tolaria 1.0.0

data/app/helpers/admin/view_helper.rb

@@ -0,0 +1,76 @@
+module Admin::ViewHelper
+
+  ADMIN_PILL_COLORS = HashWithIndifferentAccess.new({
+    green: "3BAB46",
+    red: "DA3946",
+    blue: "3497BE",
+    black: "343242",
+    grey: "777777",
+  })
+
+  # Returns a navigation menu link with the given label,
+  # Font Awesome icon name, and URI
+  def tolaria_navigation_link(label, icon, index_path, options = {})
+    options[:class] = "#{options[:class]} current" if index_path.in?(url_for)
+    link_to index_path, options do
+      fontawesome_icon(icon) << " #{label}"
+    end
+  end
+
+  # Returns an `<i>` tag that displays a Font Awesome icon
+  def fontawesome_icon(icon = "", options = {})
+    icon = icon.to_s.parameterize.tr("_", "-")
+    content_tag :i, nil, options.reverse_merge({
+      :class => "icon icon-#{icon}",
+      :"aria-hidden" => true,
+    })
+  end
+
+  # Returns a URI to a Gravatar for the given email
+  def gravatar_for(email)
+    digest = Digest::MD5.hexdigest(email)
+    return "https://secure.gravatar.com/avatar/#{digest}?d=retro&s=36"
+  end
+
+  # Returns true if a partial is available at "admin/#{template_path}"
+  def admin_template_exists?(template_path)
+    lookup_context.template_exists?("admin/#{template_path}", [], true)
+  end
+
+  # True if Ransack filtering parameters are present
+  def currently_filtering?
+    params[:q].present? && params[:q].is_a?(Hash) && params[:q].keys.reject{|key| key == "s"}.any?
+  end
+
+  # Attempt to automatically construct a default text search
+  # field name for Ransack from a given model's table settings
+  def ransack_text_search_chain(model)
+    textual_columns = model.columns_hash.select do |column, settings|
+      settings.sql_type.include?("char") || settings.sql_type.include?("text")
+    end
+    textual_columns = {id:"id"} if textual_columns.none?
+    return %{#{textual_columns.keys.join("_or_")}_cont}.to_sym
+  end
+
+  # Returns a deletion warning message for the given ActiveRecord instance
+  def deletion_warning(resource)
+    return %{Are you sure you want to delete the #{resource.model_name.human.downcase} “#{Tolaria.display_name(resource)}”? This action is not reversible.}
+  end
+
+  # Returns a `<span>` tag that displays the given +label+ as a pill
+  # status badge. You can change the color of the pill by providing a
+  # six-digit hexadecimal +color+, or passing one of the predefined
+  # color names: `:green`, `:red`, `:blue`, `:black`, `:grey`.
+  def pill(label, color: :black)
+
+    if ADMIN_PILL_COLORS[color].present?
+      color = ADMIN_PILL_COLORS[color]
+    else
+      color = color.to_s.delete("#")
+    end
+
+    content_tag :span, label.to_s, class:"pill", style:"background-color:##{color}"
+
+  end
+
+end

data/app/mailers/passcode_mailer.rb

@@ -0,0 +1,11 @@
+class PasscodeMailer < ActionMailer::Base
+
+  default from:Tolaria.config.from_address
+
+  def passcode(administrator, passcode)
+    @administrator = administrator
+    @passcode = passcode
+    mail(to:administrator.email, subject:"#{Tolaria.config.company_name} Passcode")
+  end
+
+end

data/app/models/administrator.rb

@@ -0,0 +1,146 @@
+class Administrator < ActiveRecord::Base
+
+  after_initialize :initialize_authentication!
+  before_validation :normalize_email!
+
+  # -----------------------------------------------------------------------------
+  # VALIDATIONS
+  # Use some extra validation redundancy
+  # -----------------------------------------------------------------------------
+
+  validates :email, {
+    uniqueness: true,
+    # Don't try to predict all of the possible crazy emails people can have
+    # Just validate that there is one @ and at least one dot: *@*.*
+    format: /\A[^@\s]+@([^@\s]+\.)+[^@\s]+\z/
+  }
+
+  # Require all user-visible fields
+  validates_presence_of :name
+  validates_presence_of :organization
+
+  # Parts of the admin system should not be empty
+  validates_presence_of :auth_token
+  validates_presence_of :passcode
+  validates_presence_of :passcode_expires_at
+  validates_presence_of :account_unlocks_at
+
+  # Downcase and strip whitespace from the current email
+  def normalize_email!
+    self.email = self.email.to_s.downcase.squish
+  end
+
+  # -----------------------------------------------------------------------------
+  # AUTHENTICATION SYSTEM
+  # The admin must request a passcode challenge via email
+  # To pass the challenge, the admin must enter the correct email address
+  # and passcode inside the time window
+  # -----------------------------------------------------------------------------
+
+  # Initialize +passcode+, +passcode_expires_at+,
+  # +auth_token+, and +account_unlocks_at+ for a new admin.
+  # To prevent passcode system fields from being null,
+  # we fill them with an immediately expired passcode.
+  def initialize_authentication!
+    self.passcode ||= BCrypt::Password.create(Tolaria::RandomTokens.passcode, cost:Tolaria.config.bcrypt_cost)
+    self.passcode_expires_at ||= Time.current
+    self.auth_token ||= Tolaria::RandomTokens.auth_token
+    self.account_unlocks_at ||= Time.current
+  end
+
+  # Send a passcode challenge email to the admin
+  def send_passcode_email!
+    plaintext_passcode = self.set_passcode!
+    PasscodeMailer.passcode(self, plaintext_passcode).deliver_now
+  end
+
+  # Generate a new passcode challenge.
+  # Create a passcode, save it, and set an expiration window.
+  # Returns the plaintext passcode to send to the user.
+  def set_passcode!
+    plaintext_passcode = Tolaria::RandomTokens.passcode
+    self.update!(
+      passcode: BCrypt::Password.create(plaintext_passcode, cost:Tolaria.config.bcrypt_cost),
+      passcode_expires_at: Time.current + Tolaria.config.passcode_lifespan,
+    )
+    return plaintext_passcode
+  end
+
+  # Attempt to authenticate the account with the given plaintext +passcode+.
+  # Returns true if the passcode was valid, false otherwise.
+  def authenticate!(passcode)
+
+    # Always run bcrypt first so that we incur the time penalty
+    bcrypt_valid = BCrypt::Password.new(self.passcode) == passcode
+
+    # Reject if currently locked
+    return false if self.locked?
+
+    # Clear strikes and consume the passcode if the passcode was valid.
+    # Reject and incur a strike if the challenge was failed.
+    if bcrypt_valid && Time.current < self.passcode_expires_at
+      self.consume_passcode!
+      return true
+    else
+      self.accrue_strike!
+      return false
+    end
+
+  end
+
+  # Immediately expire the current passcode and reset lockout strikes.
+  def consume_passcode!
+    self.update!(
+      passcode_expires_at: Time.current,
+      lockout_strikes: 0,
+    )
+  end
+
+  # Add one strike to the account.
+  # An admin is given a strike for requesting a code or flunking a challenge.
+  # Will lock the account if they’ve hit the threshold.
+  def accrue_strike!
+    self.update!(
+      lockout_strikes: self.lockout_strikes + 1,
+      total_strikes: self.total_strikes + 1,
+    )
+    if self.lockout_strikes >= Tolaria.config.lockout_threshold
+      self.lock_account!
+    end
+  end
+
+  # Lock this account immediately and reset lockout strikes.
+  def lock_account!
+    self.update!(
+      account_unlocks_at: Time.current + Tolaria.config.lockout_duration,
+      lockout_strikes: 0,
+    )
+  end
+
+  # Unlock the user’s account. Currently only usable by someone
+  # with Rails console access.
+  def unlock_account!
+    self.update!(
+      account_unlocks_at: Time.current,
+      lockout_strikes: 0,
+    )
+  end
+
+  # True if the account is currently inside a lockout window
+  def locked?
+    return Time.current < self.account_unlocks_at
+  end
+
+  # -----------------------------------------------------------------------------
+  # MANAGE
+  # Register this model with Tolaria
+  # -----------------------------------------------------------------------------
+
+  manage_with_tolaria using: {
+    icon: "shield",
+    category: "Settings",
+    priority: 100,
+    permit_params: %i[email name organization],
+  }
+
+end

data/app/views/admin/administrators/_form.html.erb

@@ -0,0 +1,16 @@
+<%= f.label :email %>
+<%= f.text_field :email, placeholder:"lovelace@example.org" %>
+<%= f.hint %{
+  The email address this administrator will use to sign in.
+  Administrators have the power to change site content, and can create other administrators.
+  Only people who work directly on web content should be given accounts.
+} %>
+
+<%= f.label :name %>
+<%= f.text_field :name, placeholder:"Ada Lovelace" %>
+<%= f.hint "The full name of this person." %>
+
+<%= f.label :organization %>
+<%= f.text_field :organization, placeholder:"Analytical Engineering" %>
+<%= f.hint "This person's organization or department." %>
+

data/app/views/admin/administrators/_index.html.erb

@@ -0,0 +1,20 @@
+<table class="index-table">
+  <thead>
+    <tr>
+      <%= index_th :id %>
+      <%= index_th :name %>
+      <%= index_th :organization %>
+      <%= actions_th %>
+    </tr>
+  </thead>
+  <tbody>
+    <% @resources.each do |resource| %>
+      <tr>
+        <%= index_td resource, :id %>
+        <%= index_td resource, :name, image:gravatar_for(resource.email) %>
+        <%= index_td resource, :organization %>
+        <%= actions_td resource %>
+      </tr>
+    <% end %>
+  </tbody>
+</table>

data/app/views/admin/administrators/_search.html.erb

@@ -0,0 +1,5 @@
+<%= f.label :email_cont, "Email contains" %>
+<%= f.search_field :email_cont, placeholder:"Contains anything" %>
+
+<%= f.label ransack_text_search_chain(@managed_class.klass), "Containing the text" %>
+<%= f.search_field ransack_text_search_chain(@managed_class.klass), placeholder:"Anything" %>

data/app/views/admin/administrators/_show.html.erb

@@ -0,0 +1,14 @@
+<%= show_table do %>
+
+  <thead>
+    <%= show_thead_tr %>
+  </thead>
+  <tbody>
+    <%= show_tr "Avatar", image_tag(gravatar_for(@resource.email)) %>
+    <%= show_tr :name %>
+    <%= show_tr :organization %>
+    <%= show_tr :email, class:"monospace" %>
+    <%= show_tr "Created At", @resource.created_at.presence.try(:strftime, "%Y-%m-%d %I:%M %p"), class:"monospace" %>
+  </tbody>
+
+<% end %>

data/app/views/admin/help/help_link.html.erb

@@ -0,0 +1,16 @@
+<%= content_for :title, @help_link.title %>
+
+<div class="main-controls">
+
+  <div class="main-controls-left">
+    <h1>
+      <%= fontawesome_icon :info_circle %>
+      <%= content_for :title %>
+    </h1>
+  </div>
+
+</div>
+
+<div class="help-link-body markdown-body">
+  <%= Tolaria.render_markdown(File.read(@help_link.markdown_file)) %>
+</div>

data/app/views/admin/session/form.html.erb

@@ -0,0 +1,52 @@
+<%= form_for @admin, url:admin_signin_path, html:{id:"session-form", class:"session-form"} do |f| %>
+
+  <h1><%= @greeting %></h1>
+
+  <div class="session-spinner" id="session-spinner" style="display:none"></div>
+
+  <% if flash[:error] || flash[:success] %>
+    <p class="session-form-feedback" id="session-form-feedback">
+      <%= flash[:error] %> <%= flash[:success] %>
+    </p>
+  <% else %>
+    <p class="session-form-feedback" id="session-form-feedback" style="display:none"></p>
+  <% end %>
+
+  <%= f.label :email, "Email address", for:"session-form-email", class:"visuallyhidden" %>
+  <%= f.email_field :email, {
+    id: "session-form-email",
+    placeholder: "Enter your email address",
+    autocorrect: "off",
+    autocapitalize: "none",
+    tabindex: 1,
+    value: @email,
+  } %>
+
+  <%= f.label :passcode, "Passcode", for:"session-form-passcode", class:"visuallyhidden" %>
+  <%= f.text_field :passcode, {
+    id: "session-form-passcode",
+    placeholder: "Passcode",
+    autocorrect: "off",
+    autocomplete: "off",
+    spellcheck: "false",
+    pattern: "[0-9]*",
+    tabindex: 2,
+    style: "display:none"
+  } %>
+
+  <%= f.button "Request a passcode", type:"submit", id:"session-form-submit", class:"session-button" %>
+
+  <div id="session-form-remember-group" class="session-form-checkbox-group" style="display:none">
+    <%= hidden_field_tag :remember_me, 1 %>
+    <%= check_box_tag :remember_me, 1, true, {
+      class: "session-form-remember",
+      id: "session-form-remember"
+    } %>
+    <%= label_tag "session-form-remember", "Remember this device" %>
+  </div>
+
+  <p class="session-form-resend" id="session-form-resend" style="display:none">
+    <button type="button">Request another code</button>
+  </p>
+
+<% end %>

data/app/views/admin/shared/_flash_messages.html.erb

@@ -0,0 +1,42 @@
+<% if flash[:success].present? %>
+
+  <div class="flash-message">
+    <div class="inner-align">
+      <button class="dismiss">Dismiss</button>
+      <p><%= fontawesome_icon :check %> <%= flash[:success] %></p>
+    </div>
+  </div>
+
+<% elsif flash[:error].present? %>
+
+  <div class="flash-message -error">
+    <div class="inner-align">
+      <button class="dismiss">Dismiss</button>
+      <p>
+        <%= fontawesome_icon :exclamation_triangle %> <%= flash[:error] %>
+        <% if defined?(@resource) && @resource.respond_to?(:errors) && @resource.errors.any? %>
+          <%= @resource.errors.full_messages.to_sentence.capitalize %>.
+        <% end %>
+      </p>
+    </div>
+  </div>
+
+<% elsif flash[:destructive].present? %>
+
+  <div class="flash-message">
+    <div class="inner-align">
+      <button class="dismiss">Dismiss</button>
+      <p><%= fontawesome_icon :trash %> <%= flash[:destructive] %></p>
+    </div>
+  </div>
+
+<% elsif flash[:restricted].present? %>
+
+  <div class="flash-message -error">
+    <div class="inner-align">
+      <button class="dismiss">Dismiss</button>
+      <p><%= fontawesome_icon :minus_circle %> <%= flash[:restricted] %></p>
+    </div>
+  </div>
+
+<% end %>

data/app/views/admin/shared/_footer.html.erb

@@ -0,0 +1,8 @@
+<div class="footer">
+  <div class="inner-align">
+    <p>
+      <%= "© #{Time.current.year} #{Tolaria.config.company_name}." %>
+      Information may be proprietary or confidential.
+    </p>
+  </div>
+</div>

data/app/views/admin/shared/_head.html.erb

@@ -0,0 +1,11 @@
+<head>
+  <meta charset="utf-8">
+  <title><%= "#{content_for(:title)} • " if content_for(:title) %><%= Tolaria.config.company_name %></title>
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <meta name="robots" content="noindex">
+  <meta name="google" content="notranslate">
+  <%= favicon_link_tag "admin/favicon.ico" %>
+  <%= csrf_meta_tags %>
+  <%= stylesheet_link_tag "admin/admin", media:"all" %>
+  <%= javascript_include_tag "admin/lib/no" %>
+</head>

data/app/views/admin/shared/_header.html.erb

@@ -0,0 +1,43 @@
+<div class="header-stripe"></div>
+
+<div class="header">
+  <div class="inner-align">
+
+    <%= link_to Tolaria.config.default_redirect, class:"header-menu-trigger mobile-only" do %>
+      <span><%= fontawesome_icon :bars %> <%= Tolaria.config.company_name %></span>
+    <% end %>
+
+    <%= link_to Tolaria.config.default_redirect, class:"header-app-title" do %>
+      <%= Tolaria.config.company_name %>
+    <% end %>
+
+    <ul class="header-user-controls">
+
+      <% Tolaria.help_links.each do |help_link| %>
+        <% if help_link.markdown_type? %>
+          <li><%= link_to help_link.title, admin_help_link_path(help_link), class:"header-help-link", target:"_blank" %></li>
+        <% else %>
+          <li><%= link_to help_link.title, help_link.link_to, class:"header-help-link", target:"_blank" %></li>
+        <% end %>
+      <% end %>
+
+      <li>
+        <%= link_to edit_admin_administrator_path(current_administrator), class:"header-user-profile desktop-only" do %>
+          <%= image_tag gravatar_for(current_administrator.email), alt:"", size:"18x18" %>
+          <%= current_administrator.name %>
+        <% end %>
+      </li>
+
+      <li>
+        <%= form_tag admin_destroy_session_path, method:"delete" do %>
+          <%= button_tag class:"header-user-signout" do %>
+            <%= fontawesome_icon :sign_out %>
+            Sign Out
+          <% end %>
+        <% end %>
+      </li>
+
+    </ul>
+
+  </div>
+</div>