yiffspace-auth 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: eaf8f70d591dd62b1fe71e4c6b0269b89178dbbfc96aa00d2f220dc0c051b625
+  data.tar.gz: 60e9eb43743d443d4cced565c7891fd491344d5274317b72a2a599d9c5118cb0
+SHA512:
+  metadata.gz: eca3a821613c9e57b8216ecc8a80608bd2068b31a2521d281183dbe1bd3dd2750111dfa20727912d6076ab08e1a53750b77d8ff0a111602792e791d3bd47fa96
+  data.tar.gz: 3df50557690c89ffc87e32a94c30b9f3e664702a168fb441cb5a0aa3897928114f169a3da43b8f09bd4dca599906ae42a823d9a66a246e6336a93652584f5a3c

data/CHANGELOG.md

@@ -0,0 +1,4 @@
+## 0.0.1
+
+- Initial release, extracted from the `yiffspace` gem's `YiffSpace::Auth::*`
+  engine.

data/LICENSE

@@ -0,0 +1,20 @@
+Copyright Donovan_DMC
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,41 @@
+# YiffSpace::Auth
+
+Logto-based auth engine for https://yiff.space and related projects. Extracted
+from the [yiffspace](https://github.com/YiffSpace/Gem) gem, which this gem
+depends on.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem "yiffspace-auth"
+```
+
+And then execute:
+
+```bash
+$ bundle install
+```
+
+## Development
+
+This gem depends on [`yiffspace`](https://github.com/YiffSpace/Gem) via git
+(see the `Gemfile`). To develop against a local checkout of that repo instead
+of the pushed `master` branch, point Bundler at it with a local override:
+
+```bash
+$ bundle config set local.yiffspace ../Gem
+```
+
+This is stored in `.bundle/config` (gitignored) and doesn't touch the
+`Gemfile`/`Gemfile.lock`, so it only affects your machine. Remove it with
+`bundle config unset local.yiffspace` to go back to the pushed branch.
+
+## Contributing
+
+Go away
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/Rakefile

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+require("bundler/setup")
+
+APP_RAKEFILE = File.expand_path("test/dummy/Rakefile", __dir__)
+load("rails/tasks/engine.rake")
+
+load("rails/tasks/statistics.rake")
+
+require("bundler/gem_tasks")

data/app/controllers/yiff_space/auth/application_controller.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module YiffSpace
+  module Auth
+    class ApplicationController < ::YiffSpace::ApplicationController
+      include(Helper)
+
+      helper(Helper)
+    end
+  end
+end

data/app/controllers/yiff_space/auth/root_controller.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module YiffSpace
+  module Auth
+    class RootController < ApplicationController
+      include(Helper)
+
+      before_action(:sync_auth_if_dirty!)
+
+      def show
+        client.sign_in(redirect_uri: auth_client_config.redirect_uri, post_redirect_uri: params[:path] || "/")
+      end
+
+      def cb
+        client.handle_sign_in_callback(url: request.original_url)
+        user = client.fetch_user_info
+        self.user = UserInfo.new(id: user["identities"]["discord"]["userId"], user: user, discord: user["identities"]["discord"]["details"]["rawData"])
+        token = client.access_token_claims(resource: auth_client_config.resource)
+        self.auth = AuthInfo.new(id: user["identities"]["discord"]["userId"], token: token, permissions: token["scope"].split, roles: user["roles"], client_id: auth_client_config.client_id)
+      end
+
+      def permissions; end
+
+      def logout
+        client.sign_out(post_logout_redirect_uri: request.base_url)
+        full_reset!
+      end
+
+      def debug
+        return render("yiffspace/error", locals: { message: "Access Denied" }, status: :forbidden) unless YiffSpace::Auth.enable_debug_action?
+
+        render(json: {
+          env:     request.env.select { |env| env.start_with?("yiffspace.") },
+          params:  params,
+          session: session,
+          client:  auth_client_config.as_json.merge(client_secret: "[REDACTED]"),
+          user:    client.fetch_user_info,
+          token:   client.access_token_claims(resource: auth_client_config.resource),
+        })
+      end
+
+      private
+
+      def client
+        @client ||= auth_client_config.logto(self)
+      end
+    end
+  end
+end

data/app/controllers/yiff_space/auth/webhook_controller.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require("openssl")
+require("active_support/security_utils")
+
+module YiffSpace
+  module Auth
+    class WebhookController < ApplicationController
+      skip_before_action(:verify_authenticity_token)
+
+      HANDLED_EVENTS = %w[
+        User.Roles.Updated
+        User.SuspensionStatus.Updated
+        User.Deleted
+        Role.Scopes.Updated
+      ].freeze
+      DIRTY_FLAG_TTL = 24.hours
+
+      def create
+        unless verify_signature
+          render(plain: "Unauthorized", status: :unauthorized)
+          return
+        end
+
+        payload = JSON.parse(request.raw_post)
+        event   = payload["event"]
+
+        handle_event(event, payload) if HANDLED_EVENTS.include?(event)
+
+        head(:ok)
+      rescue JSON::ParserError
+        render(plain: "Bad Request", status: :bad_request)
+      end
+
+      private
+
+      def verify_signature
+        secret = auth_client_config.logto_webhook_secret
+        return true if secret.blank?
+
+        received = request.headers["logto-signature-sha-256"].to_s
+        expected = OpenSSL::HMAC.hexdigest("SHA256", secret, request.raw_post)
+        ActiveSupport::SecurityUtils.secure_compare(received, expected)
+      end
+
+      def handle_event(event, payload)
+        data = payload["data"] || {}
+
+        if event == "Role.Scopes.Updated"
+          handle_role_scopes_updated(data)
+        else
+          user_id = data["id"]
+          mark_dirty(user_id) if user_id.present?
+        end
+      end
+
+      def handle_role_scopes_updated(data)
+        role_id = data["id"]
+        return if role_id.blank?
+
+        management = auth_client_config.logto_management
+        users      = management.get_users_with_role(role_id)
+        users.each { |u| mark_dirty(u["id"]) }
+      rescue StandardError => e
+        Rails.logger.error("[YiffSpace::Auth::WebhookController] Role.Scopes.Updated fan-out failed: #{e.message}")
+      end
+
+      def mark_dirty(user_id)
+        Rails.cache.write(format(Helper::DIRTY_FLAG_KEY, user_id), true, expires_in: DIRTY_FLAG_TTL)
+      end
+    end
+  end
+end

data/app/helpers/yiff_space/auth_helper.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+module YiffSpace
+  module AuthHelper
+  end
+end

data/app/views/yiff_space/auth/root/permissions.html.erb

@@ -0,0 +1,14 @@
+<h1 class="title">Permissions</h1>
+<% if logged_in? %>
+  <% if auth.permissions.any? %>
+    <ul class="permissions-list">
+      <% auth.permissions.each do |perm| %>
+        <li class="permission"><%= perm %></li>
+      <% end %>
+    </ul>
+  <% else %>
+    <p class="message">You have no permissions.</p>
+  <% end %>
+<% else %>
+  <p class="message">You are not logged in.</p>
+<% end %>

data/config/routes.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+YiffSpace::Auth::Engine.routes.draw do
+  constraints(YiffSpace::Auth::SetClientName.default) do
+    post(:webhook, controller: :webhook)
+    get(:cb, controller: :root)
+    get(:logout, controller: :root)
+    get(:permissions, controller: :root)
+    get(:debug, controller: :root) if YiffSpace::Auth.enable_debug_action?
+    root(action: :show, controller: :root, as: :auth)
+  end
+end

data/lib/tasks/yiffspace_auth_tasks.rake

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+namespace(:yiffspace) do
+  desc("Report and interactively remove duplicate/orphaned Logto users left behind by " \
+       "get_or_create_user races. Prompts for confirmation before deleting each one. " \
+       "Pass AUTH_CLIENT=name to use a registered auth client other than :default " \
+       "(e.g. AUTH_CLIENT=yiffyapi_manage).")
+  task(dedupe_users: :environment) do
+    client_name = (ENV["AUTH_CLIENT"] || YiffSpace::Auth::DEFAULT_CLIENT_NAME).to_sym
+    management = YiffSpace::Auth[client_name].logto_management
+
+    puts("Scanning users via auth client #{client_name.inspect}...")
+    result = YiffSpace::Utils::UserDeduper.scan(management)
+
+    puts("\n#{result[:conflicts].size} discord id(s) with more than one linked user (ambiguous - not handled by this task, review manually):")
+    result[:conflicts].each do |discord_id, group|
+      puts("  discordId=#{discord_id}: #{group.map { |u| "#{u.id} (#{u.name})" }.join(', ')}")
+    end
+
+    puts("\n#{result[:unresolved_orphans].size} orphaned user(s) with no matching linked account (not handled by this task, review manually):")
+    result[:unresolved_orphans].each do |user|
+      puts("  #{user.id} (name=#{user.name}, avatar=#{user.data.avatar})")
+    end
+
+    puts("\n#{result[:deletable_orphans].size} confirmed duplicate(s) - orphan left by a losing get_or_create_user race:")
+    if result[:deletable_orphans].empty?
+      puts("  none found")
+    else
+      result[:deletable_orphans].each do |orphan, keeper|
+        print("  delete #{orphan.id} (name=#{orphan.name}, avatar=#{orphan.data.avatar}), keeping #{keeper.id} (name=#{keeper.name}) for discordId=#{YiffSpace::Utils::UserDeduper.discord_id_for(keeper)}? [y/N] ")
+        answer = $stdin.gets&.strip&.downcase
+        if answer == "y"
+          management.delete_user(orphan.id)
+          puts("    deleted #{orphan.id}")
+        else
+          puts("    skipped")
+        end
+      end
+    end
+  end
+end

data/lib/yiffspace/auth/api_user.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module YiffSpace
+  module Auth
+    class ApiUser
+      attr_reader(:data)
+
+      def initialize(data)
+        @data = Utils::OpenHash.from(data)
+      end
+
+      delegate(:id, :name, to: :data)
+
+      def discord_id
+        data.identities.discord.userId
+      end
+
+      def created_at
+        Time.zone.at(data.createdAt)
+      end
+
+      def updated_at
+        Time.zone.at(data.updatedAt)
+      end
+
+      def last_sign_in_at
+        data.lastSignInAt.nil? ? nil : Time.zone.at(data.lastSignInAt)
+      end
+
+      def discord
+        DiscordInfo.new(data.identities.discord.details.rawData)
+      end
+
+      def avatar
+        Images::Avatar.get_for(discord_id, :discord)
+      end
+
+      def banner
+        Images::Banner.get_for(discord_id, :discord)
+      end
+    end
+  end
+end

data/lib/yiffspace/auth/auth_info/anonymous.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require("singleton")
+
+module YiffSpace
+  module Auth
+    class AuthInfo
+      class Anonymous
+        include(::Singleton)
+
+        %i[id token].each do |attr|
+          define_method(attr) { |*, **| raise(NotImplementedError, "#{attr} is not present on anonymous auth") }
+        end
+
+        def roles
+          []
+        end
+
+        def permissions
+          Permissions.new([])
+        end
+
+        def has_permission?(*)
+          false
+        end
+
+        def anonymous?
+          true
+        end
+
+        # this feels wrong, but it hopefully shouldn't break anything
+        def present?
+          false
+        end
+
+        def blank?
+          true
+        end
+
+        def serializable_hash(*)
+          nil
+        end
+
+        def to_session
+          serializable_hash
+        end
+
+        def self.from_json(*)
+          Anonymous.instance
+        end
+
+        def self.from_session(data)
+          return nil if data.blank?
+
+          from_json(data)
+        end
+      end
+    end
+  end
+end

data/lib/yiffspace/auth/auth_info.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+module YiffSpace
+  module Auth
+    class AuthInfo
+      attr_reader(:id, :token, :roles, :permissions, :client_id)
+
+      # @param id String
+      # @param roles Array(String)
+      # @param permissions Array(String)
+      # @param token LogtoClient::AccessTokenClaims
+      # @param client_id String
+      def initialize(id:, roles:, permissions:, token:, client_id:)
+        raise(ArgumentError, "no id provided") if id.blank?
+        raise(ArgumentError, "no token provided") if token.blank?
+        raise(ArgumentError, "no client id provided") if client_id.blank?
+
+        @id           = id
+        @token        = token
+        @roles        = Array(roles)
+        @permissions  = Permissions.new(permissions, separator: YiffSpace::Auth.get_by_id(client_id).permissions_separator)
+        @client_id    = client_id
+      end
+
+      def anonymous?
+        false
+      end
+
+      # this feels wrong, but it hopefully shouldn't break anything
+      def present?
+        true
+      end
+
+      def blank?
+        false
+      end
+
+      def has_permission?(name)
+        permissions.include?(name.to_s)
+      end
+
+      def serializable_hash(*)
+        {
+          "id"          => id,
+          "token"       => token.as_json,
+          "roles"       => roles,
+          "permissions" => permissions.values,
+          "client_id"   => client_id,
+        }
+      end
+
+      def to_session
+        serializable_hash
+      end
+
+      def self.from_json(data)
+        raise(ArgumentError, "invalid data") if data.blank?
+
+        data = JSON.parse(data) if data.is_a?(String)
+        data = ::YiffSpace::Utils::OpenHash.from(data)
+
+        new(
+          id:          data.id,
+          token:       data.token,
+          roles:       data.roles,
+          permissions: data.permissions,
+          client_id:   data.client_id,
+        )
+      end
+
+      def self.from_session(data)
+        return nil if data.blank?
+
+        from_json(data)
+      end
+    end
+  end
+end

data/lib/yiffspace/auth/client.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require_relative("../core_ext/logto/named_session_storage")
+require("httparty")
+
+module YiffSpace
+  module Auth
+    class Client
+      attr_accessor(:client_id, :client_secret, :scopes, :resource,
+                    :redirect_uri, :server_url, :auth_session_key, :user_session_key,
+                    :update_discord_images, :permissions_separator, :logto_webhook_secret)
+
+      attr_reader(:name)
+
+      def initialize(name)
+        @name                    = name.to_sym
+        @scopes                  = %i[openid offline_access profile roles identities custom_data]
+        @redirect_uri            = "http://127.0.0.1:3000/auth/cb"
+        @server_url              = "https://auth.yiff.space"
+        @auth_session_key        = :"yiffspace_auth_#{name}"
+        @user_session_key        = :"yiffspace_user_#{name}"
+        @update_discord_images   = true
+        @permissions_separator   = ":"
+        @logto_webhook_secret    = nil
+      end
+
+      def logto(controller)
+        LogtoClient.new(
+          config:   LogtoClient::Config.new(
+            endpoint:   server_url,
+            app_id:     client_id,
+            app_secret: client_secret,
+            scopes:     scopes,
+            resources:  [resource].compact,
+          ),
+          # Allow the client to redirect to other hosts (i.e. your Logto tenant)
+          navigate: ->(uri) { controller.redirect_to(uri, allow_other_host: true) },
+          # Controller has access to the session object
+          storage:  LogtoClient::NamedSessionStorage.new("yiffspace", controller.session, app_id: @name),
+        )
+      end
+
+      def logto_management
+        @logto_management ||= LogtoManagementClient.new(self)
+      end
+
+      def fetch_discord_user(id)
+        response = HTTParty.get("https://discord.com/api/v10/users/#{id}", { headers: { "Authorization" => "Bot #{YiffSpace.config.discord_bot_token}" } })
+        return nil if response.code == 404
+        raise("failed to fetch discord user: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200
+
+        DiscordInfo.new(response.parsed_response)
+      end
+    end
+  end
+end

data/lib/yiffspace/auth/discord_info.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module YiffSpace
+  module Auth
+    class DiscordInfo
+      # locale, mfa_enabled, and premium_type are not present for legacy users backfilled from api data,
+      # we don't need that data either way
+      ATTRIBUTES = %i[id flags avatar banner username global_name public_flags discriminator].freeze
+      attr_reader(:data, *ATTRIBUTES)
+
+      def initialize(options = {}, **kwargs)
+        @data = options.merge(kwargs).with_indifferent_access
+        ATTRIBUTES.each do |attr|
+          instance_variable_set("@#{attr}", @data[attr])
+        end
+
+        return unless YiffSpace.config.auth.update_discord_images
+
+        last_avatar = Rails.cache.fetch("yiffspace:auth:discord_avatar_update:#{id}")
+        last_banner = Rails.cache.fetch("yiffspace:auth:discord_banner_update:#{id}")
+
+        if last_avatar != avatar
+          Rails.cache.write("yiffspace:auth:discord_avatar_update:#{id}", avatar, expires_in: 30.days)
+          update_avatar
+        end
+
+        return unless last_banner != banner
+
+        Rails.cache.write("yiffspace:auth:discord_banner_update:#{id}", banner, expires_in: 30.days)
+        update_banner
+      end
+
+      def update_avatar
+        Images::Avatar.get_for(id, :discord).update(avatar)
+      end
+
+      def update_banner
+        Images::Banner.get_for(id, :discord).update(banner)
+      end
+
+      def serializable_hash(*)
+        ATTRIBUTES.to_h { |key| [key.to_s, instance_variable_get("@#{key}")] }
+      end
+
+      def to_session
+        serializable_hash
+      end
+
+      def self.from_json(data)
+        raise(ArgumentError, "invalid data") if data.blank?
+
+        data = JSON.parse(data) if data.is_a?(String)
+        data = ::YiffSpace::Utils::OpenHash.from(data)
+
+        new(data)
+      end
+
+      def self.from_session(data)
+        return nil if data.blank?
+
+        from_json(data)
+      end
+    end
+  end
+end

data/lib/yiffspace/auth/engine.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+require("rails")
+
+module YiffSpace
+  module Auth
+    class Engine < ::Rails::Engine
+      isolate_namespace(YiffSpace::Auth)
+      config.root = File.expand_path("../../..", __dir__)
+
+      initializer("yiffspace.auth.serializers") do
+        ActiveSupport.on_load(:active_job) do
+          ActiveJob::Serializers.add_serializers(
+            Serializers::AnonymousAuthInfoSerializer,
+            Serializers::AnonymousUserInfoSerializer,
+            Serializers::AuthInfoSerializer,
+            Serializers::DiscordInfoSerializer,
+            Serializers::PermissionsSerializer,
+            Serializers::UserInfoSerializer,
+          )
+        end
+      end
+
+      class << self
+        def for(name)
+          @instances              ||= {}
+          @instances[name.to_sym] ||= begin
+            subclass = Class.new(self)
+            subclass.engine_name("yiffspace_auth_#{name}")
+            # Inherit isolation settings that aren't copied from the parent class
+            subclass.instance_variable_set(:@isolated, true)
+            subclass.routes.default_scope = { module: "yiff_space/auth" }
+            subclass.routes.draw do
+              constraints(SetClientName.new(name)) do
+                post(:webhook, controller: :webhook, action: :create)
+                get(:cb, controller: :root)
+                get(:logout, controller: :root)
+                get(:permissions, controller: :root)
+                get(:debug, controller: :root) if ::YiffSpace::Auth.enable_debug_action?
+                root(action: :show, controller: :root, as: :auth)
+              end
+            end
+            subclass
+          end
+        end
+      end
+    end
+  end
+end