yiffspace-auth 0.0.1

data/lib/yiffspace/auth/helper.rb

@@ -0,0 +1,174 @@
+# frozen_string_literal: true
+
+require("active_support/concern")
+
+module YiffSpace
+  module Auth
+    module Helper
+      extend(ActiveSupport::Concern)
+
+      module ClassMethods
+        def set_client_name(name) # rubocop:disable Naming/AccessorMethodName
+          before_action do |controller|
+            controller.request.env["yiffspace.auth.client_name"] = name
+            if controller.respond_to?(:yiffspace_client_name=)
+              controller.yiffspace_client_name = name
+            elsif controller.respond_to?(:client_name=)
+              controller.client_name = name
+            elsif controller.respond_to?(:helpers)
+              if controller.helpers.respond_to?(:yiffspace_client_name=)
+                controller.helpers.yiffspace_client_name = name
+              elsif controller.helpers.respond_to?(:client_name=)
+                controller.helpers.client_name = name
+              end
+            end
+          end
+        end
+      end
+
+      def auth_raw
+        session[auth_client_config.auth_session_key]
+      end
+
+      def auth
+        return AuthInfo::Anonymous.instance if auth_raw.blank?
+
+        AuthInfo.from_session(auth_raw)
+      end
+
+      def auth?
+        auth_raw.present? && !auth.anonymous?
+      end
+
+      def auth=(value)
+        value                                        = nil if value.is_a?(AuthInfo::Anonymous)
+        session[auth_client_config.auth_session_key] = value&.to_session
+      end
+
+      def reset_auth!
+        session.delete(auth_client_config.auth_session_key)
+      end
+
+      def user_raw
+        session[auth_client_config.user_session_key]
+      end
+
+      def user
+        return UserInfo::Anonymous.instance if user_raw.blank?
+
+        UserInfo.from_session(user_raw)
+      end
+
+      def user?
+        user_raw.present? && !user.anonymous?
+      end
+
+      def user=(value)
+        value                                        = nil if value.is_a?(UserInfo::Anonymous)
+        session[auth_client_config.user_session_key] = value&.to_session
+      end
+
+      def reset_user!
+        session.delete(auth_client_config.user_session_key)
+      end
+
+      def full_reset!
+        reset_auth!
+        reset_user!
+      end
+
+      def require_auth(path)
+        redirect_to(path) unless logged_in?
+      end
+
+      def logged_in?
+        auth? && user?
+      end
+
+      def has_permission?(name)
+        return false unless logged_in?
+
+        auth.permissions.has?(name)
+      end
+
+      DIRTY_FLAG_KEY = "yiffspace:auth:dirty:%s"
+
+      # Checks the dirty flag written by the Logto webhook handler. If set, re-fetches
+      # the user's current roles and permissions from the Logto Management API and
+      # rewrites the session — without waiting for the access token to expire.
+      # Call this as a before_action in any controller that needs instant revocation.
+      def sync_auth_if_dirty!
+        return unless auth?
+
+        flag_key = format(DIRTY_FLAG_KEY, auth.id)
+        return unless Rails.cache.exist?(flag_key)
+
+        Rails.cache.delete(flag_key)
+
+        management = auth_client_config.logto_management
+        api_user   = management.get_user_by_id(auth.id)
+
+        if api_user.nil? || api_user.data["isSuspended"]
+          full_reset!
+          return
+        end
+
+        roles       = management.get_user_roles(auth.id)
+        permissions = roles.flat_map { |role| management.get_role_scopes(role["id"]) }
+                           .pluck("name")
+                           .uniq
+
+        self.auth = AuthInfo.new(
+          id:          auth.id,
+          token:       auth.token,
+          roles:       roles.pluck("name"),
+          permissions: permissions,
+          client_id:   auth.client_id,
+        )
+      end
+
+      def url_helpers
+        YiffSpace::Auth::Engine.for(client_name).routes.url_helpers
+      end
+
+      # Returns the Auth::Client for the current request. In auth engine controllers this is
+      # resolved from the routing default set by Engine.for; in host app controllers it falls
+      # back to the default registered client. Override in your controller to choose a specific
+      # client when multiple are registered.
+      def auth_client_config
+        client_name = self.client_name
+        client_name.present? ? YiffSpace::Auth[client_name.to_sym] : YiffSpace::Auth.default
+      end
+
+      def client_name
+        respond_to?(:request, true) && request.env[CLIENT_NAME_ENV]
+      end
+
+      def client_name=(value)
+        request.env[CLIENT_NAME_ENV] = value.to_sym
+      end
+
+      module Scoped
+        extend(ActiveSupport::Concern)
+        include(Helper)
+
+        included do
+          private(*Helper.instance_methods(false))
+          private_class_method(*Helper::ClassMethods.instance_methods(false))
+        end
+
+        Helper.instance_methods(false).each do |name|
+          define_method("yiffspace_#{name}") { |*args, **kwargs, &block| send(name, *args, **kwargs, &block) }
+        end
+
+        module ClassMethods
+          include(Helper::ClassMethods)
+
+          Helper::ClassMethods.instance_methods(false).each do |name|
+            define_method("yiffspace_#{name}") { |*args, **kwargs, &block| send(name, *args, **kwargs, &block) }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/yiffspace/auth/permissions.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+module YiffSpace
+  module Auth
+    class Permissions
+      attr_accessor(:values)
+
+      delegate(:each, to: :values)
+
+      include(Enumerable)
+
+      def initialize(perms, separator: ":")
+        @values = perms
+        @tree   = {}
+        @separator = separator
+
+        perms.each do |perm|
+          current = @tree
+          parts   = perm.split(separator)
+
+          parts.each do |part|
+            current[part] ||= {}
+            current       = current[part]
+          end
+
+          # mark leaf
+          current[:__leaf__] = true
+        end
+      end
+
+      def has?(perm)
+        current = @tree
+        parts   = perm.split(@separator)
+
+        parts.each do |part|
+          return false unless current[part]
+
+          current = current[part]
+        end
+
+        current[:__leaf__] == true
+      end
+
+      alias include? has?
+
+      def method_missing(name, *_args)
+        str = name.to_s
+
+        if str.end_with?("?")
+          key = str[0..-2]
+          return @tree[key]&.dig(:__leaf__) == true
+        end
+
+        if @tree.key?(str)
+          self.class.new_from_subtree(@tree[str], @separator)
+        else
+          # return empty node instead of raising
+          self.class.new([], separator: @separator)
+        end
+      end
+
+      def respond_to_missing?(_name, _include_private = false)
+        true
+      end
+
+      def self.new_from_subtree(tree, separator)
+        obj = allocate
+        obj.instance_variable_set(:@tree, tree)
+        obj.instance_variable_set(:@values, leaves_from_tree(tree))
+        obj.instance_variable_set(:@separator, separator)
+        obj
+      end
+
+      def self.leaves_from_tree(node, prefix = "")
+        result = []
+        node.each do |key, subtree|
+          next if key == :__leaf__
+
+          path = prefix.empty? ? key : "#{prefix}.#{key}"
+          result << path if subtree[:__leaf__]
+          result.concat(leaves_from_tree(subtree, path))
+        end
+        result
+      end
+    end
+  end
+end

data/lib/yiffspace/auth/set_client_name.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module YiffSpace
+  module Auth
+    class SetClientName < Utils::SetEnvConstraint
+      def initialize(value)
+        super(CLIENT_NAME_ENV, value.to_sym)
+      end
+
+      def self.default
+        new(DEFAULT_CLIENT_NAME)
+      end
+    end
+  end
+end

data/lib/yiffspace/auth/user_info/anonymous.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require("singleton")
+
+module YiffSpace
+  module Auth
+    class UserInfo
+      class Anonymous
+        include(::Singleton)
+
+        %i[id user discord avatar].each do |attr|
+          define_method(attr) { |*, **| raise(NotImplementedError, "#{attr} is not present on anonymous user") }
+        end
+
+        def username
+          "anonymous"
+        end
+
+        def display_name
+          "Anonymous"
+        end
+
+        def avatar
+          nil
+        end
+
+        def avatar_url
+          nil
+        end
+
+        def banner
+          nil
+        end
+
+        def banner_url
+          nil
+        end
+
+        def anonymous?
+          true
+        end
+
+        # this feels wrong, but it hopefully shouldn't break anything
+        def present?
+          false
+        end
+
+        def blank?
+          true
+        end
+
+        def serializable_hash(*)
+          nil
+        end
+
+        def to_session
+          serializable_hash
+        end
+
+        def self.from_json(*)
+          Anonymous.instance
+        end
+
+        def self.from_session(data)
+          return nil if data.blank?
+
+          from_json(data)
+        end
+      end
+    end
+  end
+end

data/lib/yiffspace/auth/user_info.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+module YiffSpace
+  module Auth
+    class UserInfo
+      attr_reader(:id, :user, :discord)
+
+      # @param id String
+      # @param user LogtoCore::UserInfoResponse
+      # @param discord Hash
+      def initialize(id:, user:, discord:)
+        raise(ArgumentError, "no id provided") if id.blank?
+        raise(ArgumentError, "no user provided") if user.blank?
+
+        @id        = id
+        @user      = user
+        @discord   = DiscordInfo.from_json(discord)
+      end
+
+      def anonymous?
+        false
+      end
+
+      # this feels wrong, but it hopefully shouldn't break anything
+      def present?
+        true
+      end
+
+      def blank?
+        false
+      end
+
+      def avatar(type = nil)
+        type.present? ? Images::Avatar.get_for(id, type) : Images::Avatar.default_for(id)
+      end
+
+      def avatar_url(type = nil)
+        avatar(type).url
+      end
+
+      def banner(type = nil)
+        type.present? ? Images::Banner.get_for(id, type) : Images::Banner.default_for(id)
+      end
+
+      def banner_url(type = nil)
+        banner(type).url
+      end
+
+      delegate(:username, to: :discord)
+
+      def display_name
+        discord.global_name
+      end
+
+      def serializable_hash(_options = {})
+        {
+          "id"      => id,
+          "discord" => discord.serializable_hash,
+          "user"    => user.as_json,
+        }
+      end
+
+      def to_session
+        serializable_hash.without("discord").merge(discord: discord.to_session)
+      end
+
+      def self.from_json(data)
+        raise(ArgumentError, "invalid data") if data.blank?
+
+        data = JSON.parse(data) if data.is_a?(String)
+        data = ::YiffSpace::Utils::OpenHash.from(data)
+
+        new(
+          id:      data.id,
+          discord: data.discord,
+          user:    data.user,
+        )
+      end
+
+      def self.from_session(data)
+        return nil if data.blank?
+
+        from_json(data)
+      end
+    end
+  end
+end

data/lib/yiffspace/auth/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module YiffSpace
+  module Auth
+    VERSION = "0.0.1"
+  end
+end

data/lib/yiffspace/auth.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require("yiffspace")
+require("zeitwerk")
+
+loader = Zeitwerk::Loader.for_gem_extension(YiffSpace)
+loader.ignore("#{__dir__}/core_ext")
+loader.ignore("#{__dir__}/auth/engine.rb")
+loader.setup
+
+# Require the auth engine eagerly so it registers with Rails before the host app's
+# active_support.initialize_per_engine_zeitwerk_loaders initializer runs. Without this,
+# the engine is only loaded during route drawing (after Zeitwerk setup) and its
+# app/controllers path is never added to the app's autoload roots.
+require_relative("auth/engine") if defined?(Rails)
+
+module YiffSpace
+  module Auth
+    CLIENT_NAME_ENV     = "yiffspace.auth.client_name"
+    DEFAULT_CLIENT_NAME = :default
+
+    @clients             = {}
+    @enable_debug_action = false
+
+    module_function
+
+    def register(name, &block)
+      client = Client.new(name)
+      block&.call(client)
+      @clients[name.to_sym] = client
+      client
+    end
+
+    def [](name)
+      @clients[name.to_sym] || raise(KeyError, "unknown auth client: #{name.inspect}")
+    end
+
+    def default
+      @clients[DEFAULT_CLIENT_NAME] || raise("no default client configured")
+    end
+
+    def get_by_id(id)
+      @clients.values.find { |c| c.client_id == id } || raise(ArgumentError, "unable to find client with id: #{id}")
+    end
+
+    def enable_debug_action?
+      @enable_debug_action
+    end
+
+    def enable_debug_action!
+      @enable_debug_action = true
+    end
+
+    def disable_debug_action!
+      @enable_debug_action = false
+    end
+  end
+
+  class Configuration
+    # Logto Management API credentials (shared across all auth clients).
+    attr_accessor(:logto_api_client_id, :logto_api_client_secret, :logto_api_resource)
+
+    # Discord bot token used to look up Discord users (shared across all auth clients).
+    attr_accessor(:discord_bot_token)
+
+    def auth(&block)
+      client = YiffSpace::Auth.register(Auth::DEFAULT_CLIENT_NAME) unless YiffSpace::Auth.instance_variable_get(:@clients).key?(Auth::DEFAULT_CLIENT_NAME)
+      client ||= YiffSpace::Auth[Auth::DEFAULT_CLIENT_NAME]
+      block&.call(client)
+      client
+    end
+
+    def add_auth(name, &)
+      YiffSpace::Auth.register(name, &)
+    end
+
+    def add_default_auth(&)
+      add_auth(Auth::DEFAULT_CLIENT_NAME, &)
+    end
+  end
+end

data/lib/yiffspace/core_ext/action_dispatch/set_auth_client/scoped.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require_relative("../../../extensions/action_dispatch/set_auth_client/scoped")
+
+module ActionDispatch
+  module Routing
+    class Mapper
+      module Scoping
+        include(YiffSpace::Extensions::ActionDispatch::SetAuthClient::Scoped)
+      end
+    end
+  end
+end

data/lib/yiffspace/core_ext/action_dispatch/set_auth_client.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require_relative("../../extensions/action_dispatch/set_auth_client")
+
+module ActionDispatch
+  module Routing
+    class Mapper
+      module Scoping
+        include(YiffSpace::Extensions::ActionDispatch::SetAuthClient)
+      end
+    end
+  end
+end

data/lib/yiffspace/core_ext/logto/named_session_storage.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+require_relative("../../extensions/logto/named_session_storage")
+
+class LogtoClient
+  NamedSessionStorage = YiffSpace::Extensions::Logto::NamedSessionStorage
+end

data/lib/yiffspace/extensions/action_dispatch/set_auth_client/scoped.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module YiffSpace
+  module Extensions
+    module ActionDispatch
+      module SetAuthClient
+        module Scoped
+          def yiffspace_set_auth_client(name, &)
+            constraints(Auth::SetClientName.new(name), &)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/yiffspace/extensions/action_dispatch/set_auth_client.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module YiffSpace
+  module Extensions
+    module ActionDispatch
+      module SetAuthClient
+        def set_auth_client(name, &)
+          constraints(Auth::SetClientName.new(name), &)
+        end
+      end
+    end
+  end
+end

data/lib/yiffspace/extensions/logto/named_session_storage.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require("logto/client")
+
+module YiffSpace
+  module Extensions
+    module Logto
+      class NamedSessionStorage < LogtoClient::SessionStorage
+        def initialize(name, session, app_id: nil)
+          super(session, app_id: app_id)
+          @name = name
+        end
+
+        protected
+
+        def get_session_key(key)
+          "#{@name}_#{@app_id || 'default'}_#{key}"
+        end
+      end
+    end
+  end
+end