card 1.98.3 → 1.99.0

data/db/seed/test/fixtures/schema_migrations_core_cards.yml

@@ -188,82 +188,120 @@ schema_migrations_core_cards_093:
 schema_migrations_core_cards_094:
   version: '20180712042655'
 schema_migrations_core_cards_095:
-  version: '20180905061534'
+  version: '20180805112548'
 schema_migrations_core_cards_096:
-  version: '20180905061536'
+  version: '20180905061534'
 schema_migrations_core_cards_097:
-  version: '20181108181219'
+  version: '20180905061536'
 schema_migrations_core_cards_098:
-  version: '20181120200937'
+  version: '20180905061537'
 schema_migrations_core_cards_099:
-  version: '20181129140917'
+  version: '20181108181219'
 schema_migrations_core_cards_100:
-  version: '20190125125150'
+  version: '20181120200937'
 schema_migrations_core_cards_101:
-  version: '20190204195038'
+  version: '20181129140917'
 schema_migrations_core_cards_102:
-  version: '20190204195039'
+  version: '20190125125150'
 schema_migrations_core_cards_103:
-  version: '20190228122633'
+  version: '20190204195038'
 schema_migrations_core_cards_104:
-  version: '20190228122634'
+  version: '20190204195039'
 schema_migrations_core_cards_105:
-  version: '20190228122635'
+  version: '20190228122633'
 schema_migrations_core_cards_106:
-  version: '20190228122636'
+  version: '20190228122634'
 schema_migrations_core_cards_107:
-  version: '20190228122638'
+  version: '20190228122635'
 schema_migrations_core_cards_108:
-  version: '20190228122739'
+  version: '20190228122636'
 schema_migrations_core_cards_109:
-  version: '20190306172622'
+  version: '20190228122638'
 schema_migrations_core_cards_110:
-  version: '20190306172623'
+  version: '20190228122739'
 schema_migrations_core_cards_111:
-  version: '20190306172890'
+  version: '20190306172622'
 schema_migrations_core_cards_112:
-  version: '20190320091257'
+  version: '20190306172623'
 schema_migrations_core_cards_113:
-  version: '20190321085735'
+  version: '20190306172890'
 schema_migrations_core_cards_114:
-  version: '20190322095534'
+  version: '20190320091257'
 schema_migrations_core_cards_115:
-  version: '20190417142612'
+  version: '20190321085735'
 schema_migrations_core_cards_116:
-  version: '20190424100531'
+  version: '20190322095534'
 schema_migrations_core_cards_117:
-  version: '20190424101004'
+  version: '20190417142612'
 schema_migrations_core_cards_118:
-  version: '20190502130024'
+  version: '20190424100531'
 schema_migrations_core_cards_119:
-  version: '201905021300268'
+  version: '20190424101004'
 schema_migrations_core_cards_120:
-  version: '20190502130029'
+  version: '20190502130024'
 schema_migrations_core_cards_121:
-  version: '20190503122738'
+  version: '201905021300268'
 schema_migrations_core_cards_122:
-  version: '20190503122739'
+  version: '20190502130029'
 schema_migrations_core_cards_123:
-  version: '20190528131330'
+  version: '20190503122738'
 schema_migrations_core_cards_124:
-  version: '20190528141530'
+  version: '20190503122739'
 schema_migrations_core_cards_125:
-  version: '20190605133556'
+  version: '20190528131330'
 schema_migrations_core_cards_126:
-  version: '20190618110446'
+  version: '20190528141530'
 schema_migrations_core_cards_127:
-  version: '20190621143156'
+  version: '20190605133556'
 schema_migrations_core_cards_128:
-  version: '20190625153614'
+  version: '20190618110446'
 schema_migrations_core_cards_129:
-  version: '20190625153615'
+  version: '20190621143156'
 schema_migrations_core_cards_130:
-  version: '20190625153616'
+  version: '20190625153614'
 schema_migrations_core_cards_131:
-  version: '20190710090205'
+  version: '20190625153615'
 schema_migrations_core_cards_132:
-  version: '20190710090207'
+  version: '20190625153616'
 schema_migrations_core_cards_133:
-  version: '20190718140125'
+  version: '20190710090205'
 schema_migrations_core_cards_134:
+  version: '20190710090207'
+schema_migrations_core_cards_135:
+  version: '20190710090208'
+schema_migrations_core_cards_136:
+  version: '20190710090209'
+schema_migrations_core_cards_137:
+  version: '20190718140125'
+schema_migrations_core_cards_138:
   version: '20190718140126'
+schema_migrations_core_cards_139:
+  version: '20190820155833'
+schema_migrations_core_cards_140:
+  version: '20190822093633'
+schema_migrations_core_cards_141:
+  version: '20190823220017'
+schema_migrations_core_cards_142:
+  version: '20190823220018'
+schema_migrations_core_cards_143:
+  version: '20190826132738'
+schema_migrations_core_cards_144:
+  version: '20190829093961'
+schema_migrations_core_cards_145:
+  version: '20190829151731'
+schema_migrations_core_cards_146:
+  version: '20190829205148'
+schema_migrations_core_cards_147:
+  version: '20190830131820'
+schema_migrations_core_cards_148:
+  version: '20190902161223'
+schema_migrations_core_cards_149:
+  version: '20190902193208'
+schema_migrations_core_cards_150:
+  version: '20190904174403'
+schema_migrations_core_cards_151:
+  version: '20190909104250'
+schema_migrations_core_cards_152:
+  version: '20190918200115'
+schema_migrations_core_cards_153:
+  version: '20190927112151'

data/db/{seed/test/seed.rb → test_seed.rb}

@@ -4,11 +4,11 @@ require "timecop"
 
 # noinspection RubyResolve
 class SharedData
-  require_relative "../../../lib/card/model/save_helper"
+  require_relative "../lib/card/model/save_helper"
   extend Card::Model::SaveHelper
 
   USERS = [
-    "Joe User", "Joe Admin", "Joe Camel", "Sample User", "No count",
+    "Joe Admin", "Joe User", "Joe Camel", "Sample User", "No count",
     "u1", "u2", "u3",
     "Big Brother", "Optic fan", "Sunglasses fan", "Narcissist"
   ].freeze
@@ -19,7 +19,12 @@ class SharedData
 
     def create_user name, args
       args[:subcards] = account_args args if args[:email]
-      super name, args
+
+      if name == "Joe Admin"
+        super name, args
+      else
+        Card::Auth.with("joe_admin") { super name, args }
+      end
     end
 
     def account_args hash
@@ -40,9 +45,6 @@ class SharedData
 
       create "signup alert email+*to", "signups@wagn.org"
       # CREATE A CARD OF EACH TYPE
-      create_signup "Sample Signup" # , email: "invitation@request.com"
-      # above still necessary?  try commenting out above and 'Sign up' below
-      Card::Auth.current_id = Card::WagnBotID # need to reset after creating sign up, which changes current_id for extend phase
 
       no_samples = %w[user sign_up set number mirror_list mirrored_list file image
                       customized_bootswatch_skin]
@@ -62,11 +64,11 @@ class SharedData
       create_pointer "vertical"
 
       create_pointer "friends+*right+*default"
-      create_search_type "friends+*right+*options", '{"type":"User"}'
+      create_search_type "friends+*right+*content options", '{"type":"User"}'
 
       create_pointer "joes"
-      create "joes+*self+*input", "filtered list"
-      create "joes+*self+*options", ["Joe Admin", "Joe User", "Joe Camel"]
+      create "joes+*self+*input type", "filtered list"
+      create "joes+*self+*content options", ["Joe Admin", "Joe User", "Joe Camel"]
 
       # cards for rename_test
       # FIXME: could probably refactor these..
@@ -157,8 +159,8 @@ class SharedData
 
     def user_and_role_cards
       Card::Auth.instant_account_activation do
-        create_user "Joe User", content: "I'm number two", email: "joe@user.com"
         create_user "Joe Admin", content: "I'm number one", email: "joe@admin.com"
+        create_user "Joe User", content: "I'm number two", email: "joe@user.com"
         create_user "Joe Camel", content: "Mr. Buttz", email: "joe@camel.com"
 
         # data for testing users and account requests
@@ -251,7 +253,7 @@ class SharedData
 
         Card::Auth.current_id = Card::WagnBotID
         create "Google glass+*self+*follow_fields", ""
-        create "Sunglasses+*self+*follow_fields", "[[#{Card[:includes].name}]]\n[[_self+price]]\n[[_self+producer]]"
+        create "Sunglasses+*self+*follow_fields", "[[#{Card[:nests].name}]]\n[[_self+price]]\n[[_self+producer]]"
         create "Sunglasses+tint"
         create "Sunglasses+price"
 

data/lib/card/auth.rb

@@ -3,6 +3,7 @@
 require_dependency "card/auth/permissions"
 require_dependency "card/auth/proxy"
 require_dependency "card/auth/setup"
+require_dependency "card/auth/token"
 
 class Card
   # Singleton methods for account authentication and contextualization.

data/lib/card/auth/current.rb

@@ -103,16 +103,32 @@ class Card
       end
 
       # set current from token or session
-      def set_current token, current
-        if token
-          unless set_current_from_token(token, current)
-            raise Card::Error::PermissionDenied, "token authentication failed"
-          end
+      def set_current opts={}
+        if opts[:token]
+          set_current_from_token opts[:token]
+        elsif opts[:api_key]
+          set_current_from_api_key opts[:api_key]
         else
           set_current_from_session
         end
       end
 
+      # set the current user based on token
+      def set_current_from_token token
+        payload = Token.validate! token
+        self.current_id = payload[:anonymous] ? Card::AnonymousID : payload[:user_id]
+      end
+
+      # set the current user based on api_key
+      def set_current_from_api_key api_key
+        account = find_account_by_api_key api_key
+        unless account&.validate_api_key! api_key
+          raise Card::Error::PermissionDenied, "API key authentication failed"
+        end
+
+        self.current = account.left_id
+      end
+
       # get :user id from session and set Auth.current_id
       def set_current_from_session
         self.current_id =
@@ -123,29 +139,11 @@ class Card
           end
       end
 
-      # set the current user based on token
-      def set_current_from_token token, current=nil
-        account = find_account_by_token token
-        if account&.validate_token!(token)
-          unless current && always_ok_usr_id?(account.left_id)
-            # can override current only if admin
-            current = account.left_id
-          end
-          self.current = current
-        elsif Env.params[:live_token]
-          true
-          # Used for activations and resets.
-          # Continue as anonymous and address problem later
-        else
-          false
-        end
-      end
-
-      # find +\*account card by +\*token card
+      # find +\*account card by +\*api card
       # @param token [String]
       # @return [+*account card, nil]
-      def find_account_by_token token
-        find_account_by "token", Card::TokenID, token.strip
+      def find_account_by_api_key api_key
+        find_account_by "api_key", Card::ApiKeyID, api_key.strip
       end
 
       # find +\*account card by +\*email card
@@ -165,7 +163,7 @@ class Card
           Card.search({ right_id: Card::AccountID,
                         right_plus: [{ id: field_id },
                                      { content: value }] },
-                      "find +*account for #{fieldname} (#{value})").first
+                      "find +:account for #{fieldname} (#{value})").first
         end
       end
 

data/lib/card/auth/setup.rb

@@ -8,9 +8,10 @@ class Card
       # app is not totally set up yet
       # @return [true/false]
       def needs_setup?
+        # FIXME: - should not require a cache lookup with every request!!
         @simulating_setup_need || (
           !Card.cache.read(SETUP_COMPLETED_KEY) &&
-          !Card.cache.write(SETUP_COMPLETED_KEY, account_count > 2)
+          !Card.cache.write(SETUP_COMPLETED_KEY, user_account_count.positive?)
         )
         # every deck starts with two accounts: WagnBot and Anonymous
       end
@@ -24,15 +25,7 @@ class Card
       # for testing setup
       def hide_accounts! mode=true
         Card.cache.delete(SETUP_COMPLETED_KEY) if mode
-        @hidden_accounts = mode && (account_ids - [WagnBotID, AnonymousID])
-      end
-
-      def account_ids
-        as_bot do
-          Card.search right_id: AccountID,
-                      not: { left_id: ["in", WagnBotID, AnonymousID] },
-                      return: :id
-        end
+        @hidden_accounts = mode && user_account_ids
       end
 
       def instant_account_activation
@@ -44,8 +37,16 @@ class Card
 
       private
 
-      def account_count
-        wql = { right_id: AccountID }
+      def user_account_ids
+        as_bot { Card.search user_account_wql.merge(return: :id) }
+      end
+
+      def user_account_wql
+        { right_id: AccountID, creator_id: ["ne", WagnBotID] }
+      end
+
+      def user_account_count
+        wql = user_account_wql
         wql[:not] = { id: ["in"].concat(@hidden_accounts) } if @hidden_accounts
         as_bot { Card.count_by_wql wql }
       end

data/lib/card/auth/token.rb

@@ -0,0 +1,38 @@
+require "jwt"
+
+class Card
+  module Auth
+    # methods for setting current account
+    module Token
+      SECRET_KEY = Rails.application.secrets.secret_key_base.to_s
+
+      class << self
+        def encode user_id, extra_payload={}
+          payload = { user_id: user_id, exp: expiration }.merge(extra_payload)
+
+          JWT.encode payload, SECRET_KEY
+        end
+
+        # returns Hash if valid, String error message if not
+
+        def validate! token
+          payload = decode token
+          raise Card::Error::PermissionDenied, payload if payload.is_a? String
+
+          payload
+        end
+
+        def decode token
+          decoded = JWT.decode(token, SECRET_KEY)[0]
+          HashWithIndifferentAccess.new decoded
+        rescue JWT::DecodeError => error
+          error.message
+        end
+
+        def expiration
+          Card.config.token_expiry.from_now.to_i
+        end
+      end
+    end
+  end
+end

data/lib/card/content.rb

@@ -45,6 +45,10 @@ class Card
       each_chunk.select { |chunk| chunk.is_a?(chunk_type) }
     end
 
+    def has_chunk? chunk_type
+      each_chunk.any { |chunk| chunk.is_a?(chunk_type)}
+    end
+
     # sends &block to #process_chunk on each Chunk object
     def process_chunks &block
       return custom_process_chunks(&block) if block_given?
@@ -98,20 +102,43 @@ class Card
     end
 
     def without_nests
-      nests = []
-      find_chunks(Card::Content::Chunk::Nest).each_with_index do |chunk, i|
-        nests << chunk.text
-        chunk.burn_after_reading "{{#{i}}}"
+      without_chunks Card::Content::Chunk::Nest do |content|
+        yield content
       end
+    end
 
-      result = yield to_s
-      Chunk::Nest.gsub result do |nest_content|
-        nests[nest_content.to_i]
+    def without_references
+      without_chunks Card::Content::Chunk::Nest, Card::Content::Chunk::Link do |content|
+        yield content
       end
     end
 
+    def without_chunks *chunk_classes
+      chunk_classes = ::Set.new Array.wrap(chunk_classes)
+      stash = stash_chunks chunk_classes
+      processed = yield to_s
+      unstash_chunks processed, stash
+    end
+
     private
 
+    def stash_chunks chunk_classes
+      chunks = []
+      each_chunk do |chunk|
+        next unless chunk_classes.include? chunk.class
+
+        chunk.burn_after_reading "{{#{chunks.size}}}"
+        chunks << chunk.text
+      end
+      chunks
+    end
+
+    def unstash_chunks content, stashed_chunks
+      Chunk::Nest.gsub content do |nest_content|
+        stashed_chunks[nest_content.to_i]
+      end
+    end
+
     def resolve_format format_or_card
       if format_or_card.is_a?(Card)
         Format.new format_or_card, format: nil