usernames 0.1.3 → 0.2.0

data/lib/generators/usernames/templates/availability/availability_controller.rb.tt

@@ -1,107 +0,0 @@
-# frozen_string_literal: true
-
-module Usernames
-  # GET /usernames/availability?<%= column %>=javi
-  #   => { "state": "free" | "taken" | "invalid", "message": "…" }
-  #
-  # Generated by `rails generate usernames:availability`. It's yours: edit it.
-  #
-  # An availability endpoint tells anyone which names exist — that is its
-  # job — so it comes with guard rails:
-  #
-  # * Rails' own rate_limit, on a store this controller checks. With the
-  #   NullStore (Rails' default in development and test) the limiter silently
-  #   counts nothing, so in production this answers 503, with a log line,
-  #   until config.cache_store is a shared store (Solid Cache, Redis,
-  #   Memcached). A MemoryStore works, but per process: each worker counts on
-  #   its own, so it logs a warning once.
-  # * Taken, reserved and not-allowed names all answer "taken", with one
-  #   message: it never says which list a name is on, or which word matched.
-  # * Never cached (no-store), and advisory only: the model's validations and
-  #   the unique index decide at save time.
-  class AvailabilityController < ApplicationController
-    # Captured once: the very object the limiter writes to, so the guard
-    # below checks the store that is actually in use.
-    RATE_LIMIT_STORE = cache_store
-
-    MEMORY_STORE_WARNED = Concurrent::AtomicBoolean.new(false)
-
-    # Format failures are shown as they are (the browser hints them anyway);
-    # reserved and not-allowed names are reported as taken (see above).
-    FORMAT_FAILURES = %i[
-      username_spaces username_characters username_unicode too_short too_long username_edges
-      username_consecutive username_first_character username_digits_only username_extension
-    ].freeze
-
-    # Before everything else, the limiter included: an answer about who
-    # exists is never cached, and neither is a 429 or a 503.
-    prepend_before_action :no_store
-
-    rate_limit to: 30, within: 1.minute, store: RATE_LIMIT_STORE, with: -> { head :too_many_requests }
-
-    before_action :require_a_working_rate_limit_store
-
-    def show
-      render json: answer_for(params[:<%= column %>].to_s)
-    end
-
-    private
-
-    # Every message in <%= model_name %>'s own words: a translation under
-    # activerecord.errors.models.<%= singular %>.attributes.<%= column %> wins here as on the form.
-    def answer_for(value)
-      result = <%= model_name %>.check_<%= column %>(value)
-
-      if result.canonical.empty?
-        { state: "invalid", message: message(:blank) }
-      elsif own?(result.canonical)
-        { state: "free", message: available }
-      elsif FORMAT_FAILURES.include?(result.reason)
-        { state: "invalid", message: result.message }
-      elsif result.ok? && <%= model_name %>.<%= column %>_available?(result.canonical)
-        { state: "free", message: available }
-      else
-        { state: "taken", message: message(:taken) }
-      end
-    end
-
-    def message(type)
-      <%= model_name %>.new.errors.generate_message(:<%= column %>, type)
-    end
-
-    # Said out loud too: the status is a live region, so a screen reader
-    # hears that the name is free, not just silence.
-    def available
-      I18n.t(:available, scope: :usernames)
-    end
-
-    def rules
-      <%= model_name %>.<%= column %>_options
-    end
-
-    # The signed-in person's own name is free: it's theirs. Devise and most
-    # authentication gems define current_user; with Rails' own authentication
-    # generator, use Current.user instead.
-    def own?(canonical)
-      user = current_user if respond_to?(:current_user, true)
-      name = user.try(:<%= column %>)
-      name.present? && Usernames.comparison_key(name, **rules) == Usernames.comparison_key(canonical, **rules)
-    end
-
-    def require_a_working_rate_limit_store
-      case RATE_LIMIT_STORE
-      when ActiveSupport::Cache::NullStore
-        return unless Rails.env.production?
-
-        Rails.logger.error "[usernames] The availability check is off (503): config.cache_store is the NullStore, " \
-                           "where Rails' rate_limit counts nothing. Use a shared store: Solid Cache, Redis or Memcached."
-        head :service_unavailable
-      when ActiveSupport::Cache::MemoryStore
-        if MEMORY_STORE_WARNED.make_true
-          Rails.logger.warn "[usernames] The availability check's rate limit uses a MemoryStore, which each process " \
-                            "counts on its own. Use a shared store (Solid Cache, Redis, Memcached) for one limit per client."
-        end
-      end
-    end
-  end
-end

data/lib/generators/usernames/templates/availability/username_check_controller.js.tt

@@ -1,115 +0,0 @@
-import { Controller } from "@hotwired/stimulus"
-
-// Live hints and a "is this name free?" check for <%= model_name %>#<%= column %>.
-// Generated by `rails generate usernames:availability`. It's yours: edit it.
-// app/views/usernames/_field.html.erb wires it up:
-//
-//   <div data-controller="username-check"
-//        data-username-check-url-value="/usernames/availability"
-//        data-username-check-param-value="<%= column %>"
-//        data-username-check-rules-value="[…<%= model_name %>.<%= column %>_rules_for_browser…]">
-//     <input data-username-check-target="input" data-action="input->username-check#check">
-//     <p data-username-check-target="hint"></p>
-//     <p data-username-check-target="status"></p>
-//   </div>
-//
-// Everything here is a HINT. The browser only approximates the server's
-// normalisation (Ruby's strip and JavaScript's trim() disagree on NUL, U+FEFF
-// and U+1680), so nothing here blocks submission: no setCustomValidity, no
-// pattern attribute. The model's validations and the unique index decide.
-export default class extends Controller {
-  static targets = ["input", "hint", "status"]
-  static values = {
-    url: String,
-    // The query parameter the endpoint reads: GET /usernames/availability?<%= column %>=…
-    param: { type: String, default: "<%= column %>" },
-    rules: Array,
-    lowercase: { type: Boolean, default: true },
-    delay: { type: Number, default: 300 }
-  }
-
-  connect() {
-    this.patterns = this.rulesValue.map((rule) => ({ ...rule, regexp: this.compile(rule.pattern) }))
-  }
-
-  disconnect() {
-    this.cancel()
-  }
-
-  // On every keystroke: the first rule the name breaks, at once; whether it
-  // is free, once typing pauses.
-  check() {
-    const name = this.normalize(this.inputTarget.value)
-    this.current = name
-    this.cancel()
-
-    const broken = this.firstBrokenRule(name)
-    this.write(this.hasHintTarget && this.hintTarget, broken ? broken.message : "")
-    this.render(null)
-    // Only names that could be registered are worth a request.
-    if (name === "" || broken) return
-
-    this.timer = setTimeout(() => this.ask(name), this.delayValue)
-  }
-
-  async ask(name) {
-    this.request = new AbortController()
-    const url = new URL(this.urlValue, window.location.href)
-    url.searchParams.set(this.paramValue, name)
-
-    try {
-      const response = await fetch(url, {
-        headers: { Accept: "application/json" },
-        signal: this.request.signal,
-        credentials: "same-origin"
-      })
-      if (!response.ok) return // rate-limited or switched off: say nothing rather than guess
-
-      const answer = await response.json()
-      // A slow answer for something typed earlier is not an answer for this.
-      if (name === this.current) this.render(answer)
-    } catch (error) {
-      if (error.name !== "AbortError") throw error
-    }
-  }
-
-  // The server's normalisation, approximately: NFKC, trim,
-  // lowercase (unless case is kept), one leading @ before a letter or digit.
-  normalize(value) {
-    let name = value.normalize("NFKC").trim()
-    if (this.lowercaseValue) name = name.toLowerCase().normalize("NFKC")
-    return name.replace(this.lowercaseValue ? /^@(?=[a-z0-9])/ : /^@(?=[A-Za-z0-9])/, "")
-  }
-
-  // Each pattern matches a name that BREAKS its rule; the first one wins.
-  firstBrokenRule(name) {
-    if (name === "") return null
-    return this.patterns.find(({ regexp }) => regexp && regexp.test(name)) || null
-  }
-
-  // With the u flag a length counts code points, as Ruby does.
-  compile(pattern) {
-    try {
-      return new RegExp(pattern, "u")
-    } catch {
-      try { return new RegExp(pattern) } catch { return null }
-    }
-  }
-
-  render(answer) {
-    if (!this.hasStatusTarget) return
-
-    this.statusTarget.dataset.state = answer ? answer.state : ""
-    this.write(this.statusTarget, answer && answer.message ? answer.message : "")
-  }
-
-  write(element, text) {
-    if (element) element.textContent = text
-  }
-
-  cancel() {
-    clearTimeout(this.timer)
-    if (this.request) this.request.abort()
-    this.request = null
-  }
-}