yiffspace 0.0.25 → 0.1.1

data/lib/yiffspace/auth/auth_info.rb

@@ -1,78 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Auth
-    class AuthInfo
-      attr_reader(:id, :token, :roles, :permissions, :client_id)
-
-      # @param id String
-      # @param roles Array(String)
-      # @param permissions Array(String)
-      # @param token LogtoClient::AccessTokenClaims
-      # @param client_id String
-      def initialize(id:, roles:, permissions:, token:, client_id:)
-        raise(ArgumentError, "no id provided") if id.blank?
-        raise(ArgumentError, "no token provided") if token.blank?
-        raise(ArgumentError, "no client id provided") if client_id.blank?
-
-        @id           = id
-        @token        = token
-        @roles        = Array(roles)
-        @permissions  = Permissions.new(permissions, separator: YiffSpace::Auth.get_by_id(client_id).permissions_separator)
-        @client_id    = client_id
-      end
-
-      def anonymous?
-        false
-      end
-
-      # this feels wrong, but it hopefully shouldn't break anything
-      def present?
-        true
-      end
-
-      def blank?
-        false
-      end
-
-      def has_permission?(name)
-        permissions.include?(name.to_s)
-      end
-
-      def serializable_hash(*)
-        {
-          "id"          => id,
-          "token"       => token.as_json,
-          "roles"       => roles,
-          "permissions" => permissions.values,
-          "client_id"   => client_id,
-        }
-      end
-
-      def to_session
-        serializable_hash
-      end
-
-      def self.from_json(data)
-        raise(ArgumentError, "invalid data") if data.blank?
-
-        data = JSON.parse(data) if data.is_a?(String)
-        data = ::YiffSpace::Utils::OpenHash.from(data)
-
-        new(
-          id:          data.id,
-          token:       data.token,
-          roles:       data.roles,
-          permissions: data.permissions,
-          client_id:   data.client_id,
-        )
-      end
-
-      def self.from_session(data)
-        return nil if data.blank?
-
-        from_json(data)
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/client.rb

@@ -1,56 +0,0 @@
-# frozen_string_literal: true
-
-require_relative("../core_ext/logto/named_session_storage")
-require("httparty")
-
-module YiffSpace
-  module Auth
-    class Client
-      attr_accessor(:client_id, :client_secret, :scopes, :resource,
-                    :redirect_uri, :server_url, :auth_session_key, :user_session_key,
-                    :update_discord_images, :permissions_separator, :logto_webhook_secret)
-
-      attr_reader(:name)
-
-      def initialize(name)
-        @name                    = name.to_sym
-        @scopes                  = %i[openid offline_access profile roles identities custom_data]
-        @redirect_uri            = "http://127.0.0.1:3000/auth/cb"
-        @server_url              = "https://auth.yiff.space"
-        @auth_session_key        = :"yiffspace_auth_#{name}"
-        @user_session_key        = :"yiffspace_user_#{name}"
-        @update_discord_images   = true
-        @permissions_separator   = ":"
-        @logto_webhook_secret    = nil
-      end
-
-      def logto(controller)
-        LogtoClient.new(
-          config:   LogtoClient::Config.new(
-            endpoint:   server_url,
-            app_id:     client_id,
-            app_secret: client_secret,
-            scopes:     scopes,
-            resources:  [resource].compact,
-          ),
-          # Allow the client to redirect to other hosts (i.e. your Logto tenant)
-          navigate: ->(uri) { controller.redirect_to(uri, allow_other_host: true) },
-          # Controller has access to the session object
-          storage:  LogtoClient::NamedSessionStorage.new("yiffspace", controller.session, app_id: @name),
-        )
-      end
-
-      def logto_management
-        @logto_management ||= LogtoManagementClient.new(self)
-      end
-
-      def fetch_discord_user(id)
-        response = HTTParty.get("https://discord.com/api/v10/users/#{id}", { headers: { "Authorization" => "Bot #{YiffSpace.config.discord_bot_token}" } })
-        return nil if response.code == 404
-        raise("failed to fetch discord user: #{response.code} #{response.message}\n#{response.parsed_response.inspect}") if response.code != 200
-
-        DiscordInfo.new(response.parsed_response)
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/discord_info.rb

@@ -1,65 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Auth
-    class DiscordInfo
-      # locale, mfa_enabled, and premium_type are not present for legacy users backfilled from api data,
-      # we don't need that data either way
-      ATTRIBUTES = %i[id flags avatar banner username global_name public_flags discriminator].freeze
-      attr_reader(:data, *ATTRIBUTES)
-
-      def initialize(options = {}, **kwargs)
-        @data = options.merge(kwargs).with_indifferent_access
-        ATTRIBUTES.each do |attr|
-          instance_variable_set("@#{attr}", @data[attr])
-        end
-
-        return unless YiffSpace.config.auth.update_discord_images
-
-        last_avatar = Rails.cache.fetch("yiffspace:auth:discord_avatar_update:#{id}")
-        last_banner = Rails.cache.fetch("yiffspace:auth:discord_banner_update:#{id}")
-
-        if last_avatar != avatar
-          Rails.cache.write("yiffspace:auth:discord_avatar_update:#{id}", avatar, expires_in: 30.days)
-          update_avatar
-        end
-
-        return unless last_banner != banner
-
-        Rails.cache.write("yiffspace:auth:discord_banner_update:#{id}", banner, expires_in: 30.days)
-        update_banner
-      end
-
-      def update_avatar
-        Images::Avatar.get_for(id, :discord).update(avatar)
-      end
-
-      def update_banner
-        Images::Banner.get_for(id, :discord).update(banner)
-      end
-
-      def serializable_hash(*)
-        ATTRIBUTES.to_h { |key| [key.to_s, instance_variable_get("@#{key}")] }
-      end
-
-      def to_session
-        serializable_hash
-      end
-
-      def self.from_json(data)
-        raise(ArgumentError, "invalid data") if data.blank?
-
-        data = JSON.parse(data) if data.is_a?(String)
-        data = ::YiffSpace::Utils::OpenHash.from(data)
-
-        new(data)
-      end
-
-      def self.from_session(data)
-        return nil if data.blank?
-
-        from_json(data)
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/engine.rb

@@ -1,58 +0,0 @@
-# frozen_string_literal: true
-
-require("rails")
-
-module YiffSpace
-  module Auth
-    class Engine < ::Rails::Engine
-      isolate_namespace(YiffSpace::Auth)
-      config.root        = File.expand_path("../../../engines/auth", __dir__)
-      shared_root        = File.expand_path("../../../app", __dir__)
-      shared_controllers = "#{shared_root}/controllers"
-      shared_helpers     = "#{shared_root}/helpers"
-      shared_models      = "#{shared_root}/models"
-      shared_views       = "#{shared_root}/views"
-      shared_assets      = "#{shared_root}/assets"
-
-      paths["app/controllers"] << shared_controllers
-      paths["app/helpers"] << shared_helpers
-      paths["app/models"] << shared_models
-      paths["app/views"] << shared_views
-      paths["app/assets"] << shared_assets
-
-      config.autoload_paths   += [shared_controllers, shared_helpers, shared_models]
-      config.eager_load_paths += [shared_controllers, shared_helpers, shared_models]
-
-      initializer("yiffspace.auth.asset_paths") do |app|
-        if app.config.respond_to?(:assets)
-          app.config.assets.paths << "#{shared_assets}/config"
-          app.config.assets.precompile += %w[yiffspace/application.css]
-        end
-      end
-
-      class << self
-        def for(name)
-          @instances              ||= {}
-          @instances[name.to_sym] ||= begin
-            subclass = Class.new(self)
-            subclass.engine_name("yiffspace_auth_#{name}")
-            # Inherit isolation settings that aren't copied from the parent class
-            subclass.instance_variable_set(:@isolated, true)
-            subclass.routes.default_scope = { module: "yiff_space/auth" }
-            subclass.routes.draw do
-              constraints(SetClientName.new(name)) do
-                post(:webhook, controller: :webhook, action: :create)
-                get(:cb, controller: :root)
-                get(:logout, controller: :root)
-                get(:permissions, controller: :root)
-                get(:debug, controller: :root) if ::YiffSpace::Auth.enable_debug_action?
-                root(action: :show, controller: :root, as: :auth)
-              end
-            end
-            subclass
-          end
-        end
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/helper.rb

@@ -1,174 +0,0 @@
-# frozen_string_literal: true
-
-require("active_support/concern")
-
-module YiffSpace
-  module Auth
-    module Helper
-      extend(ActiveSupport::Concern)
-
-      module ClassMethods
-        def set_client_name(name) # rubocop:disable Naming/AccessorMethodName
-          before_action do |controller|
-            controller.request.env["yiffspace.auth.client_name"] = name
-            if controller.respond_to?(:yiffspace_client_name=)
-              controller.yiffspace_client_name = name
-            elsif controller.respond_to?(:client_name=)
-              controller.client_name = name
-            elsif controller.respond_to?(:helpers)
-              if controller.helpers.respond_to?(:yiffspace_client_name=)
-                controller.helpers.yiffspace_client_name = name
-              elsif controller.helpers.respond_to?(:client_name=)
-                controller.helpers.client_name = name
-              end
-            end
-          end
-        end
-      end
-
-      def auth_raw
-        session[auth_client_config.auth_session_key]
-      end
-
-      def auth
-        return AuthInfo::Anonymous.instance if auth_raw.blank?
-
-        AuthInfo.from_session(auth_raw)
-      end
-
-      def auth?
-        auth_raw.present? && !auth.anonymous?
-      end
-
-      def auth=(value)
-        value                                        = nil if value.is_a?(AuthInfo::Anonymous)
-        session[auth_client_config.auth_session_key] = value&.to_session
-      end
-
-      def reset_auth!
-        session.delete(auth_client_config.auth_session_key)
-      end
-
-      def user_raw
-        session[auth_client_config.user_session_key]
-      end
-
-      def user
-        return UserInfo::Anonymous.instance if user_raw.blank?
-
-        UserInfo.from_session(user_raw)
-      end
-
-      def user?
-        user_raw.present? && !user.anonymous?
-      end
-
-      def user=(value)
-        value                                        = nil if value.is_a?(UserInfo::Anonymous)
-        session[auth_client_config.user_session_key] = value&.to_session
-      end
-
-      def reset_user!
-        session.delete(auth_client_config.user_session_key)
-      end
-
-      def full_reset!
-        reset_auth!
-        reset_user!
-      end
-
-      def require_auth(path)
-        redirect_to(path) unless logged_in?
-      end
-
-      def logged_in?
-        auth? && user?
-      end
-
-      def has_permission?(name)
-        return false unless logged_in?
-
-        auth.permissions.has?(name)
-      end
-
-      DIRTY_FLAG_KEY = "yiffspace:auth:dirty:%s"
-
-      # Checks the dirty flag written by the Logto webhook handler. If set, re-fetches
-      # the user's current roles and permissions from the Logto Management API and
-      # rewrites the session — without waiting for the access token to expire.
-      # Call this as a before_action in any controller that needs instant revocation.
-      def sync_auth_if_dirty!
-        return unless auth?
-
-        flag_key = format(DIRTY_FLAG_KEY, auth.id)
-        return unless Rails.cache.exist?(flag_key)
-
-        Rails.cache.delete(flag_key)
-
-        management = auth_client_config.logto_management
-        api_user   = management.get_user_by_id(auth.id)
-
-        if api_user.nil? || api_user.data["isSuspended"]
-          full_reset!
-          return
-        end
-
-        roles       = management.get_user_roles(auth.id)
-        permissions = roles.flat_map { |role| management.get_role_scopes(role["id"]) }
-                           .pluck("name")
-                           .uniq
-
-        self.auth = AuthInfo.new(
-          id:          auth.id,
-          token:       auth.token,
-          roles:       roles.pluck("name"),
-          permissions: permissions,
-          client_id:   auth.client_id,
-        )
-      end
-
-      def url_helpers
-        YiffSpace::Auth::Engine.for(client_name).routes.url_helpers
-      end
-
-      # Returns the Auth::Client for the current request. In auth engine controllers this is
-      # resolved from the routing default set by Engine.for; in host app controllers it falls
-      # back to the default registered client. Override in your controller to choose a specific
-      # client when multiple are registered.
-      def auth_client_config
-        client_name = self.client_name
-        client_name.present? ? YiffSpace::Auth[client_name.to_sym] : YiffSpace::Auth.default
-      end
-
-      def client_name
-        respond_to?(:request, true) && request.env[CLIENT_NAME_ENV]
-      end
-
-      def client_name=(value)
-        request.env[CLIENT_NAME_ENV] = value.to_sym
-      end
-
-      module Scoped
-        extend(ActiveSupport::Concern)
-        include(Helper)
-
-        included do
-          private(*Helper.instance_methods(false))
-          private_class_method(*Helper::ClassMethods.instance_methods(false))
-        end
-
-        Helper.instance_methods(false).each do |name|
-          define_method("yiffspace_#{name}") { |*args, **kwargs, &block| send(name, *args, **kwargs, &block) }
-        end
-
-        module ClassMethods
-          include(Helper::ClassMethods)
-
-          Helper::ClassMethods.instance_methods(false).each do |name|
-            define_method("yiffspace_#{name}") { |*args, **kwargs, &block| send(name, *args, **kwargs, &block) }
-          end
-        end
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/permissions.rb

@@ -1,87 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Auth
-    class Permissions
-      attr_accessor(:values)
-
-      delegate(:each, to: :values)
-
-      include(Enumerable)
-
-      def initialize(perms, separator: ":")
-        @values = perms
-        @tree   = {}
-        @separator = separator
-
-        perms.each do |perm|
-          current = @tree
-          parts   = perm.split(separator)
-
-          parts.each do |part|
-            current[part] ||= {}
-            current       = current[part]
-          end
-
-          # mark leaf
-          current[:__leaf__] = true
-        end
-      end
-
-      def has?(perm)
-        current = @tree
-        parts   = perm.split(@separator)
-
-        parts.each do |part|
-          return false unless current[part]
-
-          current = current[part]
-        end
-
-        current[:__leaf__] == true
-      end
-
-      alias include? has?
-
-      def method_missing(name, *_args)
-        str = name.to_s
-
-        if str.end_with?("?")
-          key = str[0..-2]
-          return @tree[key]&.dig(:__leaf__) == true
-        end
-
-        if @tree.key?(str)
-          self.class.new_from_subtree(@tree[str], @separator)
-        else
-          # return empty node instead of raising
-          self.class.new([], separator: @separator)
-        end
-      end
-
-      def respond_to_missing?(_name, _include_private = false)
-        true
-      end
-
-      def self.new_from_subtree(tree, separator)
-        obj = allocate
-        obj.instance_variable_set(:@tree, tree)
-        obj.instance_variable_set(:@values, leaves_from_tree(tree))
-        obj.instance_variable_set(:@separator, separator)
-        obj
-      end
-
-      def self.leaves_from_tree(node, prefix = "")
-        result = []
-        node.each do |key, subtree|
-          next if key == :__leaf__
-
-          path = prefix.empty? ? key : "#{prefix}.#{key}"
-          result << path if subtree[:__leaf__]
-          result.concat(leaves_from_tree(subtree, path))
-        end
-        result
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/set_client_name.rb

@@ -1,15 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Auth
-    class SetClientName < Utils::SetEnvConstraint
-      def initialize(value)
-        super(CLIENT_NAME_ENV, value.to_sym)
-      end
-
-      def self.default
-        new(DEFAULT_CLIENT_NAME)
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/user_info/anonymous.rb

@@ -1,72 +0,0 @@
-# frozen_string_literal: true
-
-require("singleton")
-
-module YiffSpace
-  module Auth
-    class UserInfo
-      class Anonymous
-        include(::Singleton)
-
-        %i[id user discord avatar].each do |attr|
-          define_method(attr) { |*, **| raise(NotImplementedError, "#{attr} is not present on anonymous user") }
-        end
-
-        def username
-          "anonymous"
-        end
-
-        def display_name
-          "Anonymous"
-        end
-
-        def avatar
-          nil
-        end
-
-        def avatar_url
-          nil
-        end
-
-        def banner
-          nil
-        end
-
-        def banner_url
-          nil
-        end
-
-        def anonymous?
-          true
-        end
-
-        # this feels wrong, but it hopefully shouldn't break anything
-        def present?
-          false
-        end
-
-        def blank?
-          true
-        end
-
-        def serializable_hash(*)
-          nil
-        end
-
-        def to_session
-          serializable_hash
-        end
-
-        def self.from_json(*)
-          Anonymous.instance
-        end
-
-        def self.from_session(data)
-          return nil if data.blank?
-
-          from_json(data)
-        end
-      end
-    end
-  end
-end

data/lib/yiffspace/auth/user_info.rb

@@ -1,87 +0,0 @@
-# frozen_string_literal: true
-
-module YiffSpace
-  module Auth
-    class UserInfo
-      attr_reader(:id, :user, :discord)
-
-      # @param id String
-      # @param user LogtoCore::UserInfoResponse
-      # @param discord Hash
-      def initialize(id:, user:, discord:)
-        raise(ArgumentError, "no id provided") if id.blank?
-        raise(ArgumentError, "no user provided") if user.blank?
-
-        @id        = id
-        @user      = user
-        @discord   = DiscordInfo.from_json(discord)
-      end
-
-      def anonymous?
-        false
-      end
-
-      # this feels wrong, but it hopefully shouldn't break anything
-      def present?
-        true
-      end
-
-      def blank?
-        false
-      end
-
-      def avatar(type = nil)
-        type.present? ? Images::Avatar.get_for(id, type) : Images::Avatar.default_for(id)
-      end
-
-      def avatar_url(type = nil)
-        avatar(type).url
-      end
-
-      def banner(type = nil)
-        type.present? ? Images::Banner.get_for(id, type) : Images::Banner.default_for(id)
-      end
-
-      def banner_url(type = nil)
-        banner(type).url
-      end
-
-      delegate(:username, to: :discord)
-
-      def display_name
-        discord.global_name
-      end
-
-      def serializable_hash(_options = {})
-        {
-          "id"      => id,
-          "discord" => discord.serializable_hash,
-          "user"    => user.as_json,
-        }
-      end
-
-      def to_session
-        serializable_hash.without("discord").merge(discord: discord.to_session)
-      end
-
-      def self.from_json(data)
-        raise(ArgumentError, "invalid data") if data.blank?
-
-        data = JSON.parse(data) if data.is_a?(String)
-        data = ::YiffSpace::Utils::OpenHash.from(data)
-
-        new(
-          id:      data.id,
-          discord: data.discord,
-          user:    data.user,
-        )
-      end
-
-      def self.from_session(data)
-        return nil if data.blank?
-
-        from_json(data)
-      end
-    end
-  end
-end