plutonium 0.5.0

data/lib/generators/pu/rodauth/account_generator.rb

@@ -0,0 +1,120 @@
+return unless defined?(Rodauth::Rails)
+
+require "rails/generators/base"
+require "securerandom"
+
+require "#{__dir__}/concerns/configuration"
+require "#{__dir__}/concerns/account_selector"
+require "#{__dir__}/concerns/feature_selector"
+
+module Pu
+  module Rodauth
+    class AccountGenerator < ::Rails::Generators::Base
+      include Concerns::AccountSelector
+      include Concerns::FeatureSelector
+
+      source_root "#{__dir__}/templates"
+
+      desc "Generate a rodauth-rails account.\n\n" \
+           "Configures a basic set of features as well as migrations, a model, mailer and views."
+
+      def install_dependencies
+        Bundler.with_unbundled_env do
+          run "bundle add jwt" if jwt? || jwt_refresh?
+          run "bundle add rotp" if otp?
+          run "bundle add rqrcode" if otp?
+          run "bundle add webauthn" if webauthn? || webauthn_autofill?
+        end
+      end
+
+      def create_rodauth_app
+        template "app/misc/account_rodauth_plugin.rb", "app/misc/#{table_prefix}_rodauth_plugin.rb"
+      end
+
+      def configure_rodauth_plugin
+        in_root do
+          plugin_name = indent(
+            "configure ::#{table_prefix.classify}RodauthPlugin#{", :#{table_prefix}" unless primary?}\n", 2
+          )
+          gsub_file "app/misc/rodauth_app.rb", /.*# configure RodauthMain\n/, ""
+          insert_into_file "app/misc/rodauth_app.rb", plugin_name, after: "# auth configuration\n"
+        end
+      end
+
+      def configure_rodauth_plugin_load_route
+        in_root do
+          route_config = indent("r.rodauth#{"(:#{table_prefix})" unless primary?}\n", 4)
+          gsub_file "app/misc/rodauth_app.rb", /.*# r\.rodauth\n/, ""
+          insert_into_file "app/misc/rodauth_app.rb", route_config, after: "# auth route configuration\n"
+        end
+      end
+
+      def configure_rodauth_plugin_load_memory
+        in_root do
+          plugin_config = indent(
+            "rodauth#{"(:#{table_prefix})" unless primary?}.load_memory # autologin remembered #{table}\n", 4
+          )
+          gsub_file "app/misc/rodauth_app.rb", /.*# rodauth\.load_memory.*\n/, ""
+
+          if remember?
+            insert_into_file "app/misc/rodauth_app.rb", plugin_config, after: "# plugin route configuration\n"
+          else
+            gsub_file "app/misc/rodauth_app.rb", plugin_config, ""
+            in_root do
+              unless File.read("app/misc/rodauth_app.rb").match?(/.*\.load_memory # autologin/)
+                insert_into_file "app/misc/rodauth_app.rb", indent("# rodauth.load_memory # autologin remembered users\n", 4),
+                  after: "# plugin route configuration\n"
+              end
+            end
+          end
+        end
+      end
+
+      def create_rodauth_controller
+        dest = "app/controllers/rodauth/#{table_prefix}_controller.rb"
+        template "app/controllers/plugin_controller.rb", dest
+      end
+
+      def generate_rodauth_migration
+        return if selected_migration_features.empty?
+
+        invoke "pu:rodauth:migration", [table], features: selected_migration_features,
+          name: kitchen_sink? ? "rodauth_kitchen_sink" : nil,
+          migration_name: options[:migration_name],
+          force: options[:force],
+          skip: options[:skip]
+      end
+
+      def create_account_model
+        return unless base?
+
+        template "app/models/account.rb", "app/models/#{table_prefix}.rb"
+      end
+
+      def create_mailer
+        return unless mails?
+
+        template "app/mailers/rodauth_mailer.rb", "app/mailers/rodauth_mailer.rb"
+        template "app/mailers/account_mailer.rb", "app/mailers/rodauth/#{table_prefix}_mailer.rb"
+        directory "app/views/rodauth_mailer", "app/views/rodauth/#{table_prefix}_mailer"
+      end
+
+      def create_views
+        return if only_json? || selected_view_features.empty?
+
+        account_name = primary? ? nil : table_prefix
+        # Use generate here because invoke spawns in the same process
+        # Unfortunately, during the generation process, some new files are created which are not currently loaded,
+        #   causing an error when it attempts to load the rodauth config.
+        # Generate spawns a separate process which loads the new files and ensures it works correctly
+        generate "pu:rodauth:views", account_name, "--features", *selected_view_features
+      end
+
+      private
+
+      def only_json?
+        ::Rails.application.config.api_only || !::Rails.application.config.session_store || options[:api_only]
+      end
+    end
+  end
+end

data/lib/generators/pu/rodauth/concerns/account_selector.rb

@@ -0,0 +1,22 @@
+module Pu
+  module Rodauth
+    module Concerns
+      module AccountSelector
+        def self.included(base)
+          base.send :argument, :account_name, type: :string, desc: "name of the account model. "
+          base.send :class_option, :migration_name, type: :string, desc: "[CONFIG] name of the generated migration file"
+        end
+
+        private
+
+        def table
+          @table ||= account_name.underscore.pluralize
+        end
+
+        def table_prefix
+          @table_prefix ||= account_name.underscore.singularize
+        end
+      end
+    end
+  end
+end

data/lib/generators/pu/rodauth/concerns/configuration.rb

@@ -0,0 +1,211 @@
+module Pu
+  module Rodauth
+    module Concerns
+      module Configuration
+        # Configuration map for the supported plugins
+        # key: plugin name
+        # value: hash that can contain the following keys
+        #           feature(bool) => enabled in the account plugin when selected. default: true.
+        #           default(bool) => enable this plugin by default
+        #            desc(string) => description for this plugin to be displayed in the cli help notes
+        #        migrations(Hash) => map of table override setter to table name.
+        #                            table name can contain the format strings: %{plural} and %{singluar}
+        #            views(array) => a list of views to generate
+        CONFIGURATION = {
+          base: {
+            default: true,
+            feature: false,
+            desc: "[CONFIG] create account table and model",
+            migrations: {
+              accounts_table: "%<plural>s"
+            }
+          },
+          two_factor_base: {
+            default: true,
+            feature: false,
+            desc: "[CONFIG] setup dependencies for 2fa",
+            views: %w[two_factor_manage two_factor_auth two_factor_disable]
+          },
+          separate_passwords: {
+            feature: false,
+            desc: "[CONFIG] use a separate table for password hashes",
+            migrations: {
+              password_hash_table: "%<singular>s_password_hashes"
+            }
+          },
+          login: {
+            default: true,
+            views: %w[_login_form _login_form_footer login multi_phase_login]
+          },
+          remember: {
+            default: true,
+            views: %w[remember],
+            migrations: {
+              remember_table: "%<singular>s_remember_keys"
+            }
+          },
+          logout: {
+            default: true,
+            views: %w[logout]
+          },
+          create_account: {
+            default: true,
+            views: %w[create_account]
+          },
+          verify_account: {
+            default: true,
+            views: %w[verify_account_resend verify_account],
+            migrations: {
+              verify_account_table: "%<singular>s_verification_keys"
+            }
+          },
+          verify_account_grace_period: {default: true},
+          close_account: {
+            views: %w[close_account]
+          },
+          reset_password: {
+            default: true,
+            views: %w[reset_password_request reset_password],
+            migrations: {
+              reset_password_table: "%<singular>s_password_reset_keys"
+            }
+          },
+          reset_password_notify: {default: true},
+          change_login: {
+            default: true,
+            views: %w[change_login]
+          },
+          verify_login_change: {
+            default: true,
+            views: %w[verify_login_change],
+            migrations: {
+              verify_login_change_table: "%<singular>s_login_change_keys"
+            }
+          },
+          change_password: {
+            default: true,
+            views: %w[change_password]
+          },
+          change_password_notify: {
+            default: true
+          },
+          email_auth: {
+            views: %w[_email_auth_request_form email_auth],
+            migrations: {
+              email_auth_table: "%<singular>s_email_auth_keys"
+            }
+          },
+          otp: {
+            views: %w[otp_setup otp_auth otp_disable],
+            migrations: {
+              otp_keys_table: "%<singular>s_otp_keys"
+            }
+          },
+          sms_codes: {
+            views: %w[sms_setup sms_confirm sms_auth sms_request sms_disable],
+            migrations: {
+              sms_codes_table: "%<singular>s_sms_codes"
+            }
+          },
+          recovery_codes: {
+            views: %w[recovery_codes add_recovery_codes recovery_auth],
+            migrations: {
+              recovery_codes_table: "%<singular>s_recovery_codes"
+            }
+          },
+          webauthn: {
+            views: %w[webauthn_setup webauthn_auth webauthn_remove],
+            migrations: {
+              webauthn_keys_table: "%<singular>s_webauthn_keys",
+              webauthn_user_ids_table: "%<singular>s_webauthn_user_ids",
+              webauthn_keys_account_id_column: "%<singular>s_id"
+            }
+          },
+          webauthn_autofill: {
+            views: %w[webauthn_autofill]
+          },
+          lockout: {
+            views: %w[unlock_account_request unlock_account],
+            migrations: {
+              account_login_failures_table: "%<singular>s_login_failures",
+              account_lockouts_table: "%<singular>s_lockouts"
+            }
+          },
+          active_sessions: {
+            migrations: {
+              active_sessions_table: "%<singular>s_active_session_keys",
+              active_sessions_account_id_column: "%<singular>s_id"
+            }
+          },
+          account_expiration: {
+            migrations: {
+              account_activity_table: "%<singular>s_activity_times"
+            }
+          },
+          password_expiration: {
+            migrations: {
+              password_expiration_table: "%<singular>s_password_change_times"
+            }
+          },
+          single_session: {
+            migrations: {
+              single_session_table: "%<singular>s_session_keys"
+            }
+          },
+          audit_logging: {
+            migrations: {
+              audit_logging_table: "%<singular>s_authentication_audit_logs",
+              audit_logging_account_id_column: "%<singular>s_id"
+            }
+          },
+          disallow_password_reuse: {
+            migrations: {
+              previous_password_hash_table: "%<singular>s_previous_password_hashes",
+              previous_password_account_id_column: "%<singular>s_id"
+            }
+          },
+          jwt_refresh: {
+            migrations: {
+              jwt_refresh_token_table: "%<singular>s_jwt_refresh_keys",
+              jwt_refresh_token_account_id_column: "%<singular>s_id"
+            }
+          },
+          jwt: {},
+          json: {},
+          internal_request: {default: true}
+        }.freeze
+
+        FEATURE_CONFIG = CONFIGURATION.select { |_k, v| v[:feature] != false }
+          .freeze
+
+        MIGRATION_CONFIG = CONFIGURATION.select { |_k, v| v[:migrations] }
+          .map { |k, v| [k, v[:migrations]] }
+          .to_h
+          .freeze
+
+        VIEW_CONFIG = CONFIGURATION.select { |_k, v| v[:views] }
+          .map { |k, v| [k, v[:views]] }
+          .to_h
+          .freeze
+
+        private
+
+        def configuration
+          CONFIGURATION
+        end
+
+        def feature_config
+          FEATURE_CONFIG
+        end
+
+        def migration_config
+          MIGRATION_CONFIG
+        end
+
+        def view_config
+          VIEW_CONFIG
+        end
+      end
+    end
+  end
+end

data/lib/generators/pu/rodauth/concerns/feature_selector.rb

@@ -0,0 +1,125 @@
+module Pu
+  module Rodauth
+    module Concerns
+      module FeatureSelector
+        def self.included(base)
+          base.send :include, Configuration
+
+          base.send :class_option, :primary, type: :boolean,
+            desc: "[CONFIG] generated account is primary"
+          base.send :class_option, :argon2, type: :boolean, default: false,
+            desc: "[CONFIG] use Argon2 for password hashing"
+          base.send :class_option, :mails, type: :boolean, default: true, desc: "[CONFIG] setup mails"
+          base.send :class_option, :api_only, type: :boolean, default: false,
+            desc: "[CONFIG] configure only json api support"
+
+          config_features = {}
+          base::CONFIGURATION.sort.each do |feature, opts|
+            feature = feature.to_sym
+            modifier = "[*]" if opts[:default]
+            default_description = "[FEATURE]#{modifier} #{feature}"
+            description = opts[:desc] || default_description
+
+            base.define_method :"#{feature}?" do
+              feature_selected?(feature)
+            end
+
+            if opts[:feature] != false
+              base.send :class_option, feature, type: :boolean, desc: description
+            else
+              config_features[feature] = description
+            end
+          end
+
+          config_features.each do |feature, description|
+            base.send :class_option, feature, type: :boolean, desc: description
+          end
+
+          base.send :class_option, :kitchen_sink, type: :boolean, default: false,
+            desc: "[CONFIG] enable all supported features"
+          base.send :class_option, :defaults, type: :boolean, default: true,
+            desc: "[CONFIG] enable default features (indicated with [*])"
+        end
+
+        private
+
+        def feature_selected?(feature)
+          return true if kitchen_sink?
+
+          # base is special. so long as it is not explicitly disabled, always allow it through
+          return true if feature == :base && options[:base] != false
+
+          feature_options = configuration[feature]
+          case feature
+          when :json, :jwt
+            return true if only_json?
+          when :remember
+            return false if only_json?
+          end
+
+          return feature_options[:default] if defaults? && options[feature].nil?
+
+          options[feature]
+        end
+
+        # Creates a hash of options to pass down options to an invoked sub generator
+        def invoke_options
+          # These are custom options we want to track.
+          extra_options = %i[primary argon2 mails kitchen_sink defaults]
+          # Append them to all the available options from our configuration
+          valid_options = configuration.keys.map(&:to_sym).concat extra_options
+          # Index map the list with the selection value
+          opts = valid_options.map { |opt| [opt, send(:"#{opt}?")] }.to_h.compact
+          # True only options. We don't care if they are false.
+          %i[api_only force skip pretend quiet].each do |key|
+            next unless options[key]
+
+            opts[key] = options[key]
+          end
+
+          opts
+        end
+
+        def all_selected
+          @all_selected ||= configuration.keys.select { |feature| send(:"#{feature}?") }
+        end
+
+        def selected_features
+          @selected_features ||= (all_selected & feature_config.keys)
+        end
+
+        def selected_migration_features
+          @selected_migration_features ||= (all_selected & migration_config.keys).map(&:to_s)
+        end
+
+        def selected_view_features
+          @selected_view_features ||= (all_selected & view_config.keys).map(&:to_s)
+        end
+
+        def primary?
+          options[:primary]
+        end
+
+        def argon2?
+          options[:argon2]
+        end
+
+        def mails?
+          defined?(ActionMailer) && options[:mails]
+        end
+
+        def only_json?
+          ::Rails.application.config.api_only || !::Rails.application.config.session_store || options[:api_only]
+        end
+
+        def kitchen_sink?
+          options[:kitchen_sink]
+        end
+
+        def defaults?
+          options[:defaults]
+        end
+      end
+    end
+  end
+end

data/lib/generators/pu/rodauth/install_generator.rb

@@ -0,0 +1,69 @@
+require "rails/generators/base"
+require "securerandom"
+
+module Pu
+  module Rodauth
+    class InstallGenerator < ::Rails::Generators::Base
+      SEQUEL_ADAPTERS = {
+        "postgresql" => (RUBY_ENGINE == "jruby") ? "postgresql" : "postgres",
+        "mysql2" => (RUBY_ENGINE == "jruby") ? "mysql" : "mysql2",
+        "sqlite3" => "sqlite",
+        "oracle_enhanced" => "oracle",
+        "sqlserver" => (RUBY_ENGINE == "jruby") ? "mssql" : "tinytds"
+      }
+
+      source_root "#{__dir__}/templates"
+
+      desc "Install rodauth-rails"
+
+      def add_rodauth
+        Bundler.with_unbundled_env do
+          run "bundle add bcrypt"
+          run "bundle add rodauth-rails"
+        end
+      end
+
+      def create_rodauth_initializer
+        template "config/initializers/rodauth.rb"
+      end
+
+      def create_rodauth_controller
+        template "app/controllers/rodauth_controller.rb"
+      end
+
+      def create_rodauth_app
+        template "app/misc/rodauth_app.rb"
+        template "app/misc/rodauth_plugin.rb"
+      end
+
+      def add_dev_config
+        insert_into_file "config/environments/development.rb",
+          "\n  config.action_mailer.default_url_options = { host: '127.0.0.1', port: ENV.fetch('PORT', 3000) }\n",
+          before: /^end/
+      end
+
+      def show_instructions
+        readme "INSTRUCTIONS" if behavior == :invoke
+      end
+
+      private
+
+      def sequel_activerecord_integration?
+        defined?(ActiveRecord::Railtie) &&
+          (!defined?(Sequel) || Sequel::DATABASES.empty?)
+      end
+
+      def sequel_adapter
+        SEQUEL_ADAPTERS[activerecord_adapter] || activerecord_adapter
+      end
+
+      def activerecord_adapter
+        if ActiveRecord::Base.respond_to?(:connection_db_config)
+          ActiveRecord::Base.connection_db_config.adapter
+        else
+          ActiveRecord::Base.connection_config.fetch(:adapter)
+        end
+      end
+    end
+  end
+end

data/lib/generators/pu/rodauth/migration/active_record/account_expiration.erb

@@ -0,0 +1,8 @@
+# Used by the account expiration feature
+create_table :<%= table_prefix %>_activity_times, id: false do |t|
+  t.<%= primary_key_type(nil) %> :id, primary_key: true
+  t.foreign_key :<%= table_prefix.pluralize %>, column: :id
+  t.datetime :last_activity_at, null: false
+  t.datetime :last_login_at, null: false
+  t.datetime :expired_at
+end

data/lib/generators/pu/rodauth/migration/active_record/active_sessions.erb

@@ -0,0 +1,7 @@
+# Used by the active sessions feature
+create_table :<%= table_prefix %>_active_session_keys, primary_key: [:<%= table_prefix %>_id, :session_id] do |t|
+  t.references :<%= table_prefix %>, foreign_key: true<%= primary_key_type(:type) %>
+  t.string :session_id
+  t.datetime :created_at, null: false, default: -> { "<%= current_timestamp %>" }
+  t.datetime :last_use, null: false, default: -> { "<%= current_timestamp %>" }
+end

data/lib/generators/pu/rodauth/migration/active_record/audit_logging.erb

@@ -0,0 +1,16 @@
+# Used by the audit logging feature
+create_table :<%= table_prefix %>_authentication_audit_logs<%= primary_key_type %> do |t|
+  t.references :<%= table_prefix %>, foreign_key: true, null: false<%= primary_key_type(:type) %>
+  t.datetime :at, null: false, default: -> { "<%= current_timestamp %>" }
+  t.text :message, null: false
+<% case activerecord_adapter -%>
+<% when "postgresql" -%>
+  t.jsonb :metadata
+<% when "sqlite3", "mysql2", "trilogy" -%>
+  t.json :metadata
+<% else -%>
+  t.string :metadata
+<% end -%>
+  t.index [:<%= table_prefix %>_id, :at], name: "audit_<%= table_prefix %>_at_idx"
+  t.index :at, name: "audit_at_idx"
+end

data/lib/generators/pu/rodauth/migration/active_record/base.erb

@@ -0,0 +1,22 @@
+<% if activerecord_adapter == "postgresql" -%>
+enable_extension "citext"
+
+<% end -%>
+create_table :<%= table_prefix.pluralize %><%= primary_key_type %> do |t|
+  t.integer :status, null: false, default: 1
+<% case activerecord_adapter -%>
+<% when "postgresql" -%>
+  t.citext :email, null: false
+<% else -%>
+  t.string :email, null: false
+<% end -%>
+<% case activerecord_adapter -%>
+<% when "postgresql", "sqlite3" -%>
+  t.index :email, unique: true, where: "status IN (1, 2)"
+<% else -%>
+  t.index :email, unique: true
+<% end -%>
+<% unless separate_passwords? -%>
+  t.string :password_hash
+<% end -%>
+end

data/lib/generators/pu/rodauth/migration/active_record/disallow_password_reuse.erb

@@ -0,0 +1,5 @@
+# Used by the disallow password reuse feature
+create_table :<%= table_prefix %>_previous_password_hashes do |t|
+  t.references :<%= table_prefix %>, foreign_key: true<%= primary_key_type(:type) %>
+  t.string :password_hash, null: false
+end

data/lib/generators/pu/rodauth/migration/active_record/email_auth.erb

@@ -0,0 +1,8 @@
+# Used by the email auth feature
+create_table :<%= table_prefix %>_email_auth_keys, id: false do |t|
+  t.<%= primary_key_type(nil) %> :id, primary_key: true
+  t.foreign_key :<%= table_prefix.pluralize %>, column: :id
+  t.string :key, null: false
+  t.datetime :deadline, null: false
+  t.datetime :email_last_sent, null: false, default: -> { "<%= current_timestamp %>" }
+end

data/lib/generators/pu/rodauth/migration/active_record/jwt_refresh.erb

@@ -0,0 +1,7 @@
+# Used by the jwt refresh feature
+create_table :<%= table_prefix %>_jwt_refresh_keys<%= primary_key_type %> do |t|
+  t.references :<%= table_prefix %>, foreign_key: true, null: false<%= primary_key_type(:type) %>
+  t.string :key, null: false
+  t.datetime :deadline, null: false
+  t.index :<%= table_prefix %>_id, name: "<%= table_prefix %>_jwt_rk_<%= table_prefix %>_id_idx"
+end

data/lib/generators/pu/rodauth/migration/active_record/lockout.erb

@@ -0,0 +1,13 @@
+# Used by the lockout feature
+create_table :<%= table_prefix %>_login_failures, id: false do |t|
+  t.<%= primary_key_type(nil) %> :id, primary_key: true
+  t.foreign_key :<%= table_prefix.pluralize %>, column: :id
+  t.integer :number, null: false, default: 1
+end
+create_table :<%= table_prefix %>_lockouts, id: false do |t|
+  t.<%= primary_key_type(nil) %> :id, primary_key: true
+  t.foreign_key :<%= table_prefix.pluralize %>, column: :id
+  t.string :key, null: false
+  t.datetime :deadline, null: false
+  t.datetime :email_last_sent
+end

data/lib/generators/pu/rodauth/migration/active_record/otp.erb

@@ -0,0 +1,8 @@
+# Used by the otp feature
+create_table :<%= table_prefix %>_otp_keys, id: false do |t|
+  t.<%= primary_key_type(nil) %> :id, primary_key: true
+  t.foreign_key :<%= table_prefix.pluralize %>, column: :id
+  t.string :key, null: false
+  t.integer :num_failures, null: false, default: 0
+  t.datetime :last_use, null: false, default: -> { "<%= current_timestamp %>" }
+end

data/lib/generators/pu/rodauth/migration/active_record/password_expiration.erb

@@ -0,0 +1,6 @@
+# Used by the password expiration feature
+create_table :<%= table_prefix %>_password_change_times, id: false do |t|
+  t.<%= primary_key_type(nil) %> :id, primary_key: true
+  t.foreign_key :<%= table_prefix.pluralize %>, column: :id
+  t.datetime :changed_at, null: false, default: -> { "<%= current_timestamp %>" }
+end

data/lib/generators/pu/rodauth/migration/active_record/recovery_codes.erb

@@ -0,0 +1,6 @@
+# Used by the recovery codes feature
+create_table :<%= table_prefix %>_recovery_codes, primary_key: [:id, :code] do |t|
+  t.<%= primary_key_type(nil) %> :id
+  t.foreign_key :<%= table_prefix.pluralize %>, column: :id
+  t.string :code
+end

data/lib/generators/pu/rodauth/migration/active_record/remember.erb

@@ -0,0 +1,7 @@
+# Used by the remember me feature
+create_table :<%= table_prefix %>_remember_keys, id: false do |t|
+  t.<%= primary_key_type(nil) %> :id, primary_key: true
+  t.foreign_key :<%= table_prefix.pluralize %>, column: :id
+  t.string :key, null: false
+  t.datetime :deadline, null: false
+end