module Rodauth

    # File lib/rodauth/features/email_auth.rb
251 def _account_from_email_auth_key(token)
252   account_from_key(token, account_open_status_value){|id| get_email_auth_key(id)}
253 end

    # File lib/rodauth/features/base.rb
498 def _account_from_login(login)
499   ds = db[accounts_table].where(login_column=>login)
500   ds = ds.select(*account_select) if account_select
501   ds = ds.where(account_status_column=>[account_unverified_status_value, account_open_status_value]) unless skip_status_checks?
502   ds.first
503 end

    # File lib/rodauth/features/reset_password.rb
265 def _account_from_reset_password_key(token)
266   account_from_key(token, account_open_status_value){|id| get_password_reset_key(id)}
267 end

    # File lib/rodauth/features/base.rb
505 def _account_from_session
506   ds = account_ds(session_value)
507   ds = ds.where(account_session_status_filter) unless skip_status_checks?
508   ds.first
509 end

    # File lib/rodauth/features/lockout.rb
306 def _account_from_unlock_key(token)
307   account_from_key(token){|id| account_lockouts_ds(id).get(account_lockouts_key_column)}
308 end

    # File lib/rodauth/features/verify_account.rb
314 def _account_from_verify_account_key(token)
315   account_from_key(token, account_unverified_status_value){|id| get_verify_account_key(id)}
316 end

    # File lib/rodauth/features/verify_login_change.rb
206 def _account_from_verify_login_change_key(token)
207   account_from_key(token) do |id|
208     @verify_login_change_new_login, key = get_verify_login_change_login_and_key(id)
209     key
210   end
211 end

    # File lib/rodauth/features/email_auth.rb
189 def _email_auth_request
190   if email_auth_email_recently_sent?
191     set_redirect_error_flash email_auth_email_recently_sent_error_flash
192     redirect email_auth_email_recently_sent_redirect
193   end
194 
195   generate_email_auth_key_value
196   transaction do
197     before_email_auth_request
198     create_email_auth_key
199     send_email_auth_email
200     after_email_auth_request
201   end
202 
203   set_notice_flash email_auth_email_sent_notice_flash
204 end

    # File lib/rodauth/features/base.rb
515 def _field_attributes(field)
516   nil
517 end

    # File lib/rodauth/features/base.rb
519 def _field_error_attributes(field)
520   " aria-invalid=\"true\" aria-describedby=\"#{field}_error_message\" "
521 end

    # File lib/rodauth/features/base.rb
523 def _formatted_field_error(field, error)
524   "<span class=\"#{input_field_error_message_class}\" id=\"#{field}_error_message\">#{error}</span>"
525 end

    # File lib/rodauth/features/jwt.rb
217 def _json_response_body(hash)
218   request.send(:convert_to_json, hash)
219 end

   # File lib/rodauth/features/login.rb
86 def _login
87   transaction do
88     before_login
89     update_session
90     after_login
91   end
92   set_notice_flash login_notice_flash
93   redirect login_redirect
94 end

    # File lib/rodauth/features/create_account.rb
124 def _new_account(login)
125   acc = {login_column=>login}
126   unless skip_status_checks?
127     acc[account_status_column] = account_initial_status_value
128   end
129   acc
130 end

    # File lib/rodauth/features/otp.rb
406 def _otp
407   otp_class.new(otp_user_key, :issuer=>otp_issuer, :digits=>otp_digits, :interval=>otp_interval)
408 end

    # File lib/rodauth/features/otp.rb
395 def _otp_add_key(secret)
396   # Uniqueness errors can't be handled here, as we can't be sure the secret provided
397   # is the same as the current secret.
398   otp_key_ds.insert(otp_keys_id_column=>session_value, otp_keys_column=>secret)
399 end

    # File lib/rodauth/features/otp.rb
401 def _otp_key
402   @otp_user_key = nil
403   otp_key_ds.get(otp_keys_column)
404 end

    # File lib/rodauth/features/otp.rb
390 def _otp_tmp_key(secret)
391   @otp_user_key = nil
392   @otp_key = secret
393 end

    # File lib/rodauth/features/recovery_codes.rb
234 def _recovery_codes
235   recovery_codes_ds.select_map(recovery_codes_column)
236 end

    # File lib/rodauth/features/sms_codes.rb
497 def _sms
498   sms_ds.first
499 end

    # File lib/rodauth/features/two_factor_base.rb
145 def _two_factor_auth_required_redirect
146   two_factor_auth_required_redirect || two_factor_auth_fallback_redirect || default_redirect
147 end

   # File lib/rodauth/features/change_login.rb
80 def _update_login(login)
81   updated = nil
82   raised = raises_uniqueness_violation?{updated = update_account({login_column=>login}, account_ds.exclude(login_column=>login)) == 1}
83   if raised
84     @login_requirement_message = already_an_account_with_this_login_message
85   end
86   updated && !raised
87 end

    # File lib/rodauth/features/base.rb
639 def _view(meth, page)
640   scope.send(meth, _view_opts(page))
641 end

    # File lib/rodauth/features/base.rb
624 def _view_opts(page)
625   opts = template_opts.dup
626   opts[:locals] = opts[:locals] ? opts[:locals].dup : {}
627   opts[:locals][:rodauth] = self
628   opts[:cache] = cache_templates
629   opts[:cache_key] = :"rodauth_#{page}"
630 
631   opts = scope.send(:find_template, scope.send(:parse_template_opts, page, opts))
632   unless File.file?(scope.send(:template_path, opts))
633     opts[:path] = template_path(page)
634   end
635 
636   opts
637 end

    # File lib/rodauth/features/account_expiration.rb
104 def account_activity_ds(account_id)
105   db[account_activity_table].
106     where(account_activity_id_column=>account_id)
107 end

    # File lib/rodauth/features/base.rb
535 def account_ds(id=account_id)
536   raise ArgumentError, "invalid account id passed to account_ds" unless id
537   ds = db[accounts_table].where(account_id_column=>id)
538   ds = ds.select(*account_select) if account_select
539   ds
540 end

   # File lib/rodauth/features/account_expiration.rb
54 def account_expired?
55   columns = [account_activity_last_activity_column, account_activity_last_login_column, account_activity_expired_column]
56   last_activity, last_login, expired = account_activity_ds(account_id).get(columns)
57   return true if expired
58   timestamp = convert_timestamp(expire_account_on_last_activity? ? last_activity : last_login)
59   return false unless timestamp
60   timestamp < Time.now - expire_account_after
61 end

   # File lib/rodauth/features/account_expiration.rb
35 def account_expired_at
36   get_activity_timestamp(account_id, account_activity_expired_column)
37 end

    # File lib/rodauth/features/email_auth.rb
133 def account_from_email_auth_key(key)
134   @account = _account_from_email_auth_key(key)
135 end

   # File lib/rodauth/features/email_base.rb
56 def account_from_key(token, status_id=nil)
57   id, key = split_token(token)
58   return unless id && key
59 
60   return unless actual = yield(id)
61 
62   unless timing_safe_eql?(key, convert_email_token_key(actual))
63     if hmac_secret && allow_raw_email_token?
64       return unless timing_safe_eql?(key, actual)
65     else
66       return
67     end
68   end
69 
70   ds = account_ds(id)
71   ds = ds.where(account_status_column=>status_id) if status_id && !skip_status_checks?
72   ds.first
73 end

    # File lib/rodauth/features/base.rb
213 def account_from_login(login)
214   @account = _account_from_login(login)
215 end

   # File lib/rodauth/features/password_expiration.rb
45 def account_from_reset_password_key(key)
46   if a = super
47     check_password_change_allowed
48   end
49   a
50 end

    # File lib/rodauth/features/base.rb
292 def account_from_session
293   @account = _account_from_session
294 end

    # File lib/rodauth/features/lockout.rb
215 def account_from_unlock_key(key)
216   @account = _account_from_unlock_key(key)
217 end

    # File lib/rodauth/features/verify_account.rb
195 def account_from_verify_account_key(key)
196   @account = _account_from_verify_account_key(key)
197 end

    # File lib/rodauth/features/verify_login_change.rb
116 def account_from_verify_login_change_key(key)
117   @account = _account_from_verify_login_change_key(key)
118 end

    # File lib/rodauth/features/base.rb
203 def account_id
204   account[account_id_column]
205 end

   # File lib/rodauth/features/verify_account_grace_period.rb
66 def account_in_unverified_grace_period?
67   account[account_status_column] == account_unverified_status_value &&
68     verify_account_grace_period &&
69     !verify_account_ds.where(Sequel.date_add(verification_requested_at_column, :seconds=>verify_account_grace_period) > Sequel::CURRENT_TIMESTAMP).empty?
70 end

    # File lib/rodauth/features/base.rb
288 def account_initial_status_value
289   account_open_status_value
290 end

    # File lib/rodauth/features/lockout.rb
302 def account_lockouts_ds(id=account_id)
303   db[account_lockouts_table].where(account_lockouts_id_column=>id)
304 end

    # File lib/rodauth/features/lockout.rb
298 def account_login_failures_ds
299   db[account_login_failures_table].where(account_login_failures_id_column=>account_id)
300 end

    # File lib/rodauth/features/base.rb
106 def account_model(model)
107   warn "account_model is deprecated, use db and accounts_table settings"
108   db model.db
109   accounts_table model.table_name
110   account_select model.dataset.opts[:select]
111 end

    # File lib/rodauth/features/base.rb
228 def account_password_hash_column
229   nil
230 end

    # File lib/rodauth/features/base.rb
527 def account_session_status_filter
528   {account_status_column=>account_open_status_value}
529 end

    # File lib/rodauth/features/remember.rb
216 def active_remember_key_ds(id=account_id)
217   remember_key_ds(id).where(Sequel.expr(remember_deadline_column) > Sequel::CURRENT_TIMESTAMP)
218 end

    # File lib/rodauth/features/base.rb
158 def add_field_error_class(field)
159   if field_error(field)
160     " #{input_field_error_class}"
161   end
162 end

   # File lib/rodauth/features/disallow_password_reuse.rb
25 def add_previous_password_hash(hash) 
26   ds = previous_password_ds
27   keep_before = ds.reverse(previous_password_id_column).
28     limit(nil, previous_passwords_to_check).
29     get(previous_password_id_column)
30 
31   if keep_before
32     ds.where(Sequel.expr(previous_password_id_column) <= keep_before).
33       delete
34   end
35 
36   # This should never raise uniqueness violations, as it uses a serial primary key
37   ds.insert(previous_password_account_id_column=>account_id, previous_password_hash_column=>hash)
38 end

    # File lib/rodauth/features/recovery_codes.rb
215 def add_recovery_code
216   # This should never raise uniqueness violations unless the recovery code is the same, and the odds of that
217   # are 1/256**32 assuming a good random number generator.  Still, attempt to handle that case by retrying
218   # on such a uniqueness violation.
219   retry_on_uniqueness_violation do
220     recovery_codes_ds.insert(recovery_codes_id_column=>session_value, recovery_codes_column=>new_recovery_code)
221   end
222 end

    # File lib/rodauth/features/recovery_codes.rb
205 def add_recovery_codes(number)
206   return if number <= 0
207   transaction do
208     number.times do
209       add_recovery_code
210     end
211   end
212   remove_instance_variable(:@recovery_codes)
213 end

    # File lib/rodauth/features/remember.rb
162 def add_remember_key
163   hash = {remember_id_column=>account_id, remember_key_column=>remember_key_value}
164   set_deadline_value(hash, remember_deadline_column, remember_deadline_interval)
165 
166   if e = raised_uniqueness_violation{remember_key_ds.insert(hash)}
167     # If inserting into the remember key table causes a violation, we can pull the
168     # existing row from the table.  If there is no invalid row, we can then reraise.
169     raise e unless @remember_key_value = active_remember_key_ds.get(remember_key_column)
170   end
171 end

   # File lib/rodauth/features/verify_change_login.rb
13 def after_change_login
14   super
15   update_account(account_status_column=>account_unverified_status_value)
16   setup_account_verification
17   session[unverified_account_session_key] = true
18 end

   # File lib/rodauth/features/change_password_notify.rb
31 def after_change_password
32   super
33   send_password_changed_email
34 end

   # File lib/rodauth/features/account_expiration.rb
94 def after_close_account
95   super if defined?(super)
96   account_activity_ds(account_id).delete
97 end

    # File lib/rodauth/features/remember.rb
197 def after_confirm_password
198   super
199   clear_remembered_session_key
200 end

   # File lib/rodauth/features/disallow_password_reuse.rb
72 def after_create_account
73   if account_password_hash_column && !(respond_to?(:verify_account_set_password?) && verify_account_set_password?)
74     add_previous_password_hash(password_hash(param(password_param)))
75   end
76   super if defined?(super)
77 end

    # File lib/rodauth/features/email_auth.rb
208 def after_login
209   # Remove the email auth key after any login, even if
210   # it is a password login.  This is done to invalidate
211   # the email login when a user has a password and requests
212   # email authentication, but then remembers their password
213   # and doesn't need the link.  At that point, the link
214   # that allows login access to the account becomes a
215   # security liability, and it is best to remove it.
216   remove_email_auth_key
217   super if defined?(super)
218 end

    # File lib/rodauth/features/email_auth.rb
161 def after_login_entered_during_multi_phase_login
162   if force_email_auth?
163     # If the account does not have a password hash, just send the
164     # email link.
165     _email_auth_request
166     redirect email_auth_email_sent_redirect
167   else
168     # If the account has a password hash, allow password login, but
169     # show form below to also login via email link.
170     super
171     @email_auth_request_form = email_auth_request_form
172   end
173 end

    # File lib/rodauth/features/lockout.rb
256 def after_login_failure
257   invalid_login_attempted
258   super
259 end

    # File lib/rodauth/features/remember.rb
187 def after_logout
188   forget_login
189   super if defined?(super)
190 end

   # File lib/rodauth/features/password_grace_period.rb
27 def after_reset_password
28   super if defined?(super)
29   @last_password_entry = Time.now.to_i
30 end

    # File lib/rodauth/features/verify_account.rb
161 def allow_resending_verify_account_email?
162   account[account_status_column] == account_unverified_status_value
163 end

    # File lib/rodauth/features/base.rb
236 def already_logged_in
237   nil
238 end

    # File lib/rodauth/features/base.rb
102 def auth_class_eval(&block)
103   auth.class_eval(&block)
104 end

    # File lib/rodauth/features/base.rb
280 def authenticated?
281   logged_in?
282 end

    # File lib/rodauth/features/otp.rb
378 def base32_encode(data, length)
379   chars = 'abcdefghijklmnopqrstuvwxyz234567'
380   length.times.map{|i|chars[data[i] % 32].chr}.join
381 end

   # File lib/rodauth/features/verify_account_grace_period.rb
36 def before_change_login_route
37   unless verified_account?
38     set_redirect_error_flash unverified_change_login_error_flash
39     redirect unverified_change_login_redirect
40   end
41   super if defined?(super)
42 end

   # File lib/rodauth/features/password_expiration.rb
90 def before_change_password_route
91   check_password_change_allowed
92   super
93 end

    # File lib/rodauth/features/lockout.rb
244 def before_login_attempt
245   if locked_out?
246     show_lockout_page
247   end
248   super
249 end

   # File lib/rodauth/features/single_session.rb
80 def before_logout
81   reset_single_session_key if request.post?
82   super if defined?(super)
83 end

   # File lib/rodauth/features/otp.rb
23 def before_otp_authentication_route(&block)
24   warn "before_otp_authentication_route is deprecated, switch to before_otp_auth_route"
25   before_otp_auth_route(&block)
26 end

    # File lib/rodauth/features/jwt.rb
176 def before_otp_setup_route
177   super if defined?(super)
178   if use_jwt? && otp_keys_use_hmac? && !param_or_nil(otp_setup_raw_param)
179     _otp_tmp_key(otp_new_secret)
180     json_response[otp_setup_param] = otp_user_key
181     json_response[otp_setup_raw_param] = otp_key
182   end
183 end

   # File lib/rodauth/features/account_expiration.rb
74 def before_reset_password
75   check_account_expiration
76   super if defined?(super)
77 end

   # File lib/rodauth/features/account_expiration.rb
79 def before_reset_password_request
80   check_account_expiration
81   super if defined?(super)
82 end

    # File lib/rodauth/features/jwt.rb
143 def before_rodauth
144   if json_request?
145     if jwt_check_accept? && (accept = request.env['HTTP_ACCEPT']) && accept !~ json_accept_regexp
146       response.status = 406
147       json_response[json_response_error_key] = json_not_accepted_error_message
148       response['Content-Type'] ||= json_response_content_type
149       response.write(request.send(:convert_to_json, json_response))
150       request.halt
151     end
152 
153     unless request.post?
154       response.status = 405
155       response.headers['Allow'] = 'POST'
156       json_response[json_response_error_key] = json_non_post_error_message
157       return_json_response
158     end
159   elsif only_json?
160     response.status = json_response_error_status
161     response.write non_json_request_error_message
162     request.halt
163   end
164 
165   super
166 end

   # File lib/rodauth/features/account_expiration.rb
84 def before_unlock_account
85   check_account_expiration
86   super if defined?(super)
87 end

   # File lib/rodauth/features/account_expiration.rb
89 def before_unlock_account_request
90   check_account_expiration
91   super if defined?(super)
92 end

    # File lib/rodauth/features/jwt.rb
168 def before_view_recovery_codes
169   super if defined?(super)
170   if use_jwt?
171     json_response[:codes] = recovery_codes
172     json_response[json_response_success_key] ||= "" if include_success_messages?
173   end
174 end

    # File lib/rodauth/features/base.rb
317 def button(value, opts={})
318   scope.render(button_opts(value, opts))
319 end

    # File lib/rodauth/features/base.rb
308 def button_opts(value, opts)
309   opts = Hash[template_opts].merge!(opts)
310   opts[:locals] = {:value=>value, :opts=>opts}
311   opts[:path] = template_path('button')
312   opts[:cache] = cache_templates
313   opts[:cache_key] = :rodauth_button
314   opts
315 end

    # File lib/rodauth/features/recovery_codes.rb
201 def can_add_recovery_codes?
202   recovery_codes.length < recovery_codes_limit
203 end

    # File lib/rodauth/features/base.rb
429 def catch_error(&block)
430   catch(:rodauth_error, &block)
431 end

   # File lib/rodauth/features/change_login.rb
65 def change_login(login)
66   if account_ds.get(login_column).downcase == login.downcase
67     @login_requirement_message = 'same as current login'
68     return false
69   end
70 
71   update_login(login)
72 end

  # File lib/rodauth/features/verify_change_login.rb
7 def change_login_notice_flash
8   "#{super}. #{verify_account_email_sent_notice_flash}"
9 end

   # File lib/rodauth/features/change_login.rb
61 def change_login_requires_password?
62   modifications_require_password?
63 end

   # File lib/rodauth/features/change_password.rb
66 def change_password_requires_password?
67   modifications_require_password?
68 end

   # File lib/rodauth/features/account_expiration.rb
63 def check_account_expiration
64   if account_expired?
65     set_expired unless account_expired_at
66     set_redirect_error_flash account_expiration_error_flash
67     redirect account_expiration_redirect
68   end
69   update_last_login
70 end

    # File lib/rodauth/features/base.rb
232 def check_already_logged_in
233   already_logged_in if logged_in?
234 end

   # File lib/rodauth/features/password_expiration.rb
30 def check_password_change_allowed
31   if password_changed_at = get_password_changed_at
32     if password_changed_at > Time.now - allow_password_change_after
33       set_redirect_error_flash password_not_changeable_yet_error_flash
34       redirect password_not_changeable_yet_redirect
35     end
36   end
37 end

   # File lib/rodauth/features/session_expiration.rb
15 def check_session_expiration
16   return unless logged_in?
17 
18   unless session.has_key?(session_last_activity_session_key) && session.has_key?(session_created_session_key)
19     if session_expiration_default
20       expire_session
21     end
22 
23     return
24   end
25 
26   time = Time.now.to_i
27 
28   if session[session_last_activity_session_key] + session_inactivity_timeout < time
29     expire_session
30   end
31   set_session_value(session_last_activity_session_key, time)
32 
33   if session[session_created_session_key] + max_session_lifetime < time
34     expire_session
35   end
36 end

   # File lib/rodauth/features/single_session.rb
50 def check_single_session
51   if logged_in? && !currently_active_session?
52     no_longer_active_session
53   end
54 end

    # File lib/rodauth/features/otp.rb
342 def clear_cached_otp
343   remove_instance_variable(:@otp) if defined?(@otp)
344 end

    # File lib/rodauth/features/lockout.rb
165 def clear_invalid_login_attempts
166   unlock_account
167 end

    # File lib/rodauth/features/remember.rb
177 def clear_remembered_session_key
178   session.delete(remembered_session_key)
179 end

    # File lib/rodauth/features/base.rb
240 def clear_session
241   if scope.respond_to?(:clear_session)
242     scope.clear_session
243   else
244     session.clear
245   end
246 end

   # File lib/rodauth/features/close_account.rb
62 def close_account
63   unless skip_status_checks?
64     update_account(account_status_column=>account_closed_status_value)
65   end
66 
67   unless account_password_hash_column
68     password_hash_ds.delete
69   end
70 end

   # File lib/rodauth/features/close_account.rb
58 def close_account_requires_password?
59   modifications_require_password?
60 end

    # File lib/rodauth/features/base.rb
197 def compute_hmac(data)
198   s = [compute_raw_hmac(data)].pack('m').chomp!("=\n")
199   s.tr!('+/', '-_')
200   s
201 end

    # File lib/rodauth/features/base.rb
511 def compute_raw_hmac(data)
512   OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, hmac_secret, data)
513 end

   # File lib/rodauth/features/confirm_password.rb
45 def confirm_password
46   nil
47 end

   # File lib/rodauth/features/confirm_password.rb
49 def confirm_password_redirect
50   session.delete(confirm_password_redirect_session_key) || default_redirect
51 end

   # File lib/rodauth/features/email_base.rb
52 def convert_email_token_key(key)
53   convert_token_key(key)
54 end

    # File lib/rodauth/features/base.rb
408 def convert_session_key(key)
409   scope.opts[:sessions_convert_symbols] ? key.to_s : key
410 end

    # File lib/rodauth/features/base.rb
547 def convert_timestamp(timestamp)
548   timestamp = db.to_application_timestamp(timestamp) if timestamp.is_a?(String)
549   timestamp
550 end

    # File lib/rodauth/features/base.rb
374 def convert_token_key(key)
375   if key && hmac_secret
376     compute_hmac(key)
377   else
378     key
379   end
380 end

    # File lib/rodauth/features/verify_account.rb
219 def create_account_autologin?
220   false
221 end

   # File lib/rodauth/features/create_account.rb
91 def create_account_link
92   "<p><a href=\"#{prefix}/#{create_account_route}\">Create a New Account</a></p>"
93 end

    # File lib/rodauth/features/verify_account.rb
181 def create_account_notice_flash
182   verify_account_email_sent_notice_flash
183 end

    # File lib/rodauth/features/verify_account.rb
231 def create_account_set_password?
232   return false if verify_account_set_password?
233   super
234 end

   # File lib/rodauth/features/email_base.rb
27 def create_email(subject, body)
28   create_email_to(email_to, subject, body)
29 end

    # File lib/rodauth/features/email_auth.rb
229 def create_email_auth_email
230   create_email(email_auth_email_subject, email_auth_email_body)
231 end

    # File lib/rodauth/features/email_auth.rb
104 def create_email_auth_key
105   transaction do
106     if email_auth_key_value = get_email_auth_key(account_id)
107       set_email_auth_email_last_sent
108       @email_auth_key_value = email_auth_key_value
109     elsif e = raised_uniqueness_violation{email_auth_ds.insert(email_auth_key_insert_hash)}
110       # If inserting into the email auth table causes a violation, we can pull the
111       # existing email auth key from the table, or reraise.
112       raise e unless @email_auth_key_value = get_email_auth_key(account_id)
113     end
114   end
115 end

   # File lib/rodauth/features/email_base.rb
31 def create_email_to(to, subject, body)
32   m = Mail.new
33   m.from = email_from
34   m.to = to
35   m.subject = "#{email_subject_prefix}#{subject}"
36   m.body = body
37   m
38 end

   # File lib/rodauth/features/change_password_notify.rb
23 def create_password_changed_email
24   create_email(password_changed_email_subject, password_changed_email_body)
25 end

    # File lib/rodauth/features/reset_password.rb
239 def create_reset_password_email
240   create_email(reset_password_email_subject, reset_password_email_body)
241 end

    # File lib/rodauth/features/reset_password.rb
160 def create_reset_password_key
161   transaction do
162     if reset_password_key_value = get_password_reset_key(account_id)
163       set_reset_password_email_last_sent
164       @reset_password_key_value = reset_password_key_value
165     elsif e = raised_uniqueness_violation{password_reset_ds.insert(reset_password_key_insert_hash)}
166       # If inserting into the reset password table causes a violation, we can pull the
167       # existing reset password key from the table, or reraise.
168       raise e unless @reset_password_key_value = get_password_reset_key(account_id)
169     end
170   end
171 end

    # File lib/rodauth/features/lockout.rb
282 def create_unlock_account_email
283   create_email(unlock_account_email_subject, unlock_account_email_body)
284 end

    # File lib/rodauth/features/verify_account.rb
302 def create_verify_account_email
303   create_email(verify_account_email_subject, verify_account_email_body)
304 end

    # File lib/rodauth/features/verify_account.rb
285 def create_verify_account_key
286   ds = verify_account_ds
287   transaction do
288     if ds.empty?
289       if e = raised_uniqueness_violation{ds.insert(verify_account_key_insert_hash)}
290         # If inserting into the verify account table causes a violation, we can pull the
291         # key from the verify account table, or reraise.
292         raise e unless @verify_account_key_value = get_verify_account_key(account_id)
293       end
294     end
295   end
296 end

    # File lib/rodauth/features/verify_login_change.rb
194 def create_verify_login_change_email(login)
195   create_email_to(login, verify_login_change_email_subject, verify_login_change_email_body)
196 end

    # File lib/rodauth/features/verify_login_change.rb
172 def create_verify_login_change_key(login)
173   ds = verify_login_change_ds
174   transaction do
175     ds.where((Sequel::CURRENT_TIMESTAMP > verify_login_change_deadline_column) | ~Sequel.expr(verify_login_change_login_column=>login)).delete
176     if e = raised_uniqueness_violation{ds.insert(verify_login_change_key_insert_hash(login))}
177       old_login, key = get_verify_login_change_login_and_key(account_id)
178       # If inserting into the verify login change table causes a violation, we can pull the
179       # key from the verify login change table if the logins match, or reraise.
180       @verify_login_change_key_value = if old_login.downcase == login.downcase
181         key
182       end
183       raise e unless @verify_login_change_key_value
184     end
185   end
186 end

    # File lib/rodauth/features/base.rb
296 def csrf_tag(path=request.path)
297   return unless scope.respond_to?(:csrf_tag)
298 
299   if use_request_specific_csrf_tokens?
300     scope.csrf_tag(path)
301   else
302     # :nocov:
303     scope.csrf_tag
304     # :nocov:
305   end
306 end

   # File lib/rodauth/features/single_session.rb
27 def currently_active_session?
28   single_session_key = session[single_session_session_key]
29   current_key = single_session_ds.get(single_session_key_column)
30   if single_session_key.nil?
31     unless current_key
32       # No row exists for this user, indicating the feature has never
33       # been used, so it is OK to treat the current session as a new
34       # session.
35       update_single_session_key
36     end
37     true
38   elsif current_key
39     if hmac_secret
40       valid = timing_safe_eql?(single_session_key, compute_hmac(current_key))
41       if !valid && !allow_raw_single_session_key?
42         return false
43       end
44     end
45 
46     valid || timing_safe_eql?(single_session_key, current_key)
47   end
48 end

    # File lib/rodauth/features/base.rb
221 def db
222   Sequel::DATABASES.first
223 end

    # File lib/rodauth/features/base.rb
174 def default_field_attributes
175   if mark_input_fields_as_required?
176     "required=\"required\""
177   end
178 end

   # File lib/rodauth/features/close_account.rb
72 def delete_account
73   account_ds.delete
74 end

   # File lib/rodauth/features/close_account.rb
76 def delete_account_on_close?
77   skip_status_checks?
78 end

    # File lib/rodauth/features/remember.rb
158 def disable_remember_login
159   remove_remember_key
160 end

    # File lib/rodauth/features/email_auth.rb
247 def email_auth_ds(id=account_id)
248   db[email_auth_table].where(email_auth_id_column=>id)
249 end

    # File lib/rodauth/features/email_auth.rb
233 def email_auth_email_body
234   render('email-auth-email')
235 end

    # File lib/rodauth/features/email_auth.rb
141 def email_auth_email_link
142   token_link(email_auth_route, email_auth_key_param, email_auth_key_value)
143 end

    # File lib/rodauth/features/email_auth.rb
185 def email_auth_email_recently_sent?
186   (email_last_sent = get_email_auth_email_last_sent) && (Time.now - email_last_sent < email_auth_skip_resend_email_within)
187 end

    # File lib/rodauth/features/email_auth.rb
241 def email_auth_key_insert_hash
242   hash = {email_auth_id_column=>account_id, email_auth_key_column=>email_auth_key_value}
243   set_deadline_value(hash, email_auth_deadline_column, email_auth_deadline_interval)
244   hash
245 end

    # File lib/rodauth/features/email_auth.rb
157 def email_auth_request_form
158   render('email-auth-request-form')
159 end

   # File lib/rodauth/features/email_base.rb
40 def email_from
41   "webmaster@#{request.host}"
42 end

   # File lib/rodauth/features/email_base.rb
44 def email_to
45   account[login_column]
46 end

   # File lib/rodauth/features/session_expiration.rb
38 def expire_session
39   clear_session
40   set_redirect_error_flash session_expiration_error_flash
41   redirect session_expiration_redirect
42 end

    # File lib/rodauth/features/base.rb
121 def features
122   self.class.features
123 end

    # File lib/rodauth/features/base.rb
180 def field_attributes(field)
181   _field_attributes(field) || default_field_attributes
182 end

    # File lib/rodauth/features/base.rb
153 def field_error(field)
154   return nil unless @field_errors
155   @field_errors[field]
156 end

    # File lib/rodauth/features/base.rb
184 def field_error_attributes(field)
185   if field_error(field)
186     _field_error_attributes(field)
187   end
188 end

    # File lib/rodauth/features/base.rb
137 def flash
138   scope.flash
139 end

    # File lib/rodauth/features/email_auth.rb
179 def force_email_auth?
180   get_password_hash.nil?
181 end

    # File lib/rodauth/features/remember.rb
143 def forget_login
144   ::Rack::Utils.delete_cookie_header!(response.headers, remember_cookie_key, remember_cookie_options)
145 end

    # File lib/rodauth/features/base.rb
190 def formatted_field_error(field)
191   if error = field_error(field)
192     _formatted_field_error(field, error)
193   end
194 end

    # File lib/rodauth/features/base.rb
474 def function_name(name)
475   if db.database_type == :mssql
476     # :nocov:
477     "dbo.#{name}"
478     # :nocov:
479   else
480     name
481   end
482 end

    # File lib/rodauth/features/email_auth.rb
225 def generate_email_auth_key_value
226   @email_auth_key_value = random_key
227 end

    # File lib/rodauth/features/remember.rb
204 def generate_remember_key_value
205   @remember_key_value = random_key
206 end

    # File lib/rodauth/features/reset_password.rb
235 def generate_reset_password_key_value
236   @reset_password_key_value = random_key
237 end

    # File lib/rodauth/features/lockout.rb
266 def generate_unlock_account_key
267   random_key
268 end

    # File lib/rodauth/features/verify_account.rb
281 def generate_verify_account_key_value
282   @verify_account_key_value = random_key
283 end

    # File lib/rodauth/features/verify_login_change.rb
168 def generate_verify_login_change_key_value
169   @verify_login_change_key_value = random_key
170 end

    # File lib/rodauth/features/account_expiration.rb
109 def get_activity_timestamp(account_id, column)
110   convert_timestamp(account_activity_ds(account_id).get(column))
111 end

    # File lib/rodauth/features/email_auth.rb
121 def get_email_auth_email_last_sent
122   if column = email_auth_email_last_sent_column
123     if ts = email_auth_ds.get(column)
124       convert_timestamp(ts)
125     end
126   end
127 end

    # File lib/rodauth/features/email_auth.rb
145 def get_email_auth_key(id)
146   ds = email_auth_ds(id)
147   ds.where(Sequel::CURRENT_TIMESTAMP > email_auth_deadline_column).delete
148   ds.get(email_auth_key_column)
149 end

   # File lib/rodauth/features/password_expiration.rb
26 def get_password_changed_at
27   convert_timestamp(password_expiration_ds.get(password_expiration_changed_at_column))
28 end

    # File lib/rodauth/features/base.rb
486 def get_password_hash
487   if account_password_hash_column
488     account[account_password_hash_column]
489   elsif use_database_authentication_functions?
490     db.get(Sequel.function(function_name(:rodauth_get_salt), account_id))
491   else
492     # :nocov:
493     password_hash_ds.get(password_hash_column)
494     # :nocov:
495   end
496 end

    # File lib/rodauth/features/reset_password.rb
189 def get_password_reset_key(id)
190   ds = password_reset_ds(id)
191   ds.where(Sequel::CURRENT_TIMESTAMP > reset_password_deadline_column).delete
192   ds.get(reset_password_key_column)
193 end

    # File lib/rodauth/features/remember.rb
147 def get_remember_key
148   unless @remember_key_value = active_remember_key_ds.get(remember_key_column)
149    generate_remember_key_value
150    transaction do
151      remove_remember_key
152      add_remember_key
153    end
154   end
155   nil
156 end

    # File lib/rodauth/features/reset_password.rb
207 def get_reset_password_email_last_sent
208   if column = reset_password_email_last_sent_column
209     if ts = password_reset_ds.get(column)
210       convert_timestamp(ts)
211     end
212   end
213 end

    # File lib/rodauth/features/lockout.rb
228 def get_unlock_account_email_last_sent
229   if column = account_lockouts_email_last_sent_column
230     if ts = account_lockouts_ds.get(column)
231       convert_timestamp(ts)
232     end
233   end
234 end

    # File lib/rodauth/features/lockout.rb
211 def get_unlock_account_key
212   account_lockouts_ds.get(account_lockouts_key_column)
213 end

    # File lib/rodauth/features/verify_account.rb
240 def get_verify_account_email_last_sent
241   if column = verify_account_email_last_sent_column
242     if ts = verify_account_ds.get(column)
243       convert_timestamp(ts)
244     end
245   end
246 end

    # File lib/rodauth/features/verify_account.rb
211 def get_verify_account_key(id)
212   verify_account_ds(id).get(verify_account_key_column)
213 end

    # File lib/rodauth/features/verify_login_change.rb
128 def get_verify_login_change_login_and_key(id)
129   verify_login_change_ds(id).get([verify_login_change_login_column, verify_login_change_key_column])
130 end

    # File lib/rodauth/features/jwt.rb
197 def include_success_messages?
198   !json_response_success_key.nil?
199 end

    # File lib/rodauth/features/base.rb
164 def input_field_string(param, id, opts={})
165   type = opts.fetch(:type, "text")
166 
167   unless type == "password"
168     value = opts.fetch(:value){scope.h param(param)}
169   end
170 
171   "<input #{opts[:attr]} #{field_attributes(param)} #{field_error_attributes(param)} type=\"#{type}\" class=\"form-control#{add_field_error_class(param)}\" name=\"#{param}\" id=\"#{id}\" value=\"#{value}\"/> #{formatted_field_error(param)}"
172 end

    # File lib/rodauth/features/lockout.rb
169 def invalid_login_attempted
170   ds = account_login_failures_ds.
171       where(account_login_failures_id_column=>account_id)
172 
173   number = if db.database_type == :postgres
174     ds.returning(account_login_failures_number_column).
175       with_sql(:update_sql, account_login_failures_number_column=>Sequel.expr(account_login_failures_number_column)+1).
176       single_value
177   else
178     # :nocov:
179     if ds.update(account_login_failures_number_column=>Sequel.expr(account_login_failures_number_column)+1) > 0
180       ds.get(account_login_failures_number_column)
181     end
182     # :nocov:
183   end
184 
185   unless number
186     # Ignoring the violation is safe here.  It may allow slightly more than max_invalid_logins invalid logins before
187     # lockout, but allowing a few extra is OK if the race is lost.
188     ignore_uniqueness_violation{account_login_failures_ds.insert(account_login_failures_id_column=>account_id)}
189     number = 1
190   end
191 
192   if number >= max_invalid_logins
193     @unlock_account_key_value = generate_unlock_account_key
194     hash = {account_lockouts_id_column=>account_id, account_lockouts_key_column=>unlock_account_key_value}
195     set_deadline_value(hash, account_lockouts_deadline_column, account_lockouts_deadline_interval)
196 
197     if e = raised_uniqueness_violation{account_lockouts_ds.insert(hash)}
198       # If inserting into the lockout table raises a violation, we should just be able to pull the already inserted
199       # key out of it.  If that doesn't return a valid key, we should reraise the error.
200       raise e unless @unlock_account_key_value = account_lockouts_ds.get(account_lockouts_key_column)
201 
202       after_account_lockout
203       show_lockout_page
204     else
205       after_account_lockout
206       e
207     end
208   end
209 end

   # File lib/rodauth/features/change_password.rb
70 def invalid_previous_password_message
71   invalid_password_message
72 end

    # File lib/rodauth/features/jwt.rb
104 def json_request?
105   return @json_request if defined?(@json_request)
106   @json_request = request.content_type =~ json_request_content_type_regexp
107 end

    # File lib/rodauth/features/jwt.rb
207 def json_response
208   @json_response ||= {}
209 end

   # File lib/rodauth/features/jwt_cors.rb
15 def jwt_cors_allow?
16   if origin = request.env['HTTP_ORIGIN']
17     case allowed = jwt_cors_allow_origin
18     when String
19       timing_safe_eql?(origin, allowed)
20     when Array
21       allowed.any?{|s| timing_safe_eql?(origin, s)}
22     when Regexp
23       allowed =~ origin
24     when true
25       true
26     else
27       false
28     end
29   end
30 end

    # File lib/rodauth/features/jwt.rb
185 def jwt_payload
186   return @jwt_payload if defined?(@jwt_payload)
187   @jwt_payload = JWT.decode(jwt_token, jwt_secret, true, jwt_decode_opts.merge(:algorithm=>jwt_algorithm))[0]
188 rescue JWT::DecodeError
189   @jwt_payload = false
190 end

    # File lib/rodauth/features/jwt.rb
109 def jwt_secret
110   raise ArgumentError, "jwt_secret not set"
111 end

    # File lib/rodauth/features/jwt.rb
113 def jwt_session_hash
114   jwt_session_key ? {jwt_session_key=>session} : session
115 end

    # File lib/rodauth/features/jwt.rb
121 def jwt_token
122   return @jwt_token if defined?(@jwt_token)
123 
124   if (v = request.env['HTTP_AUTHORIZATION']) && v !~ jwt_authorization_ignore
125     @jwt_token = v.sub(jwt_authorization_remove, '')
126   end
127 end

   # File lib/rodauth/features/account_expiration.rb
27 def last_account_activity_at
28   get_activity_timestamp(session_value, account_activity_last_activity_column)
29 end

   # File lib/rodauth/features/account_expiration.rb
31 def last_account_login_at
32   get_activity_timestamp(session_value, account_activity_last_login_column)
33 end

    # File lib/rodauth/features/remember.rb
 86 def load_memory
 87   return if session[session_key]
 88   return unless cookie = request.cookies[remember_cookie_key]
 89   id, key = cookie.split('_', 2)
 90   return unless id && key
 91 
 92   actual, deadline = active_remember_key_ds(id).get([remember_key_column, remember_deadline_column])
 93   unless actual
 94     forget_login
 95     return
 96   end
 97 
 98   if hmac_secret
 99     unless valid = timing_safe_eql?(key, compute_hmac(actual))
100       unless raw_remember_token_deadline && raw_remember_token_deadline > convert_timestamp(deadline)
101         forget_login
102         return
103       end
104     end
105   end
106 
107   unless valid || timing_safe_eql?(key, actual)
108     forget_login
109     return
110   end
111 
112   session[session_key] = id
113   account = account_from_session
114   session.delete(session_key)
115 
116   unless account
117     remove_remember_key(id)
118     forget_login
119     return 
120   end
121 
122   before_load_memory
123   update_session
124 
125   set_session_value(remembered_session_key, true)
126   if extend_remember_deadline?
127     active_remember_key_ds(id).update(remember_deadline_column=>Sequel.date_add(Sequel::CURRENT_TIMESTAMP, remember_period))
128     remember_login
129   end
130   after_load_memory
131 end

    # File lib/rodauth/features/base.rb
552 def loaded_templates
553   []
554 end

    # File lib/rodauth/features/lockout.rb
146 def locked_out?
147   if t = convert_timestamp(account_lockouts_ds.get(account_lockouts_deadline_column))
148     if Time.now < t
149       true
150     else
151       unlock_account
152       false
153     end
154   else
155     false
156   end
157 end

    # File lib/rodauth/features/remember.rb
181 def logged_in_via_remember_key?
182   !!session[remembered_session_key]
183 end

   # File lib/rodauth/features/login_password_requirements_base.rb
36 def login_confirm_label
37   "Confirm #{login_label}"
38 end

   # File lib/rodauth/features/login_password_requirements_base.rb
81 def login_does_not_meet_requirements_message
82   "invalid login#{", #{login_requirement_message}" if login_requirement_message}"
83 end

    # File lib/rodauth/features/reset_password.rb
243 def login_failed_reset_password_request_form
244   render("reset-password-request")
245 end

   # File lib/rodauth/features/create_account.rb
95 def login_form_footer
96   super + create_account_link
97 end

   # File lib/rodauth/features/login.rb
80 def login_hidden_field
81   "<input type='hidden' name=\"#{login_param}\" value=\"#{scope.h param(login_param)}\" />"
82 end

    # File lib/rodauth/features/login_password_requirements_base.rb
105 def login_meets_email_requirements?(login)
106   return true unless require_email_address_logins?
107   if login =~ /\A[^,;@ \r\n]+@[^,@; \r\n]+\.[^,@; \r\n]+\z/
108     return true
109   end
110   @login_requirement_message = 'not a valid email address'
111   return false
112 end

    # File lib/rodauth/features/login_password_requirements_base.rb
 93 def login_meets_length_requirements?(login)
 94   if login_minimum_length > login.length
 95     @login_requirement_message = login_too_short_message
 96     false
 97   elsif login_maximum_length < login.length
 98     @login_requirement_message = login_too_long_message
 99     false
100   else
101     true
102   end
103 end

   # File lib/rodauth/features/login_password_requirements_base.rb
44 def login_meets_requirements?(login)
45   login_meets_length_requirements?(login) && \
46     login_meets_email_requirements?(login)
47 end

    # File lib/rodauth/features/base.rb
248 def login_required
249   set_redirect_error_status(login_required_error_status)
250   set_redirect_error_flash require_login_error_flash
251   redirect require_login_redirect
252 end

   # File lib/rodauth/features/login_password_requirements_base.rb
85 def login_too_long_message
86   "maximum #{login_maximum_length} characters"
87 end

   # File lib/rodauth/features/login_password_requirements_base.rb
89 def login_too_short_message
90   "minimum #{login_minimum_length} characters"
91 end

   # File lib/rodauth/features/logout.rb
34 def logout
35   clear_session
36 end

   # File lib/rodauth/features/password_grace_period.rb
 8 def modifications_require_password?
 9   return false unless super
10   !password_recently_entered?
11 end

    # File lib/rodauth/features/create_account.rb
103 def new_account(login)
104   @account = _new_account(login)
105 end

    # File lib/rodauth/features/recovery_codes.rb
226 def new_recovery_code
227   random_key
228 end

   # File lib/rodauth/features/single_session.rb
56 def no_longer_active_session
57   clear_session
58   set_redirect_error_flash single_session_error_flash
59   redirect single_session_redirect
60 end

    # File lib/rodauth/features/base.rb
330 def only_json?
331   scope.class.opts[:rodauth_json] == :only
332 end

    # File lib/rodauth/features/base.rb
217 def open_account?
218   skip_status_checks? || account[account_status_column] == account_open_status_value 
219 end

    # File lib/rodauth/features/otp.rb
289 def otp_add_key
290   _otp_add_key(otp_key)
291   super if defined?(super)
292 end

    # File lib/rodauth/features/otp.rb
243 def otp_auth_form_footer
244   super if defined?(super)
245 end

    # File lib/rodauth/features/otp.rb
264 def otp_exists?
265   !otp_key.nil?
266 end

    # File lib/rodauth/features/otp.rb
351 def otp_hmac_secret(key)
352   base32_encode(compute_raw_hmac(ROTP::Base32.decode(key)), key.bytesize)
353 end

    # File lib/rodauth/features/otp.rb
316 def otp_issuer
317   request.host
318 end

    # File lib/rodauth/features/otp.rb
410 def otp_key_ds
411   db[otp_keys_table].where(otp_keys_id_column=>session_value)
412 end

    # File lib/rodauth/features/otp.rb
336 def otp_keys_use_hmac?
337   !!hmac_secret
338 end

    # File lib/rodauth/features/otp.rb
308 def otp_locked_out?
309   otp_key_ds.get(otp_keys_failures_column) >= otp_auth_failures_limit
310 end

    # File lib/rodauth/features/otp.rb
252 def otp_lockout_error_flash
253   "Authentication code use locked out due to numerous failures.#{super if defined?(super)}"
254 end

    # File lib/rodauth/features/otp.rb
247 def otp_lockout_redirect
248   return super if defined?(super)
249   nil
250 end

    # File lib/rodauth/features/otp.rb
366 def otp_new_secret
367   ROTP::Base32.random_base32.downcase
368 end

    # File lib/rodauth/features/otp.rb
320 def otp_provisioning_name
321   account[login_column]
322 end

    # File lib/rodauth/features/otp.rb
312 def otp_provisioning_uri
313   otp.provisioning_uri(otp_provisioning_name)
314 end

    # File lib/rodauth/features/otp.rb
324 def otp_qr_code
325   RQRCode::QRCode.new(otp_provisioning_uri).as_svg(:module_size=>8)
326 end

    # File lib/rodauth/features/otp.rb
300 def otp_record_authentication_failure
301   otp_key_ds.update(otp_keys_failures_column=>Sequel.identifier(otp_keys_failures_column) + 1)
302 end

    # File lib/rodauth/features/otp.rb
284 def otp_remove
285   otp_key_ds.delete
286   super if defined?(super)
287 end

    # File lib/rodauth/features/otp.rb
304 def otp_remove_auth_failures
305   otp_key_ds.update(otp_keys_failures_column=>0)
306 end

    # File lib/rodauth/features/otp.rb
346 def otp_tmp_key(secret)
347   _otp_tmp_key(secret)
348   clear_cached_otp
349 end

    # File lib/rodauth/features/otp.rb
294 def otp_update_last_use
295   otp_key_ds.
296     where(Sequel.date_add(otp_keys_last_use_column, :seconds=>(otp_interval||30)) < Sequel::CURRENT_TIMESTAMP).
297     update(otp_keys_last_use_column=>Sequel::CURRENT_TIMESTAMP) == 1
298 end

    # File lib/rodauth/features/otp.rb
328 def otp_user_key
329   @otp_user_key ||= if otp_keys_use_hmac?
330     otp_hmac_secret(otp_key)
331   else
332     otp_key
333   end
334 end

    # File lib/rodauth/features/otp.rb
268 def otp_valid_code?(ot_pass)
269   return false unless otp_exists?
270   ot_pass = ot_pass.gsub(/\s+/, '')
271   if drift = otp_drift
272     if otp.respond_to?(:verify_with_drift)
273       otp.verify_with_drift(ot_pass, drift)
274     else
275       # :nocov:
276       otp.verify(ot_pass, :drift_behind=>drift, :drift_ahead=>drift)
277       # :nocov:
278     end
279   else
280     otp.verify(ot_pass)
281   end
282 end

    # File lib/rodauth/features/otp.rb
355 def otp_valid_key?(secret)
356   return false unless secret =~ /\A([a-z2-7]{16}|[a-z2-7]{32})\z/
357   if otp_keys_use_hmac?
358     timing_safe_eql?(otp_hmac_secret(param(otp_setup_raw_param)), secret)
359   else
360     true
361   end
362 end

    # File lib/rodauth/features/base.rb
361 def param(key)
362   param_or_nil(key).to_s
363 end

    # File lib/rodauth/features/base.rb
367 def param_or_nil(key)
368   value = request.params[key]
369   value.to_s unless value.nil?
370 end

   # File lib/rodauth/features/change_password_notify.rb
27 def password_changed_email_body
28   render('password-changed-email')
29 end

   # File lib/rodauth/features/login_password_requirements_base.rb
40 def password_confirm_label
41   "Confirm #{password_label}"
42 end

    # File lib/rodauth/features/login_password_requirements_base.rb
120 def password_does_not_contain_null_byte?(password)
121   return true unless password.include?("\0")
122   @password_requirement_message = 'contains null byte'
123   false
124 end

   # File lib/rodauth/features/login_password_requirements_base.rb
73 def password_does_not_meet_requirements_message
74   "invalid password, does not meet requirements#{" (#{password_requirement_message})" if password_requirement_message}"
75 end

   # File lib/rodauth/features/disallow_password_reuse.rb
47 def password_doesnt_match_previous_password?(password)
48   match = if use_database_authentication_functions?
49     salts = previous_password_ds.
50       select_map([previous_password_id_column, Sequel.function(function_name(:rodauth_get_previous_salt), previous_password_id_column).as(:salt)])
51     return true if salts.empty?
52 
53     salts.any? do |hash_id, salt|
54       db.get(Sequel.function(function_name(:rodauth_previous_password_hash_match), hash_id, BCrypt::Engine.hash_secret(password, salt)))
55     end
56   else
57     # :nocov:
58     previous_password_ds.select_map(previous_password_hash_column).any?{|hash| BCrypt::Password.new(hash) == password}
59     # :nocov:
60   end
61 
62   return true unless match
63   @password_requirement_message = password_same_as_previous_password_message
64   false
65 end