yiffspace 0.0.24 → 0.1.0

data/engines/auth/app/views/yiff_space/auth/root/permissions.html.erb

@@ -1,14 +0,0 @@
-<h1 class="title">Permissions</h1>
-<% if logged_in? %>
-  <% if auth.permissions.any? %>
-    <ul class="permissions-list">
-      <% auth.permissions.each do |perm| %>
-        <li class="permission"><%= perm %></li>
-      <% end %>
-    </ul>
-  <% else %>
-    <p class="message">You have no permissions.</p>
-  <% end %>
-<% else %>
-  <p class="message">You are not logged in.</p>
-<% end %>

data/engines/auth/config/routes.rb

@@ -1,12 +0,0 @@
-# frozen_string_literal: true
-
-YiffSpace::Auth::Engine.routes.draw do
-  constraints(YiffSpace::Auth::SetClientName.default) do
-    post(:webhook, controller: :webhook)
-    get(:cb, controller: :root)
-    get(:logout, controller: :root)
-    get(:permissions, controller: :root)
-    get(:debug, controller: :root) if YiffSpace::Auth.enable_debug_action?
-    root(action: :show, controller: :root, as: :auth)
-  end
-end

data/lib/tasks/yiffspace_tasks.rake

@@ -1,41 +0,0 @@
-# frozen_string_literal: true
-
-namespace(:yiffspace) do
-  desc("Report and interactively remove duplicate/orphaned Logto users left behind by " \
-       "get_or_create_user races. Prompts for confirmation before deleting each one. " \
-       "Pass AUTH_CLIENT=name to use a registered auth client other than :default " \
-       "(e.g. AUTH_CLIENT=yiffyapi_manage).")
-  task(dedupe_users: :environment) do
-    client_name = (ENV["AUTH_CLIENT"] || YiffSpace::Auth::DEFAULT_CLIENT_NAME).to_sym
-    management = YiffSpace::Auth[client_name].logto_management
-
-    puts("Scanning users via auth client #{client_name.inspect}...")
-    result = YiffSpace::Utils::UserDeduper.scan(management)
-
-    puts("\n#{result[:conflicts].size} discord id(s) with more than one linked user (ambiguous - not handled by this task, review manually):")
-    result[:conflicts].each do |discord_id, group|
-      puts("  discordId=#{discord_id}: #{group.map { |u| "#{u.id} (#{u.name})" }.join(', ')}")
-    end
-
-    puts("\n#{result[:unresolved_orphans].size} orphaned user(s) with no matching linked account (not handled by this task, review manually):")
-    result[:unresolved_orphans].each do |user|
-      puts("  #{user.id} (name=#{user.name}, avatar=#{user.data.avatar})")
-    end
-
-    puts("\n#{result[:deletable_orphans].size} confirmed duplicate(s) - orphan left by a losing get_or_create_user race:")
-    if result[:deletable_orphans].empty?
-      puts("  none found")
-    else
-      result[:deletable_orphans].each do |orphan, keeper|
-        print("  delete #{orphan.id} (name=#{orphan.name}, avatar=#{orphan.data.avatar}), keeping #{keeper.id} (name=#{keeper.name}) for discordId=#{YiffSpace::Utils::UserDeduper.discord_id_for(keeper)}? [y/N] ")
-        answer = $stdin.gets&.strip&.downcase
-        if answer == "y"
-          management.delete_user(orphan.id)
-          puts("    deleted #{orphan.id}")
-        else
-          puts("    skipped")
-        end
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/api_user.rb

@@ -1,43 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Auth
-    class ApiUser
-      attr_reader(:data)
-
-      def initialize(data)
-        @data = Utils::OpenHash.from(data)
-      end
-
-      delegate(:id, :name, to: :data)
-
-      def discord_id
-        data.identities.discord.userId
-      end
-
-      def created_at
-        Time.zone.at(data.createdAt)
-      end
-
-      def updated_at
-        Time.zone.at(data.updatedAt)
-      end
-
-      def last_sign_in_at
-        data.lastSignInAt.nil? ? nil : Time.zone.at(data.lastSignInAt)
-      end
-
-      def discord
-        DiscordInfo.new(data.identities.discord.details.rawData)
-      end
-
-      def avatar
-        Images::Avatar.get_for(discord_id, :discord)
-      end
-
-      def banner
-        Images::Banner.get_for(discord_id, :discord)
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/auth_info/anonymous.rb

@@ -1,60 +0,0 @@
-# frozen_string_literal: true
-
-require("singleton")
-
-module YiffSpace
-  module Auth
-    class AuthInfo
-      class Anonymous
-        include(::Singleton)
-
-        %i[id token].each do |attr|
-          define_method(attr) { |*, **| raise(NotImplementedError, "#{attr} is not present on anonymous auth") }
-        end
-
-        def roles
-          []
-        end
-
-        def permissions
-          Permissions.new([])
-        end
-
-        def has_permission?(*)
-          false
-        end
-
-        def anonymous?
-          true
-        end
-
-        # this feels wrong, but it hopefully shouldn't break anything
-        def present?
-          false
-        end
-
-        def blank?
-          true
-        end
-
-        def serializable_hash(*)
-          nil
-        end
-
-        def to_session
-          serializable_hash
-        end
-
-        def self.from_json(*)
-          Anonymous.instance
-        end
-
-        def self.from_session(data)
-          return nil if data.blank?
-
-          from_json(data)
-        end
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/auth_info.rb

@@ -1,78 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Auth
-    class AuthInfo
-      attr_reader(:id, :token, :roles, :permissions, :client_id)
-
-      # @param id String
-      # @param roles Array(String)
-      # @param permissions Array(String)
-      # @param token LogtoClient::AccessTokenClaims
-      # @param client_id String
-      def initialize(id:, roles:, permissions:, token:, client_id:)
-        raise(ArgumentError, "no id provided") if id.blank?
-        raise(ArgumentError, "no token provided") if token.blank?
-        raise(ArgumentError, "no client id provided") if client_id.blank?
-
-        @id           = id
-        @token        = token
-        @roles        = Array(roles)
-        @permissions  = Permissions.new(permissions, separator: YiffSpace::Auth.get_by_id(client_id).permissions_separator)
-        @client_id    = client_id
-      end
-
-      def anonymous?
-        false
-      end
-
-      # this feels wrong, but it hopefully shouldn't break anything
-      def present?
-        true
-      end
-
-      def blank?
-        false
-      end
-
-      def has_permission?(name)
-        permissions.include?(name.to_s)
-      end
-
-      def serializable_hash(*)
-        {
-          "id"          => id,
-          "token"       => token.as_json,
-          "roles"       => roles,
-          "permissions" => permissions.values,
-          "client_id"   => client_id,
-        }
-      end
-
-      def to_session
-        serializable_hash
-      end
-
-      def self.from_json(data)
-        raise(ArgumentError, "invalid data") if data.blank?
-
-        data = JSON.parse(data) if data.is_a?(String)
-        data = ::YiffSpace::Utils::OpenHash.from(data)
-
-        new(
-          id:          data.id,
-          token:       data.token,
-          roles:       data.roles,
-          permissions: data.permissions,
-          client_id:   data.client_id,
-        )
-      end
-
-      def self.from_session(data)
-        return nil if data.blank?
-
-        from_json(data)
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/client.rb

@@ -1,56 +0,0 @@
-# frozen_string_literal: true
-
-require_relative("../core_ext/logto/named_session_storage")
-require("httparty")
-
-module YiffSpace
-  module Auth
-    class Client
-      attr_accessor(:client_id, :client_secret, :scopes, :resource,
-                    :redirect_uri, :server_url, :auth_session_key, :user_session_key,
-                    :update_discord_images, :permissions_separator, :logto_webhook_secret)
-
-      attr_reader(:name)
-
-      def initialize(name)
-        @name                    = name.to_sym
-        @scopes                  = %i[openid offline_access profile roles identities custom_data]
-        @redirect_uri            = "http://127.0.0.1:3000/auth/cb"
-        @server_url              = "https://auth.yiff.space"
-        @auth_session_key        = :"yiffspace_auth_#{name}"
-        @user_session_key        = :"yiffspace_user_#{name}"
-        @update_discord_images   = true
-        @permissions_separator   = ":"
-        @logto_webhook_secret    = nil
-      end
-
-      def logto(controller)
-        LogtoClient.new(
-          config:   LogtoClient::Config.new(
-            endpoint:   server_url,
-            app_id:     client_id,
-            app_secret: client_secret,
-            scopes:     scopes,
-            resources:  [resource].compact,
-          ),
-          # Allow the client to redirect to other hosts (i.e. your Logto tenant)
-          navigate: ->(uri) { controller.redirect_to(uri, allow_other_host: true) },
-          # Controller has access to the session object
-          storage:  LogtoClient::NamedSessionStorage.new("yiffspace", controller.session, app_id: @name),
-        )
-      end
-
-      def logto_management
-        @logto_management ||= LogtoManagementClient.new(self)
-      end
-
-      def fetch_discord_user(id)
-        response = HTTParty.get("https://discord.com/api/v10/users/#{id}", { headers: { "Authorization" => "Bot #{YiffSpace.config.discord_bot_token}" } })
-        return nil if response.code == 404
-        raise("failed to fetch discord user: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200
-
-        DiscordInfo.new(response.parsed_response)
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/discord_info.rb

@@ -1,65 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Auth
-    class DiscordInfo
-      # locale, mfa_enabled, and premium_type are not present for legacy users backfilled from api data,
-      # we don't need that data either way
-      ATTRIBUTES = %i[id flags avatar banner username global_name public_flags discriminator].freeze
-      attr_reader(:data, *ATTRIBUTES)
-
-      def initialize(options = {}, **kwargs)
-        @data = options.merge(kwargs).with_indifferent_access
-        ATTRIBUTES.each do |attr|
-          instance_variable_set("@#{attr}", @data[attr])
-        end
-
-        return unless YiffSpace.config.auth.update_discord_images
-
-        last_avatar = Rails.cache.fetch("yiffspace:auth:discord_avatar_update:#{id}")
-        last_banner = Rails.cache.fetch("yiffspace:auth:discord_banner_update:#{id}")
-
-        if last_avatar != avatar
-          Rails.cache.write("yiffspace:auth:discord_avatar_update:#{id}", avatar, expires_in: 30.days)
-          update_avatar
-        end
-
-        return unless last_banner != banner
-
-        Rails.cache.write("yiffspace:auth:discord_banner_update:#{id}", banner, expires_in: 30.days)
-        update_banner
-      end
-
-      def update_avatar
-        Images::Avatar.get_for(id, :discord).update(avatar)
-      end
-
-      def update_banner
-        Images::Banner.get_for(id, :discord).update(banner)
-      end
-
-      def serializable_hash(*)
-        ATTRIBUTES.to_h { |key| [key.to_s, instance_variable_get("@#{key}")] }
-      end
-
-      def to_session
-        serializable_hash
-      end
-
-      def self.from_json(data)
-        raise(ArgumentError, "invalid data") if data.blank?
-
-        data = JSON.parse(data) if data.is_a?(String)
-        data = ::YiffSpace::Utils::OpenHash.from(data)
-
-        new(data)
-      end
-
-      def self.from_session(data)
-        return nil if data.blank?
-
-        from_json(data)
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/engine.rb

@@ -1,58 +0,0 @@
-# frozen_string_literal: true
-
-require("rails")
-
-module YiffSpace
-  module Auth
-    class Engine < ::Rails::Engine
-      isolate_namespace(YiffSpace::Auth)
-      config.root        = File.expand_path("../../../engines/auth", __dir__)
-      shared_root        = File.expand_path("../../../app", __dir__)
-      shared_controllers = "#{shared_root}/controllers"
-      shared_helpers     = "#{shared_root}/helpers"
-      shared_models      = "#{shared_root}/models"
-      shared_views       = "#{shared_root}/views"
-      shared_assets      = "#{shared_root}/assets"
-
-      paths["app/controllers"] << shared_controllers
-      paths["app/helpers"] << shared_helpers
-      paths["app/models"] << shared_models
-      paths["app/views"] << shared_views
-      paths["app/assets"] << shared_assets
-
-      config.autoload_paths   += [shared_controllers, shared_helpers, shared_models]
-      config.eager_load_paths += [shared_controllers, shared_helpers, shared_models]
-
-      initializer("yiffspace.auth.asset_paths") do |app|
-        if app.config.respond_to?(:assets)
-          app.config.assets.paths << "#{shared_assets}/config"
-          app.config.assets.precompile += %w[yiffspace/application.css]
-        end
-      end
-
-      class << self
-        def for(name)
-          @instances              ||= {}
-          @instances[name.to_sym] ||= begin
-            subclass = Class.new(self)
-            subclass.engine_name("yiffspace_auth_#{name}")
-            # Inherit isolation settings that aren't copied from the parent class
-            subclass.instance_variable_set(:@isolated, true)
-            subclass.routes.default_scope = { module: "yiff_space/auth" }
-            subclass.routes.draw do
-              constraints(SetClientName.new(name)) do
-                post(:webhook, controller: :webhook, action: :create)
-                get(:cb, controller: :root)
-                get(:logout, controller: :root)
-                get(:permissions, controller: :root)
-                get(:debug, controller: :root) if ::YiffSpace::Auth.enable_debug_action?
-                root(action: :show, controller: :root, as: :auth)
-              end
-            end
-            subclass
-          end
-        end
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/helper.rb

@@ -1,174 +0,0 @@
-# frozen_string_literal: true
-
-require("active_support/concern")
-
-module YiffSpace
-  module Auth
-    module Helper
-      extend(ActiveSupport::Concern)
-
-      module ClassMethods
-        def set_client_name(name) # rubocop:disable Naming/AccessorMethodName
-          before_action do |controller|
-            controller.request.env["yiffspace.auth.client_name"] = name
-            if controller.respond_to?(:yiffspace_client_name=)
-              controller.yiffspace_client_name = name
-            elsif controller.respond_to?(:client_name=)
-              controller.client_name = name
-            elsif controller.respond_to?(:helpers)
-              if controller.helpers.respond_to?(:yiffspace_client_name=)
-                controller.helpers.yiffspace_client_name = name
-              elsif controller.helpers.respond_to?(:client_name=)
-                controller.helpers.client_name = name
-              end
-            end
-          end
-        end
-      end
-
-      def auth_raw
-        session[auth_client_config.auth_session_key]
-      end
-
-      def auth
-        return AuthInfo::Anonymous.instance if auth_raw.blank?
-
-        AuthInfo.from_session(auth_raw)
-      end
-
-      def auth?
-        auth_raw.present? && !auth.anonymous?
-      end
-
-      def auth=(value)
-        value                                        = nil if value.is_a?(AuthInfo::Anonymous)
-        session[auth_client_config.auth_session_key] = value&.to_session
-      end
-
-      def reset_auth!
-        session.delete(auth_client_config.auth_session_key)
-      end
-
-      def user_raw
-        session[auth_client_config.user_session_key]
-      end
-
-      def user
-        return UserInfo::Anonymous.instance if user_raw.blank?
-
-        UserInfo.from_session(user_raw)
-      end
-
-      def user?
-        user_raw.present? && !user.anonymous?
-      end
-
-      def user=(value)
-        value                                        = nil if value.is_a?(UserInfo::Anonymous)
-        session[auth_client_config.user_session_key] = value&.to_session
-      end
-
-      def reset_user!
-        session.delete(auth_client_config.user_session_key)
-      end
-
-      def full_reset!
-        reset_auth!
-        reset_user!
-      end
-
-      def require_auth(path)
-        redirect_to(path) unless logged_in?
-      end
-
-      def logged_in?
-        auth? && user?
-      end
-
-      def has_permission?(name)
-        return false unless logged_in?
-
-        auth.permissions.has?(name)
-      end
-
-      DIRTY_FLAG_KEY = "yiffspace:auth:dirty:%s"
-
-      # Checks the dirty flag written by the Logto webhook handler. If set, re-fetches
-      # the user's current roles and permissions from the Logto Management API and
-      # rewrites the session — without waiting for the access token to expire.
-      # Call this as a before_action in any controller that needs instant revocation.
-      def sync_auth_if_dirty!
-        return unless auth?
-
-        flag_key = format(DIRTY_FLAG_KEY, auth.id)
-        return unless Rails.cache.exist?(flag_key)
-
-        Rails.cache.delete(flag_key)
-
-        management = auth_client_config.logto_management
-        api_user   = management.get_user_by_id(auth.id)
-
-        if api_user.nil? || api_user.data["isSuspended"]
-          full_reset!
-          return
-        end
-
-        roles       = management.get_user_roles(auth.id)
-        permissions = roles.flat_map { |role| management.get_role_scopes(role["id"]) }
-                           .pluck("name")
-                           .uniq
-
-        self.auth = AuthInfo.new(
-          id:          auth.id,
-          token:       auth.token,
-          roles:       roles.pluck("name"),
-          permissions: permissions,
-          client_id:   auth.client_id,
-        )
-      end
-
-      def url_helpers
-        YiffSpace::Auth::Engine.for(client_name).routes.url_helpers
-      end
-
-      # Returns the Auth::Client for the current request. In auth engine controllers this is
-      # resolved from the routing default set by Engine.for; in host app controllers it falls
-      # back to the default registered client. Override in your controller to choose a specific
-      # client when multiple are registered.
-      def auth_client_config
-        client_name = self.client_name
-        client_name.present? ? YiffSpace::Auth[client_name.to_sym] : YiffSpace::Auth.default
-      end
-
-      def client_name
-        respond_to?(:request, true) && request.env[CLIENT_NAME_ENV]
-      end
-
-      def client_name=(value)
-        request.env[CLIENT_NAME_ENV] = value.to_sym
-      end
-
-      module Scoped
-        extend(ActiveSupport::Concern)
-        include(Helper)
-
-        included do
-          private(*Helper.instance_methods(false))
-          private_class_method(*Helper::ClassMethods.instance_methods(false))
-        end
-
-        Helper.instance_methods(false).each do |name|
-          define_method("yiffspace_#{name}") { |*args, **kwargs, &block| send(name, *args, **kwargs, &block) }
-        end
-
-        module ClassMethods
-          include(Helper::ClassMethods)
-
-          Helper::ClassMethods.instance_methods(false).each do |name|
-            define_method("yiffspace_#{name}") { |*args, **kwargs, &block| send(name, *args, **kwargs, &block) }
-          end
-        end
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/permissions.rb

@@ -1,87 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Auth
-    class Permissions
-      attr_accessor(:values)
-
-      delegate(:each, to: :values)
-
-      include(Enumerable)
-
-      def initialize(perms, separator: ":")
-        @values = perms
-        @tree   = {}
-        @separator = separator
-
-        perms.each do |perm|
-          current = @tree
-          parts   = perm.split(separator)
-
-          parts.each do |part|
-            current[part] ||= {}
-            current       = current[part]
-          end
-
-          # mark leaf
-          current[:__leaf__] = true
-        end
-      end
-
-      def has?(perm)
-        current = @tree
-        parts   = perm.split(@separator)
-
-        parts.each do |part|
-          return false unless current[part]
-
-          current = current[part]
-        end
-
-        current[:__leaf__] == true
-      end
-
-      alias include? has?
-
-      def method_missing(name, *_args)
-        str = name.to_s
-
-        if str.end_with?("?")
-          key = str[0..-2]
-          return @tree[key]&.dig(:__leaf__) == true
-        end
-
-        if @tree.key?(str)
-          self.class.new_from_subtree(@tree[str], @separator)
-        else
-          # return empty node instead of raising
-          self.class.new([], separator: @separator)
-        end
-      end
-
-      def respond_to_missing?(_name, _include_private = false)
-        true
-      end
-
-      def self.new_from_subtree(tree, separator)
-        obj = allocate
-        obj.instance_variable_set(:@tree, tree)
-        obj.instance_variable_set(:@values, leaves_from_tree(tree))
-        obj.instance_variable_set(:@separator, separator)
-        obj
-      end
-
-      def self.leaves_from_tree(node, prefix = "")
-        result = []
-        node.each do |key, subtree|
-          next if key == :__leaf__
-
-          path = prefix.empty? ? key : "#{prefix}.#{key}"
-          result << path if subtree[:__leaf__]
-          result.concat(leaves_from_tree(subtree, path))
-        end
-        result
-      end
-    end
-  end
-end