ultra-max-kit 0.0.1

data/devise-5.0.4/lib/devise/encryptor.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require 'bcrypt'
+
+module Devise
+  module Encryptor
+    def self.digest(klass, password)
+      if klass.pepper.present?
+        password = "#{password}#{klass.pepper}"
+      end
+      ::BCrypt::Password.create(password, cost: klass.stretches).to_s
+    end
+
+    def self.compare(klass, hashed_password, password)
+      return false if hashed_password.blank?
+      bcrypt   = ::BCrypt::Password.new(hashed_password)
+      if klass.pepper.present?
+        password = "#{password}#{klass.pepper}"
+      end
+      password = ::BCrypt::Engine.hash_secret(password, bcrypt.salt)
+      Devise.secure_compare(password, hashed_password)
+    end
+  end
+end

data/devise-5.0.4/lib/devise/failure_app.rb

@@ -0,0 +1,287 @@
+# frozen_string_literal: true
+
+require "action_controller/metal"
+
+module Devise
+  # Failure application that will be called every time :warden is thrown from
+  # any strategy or hook. It is responsible for redirecting the user to the sign
+  # in page based on current scope and mapping. If no scope is given, it
+  # redirects to the default_url.
+  class FailureApp < ActionController::Metal
+    include ActionController::UrlFor
+    include ActionController::Redirecting
+
+    include Rails.application.routes.url_helpers
+    include Rails.application.routes.mounted_helpers
+
+    include Devise::Controllers::StoreLocation
+
+    delegate :flash, to: :request
+
+    include AbstractController::Callbacks
+    around_action do |failure_app, action|
+      I18n.with_locale(failure_app.i18n_locale, &action)
+    end
+
+    def self.call(env)
+      @respond ||= action(:respond)
+      @respond.call(env)
+    end
+
+    # Try retrieving the URL options from the parent controller (usually
+    # ApplicationController). Instance methods are not supported at the moment,
+    # so only the class-level attribute is used.
+    def self.default_url_options(*args)
+      if defined?(Devise.parent_controller.constantize)
+        Devise.parent_controller.constantize.try(:default_url_options) || {}
+      else
+        {}
+      end
+    end
+
+    def respond
+      if http_auth?
+        http_auth
+      elsif warden_options[:recall]
+        recall
+      else
+        redirect
+      end
+    end
+
+    def http_auth
+      self.status = 401
+      self.headers["WWW-Authenticate"] = %(Basic realm=#{Devise.http_authentication_realm.inspect}) if http_auth_header?
+      self.content_type = request.format.to_s
+      self.response_body = http_auth_body
+    end
+
+    def recall
+      header_info = if relative_url_root?
+        base_path = Pathname.new(relative_url_root)
+        full_path = Pathname.new(attempted_path)
+
+        { "SCRIPT_NAME" => relative_url_root,
+          "PATH_INFO" => '/' + full_path.relative_path_from(base_path).to_s }
+      else
+        { "PATH_INFO" => attempted_path }
+      end
+
+      header_info.each do | var, value|
+        if request.respond_to?(:set_header)
+          request.set_header(var, value)
+        else
+          request.env[var]  = value
+        end
+      end
+
+      flash.now[:alert] = i18n_message(:invalid) if is_flashing_format?
+      self.response = recall_app(warden_options[:recall]).call(request.env).tap { |response|
+        status = response[0].in?(300..399) ? Devise.responder.redirect_status : Devise.responder.error_status
+        # Avoid warnings translating status to code using Rails if available (e.g. `unprocessable_entity` => `unprocessable_content`)
+        response[0] = ActionDispatch::Response.try(:rack_status_code, status) || Rack::Utils.status_code(status)
+      }
+    end
+
+    def redirect
+      store_location!
+      if is_flashing_format?
+        if flash[:timedout] && flash[:alert]
+          flash.keep(:timedout)
+          flash.keep(:alert)
+        else
+          flash[:alert] = i18n_message
+        end
+      end
+      redirect_to redirect_url
+    end
+
+  protected
+
+    def i18n_options(options)
+      options
+    end
+
+    def i18n_message(default = nil)
+      message = warden_message || default || :unauthenticated
+
+      if message.is_a?(Symbol)
+        options = {}
+        options[:resource_name] = scope
+        options[:scope] = "devise.failure"
+        options[:default] = [message]
+        auth_keys = scope_class.authentication_keys
+        human_keys = (auth_keys.respond_to?(:keys) ? auth_keys.keys : auth_keys).map { |key|
+          # TODO: Remove the fallback and just use `downcase_first` once we drop support for Rails 7.0.
+          human_key = scope_class.human_attribute_name(key)
+          human_key.respond_to?(:downcase_first) ? human_key.downcase_first : human_key[0].downcase + human_key[1..]
+        }
+        options[:authentication_keys] = human_keys.join(I18n.t(:"support.array.words_connector"))
+        options = i18n_options(options)
+
+        I18n.t(:"#{scope}.#{message}", **options).then { |msg|
+          # Ensure that auth keys at the start of the translated string are properly cased.
+          msg.start_with?(human_keys.first) ? msg.upcase_first : msg
+        }
+      else
+        message.to_s
+      end
+    end
+
+    def i18n_locale
+      warden_options[:locale]
+    end
+
+    def redirect_url
+      if warden_message == :timeout
+        flash[:timedout] = true if is_flashing_format?
+
+        path = if request.get?
+          attempted_path
+        else
+          extract_path_from_location(request.referrer)
+        end
+
+        path || scope_url
+      else
+        scope_url
+      end
+    end
+
+    def route(scope)
+      :"new_#{scope}_session_url"
+    end
+
+    def scope_url
+      opts  = {}
+
+      # Initialize script_name with nil to prevent infinite loops in
+      # authenticated mounted engines
+      opts[:script_name] = nil
+
+      route = route(scope)
+
+      opts[:format] = request_format unless skip_format?
+
+      router_name = Devise.mappings[scope].router_name || Devise.available_router_name
+      context = send(router_name)
+
+      if relative_url_root?
+        opts[:script_name] = relative_url_root
+      end
+
+      if context.respond_to?(route)
+        context.send(route, opts)
+      elsif respond_to?(:root_url)
+        root_url(opts)
+      else
+        "/"
+      end
+    end
+
+    def skip_format?
+      %w(html */* turbo_stream).include? request_format.to_s
+    end
+
+    # Choose whether we should respond in an HTTP authentication fashion,
+    # including 401 and optional headers.
+    #
+    # This method allows the user to explicitly disable HTTP authentication
+    # on AJAX requests in case they want to redirect on failures instead of
+    # handling the errors on their own. This is useful in case your AJAX API
+    # is the same as your public API and uses a format like JSON (so you
+    # cannot mark JSON as a navigational format).
+    def http_auth?
+      if request.xhr?
+        Devise.http_authenticatable_on_xhr
+      else
+        !(request_format && is_navigational_format?)
+      end
+    end
+
+    # It doesn't make sense to send authenticate headers in AJAX requests
+    # or if the user disabled them.
+    def http_auth_header?
+      scope_class.http_authenticatable && !request.xhr?
+    end
+
+    def http_auth_body
+      return i18n_message unless request_format
+      method = "to_#{request_format}"
+      if method == "to_xml"
+        { error: i18n_message }.to_xml(root: "errors")
+      elsif {}.respond_to?(method)
+        { error: i18n_message }.send(method)
+      else
+        i18n_message
+      end
+    end
+
+    def recall_app(app)
+      controller, action = app.split("#")
+      controller_name  = ActiveSupport::Inflector.camelize(controller)
+      controller_klass = ActiveSupport::Inflector.constantize("#{controller_name}Controller")
+      controller_klass.action(action)
+    end
+
+    def warden
+      request.respond_to?(:get_header) ? request.get_header("warden") : request.env["warden"]
+    end
+
+    def warden_options
+      request.respond_to?(:get_header) ? request.get_header("warden.options") : request.env["warden.options"]
+    end
+
+    def warden_message
+      @message ||= warden.message || warden_options[:message]
+    end
+
+    def scope
+      @scope ||= warden_options[:scope] || Devise.default_scope
+    end
+
+    def scope_class
+      @scope_class ||= Devise.mappings[scope].to
+    end
+
+    def attempted_path
+      warden_options[:attempted_path]
+    end
+
+    # Stores requested URI to redirect the user after signing in. We can't use
+    # the scoped session provided by warden here, since the user is not
+    # authenticated yet, but we still need to store the URI based on scope, so
+    # different scopes would never use the same URI to redirect.
+    def store_location!
+      store_location_for(scope, attempted_path) if request.get? && !http_auth?
+    end
+
+    def is_navigational_format?
+      Devise.navigational_formats.include?(request_format)
+    end
+
+    # Check if flash messages should be emitted. Default is to do it on
+    # navigational formats
+    def is_flashing_format?
+      request.respond_to?(:flash) && is_navigational_format?
+    end
+
+    def request_format
+      @request_format ||= request.format.try(:ref)
+    end
+
+    def relative_url_root
+      @relative_url_root ||= begin
+        config = Rails.application.config
+
+        config.try(:relative_url_root) || config.action_controller.try(:relative_url_root)
+      end
+    end
+
+    def relative_url_root?
+      relative_url_root.present?
+    end
+
+    ActiveSupport.run_load_hooks(:devise_failure_app, self)
+  end
+end

data/devise-5.0.4/lib/devise/hooks/activatable.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+# Deny user access whenever their account is not active yet.
+# We need this as hook to validate the user activity on each request
+# and in case the user is using other strategies beside Devise ones.
+Warden::Manager.after_set_user do |record, warden, options|
+  if record && record.respond_to?(:active_for_authentication?) && !record.active_for_authentication?
+    scope = options[:scope]
+    warden.logout(scope)
+    throw :warden, scope: scope, message: record.inactive_message, locale: options.fetch(:locale, I18n.locale)
+  end
+end

data/devise-5.0.4/lib/devise/hooks/csrf_cleaner.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+Warden::Manager.after_authentication do |record, warden, options|
+  clean_up_for_winning_strategy = !warden.winning_strategy.respond_to?(:clean_up_csrf?) ||
+    warden.winning_strategy.clean_up_csrf?
+  if Devise.clean_up_csrf_token_on_authentication && clean_up_for_winning_strategy
+    if warden.request.respond_to?(:reset_csrf_token)
+      # Rails 7.1+
+      warden.request.reset_csrf_token
+    else
+      warden.request.session.try(:delete, :_csrf_token)
+    end
+  end
+end

data/devise-5.0.4/lib/devise/hooks/forgetable.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+# Before logout hook to forget the user in the given scope, if it responds
+# to forget_me! Also clear remember token to ensure the user won't be
+# remembered again. Notice that we forget the user unless the record is not persisted.
+# This avoids forgetting deleted users.
+Warden::Manager.before_logout do |record, warden, options|
+  if record.respond_to?(:forget_me!)
+    Devise::Hooks::Proxy.new(warden).forget_me(record)
+  end
+end

data/devise-5.0.4/lib/devise/hooks/lockable.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+# After each sign in, if resource responds to failed_attempts, sets it to 0
+# This is only triggered when the user is explicitly set (with set_user)
+Warden::Manager.after_set_user except: :fetch do |record, warden, options|
+  if record.respond_to?(:reset_failed_attempts!) && warden.authenticated?(options[:scope])
+    record.reset_failed_attempts!
+  end
+end

data/devise-5.0.4/lib/devise/hooks/proxy.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Devise
+  module Hooks
+    # A small warden proxy so we can remember, forget and
+    # sign out users from hooks.
+    class Proxy #:nodoc:
+      include Devise::Controllers::Rememberable
+      include Devise::Controllers::SignInOut
+
+      attr_reader :warden
+      delegate :cookies, :request, to: :warden
+
+      def initialize(warden)
+        @warden = warden
+      end
+
+      def session
+        warden.request.session
+      end
+    end
+  end
+end

data/devise-5.0.4/lib/devise/hooks/rememberable.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+Warden::Manager.after_set_user except: :fetch do |record, warden, options|
+  scope = options[:scope]
+  if record.respond_to?(:remember_me) && options[:store] != false &&
+     record.remember_me && warden.authenticated?(scope)
+    Devise::Hooks::Proxy.new(warden).remember_me(record)
+  end
+end

data/devise-5.0.4/lib/devise/hooks/timeoutable.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+# Each time a record is set we check whether its session has already timed out
+# or not, based on last request time. If so, the record is logged out and
+# redirected to the sign in page. Also, each time the request comes and the
+# record is set, we set the last request time inside its scoped session to
+# verify timeout in the following request.
+Warden::Manager.after_set_user do |record, warden, options|
+  scope = options[:scope]
+  env   = warden.request.env
+
+  if record && record.respond_to?(:timedout?) && warden.authenticated?(scope) &&
+     options[:store] != false && !env['devise.skip_timeoutable']
+    last_request_at = warden.session(scope)['last_request_at']
+
+    if last_request_at.is_a? Integer
+      last_request_at = Time.at(last_request_at).utc
+    elsif last_request_at.is_a? String
+      last_request_at = Time.parse(last_request_at)
+    end
+
+    proxy = Devise::Hooks::Proxy.new(warden)
+
+    if !env['devise.skip_timeout'] &&
+        record.timedout?(last_request_at) &&
+        !proxy.remember_me_is_active?(record)
+      Devise.sign_out_all_scopes ? proxy.sign_out : proxy.sign_out(scope)
+      throw :warden, scope: scope, message: :timeout, locale: options.fetch(:locale, I18n.locale)
+    end
+
+    unless env['devise.skip_trackable']
+      warden.session(scope)['last_request_at'] = Time.now.utc.to_i
+    end
+  end
+end

data/devise-5.0.4/lib/devise/hooks/trackable.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+# After each sign in, update sign in time, sign in count and sign in IP.
+# This is only triggered when the user is explicitly set (with set_user)
+# and on authentication. Retrieving the user from session (:fetch) does
+# not trigger it.
+Warden::Manager.after_set_user except: :fetch do |record, warden, options|
+  if record.respond_to?(:update_tracked_fields!) && warden.authenticated?(options[:scope]) && !warden.request.env['devise.skip_trackable']
+    record.update_tracked_fields!(warden.request)
+  end
+end

data/devise-5.0.4/lib/devise/mailers/helpers.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+module Devise
+  module Mailers
+    module Helpers
+      extend ActiveSupport::Concern
+
+      included do
+        include Devise::Controllers::ScopedViews
+      end
+
+      protected
+
+      attr_reader :scope_name, :resource
+
+      # Configure default email options
+      def devise_mail(record, action, opts = {}, &block)
+        initialize_from_record(record)
+        mail headers_for(action, opts), &block
+      end
+
+      def initialize_from_record(record)
+        @scope_name = Devise::Mapping.find_scope!(record)
+        @resource   = instance_variable_set("@#{devise_mapping.name}", record)
+      end
+
+      def devise_mapping
+        @devise_mapping ||= Devise.mappings[scope_name]
+      end
+
+      def headers_for(action, opts)
+        headers = {
+          subject: subject_for(action),
+          to: resource.email,
+          from: mailer_sender(devise_mapping),
+          reply_to: mailer_sender(devise_mapping),
+          template_path: template_paths,
+          template_name: action
+        }
+        # Give priority to the mailer's default if they exists.
+        headers.delete(:from) if default_params[:from]
+        headers.delete(:reply_to) if default_params[:reply_to]
+
+        headers.merge!(opts)
+
+        @email = headers[:to]
+        headers
+      end
+
+      def mailer_sender(mapping)
+        if Devise.mailer_sender.is_a?(Proc)
+          Devise.mailer_sender.call(mapping.name)
+        else
+          Devise.mailer_sender
+        end
+      end
+
+      def template_paths
+        template_path = _prefixes.dup
+        template_path.unshift "#{@devise_mapping.scoped_path}/mailer" if self.class.scoped_views?
+        template_path
+      end
+
+      # Set up a subject doing an I18n lookup. At first, it attempts to set a subject
+      # based on the current mapping:
+      #
+      #   en:
+      #     devise:
+      #       mailer:
+      #         confirmation_instructions:
+      #           user_subject: '...'
+      #
+      # If one does not exist, it fallbacks to ActionMailer default:
+      #
+      #   en:
+      #     devise:
+      #       mailer:
+      #         confirmation_instructions:
+      #           subject: '...'
+      #
+      def subject_for(key)
+        I18n.t(:"#{devise_mapping.name}_subject", scope: [:devise, :mailer, key],
+          default: [:subject, key.to_s.humanize])
+      end
+    end
+  end
+end