yiffspace 0.0.24 → 0.1.0

data/lib/yiffspace/auth/set_client_name.rb

@@ -1,15 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Auth
-    class SetClientName < Utils::SetEnvConstraint
-      def initialize(value)
-        super(CLIENT_NAME_ENV, value.to_sym)
-      end
-
-      def self.default
-        new(DEFAULT_CLIENT_NAME)
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/user_info/anonymous.rb

@@ -1,72 +0,0 @@
-# frozen_string_literal: true
-
-require("singleton")
-
-module YiffSpace
-  module Auth
-    class UserInfo
-      class Anonymous
-        include(::Singleton)
-
-        %i[id user discord avatar].each do |attr|
-          define_method(attr) { |*, **| raise(NotImplementedError, "#{attr} is not present on anonymous user") }
-        end
-
-        def username
-          "anonymous"
-        end
-
-        def display_name
-          "Anonymous"
-        end
-
-        def avatar
-          nil
-        end
-
-        def avatar_url
-          nil
-        end
-
-        def banner
-          nil
-        end
-
-        def banner_url
-          nil
-        end
-
-        def anonymous?
-          true
-        end
-
-        # this feels wrong, but it hopefully shouldn't break anything
-        def present?
-          false
-        end
-
-        def blank?
-          true
-        end
-
-        def serializable_hash(*)
-          nil
-        end
-
-        def to_session
-          serializable_hash
-        end
-
-        def self.from_json(*)
-          Anonymous.instance
-        end
-
-        def self.from_session(data)
-          return nil if data.blank?
-
-          from_json(data)
-        end
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/user_info.rb

@@ -1,87 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Auth
-    class UserInfo
-      attr_reader(:id, :user, :discord)
-
-      # @param id String
-      # @param user LogtoCore::UserInfoResponse
-      # @param discord Hash
-      def initialize(id:, user:, discord:)
-        raise(ArgumentError, "no id provided") if id.blank?
-        raise(ArgumentError, "no user provided") if user.blank?
-
-        @id        = id
-        @user      = user
-        @discord   = DiscordInfo.from_json(discord)
-      end
-
-      def anonymous?
-        false
-      end
-
-      # this feels wrong, but it hopefully shouldn't break anything
-      def present?
-        true
-      end
-
-      def blank?
-        false
-      end
-
-      def avatar(type = nil)
-        type.present? ? Images::Avatar.get_for(id, type) : Images::Avatar.default_for(id)
-      end
-
-      def avatar_url(type = nil)
-        avatar(type).url
-      end
-
-      def banner(type = nil)
-        type.present? ? Images::Banner.get_for(id, type) : Images::Banner.default_for(id)
-      end
-
-      def banner_url(type = nil)
-        banner(type).url
-      end
-
-      delegate(:username, to: :discord)
-
-      def display_name
-        discord.global_name
-      end
-
-      def serializable_hash(_options = {})
-        {
-          "id"      => id,
-          "discord" => discord.serializable_hash,
-          "user"    => user.as_json,
-        }
-      end
-
-      def to_session
-        serializable_hash.without("discord").merge(discord: discord.to_session)
-      end
-
-      def self.from_json(data)
-        raise(ArgumentError, "invalid data") if data.blank?
-
-        data = JSON.parse(data) if data.is_a?(String)
-        data = ::YiffSpace::Utils::OpenHash.from(data)
-
-        new(
-          id:      data.id,
-          discord: data.discord,
-          user:    data.user,
-        )
-      end
-
-      def self.from_session(data)
-        return nil if data.blank?
-
-        from_json(data)
-      end
-    end
-  end
-end

data/lib/yiffspace/auth.rb

@@ -1,44 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Auth
-    CLIENT_NAME_ENV     = "yiffspace.auth.client_name"
-    DEFAULT_CLIENT_NAME = :default
-
-    @clients             = {}
-    @enable_debug_action = false
-
-    module_function
-
-    def register(name, &block)
-      client = Client.new(name)
-      block&.call(client)
-      @clients[name.to_sym] = client
-      client
-    end
-
-    def [](name)
-      @clients[name.to_sym] || raise(KeyError, "unknown auth client: #{name.inspect}")
-    end
-
-    def default
-      @clients[DEFAULT_CLIENT_NAME] || raise("no default client configured")
-    end
-
-    def get_by_id(id)
-      @clients.values.find { |c| c.client_id == id } || raise(ArgumentError, "unable to find client with id: #{id}")
-    end
-
-    def enable_debug_action?
-      @enable_debug_action
-    end
-
-    def enable_debug_action!
-      @enable_debug_action = true
-    end
-
-    def disable_debug_action!
-      @enable_debug_action = false
-    end
-  end
-end

data/lib/yiffspace/core_ext/action_dispatch/set_auth_client/scoped.rb

@@ -1,13 +0,0 @@
-# frozen_string_literal: true
-
-require_relative("../../../extensions/action_dispatch/set_auth_client/scoped")
-
-module ActionDispatch
-  module Routing
-    class Mapper
-      module Scoping
-        include(YiffSpace::Extensions::ActionDispatch::SetAuthClient::Scoped)
-      end
-    end
-  end
-end

data/lib/yiffspace/core_ext/action_dispatch/set_auth_client.rb

@@ -1,13 +0,0 @@
-# frozen_string_literal: true
-
-require_relative("../../extensions/action_dispatch/set_auth_client")
-
-module ActionDispatch
-  module Routing
-    class Mapper
-      module Scoping
-        include(YiffSpace::Extensions::ActionDispatch::SetAuthClient)
-      end
-    end
-  end
-end

data/lib/yiffspace/core_ext/logto/named_session_storage.rb

@@ -1,7 +0,0 @@
-# frozen_string_literal: true
-
-require_relative("../../extensions/logto/named_session_storage")
-
-class LogtoClient
-  NamedSessionStorage = YiffSpace::Extensions::Logto::NamedSessionStorage
-end

data/lib/yiffspace/extensions/action_dispatch/set_auth_client/scoped.rb

@@ -1,15 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Extensions
-    module ActionDispatch
-      module SetAuthClient
-        module Scoped
-          def yiffspace_set_auth_client(name, &)
-            constraints(Auth::SetClientName.new(name), &)
-          end
-        end
-      end
-    end
-  end
-end

data/lib/yiffspace/extensions/action_dispatch/set_auth_client.rb

@@ -1,13 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Extensions
-    module ActionDispatch
-      module SetAuthClient
-        def set_auth_client(name, &)
-          constraints(Auth::SetClientName.new(name), &)
-        end
-      end
-    end
-  end
-end

data/lib/yiffspace/extensions/logto/named_session_storage.rb

@@ -1,22 +0,0 @@
-# frozen_string_literal: true
-
-require("logto/client")
-
-module YiffSpace
-  module Extensions
-    module Logto
-      class NamedSessionStorage < LogtoClient::SessionStorage
-        def initialize(name, session, app_id: nil)
-          super(session, app_id: app_id)
-          @name = name
-        end
-
-        protected
-
-        def get_session_key(key)
-          "#{@name}_#{@app_id || 'default'}_#{key}"
-        end
-      end
-    end
-  end
-end

data/lib/yiffspace/logto_management_client.rb

@@ -1,136 +0,0 @@
-# frozen_string_literal: true
-
-require("active_support/core_ext/integer/time")
-require("httparty")
-
-module YiffSpace
-  class LogtoManagementClient
-    attr_reader(:auth)
-
-    def initialize(auth)
-      @auth = auth
-    end
-
-    def get_token # rubocop:disable Naming/AccessorMethodName
-      if @_cached_token
-        return @_cached_token if @_cache_expire_time > Time.current
-
-        @_cached_token = nil
-        @_cache_expire_time = nil
-      end
-      response = HTTParty.post("#{auth.server_url}/oidc/token", {
-        body: {
-          grant_type:    "client_credentials",
-          client_id:     YiffSpace.config.logto_api_client_id,
-          client_secret: YiffSpace.config.logto_api_client_secret,
-          resource:      YiffSpace.config.logto_api_resource,
-          scope:         "all",
-        },
-      })
-      raise("failed to get access token: #{response.to_json}") unless response.key?("access_token")
-
-      @_cached_token = response["access_token"]
-      @_cache_expire_time = response["expires_in"].to_i.seconds.from_now
-      response["access_token"]
-    end
-
-    def get_user(id)
-      response = HTTParty.get("#{auth.server_url}/api/users?discordId=#{id}", { headers: { "Authorization" => "Bearer #{get_token}" } })
-      return nil if response.code == 404 || (response.parsed_response.is_a?(Array) && response.parsed_response.empty?)
-      raise("failed to get user: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200 || !response.parsed_response.is_a?(Array)
-
-      Utils::TraceLogger.warn("LogtoManagementClient", "query discordId=#{id} returned more than one user:\n#{response.parsed_response.inspect}") if response.parsed_response.length > 1
-
-      Auth::ApiUser.new(response.parsed_response.first)
-    end
-
-    def create_user(id)
-      details = auth.fetch_discord_user(id)&.data
-      raise("invalid discord user: #{id}") if details.blank?
-
-      response = HTTParty.post("#{auth.server_url}/api/users", {
-        headers: { "Authorization" => "Bearer #{get_token}", "Content-Type" => "application/json" },
-        body:    { avatar: "https://cdn.discordapp.com/avatars/#{details['id']}/#{details['avatar']}", name: details["username"] }.to_json,
-      })
-      raise("failed to create user: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200
-
-      response2 = HTTParty.put("#{auth.server_url}/api/users/#{response.parsed_response['id']}/identities/discord", {
-        headers: { "Authorization" => "Bearer #{get_token}", "Content-Type" => "application/json" },
-        body:    {
-          userId:  details["id"],
-          details: {
-            id:      details["id"],
-            name:    details["username"],
-            avatar:  "https://cdn.discordapp.com/avatars/#{details['id']}/#{details['avatar']}",
-            rawData: details,
-          },
-        }.to_json,
-      })
-      raise("failed to add discord identity: #{response2.code} #{response2.message}\n#{response2.parsed_response.inspect}") if response2.code != 201
-
-      get_user(id) # force fresh fetch to ensure identity data is included properly
-    end
-
-    def get_or_create_user(id)
-      get_user(id) || create_user(id)
-    end
-
-    # Pages through every user in the tenant. Used by maintenance tasks (e.g. the
-    # dedupe_users rake task) - there's no discordId to filter by when scanning the
-    # whole user base for duplicates/orphans.
-    def list_users(page_size: 100)
-      users = []
-      page = 1
-      loop do
-        response = HTTParty.get("#{auth.server_url}/api/users", {
-          headers: { "Authorization" => "Bearer #{get_token}" },
-          query:   { page: page, page_size: page_size },
-        })
-        raise("failed to list users: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200 || !response.parsed_response.is_a?(Array)
-
-        batch = response.parsed_response
-        users.concat(batch.map { |u| Auth::ApiUser.new(u) })
-        break if batch.length < page_size
-
-        page += 1
-      end
-      users
-    end
-
-    def delete_user(logto_id)
-      response = HTTParty.delete("#{auth.server_url}/api/users/#{logto_id}", { headers: { "Authorization" => "Bearer #{get_token}" } })
-      return true if [204, 404].include?(response.code)
-
-      raise("failed to delete user #{logto_id}: #{response.code} #{response.message}\n#{response.parsed_response.inspect}")
-    end
-
-    def get_user_by_id(logto_id)
-      response = HTTParty.get("#{auth.server_url}/api/users/#{logto_id}", { headers: { "Authorization" => "Bearer #{get_token}" } })
-      return nil if response.code == 404
-      raise("failed to get user: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200
-
-      Auth::ApiUser.new(response.parsed_response)
-    end
-
-    def get_user_roles(logto_id)
-      response = HTTParty.get("#{auth.server_url}/api/users/#{logto_id}/roles", { headers: { "Authorization" => "Bearer #{get_token}" } })
-      raise("failed to get user roles: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200
-
-      response.parsed_response
-    end
-
-    def get_role_scopes(role_id)
-      response = HTTParty.get("#{auth.server_url}/api/roles/#{role_id}/scopes", { headers: { "Authorization" => "Bearer #{get_token}" } })
-      raise("failed to get role scopes: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200
-
-      response.parsed_response
-    end
-
-    def get_users_with_role(role_id)
-      response = HTTParty.get("#{auth.server_url}/api/roles/#{role_id}/users", { headers: { "Authorization" => "Bearer #{get_token}" } })
-      raise("failed to get users with role: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200
-
-      response.parsed_response
-    end
-  end
-end

data/lib/yiffspace/serializers/anonymous_auth_info_serializer.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-require("active_job")
-
-module YiffSpace
-  module Serializers
-    class AnonymousAuthInfoSerializer < ActiveJob::Serializers::ObjectSerializer
-      def serialize(_)
-        super({})
-      end
-
-      def deserialize(_)
-        Auth::AuthInfo::Anonymous.instance
-      end
-
-      private
-
-      def klass
-        Auth::AuthInfo::Anonymous
-      end
-    end
-  end
-end

data/lib/yiffspace/serializers/anonymous_user_info_serializer.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-require("active_job")
-
-module YiffSpace
-  module Serializers
-    class AnonymousUserInfoSerializer < ActiveJob::Serializers::ObjectSerializer
-      def serialize(_)
-        super({})
-      end
-
-      def deserialize(_)
-        Auth::UserInfo::Anonymous.instance
-      end
-
-      private
-
-      def klass
-        Auth::UserInfo::Anonymous
-      end
-    end
-  end
-end

data/lib/yiffspace/serializers/auth_info_serializer.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-require("active_job")
-
-module YiffSpace
-  module Serializers
-    class AuthInfoSerializer < ActiveJob::Serializers::ObjectSerializer
-      def serialize(arg)
-        super(**arg.serializable_hash)
-      end
-
-      def deserialize(arg)
-        Auth::AuthInfo.from_json(arg)
-      end
-
-      private
-
-      def klass
-        Auth::AuthInfo
-      end
-    end
-  end
-end

data/lib/yiffspace/serializers/discord_info_serializer.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-require("active_job")
-
-module YiffSpace
-  module Serializers
-    class DiscordInfoSerializer < ActiveJob::Serializers::ObjectSerializer
-      def serialize(arg)
-        super(**arg.serializable_hash)
-      end
-
-      def deserialize(arg)
-        Auth::DiscordInfo.from_json(arg)
-      end
-
-      private
-
-      def klass
-        Auth::DiscordInfo
-      end
-    end
-  end
-end

data/lib/yiffspace/serializers/permissions_serializer.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-require("active_job")
-
-module YiffSpace
-  module Serializers
-    class PermissionsSerializer < ActiveJob::Serializers::ObjectSerializer
-      def serialize(arg)
-        super("value" => arg.value)
-      end
-
-      def deserialize(arg)
-        Auth::Permissions.new(arg["value"])
-      end
-
-      private
-
-      def klass
-        Auth::Permissions
-      end
-    end
-  end
-end

data/lib/yiffspace/serializers/user_info_serializer.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-require("active_job")
-
-module YiffSpace
-  module Serializers
-    class UserInfoSerializer < ActiveJob::Serializers::ObjectSerializer
-      def serialize(arg)
-        super(**arg.serializable_hash)
-      end
-
-      def deserialize(arg)
-        Auth::UserInfo.from_json(arg)
-      end
-
-      private
-
-      def klass
-        Auth::UserInfo
-      end
-    end
-  end
-end

data/lib/yiffspace/utils/user_deduper.rb

@@ -1,66 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Utils
-    # get_or_create_user is check-then-act (query Logto, then create) with no locking
-    # of its own - two concurrent calls for a discord id that doesn't exist yet will
-    # both create a user, and the loser's discord-identity-attach step fails once the
-    # winner's identity claims it first. That leaves an identity-less "orphan" user
-    # behind in Logto. This scans the whole user base to find those orphans (and any
-    # other duplicate/ambiguous state) so they can be cleaned up.
-    module UserDeduper
-      # create_user sets a new user's avatar to the discord CDN URL for the discord id
-      # it was created for, before the identity-attach step runs - so even an orphan
-      # that never got its identity attached still reveals which discord id it was
-      # meant for.
-      AVATAR_ID_PATTERN = %r{cdn\.discordapp\.com/avatars/(\d+)/}
-
-      module_function
-
-      def discord_id_for(user)
-        user.data.identities&.discord&.userId || avatar_discord_id_for(user)
-      end
-
-      def avatar_discord_id_for(user)
-        match = user.data.avatar.to_s.match(AVATAR_ID_PATTERN)
-        match && match[1]
-      end
-
-      def linked?(user)
-        user.data.identities&.discord&.userId.present?
-      end
-
-      # Returns a hash with:
-      # - :conflicts - discord id => users, for ids where more than one user has the
-      #   identity actually attached. Ambiguous; always needs manual review, never
-      #   auto-deleted.
-      # - :deletable_orphans - [orphan, keeper] pairs, where orphan has no identity
-      #   attached but its avatar points at a discord id claimed by exactly one other
-      #   (linked) user. This is the confirmed race-loser case - safe to delete.
-      # - :unresolved_orphans - users with no identity attached and no corresponding
-      #   linked user (still mid-race, or the winner can't be identified). Reported
-      #   only, never auto-deleted.
-      def scan(management)
-        users = management.list_users
-        linked, unlinked = users.partition { |u| linked?(u) }
-
-        by_discord_id = linked.group_by { |u| u.data.identities.discord.userId }
-        conflicts = by_discord_id.select { |_id, group| group.length > 1 }
-
-        deletable_orphans = []
-        unresolved_orphans = []
-        unlinked.each do |user|
-          discord_id = avatar_discord_id_for(user)
-          keeper = discord_id && by_discord_id[discord_id]
-          if keeper&.length == 1
-            deletable_orphans << [user, keeper.first]
-          else
-            unresolved_orphans << user
-          end
-        end
-
-        { conflicts: conflicts, deletable_orphans: deletable_orphans, unresolved_orphans: unresolved_orphans }
-      end
-    end
-  end
-end