door_check 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 8dc6f095ae6f16376021826916b13efa16fabacd433c929e760a93a7ee425324
+  data.tar.gz: 861f4c4ad212731e360b197ca1d32176849e8558d6eeb1a372de1907d8e9a853
+SHA512:
+  metadata.gz: 6ed367d8701e8078d3117552336273b883d06cde8e6dfb1a409482cf509e95b1ab436ddfb75eb6143e469a62cc96e6fbff01ecf027d7e11f91b069134d40e4fb
+  data.tar.gz: 4d3e64f5f006a9faa8c3001209859c67606fb3ab979ca7a091674b30434e75666a1e41d05667249ebf50981e0d11d93e4af276046c17a13c8fc97fc359083560

data/MIT-LICENSE

@@ -0,0 +1,20 @@
+Copyright TODO: Write your name
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,2 @@
+# door_check
+Sign-in methods and second steps an app offers, each account narrows, and each person chooses from

data/Rakefile

@@ -0,0 +1,6 @@
+require "bundler/setup"
+
+APP_RAKEFILE = File.expand_path("test/dummy/Rakefile", __dir__)
+load "rails/tasks/engine.rake"
+
+require "bundler/gem_tasks"

data/app/assets/stylesheets/door_check/application.css

@@ -0,0 +1,15 @@
+/*
+ * This is a manifest file that'll be compiled into application.css, which will include all the files
+ * listed below.
+ *
+ * Any CSS and SCSS file within this directory, lib/assets/stylesheets, vendor/assets/stylesheets,
+ * or any plugin's vendor/assets/stylesheets directory can be referenced here using a relative path.
+ *
+ * You're free to add application-wide styles to this file and they'll appear at the bottom of the
+ * compiled file so the styles you add here take precedence over styles defined in any other CSS/SCSS
+ * files in this directory. Styles in this file should be added after the last require_* statement.
+ * It is generally better to create a new file per style scope.
+ *
+ *= require_tree .
+ *= require_self
+ */

data/app/controllers/concerns/door_check/entry_check.rb

@@ -0,0 +1,13 @@
+module DoorCheck
+  module EntryCheck
+    RETURN_KEY = :door_check_return_to
+
+    def door_check_check_entry
+      account = door_check_account
+      return if account.nil? || AccountRule.for(account).met_by?(door_check_proved_by.map(&:first))
+
+      session[RETURN_KEY] = request.fullpath
+      redirect_to door_check.new_second_step_path
+    end
+  end
+end

data/app/controllers/concerns/door_check/tracking.rb

@@ -0,0 +1,31 @@
+module DoorCheck
+  module Tracking
+    SESSION_KEY = :door_check_session_id
+
+    def door_check_signed_in(person, method_name:)
+      signed_in_session = SignedInSession.create!(person: person)
+      signed_in_session.prove!(method_name)
+      session[SESSION_KEY] = signed_in_session.id
+    end
+
+    def door_check_proved_by
+      door_check_session&.proved_by || []
+    end
+
+    def door_check_account
+      account_method = DoorCheck.configuration.account_method
+      send(account_method) if account_method
+    end
+
+    private
+
+    def door_check_session
+      person = door_check_person
+      SignedInSession.find_by(id: session[SESSION_KEY], person: person) if person
+    end
+
+    def door_check_person
+      send(DoorCheck.configuration.person_method)
+    end
+  end
+end

data/app/controllers/door_check/application_controller.rb

@@ -0,0 +1,7 @@
+module DoorCheck
+  class ApplicationController < DoorCheck.configuration.parent_controller.constantize
+    helper KeystoneUiHelper
+
+    skip_before_action :door_check_check_entry, raise: false
+  end
+end

data/app/controllers/door_check/second_steps_controller.rb

@@ -0,0 +1,28 @@
+module DoorCheck
+  class SecondStepsController < ApplicationController
+    before_action :find_authenticator
+
+    def new
+    end
+
+    def create
+      method_name = @authenticator.verify(@person, params[:code].to_s.strip)
+      return refuse_code unless method_name
+
+      door_check_session.prove!(method_name)
+      redirect_to session.delete(EntryCheck::RETURN_KEY) || "/"
+    end
+
+    private
+
+    def find_authenticator
+      @person = door_check_person
+      @authenticator = DoorCheck.configuration.authenticator
+    end
+
+    def refuse_code
+      @error = "That code is not right. Check your authenticator app and try again."
+      render :new, status: :unprocessable_content
+    end
+  end
+end

data/app/helpers/door_check/application_helper.rb

@@ -0,0 +1,4 @@
+module DoorCheck
+  module ApplicationHelper
+  end
+end

data/app/jobs/door_check/application_job.rb

@@ -0,0 +1,4 @@
+module DoorCheck
+  class ApplicationJob < ActiveJob::Base
+  end
+end

data/app/mailers/door_check/application_mailer.rb

@@ -0,0 +1,6 @@
+module DoorCheck
+  class ApplicationMailer < ActionMailer::Base
+    default from: "from@example.com"
+    layout "mailer"
+  end
+end

data/app/models/door_check/account_rule.rb

@@ -0,0 +1,13 @@
+module DoorCheck
+  class AccountRule < ApplicationRecord
+    belongs_to :account, polymorphic: true
+
+    def self.for(account)
+      find_or_initialize_by(account: account)
+    end
+
+    def met_by?(method_names)
+      !second_step_required || method_names.any? { |name| Methods.roles(name).include?(:second_step) }
+    end
+  end
+end

data/app/models/door_check/application_record.rb

@@ -0,0 +1,5 @@
+module DoorCheck
+  class ApplicationRecord < ActiveRecord::Base
+    self.abstract_class = true
+  end
+end

data/app/models/door_check/proof.rb

@@ -0,0 +1,5 @@
+module DoorCheck
+  class Proof < ApplicationRecord
+    belongs_to :signed_in_session
+  end
+end

data/app/models/door_check/require_second_step.rb

@@ -0,0 +1,14 @@
+module DoorCheck
+  class RequireSecondStep
+    def initialize(person:, account:, values:)
+      @person = person
+      @account = account
+      @values = values
+    end
+
+    def call
+      AccountRule.for(@account).update!(second_step_required: @values[:second_step_required] == "1")
+      Result.new(ok: true)
+    end
+  end
+end

data/app/models/door_check/result.rb

@@ -0,0 +1,12 @@
+module DoorCheck
+  class Result
+    attr_reader :message
+
+    def initialize(ok:, message: nil)
+      @ok = ok
+      @message = message
+    end
+
+    def ok? = @ok
+  end
+end

data/app/models/door_check/signed_in_session.rb

@@ -0,0 +1,14 @@
+module DoorCheck
+  class SignedInSession < ApplicationRecord
+    belongs_to :person, polymorphic: true
+    has_many :proofs, dependent: :delete_all
+
+    def prove!(method_name)
+      proofs.create!(method_name: method_name, proved_at: Time.current)
+    end
+
+    def proved_by
+      proofs.order(:proved_at).map { |proof| [ proof.method_name.to_sym, proof.proved_at ] }
+    end
+  end
+end

data/app/views/door_check/second_steps/new.html.erb

@@ -0,0 +1,15 @@
+<%= ui_page(max_width: :md) do %>
+  <% if @authenticator.set_up?(@person) %>
+    <%= ui_page_header(title: "Confirm it's you", subtitle: "Enter the code from your authenticator app or one of your backup codes.") %>
+    <%= ui_alert(message: @error, type: :error) if @error %>
+    <%= ui_form(action: door_check.second_step_path) do %>
+      <%= ui_form_field(attribute: "code", label: "Code", required: true, autofocus: true,
+                        autocomplete: "one-time-code", inputmode: "numeric", autocapitalize: "none") %>
+      <%= ui_button(label: "Verify") %>
+    <% end %>
+  <% else %>
+    <%= ui_page_header(title: "Set up a second step", subtitle: "This account requires a second step after your password.") %>
+    <%= ui_empty_state(title: "No authenticator app yet", message: "Set up an authenticator app, then come back to this account.",
+                       action: { label: "Set up", href: @authenticator.setup_path }) %>
+  <% end %>
+<% end %>

data/app/views/door_check/settings/_sign_in_rules.html.erb

@@ -0,0 +1,7 @@
+<% rule = DoorCheck::AccountRule.for(account) %>
+<%= ui_form(action: submit_url, method: :patch) do %>
+  <%= ui_form_field(attribute: "second_step_required", label: "Require a second step to enter this account",
+                    type: :checkbox, value: (rule.second_step_required ? "1" : "0"),
+                    hint: "Members who signed in with only a password are asked for their authenticator code when they enter.") %>
+  <%= ui_button(label: "Save") %>
+<% end %>

data/app/views/layouts/door_check/application.html.erb

@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Door check</title>
+  <%= csrf_meta_tags %>
+  <%= csp_meta_tag %>
+
+  <%= yield :head %>
+
+  <%= stylesheet_link_tag    "door_check/application", media: "all" %>
+</head>
+<body>
+
+<%= yield %>
+
+</body>
+</html>

data/config/routes.rb

@@ -0,0 +1,3 @@
+DoorCheck::Engine.routes.draw do
+  resource :second_step, only: %i[new create]
+end

data/db/migrate/20261111005356_create_door_check_signed_in_sessions.rb

@@ -0,0 +1,10 @@
+class CreateDoorCheckSignedInSessions < ActiveRecord::Migration[8.1]
+  def change
+    create_table :door_check_signed_in_sessions do |t|
+      t.references :person, polymorphic: true, null: false
+      t.datetime :signed_out_at
+
+      t.timestamps
+    end
+  end
+end

data/db/migrate/20261111005407_create_door_check_proofs.rb

@@ -0,0 +1,11 @@
+class CreateDoorCheckProofs < ActiveRecord::Migration[8.1]
+  def change
+    create_table :door_check_proofs do |t|
+      t.references :signed_in_session, null: false, foreign_key: { to_table: :door_check_signed_in_sessions }
+      t.string :method_name, null: false
+      t.datetime :proved_at, null: false
+
+      t.timestamps
+    end
+  end
+end

data/db/migrate/20261111010724_create_door_check_account_rules.rb

@@ -0,0 +1,10 @@
+class CreateDoorCheckAccountRules < ActiveRecord::Migration[8.1]
+  def change
+    create_table :door_check_account_rules do |t|
+      t.references :account, polymorphic: true, null: false, index: { unique: true }
+      t.boolean :second_step_required, null: false, default: false
+
+      t.timestamps
+    end
+  end
+end

data/lib/door_check/configuration.rb

@@ -0,0 +1,25 @@
+require "door_check/methods"
+
+module DoorCheck
+  class UnknownMethod < StandardError; end
+
+  class Configuration
+    attr_reader :offered_methods
+    attr_accessor :person_method, :account_method, :parent_controller, :existing_authenticator
+
+    def initialize
+      @parent_controller = "::ApplicationController"
+    end
+
+    def offered_methods=(names)
+      unknown = names - Methods.names
+      raise UnknownMethod, "door_check does not know the sign-in method #{unknown.join(', ')}" if unknown.any?
+
+      @offered_methods = names
+    end
+
+    def authenticator
+      existing_authenticator&.constantize&.new
+    end
+  end
+end

data/lib/door_check/engine.rb

@@ -0,0 +1,5 @@
+module DoorCheck
+  class Engine < ::Rails::Engine
+    isolate_namespace DoorCheck
+  end
+end

data/lib/door_check/methods.rb

@@ -0,0 +1,22 @@
+module DoorCheck
+  module Methods
+    ROLES = {
+      password: %i[sign_in],
+      email_code: %i[sign_in],
+      email_link: %i[sign_in],
+      device_approval: %i[sign_in],
+      authenticator_app: %i[second_step],
+      sms_code: %i[second_step],
+      passkey: %i[sign_in second_step],
+      backup_codes: %i[second_step],
+      trusted_device: %i[second_step],
+      google: %i[sign_in],
+      apple: %i[sign_in],
+      sso: %i[sign_in]
+    }.freeze
+
+    def self.names = ROLES.keys
+
+    def self.roles(name) = ROLES.fetch(name)
+  end
+end

data/lib/door_check/version.rb

@@ -0,0 +1,3 @@
+module DoorCheck
+  VERSION = "0.1.0"
+end

data/lib/door_check.rb

@@ -0,0 +1,14 @@
+require "keystone_ui"
+require "door_check/version"
+require "door_check/configuration"
+require "door_check/engine"
+
+module DoorCheck
+  class << self
+    attr_writer :configuration
+
+    def configuration = @configuration ||= Configuration.new
+
+    def configure = yield(configuration)
+  end
+end

data/lib/tasks/door_check_tasks.rake

@@ -0,0 +1,4 @@
+# desc "Explaining what the task does"
+# task :door_check do
+#   # Task goes here
+# end

metadata

@@ -0,0 +1,107 @@
+--- !ruby/object:Gem::Specification
+name: door_check
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Tyler Schneider
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2026-11-11 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+- !ruby/object:Gem::Dependency
+  name: keystone_ui
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.50'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.50'
+description: Records which methods proved a person in each sign-in, and checks that
+  record against the rule of each account the person enters.
+email:
+- tylercschneider@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- MIT-LICENSE
+- README.md
+- Rakefile
+- app/assets/stylesheets/door_check/application.css
+- app/controllers/concerns/door_check/entry_check.rb
+- app/controllers/concerns/door_check/tracking.rb
+- app/controllers/door_check/application_controller.rb
+- app/controllers/door_check/second_steps_controller.rb
+- app/helpers/door_check/application_helper.rb
+- app/jobs/door_check/application_job.rb
+- app/mailers/door_check/application_mailer.rb
+- app/models/door_check/account_rule.rb
+- app/models/door_check/application_record.rb
+- app/models/door_check/proof.rb
+- app/models/door_check/require_second_step.rb
+- app/models/door_check/result.rb
+- app/models/door_check/signed_in_session.rb
+- app/views/door_check/second_steps/new.html.erb
+- app/views/door_check/settings/_sign_in_rules.html.erb
+- app/views/layouts/door_check/application.html.erb
+- config/routes.rb
+- db/migrate/20261111005356_create_door_check_signed_in_sessions.rb
+- db/migrate/20261111005407_create_door_check_proofs.rb
+- db/migrate/20261111010724_create_door_check_account_rules.rb
+- lib/door_check.rb
+- lib/door_check/configuration.rb
+- lib/door_check/engine.rb
+- lib/door_check/methods.rb
+- lib/door_check/version.rb
+- lib/tasks/door_check_tasks.rake
+homepage: https://github.com/DYB-Development/door_check
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/DYB-Development/door_check
+  source_code_uri: https://github.com/DYB-Development/door_check
+  bug_tracker_uri: https://github.com/DYB-Development/door_check/issues
+  rubygems_mfa_required: 'true'
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.2.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.5.16
+signing_key:
+specification_version: 4
+summary: Sign-in methods and second steps an app offers, each account narrows, and
+  each person chooses from.
+test_files: []