yiffspace-auth 0.0.1

data/lib/yiffspace/logto_management_client.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+require("active_support/core_ext/integer/time")
+require("httparty")
+
+module YiffSpace
+  class LogtoManagementClient
+    attr_reader(:auth)
+
+    def initialize(auth)
+      @auth = auth
+    end
+
+    def get_token # rubocop:disable Naming/AccessorMethodName
+      if @_cached_token
+        return @_cached_token if @_cache_expire_time > Time.current
+
+        @_cached_token = nil
+        @_cache_expire_time = nil
+      end
+      response = HTTParty.post("#{auth.server_url}/oidc/token", {
+        body: {
+          grant_type:    "client_credentials",
+          client_id:     YiffSpace.config.logto_api_client_id,
+          client_secret: YiffSpace.config.logto_api_client_secret,
+          resource:      YiffSpace.config.logto_api_resource,
+          scope:         "all",
+        },
+      })
+      raise("failed to get access token: #{response.to_json}") unless response.key?("access_token")
+
+      @_cached_token = response["access_token"]
+      @_cache_expire_time = response["expires_in"].to_i.seconds.from_now
+      response["access_token"]
+    end
+
+    def get_user(id)
+      response = HTTParty.get("#{auth.server_url}/api/users?discordId=#{id}", { headers: { "Authorization" => "Bearer #{get_token}" } })
+      return nil if response.code == 404 || (response.parsed_response.is_a?(Array) && response.parsed_response.empty?)
+      raise("failed to get user: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200 || !response.parsed_response.is_a?(Array)
+
+      Utils::TraceLogger.warn("LogtoManagementClient", "query discordId=#{id} returned more than one user:\n#{response.parsed_response.inspect}") if response.parsed_response.length > 1
+
+      Auth::ApiUser.new(response.parsed_response.first)
+    end
+
+    def create_user(id)
+      details = auth.fetch_discord_user(id)&.data
+      raise("invalid discord user: #{id}") if details.blank?
+
+      response = HTTParty.post("#{auth.server_url}/api/users", {
+        headers: { "Authorization" => "Bearer #{get_token}", "Content-Type" => "application/json" },
+        body:    { avatar: "https://cdn.discordapp.com/avatars/#{details['id']}/#{details['avatar']}", name: details["username"] }.to_json,
+      })
+      raise("failed to create user: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200
+
+      response2 = HTTParty.put("#{auth.server_url}/api/users/#{response.parsed_response['id']}/identities/discord", {
+        headers: { "Authorization" => "Bearer #{get_token}", "Content-Type" => "application/json" },
+        body:    {
+          userId:  details["id"],
+          details: {
+            id:      details["id"],
+            name:    details["username"],
+            avatar:  "https://cdn.discordapp.com/avatars/#{details['id']}/#{details['avatar']}",
+            rawData: details,
+          },
+        }.to_json,
+      })
+      raise("failed to add discord identity: #{response2.code} #{response2.message}\n#{response2.parsed_response.inspect}") if response2.code != 201
+
+      get_user(id) # force fresh fetch to ensure identity data is included properly
+    end
+
+    def get_or_create_user(id)
+      get_user(id) || create_user(id)
+    end
+
+    # Pages through every user in the tenant. Used by maintenance tasks (e.g. the
+    # dedupe_users rake task) - there's no discordId to filter by when scanning the
+    # whole user base for duplicates/orphans.
+    def list_users(page_size: 100)
+      users = []
+      page = 1
+      loop do
+        response = HTTParty.get("#{auth.server_url}/api/users", {
+          headers: { "Authorization" => "Bearer #{get_token}" },
+          query:   { page: page, page_size: page_size },
+        })
+        raise("failed to list users: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200 || !response.parsed_response.is_a?(Array)
+
+        batch = response.parsed_response
+        users.concat(batch.map { |u| Auth::ApiUser.new(u) })
+        break if batch.length < page_size
+
+        page += 1
+      end
+      users
+    end
+
+    def delete_user(logto_id)
+      response = HTTParty.delete("#{auth.server_url}/api/users/#{logto_id}", { headers: { "Authorization" => "Bearer #{get_token}" } })
+      return true if [204, 404].include?(response.code)
+
+      raise("failed to delete user #{logto_id}: #{response.code} #{response.message}\n#{response.parsed_response.inspect}")
+    end
+
+    def get_user_by_id(logto_id)
+      response = HTTParty.get("#{auth.server_url}/api/users/#{logto_id}", { headers: { "Authorization" => "Bearer #{get_token}" } })
+      return nil if response.code == 404
+      raise("failed to get user: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200
+
+      Auth::ApiUser.new(response.parsed_response)
+    end
+
+    def get_user_roles(logto_id)
+      response = HTTParty.get("#{auth.server_url}/api/users/#{logto_id}/roles", { headers: { "Authorization" => "Bearer #{get_token}" } })
+      raise("failed to get user roles: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200
+
+      response.parsed_response
+    end
+
+    def get_role_scopes(role_id)
+      response = HTTParty.get("#{auth.server_url}/api/roles/#{role_id}/scopes", { headers: { "Authorization" => "Bearer #{get_token}" } })
+      raise("failed to get role scopes: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200
+
+      response.parsed_response
+    end
+
+    def get_users_with_role(role_id)
+      response = HTTParty.get("#{auth.server_url}/api/roles/#{role_id}/users", { headers: { "Authorization" => "Bearer #{get_token}" } })
+      raise("failed to get users with role: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200
+
+      response.parsed_response
+    end
+  end
+end

data/lib/yiffspace/serializers/anonymous_auth_info_serializer.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require("active_job")
+
+module YiffSpace
+  module Serializers
+    class AnonymousAuthInfoSerializer < ActiveJob::Serializers::ObjectSerializer
+      def serialize(_)
+        super({})
+      end
+
+      def deserialize(_)
+        Auth::AuthInfo::Anonymous.instance
+      end
+
+      private
+
+      def klass
+        Auth::AuthInfo::Anonymous
+      end
+    end
+  end
+end

data/lib/yiffspace/serializers/anonymous_user_info_serializer.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require("active_job")
+
+module YiffSpace
+  module Serializers
+    class AnonymousUserInfoSerializer < ActiveJob::Serializers::ObjectSerializer
+      def serialize(_)
+        super({})
+      end
+
+      def deserialize(_)
+        Auth::UserInfo::Anonymous.instance
+      end
+
+      private
+
+      def klass
+        Auth::UserInfo::Anonymous
+      end
+    end
+  end
+end

data/lib/yiffspace/serializers/auth_info_serializer.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require("active_job")
+
+module YiffSpace
+  module Serializers
+    class AuthInfoSerializer < ActiveJob::Serializers::ObjectSerializer
+      def serialize(arg)
+        super(**arg.serializable_hash)
+      end
+
+      def deserialize(arg)
+        Auth::AuthInfo.from_json(arg)
+      end
+
+      private
+
+      def klass
+        Auth::AuthInfo
+      end
+    end
+  end
+end

data/lib/yiffspace/serializers/discord_info_serializer.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require("active_job")
+
+module YiffSpace
+  module Serializers
+    class DiscordInfoSerializer < ActiveJob::Serializers::ObjectSerializer
+      def serialize(arg)
+        super(**arg.serializable_hash)
+      end
+
+      def deserialize(arg)
+        Auth::DiscordInfo.from_json(arg)
+      end
+
+      private
+
+      def klass
+        Auth::DiscordInfo
+      end
+    end
+  end
+end

data/lib/yiffspace/serializers/permissions_serializer.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require("active_job")
+
+module YiffSpace
+  module Serializers
+    class PermissionsSerializer < ActiveJob::Serializers::ObjectSerializer
+      def serialize(arg)
+        super("value" => arg.value)
+      end
+
+      def deserialize(arg)
+        Auth::Permissions.new(arg["value"])
+      end
+
+      private
+
+      def klass
+        Auth::Permissions
+      end
+    end
+  end
+end

data/lib/yiffspace/serializers/user_info_serializer.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require("active_job")
+
+module YiffSpace
+  module Serializers
+    class UserInfoSerializer < ActiveJob::Serializers::ObjectSerializer
+      def serialize(arg)
+        super(**arg.serializable_hash)
+      end
+
+      def deserialize(arg)
+        Auth::UserInfo.from_json(arg)
+      end
+
+      private
+
+      def klass
+        Auth::UserInfo
+      end
+    end
+  end
+end

data/lib/yiffspace/utils/user_deduper.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+module YiffSpace
+  module Utils
+    # get_or_create_user is check-then-act (query Logto, then create) with no locking
+    # of its own - two concurrent calls for a discord id that doesn't exist yet will
+    # both create a user, and the loser's discord-identity-attach step fails once the
+    # winner's identity claims it first. That leaves an identity-less "orphan" user
+    # behind in Logto. This scans the whole user base to find those orphans (and any
+    # other duplicate/ambiguous state) so they can be cleaned up.
+    module UserDeduper
+      # create_user sets a new user's avatar to the discord CDN URL for the discord id
+      # it was created for, before the identity-attach step runs - so even an orphan
+      # that never got its identity attached still reveals which discord id it was
+      # meant for.
+      AVATAR_ID_PATTERN = %r{cdn\.discordapp\.com/avatars/(\d+)/}
+
+      module_function
+
+      def discord_id_for(user)
+        user.data.identities&.discord&.userId || avatar_discord_id_for(user)
+      end
+
+      def avatar_discord_id_for(user)
+        match = user.data.avatar.to_s.match(AVATAR_ID_PATTERN)
+        match && match[1]
+      end
+
+      def linked?(user)
+        user.data.identities&.discord&.userId.present?
+      end
+
+      # Returns a hash with:
+      # - :conflicts - discord id => users, for ids where more than one user has the
+      #   identity actually attached. Ambiguous; always needs manual review, never
+      #   auto-deleted.
+      # - :deletable_orphans - [orphan, keeper] pairs, where orphan has no identity
+      #   attached but its avatar points at a discord id claimed by exactly one other
+      #   (linked) user. This is the confirmed race-loser case - safe to delete.
+      # - :unresolved_orphans - users with no identity attached and no corresponding
+      #   linked user (still mid-race, or the winner can't be identified). Reported
+      #   only, never auto-deleted.
+      def scan(management)
+        users = management.list_users
+        linked, unlinked = users.partition { |u| linked?(u) }
+
+        by_discord_id = linked.group_by { |u| u.data.identities.discord.userId }
+        conflicts = by_discord_id.select { |_id, group| group.length > 1 }
+
+        deletable_orphans = []
+        unresolved_orphans = []
+        unlinked.each do |user|
+          discord_id = avatar_discord_id_for(user)
+          keeper = discord_id && by_discord_id[discord_id]
+          if keeper&.length == 1
+            deletable_orphans << [user, keeper.first]
+          else
+            unresolved_orphans << user
+          end
+        end
+
+        { conflicts: conflicts, deletable_orphans: deletable_orphans, unresolved_orphans: unresolved_orphans }
+      end
+    end
+  end
+end

metadata

@@ -0,0 +1,153 @@
+--- !ruby/object:Gem::Specification
+name: yiffspace-auth
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Donovan_DMC
+bindir: bin
+cert_chain: []
+date: 2026-07-14 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: httparty
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.24'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.24'
+- !ruby/object:Gem::Dependency
+  name: logto
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.2.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.2.0
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+- !ruby/object:Gem::Dependency
+  name: yiffspace
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.0
+- !ruby/object:Gem::Dependency
+  name: zeitwerk
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.6'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.6'
+description: Logto-based auth engine for https://yiff.space and related projects
+email:
+- hewwo@yiff.rocks
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE
+- README.md
+- Rakefile
+- app/controllers/yiff_space/auth/application_controller.rb
+- app/controllers/yiff_space/auth/root_controller.rb
+- app/controllers/yiff_space/auth/webhook_controller.rb
+- app/helpers/yiff_space/auth_helper.rb
+- app/views/yiff_space/auth/root/permissions.html.erb
+- config/routes.rb
+- lib/tasks/yiffspace_auth_tasks.rake
+- lib/yiffspace/auth.rb
+- lib/yiffspace/auth/api_user.rb
+- lib/yiffspace/auth/auth_info.rb
+- lib/yiffspace/auth/auth_info/anonymous.rb
+- lib/yiffspace/auth/client.rb
+- lib/yiffspace/auth/discord_info.rb
+- lib/yiffspace/auth/engine.rb
+- lib/yiffspace/auth/helper.rb
+- lib/yiffspace/auth/permissions.rb
+- lib/yiffspace/auth/set_client_name.rb
+- lib/yiffspace/auth/user_info.rb
+- lib/yiffspace/auth/user_info/anonymous.rb
+- lib/yiffspace/auth/version.rb
+- lib/yiffspace/core_ext/action_dispatch/set_auth_client.rb
+- lib/yiffspace/core_ext/action_dispatch/set_auth_client/scoped.rb
+- lib/yiffspace/core_ext/logto/named_session_storage.rb
+- lib/yiffspace/extensions/action_dispatch/set_auth_client.rb
+- lib/yiffspace/extensions/action_dispatch/set_auth_client/scoped.rb
+- lib/yiffspace/extensions/logto/named_session_storage.rb
+- lib/yiffspace/logto_management_client.rb
+- lib/yiffspace/serializers/anonymous_auth_info_serializer.rb
+- lib/yiffspace/serializers/anonymous_user_info_serializer.rb
+- lib/yiffspace/serializers/auth_info_serializer.rb
+- lib/yiffspace/serializers/discord_info_serializer.rb
+- lib/yiffspace/serializers/permissions_serializer.rb
+- lib/yiffspace/serializers/user_info_serializer.rb
+- lib/yiffspace/utils/user_deduper.rb
+homepage: https://yiff.space
+licenses:
+- MIT
+metadata:
+  allowed_push_host: https://rubygems.org
+  homepage_uri: https://yiff.space
+  source_code_uri: https://github.com/YiffSpace/Auth.rb
+  changelog_uri: https://github.com/YiffSpace/Auth.rb/blob/master/CHANGELOG.md
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.4.1
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.2
+specification_version: 4
+summary: Logto-based auth engine for https://yiff.space and related projects
+test_files: []