yiffspace 0.0.25 → 0.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d25c09cc2215ae215fedbcac2a2f7df9cb90bcffe077b9ce65e19cc7a87cdcc2
-  data.tar.gz: d1e559638ed2c624a88df12fb99c95e6f72af323d1acea7745240bd2f44e8b36
+  metadata.gz: 91faac8d32a587e89936bc66f94459251f40b7a5c59de022e240684f76b632da
+  data.tar.gz: 58fbb7700a5f72959bb94e1b6afdd5ebc20532e9ba5af471b312664fbe9124c9
 SHA512:
-  metadata.gz: '068f7913582ba815958d342421467c0af7a88ca7ec98643e2d3503c1c5cf36a74d284928f8e4df4a100e874170ca3eed13d2e6ff1c4c448ebbc3fea05e19b5fe'
-  data.tar.gz: 9991d33a718322c301de8fff0a705f209d1853fb5d60bb1dc00a6f0d39e16fb5c9c85ef1af0a1e772c56d7e894f43461d994ebe66dd1ac15b7a24df65026b2e8
+  metadata.gz: 1951e8e761f305e1fb07817b11377a051ba6c3715e1e1c6fe54e3d06f742ebce67699c883478be5a8f8299dd2ffacbd59be7308591d7fd7cf88e5f6fedf3e8c8
+  data.tar.gz: ab2ddab57baa7d797fd5da05d9e79dd0a8993d8b0c850ead972dbea48bfd72a609530ee825c11f767aeb5a73c3ccae98e29b1b119ee0db56defa19b2dee73569

data/CHANGELOG.md

@@ -0,0 +1,11 @@
+## 0.1.0
+
+- **Breaking:** extracted the Logto auth engine (`YiffSpace::Auth::*`) into a
+  separate gem, [`yiffspace-auth`](https://github.com/YiffSpace/Auth.rb). Apps
+  using auth need to add that gem alongside `yiffspace`.
+- `YiffSpace::Configuration#auth`/`#add_auth`/`#add_default_auth` and the
+  `logto_api_*`/`discord_bot_token` settings moved to `yiffspace-auth`.
+- Replaced the dead `YiffSpace::Railtie` with a real `YiffSpace::Engine <
+  Rails::Engine`, so the shared `app/` directory (ApplicationController,
+  layout, error view, CSS, ActiveJob serializers) actually loads into host
+  apps again.

data/lib/yiffspace/configuration.rb

@@ -31,12 +31,6 @@ module YiffSpace
     # The `last_ip_addr` attribute of the User model, used by the UserResolvableMethods concern
     attr_accessor(:last_ip_addr_attribute)
 
-    # Logto Management API credentials (shared across all auth clients).
-    attr_accessor(:logto_api_client_id, :logto_api_client_secret, :logto_api_resource)
-
-    # Discord bot token used to look up Discord users (shared across all auth clients).
-    attr_accessor(:discord_bot_token)
-
     # The anonymous user's name, can be a proc
     attr_reader(:anonymous_user_name)
 
@@ -58,10 +52,6 @@ module YiffSpace
       @default_ip_address      = "127.0.0.1"
       @last_ip_addr_attribute  = :last_ip_addr
       @anonymous_user_name     = -> { "Anonymous" }
-      @logto_api_client_id     = nil
-      @logto_api_client_secret = nil
-      @logto_api_resource      = nil
-      @discord_bot_token       = nil
     end
 
     def user_class
@@ -103,21 +93,6 @@ module YiffSpace
       @anonymous_user_name = value.is_a?(Proc) ? value : -> { value }
     end
 
-    def auth(&block)
-      client = YiffSpace::Auth.register(Auth::DEFAULT_CLIENT_NAME) unless YiffSpace::Auth.instance_variable_get(:@clients).key?(Auth::DEFAULT_CLIENT_NAME)
-      client ||= YiffSpace::Auth[Auth::DEFAULT_CLIENT_NAME]
-      block&.call(client)
-      client
-    end
-
-    def add_auth(name, &)
-      YiffSpace::Auth.register(name, &)
-    end
-
-    def add_default_auth(&)
-      add_auth(Auth::DEFAULT_CLIENT_NAME, &)
-    end
-
     def images
       @images ||= Images.new
     end

data/lib/yiffspace/{railtie.rb → engine.rb}

@@ -1,18 +1,20 @@
 # frozen_string_literal: true
 
+require("rails")
+
 module YiffSpace
-  class Railtie < Rails::Railtie
+  class Engine < ::Rails::Engine
+    config.root = File.expand_path("../..", __dir__)
+
+    initializer("yiffspace.assets") do |app|
+      app.config.assets.precompile += %w[yiffspace/application.css] if app.config.respond_to?(:assets)
+    end
+
     initializer("yiffspace.serializers") do
       ActiveSupport.on_load(:active_job) do
         ActiveJob::Serializers.add_serializers(
-          Serializers::AnonymousAuthInfoSerializer,
-          Serializers::AnonymousUserInfoSerializer,
-          Serializers::AuthInfoSerializer,
           Serializers::AvatarSerializer,
           Serializers::BannerSerializer,
-          Serializers::DiscordInfoSerializer,
-          Serializers::PermissionsSerializer,
-          Serializers::UserInfoSerializer,
           Serializers::UserResolvableSerializer,
         )
       end

data/lib/yiffspace/extensions/active_record/where_chain.rb

@@ -23,17 +23,17 @@ module YiffSpace
         # https://www.postgresql.org/docs/current/static/functions-matching.html#FUNCTIONS-POSIX-REGEXP
         # "(?e)" means force use of ERE syntax; see sections 9.7.3.1 and 9.7.3.4.
         def regex(conditions = {}, flags: "e", **kwargs)
-          conditions.merge!(kwargs) if conditions.is_a?(Hash)
+          conditions.merge!(kwargs) if conditions.is_a?(::Hash)
           build(conditions, :regex, flags)
         end
 
         def not_regex(conditions = {}, flags: "e", **kwargs)
-          conditions.merge!(kwargs) if conditions.is_a?(Hash)
+          conditions.merge!(kwargs) if conditions.is_a?(::Hash)
           build(conditions, :not_regex, flags)
         end
 
         def tsquery(conditions = {}, ts_config: "english", **kwargs)
-          conditions.merge!(kwargs) if conditions.is_a?(Hash)
+          conditions.merge!(kwargs) if conditions.is_a?(::Hash)
           build(conditions, :tsquery, ts_config)
         end
 
@@ -84,9 +84,9 @@ module YiffSpace
 
           conditions.each do |key, value|
             case key
-            when String, Symbol
+            when ::String, ::Symbol
               key = key.to_s
-              if value.is_a?(Hash)
+              if value.is_a?(::Hash)
                 pairs.concat(normalize_conditions(value, model, key))
               elsif key.include?(".")
                 table, col = key.split(".", 2)

data/lib/yiffspace/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module YiffSpace
-  VERSION = "0.0.25"
+  VERSION = "0.1.0"
 end

data/lib/yiffspace.rb

@@ -20,12 +20,11 @@ loader = Zeitwerk::Loader.for_gem
 loader.inflector.inflect({ "postgresql" => "PostgreSQL", "yiffspace" => "YiffSpace", "query_dsl" => "QueryDSL" })
 loader.ignore("#{__dir__}/yiffspace/core_ext")
 loader.ignore("#{__dir__}/yiffspace/include")
-loader.ignore("#{__dir__}/yiffspace/railtie.rb")
-loader.ignore("#{__dir__}/yiffspace/auth/engine.rb")
+loader.ignore("#{__dir__}/yiffspace/engine.rb")
 loader.setup
 
-# Require the auth engine eagerly so it registers with Rails before the host app's
+# Require the engine eagerly so it registers with Rails before the host app's
 # active_support.initialize_per_engine_zeitwerk_loaders initializer runs. Without this,
-# the engine is only loaded during route drawing (after Zeitwerk setup) and its
-# app/controllers path is never added to the app's autoload roots.
-require_relative("yiffspace/auth/engine") if defined?(Rails)
+# the engine is only loaded lazily (after Zeitwerk setup) and its app/controllers
+# path is never added to the app's autoload roots.
+require_relative("yiffspace/engine") if defined?(Rails)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yiffspace
 version: !ruby/object:Gem::Version
-  version: 0.0.25
+  version: 0.1.0
 platform: ruby
 authors:
 - Donovan_DMC
@@ -37,20 +37,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0.24'
-- !ruby/object:Gem::Dependency
-  name: logto
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.2.0
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.2.0
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
@@ -108,29 +94,10 @@ files:
 - app/assets/stylesheets/yiffspace/application.css
 - app/controllers/yiff_space/application_controller.rb
 - app/helpers/yiff_space/application_helper.rb
-- app/helpers/yiff_space/auth_helper.rb
 - app/models/yiff_space/application_record.rb
 - app/views/layouts/yiff_space/application.html.erb
 - app/views/yiff_space/error.html.erb
-- engines/auth/app/controllers/yiff_space/auth/application_controller.rb
-- engines/auth/app/controllers/yiff_space/auth/root_controller.rb
-- engines/auth/app/controllers/yiff_space/auth/webhook_controller.rb
-- engines/auth/app/views/yiff_space/auth/root/permissions.html.erb
-- engines/auth/config/routes.rb
-- lib/tasks/yiffspace_tasks.rake
 - lib/yiffspace.rb
-- lib/yiffspace/auth.rb
-- lib/yiffspace/auth/api_user.rb
-- lib/yiffspace/auth/auth_info.rb
-- lib/yiffspace/auth/auth_info/anonymous.rb
-- lib/yiffspace/auth/client.rb
-- lib/yiffspace/auth/discord_info.rb
-- lib/yiffspace/auth/engine.rb
-- lib/yiffspace/auth/helper.rb
-- lib/yiffspace/auth/permissions.rb
-- lib/yiffspace/auth/set_client_name.rb
-- lib/yiffspace/auth/user_info.rb
-- lib/yiffspace/auth/user_info/anonymous.rb
 - lib/yiffspace/concerns/active_record_extensions.rb
 - lib/yiffspace/concerns/api_methods.rb
 - lib/yiffspace/concerns/attribute_matchers.rb
@@ -146,8 +113,6 @@ files:
 - lib/yiffspace/config_builder.rb
 - lib/yiffspace/configuration.rb
 - lib/yiffspace/configuration/images.rb
-- lib/yiffspace/core_ext/action_dispatch/set_auth_client.rb
-- lib/yiffspace/core_ext/action_dispatch/set_auth_client/scoped.rb
 - lib/yiffspace/core_ext/active_record/all.rb
 - lib/yiffspace/core_ext/active_record/where_chain.rb
 - lib/yiffspace/core_ext/all.rb
@@ -158,14 +123,12 @@ files:
 - lib/yiffspace/core_ext/enumerable/parallel.rb
 - lib/yiffspace/core_ext/hash/all.rb
 - lib/yiffspace/core_ext/hash/to_open_hash.rb
-- lib/yiffspace/core_ext/logto/named_session_storage.rb
 - lib/yiffspace/core_ext/object/all.rb
 - lib/yiffspace/core_ext/object/to_b.rb
 - lib/yiffspace/core_ext/object/truthy_falsy.rb
 - lib/yiffspace/core_ext/string/all.rb
 - lib/yiffspace/core_ext/string/sql.rb
-- lib/yiffspace/extensions/action_dispatch/set_auth_client.rb
-- lib/yiffspace/extensions/action_dispatch/set_auth_client/scoped.rb
+- lib/yiffspace/engine.rb
 - lib/yiffspace/extensions/active_record/where_chain.rb
 - lib/yiffspace/extensions/arel/nodes/cross_join_lateral.rb
 - lib/yiffspace/extensions/arel/nodes/left_join_lateral.rb
@@ -175,7 +138,6 @@ files:
 - lib/yiffspace/extensions/arel/visitors/postgresql/left_join_lateral.rb
 - lib/yiffspace/extensions/enumerable/parallel.rb
 - lib/yiffspace/extensions/hash/to_open_hash.rb
-- lib/yiffspace/extensions/logto/named_session_storage.rb
 - lib/yiffspace/extensions/object/to_b.rb
 - lib/yiffspace/extensions/object/truthy_falsy.rb
 - lib/yiffspace/extensions/string/sql.rb
@@ -217,19 +179,11 @@ files:
 - lib/yiffspace/include/user_name_methods.rb
 - lib/yiffspace/include/user_resolvable.rb
 - lib/yiffspace/include/user_resolvable_methods.rb
-- lib/yiffspace/logto_management_client.rb
-- lib/yiffspace/railtie.rb
 - lib/yiffspace/search/query_builder.rb
 - lib/yiffspace/search/query_dsl.rb
 - lib/yiffspace/search/query_helper.rb
-- lib/yiffspace/serializers/anonymous_auth_info_serializer.rb
-- lib/yiffspace/serializers/anonymous_user_info_serializer.rb
-- lib/yiffspace/serializers/auth_info_serializer.rb
 - lib/yiffspace/serializers/avatar_serializer.rb
 - lib/yiffspace/serializers/banner_serializer.rb
-- lib/yiffspace/serializers/discord_info_serializer.rb
-- lib/yiffspace/serializers/permissions_serializer.rb
-- lib/yiffspace/serializers/user_info_serializer.rb
 - lib/yiffspace/serializers/user_resolvable_serializer.rb
 - lib/yiffspace/utils.rb
 - lib/yiffspace/utils/cache.rb
@@ -244,7 +198,6 @@ files:
 - lib/yiffspace/utils/table_builder.rb
 - lib/yiffspace/utils/trace_logger.rb
 - lib/yiffspace/utils/user_attribute.rb
-- lib/yiffspace/utils/user_deduper.rb
 - lib/yiffspace/utils/user_like.rb
 - lib/yiffspace/utils/user_resolvable.rb
 - lib/yiffspace/utils/user_to_id.rb

data/app/helpers/yiff_space/auth_helper.rb

@@ -1,6 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module AuthHelper
-  end
-end

data/engines/auth/app/controllers/yiff_space/auth/application_controller.rb

@@ -1,11 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Auth
-    class ApplicationController < ::YiffSpace::ApplicationController
-      include(Helper)
-
-      helper(Helper)
-    end
-  end
-end

data/engines/auth/app/controllers/yiff_space/auth/root_controller.rb

@@ -1,49 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Auth
-    class RootController < ApplicationController
-      include(Helper)
-
-      before_action(:sync_auth_if_dirty!)
-
-      def show
-        client.sign_in(redirect_uri: auth_client_config.redirect_uri, post_redirect_uri: params[:path] || "/")
-      end
-
-      def cb
-        client.handle_sign_in_callback(url: request.original_url)
-        user = client.fetch_user_info
-        self.user = UserInfo.new(id: user["identities"]["discord"]["userId"], user: user, discord: user["identities"]["discord"]["details"]["rawData"])
-        token = client.access_token_claims(resource: auth_client_config.resource)
-        self.auth = AuthInfo.new(id: user["identities"]["discord"]["userId"], token: token, permissions: token["scope"].split, roles: user["roles"], client_id: auth_client_config.client_id)
-      end
-
-      def permissions; end
-
-      def logout
-        client.sign_out(post_logout_redirect_uri: request.base_url)
-        full_reset!
-      end
-
-      def debug
-        return render("yiffspace/error", locals: { message: "Access Denied" }, status: :forbidden) unless YiffSpace::Auth.enable_debug_action?
-
-        render(json: {
-          env:     request.env.select { |env| env.start_with?("yiffspace.") },
-          params:  params,
-          session: session,
-          client:  auth_client_config.as_json.merge(client_secret: "[REDACTED]"),
-          user:    client.fetch_user_info,
-          token:   client.access_token_claims(resource: auth_client_config.resource),
-        })
-      end
-
-      private
-
-      def client
-        @client ||= auth_client_config.logto(self)
-      end
-    end
-  end
-end

data/engines/auth/app/controllers/yiff_space/auth/webhook_controller.rb

@@ -1,73 +0,0 @@
-# frozen_string_literal: true
-
-require("openssl")
-require("active_support/security_utils")
-
-module YiffSpace
-  module Auth
-    class WebhookController < ApplicationController
-      skip_before_action(:verify_authenticity_token)
-
-      HANDLED_EVENTS = %w[
-        User.Roles.Updated
-        User.SuspensionStatus.Updated
-        User.Deleted
-        Role.Scopes.Updated
-      ].freeze
-      DIRTY_FLAG_TTL = 24.hours
-
-      def create
-        unless verify_signature
-          render(plain: "Unauthorized", status: :unauthorized)
-          return
-        end
-
-        payload = JSON.parse(request.raw_post)
-        event   = payload["event"]
-
-        handle_event(event, payload) if HANDLED_EVENTS.include?(event)
-
-        head(:ok)
-      rescue JSON::ParserError
-        render(plain: "Bad Request", status: :bad_request)
-      end
-
-      private
-
-      def verify_signature
-        secret = auth_client_config.logto_webhook_secret
-        return true if secret.blank?
-
-        received = request.headers["logto-signature-sha-256"].to_s
-        expected = OpenSSL::HMAC.hexdigest("SHA256", secret, request.raw_post)
-        ActiveSupport::SecurityUtils.secure_compare(received, expected)
-      end
-
-      def handle_event(event, payload)
-        data = payload["data"] || {}
-
-        if event == "Role.Scopes.Updated"
-          handle_role_scopes_updated(data)
-        else
-          user_id = data["id"]
-          mark_dirty(user_id) if user_id.present?
-        end
-      end
-
-      def handle_role_scopes_updated(data)
-        role_id = data["id"]
-        return if role_id.blank?
-
-        management = auth_client_config.logto_management
-        users      = management.get_users_with_role(role_id)
-        users.each { |u| mark_dirty(u["id"]) }
-      rescue StandardError => e
-        Rails.logger.error("[YiffSpace::Auth::WebhookController] Role.Scopes.Updated fan-out failed: #{e.message}")
-      end
-
-      def mark_dirty(user_id)
-        Rails.cache.write(format(Helper::DIRTY_FLAG_KEY, user_id), true, expires_in: DIRTY_FLAG_TTL)
-      end
-    end
-  end
-end

data/engines/auth/app/views/yiff_space/auth/root/permissions.html.erb

@@ -1,14 +0,0 @@
-<h1 class="title">Permissions</h1>
-<% if logged_in? %>
-  <% if auth.permissions.any? %>
-    <ul class="permissions-list">
-      <% auth.permissions.each do |perm| %>
-        <li class="permission"><%= perm %></li>
-      <% end %>
-    </ul>
-  <% else %>
-    <p class="message">You have no permissions.</p>
-  <% end %>
-<% else %>
-  <p class="message">You are not logged in.</p>
-<% end %>

data/engines/auth/config/routes.rb

@@ -1,12 +0,0 @@
-# frozen_string_literal: true
-
-YiffSpace::Auth::Engine.routes.draw do
-  constraints(YiffSpace::Auth::SetClientName.default) do
-    post(:webhook, controller: :webhook)
-    get(:cb, controller: :root)
-    get(:logout, controller: :root)
-    get(:permissions, controller: :root)
-    get(:debug, controller: :root) if YiffSpace::Auth.enable_debug_action?
-    root(action: :show, controller: :root, as: :auth)
-  end
-end

data/lib/tasks/yiffspace_tasks.rake

@@ -1,41 +0,0 @@
-# frozen_string_literal: true
-
-namespace(:yiffspace) do
-  desc("Report and interactively remove duplicate/orphaned Logto users left behind by " \
-       "get_or_create_user races. Prompts for confirmation before deleting each one. " \
-       "Pass AUTH_CLIENT=name to use a registered auth client other than :default " \
-       "(e.g. AUTH_CLIENT=yiffyapi_manage).")
-  task(dedupe_users: :environment) do
-    client_name = (ENV["AUTH_CLIENT"] || YiffSpace::Auth::DEFAULT_CLIENT_NAME).to_sym
-    management = YiffSpace::Auth[client_name].logto_management
-
-    puts("Scanning users via auth client #{client_name.inspect}...")
-    result = YiffSpace::Utils::UserDeduper.scan(management)
-
-    puts("\n#{result[:conflicts].size} discord id(s) with more than one linked user (ambiguous - not handled by this task, review manually):")
-    result[:conflicts].each do |discord_id, group|
-      puts("  discordId=#{discord_id}: #{group.map { |u| "#{u.id} (#{u.name})" }.join(', ')}")
-    end
-
-    puts("\n#{result[:unresolved_orphans].size} orphaned user(s) with no matching linked account (not handled by this task, review manually):")
-    result[:unresolved_orphans].each do |user|
-      puts("  #{user.id} (name=#{user.name}, avatar=#{user.data.avatar})")
-    end
-
-    puts("\n#{result[:deletable_orphans].size} confirmed duplicate(s) - orphan left by a losing get_or_create_user race:")
-    if result[:deletable_orphans].empty?
-      puts("  none found")
-    else
-      result[:deletable_orphans].each do |orphan, keeper|
-        print("  delete #{orphan.id} (name=#{orphan.name}, avatar=#{orphan.data.avatar}), keeping #{keeper.id} (name=#{keeper.name}) for discordId=#{YiffSpace::Utils::UserDeduper.discord_id_for(keeper)}? [y/N] ")
-        answer = $stdin.gets&.strip&.downcase
-        if answer == "y"
-          management.delete_user(orphan.id)
-          puts("    deleted #{orphan.id}")
-        else
-          puts("    skipped")
-        end
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/api_user.rb

@@ -1,43 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Auth
-    class ApiUser
-      attr_reader(:data)
-
-      def initialize(data)
-        @data = Utils::OpenHash.from(data)
-      end
-
-      delegate(:id, :name, to: :data)
-
-      def discord_id
-        data.identities.discord.userId
-      end
-
-      def created_at
-        Time.zone.at(data.createdAt)
-      end
-
-      def updated_at
-        Time.zone.at(data.updatedAt)
-      end
-
-      def last_sign_in_at
-        data.lastSignInAt.nil? ? nil : Time.zone.at(data.lastSignInAt)
-      end
-
-      def discord
-        DiscordInfo.new(data.identities.discord.details.rawData)
-      end
-
-      def avatar
-        Images::Avatar.get_for(discord_id, :discord)
-      end
-
-      def banner
-        Images::Banner.get_for(discord_id, :discord)
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/auth_info/anonymous.rb

@@ -1,60 +0,0 @@
-# frozen_string_literal: true
-
-require("singleton")
-
-module YiffSpace
-  module Auth
-    class AuthInfo
-      class Anonymous
-        include(::Singleton)
-
-        %i[id token].each do |attr|
-          define_method(attr) { |*, **| raise(NotImplementedError, "#{attr} is not present on anonymous auth") }
-        end
-
-        def roles
-          []
-        end
-
-        def permissions
-          Permissions.new([])
-        end
-
-        def has_permission?(*)
-          false
-        end
-
-        def anonymous?
-          true
-        end
-
-        # this feels wrong, but it hopefully shouldn't break anything
-        def present?
-          false
-        end
-
-        def blank?
-          true
-        end
-
-        def serializable_hash(*)
-          nil
-        end
-
-        def to_session
-          serializable_hash
-        end
-
-        def self.from_json(*)
-          Anonymous.instance
-        end
-
-        def self.from_session(data)
-          return nil if data.blank?
-
-          from_json(data)
-        end
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/auth_info.rb

@@ -1,78 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Auth
-    class AuthInfo
-      attr_reader(:id, :token, :roles, :permissions, :client_id)
-
-      # @param id String
-      # @param roles Array(String)
-      # @param permissions Array(String)
-      # @param token LogtoClient::AccessTokenClaims
-      # @param client_id String
-      def initialize(id:, roles:, permissions:, token:, client_id:)
-        raise(ArgumentError, "no id provided") if id.blank?
-        raise(ArgumentError, "no token provided") if token.blank?
-        raise(ArgumentError, "no client id provided") if client_id.blank?
-
-        @id           = id
-        @token        = token
-        @roles        = Array(roles)
-        @permissions  = Permissions.new(permissions, separator: YiffSpace::Auth.get_by_id(client_id).permissions_separator)
-        @client_id    = client_id
-      end
-
-      def anonymous?
-        false
-      end
-
-      # this feels wrong, but it hopefully shouldn't break anything
-      def present?
-        true
-      end
-
-      def blank?
-        false
-      end
-
-      def has_permission?(name)
-        permissions.include?(name.to_s)
-      end
-
-      def serializable_hash(*)
-        {
-          "id"          => id,
-          "token"       => token.as_json,
-          "roles"       => roles,
-          "permissions" => permissions.values,
-          "client_id"   => client_id,
-        }
-      end
-
-      def to_session
-        serializable_hash
-      end
-
-      def self.from_json(data)
-        raise(ArgumentError, "invalid data") if data.blank?
-
-        data = JSON.parse(data) if data.is_a?(String)
-        data = ::YiffSpace::Utils::OpenHash.from(data)
-
-        new(
-          id:          data.id,
-          token:       data.token,
-          roles:       data.roles,
-          permissions: data.permissions,
-          client_id:   data.client_id,
-        )
-      end
-
-      def self.from_session(data)
-        return nil if data.blank?
-
-        from_json(data)
-      end
-    end
-  end
-end