rails_authentication 0.1.0

data/lib/generators/authentication/templates/app/controllers/registrations_controller.rb.tt

@@ -0,0 +1,56 @@
+class RegistrationsController < ApplicationController
+  allow_unauthenticated_access only: %i[ new create ]
+
+  def new
+    @user = User.new
+  end
+
+  def create
+    @user = User.new(user_params)
+
+    if @user.save
+<% if confirmable? -%>
+      @user.send_confirmation_instructions
+      redirect_to new_session_path, notice: "Welcome! Check your email to confirm your account."
+<% else -%>
+      start_new_session_for @user
+      redirect_to after_authentication_url, notice: "Welcome! You have signed up successfully."
+<% end -%>
+    else
+      render :new, status: :unprocessable_content
+    end
+  end
+
+  def edit
+    @user = Current.user
+  end
+
+  def update
+    @user = Current.user
+
+    if @user.update(user_params_for_update)
+      redirect_to edit_registration_path, notice: "Your account has been updated."
+    else
+      render :edit, status: :unprocessable_content
+    end
+  end
+
+  def destroy
+    user = Current.user
+    terminate_session
+    user.destroy
+    redirect_to new_session_path, notice: "Your account has been deleted.", status: :see_other
+  end
+
+  private
+
+  def user_params
+    params.permit(:email_address, :password, :password_confirmation)
+  end
+
+  def user_params_for_update
+    permitted = user_params
+    permitted = permitted.except(:password, :password_confirmation) if permitted[:password].blank?
+    permitted
+  end
+end

data/lib/generators/authentication/templates/app/controllers/sessions_controller.rb.tt

@@ -0,0 +1,64 @@
+class SessionsController < ApplicationController
+  allow_unauthenticated_access only: %i[ new create ]
+  rate_limit to: 10, within: 3.minutes, only: :create, with: -> { redirect_to new_session_path, alert: "Try again later." }
+
+  def new
+  end
+
+  def create
+    user = User.authenticate_by(params.permit(:email_address, :password))
+
+    if user.nil?
+<% if lockable? || trackable? -%>
+      account = User.find_by(email_address: params[:email_address])
+<% end -%>
+<% if lockable? -%>
+      account&.register_failed_attempt!
+<% end -%>
+<% if trackable? -%>
+      record_authentication_attempt(account, success: false, failure_reason: "invalid_credentials")
+<% end -%>
+      redirect_to new_session_path, alert: "Try another email address or password."
+<% if lockable? -%>
+    elsif user.locked?
+<% if trackable? -%>
+      record_authentication_attempt(user, success: false, failure_reason: "locked")
+<% end -%>
+      redirect_to new_session_path, alert: "Your account is locked. Check your email for unlock instructions."
+<% end -%>
+<% if confirmable? -%>
+    elsif !user.confirmed?
+<% if trackable? -%>
+      record_authentication_attempt(user, success: false, failure_reason: "unconfirmed")
+<% end -%>
+      redirect_to new_session_path, alert: "You must confirm your email address before signing in."
+<% end -%>
+    else
+<% if lockable? -%>
+      user.reset_failed_attempts!
+<% end -%>
+<% if trackable? -%>
+      record_authentication_attempt(user, success: true)
+<% end -%>
+<% if rememberable? -%>
+      start_new_session_for user, remember: params[:remember_me] == "1"
+<% else -%>
+      start_new_session_for user
+<% end -%>
+      redirect_to after_authentication_url
+    end
+  end
+
+  def destroy
+    terminate_session
+    redirect_to new_session_path, status: :see_other
+  end
+<% if trackable? -%>
+
+  private
+
+  def record_authentication_attempt(user, success:, failure_reason: nil)
+    UserAuth.record(user, request, success: success, failure_reason: failure_reason)
+  end
+<% end -%>
+end

data/lib/generators/authentication/templates/app/controllers/unlocks_controller.rb.tt

@@ -0,0 +1,23 @@
+class UnlocksController < ApplicationController
+  allow_unauthenticated_access
+  rate_limit to: 10, within: 3.minutes, only: :create, with: -> { redirect_to new_unlock_path, alert: "Try again later." }
+
+  def new
+  end
+
+  def create
+    user = User.find_by(email_address: params[:email_address])
+    user.send_unlock_instructions if user&.locked?
+
+    redirect_to new_session_path, notice: "Unlock instructions sent (if user with that email address exists and is locked)."
+  end
+
+  def show
+    if user = User.find_by_valid_unlock_token(params[:token])
+      user.unlock!
+      redirect_to new_session_path, notice: "Your account has been unlocked. Please sign in."
+    else
+      redirect_to new_unlock_path, alert: "Unlock link is invalid or has expired."
+    end
+  end
+end

data/lib/generators/authentication/templates/app/mailers/confirmations_mailer.rb.tt

@@ -0,0 +1,10 @@
+class ConfirmationsMailer < ApplicationMailer
+  def confirmation_instructions(user)
+    @user = user
+<% if reconfirmable? -%>
+    mail subject: "Confirm your email address", to: user.unconfirmed_email.presence || user.email_address
+<% else -%>
+    mail subject: "Confirm your email address", to: user.email_address
+<% end -%>
+  end
+end

data/lib/generators/authentication/templates/app/mailers/invitations_mailer.rb.tt

@@ -0,0 +1,6 @@
+class InvitationsMailer < ApplicationMailer
+  def invitation_instructions(user)
+    @user = user
+    mail subject: "You have been invited", to: user.email_address
+  end
+end

data/lib/generators/authentication/templates/app/mailers/passwords_mailer.rb.tt

@@ -0,0 +1,6 @@
+class PasswordsMailer < ApplicationMailer
+  def reset(user)
+    @user = user
+    mail subject: "Reset your password", to: user.email_address
+  end
+end

data/lib/generators/authentication/templates/app/mailers/unlocks_mailer.rb.tt

@@ -0,0 +1,6 @@
+class UnlocksMailer < ApplicationMailer
+  def unlock_instructions(user)
+    @user = user
+    mail subject: "Unlock your account", to: user.email_address
+  end
+end

data/lib/generators/authentication/templates/app/models/concerns/confirmable_concern.rb.tt

@@ -0,0 +1,74 @@
+module ConfirmableConcern
+  extend ActiveSupport::Concern
+
+  CONFIRMATION_TOKEN_EXPIRES_IN = 24.hours
+<% if reconfirmable? -%>
+
+  included do
+    before_update :postpone_email_address_change, if: :postponing_email_address_change?
+    after_update_commit :deliver_reconfirmation_instructions, if: -> { saved_change_to_unconfirmed_email? && unconfirmed_email.present? }
+  end
+<% end -%>
+
+  class_methods do
+    def find_by_valid_confirmation_token(token)
+      return if token.blank?
+
+      user = find_by(confirmation_token: token)
+      user if user&.confirmation_sent_at&.after?(CONFIRMATION_TOKEN_EXPIRES_IN.ago)
+    end
+  end
+
+  def confirmed?
+    confirmed_at.present?
+  end
+
+  def confirm!
+<% if reconfirmable? -%>
+    @confirming = true
+    self.email_address = unconfirmed_email if unconfirmed_email.present?
+    self.unconfirmed_email = nil
+    self.confirmed_at = Time.current
+    self.confirmation_token = nil
+    self.confirmation_sent_at = nil
+    save!
+  ensure
+    @confirming = false
+<% else -%>
+    update!(confirmed_at: Time.current, confirmation_token: nil, confirmation_sent_at: nil)
+<% end -%>
+  end
+
+  def send_confirmation_instructions
+    generate_confirmation_token!
+    ConfirmationsMailer.confirmation_instructions(self).deliver_later
+  end
+
+  def generate_confirmation_token!
+    update!(confirmation_token: generate_confirmable_token, confirmation_sent_at: Time.current)
+  end
+<% if reconfirmable? -%>
+
+  private
+    def postponing_email_address_change?
+      !@confirming && email_address_changed? && confirmed?
+    end
+
+    def postpone_email_address_change
+      self.unconfirmed_email = email_address
+      self.email_address = email_address_in_database
+      self.confirmation_token = generate_confirmable_token
+      self.confirmation_sent_at = Time.current
+    end
+
+    def deliver_reconfirmation_instructions
+      ConfirmationsMailer.confirmation_instructions(self).deliver_later
+    end
+<% end -%>
+
+  protected
+
+  def generate_confirmable_token
+    SecureRandom.urlsafe_base64(32)
+  end
+end

data/lib/generators/authentication/templates/app/models/concerns/invitable_concern.rb.tt

@@ -0,0 +1,86 @@
+module InvitableConcern
+  extend ActiveSupport::Concern
+
+  INVITATION_TOKEN_EXPIRES_IN = 7.days
+
+  included do
+    belongs_to :invited_by, polymorphic: true, optional: true
+  end
+
+  class_methods do
+    def invite!(email_address, invited_by: nil)
+      user = find_by(email_address: email_address)
+
+      if user
+        # Re-inviting an existing pending invitee refreshes their token; anyone else
+        # is returned untouched (and no email is sent).
+        if user.invitation_pending?
+          user.update!(invitation_token: generate_invitable_token, invitation_created_at: Time.current)
+          user.send_invitation_instructions
+          invited_by.increment!(:invitations_count) if invited_by.respond_to?(:invitations_count)
+        end
+
+        return user
+      end
+
+      user = new(
+        email_address: email_address,
+        password: generate_temporary_password,
+        invited_by: invited_by,
+        invitation_token: generate_invitable_token,
+        invitation_created_at: Time.current
+      )
+
+      if user.save
+        user.send_invitation_instructions
+        invited_by.increment!(:invitations_count) if invited_by.respond_to?(:invitations_count)
+      end
+
+      user
+    end
+
+    def find_by_valid_invitation_token(token)
+      return if token.blank?
+
+      user = find_by(invitation_token: token)
+      user if user&.invitation_created_at&.after?(INVITATION_TOKEN_EXPIRES_IN.ago)
+    end
+
+    protected
+
+    def generate_invitable_token
+      SecureRandom.urlsafe_base64(32)
+    end
+
+    def generate_temporary_password
+      lower_letter = ("a".."z").to_a.sample(2)
+      upper_letter = ("A".."Z").to_a.sample(2)
+      digits = (1..5).to_a.sample(2)
+      special = %w[~ ! @ % & _ + -].sample(2)
+      prefix = (lower_letter + upper_letter + digits + special).join
+      SecureRandom.base58(16).sub(/\A.{#{prefix.length}}/, prefix)
+    end
+  end
+
+  def invitation_pending?
+    invitation_token.present? && invitation_accepted_at.nil?
+  end
+
+  def send_invitation_instructions
+    update!(invitation_sent_at: Time.current)
+    InvitationsMailer.invitation_instructions(self).deliver_later
+  end
+
+  def accept_invitation!(password:, password_confirmation:)
+    assign_attributes(
+      password: password,
+      password_confirmation: password_confirmation,
+      invitation_token: nil,
+      invitation_accepted_at: Time.current
+    )
+<% if confirmable? -%>
+    self.confirmed_at ||= Time.current # accepting the invite proves the email address
+<% end -%>
+    save
+  end
+end

data/lib/generators/authentication/templates/app/models/concerns/lockable_concern.rb.tt

@@ -0,0 +1,48 @@
+module LockableConcern
+  extend ActiveSupport::Concern
+
+  MAXIMUM_ATTEMPTS = 5
+  UNLOCK_IN = 1.hour
+
+  class_methods do
+    def find_by_valid_unlock_token(token)
+      return if token.blank?
+
+      find_by(unlock_token: token)
+    end
+  end
+
+  # Locks expire on their own after UNLOCK_IN; the stale lock is cleared on the
+  # next successful sign-in by reset_failed_attempts!.
+  def locked?
+    locked_at.present? && locked_at.after?(UNLOCK_IN.ago)
+  end
+
+  def register_failed_attempt!
+    increment!(:failed_attempts)
+    lock! if failed_attempts >= MAXIMUM_ATTEMPTS && !locked?
+  end
+
+  def lock!
+    update!(locked_at: Time.current, unlock_token: generate_lockable_token)
+    send_unlock_instructions
+  end
+
+  def unlock!
+    update!(locked_at: nil, unlock_token: nil, failed_attempts: 0)
+  end
+
+  def reset_failed_attempts!
+    update!(failed_attempts: 0, locked_at: nil, unlock_token: nil) if failed_attempts.positive? || locked_at.present?
+  end
+
+  def send_unlock_instructions
+    UnlocksMailer.unlock_instructions(self).deliver_later
+  end
+
+  protected
+
+  def generate_lockable_token
+    SecureRandom.urlsafe_base64(32)
+  end
+end

data/lib/generators/authentication/templates/app/models/concerns/recoverable_concern.rb.tt

@@ -0,0 +1,33 @@
+module RecoverableConcern
+  extend ActiveSupport::Concern
+
+  RESET_PASSWORD_TOKEN_EXPIRES_IN = 4.hours
+
+  class_methods do
+    def find_by_valid_reset_password_token(token)
+      return if token.blank?
+
+      user = find_by(reset_password_token: token)
+      user if user&.reset_password_sent_at&.after?(RESET_PASSWORD_TOKEN_EXPIRES_IN.ago)
+    end
+  end
+
+  def send_reset_password_instructions
+    generate_reset_password_token!
+    PasswordsMailer.reset(self).deliver_later
+  end
+
+  def generate_reset_password_token!
+    update!(reset_password_token: generate_recoverable_token, reset_password_sent_at: Time.current)
+  end
+
+  def clear_reset_password_token!
+    update!(reset_password_token: nil, reset_password_sent_at: nil)
+  end
+
+  protected
+
+  def generate_recoverable_token
+    SecureRandom.urlsafe_base64(32)
+  end
+end

data/lib/generators/authentication/templates/app/models/concerns/rememberable_concern.rb.tt

@@ -0,0 +1,15 @@
+module RememberableConcern
+  extend ActiveSupport::Concern
+
+  def remembered?
+    remember_created_at.present?
+  end
+
+  def remember_me!
+    update!(remember_created_at: Time.current)
+  end
+
+  def forget_me!
+    update!(remember_created_at: nil) if remember_created_at.present?
+  end
+end

data/lib/generators/authentication/templates/app/models/concerns/timeoutable_concern.rb.tt

@@ -0,0 +1,9 @@
+module TimeoutableConcern
+  extend ActiveSupport::Concern
+
+  TIMEOUT_IN = 30.minutes
+
+  def timedout?(last_activity_at)
+    last_activity_at.present? && last_activity_at.before?(TIMEOUT_IN.ago)
+  end
+end

data/lib/generators/authentication/templates/app/models/concerns/trackable_concern.rb.tt

@@ -0,0 +1,7 @@
+module TrackableConcern
+  extend ActiveSupport::Concern
+
+  included do
+    has_many :user_auths, dependent: :destroy
+  end
+end

data/lib/generators/authentication/templates/app/models/concerns/validatable_concern.rb.tt

@@ -0,0 +1,40 @@
+module ValidatableConcern
+  extend ActiveSupport::Concern
+
+  EMAIL_ADDRESS_REGEXP = /\A[^@\s]+@[^@\s]+\z/
+  PASSWORD_LENGTH = 6..72
+  PASSWORD_DIGIT_REGEXP = /\d+/
+  PASSWORD_UPPER_REGEXP = /[A-Z]+/
+  PASSWORD_LOWER_REGEXP = /[a-z]+/
+  PASSWORD_SPECIAL_REGEXP = /[^a-zA-Z\d\s]+/
+  PASSWORD_MINIMUM_COMPLEXITY = 2 # Minumum number of complexities to match to be valid
+
+  included do
+    validates :email_address, presence: true,
+      format: { with: EMAIL_ADDRESS_REGEXP },
+      uniqueness: { case_sensitive: false }
+    validates :password, length: { in: PASSWORD_LENGTH }, allow_nil: true
+
+    validate :password_complexity
+  end
+
+  protected
+
+  def password_complexity
+    return if password.blank? || valid_password_complexity?
+
+    errors.add(:password, "must meet password complexity standards")
+  end
+
+  def valid_password_complexity?
+    return false if password.blank?
+
+    conditions = [
+      PASSWORD_DIGIT_REGEXP.match?(password),
+      PASSWORD_UPPER_REGEXP.match?(password),
+      PASSWORD_LOWER_REGEXP.match?(password),
+      PASSWORD_SPECIAL_REGEXP.match?(password)
+    ]
+    conditions.count(true) >= PASSWORD_MINIMUM_COMPLEXITY
+  end
+end

data/lib/generators/authentication/templates/app/models/user_auth.rb.tt

@@ -0,0 +1,18 @@
+class UserAuth < ApplicationRecord
+  # user is optional so failed attempts against unknown email addresses still get recorded
+  belongs_to :user, optional: true
+
+  scope :successful, -> { where(success: true) }
+  scope :failed, -> { where(success: false) }
+
+  def self.record(user, request, success:, failure_reason: nil)
+    create!(
+      user: user,
+      ip: request.remote_ip,
+      user_agent: request.user_agent,
+      referrer: request.referer,
+      success: success,
+      failure_reason: failure_reason
+    )
+  end
+end

data/lib/generators/authentication/templates/app/views/confirmations/new.html.erb.tt

@@ -0,0 +1,8 @@
+<h1>Resend confirmation instructions</h1>
+
+<%%= tag.div(flash[:alert], style: "color:red") if flash[:alert] %>
+
+<%%= form_with url: confirmations_path do |form| %>
+  <%%= form.email_field :email_address, required: true, autofocus: true, autocomplete: "username", placeholder: "Enter your email address", value: params[:email_address] %><br>
+  <%%= form.submit "Resend confirmation instructions" %>
+<%% end %>

data/lib/generators/authentication/templates/app/views/confirmations_mailer/confirmation_instructions.html.erb.tt

@@ -0,0 +1,6 @@
+<p>
+  You can confirm your email address on
+  <%%= link_to "this confirmation page", confirmation_url(@user.confirmation_token) %>.
+
+  This link will expire in <%%= distance_of_time_in_words(0, ConfirmableConcern::CONFIRMATION_TOKEN_EXPIRES_IN) %>.
+</p>

data/lib/generators/authentication/templates/app/views/confirmations_mailer/confirmation_instructions.text.erb.tt

@@ -0,0 +1,4 @@
+You can confirm your email address on
+<%%= confirmation_url(@user.confirmation_token) %>
+
+This link will expire in <%%= distance_of_time_in_words(0, ConfirmableConcern::CONFIRMATION_TOKEN_EXPIRES_IN) %>.

data/lib/generators/authentication/templates/app/views/invitations/edit.html.erb.tt

@@ -0,0 +1,9 @@
+<h1>Accept your invitation</h1>
+
+<%%= tag.div(flash[:alert], style: "color:red") if flash[:alert] %>
+
+<%%= form_with url: invitation_path(params[:token]), method: :patch do |form| %>
+  <%%= form.password_field :password, required: true, autofocus: true, autocomplete: "new-password", placeholder: "Choose a password", maxlength: 72 %><br>
+  <%%= form.password_field :password_confirmation, required: true, autocomplete: "new-password", placeholder: "Repeat the password", maxlength: 72 %><br>
+  <%%= form.submit "Set my password" %>
+<%% end %>

data/lib/generators/authentication/templates/app/views/invitations/new.html.erb.tt

@@ -0,0 +1,9 @@
+<h1>Invite someone</h1>
+
+<%%= tag.div(flash[:alert], style: "color:red") if flash[:alert] %>
+<%%= tag.div(flash[:notice], style: "color:green") if flash[:notice] %>
+
+<%%= form_with url: invitations_path do |form| %>
+  <%%= form.email_field :email_address, required: true, autofocus: true, placeholder: "Enter their email address" %><br>
+  <%%= form.submit "Send invitation" %>
+<%% end %>

data/lib/generators/authentication/templates/app/views/invitations_mailer/invitation_instructions.html.erb.tt

@@ -0,0 +1,6 @@
+<p>
+  You have been invited. Set your password and activate your account on
+  <%%= link_to "this invitation page", edit_invitation_url(@user.invitation_token) %>.
+
+  This link will expire in <%%= distance_of_time_in_words(0, InvitableConcern::INVITATION_TOKEN_EXPIRES_IN) %>.
+</p>

data/lib/generators/authentication/templates/app/views/invitations_mailer/invitation_instructions.text.erb.tt

@@ -0,0 +1,4 @@
+You have been invited. Set your password and activate your account on
+<%%= edit_invitation_url(@user.invitation_token) %>
+
+This link will expire in <%%= distance_of_time_in_words(0, InvitableConcern::INVITATION_TOKEN_EXPIRES_IN) %>.

data/lib/generators/authentication/templates/app/views/passwords_mailer/reset.html.erb.tt

@@ -0,0 +1,6 @@
+<p>
+  You can reset your password on
+  <%%= link_to "this password reset page", edit_password_url(@user.reset_password_token) %>.
+
+  This link will expire in <%%= distance_of_time_in_words(0, RecoverableConcern::RESET_PASSWORD_TOKEN_EXPIRES_IN) %>.
+</p>

data/lib/generators/authentication/templates/app/views/passwords_mailer/reset.text.erb.tt

@@ -0,0 +1,4 @@
+You can reset your password on
+<%%= edit_password_url(@user.reset_password_token) %>
+
+This link will expire in <%%= distance_of_time_in_words(0, RecoverableConcern::RESET_PASSWORD_TOKEN_EXPIRES_IN) %>.

data/lib/generators/authentication/templates/app/views/registrations/edit.html.erb.tt

@@ -0,0 +1,22 @@
+<h1>Your account</h1>
+
+<%%= tag.div(flash[:alert], style: "color:red") if flash[:alert] %>
+<%%= tag.div(flash[:notice], style: "color:green") if flash[:notice] %>
+
+<%% if @user.errors.any? %>
+  <ul style="color:red">
+    <%% @user.errors.full_messages.each do |message| %>
+      <li><%%= message %></li>
+    <%% end %>
+  </ul>
+<%% end %>
+
+<%%= form_with url: registration_path, method: :patch do |form| %>
+  <%%= form.email_field :email_address, required: true, autocomplete: "username", value: @user.email_address %><br>
+  <%%= form.password_field :password, autocomplete: "new-password", placeholder: "New password (leave blank to keep current)", maxlength: 72 %><br>
+  <%%= form.password_field :password_confirmation, autocomplete: "new-password", placeholder: "Repeat new password", maxlength: 72 %><br>
+  <%%= form.submit "Update" %>
+<%% end %>
+<br>
+
+<%%= button_to "Delete my account", registration_path, method: :delete, data: { turbo_confirm: "Are you sure?" } %>

data/lib/generators/authentication/templates/app/views/registrations/new.html.erb.tt

@@ -0,0 +1,21 @@
+<h1>Sign up</h1>
+
+<%%= tag.div(flash[:alert], style: "color:red") if flash[:alert] %>
+
+<%% if @user.errors.any? %>
+  <ul style="color:red">
+    <%% @user.errors.full_messages.each do |message| %>
+      <li><%%= message %></li>
+    <%% end %>
+  </ul>
+<%% end %>
+
+<%%= form_with url: registration_path do |form| %>
+  <%%= form.email_field :email_address, required: true, autofocus: true, autocomplete: "username", placeholder: "Enter your email address", value: @user.email_address %><br>
+  <%%= form.password_field :password, required: true, autocomplete: "new-password", placeholder: "Enter a password", maxlength: 72 %><br>
+  <%%= form.password_field :password_confirmation, required: true, autocomplete: "new-password", placeholder: "Repeat the password", maxlength: 72 %><br>
+  <%%= form.submit "Sign up" %>
+<%% end %>
+<br>
+
+<%%= link_to "Sign in", new_session_path %>

data/lib/generators/authentication/templates/app/views/sessions/new.html.erb.tt

@@ -0,0 +1,23 @@
+<%%= tag.div(flash[:alert], style: "color:red") if flash[:alert] %>
+<%%= tag.div(flash[:notice], style: "color:green") if flash[:notice] %>
+
+<%%= form_with url: session_path do |form| %>
+  <%%= form.email_field :email_address, required: true, autofocus: true, autocomplete: "username", placeholder: "Enter your email address", value: params[:email_address] %><br>
+  <%%= form.password_field :password, required: true, autocomplete: "current-password", placeholder: "Enter your password", maxlength: 72 %><br>
+<% if rememberable? -%>
+  <%%= form.check_box :remember_me %> <%%= form.label :remember_me, "Remember me" %><br>
+<% end -%>
+  <%%= form.submit "Sign in" %>
+<%% end %>
+<br>
+
+<%%= link_to "Forgot password?", new_password_path %>
+<% if registerable? -%>
+<br><%%= link_to "Sign up", new_registration_path %>
+<% end -%>
+<% if confirmable? -%>
+<br><%%= link_to "Resend confirmation instructions", new_confirmation_path %>
+<% end -%>
+<% if lockable? -%>
+<br><%%= link_to "Resend unlock instructions", new_unlock_path %>
+<% end -%>