yiffspace 0.0.25 → 0.1.0

data/lib/yiffspace/extensions/action_dispatch/set_auth_client/scoped.rb

@@ -1,15 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Extensions
-    module ActionDispatch
-      module SetAuthClient
-        module Scoped
-          def yiffspace_set_auth_client(name, &)
-            constraints(Auth::SetClientName.new(name), &)
-          end
-        end
-      end
-    end
-  end
-end

data/lib/yiffspace/extensions/action_dispatch/set_auth_client.rb

@@ -1,13 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Extensions
-    module ActionDispatch
-      module SetAuthClient
-        def set_auth_client(name, &)
-          constraints(Auth::SetClientName.new(name), &)
-        end
-      end
-    end
-  end
-end

data/lib/yiffspace/extensions/logto/named_session_storage.rb

@@ -1,22 +0,0 @@
-# frozen_string_literal: true
-
-require("logto/client")
-
-module YiffSpace
-  module Extensions
-    module Logto
-      class NamedSessionStorage < LogtoClient::SessionStorage
-        def initialize(name, session, app_id: nil)
-          super(session, app_id: app_id)
-          @name = name
-        end
-
-        protected
-
-        def get_session_key(key)
-          "#{@name}_#{@app_id || 'default'}_#{key}"
-        end
-      end
-    end
-  end
-end

data/lib/yiffspace/logto_management_client.rb

@@ -1,136 +0,0 @@
-# frozen_string_literal: true
-
-require("active_support/core_ext/integer/time")
-require("httparty")
-
-module YiffSpace
-  class LogtoManagementClient
-    attr_reader(:auth)
-
-    def initialize(auth)
-      @auth = auth
-    end
-
-    def get_token # rubocop:disable Naming/AccessorMethodName
-      if @_cached_token
-        return @_cached_token if @_cache_expire_time > Time.current
-
-        @_cached_token = nil
-        @_cache_expire_time = nil
-      end
-      response = HTTParty.post("#{auth.server_url}/oidc/token", {
-        body: {
-          grant_type:    "client_credentials",
-          client_id:     YiffSpace.config.logto_api_client_id,
-          client_secret: YiffSpace.config.logto_api_client_secret,
-          resource:      YiffSpace.config.logto_api_resource,
-          scope:         "all",
-        },
-      })
-      raise("failed to get access token: #{response.to_json}") unless response.key?("access_token")
-
-      @_cached_token = response["access_token"]
-      @_cache_expire_time = response["expires_in"].to_i.seconds.from_now
-      response["access_token"]
-    end
-
-    def get_user(id)
-      response = HTTParty.get("#{auth.server_url}/api/users?discordId=#{id}", { headers: { "Authorization" => "Bearer #{get_token}" } })
-      return nil if response.code == 404 || (response.parsed_response.is_a?(Array) && response.parsed_response.empty?)
-      raise("failed to get user: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200 || !response.parsed_response.is_a?(Array)
-
-      Utils::TraceLogger.warn("LogtoManagementClient", "query discordId=#{id} returned more than one user:\n#{response.parsed_response.inspect}") if response.parsed_response.length > 1
-
-      Auth::ApiUser.new(response.parsed_response.first)
-    end
-
-    def create_user(id)
-      details = auth.fetch_discord_user(id)&.data
-      raise("invalid discord user: #{id}") if details.blank?
-
-      response = HTTParty.post("#{auth.server_url}/api/users", {
-        headers: { "Authorization" => "Bearer #{get_token}", "Content-Type" => "application/json" },
-        body:    { avatar: "https://cdn.discordapp.com/avatars/#{details['id']}/#{details['avatar']}", name: details["username"] }.to_json,
-      })
-      raise("failed to create user: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200
-
-      response2 = HTTParty.put("#{auth.server_url}/api/users/#{response.parsed_response['id']}/identities/discord", {
-        headers: { "Authorization" => "Bearer #{get_token}", "Content-Type" => "application/json" },
-        body:    {
-          userId:  details["id"],
-          details: {
-            id:      details["id"],
-            name:    details["username"],
-            avatar:  "https://cdn.discordapp.com/avatars/#{details['id']}/#{details['avatar']}",
-            rawData: details,
-          },
-        }.to_json,
-      })
-      raise("failed to add discord identity: #{response2.code} #{response2.message}\n#{response2.parsed_response.inspect}") if response2.code != 201
-
-      get_user(id) # force fresh fetch to ensure identity data is included properly
-    end
-
-    def get_or_create_user(id)
-      get_user(id) || create_user(id)
-    end
-
-    # Pages through every user in the tenant. Used by maintenance tasks (e.g. the
-    # dedupe_users rake task) - there's no discordId to filter by when scanning the
-    # whole user base for duplicates/orphans.
-    def list_users(page_size: 100)
-      users = []
-      page = 1
-      loop do
-        response = HTTParty.get("#{auth.server_url}/api/users", {
-          headers: { "Authorization" => "Bearer #{get_token}" },
-          query:   { page: page, page_size: page_size },
-        })
-        raise("failed to list users: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200 || !response.parsed_response.is_a?(Array)
-
-        batch = response.parsed_response
-        users.concat(batch.map { |u| Auth::ApiUser.new(u) })
-        break if batch.length < page_size
-
-        page += 1
-      end
-      users
-    end
-
-    def delete_user(logto_id)
-      response = HTTParty.delete("#{auth.server_url}/api/users/#{logto_id}", { headers: { "Authorization" => "Bearer #{get_token}" } })
-      return true if [204, 404].include?(response.code)
-
-      raise("failed to delete user #{logto_id}: #{response.code} #{response.message}\n#{response.parsed_response.inspect}")
-    end
-
-    def get_user_by_id(logto_id)
-      response = HTTParty.get("#{auth.server_url}/api/users/#{logto_id}", { headers: { "Authorization" => "Bearer #{get_token}" } })
-      return nil if response.code == 404
-      raise("failed to get user: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200
-
-      Auth::ApiUser.new(response.parsed_response)
-    end
-
-    def get_user_roles(logto_id)
-      response = HTTParty.get("#{auth.server_url}/api/users/#{logto_id}/roles", { headers: { "Authorization" => "Bearer #{get_token}" } })
-      raise("failed to get user roles: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200
-
-      response.parsed_response
-    end
-
-    def get_role_scopes(role_id)
-      response = HTTParty.get("#{auth.server_url}/api/roles/#{role_id}/scopes", { headers: { "Authorization" => "Bearer #{get_token}" } })
-      raise("failed to get role scopes: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200
-
-      response.parsed_response
-    end
-
-    def get_users_with_role(role_id)
-      response = HTTParty.get("#{auth.server_url}/api/roles/#{role_id}/users", { headers: { "Authorization" => "Bearer #{get_token}" } })
-      raise("failed to get users with role: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200
-
-      response.parsed_response
-    end
-  end
-end

data/lib/yiffspace/serializers/anonymous_auth_info_serializer.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-require("active_job")
-
-module YiffSpace
-  module Serializers
-    class AnonymousAuthInfoSerializer < ActiveJob::Serializers::ObjectSerializer
-      def serialize(_)
-        super({})
-      end
-
-      def deserialize(_)
-        Auth::AuthInfo::Anonymous.instance
-      end
-
-      private
-
-      def klass
-        Auth::AuthInfo::Anonymous
-      end
-    end
-  end
-end

data/lib/yiffspace/serializers/anonymous_user_info_serializer.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-require("active_job")
-
-module YiffSpace
-  module Serializers
-    class AnonymousUserInfoSerializer < ActiveJob::Serializers::ObjectSerializer
-      def serialize(_)
-        super({})
-      end
-
-      def deserialize(_)
-        Auth::UserInfo::Anonymous.instance
-      end
-
-      private
-
-      def klass
-        Auth::UserInfo::Anonymous
-      end
-    end
-  end
-end

data/lib/yiffspace/serializers/auth_info_serializer.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-require("active_job")
-
-module YiffSpace
-  module Serializers
-    class AuthInfoSerializer < ActiveJob::Serializers::ObjectSerializer
-      def serialize(arg)
-        super(**arg.serializable_hash)
-      end
-
-      def deserialize(arg)
-        Auth::AuthInfo.from_json(arg)
-      end
-
-      private
-
-      def klass
-        Auth::AuthInfo
-      end
-    end
-  end
-end

data/lib/yiffspace/serializers/discord_info_serializer.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-require("active_job")
-
-module YiffSpace
-  module Serializers
-    class DiscordInfoSerializer < ActiveJob::Serializers::ObjectSerializer
-      def serialize(arg)
-        super(**arg.serializable_hash)
-      end
-
-      def deserialize(arg)
-        Auth::DiscordInfo.from_json(arg)
-      end
-
-      private
-
-      def klass
-        Auth::DiscordInfo
-      end
-    end
-  end
-end

data/lib/yiffspace/serializers/permissions_serializer.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-require("active_job")
-
-module YiffSpace
-  module Serializers
-    class PermissionsSerializer < ActiveJob::Serializers::ObjectSerializer
-      def serialize(arg)
-        super("value" => arg.value)
-      end
-
-      def deserialize(arg)
-        Auth::Permissions.new(arg["value"])
-      end
-
-      private
-
-      def klass
-        Auth::Permissions
-      end
-    end
-  end
-end

data/lib/yiffspace/serializers/user_info_serializer.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-require("active_job")
-
-module YiffSpace
-  module Serializers
-    class UserInfoSerializer < ActiveJob::Serializers::ObjectSerializer
-      def serialize(arg)
-        super(**arg.serializable_hash)
-      end
-
-      def deserialize(arg)
-        Auth::UserInfo.from_json(arg)
-      end
-
-      private
-
-      def klass
-        Auth::UserInfo
-      end
-    end
-  end
-end

data/lib/yiffspace/utils/user_deduper.rb

@@ -1,66 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Utils
-    # get_or_create_user is check-then-act (query Logto, then create) with no locking
-    # of its own - two concurrent calls for a discord id that doesn't exist yet will
-    # both create a user, and the loser's discord-identity-attach step fails once the
-    # winner's identity claims it first. That leaves an identity-less "orphan" user
-    # behind in Logto. This scans the whole user base to find those orphans (and any
-    # other duplicate/ambiguous state) so they can be cleaned up.
-    module UserDeduper
-      # create_user sets a new user's avatar to the discord CDN URL for the discord id
-      # it was created for, before the identity-attach step runs - so even an orphan
-      # that never got its identity attached still reveals which discord id it was
-      # meant for.
-      AVATAR_ID_PATTERN = %r{cdn\.discordapp\.com/avatars/(\d+)/}
-
-      module_function
-
-      def discord_id_for(user)
-        user.data.identities&.discord&.userId || avatar_discord_id_for(user)
-      end
-
-      def avatar_discord_id_for(user)
-        match = user.data.avatar.to_s.match(AVATAR_ID_PATTERN)
-        match && match[1]
-      end
-
-      def linked?(user)
-        user.data.identities&.discord&.userId.present?
-      end
-
-      # Returns a hash with:
-      # - :conflicts - discord id => users, for ids where more than one user has the
-      #   identity actually attached. Ambiguous; always needs manual review, never
-      #   auto-deleted.
-      # - :deletable_orphans - [orphan, keeper] pairs, where orphan has no identity
-      #   attached but its avatar points at a discord id claimed by exactly one other
-      #   (linked) user. This is the confirmed race-loser case - safe to delete.
-      # - :unresolved_orphans - users with no identity attached and no corresponding
-      #   linked user (still mid-race, or the winner can't be identified). Reported
-      #   only, never auto-deleted.
-      def scan(management)
-        users = management.list_users
-        linked, unlinked = users.partition { |u| linked?(u) }
-
-        by_discord_id = linked.group_by { |u| u.data.identities.discord.userId }
-        conflicts = by_discord_id.select { |_id, group| group.length > 1 }
-
-        deletable_orphans = []
-        unresolved_orphans = []
-        unlinked.each do |user|
-          discord_id = avatar_discord_id_for(user)
-          keeper = discord_id && by_discord_id[discord_id]
-          if keeper&.length == 1
-            deletable_orphans << [user, keeper.first]
-          else
-            unresolved_orphans << user
-          end
-        end
-
-        { conflicts: conflicts, deletable_orphans: deletable_orphans, unresolved_orphans: unresolved_orphans }
-      end
-    end
-  end
-end