module Rodauth

    # File lib/rodauth/features/email_auth.rb
247 def _account_from_email_auth_key(token)
248   account_from_key(token, account_open_status_value){|id| get_email_auth_key(id)}
249 end

    # File lib/rodauth/features/base.rb
890 def _account_from_id(id, status_id=nil)
891   ds = account_ds(id)
892   ds = ds.where(account_status_column=>status_id) if status_id && !skip_status_checks?
893   ds.first
894 end

    # File lib/rodauth/features/base.rb
877 def _account_from_login(login)
878   ds = account_table_ds.where(login_column=>login)
879   ds = ds.select(*account_select) if account_select
880   ds = ds.where(account_status_column=>[account_unverified_status_value, account_open_status_value]) unless skip_status_checks?
881   ds.first
882 end

    # File lib/rodauth/features/jwt_refresh.rb
124 def _account_from_refresh_token(token)
125   id, token_id, key = _account_refresh_token_split(token)
126 
127   unless key &&
128          (id.to_s == session_value.to_s) &&
129          (actual = get_active_refresh_token(id, token_id)) &&
130          (timing_safe_eql?(key, convert_token_key(actual)) || (hmac_secret_rotation? && timing_safe_eql?(key, compute_old_hmac(actual)))) &&
131          jwt_refresh_token_match?(key)
132     return
133   end
134 
135   ds = account_ds(id)
136   ds = ds.where(account_session_status_filter) unless skip_status_checks?
137   ds.first
138 end

    # File lib/rodauth/features/reset_password.rb
260 def _account_from_reset_password_key(token)
261   account_from_key(token, reset_password_account_status_value){|id| get_password_reset_key(id)}
262 end

    # File lib/rodauth/features/base.rb
884 def _account_from_session
885   ds = account_ds(session_value)
886   ds = ds.where(account_session_status_filter) unless skip_status_checks?
887   ds.first
888 end

    # File lib/rodauth/features/lockout.rb
315 def _account_from_unlock_key(token)
316   account_from_key(token){|id| apply_key_for_update(account_lockouts_ds(id)).get(account_lockouts_key_column)}
317 end

    # File lib/rodauth/features/verify_account.rb
319 def _account_from_verify_account_key(token)
320   account_from_key(token, account_unverified_status_value){|id| get_verify_account_key(id)}
321 end

    # File lib/rodauth/features/verify_login_change.rb
216 def _account_from_verify_login_change_key(token)
217   account_from_key(token, verify_login_change_account_status_value) do |id|
218     @verify_login_change_new_login, key = get_verify_login_change_login_and_key(id)
219     key
220   end
221 end

    # File lib/rodauth/features/jwt_refresh.rb
140 def _account_refresh_token_split(token)
141   id, token = split_token(token)
142   return unless token && (id = convert_token_id(id))
143 
144   token_id, key = split_token(token)
145   return unless key && (token_id = convert_token_id(token_id))
146 
147   [id, token_id, key]
148 end

    # File lib/rodauth/features/base.rb
599 def _around_rodauth
600   yield
601 end

    # File lib/rodauth/features/email_auth.rb
194 def _email_auth_request
195   if email_auth_email_recently_sent?
196     set_redirect_error_flash email_auth_email_recently_sent_error_flash
197     redirect email_auth_email_recently_sent_redirect
198   end
199 
200   generate_email_auth_key_value
201   transaction do
202     before_email_auth_request
203     create_email_auth_key
204     send_email_auth_email
205     after_email_auth_request
206   end
207 
208   email_auth_email_sent_response
209 end

    # File lib/rodauth/features/base.rb
909 def _field_attributes(field)
910   nil
911 end

    # File lib/rodauth/features/base.rb
913 def _field_error_attributes(field)
914   " aria-invalid=\"true\" aria-describedby=\"#{field}_error_message\" "
915 end

     # File lib/rodauth/features/base.rb
1004 def _filter_links(links)
1005   links.select!{|_, link| link}
1006   links.sort!
1007   links
1008 end

    # File lib/rodauth/features/base.rb
917 def _formatted_field_error(field, error)
918   "<span class=\"#{input_field_error_message_class}\" id=\"#{field}_error_message\">#{error}</span>"
919 end

    # File lib/rodauth/features/remember.rb
241 def _get_remember_cookie
242   request.cookies[remember_cookie_key]
243 end

    # File lib/rodauth/features/base.rb
596 def _initialize_instance_variables
597 end

    # File lib/rodauth/features/json.rb
228 def _json_response_body(hash)
229   request.send(:convert_to_json, hash)
230 end

    # File lib/rodauth/features/jwt.rb
106 def _jwt_decode_opts
107   jwt_decode_opts
108 end

    # File lib/rodauth/features/jwt.rb
111 def _jwt_decode_secrets
112   secrets = [jwt_secret, jwt_old_secret]
113   secrets.compact!
114   secrets
115 end

    # File lib/rodauth/features/login.rb
186 def _login(auth_type)
187   warn("Deprecated #_login method called, use #login instead.")
188   login(auth_type)
189 end

    # File lib/rodauth/features/login.rb
181 def _login_form_footer
182   return '' if _login_form_footer_links.empty?
183   render('login-form-footer')
184 end

    # File lib/rodauth/features/create_account.rb
118 def _login_form_footer_links
119   super << [10, create_account_path, create_account_link_text]
120 end

    # File lib/rodauth/features/login.rb
166 def _login_response
167   set_notice_flash login_notice_flash
168   redirect(saved_login_redirect || login_redirect)
169 end

     # File lib/rodauth/features/base.rb
1075 def _merge_fixed_locals_opts(opts, fixed_locals)
1076   if use_template_fixed_locals? && !opts[:locals]
1077     fixed_locals_opts = {default_fixed_locals: fixed_locals}
1078     fixed_locals_opts.merge!(opts[:template_opts]) if opts[:template_opts]
1079     opts[:template_opts] = fixed_locals_opts
1080   end
1081 end

    # File lib/rodauth/features/email_auth.rb
188 def _multi_phase_login_forms
189   forms = super
190   forms << [30, email_auth_request_form, :_email_auth_request] if valid_login_entered? && allow_email_auth?
191   forms
192 end

    # File lib/rodauth/features/create_account.rb
122 def _new_account(login)
123   acc = {login_column=>login}
124   unless skip_status_checks?
125     acc[account_status_column] = account_initial_status_value
126   end
127   acc
128 end

    # File lib/rodauth/features/otp.rb
457 def _otp
458   _otp_for_key(otp_user_key)
459 end

    # File lib/rodauth/features/otp.rb
442 def _otp_add_key(secret)
443   # Uniqueness errors can't be handled here, as we can't be sure the secret provided
444   # is the same as the current secret.
445   otp_key_ds.insert(otp_keys_id_column=>session_value, otp_keys_column=>secret)
446 end

    # File lib/rodauth/features/otp.rb
453 def _otp_for_key(key)
454   otp_class.new(key, :issuer=>otp_issuer, :digits=>otp_digits, :interval=>otp_interval)
455 end

    # File lib/rodauth/features/otp.rb
434 def _otp_interval
435   otp_interval || 30
436 end

    # File lib/rodauth/features/otp.rb
448 def _otp_key
449   @otp_user_key = nil
450   otp_key_ds.get(otp_keys_column) || false
451 end

    # File lib/rodauth/features/otp.rb
428 def _otp_tmp_key(secret)
429   @otp_tmp_key = true
430   @otp_user_key = nil
431   @otp_key = secret
432 end

    # File lib/rodauth/features/otp.rb
269 def _otp_valid_code?(ot_pass, otp)
270   return false unless otp_exists?
271   ot_pass = ot_pass.gsub(/\s+/, '')
272   if drift = otp_drift
273     # :nocov:
274     if otp.respond_to?(:verify_with_drift)
275       otp.verify_with_drift(ot_pass, drift)
276     # :nocov:
277     else
278       otp.verify(ot_pass, :drift_behind=>drift, :drift_ahead=>drift, :after=>otp_last_use)
279     end
280   # :nocov:
281   elsif otp.respond_to?(:verify_with_drift)
282     otp.verify(ot_pass)
283   # :nocov:
284   else
285     otp.verify(ot_pass, :after=>otp_last_use)
286   end
287 end

    # File lib/rodauth/features/otp.rb
439 def _otp_valid_code_for_old_secret
440 end

    # File lib/rodauth/features/webauthn.rb
443 def _override_webauthn_credential_response_verify(webauthn_credential)
444   # no need to override
445 end

    # File lib/rodauth/features/base.rb
603 def _process_raw_hmac(hmac)
604   s = [hmac].pack('m')
605   s.chomp!("=\n")
606   s.tr!('+/', '-_')
607   s
608 end

    # File lib/rodauth/features/recovery_codes.rb
265 def _recovery_codes
266   recovery_codes_ds.select_map(recovery_codes_column)
267 end

    # File lib/rodauth/features/json.rb
218 def _return_json_response
219   response.status ||= json_response_error_status if json_response_error?
220   response.headers[convert_response_header_key('content-type')] ||= json_response_content_type
221   return_response _json_response_body(json_response)
222 end

   # File lib/rodauth/features/json.rb
88 def _set_otp_unlock_info
89   if use_json?
90     json_response[:num_successes] = otp_unlock_num_successes
91     json_response[:required_successes] = otp_unlock_auths_required
92     json_response[:next_attempt_after] = otp_unlock_next_auth_attempt_after.to_i
93   end
94 end

    # File lib/rodauth/features/remember.rb
190 def _set_remember_cookie(account_id, remember_key_value, deadline)
191   opts = Hash[remember_cookie_options]
192   opts[:value] = "#{account_id}_#{convert_token_key(remember_key_value)}"
193   opts[:expires] = convert_timestamp(deadline)
194   opts[:path] = "/" unless opts.key?(:path)
195   opts[:httponly] = true unless opts.key?(:httponly) || opts.key?(:http_only)
196   opts[:secure] = true unless opts.key?(:secure) || !request.ssl?
197   ::Rack::Utils.set_cookie_header!(response.headers, remember_cookie_key, opts)
198 end

    # File lib/rodauth/features/lockout.rb
175 def _setup_account_lockouts_hash(account_id, key)
176   hash = {account_lockouts_id_column=>account_id, account_lockouts_key_column=>key}
177   set_deadline_value(hash, account_lockouts_deadline_column, account_lockouts_deadline_interval)
178   hash
179 end

    # File lib/rodauth/features/sms_codes.rb
476 def _sms_request_response
477   set_notice_flash sms_request_notice_flash
478   redirect sms_auth_redirect
479 end

     # File lib/rodauth/features/base.rb
1085 def _template_opts(opts, page)
1086   opts = scope.send(:find_template, scope.send(:parse_template_opts, page, opts))
1087   unless File.file?(scope.send(:template_path, opts))
1088     opts[:path] = template_path(page)
1089   end
1090   opts
1091 end

   # File lib/rodauth/features/confirm_password.rb
79 def _two_factor_auth_links
80   links = (super if defined?(super)) || []
81   if authenticated_by.length == 1 && !authenticated_by.include?('password') && has_password?
82     links << [5, confirm_password_path, confirm_password_link_text]
83   end
84   links
85 end

    # File lib/rodauth/features/two_factor_base.rb
250 def _two_factor_auth_response
251   saved_two_factor_auth_redirect = remove_session_value(two_factor_auth_redirect_session_key)
252   set_notice_flash two_factor_auth_notice_flash
253   redirect(saved_two_factor_auth_redirect || two_factor_auth_redirect)
254 end

    # File lib/rodauth/features/otp.rb
376 def _two_factor_remove_all_from_session
377   two_factor_remove_session('totp')
378   super
379 end

    # File lib/rodauth/features/otp.rb
370 def _two_factor_remove_links
371   links = super
372   links << [20, otp_disable_path, otp_disable_link_text] if otp_exists?
373   links
374 end

    # File lib/rodauth/features/otp.rb
364 def _two_factor_setup_links
365   links = super
366   links << [20, otp_setup_path, otp_setup_link_text] unless otp_exists?
367   links
368 end

   # File lib/rodauth/features/change_login.rb
83 def _update_login(login)
84   updated = nil
85   raised = raises_uniqueness_violation?{updated = update_account({login_column=>login}, account_ds.exclude(login_column=>login)) == 1}
86   if raised
87     set_login_requirement_error_message(:already_an_account_with_this_login, already_an_account_with_this_login_message)
88   end
89   change_made = updated && !raised
90   clear_tokens(:change_login) if change_made
91   change_made
92 end

     # File lib/rodauth/features/base.rb
1093 def _view(meth, page)
1094   unless scope.respond_to?(meth)
1095     raise ConfigurationError, "attempted to render a built-in view/email template (#{page.inspect}), but rendering is disabled"
1096   end
1097 
1098   scope.send(meth, _view_opts(page))
1099 end

     # File lib/rodauth/features/base.rb
1065 def _view_opts(page)
1066   opts = template_opts.dup
1067   _merge_fixed_locals_opts(opts, '(rodauth: self.rodauth)')
1068   opts[:locals] = opts[:locals] ? opts[:locals].dup : {}
1069   opts[:locals][:rodauth] = self
1070   opts[:cache] = cache_templates
1071   opts[:cache_key] = :"rodauth_#{page}"
1072   _template_opts(opts, page)
1073 end

    # File lib/rodauth/features/base.rb
424 def account!
425   @account_retrieval_type ? @account : (session_value && account_from_session)
426 end

    # File lib/rodauth/features/account_expiration.rb
104 def account_activity_ds(account_id)
105   db[account_activity_table].
106     where(account_activity_id_column=>account_id)
107 end

    # File lib/rodauth/features/base.rb
929 def account_ds(id=account_id)
930   raise ArgumentError, "invalid account id passed to account_ds" unless id
931   ds = account_table_ds.where(account_id_column=>id)
932   ds = ds.select(*account_select) if account_select
933   ds
934 end

   # File lib/rodauth/features/account_expiration.rb
54 def account_expired?
55   columns = [account_activity_last_activity_column, account_activity_last_login_column, account_activity_expired_column]
56   last_activity, last_login, expired = account_activity_ds(account_id).get(columns)
57   return true if expired
58   timestamp = convert_timestamp(expire_account_on_last_activity? ? last_activity : last_login)
59   return false unless timestamp
60   timestamp < Time.now - expire_account_after
61 end

   # File lib/rodauth/features/account_expiration.rb
35 def account_expired_at
36   get_activity_timestamp(account_id, account_activity_expired_column)
37 end

    # File lib/rodauth/features/email_auth.rb
142 def account_from_email_auth_key(key)
143   set_account(_account_from_email_auth_key(key), :email_auth)
144 end

    # File lib/rodauth/features/base.rb
432 def account_from_id(id, status_id=nil)
433   set_account(_account_from_id(id, status_id), :id)
434 end

    # File lib/rodauth/features/email_base.rb
100 def account_from_key(token, status_id=nil)
101   id, key = split_token(token)
102   return unless key && (id = convert_token_id(id))
103 
104   return unless actual = yield(id)
105 
106   unless (hmac_secret && timing_safe_eql?(key, convert_email_token_key(actual))) ||
107      (hmac_secret_rotation? && timing_safe_eql?(key, compute_old_hmac(actual))) ||
108      ((!hmac_secret || allow_raw_email_token?) && timing_safe_eql?(key, actual))
109     return
110   end
111   _account_from_id(id, status_id)
112 end

    # File lib/rodauth/features/base.rb
317 def account_from_login(login)
318   set_account(_account_from_login(login), :login)
319 end

   # File lib/rodauth/features/jwt_refresh.rb
96 def account_from_refresh_token(token)
97   set_account(_account_from_refresh_token(token), :jwt_refresh)
98 end

    # File lib/rodauth/features/remember.rb
221 def account_from_remember_cookie
222   unless id = remembered_session_id
223     # Only set expired cookie if there is already a cookie set.
224     forget_login if _get_remember_cookie
225     return
226   end
227 
228   set_session_value(session_key, id)
229   account_from_session
230   remove_session_value(session_key)
231 
232   unless account
233     remove_remember_key(id)
234     forget_login
235     return
236   end
237 
238   account
239 end

   # File lib/rodauth/features/password_expiration.rb
45 def account_from_reset_password_key(key)
46   if a = super
47     check_password_change_allowed
48   end
49   a
50 end

    # File lib/rodauth/features/base.rb
428 def account_from_session
429   set_account(_account_from_session, :session)
430 end

    # File lib/rodauth/features/lockout.rb
226 def account_from_unlock_key(key)
227   set_account(_account_from_unlock_key(key), :unlock)
228 end

    # File lib/rodauth/features/verify_account.rb
199 def account_from_verify_account_key(key)
200   set_account(_account_from_verify_account_key(key), :verify_account)
201 end

    # File lib/rodauth/features/verify_login_change.rb
124 def account_from_verify_login_change_key(key)
125   set_account(_account_from_verify_login_change_key(key), :verify_login_change)
126 end

   # File lib/rodauth/features/webauthn_autofill.rb
45 def account_from_webauthn_login
46   return super if param_or_nil(login_param)
47 
48   credential_id = webauthn_auth_data["id"]
49   account_id = db[webauthn_keys_table]
50     .where(webauthn_keys_webauthn_id_column => credential_id)
51     .get(webauthn_keys_account_id_column)
52 
53   unless account_id
54     throw_error_reason(:invalid_webauthn_id, invalid_field_error_status, webauthn_auth_param, webauthn_invalid_webauthn_id_message)
55   end
56 
57   account_from_id(account_id)
58 end

    # File lib/rodauth/features/base.rb
307 def account_id
308   account[account_id_column]
309 end

    # File lib/rodauth/features/base.rb
610 def account_id_or_session_value
611   if @account
612     account_id
613   elsif !@account_retrieval_type
614     session_value
615   end
616 end

   # File lib/rodauth/features/verify_account_grace_period.rb
85 def account_in_unverified_grace_period?
86   return false unless account!
87   account[account_status_column] == account_unverified_status_value &&
88     verify_account_grace_period &&
89     !verify_account_ds.where(Sequel.date_add(verification_requested_at_column, :seconds=>verify_account_grace_period) > Sequel::CURRENT_TIMESTAMP).empty?
90 end

    # File lib/rodauth/features/base.rb
420 def account_initial_status_value
421   account_open_status_value
422 end

    # File lib/rodauth/features/lockout.rb
311 def account_lockouts_ds(id=account_id)
312   db[account_lockouts_table].where(account_lockouts_id_column=>id)
313 end

    # File lib/rodauth/features/lockout.rb
307 def account_login_failures_ds
308   db[account_login_failures_table].where(account_login_failures_id_column=>account_id)
309 end

    # File lib/rodauth/features/base.rb
341 def account_password_hash_column
342   nil
343 end

    # File lib/rodauth/features/base.rb
674 def account_reload(current_retrieval_type, new_retrieval_type)
675   return unless @current_route
676 
677 
678   if current_retrieval_type == new_retrieval_type
679     warn "account retrieved multiple times during rodauth route with retrieval type #{current_retrieval_type}"
680   else
681     raise Error, "account retrieved multiple times during rodauth route, original retrieval type: #{current_retrieval_type}, new retrieval type: #{new_retrieval_type}"
682   end
683 end

    # File lib/rodauth/features/base.rb
921 def account_session_status_filter
922   {account_status_column=>account_open_status_value}
923 end

    # File lib/rodauth/features/base.rb
936 def account_table_ds
937   db[accounts_table]
938 end

    # File lib/rodauth/features/webauthn.rb
271 def account_webauthn_ids
272   webauthn_keys_ds.select_map(webauthn_keys_webauthn_id_column)
273 end

    # File lib/rodauth/features/webauthn.rb
275 def account_webauthn_usage
276   webauthn_keys_ds.select_hash(webauthn_keys_webauthn_id_column, webauthn_keys_last_use_column)
277 end

    # File lib/rodauth/features/webauthn.rb
279 def account_webauthn_user_id
280   unless webauthn_id = webauthn_user_ids_ds.get(webauthn_user_ids_webauthn_id_column)
281     webauthn_id = WebAuthn.generate_user_id
282     if e = raised_uniqueness_violation do
283           webauthn_user_ids_ds.insert(
284             webauthn_user_ids_account_id_column => webauthn_account_id,
285             webauthn_user_ids_webauthn_id_column => webauthn_id
286           )
287         end
288       # If two requests to create a webauthn user id are sent at the same time and an insert
289       # is attempted for both, one will fail with a unique constraint violation.  In that case
290       # it is safe for the second one to use the webauthn user id inserted by the other request.
291       # If there is still no webauthn user id at this point, then we'll just reraise the
292       # exception.
293       # :nocov:
294       raise e unless webauthn_id = webauthn_user_ids_ds.get(webauthn_user_ids_webauthn_id_column)
295       # :nocov:
296     end
297   end
298 
299   webauthn_id
300 end

    # File lib/rodauth/features/remember.rb
269 def active_remember_key_ds(id=account_id)
270   remember_key_ds(id).where(Sequel.expr(remember_deadline_column) > Sequel::CURRENT_TIMESTAMP)
271 end

    # File lib/rodauth/features/active_sessions.rb
236 def active_sessions_ds
237   db[active_sessions_table].
238     where(active_sessions_account_id_column=>account_id_or_session_value)
239 end

    # File lib/rodauth/features/active_sessions.rb
199 def active_sessions_insert_hash
200   {active_sessions_account_id_column => session_value, active_sessions_session_id_column => compute_hmac(active_sessions_key)}
201 end

    # File lib/rodauth/features/active_sessions.rb
203 def active_sessions_update_hash
204   h = {active_sessions_last_use_column => Sequel::CURRENT_TIMESTAMP}
205 
206   if hmac_secret_rotation?
207     h[active_sessions_session_id_column] = compute_hmac(session[session_id_session_key])
208   end
209 
210   h
211 end

   # File lib/rodauth/features/active_sessions.rb
70 def add_active_session
71   key = generate_active_sessions_key
72   set_session_value(session_id_session_key, key)
73   if e = raises_uniqueness_violation?{active_sessions_ds.insert(active_sessions_insert_hash)}
74     handle_duplicate_active_session_id(e)
75   end
76   nil
77 end

   # File lib/rodauth/features/audit_logging.rb
40 def add_audit_log(account_id, action)
41   if hash = audit_log_insert_hash(account_id, action)
42     audit_log_ds.insert(hash)
43   end
44 end

    # File lib/rodauth/features/base.rb
222 def add_field_error_class(field)
223   if field_error(field)
224     " #{input_field_error_class}"
225   end
226 end

   # File lib/rodauth/features/disallow_password_reuse.rb
27 def add_previous_password_hash(hash) 
28   ds = previous_password_ds
29 
30   unless @dont_check_previous_password
31     keep_before = ds.reverse(previous_password_id_column).
32       limit(nil, previous_passwords_to_check).
33       get(previous_password_id_column)
34 
35     if keep_before
36       ds.where(Sequel.expr(previous_password_id_column) <= keep_before).
37         delete
38     end
39   end
40 
41   # This should never raise uniqueness violations, as it uses a serial primary key
42   ds.insert(previous_password_account_id_column=>account_id, previous_password_hash_column=>hash)
43 end

    # File lib/rodauth/features/recovery_codes.rb
192 def add_recovery_code
193   # This should never raise uniqueness violations unless the recovery code is the same, and the odds of that
194   # are 1/256**32 assuming a good random number generator.  Still, attempt to handle that case by retrying
195   # on such a uniqueness violation.
196   retry_on_uniqueness_violation do
197     recovery_codes_ds.insert(recovery_codes_id_column=>session_value, recovery_codes_column=>new_recovery_code)
198   end
199 end

    # File lib/rodauth/features/recovery_codes.rb
182 def add_recovery_codes(number)
183   return if number <= 0
184   transaction do
185     number.times do
186       add_recovery_code
187     end
188   end
189   @recovery_codes = nil
190 end

    # File lib/rodauth/features/remember.rb
163 def add_remember_key
164   hash = {remember_id_column=>account_id, remember_key_column=>remember_key_value}
165   set_deadline_value(hash, remember_deadline_column, remember_deadline_interval)
166 
167   if e = raised_uniqueness_violation{remember_key_ds.insert(hash)}
168     # If inserting into the remember key table causes a violation, we can pull the
169     # existing row from the table.  If there is no invalid row, we can then reraise.
170     raise e unless @remember_key_value = active_remember_key_ds.get(remember_key_column)
171   end
172 end

    # File lib/rodauth/features/recovery_codes.rb
153 def add_webauthn_credential(_)
154   super if defined?(super)
155   auto_add_missing_recovery_codes
156 end

   # File lib/rodauth/features/change_password_notify.rb
11 def after_change_password
12   super
13   send_password_changed_email
14 end

    # File lib/rodauth/features/account_expiration.rb
 99 def after_close_account
100   super if defined?(super)
101   account_activity_ds(account_id).delete
102 end

   # File lib/rodauth/features/disallow_password_reuse.rb
89 def after_create_account
90   if account_password_hash_column && !(respond_to?(:verify_account_set_password?) && verify_account_set_password?)
91     add_previous_password_hash(password_hash(param(password_param)))
92   end
93   super if defined?(super)
94 end

    # File lib/rodauth/features/email_auth.rb
217 def after_login
218   # Remove the email auth key after any login, even if
219   # it is a password login.  This is done to invalidate
220   # the email login when a user has a password and requests
221   # email authentication, but then remembers their password
222   # and doesn't need the link.  At that point, the link
223   # that allows login access to the account becomes a
224   # security liability, and it is best to remove it.
225   remove_email_auth_key
226   super
227 end

    # File lib/rodauth/features/email_auth.rb
160 def after_login_entered_during_multi_phase_login
161   # If forcing email auth, just send the email link.
162   _email_auth_request if force_email_auth?
163 
164   super
165 end

    # File lib/rodauth/features/lockout.rb
278 def after_login_failure
279   invalid_login_attempted
280   super
281 end

    # File lib/rodauth/features/remember.rb
245 def after_logout
246   forget_login
247   super if defined?(super)
248 end

   # File lib/rodauth/features/otp_lockout_email.rb
18 def after_otp_authentication_failure
19   super
20 
21   if otp_locked_out? && send_otp_locked_out_email?
22     send_otp_locked_out_email
23   end
24 end

   # File lib/rodauth/features/otp_modify_email.rb
18 def after_otp_disable
19   super
20   send_otp_disabled_email
21 end

    # File lib/rodauth/features/active_sessions.rb
153 def after_otp_setup
154   super if defined?(super)
155   remove_all_active_sessions_except_current if @clear_active_sessions_after_two_factor_setup
156 end

    # File lib/rodauth/features/json.rb
104 def after_otp_unlock_auth_failure
105   super if defined?(super)
106   _set_otp_unlock_info
107 end

    # File lib/rodauth/features/json.rb
 96 def after_otp_unlock_auth_success
 97   super if defined?(super)
 98   if otp_locked_out?
 99     _set_otp_unlock_info
100     json_response[:deadline] = otp_unlock_deadline.to_i
101   end
102 end

    # File lib/rodauth/features/json.rb
109 def after_otp_unlock_not_yet_available
110   super if defined?(super)
111   _set_otp_unlock_info
112 end

    # File lib/rodauth/features/active_sessions.rb
137 def after_refresh_token
138   super if defined?(super)
139   if prev_key = session[session_id_session_key]
140     key = generate_active_sessions_key
141     set_session_value(session_id_session_key, key)
142     active_sessions_ds.
143       where(active_sessions_session_id_column => compute_hmacs(prev_key)).
144       update(active_sessions_session_id_column => compute_hmac(key))
145   end
146 end

   # File lib/rodauth/features/password_grace_period.rb
48 def after_reset_password
49   super if defined?(super)
50   @last_password_entry = Time.now.to_i
51 end

    # File lib/rodauth/features/active_sessions.rb
158 def after_sms_confirm
159   super if defined?(super)
160   remove_all_active_sessions_except_current if @clear_active_sessions_after_two_factor_setup
161 end

    # File lib/rodauth/features/recovery_codes.rb
235 def after_sms_disable
236   super if defined?(super)
237   auto_remove_recovery_codes
238 end

    # File lib/rodauth/features/recovery_codes.rb
240 def after_webauthn_remove
241   super if defined?(super)
242   auto_remove_recovery_codes
243 end

    # File lib/rodauth/features/active_sessions.rb
163 def after_webauthn_setup
164   super if defined?(super)
165   remove_all_active_sessions_except_current if @clear_active_sessions_after_two_factor_setup
166 end

    # File lib/rodauth/features/email_auth.rb
213 def allow_email_auth?
214   defined?(super) ? super : true
215 end

   # File lib/rodauth/features/email_base.rb
78 def allow_param_fallback_for_session_param?
79   return super if defined?(super)
80   false
81 end

    # File lib/rodauth/features/verify_account.rb
165 def allow_resending_verify_account_email?
166   account[account_status_column] == account_unverified_status_value
167 end

    # File lib/rodauth/features/base.rb
350 def already_logged_in
351   # RODAUTH3: Move to login feature, halt or redirect by default
352   nil
353 end

   # File lib/rodauth/features/email_base.rb
91 def apply_key_for_update(ds)
92   if @key_for_update
93     @key_for_update = nil
94     ds.for_update
95   else
96     ds
97   end
98 end

    # File lib/rodauth/features/argon2.rb
107 def argon2_hash_algorithm?(hash)
108   hash.start_with?('$argon2id$')
109 end

   # File lib/rodauth/features/argon2.rb
78 def argon2_hash_cost
79   { t_cost: 1, m_cost: 5, p_cost: 1 }
80 end

    # File lib/rodauth/features/argon2.rb
111 def argon2_password_hash_match?(hash, password)
112   ret = ::Argon2::Password.verify_password(password, hash, argon2_secret)
113 
114   if ret == false && argon2_old_secret != argon2_secret && (ret = ::Argon2::Password.verify_password(password, hash, argon2_old_secret))
115     @update_password_hash = true
116   end
117 
118   ret
119 end

   # File lib/rodauth/features/argon2.rb
62 def argon2_password_hash_using_salt_and_secret(password, salt, secret)
63   argon2_params = Hash[extract_password_hash_cost(salt)]
64   argon2_params[argon2_salt_option] = salt.split('$').last.unpack("m")[0]
65   argon2_params[:secret] = secret
66   ::Argon2::Password.new(argon2_params).create(password)
67 end

   # File lib/rodauth/features/argon2.rb
36 def argon2_salt_option
37   :salt_do_not_supply
38 end

   # File lib/rodauth/features/audit_logging.rb
84 def audit_log_ds
85   ds = db[audit_logging_table]
86   # :nocov:
87   if db.database_type == :postgres
88   # :nocov:
89     # For PostgreSQL, use RETURNING NULL. This allows the feature
90     # to be used with INSERT but not SELECT permissions on the
91     # table, useful for audit logging where the database user
92     # the application is running as should not need to read the
93     # logs.
94     ds = ds.returning(nil)
95   end
96   ds
97 end

   # File lib/rodauth/features/audit_logging.rb
46 def audit_log_insert_hash(account_id, action)
47   if message = audit_log_message(action)
48     {
49       audit_logging_account_id_column => account_id,
50       audit_logging_message_column => message,
51       audit_logging_metadata_column => serialize_audit_log_metadata(audit_log_metadata(action))
52     }
53   end
54 end

   # File lib/rodauth/features/audit_logging.rb
64 def audit_log_message(action)
65   meth = :"audit_log_message_for_#{action}"
66   if respond_to?(meth, true)
67     send(meth)
68   else
69     audit_log_message_default(action)
70   end
71 end

   # File lib/rodauth/features/audit_logging.rb
60 def audit_log_message_default(action)
61   action.to_s
62 end

   # File lib/rodauth/features/audit_logging.rb
73 def audit_log_metadata(action)
74   meth = :"audit_log_metadata_for_#{action}"
75   if respond_to?(meth, true)
76     send(meth)
77   else
78     audit_log_metadata_default
79   end
80 end

    # File lib/rodauth/features/base.rb
155 def auth_class_eval(&block)
156   auth.class_eval(&block)
157 end

    # File lib/rodauth/features/base.rb
407 def authenticated?
408   logged_in?
409 end

    # File lib/rodauth/features/base.rb
511 def authenticated_by
512   session[authenticated_by_session_key]
513 end

    # File lib/rodauth/features/webauthn.rb
251 def authenticated_webauthn_id
252   session[authenticated_webauthn_id_session_key]
253 end

    # File lib/rodauth/features/recovery_codes.rb
253 def auto_add_missing_recovery_codes
254   if auto_add_recovery_codes?
255     add_recovery_codes(recovery_codes_limit - recovery_codes.length)
256   end
257 end

    # File lib/rodauth/features/recovery_codes.rb
259 def auto_remove_recovery_codes
260   if auto_remove_recovery_codes? && (%w'totp webauthn sms_code' & possible_authentication_methods).empty?
261     recovery_codes_remove
262   end
263 end

    # File lib/rodauth/features/base.rb
252 def autocomplete_for_field?(_param)
253   mark_input_fields_with_autocomplete?
254 end

    # File lib/rodauth/features/base.rb
524 def autologin_session(autologin_type)
525   login_session('autologin')
526   set_session_value(autologin_type_session_key, autologin_type)
527 end

    # File lib/rodauth/features/base.rb
520 def autologin_type
521   session[autologin_type_session_key]
522 end

    # File lib/rodauth/features/otp.rb
423 def base32_encode(data, length)
424   chars = 'abcdefghijklmnopqrstuvwxyz234567'
425   length.times.map{|i|chars[data[i].ord % 32]}.join
426 end

    # File lib/rodauth/features/base.rb
570 def base_url
571   url = String.new("#{request.scheme}://#{domain}")
572   url << ":#{request.port}" if request.port != Rack::Request::DEFAULT_PORTS[request.scheme]
573   url
574 end

   # File lib/rodauth/features/verify_account_grace_period.rb
58 def before_change_login_route
59   unless verified_account?
60     set_redirect_error_flash unverified_change_login_error_flash
61     redirect unverified_change_login_redirect
62   end
63   super if defined?(super)
64 end

   # File lib/rodauth/features/password_expiration.rb
89 def before_change_password_route
90   check_password_change_allowed
91   super
92 end

   # File lib/rodauth/features/disallow_password_reuse.rb
79 def before_create_account_route
80   super if defined?(super)
81   @dont_check_previous_password = true
82 end

    # File lib/rodauth/features/lockout.rb
266 def before_login_attempt
267   if locked_out?
268     show_lockout_page
269   end
270   super
271 end

    # File lib/rodauth/features/active_sessions.rb
168 def before_logout
169   if param_or_nil(global_logout_param)
170     remove_remember_key(session_value) if respond_to?(:remove_remember_key)
171     remove_all_active_sessions
172   else
173     remove_current_session
174   end
175   super
176 end

    # File lib/rodauth/features/active_sessions.rb
178 def before_otp_setup
179   @clear_active_sessions_after_two_factor_setup = !two_factor_authentication_setup?
180   super if defined?(super)
181 end

    # File lib/rodauth/features/json.rb
178 def before_otp_setup_route
179   super if defined?(super)
180   if use_json? && otp_keys_use_hmac? && !param_or_nil(otp_setup_raw_param)
181     _otp_tmp_key(otp_new_secret)
182     json_response[otp_setup_param] = otp_user_key
183     json_response[otp_setup_raw_param] = otp_key
184   end
185 end

   # File lib/rodauth/features/account_expiration.rb
79 def before_reset_password
80   check_account_expiration
81   super if defined?(super)
82 end

   # File lib/rodauth/features/account_expiration.rb
84 def before_reset_password_request
85   check_account_expiration
86   super if defined?(super)
87 end

    # File lib/rodauth/features/json.rb
187 def before_rodauth
188   if json_request?
189     if json_check_accept? && (accept = request.env['HTTP_ACCEPT']) && accept !~ json_accept_regexp
190       response.status = 406
191       json_response[json_response_error_key] = json_not_accepted_error_message
192       _return_json_response
193     end
194 
195     unless request.post?
196       response.status = 405
197       set_response_header('allow', 'POST')
198       json_response[json_response_error_key] = json_non_post_error_message
199       return_json_response
200     end
201   elsif only_json?
202     response.status = json_response_error_status
203     return_response non_json_request_error_message
204   end
205 
206   super
207 end

    # File lib/rodauth/features/active_sessions.rb
183 def before_sms_confirm
184   @clear_active_sessions_after_two_factor_setup = !two_factor_authentication_setup?
185   super if defined?(super)
186 end

    # File lib/rodauth/features/json.rb
124 def before_two_factor_auth_route
125   super if defined?(super)
126   if use_json?
127     json_response[:auth_links] = two_factor_auth_links.sort.map{|_,link| link}
128     json_response[json_response_success_key] ||= "" if include_success_messages?
129     return_json_response
130   end
131 end

    # File lib/rodauth/features/json.rb
114 def before_two_factor_manage_route
115   super if defined?(super)
116   if use_json?
117     json_response[:setup_links] = two_factor_setup_links.sort.map{|_,link| link}
118     json_response[:remove_links] = two_factor_remove_links.sort.map{|_,link| link}
119     json_response[json_response_success_key] ||= "" if include_success_messages?
120     return_json_response
121   end
122 end

   # File lib/rodauth/features/account_expiration.rb
89 def before_unlock_account
90   check_account_expiration
91   super if defined?(super)
92 end

   # File lib/rodauth/features/account_expiration.rb
94 def before_unlock_account_request
95   check_account_expiration
96   super if defined?(super)
97 end

   # File lib/rodauth/features/webauthn_verify_account.rb
32 def before_verify_account
33   super
34   if features.include?(:json) && use_json? && !param_or_nil(webauthn_setup_param)
35     cred = new_webauthn_credential
36     json_response[webauthn_setup_param] = cred.as_json
37     json_response[webauthn_setup_challenge_param] = cred.challenge
38     json_response[webauthn_setup_challenge_hmac_param] = compute_hmac(cred.challenge)
39   end
40   @webauthn_credential = webauthn_setup_credential_from_form_submission
41   add_webauthn_credential(@webauthn_credential)
42 end

   # File lib/rodauth/features/disallow_password_reuse.rb
84 def before_verify_account_route
85   super if defined?(super)
86   @dont_check_previous_password = true
87 end

    # File lib/rodauth/features/json.rb
133 def before_view_recovery_codes
134   super if defined?(super)
135   if use_json?
136     json_response[:codes] = recovery_codes
137     json_response[json_response_success_key] ||= "" if include_success_messages?
138   end
139 end

    # File lib/rodauth/features/json.rb
151 def before_webauthn_auth_route
152   super if defined?(super)
153   if use_json? && !param_or_nil(webauthn_auth_param)
154     cred = webauthn_credential_options_for_get
155     json_response[webauthn_auth_param] = cred.as_json
156     json_response[webauthn_auth_challenge_param] = cred.challenge
157     json_response[webauthn_auth_challenge_hmac_param] = compute_hmac(cred.challenge)
158   end
159 end

    # File lib/rodauth/features/json.rb
161 def before_webauthn_login_route
162   super if defined?(super)
163   if use_json? && !param_or_nil(webauthn_auth_param) && webauthn_login_options?
164     cred = webauthn_credential_options_for_get
165     json_response[webauthn_auth_param] = cred.as_json
166     json_response[webauthn_auth_challenge_param] = cred.challenge
167     json_response[webauthn_auth_challenge_hmac_param] = compute_hmac(cred.challenge)
168   end
169 end

    # File lib/rodauth/features/json.rb
171 def before_webauthn_remove_route
172   super if defined?(super)
173   if use_json? && !param_or_nil(webauthn_remove_param)
174     json_response[webauthn_remove_param] = account_webauthn_usage
175   end
176 end

    # File lib/rodauth/features/active_sessions.rb
188 def before_webauthn_setup
189   @clear_active_sessions_after_two_factor_setup = !two_factor_authentication_setup?
190   super if defined?(super)
191 end

    # File lib/rodauth/features/json.rb
141 def before_webauthn_setup_route
142   super if defined?(super)
143   if use_json? && !param_or_nil(webauthn_setup_param)
144     cred = new_webauthn_credential
145     json_response[webauthn_setup_param] = cred.as_json
146     json_response[webauthn_setup_challenge_param] = cred.challenge
147     json_response[webauthn_setup_challenge_hmac_param] = compute_hmac(cred.challenge)
148   end
149 end

    # File lib/rodauth/features/base.rb
461 def button(value, opts=OPTS)
462   scope.render(button_opts(value, opts))
463 end

    # File lib/rodauth/features/base.rb
656 def button_fixed_locals
657   '(value:, opts:)'
658 end

    # File lib/rodauth/features/base.rb
452 def button_opts(value, opts)
453   opts = Hash[template_opts].merge!(opts)
454   _merge_fixed_locals_opts(opts, button_fixed_locals)
455   opts[:locals] = {:value=>value, :opts=>opts}
456   opts[:cache] = cache_templates
457   opts[:cache_key] = :rodauth_button
458   _template_opts(opts, 'button')
459 end

    # File lib/rodauth/features/recovery_codes.rb
178 def can_add_recovery_codes?
179   recovery_codes.length < recovery_codes_limit
180 end

    # File lib/rodauth/features/base.rb
779 def catch_error(&block)
780   catch(:rodauth_error, &block)
781 end

   # File lib/rodauth/features/change_login.rb
68 def change_login(login)
69   if account_ds.get(login_column).downcase == login.downcase
70     set_login_requirement_error_message(:same_as_current_login, same_as_current_login_message)
71     return false
72   end
73 
74   update_login(login)
75 end

    # File lib/rodauth/features/verify_login_change.rb
142 def change_login_notice_flash
143   change_login_needs_verification_notice_flash
144 end

   # File lib/rodauth/features/change_login.rb
64 def change_login_requires_password?
65   modifications_require_password?
66 end

   # File lib/rodauth/features/change_password.rb
78 def change_password_requires_password?
79   modifications_require_password?
80 end

   # File lib/rodauth/features/account_expiration.rb
63 def check_account_expiration
64   if account_expired?
65     set_expired unless account_expired_at
66     set_redirect_error_flash account_expiration_error_flash
67     redirect account_expiration_redirect
68   end
69   update_last_login
70 end

   # File lib/rodauth/features/active_sessions.rb
56 def check_active_session
57   if logged_in? && !currently_active_session?
58     no_longer_active_session
59   end
60 end

    # File lib/rodauth/features/base.rb
345 def check_already_logged_in
346   # RODAUTH3: Move to login feature
347   already_logged_in if logged_in?
348 end

    # File lib/rodauth/features/base.rb
436 def check_csrf
437   scope.check_csrf!(check_csrf_opts, &check_csrf_block)
438 end

    # File lib/rodauth/features/base.rb
841 def check_csrf?
842   scope.opts[:rodauth_route_csrf]
843 end

   # File lib/rodauth/features/password_expiration.rb
30 def check_password_change_allowed
31   if password_changed_at = get_password_changed_at
32     if password_changed_at > Time.now - allow_password_change_after
33       set_redirect_error_flash password_not_changeable_yet_error_flash
34       redirect password_not_changeable_yet_redirect
35     end
36   end
37 end

   # File lib/rodauth/features/session_expiration.rb
15 def check_session_expiration
16   return unless logged_in?
17 
18   unless session.has_key?(session_last_activity_session_key) && session.has_key?(session_created_session_key)
19     if session_expiration_default
20       expire_session
21     end
22 
23     return
24   end
25 
26   time = Time.now.to_i
27 
28   if session[session_last_activity_session_key] + session_inactivity_timeout < time
29     expire_session
30   end
31   set_session_value(session_last_activity_session_key, time)
32 
33   if session[session_created_session_key] + max_session_lifetime < time
34     expire_session
35   end
36 end

   # File lib/rodauth/features/single_session.rb
56 def check_single_session
57   if logged_in? && !currently_active_session?
58     no_longer_active_session
59   end
60 end

    # File lib/rodauth/features/otp.rb
381 def clear_cached_otp
382   @otp = nil
383 end

    # File lib/rodauth/features/lockout.rb
171 def clear_invalid_login_attempts
172   unlock_account
173 end

    # File lib/rodauth/features/base.rb
363 def clear_session
364   if use_scope_clear_session?
365     scope.clear_session
366   else
367     session.clear
368   end
369 end

    # File lib/rodauth/features/active_sessions.rb
130 def clear_tokens(reason)
131   super
132   remove_all_active_sessions_except_current
133 end

   # File lib/rodauth/features/close_account.rb
67 def close_account
68   unless skip_status_checks?
69     update_account(account_status_column=>account_closed_status_value)
70   end
71 
72   unless account_password_hash_column
73     password_hash_ds.delete
74   end
75 end

   # File lib/rodauth/features/close_account.rb
63 def close_account_requires_password?
64   modifications_require_password?
65 end

    # File lib/rodauth/features/base.rb
286 def compute_hmac(data)
287   _process_raw_hmac(compute_raw_hmac(data))
288 end

    # File lib/rodauth/features/base.rb
297 def compute_hmacs(data)
298   hmacs = [compute_hmac(data)]
299 
300   if hmac_old_secret
301     hmacs << compute_old_hmac(data)
302   end
303 
304   hmacs
305 end

    # File lib/rodauth/features/base.rb
291 def compute_old_hmac(data)
292   _process_raw_hmac(compute_raw_hmac_with_secret(data, hmac_old_secret))
293 end

    # File lib/rodauth/features/base.rb
900 def compute_raw_hmac(data)
901   raise ConfigurationError, "hmac_secret not set" unless hmac_secret
902   compute_raw_hmac_with_secret(data, hmac_secret)
903 end