE
-
-# legal to add +*account card
-event :validate_accountability, :prepare_to_validate, on: :create do
-  errors.add :content, tr(:error_not_allowed) unless left&.accountable?
-end
+card_accessor :api_key
 
-event :require_email, :prepare_to_validate,
-      after: :validate_accountability, on: :create do
-  errors.add :email, "required" unless subfield(:email)
-end
-
-event :set_default_salt, :prepare_to_validate, on: :create do
-  salt = Digest::SHA1.hexdigest "--#{Time.zone.now}--"
-  Env[:salt] = salt # HACK!!! need viable mechanism to get this to password
-  add_subfield :salt, content: salt
-end
-
-event :set_default_status, :prepare_to_validate, on: :create do
-  default_status = left&.try(:default_account_status) || "active"
-  add_subfield :status, content: default_status
-end
-
-event :generate_confirmation_token,
-      :prepare_to_store, on: :create, when: :can_approve? do
-  add_subfield :token, content: generate_token
-end
-
-event :send_account_verification_email, :integrate,
-      on: :create, when: proc { |c| c.token.present? } do
-  Card[:verification_email].deliver self, to: email
-end
-
-# ON UPDATE
-
-# reset password emails contain a link to update the +*account card
-# and trigger this event
-event :reset_password, :prepare_to_validate, on: :update, trigger: :required do
-  reset_password_with_token Env.params[:token]
-end
-
-# STANDALONE EVENTS
-# only triggered when called directly (as methods)
-
-event :reset_token do
-  token = generate_token
-  Auth.as_bot { token_card.update! content: token }
-  token
-end
-
-event :send_welcome_email do
-  welcome = Card[:welcome_email]
-  welcome.deliver self, to: email if welcome&.type_code == :email_template
-end
-
-event :send_reset_password_token do
-  reset_token
-  Card[:password_reset_email].deliver self, to: email
-end
-
-def active?
-  status == "active"
-end
+require_field :email
 
-def blocked?
-  status == "blocked"
+def accounted
+  left
 end
 
-def built_in?
-  status == "system"
-end
-
-def pending?
-  status == "pending"
-end
-
-def validate_token! test_token
-  token_card.validate! test_token
-end
-
-def reset_password_with_token token
-  aborting do
-    if !token
-      errors.add :token, "is required"
-    elsif !validate_token!(token)
-      # FIXME: This should be an error.
-      # However, an error abort will trigger a rollback, so the
-      # token reset won't work.  That may be an argument for
-      # handling the token update in a separate request?
-      success << reset_password_try_again
-    else
-      success << reset_password_success
-    end
-  end
-end
-
-def refreshed_token
-  if token_card.id
-    token_card.refresh(true).db_content # TODO: explain why refresh is needed
-  else # eg when viewing email template
-    "[token]"
-  end
-end
-
-def can_approve?
-  Card.new(type_id: Card.default_accounted_type_id).ok? :create
+def accounted_id
+  left_id
 end
 
 def ok_to_read
   own_account? ? true : super
 end
 
-def reset_password_success
-  # token_card.used!
-  Auth.signin left_id
-  { id: name, view: :edit }
-end
+# allow account owner to update account field content
+def ok_to_update
+  return true if own_account? && !name_changed? && !type_id_changed?
 
-def reset_password_try_again
-  message = tr :sorry_email_reset, error_msg: token_card.errors.first.last
-  send_reset_password_token
-  { id: "_self", view: "message", message: message }
+  super
 end
 
-# FIXME: explain or remove.
-def edit_password_success_args; end
-
 def changes_visible? act
   act.actions_affecting(act.card).each do |action|
     return true if action.card.ok? :read
@@ -142,45 +34,25 @@ def changes_visible? act
   false
 end
 
-format do
-  view :verify_url, cache: :never do
-    card_url path(token_path_opts.merge(mark: card.name.left))
-  end
-
-  view :verify_days, cache: :never do
-    (Card.config.token_expiry / 1.day).to_s
-  end
-
-  view :reset_password_url do
-    card_url path(token_path_opts.merge(card: { trigger: :reset_password }))
+def send_account_email email_template
+  ecard = Card[email_template]
+  unless ecard&.type_id == EmailTemplateID
+    raise Card::Error, "invalid email template: #{email_template}"
   end
 
-  view :reset_password_days do
-    (Card.config.token_expiry / 1.day).to_s
-  end
+  ecard.deliver self, to: email
+end
 
-  def token_path_opts
-    { action: :update, live_token: true, token: card.refreshed_token }
-  end
+def validate_api_key! api_key
+  api_key_card.validate! api_key
 end
 
-format :html do
-  view :raw do
-    # FIXME: use field_nest instead of parsing content
-    # Problem: when you do that then the fields are missing in the sign up form:
-    # output( [field_nest(:email, view: :titled, title: "email"),
-    #          field_nest(:password, view: :titled, title: "password")])
-    %({{+#{:email.cardname}|labeled;title:email;edit:inline}}
-      {{+#{:password.cardname}|labeled;title:password;edit:inline}})
-  end
+def method_missing method, *args
+  super unless args.empty? && (matches = method.match(/^(?<status>.*)\?$/))
 
-  before :content_formgroup do
-    voo.edit_structure = [[:email, "email"], [:password, "password"]]
-  end
+  status == matches[:status]
 end
 
-format :email do
-  def mail context, fields
-    super context, fields.reverse_merge(to: card.email)
-  end
+def respond_to_missing? method, _include_private=false
+  method.match?(/\?/) ? true : super
 end

data/mod/account/set/right/account/events.rb

@@ -0,0 +1,98 @@
+#### ON CREATE
+
+event :set_default_salt, :prepare_to_validate, on: :create do
+  add_subfield(:salt).generate
+end
+
+event :set_default_status, :prepare_to_validate, on: :create do
+  add_subfield :status, content: (accounted&.try(:default_account_status) || "active")
+end
+
+# ON UPDATE
+
+# reset password emails contain a link to update the +*account card
+# and trigger this event
+event :reset_password, :prepare_to_validate, on: :update, trigger: :required do
+  verifying_token :reset_password_success, :reset_password_failure
+end
+
+event :verify_and_activate, :prepare_to_validate, on: :update, trigger: :required do
+  activatable do
+    verifying_token :verify_and_activate_success, :verify_and_activate_failure
+    add_subcard(accounted)&.try :activate_accounted
+  end
+end
+
+event :password_redirect, :finalize, on: :update, when: :password_redirect? do
+  success << { id: name, view: "edit" }
+end
+
+# INTEGRATION
+
+%i[password_reset_email verification_email welcome_email].each do |email|
+  event "send_#{email}".to_sym, :integrate, trigger: :required do
+    send_account_email email
+  end
+end
+
+## EVENT HELPERS
+
+def activatable
+  abort :failure, "no field manipulation mid-activation" if subcards.present?
+  # above is necessary because activation uses super user (Decko Bot),
+  # so allowing subcards would be unsafe
+  yield
+end
+
+# note: this only works in the context of an action.
+# if run independently, it will not activate an account
+event :activate_account do
+  add_subfield :status, content: "active"
+  trigger_event! :send_welcome_email
+end
+
+def verifying_token success, failure
+  requiring_token do |token|
+    result = Auth::Token.decode token
+    if result.is_a?(String)
+      aborting { send failure, result }
+    else
+      send success
+    end
+  end
+end
+
+def requiring_token
+  if !(token = Env.params[:token])
+    aborting { errors.add :token, "is required" }
+  else
+    yield token
+  end
+end
+
+def password_redirect?
+  Auth.current_id == accounted_id && password.blank?
+end
+
+def verify_and_activate_success
+  Auth.signin accounted_id
+  Auth.as_bot # use admin permissions for rest of action
+  activate_account
+  success << ""
+end
+
+def verify_and_activate_failure error_message
+  send_verification_email
+  errors.add "Sorry, #{error_message}. Please check your email for a new activation link."
+end
+
+def reset_password_success
+  Auth.signin accounted_id
+  success << { id: name, view: :edit }
+  abort :success
+end
+
+def reset_password_failure error_message
+  Auth.as_bot { send_password_reset_email }
+  errors.add tr(:sorry_email_reset, error_msg: error_message)
+end

data/mod/account/set/right/account/views.rb

@@ -0,0 +1,65 @@
+format do
+  view :verify_url, cache: :never do
+    raise Error::PermissionDenied unless card.ok?(:create) || card.action
+
+    token_url :verify_and_activate, anonymous: true
+  end
+
+  view :reset_password_url do
+    raise Error::PermissionDenied unless card.password_card.ok? :update
+
+    token_url :reset_password
+  end
+
+  view :token_expiry do
+    "(#{token_expiry_sentence}"
+  end
+
+  view :token_days do
+    Card.config.token_expiry / 1.day
+  end
+
+  # DEPRECATED
+  view :verify_days, :token_days
+  view :reset_password_days, :token_days
+
+  def token_url trigger, extra_payload={}
+    card_url path(action: :update,
+                  card: { trigger: trigger },
+                  token: new_token(extra_payload))
+  end
+
+  def token_expiry_sentence
+    "Link will expire in #{render_token_days} days"
+  end
+
+  def new_token extra_payload
+    Auth::Token.encode card.accounted_id, extra_payload
+  end
+end
+
+format :html do
+  view :core do
+    [account_field_nest(:email, "email"),
+     account_field_nest(:password, "password")]
+  end
+
+  def account_field_nest field, title
+    field_nest field, title: title, view: :labeled
+    # edit: :inline, hide: [:help_link, :bridge_link]
+  end
+
+  before :content_formgroups do
+    voo.edit_structure = [[:email, "email"], [:password, "password"]]
+  end
+
+  view :token_expiry do
+    "<p><em>#{token_expiry_sentence}</em></p>"
+  end
+end
+
+format :email do
+  def mail context, fields
+    super context, fields.reverse_merge(to: card.email)
+  end
+end

data/mod/account/set/right/api_key.rb

@@ -0,0 +1,48 @@
+include_set Abstract::AccountField
+
+# DURATIONS = "second|minute|hour|day|week|month|year".freeze
+
+def history?
+  false
+end
+
+view :raw do
+  tr :private_data
+end
+
+def validate! api_key
+  error =
+    case
+    when !real?             then [:token_not_found, tr(:error_token_not_found)]
+    # when expired?           then [:token_expired, tr(:error_token_expired)]
+    when content != api_key then [:incorrect_token, tr(:error_incorrect_token)]
+    end
+  errors.add(*error) if error
+  error.nil?
+end
+
+# def expired?
+#   !permanent? && updated_at <= term.ago
+# end
+#
+# def permanent?
+#   term == "permanent"
+# end
+
+# def term
+#   @term ||=
+#     if expiration.present?
+#       term_from_string expiration
+#     else
+#       Card.config.token_expiry
+#     end
+# end
+
+# def term_from_string string
+#   string.strip!
+#   return "permanent" if string == "none"
+#   re_match = /^(\d+)[\.\s]*(#{DURATIONS})s?$/.match(string)
+#   number, unit = re_match.captures if re_match
+#   raise Card::Open::Error, tr(:exception_bad_expiration, example: '2 days') unless unit
+#   number.to_i.send unit
+# end