rodauth-tools 0.3.1 → 0.4.1

data/lib/rodauth/features/table_guard.rb

@@ -136,30 +136,6 @@ module Rodauth
       mode_value != :silent && mode_value != :skip && !mode_value.nil?
     end
 
-    # Internal method called by auth_cached_method :table_configuration
-    #
-    # Discovers and returns table configuration. This is called lazily
-    # per-instance and the result is cached in @table_configuration.
-    #
-    # @return [Hash<Symbol, Hash>] Table configuration
-    def _table_configuration
-      config = Rodauth::TableInspector.table_information(self)
-      rodauth_debug("[table_guard] Discovered #{config.size} required tables") if ENV['RODAUTH_DEBUG']
-      config
-    end
-
-    # Internal method called by auth_cached_method :column_requirements
-    #
-    # Initializes and returns column requirements hash. This is called lazily
-    # per-instance and the result is cached in @column_requirements.
-    #
-    # Structure: { table_name => { column_name => { type:, null:, feature: } } }
-    #
-    # @return [Hash<Symbol, Hash<Symbol, Hash>>] Column requirements by table
-    def _column_requirements
-      {}
-    end
-
     # Check required tables and handle based on mode
     #
     # This is the main entry point for table validation
@@ -198,9 +174,14 @@ module Rodauth
     def missing_tables
       result = []
 
+      # Fetch the set of existing table names ONCE for this pass and reuse it
+      # across every table check, instead of running a catalog query per table
+      # (N+1). See #table_exists? for why the set is not cached on the instance.
+      existing = existing_table_names
+
       table_configuration.each do |method, info|
         table_name = info[:name]
-        next if table_exists?(table_name)
+        next if table_exists?(table_name, existing)
 
         result << {
           method: method,
@@ -222,33 +203,61 @@ module Rodauth
 
     # Check if a table exists in the database
     #
-    # Temporarily suppresses Sequel's logger to avoid confusing error logs
-    # when checking non-existent tables (Sequel logs SQLite exceptions before
-    # catching them internally).
+    # For the common case (an unqualified base table in the default schema) this
+    # matches against the database's table/view list rather than probing each
+    # table with a SELECT. Sequel's db.table_exists? probe logs the "no such
+    # table" exception before catching it internally, which an earlier
+    # implementation worked around by clearing and restoring the shared
+    # db.loggers array around the call. That mutation of shared connection state
+    # was not thread-safe: a concurrent query (e.g. when table_status/
+    # column_status are called at runtime) could execute while logging was
+    # disabled. Matching against the listed names avoids the failed probe
+    # entirely, so no logger suppression — and no shared-state mutation — is
+    # needed. Views are included (via db.views when the adapter supports it)
+    # because a Rodauth table can legitimately be backed by a view, which
+    # db.tables alone omits on most adapters.
+    #
+    # Schema-qualified names (a Symbol like :auth__accounts, a
+    # Sequel::SQL::QualifiedIdentifier, or a Sequel.qualify(...) result) are NOT
+    # reflected in db.tables (which returns unqualified names from the current
+    # search_path), so they take a separate, schema-aware path: we probe with
+    # db.table_exists?. That probe can emit Sequel's error-log noise, but it is
+    # confined to this rare qualified path and never fires for the common
+    # unqualified case that #116 was about.
+    #
+    # The optional existing_tables argument lets looping callers
+    # (missing_tables, table_status) build the existing-name Set ONCE per
+    # introspection pass and reuse it, avoiding N catalog queries. When omitted
+    # (the single-name public call) a fresh set is fetched — the set is
+    # deliberately NOT cached on the instance so runtime introspection does not
+    # go stale if tables are created after boot.
     #
-    # @param table_name [String, Symbol] Table name
+    # NOTE: On a genuine error we still fail open (assume the table exists) to
+    # preserve current behavior; switching this to fail closed is tracked in the
+    # table_guard hardening follow-up (issue #116).
+    #
+    # @param table_name [String, Symbol, Sequel::SQL::QualifiedIdentifier] Table name
+    # @param existing_tables [Set<Symbol>, nil] Pre-fetched existing table names
     # @return [Boolean] True if table exists
-    def table_exists?(table_name)
-      return true if table_guard_skip_tables.include?(table_name.to_sym) ||
-                     table_guard_skip_tables.include?(table_name.to_s)
-
-      # Temporarily suppress Sequel's logger to prevent confusing error logs
-      # during table existence checks. Sequel's table_exists? implementation
-      # attempts a SELECT query and logs the exception if table doesn't exist,
-      # even though it catches the error internally.
-      original_logger = db.loggers.dup
-      db.loggers.clear
-
-      db.table_exists?(table_name)
+    def table_exists?(table_name, existing_tables = nil)
+      # Symbol/String names may be skipped by configuration. A
+      # QualifiedIdentifier does not respond to to_sym, so guard the lookup.
+      if table_name.respond_to?(:to_sym) &&
+         (table_guard_skip_tables.include?(table_name.to_sym) ||
+          table_guard_skip_tables.include?(table_name.to_s))
+        return true
+      end
+
+      # Qualified names live outside the current search_path's unqualified
+      # listing, so probe them directly (schema-aware) rather than matching the
+      # Set. Rare path — the log noise this can produce does not hit boot.
+      return db.table_exists?(table_name) if qualified_table_name?(table_name)
+
+      existing_tables ||= existing_table_names
+      existing_tables.include?(table_name.to_sym)
     rescue StandardError => e
       rodauth_warn("[table_guard] Unable to check table existence for #{table_name}: #{e.message}")
-      true # Assume exists to avoid false positives
-    ensure
-      # Restore original loggers
-      if original_logger
-        db.loggers.clear
-        original_logger.each { |logger| db.loggers << logger }
-      end
+      true # Assume exists to avoid false positives (see hardening follow-up #116)
     end
 
     # List all required table names (sorted)
@@ -262,12 +271,15 @@ module Rodauth
     #
     # @return [Array<Hash>] Status information for each table
     def table_status
+      # Build the existing-name set once and reuse it (see missing_tables).
+      existing = existing_table_names
+
       table_configuration.map do |method, info|
         {
           method: method,
           table: info[:name],
           feature: info[:feature],
-          exists: table_exists?(info[:name])
+          exists: table_exists?(info[:name], existing)
         }
       end
     end
@@ -414,6 +426,89 @@ module Rodauth
 
     private
 
+    # Backing method for the +table_configuration+ auth_cached_method.
+    #
+    # Discovers and returns table configuration. This is called lazily
+    # per-instance and the result is cached in @table_configuration.
+    #
+    # Must stay private: rodauth registers it via auth_private_methods and (as
+    # of rodauth 2.45.0) warns when the backing method is not defined privately.
+    #
+    # @return [Hash<Symbol, Hash>] Table configuration
+    def _table_configuration
+      config = Rodauth::TableInspector.table_information(self)
+      rodauth_debug("[table_guard] Discovered #{config.size} required tables") if ENV['RODAUTH_DEBUG']
+      config
+    end
+
+    # Backing method for the +column_requirements+ auth_cached_method.
+    #
+    # Initializes and returns column requirements hash. This is called lazily
+    # per-instance and the result is cached in @column_requirements.
+    #
+    # Structure: { table_name => { column_name => { type:, null:, feature: } } }
+    #
+    # @return [Hash<Symbol, Hash<Symbol, Hash>>] Column requirements by table
+    def _column_requirements
+      {}
+    end
+
+    # Build the set of unqualified table names that currently exist, including
+    # views (which db.tables omits on most adapters but which can legitimately
+    # back a Rodauth table).
+    #
+    # Fetched fresh on each call — never memoized on the instance — so runtime
+    # introspection reflects tables created after boot. Looping callers pass the
+    # result into #table_exists? to fetch it only once per pass (see #116 / N+1).
+    #
+    # @return [Set<Symbol>] Existing base-table and view names
+    def existing_table_names
+      names = db.tables.map(&:to_sym)
+      names.concat(db.views.map(&:to_sym)) if db.respond_to?(:views)
+      # Set.new (not names.to_set): referencing the Set constant triggers its
+      # autoload on Ruby >= 3.2 (the gem's floor), whereas Enumerable#to_set is
+      # only defined once 'set' is already loaded. Using to_set here would rely
+      # on a dependency having required 'set' first and could otherwise raise
+      # NoMethodError. This also keeps Lint/RedundantRequireStatement satisfied.
+      Set.new(names)
+    end
+
+    # Determine whether a table identifier is schema-qualified.
+    #
+    # Qualified identifiers are not present in db.tables (which lists unqualified
+    # names from the current search_path), so #table_exists? routes them to a
+    # schema-aware probe instead of the Set match.
+    #
+    # Recognizes Sequel's qualified forms: a QualifiedIdentifier (from
+    # Sequel.qualify) and the implicit-qualification Symbol form :schema__table.
+    # A String with underscores is a literal name, not a qualification.
+    #
+    # @param table_name [Object] Table identifier
+    # @return [Boolean] True if schema-qualified
+    def qualified_table_name?(table_name)
+      return true if defined?(Sequel::SQL::QualifiedIdentifier) &&
+                     table_name.is_a?(Sequel::SQL::QualifiedIdentifier)
+
+      table_name.is_a?(Symbol) && table_name.to_s.include?('__')
+    end
+
+    # Resolve table_guard_mode to its symbol value, or nil when it is a
+    # block/Proc handler.
+    #
+    # A block handler (arity > 0) cannot be evaluated without arguments, and a
+    # 0-arity Proc is a custom handler rather than a mode symbol; in both cases
+    # there is no symbol to compare against, so we return nil. This lets callers
+    # do `%i[raise halt exit].include?(table_guard_mode_symbol)` safely instead
+    # of invoking table_guard_mode with the wrong arity.
+    #
+    # @return [Symbol, nil] the configured mode symbol, or nil for block/Proc handlers
+    def table_guard_mode_symbol
+      return nil if method(:table_guard_mode).arity > 0
+
+      value = table_guard_mode
+      value.is_a?(Proc) ? nil : value
+    end
+
     # Handle column validation based on mode setting
     #
     # @param missing_cols [Array<Hash>] Missing column information
@@ -608,22 +703,38 @@ module Rodauth
           return
         end
 
-        # Get all required tables from configuration
-        all_tables = table_configuration.map { |_, info| info[:name] }.uniq
-
-        # Drop all existing tables in reverse dependency order
-        rodauth_info("[table_guard] Recreating #{all_tables.size} table(s) (dropping all, creating fresh)...")
-        drop_tables(all_tables.reverse)
-
-        # Create all tables fresh (uses missing_tables which should now be all of them)
-        current_missing = missing_tables
-        current_missing_cols = missing_columns
-        if current_missing.any? || current_missing_cols.any?
-          generator_for_all = Rodauth::SequelGenerator.new(current_missing, self, current_missing_cols)
-          generator_for_all.execute_creates(db)
+        # Enumerate every table the enabled features' ERB templates create —
+        # including "hidden" tables such as account_statuses and
+        # account_password_hashes that have no *_table method (RT-09) — and drop
+        # them in FK-dependency order via the generator (the same path :sync
+        # already uses). The previous code dropped only the discovered *_table
+        # names in reversed hash order, so it left the hidden tables in place and
+        # the recreate step then failed with "table account_statuses already
+        # exists", making :recreate unusable with the default schema.
+        features = enabled_template_features
+
+        rodauth_info("[table_guard] Recreating tables for #{features.size} feature(s) " \
+                     '(dropping all, creating fresh)...')
+
+        # Wrap the whole drop+create cycle in one transaction so a failure
+        # part-way through cannot leave a partially dropped schema (RT-08).
+        # Transactional DDL is a no-op on MySQL (it auto-commits DDL), but it
+        # makes PostgreSQL and SQLite atomic, which is exactly where an
+        # out-of-order drop would otherwise destroy data and then fail.
+        db.transaction do
+          generator.execute_drops(db, features: features)
+
+          # Every required table is now missing, so recreate them all from the
+          # templates (base.erb brings back the hidden tables too).
+          current_missing = missing_tables
+          current_missing_cols = missing_columns
+          if current_missing.any? || current_missing_cols.any?
+            generator_for_all = Rodauth::SequelGenerator.new(current_missing, self, current_missing_cols)
+            generator_for_all.execute_creates(db)
+          end
         end
 
-        rodauth_info("[table_guard] Recreated #{all_tables.size} table(s)")
+        rodauth_info("[table_guard] Recreated tables for #{features.size} feature(s)")
 
         # Re-validate to show success message
         revalidate_after_creation
@@ -638,17 +749,24 @@ module Rodauth
           return
         end
 
-        # Get all required tables from configuration
-        all_tables = table_configuration.map { |_, info| info[:name] }.uniq
+        # Drop every table the enabled features' templates create, hidden
+        # tables included (RT-09), in FK-dependency order via the generator.
+        features = enabled_template_features
 
-        # Drop all existing tables in reverse dependency order
-        rodauth_info("[table_guard] Dropping #{all_tables.size} table(s)...")
-        drop_tables(all_tables.reverse)
+        rodauth_info("[table_guard] Dropping tables for #{features.size} feature(s)...")
 
-        # Drop Sequel migration tracking tables so migrations re-run from scratch
-        drop_tables(%i[schema_info schema_migrations])
+        # One transaction for the whole drop so it is atomic (RT-08).
+        db.transaction do
+          generator.execute_drops(db, features: features)
 
-        rodauth_info("[table_guard] Dropped #{all_tables.size} table(s) and migration tracking")
+          # Drop Sequel migration tracking tables so migrations re-run from
+          # scratch. These are independent leaf tables with no ordering
+          # constraints, so the simple helper is fine; keeping them in the same
+          # transaction makes the whole :drop atomic.
+          drop_tables(%i[schema_info schema_migrations])
+        end
+
+        rodauth_info("[table_guard] Dropped tables for #{features.size} feature(s) and migration tracking")
         rodauth_info('[table_guard] Migrations will run from scratch on next execution')
 
       else
@@ -657,7 +775,10 @@ module Rodauth
     rescue StandardError => e
       rodauth_error("[table_guard] Sequel generation failed: #{e.class} - #{e.message}")
       rodauth_error("  Location: #{e.backtrace.first}")
-      raise if %i[raise halt exit].include?(table_guard_mode)
+      # Use the resolved symbol mode: calling table_guard_mode directly would
+      # raise ArgumentError here when the user configured a block handler
+      # (arity > 0), masking the real error `e` we are trying to surface.
+      raise if %i[raise halt exit].include?(table_guard_mode_symbol)
     end
 
     # Check if the database supports CASCADE on DELETE
@@ -667,13 +788,37 @@ module Rodauth
       %i[postgres mysql].include?(db.database_type)
     end
 
-    # Drop tables with proper CASCADE handling for non-SQLite databases
+    # Feature names (matching ERB template basenames) for every discovered
+    # required table, de-duplicated.
+    #
+    # Used by :recreate/:drop to enumerate the full set of tables to drop from
+    # the templates — including hidden tables like account_statuses — rather
+    # than only the discovered *_table names. A feature whose template is
+    # missing simply contributes no tables (TemplateInspector returns [] for
+    # it), which is consistent with the create path, which likewise cannot
+    # build a table it has no template for.
+    #
+    # @return [Array<Symbol>] Enabled feature names that own required tables
+    def enabled_template_features
+      table_configuration.map { |_, info| info[:feature] }.compact.uniq
+    end
+
+    # Drop a set of independent tables (no inter-table foreign keys), with
+    # CASCADE where the adapter supports it.
+    #
+    # This helper does NOT order for foreign-key dependencies. The destructive
+    # sequel modes route their FK-ordered drops through
+    # SequelGenerator#execute_drops, which enumerates the templates (hidden
+    # tables included) and drops child-before-parent. This helper is now used
+    # only for the Sequel migration-tracking tables (:schema_info,
+    # :schema_migrations) in :drop mode, which have no ordering constraints. It
+    # opens no transaction of its own, so a caller can wrap it (together with
+    # execute_drops) in a single transaction for atomicity (RT-08).
     #
-    # SQLite doesn't support CASCADE on DROP TABLE, so we need to detect
-    # the database type and avoid using it. For other databases, CASCADE
-    # ensures dependent objects are properly cleaned up.
+    # SQLite doesn't support CASCADE on DROP TABLE, so we detect the database
+    # type and avoid it there.
     #
-    # @param table_names [Array<String, Symbol>] Tables to drop
+    # @param table_names [Array<String, Symbol>] Independent tables to drop
     def drop_tables(table_names)
       table_names.each do |table_name|
         next unless db.table_exists?(table_name)

data/lib/rodauth/secret_guard.rb

@@ -0,0 +1,137 @@
+# lib/rodauth/secret_guard.rb
+#
+# frozen_string_literal: true
+
+require 'securerandom'
+
+module Rodauth
+  # Shared, secret-kind-parameterized logic behind the +hmac_secret_guard+ and
+  # +jwt_secret_guard+ features.
+  #
+  # The two guard features are nearly identical; the only thing that differs is
+  # the "kind" of secret they manage (+:hmac+ or +:jwt+) and the names of the
+  # configuration methods that carry that kind as a prefix
+  # (+hmac_secret_env_key+ vs +jwt_secret_env_key+, and so on).
+  #
+  # Keeping this logic in one place — and taking +kind+ as an explicit argument
+  # rather than baking it into method names — is what lets both features be
+  # enabled at the same time. Each feature's +post_configure+ calls into these
+  # helpers with its own +kind+, so both secrets are validated at boot. When the
+  # per-feature methods shared a name (the previous design), enabling both
+  # guards meant one definition shadowed the other and only a single secret was
+  # ever validated.
+  #
+  # These are plain module functions that take the Rodauth instance explicitly
+  # (rather than being mixed in) so there is no method-name surface to collide
+  # in the first place.
+  module SecretGuard
+    module_function
+
+    # Auto-populate +<kind>_secret+ from its environment variable when it has
+    # not been configured explicitly.
+    #
+    # The variable is read with +ENV.delete+ so the raw secret does not linger
+    # in the process environment after boot. A blank (nil/empty/whitespace-only)
+    # value is treated as absent and leaves the secret unset for +validate!+ to
+    # handle.
+    #
+    # @param rodauth [Rodauth::Auth] the Rodauth instance being configured
+    # @param kind [Symbol] the secret kind (+:hmac+ or +:jwt+)
+    # @return [void]
+    def load_from_env!(rodauth, kind)
+      return unless blank?(rodauth.send(:"#{kind}_secret"))
+
+      raw = ENV.delete(rodauth.send(:"#{kind}_secret_env_key"))
+      value = raw&.strip
+      return if value.nil? || value.empty?
+
+      define_secret(rodauth, kind, value)
+    end
+
+    # Validate that +<kind>_secret+ is usable.
+    #
+    # In production a missing (nil/empty/whitespace-only) or too-short secret
+    # raises +Rodauth::ConfigurationError+ — the guard fails closed. Outside
+    # production a missing secret logs a warning and falls back to the
+    # (ephemeral, per-process) development fallback.
+    #
+    # @param rodauth [Rodauth::Auth] the Rodauth instance being configured
+    # @param kind [Symbol] the secret kind (+:hmac+ or +:jwt+)
+    # @raise [Rodauth::ConfigurationError] when the secret is unusable in production
+    # @return [void]
+    def validate!(rodauth, kind)
+      current = rodauth.send(:"#{kind}_secret")
+
+      unless blank?(current)
+        enforce_minimum_length!(rodauth, kind, current)
+        return
+      end
+
+      raise Rodauth::ConfigurationError, rodauth.send(:"#{kind}_secret_missing_error") if rodauth.production?
+
+      warn(rodauth, rodauth.send(:"#{kind}_secret_dev_warning"))
+      define_secret(rodauth, kind, rodauth.send(:"development_#{kind}_secret_fallback"))
+    end
+
+    # Resolve the configured production check into a boolean.
+    #
+    # A Proc is evaluated in the Rodauth instance context (so it can read config
+    # methods); anything else is coerced with +!!+.
+    #
+    # @param rodauth [Rodauth::Auth] the Rodauth instance being configured
+    # @return [Boolean]
+    def production?(rodauth)
+      check = rodauth.send(:production_env_check)
+      check.is_a?(Proc) ? rodauth.instance_exec(&check) : !!check
+    end
+
+    # Enforce +minimum_secret_length+ when it is configured (> 0).
+    #
+    # Only applied in production so development fallbacks and short test secrets
+    # are unaffected. Disabled by default.
+    #
+    # @return [void]
+    def enforce_minimum_length!(rodauth, kind, value)
+      minimum = rodauth.send(:minimum_secret_length).to_i
+      return if minimum <= 0
+      return unless rodauth.production?
+      return if value.to_s.strip.length >= minimum
+
+      # Name the secret generically and cite both configuration avenues: the
+      # value may have come from the env var OR from the #{kind}_secret DSL
+      # method, so blaming the env key alone would mislead when a short secret
+      # was configured directly.
+      key = rodauth.send(:"#{kind}_secret_env_key")
+      raise Rodauth::ConfigurationError,
+            "#{kind.to_s.upcase} secret must be at least #{minimum} characters in production " \
+            "(set via #{key} or #{kind}_secret)"
+    end
+
+    # @return [Boolean] true when the value is nil, empty, or whitespace-only
+    def blank?(value)
+      value.nil? || value.to_s.strip.empty?
+    end
+
+    # Redefine +<kind>_secret+ on the Rodauth subclass to return +value+.
+    #
+    # This mirrors how Rodauth features memoize resolved config: the auth class
+    # is per-configuration and this runs once, single-threaded, at boot.
+    #
+    # @return [void]
+    def define_secret(rodauth, kind, value)
+      rodauth.class.send(:define_method, :"#{kind}_secret") { value }
+    end
+
+    # Emit a development warning via the Rodauth logger when present, otherwise
+    # to stderr.
+    #
+    # @return [void]
+    def warn(rodauth, message)
+      if rodauth.respond_to?(:logger) && rodauth.logger
+        rodauth.logger.warn(message)
+      else
+        Kernel.warn(message)
+      end
+    end
+  end
+end

data/lib/rodauth/sequel_generator.rb

@@ -263,12 +263,22 @@ module Rodauth
 
     # Execute DROP TABLE operations directly against the database
     #
-    # Uses TemplateInspector to extract ALL tables from ERB templates.
+    # Uses TemplateInspector to extract ALL tables from ERB templates,
+    # including "hidden" tables (account_statuses, account_password_hashes)
+    # that have no corresponding *_table method.
+    #
+    # By default the feature set is derived from missing_tables (the :sync
+    # path). Callers that need to drop the full schema regardless of what is
+    # currently missing — :recreate and :drop, where nothing may be "missing" —
+    # pass an explicit +features+ list so the template enumeration still covers
+    # every enabled feature (and therefore the hidden tables).
     #
     # @param db [Sequel::Database] Database connection
-    def execute_drops(db)
+    # @param features [Array<Symbol>, nil] Explicit feature list to enumerate;
+    #   when nil, features are inferred from missing_tables
+    def execute_drops(db, features: nil)
       # Extract all tables from ERB templates
-      all_tables = extract_all_tables_from_templates
+      all_tables = extract_all_tables_from_templates(features: features)
 
       # Drop in reverse order to handle foreign key dependencies
       ordered_tables = order_tables_for_drop(all_tables).reverse
@@ -336,9 +346,11 @@ module Rodauth
     # like account_statuses and account_password_hashes that don't have
     # corresponding *_table methods in Rodauth.
     #
+    # @param features [Array<Symbol>, nil] Explicit feature list; when nil,
+    #   features are inferred from missing_tables (the :sync/codegen default)
     # @return [Array<Symbol>] Array of all table names
-    def extract_all_tables_from_templates
-      features = extract_features_from_missing_tables
+    def extract_all_tables_from_templates(features: nil)
+      features ||= extract_features_from_missing_tables
       table_prefix = extract_table_prefix
       db_type = extract_db_type
 

data/lib/rodauth/table_inspector.rb

@@ -97,7 +97,7 @@ module Rodauth
         next unless feature_module
 
         # Check if this feature module defines the table method
-        return feature_name if feature_module.instance_methods(false).include?(method_name)
+        return feature_name if feature_module.method_defined?(method_name, false)
       end
 
       # Fallback: try to infer from method name if not found in any feature