rails_iam 0.1.0

data/app/controllers/rails_iam/auth_controller.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+module RailsIam
+  class AuthController < ApplicationController
+    include ActionController::Cookies
+    include RailsIam::AuthConcern
+    include RailsIam::ConfigLoader
+
+    rescue_from RailsIam::Authentication::Exceptions::AuthenticationError, with: :render_rails_iam_authentication_error
+
+    def sign_in
+      result = RailsIam::Authentication::Login.call(
+        email: login_params[:email],
+        password: login_params[:password],
+        request: request,
+      )
+
+      ensure_valid_strategy!
+
+      create_authenticated_user_cookies!(result) if strategy_includes?(:cookie)
+
+      if strategy_includes?(:bearer)
+        render json: token_response_payload(result)
+      else
+        render json: { user: result.user }
+      end
+    end
+
+    def sign_out
+      refresh_token = current_refresh_token
+
+      RailsIam::Authentication::Logout.call(
+        refresh_token: refresh_token,
+      )
+
+      delete_authenticated_user_cookies! if strategy_includes?(:cookie)
+
+      head :no_content
+    end
+
+    def refresh
+      refresh_token = current_refresh_token
+
+      validate_refresh_token(refresh_token)
+
+      user = refresh_token.user
+      jti = SecureRandom.uuid
+
+      new_access_token = RailsIam::Authentication::JwtEncoder.call(user, jti: jti)
+
+      cookies.encrypted[access_token_key] = {
+        value: new_access_token,
+        expires: access_token_expires_in,
+        **cookie_options,
+      }
+
+      refresh_token.update!(last_used_at: Time.current, jti: jti)
+
+      render json: { success: true }
+    end
+
+    private
+
+    def create_authenticated_user_cookies!(result)
+      cookies.encrypted[access_token_key] = {
+        value: result.access_token,
+        expires: result.access_token_expires_in,
+        **cookie_options,
+      }
+
+      cookies.encrypted[refresh_token_key] = {
+        value: result.refresh_token,
+        expires: result.refresh_token_expires_in,
+        **cookie_options,
+      }
+    end
+
+    def delete_authenticated_user_cookies!
+      cookies.delete(access_token_key)
+      cookies.delete(refresh_token_key)
+    end
+
+    def validate_refresh_token(refresh_token)
+      return unless refresh_token.nil? || refresh_token.revoked_at.present? || refresh_token.expires_at < Time.current
+
+      raise RailsIam::Authentication::Exceptions::AuthenticationError, token_error
+    end
+
+    def ensure_valid_strategy!
+      return unless (authentication_strategies & %i[cookie bearer]).empty?
+
+      raise RailsIam::Authentication::Exceptions::AuthenticationError, authentication_strategy_error
+    end
+
+    def strategy_includes?(strategy)
+      authentication_strategies.include?(strategy)
+    end
+
+    def token_response_payload(result)
+      {
+        user: result.user,
+        access_token: result.access_token,
+        refresh_token: result.refresh_token,
+        access_token_expires_in: result.access_token_expires_in,
+        refresh_token_expires_in: result.refresh_token_expires_in,
+      }
+    end
+
+    def login_params
+      params.expect(auth: %i[email password])
+    end
+  end
+end

data/app/helpers/rails_iam/config_loader.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module ConfigLoader
+    extend Forwardable
+
+    def user_class
+      @user_class ||= RailsIam.configuration.user_class.constantize
+    end
+
+    # Authentication configuration
+    def_delegators :"RailsIam.configuration.authentication",
+                   :access_token_key,
+                   :refresh_token_key,
+                   :token_error,
+                   :token_expired_error,
+                   :authentication_error,
+                   :authentication_strategy_error,
+                   :session_strategy_error,
+                   :refresh_token_transport_error,
+                   :refresh_token_expires_in,
+                   :access_token_expires_in
+    def session_strategy
+      @session_strategy ||= RailsIam.configuration.authentication.session_strategy&.to_sym
+    end
+
+    def authentication_strategies
+      @authentication_strategies ||= Array(RailsIam.configuration.authentication.authentication_strategies).map(&:to_sym)
+    end
+
+    def refresh_token_transport
+      @refresh_token_transport ||= RailsIam.configuration.authentication.refresh_token_transport.to_sym
+    end
+
+    def cookie_options
+      @cookie_options ||= RailsIam.configuration.authentication.cookie_options.except(:value, :expires)
+    end
+
+    # Authorization configuration
+    def_delegators :"RailsIam.configuration.authorization",
+                   :missing_permission_error,
+                   :missing_role_error,
+                   :excluded_controller_patterns
+
+    def authorization_rule_error
+      error = RailsIam.configuration.authorization.authorization_rule_error
+      "#{error.to_s.strip.ljust(1)} #{controller_name}##{action_name}"
+    end
+
+    # Jwt configuration
+    def jwt_algorithm
+      RailsIam.configuration.jwt.algorithm
+    end
+
+    def jwt_expiry
+      RailsIam.configuration.jwt.jwt_expires_in
+    end
+
+    def jwt_issuer
+      RailsIam.configuration.jwt.issuer
+    end
+
+    def jwt_audience
+      RailsIam.configuration.jwt.audience
+    end
+
+    def jwt_secret_key
+      RailsIam.configuration.jwt.secret
+    end
+  end
+end

data/app/models/concerns/rails_iam/auditable.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module RailsIam
+  # frozen_string_literal: true
+
+  module Auditable
+    extend ActiveSupport::Concern
+
+    included do
+      before_create :set_created_by, if: :created_by_column_present?
+      before_destroy :set_deleted_by, if: :deleted_by_column_present?
+      before_update :set_updated_by, if: :updated_by_column_present?
+    end
+
+    private
+
+    def set_created_by
+      self.created_by = performer if respond_to?(:created_by=)
+    end
+
+    def set_updated_by
+      self.updated_by = performer if respond_to?(:updated_by=)
+    end
+
+    def set_deleted_by
+      self.deleted_by = performer if respond_to?(:deleted_by=)
+    end
+
+    def performer
+      user = RailsIam::Authentication::Current.user
+      return if user.nil?
+
+      method = RailsIam.configuration.audit_performer_method
+
+      case method
+      when Symbol
+        user.public_send(method)
+      when Proc
+        method.call(user)
+      else
+        user.id
+      end
+    end
+
+    def created_by_column_present?
+      self.class.column_names.include?("created_by")
+    end
+
+    def deleted_by_column_present?
+      self.class.column_names.include?("deleted_by")
+    end
+
+    def updated_by_column_present?
+      self.class.column_names.include?("updated_by")
+    end
+  end
+end

data/app/models/concerns/rails_iam/user_concern.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module UserConcern
+    extend ActiveSupport::Concern
+
+    included do
+      has_many :user_roles,
+               class_name: "RailsIam::UserRole",
+               foreign_key: :user_id,
+               dependent: :destroy
+
+      has_many :roles,
+               through: :user_roles,
+               source: :role
+
+      has_many :user_permissions,
+               class_name: "RailsIam::UserPermission",
+               foreign_key: :user_id,
+               dependent: :destroy
+
+      has_many :granted_permissions,
+               through: :user_permissions,
+               source: :permission
+
+      has_many :user_denied_permissions,
+               class_name: "RailsIam::UserDeniedPermission",
+               foreign_key: :user_id,
+               dependent: :destroy
+
+      has_many :denied_permissions,
+               through: :user_denied_permissions,
+               source: :permission
+
+      has_many :refresh_tokens,
+               class_name: "RailsIam::RefreshToken",
+               foreign_key: :user_id,
+               dependent: :destroy
+
+      scope :with_allowed_permissions, -> { includes(user_permissions: :permission) }
+      scope :with_denied_permissions, -> { includes(user_denied_permissions: :permission) }
+      scope :with_authorization, lambda {
+        includes(
+          roles: :permissions,
+          user_permissions: :permission,
+          user_denied_permissions: :permission,
+        )
+      }
+    end
+
+    def permission_codes
+      RailsIam::Authorization::PermissionResolver.call(self).effective_codes.to_a
+    end
+
+    def role_names
+      RailsIam::Authorization::RoleResolver.call(self).to_a
+    end
+  end
+end

data/app/models/rails_iam/application_record.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module RailsIam
+  class ApplicationRecord < ActiveRecord::Base
+    self.abstract_class = true
+    include RailsIam::Auditable
+  end
+end

data/app/models/rails_iam/permission.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module RailsIam
+  class Permission < ApplicationRecord
+    has_many :role_permissions, dependent: :destroy, class_name: "RailsIam::RolePermission"
+    has_many :roles, through: :role_permissions, class_name: "RailsIam::Role"
+    has_many :user_permissions, dependent: :destroy, class_name: "RailsIam::UserPermission"
+    has_many :users, through: :user_permissions, class_name: RailsIam.configuration.user_class
+
+    validates :code, presence: true, uniqueness: true
+
+    normalizes :code, with: ->(code) { code.to_s.downcase.strip }
+  end
+end

data/app/models/rails_iam/refresh_token.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module RailsIam
+  class RefreshToken < ApplicationRecord
+    belongs_to :user, class_name: RailsIam.configuration.user_class
+  end
+end

data/app/models/rails_iam/role.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module RailsIam
+  class Role < ApplicationRecord
+    has_many :user_roles, dependent: :destroy, class_name: "RailsIam::UserRole"
+    has_many :users, through: :user_roles, class_name: RailsIam.configuration.user_class
+    has_many :role_permissions, dependent: :destroy, class_name: "RailsIam::RolePermission"
+    has_many :permissions, through: :role_permissions, class_name: "RailsIam::Permission"
+
+    validates :name, presence: true, uniqueness: true
+
+    normalizes :name, with: ->(code) { code.to_s.downcase.strip }
+  end
+end

data/app/models/rails_iam/role_permission.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module RailsIam
+  class RolePermission < ApplicationRecord
+    belongs_to :permission, class_name: "RailsIam::Permission"
+    belongs_to :role, class_name: "RailsIam::Role"
+
+    validates :permission_id, uniqueness: { scope: :role_id }
+
+    after_commit :clear_user_permission_caches
+
+    private
+
+    def clear_user_permission_caches
+      role.users.find_each do |user|
+        RailsIam::Authorization::Cache.delete_all(user.id)
+      end
+    end
+  end
+end

data/app/models/rails_iam/user.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module RailsIam
+  class User < ApplicationRecord
+    has_secure_password
+    include RailsIam::UserConcern
+
+    validates :email, presence: true, uniqueness: true
+    validates :password, presence: true, length: { minimum: 6, maximum: 20 }, if: :password
+    normalizes :email, with: ->(email) { email.to_s.downcase.strip }
+
+    def as_json(options = {})
+      super.except("password_digest")
+    end
+  end
+end

data/app/models/rails_iam/user_denied_permission.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module RailsIam
+  class UserDeniedPermission < ApplicationRecord
+    belongs_to :permission, class_name: "RailsIam::Permission"
+    belongs_to :user, class_name: RailsIam.configuration.user_class
+
+    validates :permission_id, uniqueness: { scope: :user_id }
+
+    after_commit -> { RailsIam::Authorization::Cache.delete_all(user_id) }
+  end
+end

data/app/models/rails_iam/user_permission.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module RailsIam
+  class UserPermission < ApplicationRecord
+    belongs_to :permission, class_name: "RailsIam::Permission"
+    belongs_to :user, class_name: RailsIam.configuration.user_class
+
+    validates :permission_id, uniqueness: { scope: :user_id }
+
+    after_commit -> { RailsIam::Authorization::Cache.delete_all(user_id) }
+  end
+end

data/app/models/rails_iam/user_role.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module RailsIam
+  class UserRole < ApplicationRecord
+    belongs_to :user, class_name: RailsIam.configuration.user_class
+    belongs_to :role, class_name: "RailsIam::Role"
+
+    validates :role_id, uniqueness: { scope: :user_id }
+
+    after_commit -> { RailsIam::Authorization::Cache.delete_all(user_id) }
+  end
+end

data/app/services/application_service.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+class ApplicationService
+end

data/app/services/rails_iam/authentication/authenticated_user.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authentication
+    AuthenticatedUser = Data.define(
+      :user,
+      :access_token,
+      :access_token_expires_in,
+      :refresh_token,
+      :refresh_token_expires_in,
+    )
+  end
+end

data/app/services/rails_iam/authentication/authenticator.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authentication
+    class Authenticator < RailsIam::RailsIamService
+      include RailsIam::ConfigLoader
+
+      def initialize(request, raise_on_failure: true)
+        super()
+        @request = request
+        @raise_on_failure = raise_on_failure
+      end
+
+      def call
+        token = TokenExtractor.call(request)
+
+        if token.blank?
+          return nil unless @raise_on_failure
+
+          raise RailsIam::Authentication::Exceptions::AuthenticationError, token_error
+        end
+
+        payload = JwtDecoder.call(token)
+
+        user = User.find_by(id: payload[:sub])
+
+        raise Authentication::Exceptions::AuthenticationError, token_error unless user
+
+        user
+      rescue JwtDecoder::InvalidToken => e
+        raise Authentication::Exceptions::AuthenticationError, e.message # => token_error
+      end
+
+      private
+
+      attr_reader :request
+    end
+  end
+end

data/app/services/rails_iam/authentication/current.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authentication
+    class Current < ActiveSupport::CurrentAttributes
+      attribute :user
+    end
+  end
+end

data/app/services/rails_iam/authentication/exceptions/authentication_error.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authentication
+    module Exceptions
+      class AuthenticationError < StandardError
+      end
+    end
+  end
+end

data/app/services/rails_iam/authentication/jwt_decoder.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require "jwt"
+
+module RailsIam
+  module Authentication
+    class JwtDecoder < RailsIam::RailsIamService
+      include RailsIam::ConfigLoader
+
+      class InvalidToken < StandardError; end
+
+      def initialize(token, headers = {})
+        super()
+        @token = token
+        @headers = headers
+      end
+
+      def call
+        decoded = JWT.decode(
+          token,
+          jwt_secret_key,
+          true,
+          { algorithm: jwt_algorithm, verify_jti: true }.merge(headers),
+        )
+
+        decoded.first.deep_symbolize_keys
+      rescue JWT::ExpiredSignature
+        raise InvalidToken, token_expired_error
+      rescue JWT::DecodeError
+        raise InvalidToken, token_error
+      end
+
+      private
+
+      attr_reader :token, :headers
+    end
+  end
+end

data/app/services/rails_iam/authentication/jwt_encoder.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authentication
+    class JwtEncoder < RailsIam::RailsIamService
+      def initialize(user, extra_claims = {}, headers = {})
+        super()
+        @user = user
+        @extra_claims = extra_claims
+        @headers = headers
+      end
+
+      def call
+        if jwt_secret_key.blank?
+          raise RailsIam::Authentication::Exceptions::AuthenticationError,
+                "Token generation failed due to a missing cryptographic configuration/jwt secret."
+        end
+
+        JWT.encode(payload, jwt_secret_key, jwt_algorithm, headers)
+      rescue JWT::EncodeError => e
+        raise RailsIam::Authentication::Exceptions::AuthenticationError e.message
+      end
+
+      private
+
+      attr_reader :user, :extra_claims, :headers
+
+      def payload
+        # Base claims recommended by RFC 7519 standards
+        claims = {
+          sub: user&.id.to_s, # Standards recommend 'sub' string values
+          email: user&.email,
+          iat: Time.current.to_i,
+          # nbf: Time.current.to_i, # Not Before: valid immediately
+          exp: jwt_expiry.from_now.to_i,
+        }
+
+        claims[:iss] = jwt_issuer if jwt_issuer.present?
+        claims[:aud] = jwt_audience if jwt_audience.present?
+
+        claims.merge(extra_claims)
+      end
+    end
+  end
+end

data/app/services/rails_iam/authentication/login.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authentication
+    class Login < RailsIam::RailsIamService
+      include RailsIam::ConfigLoader
+
+      def initialize(email:, password:, request: nil)
+        super()
+
+        @email = email.to_s.downcase.strip
+        @password = password
+        @request = request
+      end
+
+      def call
+        user = user_class.find_by(email: email)
+
+        raise RailsIam::Authentication::Exceptions::AuthenticationError, authentication_error unless user&.authenticate(password)
+
+        jti = SecureRandom.uuid
+
+        access_token = JwtEncoder.call(user, jti: jti)
+        refresh_token = RefreshTokenEncoder.call
+
+        if session_strategy == :single
+          ActiveRecord::Base.transaction do
+            remove_existing_sessions(user)
+            create_refresh_token(user, refresh_token, jti)
+          end
+        else
+          create_refresh_token(user, refresh_token, jti)
+        end
+
+        AuthenticatedUser.new(
+          user: user,
+          access_token: access_token,
+          refresh_token: refresh_token,
+          access_token_expires_in: access_token_expires_in.from_now,
+          refresh_token_expires_in: refresh_token_expires_in.from_now,
+        )
+      end
+
+      private
+
+      attr_reader :email, :password, :request
+
+      def remove_existing_sessions(user)
+        user.refresh_tokens.delete_all
+      end
+
+      def create_refresh_token(user, refresh_token, jti)
+        user.refresh_tokens.create!(refresh_token_attributes(refresh_token, jti))
+      end
+
+      def refresh_token_attributes(refresh_token, jti)
+        {
+          token_digest: Digest::SHA256.hexdigest(refresh_token),
+          expires_at: refresh_token_expires_in.from_now,
+          jti: jti,
+          ip_address: request&.remote_ip,
+          user_agent: request&.user_agent,
+        }
+      end
+    end
+  end
+end