trek 2.5.0 → 2.6.0

data/lib/generators/trek/public_accounts_generator.rb

@@ -0,0 +1,267 @@
+require "rails/generators/named_base"
+require "rails/generators/migration"
+require "generators/trek/helpers"
+
+module Trek
+  module Generators
+    # Accounts for the site's or the mobile app's users (customers, members…), apart from the admin's
+    # User: their own model, table, sessions and sign-in, so nothing public can reach a staff account.
+    #
+    # They sign in one way, picked with --sign-in:
+    #
+    # - `code` (default): a code emailed to them, which creates the account the first time;
+    # - `password`: a password chosen on signing up, the email confirmed by a link, and reset by one.
+    #
+    # By default for a website: pages, and sessions kept in a cookie. With --api, for a mobile app:
+    # JSON endpoints, and sessions held through a JWT instead. With --model-only, neither: the models,
+    # mails and specs, for an app whose sign-in is its own (e.g. an API ported from another app).
+    class PublicAccountsGenerator < Rails::Generators::NamedBase
+      # Taken by the admin's account and Trek's own models, or planned for Trek 3 (Staff::User).
+      RESERVED_NAMES = %w[User Staff Session Current Page PagePath PageVersion Fragment MenuNode Tag Tagging TagCategory
+                          ExternalLink AuditLog Dashboard].freeze
+      SIGN_INS = %w[code password].freeze
+      JWT_VERSION = "~> 3.1".freeze
+
+      include Rails::Generators::Migration
+      include Trek::Generators::Helpers
+
+      desc "Create accounts for the site's or the app's users, apart from the admin's: " \
+        "rails g trek:public_accounts Customer [--sign-in=code|password] [--api] [--path=customers] [--model-only]"
+
+      class_option :sign_in, type: :string, default: "code", enum: SIGN_INS,
+        desc: "How accounts sign in: with a code emailed to them, or with a password"
+      class_option :api, type: :boolean, default: false,
+        desc: "JSON endpoints and JWTs for a mobile app, instead of pages and a cookie"
+      class_option :path, type: :string, default: nil,
+        desc: "A path to put the routes under, e.g. members for /members/sign-in"
+      class_option :model_only, type: :boolean, default: false,
+        desc: "Only the models, mails and specs: no controllers, pages, routes nor tokens, the app signs in its own way"
+
+      source_root File.expand_path("templates/public_accounts", __dir__)
+
+      def check_name
+        return unless class_name.include?("::") || RESERVED_NAMES.include?(class_name)
+
+        raise Thor::Error, "#{class_name} can't be a public account model: pick a top-level name of the app's domain " \
+          "(Customer, Member, Reader…), other than #{RESERVED_NAMES.to_sentence(last_word_connector: " or ")}."
+      end
+
+      def check_options
+        return unless model_only? && (api? || options[:path].present?)
+
+        raise Thor::Error, "--model-only adds no endpoints nor routes: drop --api and --path."
+      end
+
+      def add_jwt_gem
+        return unless api?
+        return if in_gemfile?("jwt")
+
+        gem "jwt", JWT_VERSION
+        bundle_install
+      end
+
+      def copy_models
+        template "models/account.rb.tt", "app/models/#{file_name}.rb"
+        template "models/account/session.rb.tt", "app/models/#{file_name}/session.rb"
+        template "models/account/sign_in_code.rb.tt", "app/models/#{file_name}/sign_in_code.rb" if code?
+      end
+
+      def copy_migration
+        return unless defined?(ActiveRecord)
+
+        migration_template "migrations/create_accounts.rb.tt", "db/migrate/trek_create_#{table_name}.rb",
+          migration_class_name:
+      end
+
+      def add_current_attributes
+        inject_into_class "app/models/current.rb", "Current", <<-RUBY
+# The signed-in #{human_name.downcase} (#{model_only? ? "set by the app's own sign-in" : "#{accounts_module}::Authentication"})
+attribute :#{file_name}_session
+delegate :#{file_name}, to: :#{file_name}_session, allow_nil: true
+
+        RUBY
+      end
+
+      def copy_authentication_concern
+        return if model_only?
+
+        template "#{mode}/authentication.rb.tt", "app/controllers/concerns/#{accounts_path}/authentication.rb"
+      end
+
+      # Every page of the site may show who is signed in. The API's controllers include it in their
+      # base controller instead.
+      def include_authentication_in_application_controller
+        return unless web?
+
+        inject_into_class "app/controllers/application_controller.rb", "ApplicationController",
+          "  include #{accounts_module}::Authentication\n"
+      end
+
+      def copy_controllers
+        return if model_only?
+
+        controllers.each do |controller|
+          template "#{mode}/controllers/#{controller}_controller.rb.tt", "app/controllers/#{controllers_path}/#{controller}_controller.rb"
+        end
+      end
+
+      def copy_views
+        return unless web?
+
+        template "web/views/_flash.html.slim.tt", "app/views/#{controllers_path}/_flash.html.slim"
+        views.each do |view|
+          template "web/views/#{view}.html.slim.tt", "app/views/#{controllers_path}/#{view}.html.slim"
+        end
+      end
+
+      def copy_job
+        template "jobs/sign_in_code_job.rb.tt", "app/jobs/#{accounts_path}/sign_in_code_job.rb" if code?
+      end
+
+      def copy_mailer
+        template "mailers/account_mailer.rb.tt", "app/mailers/#{file_name}_mailer.rb"
+        mails.product(%w[en fr], %w[html.slim text.erb]).each do |mail, locale, format|
+          template "views/mailer/#{mail}.#{locale}.#{format}.tt", "app/views/#{file_name}_mailer/#{mail}.#{locale}.#{format}"
+        end
+      end
+
+      def copy_locales
+        %w[en fr].each do |locale|
+          template "locales/accounts.#{locale}.yml.tt", "config/locales/#{accounts_path}.#{locale}.yml"
+        end
+      end
+
+      def add_routes
+        route routes unless model_only?
+      end
+
+      def copy_specs
+        return unless File.directory?(File.join(destination_root, "spec"))
+
+        template "spec/models/account_spec.rb.tt", "spec/models/#{file_name}_spec.rb"
+        template "spec/models/account/sign_in_code_spec.rb.tt", "spec/models/#{file_name}/sign_in_code_spec.rb" if code?
+        return if model_only?
+
+        template "spec/#{mode}/sign_ins_spec.rb.tt", "spec/requests/#{controllers_path}/sign_ins_spec.rb"
+        template "spec/#{mode}/accounts_spec.rb.tt", "spec/requests/#{controllers_path}/accounts_spec.rb"
+        return if api?
+
+        template "spec/web/authentication_spec.rb.tt", "spec/controllers/application_controller_#{accounts_path}_spec.rb"
+      end
+
+      private
+
+      def code? = options[:sign_in] == "code"
+      def password? = options[:sign_in] == "password"
+      def api? = options[:api]
+      def model_only? = options[:model_only]
+      # Pages and a cookie: neither --api nor --model-only
+      def web? = !api? && !model_only?
+      def mode = api? ? "api" : "web"
+      # With trek:install:audit_log, which the account controllers write to
+      def audit_log? = File.exist?(File.join(destination_root, "app/models/audit_log.rb"))
+
+      # Customers: the module of the authentication concern, and the folder of its files.
+      def accounts_module = class_name.pluralize
+      def accounts_path = file_name.pluralize
+
+      # The controllers' module and folder: under Api::V1:: for the API, the first version of it, so that a
+      # later version can be served next to it while older releases of the mobile app still use this one.
+      def controllers_module = api? ? "Api::V1::#{accounts_module}" : accounts_module
+      def controllers_path = api? ? "api/v1/#{accounts_path}" : accounts_path
+
+      # The route helpers' prefix: customer_sign_in_path, api_v1_customer_sign_in_path…
+      def route_prefix = api? ? "api_v1_#{file_name}" : file_name
+
+      # Where the routes go: /sign-in, /members/sign-in, /api/v1/sign-in…
+      def routes_path = [("api/v1" if api?), options[:path].presence].compact.join("/").presence
+
+      def controllers
+        names = code? ? %w[sign_in_codes sessions] : %w[registrations sessions password_resets email_confirmations passwords]
+        %w[base] + names + %w[accounts email_changes active_sessions]
+      end
+
+      def views
+        shared = %w[sessions/new accounts/show email_changes/new]
+        if code?
+          shared + %w[sign_in_codes/new email_changes/edit]
+        else
+          shared + %w[registrations/new password_resets/new password_resets/edit passwords/edit]
+        end
+      end
+
+      def mails
+        code? ? %w[sign_in_code email_change_code] : %w[email_confirmation password_reset email_change sign_in_locked]
+      end
+
+      # On paths of their own rather than the model's name, so renaming the model keeps them.
+      def routes
+        scope = [(%("#{routes_path}") if routes_path), "module: \"#{controllers_path}\"", "as: :#{route_prefix}"].compact
+        scope << "defaults: { format: :json }" if api?
+
+        <<~RUBY
+          # #{human_name.pluralize}' accounts (#{accounts_module}::Authentication)
+          scope #{scope.join(", ")} do
+          #{(api? ? api_routes : web_routes).gsub(/^/, "  ")}end
+        RUBY
+      end
+
+      def web_routes
+        sign_in = if code?
+          <<~RUBY
+            get "sign-in", to: "sign_in_codes#new", as: :sign_in
+            post "sign-in", to: "sign_in_codes#create"
+            get "sign-in/code", to: "sessions#new", as: :sign_in_code
+            post "sign-in/code", to: "sessions#create"
+          RUBY
+        else
+          <<~RUBY
+            get "sign-in", to: "sessions#new", as: :sign_in
+            post "sign-in", to: "sessions#create"
+            get "sign-up", to: "registrations#new", as: :sign_up
+            post "sign-up", to: "registrations#create"
+            resource :password_reset, only: %i[new create edit update], path: "password-reset"
+            get "account/confirm", to: "email_confirmations#show", as: :email_confirmation
+            post "account/confirm", to: "email_confirmations#create"
+            resource :password, only: %i[edit update], path: "account/password"
+          RUBY
+        end
+
+        sign_in + <<~RUBY
+          delete "sign-out", to: "sessions#destroy", as: :sign_out
+          resource :account, only: %i[show update destroy]
+          resource :email_change, only: %i[new create #{code? ? "edit update" : "show"}], path: "account/email"
+          resources :active_sessions, only: :destroy, path: "account/sessions" do
+            delete :others, action: :destroy_others, on: :collection
+          end
+        RUBY
+      end
+
+      def api_routes
+        sign_in = if code?
+          <<~RUBY
+            post "sign-in", to: "sign_in_codes#create", as: :sign_in
+            post "sign-in/code", to: "sessions#create", as: :sign_in_code
+          RUBY
+        else
+          <<~RUBY
+            post "sign-in", to: "sessions#create", as: :sign_in
+            post "sign-up", to: "registrations#create", as: :sign_up
+            resource :password_reset, only: %i[create update], path: "password-reset"
+            resource :email_confirmation, only: %i[create update], path: "account/confirmation"
+            resource :password, only: :update, path: "account/password"
+          RUBY
+        end
+
+        sign_in + <<~RUBY
+          delete "session", to: "sessions#destroy", as: :session
+          resource :account, only: %i[show update destroy]
+          resource :email_change, only: %i[create update], path: "account/email"
+          resources :active_sessions, only: %i[index destroy], path: "account/sessions" do
+            delete :others, action: :destroy_others, on: :collection
+          end
+        RUBY
+      end
+    end
+  end
+end

data/lib/generators/trek/scalingo_generator.rb

@@ -0,0 +1,55 @@
+require "rails/generators/actions"
+require "generators/trek/helpers"
+
+module Trek
+  module Generators
+    class ScalingoGenerator < Rails::Generators::Base
+      BUILDPACK_URL = "https://github.com/etaminstudio/trek-buildpack/archive/refs/tags/v0.1.0.tar.gz".freeze
+
+      include Trek::Generators::Helpers
+
+      desc "Create Scalingo files."
+
+      # The trek-buildpack replaces the apt + ruby buildpack combination. It
+      # pins Node from the .node-version that `rails new` already generates.
+      def remove_buildpacks
+        remove_file ".buildpacks"
+      end
+
+      def create_aptfile
+        create_file "Aptfile" do
+          <<~TEXT
+            libjemalloc2
+            libvips-tools --no-install-recommends
+            libwebp-dev
+          TEXT
+        end
+      end
+
+      def create_procfile
+        create_file "Procfile" do
+          <<~TEXT
+            web: bundle exec rails server -p $PORT -e $RAILS_ENV -b 0.0.0.0
+            # A worker is only needed once jobs outgrow the web container
+            # (config.good_job.execution_mode = :async):
+            # worker: bundle exec good_job start
+            postdeploy: bundle exec rails db:migrate
+          TEXT
+        end
+      end
+
+      def final_instructions
+        say ""
+        say "Configure the Scalingo app environment:"
+        say ""
+        say "    scalingo --app <app> env-set BUILDPACK_URL=#{BUILDPACK_URL}"
+        say "    scalingo --app <app> env-set 'DATABASE_URL=$SCALINGO_POSTGRESQL_URL'"
+        say ""
+        say "and make sure config/database.yml reads DATABASE_URL in production."
+        say ""
+        say "See https://trek.etamin.studio/deploy for details."
+        say ""
+      end
+    end
+  end
+end

data/lib/generators/trek/templates/.gitlab-ci.yml

@@ -20,7 +20,7 @@ stages:
 
 # Defaults
 default:
-  image: registry.git.etamin.studio/devops/ci-ruby/node-24:4.0.7
+  image: registry.git.etamin.studio/devops/ci-ruby/node-24:4.0.9
 
   services:
     - postgres:16

data/lib/generators/trek/templates/controllers/admin/password_renewals_controller.rb

@@ -0,0 +1,11 @@
+module Admin
+  # After a suspected compromise: every user, this admin included, must choose a new password at
+  # their next request (User.require_password_renewal!).
+  class PasswordRenewalsController < Admin::BaseController
+    def create
+      authorize! User, to: :require_password_renewal?
+      User.require_password_renewal!
+      redirect_to admin_users_path, notice: t(".success")
+    end
+  end
+end

data/lib/generators/trek/templates/controllers/admin/user_sessions_controller.rb

@@ -39,7 +39,7 @@ module Admin
       else
         @user&.record_failed_sign_in!
         count_failed_sign_in_from_ip
-        render_sign_in_form t(".failure"), status: :unprocessable_entity
+        render_sign_in_form t(".failure"), status: :unprocessable_content
       end
     end
 

data/lib/generators/trek/templates/controllers/admin/users_controller.rb

@@ -24,14 +24,6 @@ module Admin
       @object.password = SecureRandom.alphanumeric(24) if @object.password.blank?
     end
 
-    # After a suspected compromise: every user, this admin included, must choose a new password at
-    # their next request.
-    def require_password_renewal
-      authorize! User, to: :require_password_renewal?
-      User.require_password_renewal!
-      redirect_to admin_users_path, notice: t(".success")
-    end
-
     def theme
       value = params[:theme].to_s
       Current.user.update!(theme: value) if User.themes.key?(value)

data/lib/generators/trek/templates/initializers/content_security_policy.rb

@@ -22,8 +22,9 @@ Rails.application.configure do
     # Framed by its own pages only (Lookbook's previews), against clickjacking
     policy.frame_ancestors :self
     policy.object_src :none
-    # No inline script: the app's own files, and the scripts given the request's nonce
-    policy.script_src :self
+    # No inline script: the app's own files, and the scripts given the request's nonce. A blocked
+    # inline script's first 40 characters go with the report (`'report-sample'`), to tell what it was
+    policy.script_src :self, :report_sample
     # Inline `style` attributes stay allowed: Trek's components and Backpack's set some (colors,
     # custom properties)
     policy.style_src :self, :unsafe_inline

data/lib/generators/trek/templates/initializers/good_job.rb.tt

@@ -0,0 +1,38 @@
+Rails.application.configure do
+  # One scheduler for every queue. Give a queue its own lane when it must not wait behind the
+  # others, e.g. "mailers:2;*:3" — the thread counts have to stay within GOOD_JOB_MAX_THREADS,
+  # which config/database.yml turns into database connections.
+  config.good_job.queues = "*"
+
+  # Cron runs wherever a scheduler runs, which in :async mode means every web container. Keep it
+  # to production so a development machine never fires a scheduled job.
+  config.good_job.enable_cron = Rails.env.production?
+  config.good_job.cron = {
+    # purge_old_sessions: {
+    #   cron: "0 3 * * *", # every day at 3am
+    #   class: "PurgeOldSessionsJob",
+    #   description: "Delete the user sessions that expired more than a month ago"
+    # }
+  }
+
+  # An error raised outside a job's own execution (in the scheduler thread) has no retry handler
+  # to catch it. Report it through Rails.error, like the rest of the app.
+  config.good_job.on_thread_error = ->(error) { Rails.error.report(error, handled: false) }
+end
+
+# The dashboard is mounted at /admin/good_job, outside Admin::BaseController and therefore outside
+# Trek's authentication. Guard it with the same signed session cookie, and answer 404 rather than
+# redirecting: the route stays invisible to anyone who is not an administrator.
+ActiveSupport.on_load(:good_job_application_controller) do
+  before_action do
+    raise ActionController::RoutingError, "Not Found" unless good_job_dashboard_user&.admin?
+  end
+
+  private
+
+  def good_job_dashboard_user
+    return unless cookies.signed[:session_id]
+
+    <%= session_model %>.find_by(id: cookies.signed[:session_id])&.user
+  end
+end

data/lib/generators/trek/templates/jobs/mail_delivery_job.rb

@@ -0,0 +1,6 @@
+# Delivers every `deliver_later` email (config.action_mailer.delivery_job).
+# GoodJob discards a failed job rather than retrying it, so a transient error from the delivery
+# service would lose the email: retry with a growing delay instead.
+class MailDeliveryJob < ActionMailer::MailDeliveryJob
+  retry_on StandardError, wait: :polynomially_longer, attempts: 5
+end

data/lib/generators/trek/templates/layouts/admin.html.slim

@@ -56,6 +56,11 @@ html(lang=I18n.locale class=class_for_theme)
               href: %i[admin users],
               allowed_to: allowed_to?(:index?, User),
             )
+            s.with_item(
+              text: t("admin.jobs"),
+              href: "/admin/good_job",
+              allowed_to: Current.user.admin?,
+            )
           end
         end
       = render Trek::ToasterComponent.new

data/lib/generators/trek/templates/mailers/admin_mailer.rb

@@ -13,11 +13,13 @@ class AdminMailer < ApplicationMailer
     end
   end
 
-  # A sign-in from a browser that never signed in as the user, so they can react if it wasn't them
+  # A sign-in from a browser that never signed in as the user, so they can react if it wasn't them.
+  # The IP address comes with its host name, as on the active sessions: sent later, the email can
+  # wait for the lookup.
   def new_sign_in(user, at:, ip:, user_agent:)
     @user = user
     @at = at
-    @ip = ip
+    @address = [ip, Trek::ReverseDns.hostname(ip)&.then { |hostname| "(#{hostname})" }].compact.join(" ")
     @user_agent = user_agent
     @sessions_url = admin_user_url(user, anchor: "sessions")
     @reset_url = new_admin_user_password_reset_url

data/lib/generators/trek/templates/package.json.tt

@@ -4,7 +4,7 @@
   "dependencies": {
     "@hotwired/stimulus": "^3.2.2",
     "@hotwired/turbo-rails": "^8.0.0",
-    "trek": "^<%= Trek::VERSION %>"
+    "trek": "<%= ENV.fetch("TREK_NPM_PACKAGE") { "^#{Trek::VERSION}" } %>"
   },
   "scripts": {
     "build": "node esbuild.config.js"

data/lib/generators/trek/templates/public_accounts/api/authentication.rb.tt

@@ -0,0 +1,76 @@
+# Signs <%= human_name.pluralize.downcase %> in to the API through a JWT the mobile app sends with each request
+# (Authorization: Bearer). The token only names a <%= class_name %>::Session: signing out deletes the session and
+# the token with it, and the session's idle timeout and lifetime apply as on the web. Apart from the
+# admin's users and sessions altogether.
+module <%= accounts_module %>::Authentication
+  extend ActiveSupport::Concern
+
+  included do
+    before_action :require_<%= file_name %>
+    after_action :track_<%= file_name %>_activity
+  end
+
+  class_methods do
+    def allow_unauthenticated_access(**options)
+      skip_before_action :require_<%= file_name %>, **options
+    end
+  end
+
+  private
+
+  def require_<%= file_name %>
+    render_api_error :unauthorized, :sign_in_needed unless resume_<%= file_name %>_session
+  end
+
+  # Changing the password or deleting the account asks to sign in again when the session isn't recent.
+  def require_recent_<%= file_name %>_sign_in
+    render_api_error :forbidden, :recent_sign_in_needed unless Current.<%= file_name %>_session.recent?
+  end
+
+  def resume_<%= file_name %>_session
+    Current.<%= file_name %>_session ||= find_<%= file_name %>_session_by_token
+  end
+
+  # A session past its idle timeout or lifetime is dropped: the <%= human_name.downcase %> signs in again.
+  def find_<%= file_name %>_session_by_token
+    token = request.authorization.to_s[/\ABearer (.+)\z/, 1]
+    return unless token
+
+    <%= file_name %>_session = <%= class_name %>::Session.from_token(token)
+    return <%= file_name %>_session unless <%= file_name %>_session&.expired?
+
+    <%= file_name %>_session.destroy
+    nil
+  end
+
+  # The session the token of the response will name
+  def start_<%= file_name %>_session_for(<%= file_name %>)
+    <%= file_name %>.sessions.create!(user_agent: request.user_agent, ip_address: request.remote_ip).tap do |<%= file_name %>_session|
+      Current.<%= file_name %>_session = <%= file_name %>_session
+      Trek::ResolveSessionHostnameJob.perform_later(<%= file_name %>_session)
+    end
+  end
+
+  def terminate_<%= file_name %>_session
+    Current.<%= file_name %>_session.destroy
+    Current.<%= file_name %>_session = nil
+  end
+
+  # At most once every <%= class_name %>::Session.activity_interval (5 minutes), so using the app doesn't write on
+  # every request.
+  def track_<%= file_name %>_activity
+    <%= file_name %>_session = Current.<%= file_name %>_session
+    return unless <%= file_name %>_session&.persisted?
+
+    <%= file_name %>_session.record_activity
+    <%= file_name %> = <%= file_name %>_session.<%= file_name %>
+    return if <%= file_name %>.last_activity_at&.after?(<%= class_name %>::Session.activity_interval.ago)
+
+    <%= file_name %>.update_columns(last_activity_at: Time.current) # rubocop:disable Rails/SkipsModelValidations
+  end
+
+  # An error the app can act on (`error`), with a message it may show (`message`).
+  def render_api_error(status, error, **details)
+    render json: { error:, message: I18n.t("<%= accounts_path %>.api.errors.#{error}"), **details }, status:
+  end
+end

data/lib/generators/trek/templates/public_accounts/api/controllers/accounts_controller.rb.tt

@@ -0,0 +1,22 @@
+# The signed-in <%= human_name.downcase %>'s account: GET, PATCH { name }, and DELETE after a recent sign-in.
+class <%= controllers_module %>::AccountsController < <%= controllers_module %>::BaseController
+  before_action :require_recent_<%= file_name %>_sign_in, only: :destroy
+
+  def show
+    render json: <%= file_name %>_json(Current.<%= file_name %>)
+  end
+
+  def update
+    if Current.<%= file_name %>.update(params.permit(:name))
+      render json: <%= file_name %>_json(Current.<%= file_name %>)
+    else
+      render_api_error :unprocessable_content, :invalid, errors: Current.<%= file_name %>.errors
+    end
+  end
+
+  def destroy
+    Current.<%= file_name %>.destroy!
+    Current.<%= file_name %>_session = nil
+    head :no_content
+  end
+end

data/lib/generators/trek/templates/public_accounts/api/controllers/active_sessions_controller.rb.tt

@@ -0,0 +1,21 @@
+# The devices signed in as the current <%= human_name.downcase %>: GET lists them, DELETE signs one or the others out.
+# Only theirs: every query goes through Current.<%= file_name %>.sessions.
+class <%= controllers_module %>::ActiveSessionsController < <%= controllers_module %>::BaseController
+  def index
+    sessions = Current.<%= file_name %>.sessions.active.recent_first.map do |<%= file_name %>_session|
+      <%= file_name %>_session.as_json(only: %i[id user_agent ip_address ip_hostname created_at last_activity_at])
+        .merge("current" => <%= file_name %>_session == Current.<%= file_name %>_session)
+    end
+    render json: sessions
+  end
+
+  def destroy
+    Current.<%= file_name %>.sessions.find(params[:id]).destroy
+    head :no_content
+  end
+
+  def destroy_others
+    Current.<%= file_name %>.sessions.where.not(id: Current.<%= file_name %>_session.id).destroy_all
+    head :no_content
+  end
+end

data/lib/generators/trek/templates/public_accounts/api/controllers/base_controller.rb.tt

@@ -0,0 +1,71 @@
+# The API's account endpoints: <%= human_name.pluralize.downcase %> only, never the admin's users.
+class <%= controllers_module %>::BaseController < ActionController::API
+  include <%= accounts_module %>::Authentication
+  # Sign-ins, <% if code? %>code requests<% else %>sign-ups, password resets<% end %> and account changes go to the audit log, when the app has one.
+  include Trek::Auditable if defined?(::AuditLog)
+
+  # Emails sent to one address (<% if code? %>codes<% else %>password resets, confirmations<% end %>), whatever the IP address: rate_limit
+  # counts per IP address.
+  EMAILS_PER_ADDRESS = 5
+  EMAILS_PER_ADDRESS_WINDOW = 1.hour
+
+  # Failed sign-ins from one IP address, whatever the account, over a longer window than rate_limit's.
+  FAILED_SIGN_INS_PER_IP = 20
+  FAILED_SIGN_INS_WINDOW = 1.hour
+
+  private
+
+  def normalized_email(email)
+    <%= class_name %>.normalize_value_for(:email, email.to_s)
+  end
+
+  def valid_email?(email)
+    email.match?(URI::MailTo::EMAIL_REGEXP)
+  end
+
+  # Counted in Rails.cache, as rate_limit is, under a digest rather than the email itself.
+  def too_many_emails_to?(email)
+    key = "<%= accounts_path %>/emails/#{Digest::SHA256.hexdigest(email)}"
+    Rails.cache.increment(key, 1, expires_in: EMAILS_PER_ADDRESS_WINDOW).to_i > EMAILS_PER_ADDRESS
+  end
+
+  def too_many_failed_sign_ins_from_ip?
+    Rails.cache.read(failed_sign_ins_from_ip_key).to_i >= FAILED_SIGN_INS_PER_IP
+  end
+
+  def count_failed_sign_in_from_ip
+    Rails.cache.increment(failed_sign_ins_from_ip_key, 1, expires_in: FAILED_SIGN_INS_WINDOW)
+  end
+
+  def failed_sign_ins_from_ip_key
+    "<%= accounts_path %>/failed_sign_ins/#{request.remote_ip}"
+  end
+
+  def render_rate_limited
+    render_api_error :too_many_requests, :rate_limited
+  end
+
+  def <%= file_name %>_json(<%= file_name %>)
+<% if password? -%>
+    <%= file_name %>.as_json(only: %i[id email unconfirmed_email name confirmed_at created_at])
+<% else -%>
+    <%= file_name %>.as_json(only: %i[id email name created_at])
+<% end -%>
+  end
+
+  # A new session, and the token naming it, for the app to send with each request
+  def render_new_session(<%= file_name %>, status: :created)
+    <%= file_name %>_session = start_<%= file_name %>_session_for(<%= file_name %>)
+    render json: { token: <%= file_name %>_session.token, <%= file_name %>: <%= file_name %>_json(<%= file_name %>) }, status:
+  end
+
+  # For the audit log (Trek::Auditable): the signed-in <%= human_name.downcase %>, nil before signing in
+  def audit_actor
+    Current.<%= file_name %>
+  end
+
+  # The account signed in to, tried, or changed
+  def audit_target
+    @<%= file_name %> || Current.<%= file_name %>
+  end
+end