module Rodauth

# File lib/rodauth/features/base.rb, line 428
def _account_from_login(login)
  ds = db[accounts_table].where(login_column=>login)
  ds = ds.select(*account_select) if account_select
  ds = ds.where(account_status_column=>[account_unverified_status_value, account_open_status_value]) unless skip_status_checks?
  ds.first
end

# File lib/rodauth/features/reset_password.rb, line 233
def _account_from_reset_password_key(token)
  account_from_key(token, account_open_status_value){|id| get_password_reset_key(id)}
end

# File lib/rodauth/features/base.rb, line 435
def _account_from_session
  ds = account_ds(session_value)
  ds = ds.where(account_session_status_filter) unless skip_status_checks?
  ds.first
end

# File lib/rodauth/features/lockout.rb, line 272
def _account_from_unlock_key(token)
  account_from_key(token){|id| account_lockouts_ds(id).get(account_lockouts_key_column)}
end

# File lib/rodauth/features/verify_account.rb, line 282
def _account_from_verify_account_key(token)
  account_from_key(token, account_unverified_status_value){|id| get_verify_account_key(id)}
end

# File lib/rodauth/features/verify_login_change.rb, line 180
def _account_from_verify_login_change_key(token)
  account_from_key(token) do |id|
    @verify_login_change_new_login, key = get_verify_login_change_login_and_key(id)
    key
  end
end

# File lib/rodauth/features/jwt.rb, line 207
def _json_response_body(hash)
  request.send(:convert_to_json, hash)
end

# File lib/rodauth/features/create_account.rb, line 123
def _new_account(login)
  acc = {login_column=>login}
  unless skip_status_checks?
    acc[account_status_column] = account_initial_status_value
  end
  acc
end

# File lib/rodauth/features/otp.rb, line 335
def _otp
  otp_class.new(otp_key, :issuer=>otp_issuer, :digits=>otp_digits, :interval=>otp_interval)
end

# File lib/rodauth/features/otp.rb, line 325
def _otp_add_key(secret)
  # Uniqueness errors can't be handled here, as we can't be sure the secret provided
  # is the same as the current secret.
  otp_key_ds.insert(otp_keys_id_column=>session_value, otp_keys_column=>secret)
end

# File lib/rodauth/features/otp.rb, line 331
def _otp_key
  otp_key_ds.get(otp_keys_column)
end

# File lib/rodauth/features/otp.rb, line 321
def _otp_tmp_key(secret)
  @otp_key = secret
end

# File lib/rodauth/features/recovery_codes.rb, line 234
def _recovery_codes
  recovery_codes_ds.select_map(recovery_codes_column)
end

# File lib/rodauth/features/sms_codes.rb, line 502
def _sms
  sms_ds.first
end

# File lib/rodauth/features/two_factor_base.rb, line 137
def _two_factor_auth_required_redirect
  two_factor_auth_required_redirect || two_factor_auth_fallback_redirect || default_redirect
end

# File lib/rodauth/features/base.rb, line 556
def _view(meth, page)
  scope.send(meth, _view_opts(page))
end

# File lib/rodauth/features/base.rb, line 538
def _view_opts(page)
  auth_template_path = template_path(page)
  opts = template_opts.dup
  opts[:locals] = opts[:locals] ? opts[:locals].dup : {}
  opts[:locals][:rodauth] = self
  opts[:cache] = cache_templates
  opts[:cache_key] = :"rodauth_#{page}"

  scope.instance_exec do
    opts = find_template(parse_template_opts(page, opts))
    unless File.file?(template_path(opts))
      opts[:path] = auth_template_path
    end
  end

  opts
end

# File lib/rodauth/features/account_expiration.rb, line 103
def account_activity_ds(account_id)
  db[account_activity_table].
    where(account_activity_id_column=>account_id)
end

# File lib/rodauth/features/base.rb, line 449
def account_ds(id=account_id)
  raise ArgumentError, "invalid account id passed to account_ds" unless id
  ds = db[accounts_table].where(account_id_column=>id)
  ds = ds.select(*account_select) if account_select
  ds
end

# File lib/rodauth/features/account_expiration.rb, line 53
def account_expired?
  columns = [account_activity_last_activity_column, account_activity_last_login_column, account_activity_expired_column]
  last_activity, last_login, expired = account_activity_ds(account_id).get(columns)
  return true if expired
  timestamp = convert_timestamp(expire_account_on_last_activity? ? last_activity : last_login)
  return false unless timestamp
  timestamp < Time.now - expire_account_after
end

# File lib/rodauth/features/account_expiration.rb, line 34
def account_expired_at
  get_activity_timestamp(account_id, account_activity_expired_column)
end

# File lib/rodauth/features/email_base.rb, line 53
def account_from_key(token, status_id=nil)
  id, key = split_token(token)
  return unless id && key

  return unless actual = yield(id)

  return unless timing_safe_eql?(key, actual)

  ds = account_ds(id)
  ds = ds.where(account_status_column=>status_id) if status_id && !skip_status_checks?
  ds.first
end

# File lib/rodauth/features/base.rb, line 157
def account_from_login(login)
  @account = _account_from_login(login)
end

# File lib/rodauth/features/password_expiration.rb, line 44
def account_from_reset_password_key(key)
  if a = super
    check_password_change_allowed
  end
  a
end

# File lib/rodauth/features/base.rb, line 236
def account_from_session
  @account = _account_from_session
end

# File lib/rodauth/features/lockout.rb, line 197
def account_from_unlock_key(key)
  @account = _account_from_unlock_key(key)
end

# File lib/rodauth/features/verify_account.rb, line 179
def account_from_verify_account_key(key)
  @account = _account_from_verify_account_key(key)
end

# File lib/rodauth/features/verify_login_change.rb, line 101
def account_from_verify_login_change_key(key)
  @account = _account_from_verify_login_change_key(key)
end

# File lib/rodauth/features/base.rb, line 147
def account_id
  account[account_id_column]
end

# File lib/rodauth/features/verify_account_grace_period.rb, line 65
def account_in_unverified_grace_period?
  account[account_status_column] == account_unverified_status_value &&
    verify_account_grace_period &&
    !verify_account_ds.where(Sequel.date_add(verification_requested_at_column, :seconds=>verify_account_grace_period) > Sequel::CURRENT_TIMESTAMP).empty?
end

# File lib/rodauth/features/base.rb, line 232
def account_initial_status_value
  account_open_status_value
end

# File lib/rodauth/features/lockout.rb, line 268
def account_lockouts_ds(id=account_id)
  db[account_lockouts_table].where(account_lockouts_id_column=>id)
end

# File lib/rodauth/features/lockout.rb, line 264
def account_login_failures_ds
  db[account_login_failures_table].where(account_login_failures_id_column=>account_id)
end

# File lib/rodauth/features/base.rb, line 95
def account_model(model)
  warn "account_model is deprecated, use db and accounts_table settings"
  db model.db
  accounts_table model.table_name
  account_select model.dataset.opts[:select]
end

# File lib/rodauth/features/base.rb, line 172
def account_password_hash_column
  nil
end

# File lib/rodauth/features/base.rb, line 441
def account_session_status_filter
  {account_status_column=>account_open_status_value}
end

# File lib/rodauth/features/remember.rb, line 197
def active_remember_key_ds(id=account_id)
  remember_key_ds(id).where(Sequel.expr(remember_deadline_column) > Sequel::CURRENT_TIMESTAMP)
end

# File lib/rodauth/features/disallow_password_reuse.rb, line 24
def add_previous_password_hash(hash) 
  ds = previous_password_ds
  keep_before = ds.reverse(previous_password_id_column).
    limit(nil, previous_passwords_to_check).
    get(previous_password_id_column)

  ds.where(Sequel.expr(previous_password_id_column) <= keep_before).
    delete

  # This should never raise uniqueness violations, as it uses a serial primary key
  ds.insert(previous_password_account_id_column=>account_id, previous_password_hash_column=>hash)
end

# File lib/rodauth/features/recovery_codes.rb, line 215
def add_recovery_code
  # This should never raise uniqueness violations unless the recovery code is the same, and the odds of that
  # are 1/256**32 assuming a good random number generator.  Still, attempt to handle that case by retrying
  # on such a uniqueness violation.
  retry_on_uniqueness_violation do
    recovery_codes_ds.insert(recovery_codes_id_column=>session_value, recovery_codes_column=>new_recovery_code)
  end
end

# File lib/rodauth/features/recovery_codes.rb, line 205
def add_recovery_codes(number)
  return if number <= 0
  transaction do
    number.times do
      add_recovery_code
    end
  end
  remove_instance_variable(:@recovery_codes)
end

# File lib/rodauth/features/remember.rb, line 143
def add_remember_key
  hash = {remember_id_column=>account_id, remember_key_column=>remember_key_value}
  set_deadline_value(hash, remember_deadline_column, remember_deadline_interval)

  if e = raised_uniqueness_violation{remember_key_ds.insert(hash)}
    # If inserting into the remember key table causes a violation, we can pull the
    # existing row from the table.  If there is no invalid row, we can then reraise.
    raise e unless @remember_key_value = active_remember_key_ds.get(remember_key_column)
  end
end

# File lib/rodauth/features/verify_change_login.rb, line 12
def after_change_login
  super
  update_account(account_status_column=>account_unverified_status_value)
  setup_account_verification
  session[unverified_account_session_key] = true
end

# File lib/rodauth/features/change_password_notify.rb, line 30
def after_change_password
  super
  send_password_changed_email
end

# File lib/rodauth/features/account_expiration.rb, line 93
def after_close_account
  super if defined?(super)
  account_activity_ds(account_id).delete
end

# File lib/rodauth/features/remember.rb, line 178
def after_confirm_password
  super
  clear_remembered_session_key
end

# File lib/rodauth/features/disallow_password_reuse.rb, line 69
def after_create_account
  if account_password_hash_column
    add_previous_password_hash(password_hash(param(password_param)))
  end
  super if defined?(super)
end

# File lib/rodauth/features/lockout.rb, line 221
def after_login
  clear_invalid_login_attempts
  super
end

# File lib/rodauth/features/lockout.rb, line 226
def after_login_failure
  invalid_login_attempted
  super
end

# File lib/rodauth/features/remember.rb, line 168
def after_logout
  forget_login
  super if defined?(super)
end

# File lib/rodauth/features/password_grace_period.rb, line 26
def after_reset_password
  super if defined?(super)
  @last_password_entry = Time.now.to_i
end

# File lib/rodauth/features/verify_account.rb, line 146
def allow_resending_verify_account_email?
  account[account_status_column] == account_unverified_status_value
end

# File lib/rodauth/features/base.rb, line 180
def already_logged_in
  nil
end

# File lib/rodauth/features/base.rb, line 91
def auth_class_eval(&block)
  auth.class_eval(&block)
end

# File lib/rodauth/features/base.rb, line 224
def authenticated?
  logged_in?
end

# File lib/rodauth/features/verify_account_grace_period.rb, line 35
def before_change_login_route
  unless verified_account?
    set_redirect_error_flash unverified_change_login_error_flash
    redirect unverified_change_login_redirect
  end
  super if defined?(super)
end

# File lib/rodauth/features/password_expiration.rb, line 89
def before_change_password_route
  check_password_change_allowed
  super
end

# File lib/rodauth/features/lockout.rb, line 214
def before_login_attempt
  if locked_out?
    show_lockout_page
  end
  super
end

# File lib/rodauth/features/single_session.rb, line 71
def before_logout
  reset_single_session_key if request.post?
  super if defined?(super)
end

# File lib/rodauth/features/account_expiration.rb, line 73
def before_reset_password
  check_account_expiration
  super if defined?(super)
end

# File lib/rodauth/features/account_expiration.rb, line 78
def before_reset_password_request
  check_account_expiration
  super if defined?(super)
end

# File lib/rodauth/features/jwt.rb, line 142
def before_rodauth
  if json_request?
    if jwt_check_accept? && (accept = request.env['HTTP_ACCEPT']) && accept !~ json_accept_regexp
      response.status = 406
      json_response[json_response_error_key] = json_not_accepted_error_message
      response['Content-Type'] ||= json_response_content_type
      response.write(request.send(:convert_to_json, json_response))
      request.halt
    end

    unless request.post?
      response.status = 405
      response.headers['Allow'] = 'POST'
      json_response[json_response_error_key] = json_non_post_error_message
      return_json_response
    end
  elsif only_json?
    response.status = json_response_error_status
    response.write non_json_request_error_message
    request.halt
  end

  super
end

# File lib/rodauth/features/account_expiration.rb, line 83
def before_unlock_account
  check_account_expiration
  super if defined?(super)
end

# File lib/rodauth/features/account_expiration.rb, line 88
def before_unlock_account_request
  check_account_expiration
  super if defined?(super)
end

# File lib/rodauth/features/jwt.rb, line 167
def before_view_recovery_codes
  super if defined?(super)
  if use_jwt?
    json_response[:codes] = recovery_codes
    json_response[json_response_success_key] ||= "" if include_success_messages?
  end
end

# File lib/rodauth/features/base.rb, line 261
def button(value, opts={})
  scope.render(button_opts(value, opts))
end

# File lib/rodauth/features/base.rb, line 252
def button_opts(value, opts)
  opts = Hash[template_opts].merge!(opts)
  opts[:locals] = {:value=>value, :opts=>opts}
  opts[:path] = template_path('button')
  opts[:cache] = cache_templates
  opts[:cache_key] = :rodauth_button
  opts
end

# File lib/rodauth/features/recovery_codes.rb, line 201
def can_add_recovery_codes?
  recovery_codes.length < recovery_codes_limit
end

# File lib/rodauth/features/base.rb, line 359
def catch_error(&block)
  catch(:rodauth_error, &block)
end

# File lib/rodauth/features/change_login.rb, line 64
def change_login(login)
  if account_ds.get(login_column).downcase == login.downcase
    @login_requirement_message = 'same as current login'
    return false
  end

  update_login(login)
end

# File lib/rodauth/features/verify_change_login.rb, line 6
def change_login_notice_flash
  "#{super}. #{verify_account_email_sent_notice_flash}"
end

# File lib/rodauth/features/change_login.rb, line 60
def change_login_requires_password?
  modifications_require_password?
end

# File lib/rodauth/features/change_password.rb, line 65
def change_password_requires_password?
  modifications_require_password?
end

# File lib/rodauth/features/account_expiration.rb, line 62
def check_account_expiration
  if account_expired?
    set_expired unless account_expired_at
    set_redirect_error_flash account_expiration_error_flash
    redirect account_expiration_redirect
  end
  update_last_login
end

# File lib/rodauth/features/base.rb, line 176
def check_already_logged_in
  already_logged_in if logged_in?
end

# File lib/rodauth/features/password_expiration.rb, line 29
def check_password_change_allowed
  if password_changed_at = get_password_changed_at
    if password_changed_at > Time.now - allow_password_change_after
      set_redirect_error_flash password_not_changeable_yet_error_flash
      redirect password_not_changeable_yet_redirect
    end
  end
end

# File lib/rodauth/features/session_expiration.rb, line 14
def check_session_expiration
  return unless logged_in?

  unless session.has_key?(session_last_activity_session_key) && session.has_key?(session_created_session_key)
    if session_expiration_default
      expire_session
    end

    return
  end

  time = Time.now.to_i

  if session[session_last_activity_session_key] + session_inactivity_timeout < time
    expire_session
  end
  set_session_value(session_last_activity_session_key, time)

  if session[session_created_session_key] + max_session_lifetime < time
    expire_session
  end
end

# File lib/rodauth/features/single_session.rb, line 41
def check_single_session
  if logged_in? && !currently_active_session?
    no_longer_active_session
  end
end

# File lib/rodauth/features/otp.rb, line 304
def clear_cached_otp
  remove_instance_variable(:@otp) if defined?(@otp)
end

# File lib/rodauth/features/lockout.rb, line 151
def clear_invalid_login_attempts
  unlock_account
end

# File lib/rodauth/features/remember.rb, line 158
def clear_remembered_session_key
  session.delete(remembered_session_key)
end

# File lib/rodauth/features/base.rb, line 184
def clear_session
  if scope.respond_to?(:clear_session)
    scope.clear_session
  else
    session.clear
  end
end

# File lib/rodauth/features/close_account.rb, line 61
def close_account
  unless skip_status_checks?
    update_account(account_status_column=>account_closed_status_value)
  end

  unless account_password_hash_column
    password_hash_ds.delete
  end
end

# File lib/rodauth/features/close_account.rb, line 57
def close_account_requires_password?
  modifications_require_password?
end

# File lib/rodauth/features/confirm_password.rb, line 44
def confirm_password
  nil
end

# File lib/rodauth/features/confirm_password.rb, line 48
def confirm_password_redirect
  session.delete(confirm_password_redirect_session_key) || default_redirect
end

# File lib/rodauth/features/base.rb, line 338
def convert_session_key(key)
  scope.opts[:sessions_convert_symbols] ? key.to_s : key
end

# File lib/rodauth/features/base.rb, line 461
def convert_timestamp(timestamp)
  timestamp = db.to_application_timestamp(timestamp) if timestamp.is_a?(String)
  timestamp
end

# File lib/rodauth/features/verify_account.rb, line 203
def create_account_autologin?
  false
end

# File lib/rodauth/features/create_account.rb, line 90
def create_account_link
  "<p><a href=\"#{prefix}/#{create_account_route}\">Create a New Account</a></p>"
end

# File lib/rodauth/features/verify_account.rb, line 165
def create_account_notice_flash
  verify_account_email_sent_notice_flash
end

# File lib/rodauth/features/verify_account.rb, line 215
def create_account_set_password?
  return false if verify_account_set_password?
  super
end

# File lib/rodauth/features/email_base.rb, line 24
def create_email(subject, body)
  create_email_to(email_to, subject, body)
end

# File lib/rodauth/features/email_base.rb, line 28
def create_email_to(to, subject, body)
  m = Mail.new
  m.from = email_from
  m.to = to
  m.subject = "#{email_subject_prefix}#{subject}"
  m.body = body
  m
end

# File lib/rodauth/features/change_password_notify.rb, line 22
def create_password_changed_email
  create_email(password_changed_email_subject, password_changed_email_body)
end

# File lib/rodauth/features/reset_password.rb, line 207
def create_reset_password_email
  create_email(reset_password_email_subject, reset_password_email_body)
end

# File lib/rodauth/features/reset_password.rb, line 145
def create_reset_password_key
  transaction do
    if reset_password_key_value = get_password_reset_key(account_id)
      @reset_password_key_value = reset_password_key_value
    elsif e = raised_uniqueness_violation{password_reset_ds.insert(reset_password_key_insert_hash)}
      # If inserting into the reset password table causes a violation, we can pull the
      # existing reset password key from the table, or reraise.
      raise e unless @reset_password_key_value = get_password_reset_key(account_id)
    end
  end
end

# File lib/rodauth/features/lockout.rb, line 252
def create_unlock_account_email
  create_email(unlock_account_email_subject, unlock_account_email_body)
end

# File lib/rodauth/features/verify_account.rb, line 270
def create_verify_account_email
  create_email(verify_account_email_subject, verify_account_email_body)
end

# File lib/rodauth/features/verify_account.rb, line 253
def create_verify_account_key
  ds = verify_account_ds
  transaction do
    if ds.empty?
      if e = raised_uniqueness_violation{ds.insert(verify_account_key_insert_hash)}
        # If inserting into the verify account table causes a violation, we can pull the
        # key from the verify account table, or reraise.
        raise e unless @verify_account_key_value = get_verify_account_key(account_id)
      end
    end
  end
end

# File lib/rodauth/features/verify_login_change.rb, line 168
def create_verify_login_change_email(login)
  create_email_to(login, verify_login_change_email_subject, verify_login_change_email_body)
end

# File lib/rodauth/features/verify_login_change.rb, line 146
def create_verify_login_change_key(login)
  ds = verify_login_change_ds
  transaction do
    ds.where((Sequel::CURRENT_TIMESTAMP > verify_login_change_deadline_column) | ~Sequel.expr(verify_login_change_login_column=>login)).delete
    if e = raised_uniqueness_violation{ds.insert(verify_login_change_key_insert_hash(login))}
      old_login, key = get_verify_login_change_login_and_key(account_id)
      # If inserting into the verify account table causes a violation, we can pull the
      # key from the verify login change table if the logins match, or reraise.
      @verify_login_change_key_value = if old_login.downcase == login.downcase
        key
      end
      raise e unless @verify_login_change_key_value
    end
  end
end

# File lib/rodauth/features/base.rb, line 240
def csrf_tag(path=request.path)
  return unless scope.respond_to?(:csrf_tag)

  if use_request_specific_csrf_tokens?
    # :nocov:
    scope.csrf_tag(path)
    # :nocov:
  else
    scope.csrf_tag
  end
end

# File lib/rodauth/features/single_session.rb, line 25
def currently_active_session?
  single_session_key = session[single_session_session_key]
  current_key = single_session_ds.get(single_session_key_column)
  if single_session_key.nil?
    unless current_key
      # No row exists for this user, indicating the feature has never
      # been used, so it is OK to treat the current session as a new
      # session.
      update_single_session_key
    end
    true
  elsif current_key
    timing_safe_eql?(single_session_key, current_key)
  end
end

# File lib/rodauth/features/base.rb, line 165
def db
  Sequel::DATABASES.first
end

# File lib/rodauth/features/close_account.rb, line 71
def delete_account
  account_ds.delete
end

# File lib/rodauth/features/close_account.rb, line 75
def delete_account_on_close?
  skip_status_checks?
end

# File lib/rodauth/features/remember.rb, line 139
def disable_remember_login
  remove_remember_key
end

# File lib/rodauth/features/email_base.rb, line 37
def email_from
  "webmaster@#{request.host}"
end

# File lib/rodauth/features/email_base.rb, line 41
def email_to
  account[login_column]
end

# File lib/rodauth/features/session_expiration.rb, line 37
def expire_session
  clear_session
  set_redirect_error_flash session_expiration_error_flash
  redirect session_expiration_redirect
end

# File lib/rodauth/features/base.rb, line 110
def features
  self.class.features
end

# File lib/rodauth/features/base.rb, line 142
def field_error(field)
  return nil unless @field_errors
  @field_errors[field]
end

# File lib/rodauth/features/base.rb, line 126
def flash
  scope.flash
end

# File lib/rodauth/features/remember.rb, line 124
def forget_login
  ::Rack::Utils.delete_cookie_header!(response.headers, remember_cookie_key, remember_cookie_options)
end

# File lib/rodauth/features/base.rb, line 404
def function_name(name)
  if db.database_type == :mssql
    # :nocov:
    "dbo.#{name}"
    # :nocov:
  else
    name
  end
end

# File lib/rodauth/features/remember.rb, line 185
def generate_remember_key_value
  @remember_key_value = random_key
end

# File lib/rodauth/features/reset_password.rb, line 203
def generate_reset_password_key_value
  @reset_password_key_value = random_key
end

# File lib/rodauth/features/lockout.rb, line 236
def generate_unlock_account_key
  random_key
end

# File lib/rodauth/features/verify_account.rb, line 249
def generate_verify_account_key_value
  @verify_account_key_value = random_key
end

# File lib/rodauth/features/verify_login_change.rb, line 142
def generate_verify_login_change_key_value
  @verify_login_change_key_value = random_key
end

# File lib/rodauth/features/account_expiration.rb, line 108
def get_activity_timestamp(account_id, column)
  convert_timestamp(account_activity_ds(account_id).get(column))
end

# File lib/rodauth/features/password_expiration.rb, line 25
def get_password_changed_at
  convert_timestamp(password_expiration_ds.get(password_expiration_changed_at_column))
end

# File lib/rodauth/features/base.rb, line 416
def get_password_hash
  if account_password_hash_column
    account[account_password_hash_column]
  elsif use_database_authentication_functions?
    db.get(Sequel.function(function_name(:rodauth_get_salt), account_id))
  else
    # :nocov:
    password_hash_ds.get(password_hash_column)
    # :nocov:
  end
end

# File lib/rodauth/features/reset_password.rb, line 173
def get_password_reset_key(id)
  ds = password_reset_ds(id)
  ds.where(Sequel::CURRENT_TIMESTAMP > reset_password_deadline_column).delete
  ds.get(reset_password_key_column)
end

# File lib/rodauth/features/remember.rb, line 128
def get_remember_key
  unless @remember_key_value = active_remember_key_ds.get(remember_key_column)
   generate_remember_key_value
   transaction do
     remove_remember_key
     add_remember_key
   end
  end
  nil
end

# File lib/rodauth/features/lockout.rb, line 193
def get_unlock_account_key
  account_lockouts_ds.get(account_lockouts_key_column)
end

# File lib/rodauth/features/verify_account.rb, line 195
def get_verify_account_key(id)
  verify_account_ds(id).get(verify_account_key_column)
end

# File lib/rodauth/features/verify_login_change.rb, line 113
def get_verify_login_change_login_and_key(id)
  verify_login_change_ds(id).get([verify_login_change_login_column, verify_login_change_key_column])
end

# File lib/rodauth/features/jwt.rb, line 187
def include_success_messages?
  !json_response_success_key.nil?
end

# File lib/rodauth/features/lockout.rb, line 155
def invalid_login_attempted
  ds = account_login_failures_ds.
      where(account_login_failures_id_column=>account_id)

  number = if db.database_type == :postgres
    ds.returning(account_login_failures_number_column).
      with_sql(:update_sql, account_login_failures_number_column=>Sequel.expr(account_login_failures_number_column)+1).
      single_value
  else
    # :nocov:
    if ds.update(account_login_failures_number_column=>Sequel.expr(account_login_failures_number_column)+1) > 0
      ds.get(account_login_failures_number_column)
    end
    # :nocov:
  end

  unless number
    # Ignoring the violation is safe here.  It may allow slightly more than max_invalid_logins invalid logins before
    # lockout, but allowing a few extra is OK if the race is lost.
    ignore_uniqueness_violation{account_login_failures_ds.insert(account_login_failures_id_column=>account_id)}
    number = 1
  end

  if number >= max_invalid_logins
    @unlock_account_key_value = generate_unlock_account_key
    hash = {account_lockouts_id_column=>account_id, account_lockouts_key_column=>unlock_account_key_value}
    set_deadline_value(hash, account_lockouts_deadline_column, account_lockouts_deadline_interval)

    if e = raised_uniqueness_violation{account_lockouts_ds.insert(hash)}
      # If inserting into the lockout table raises a violation, we should just be able to pull the already inserted
      # key out of it.  If that doesn't return a valid key, we should reraise the error.
      raise e unless @unlock_account_key_value = account_lockouts_ds.get(account_lockouts_key_column)

      show_lockout_page
    end
  end
end

# File lib/rodauth/features/change_password.rb, line 69
def invalid_previous_password_message
  invalid_password_message
end

# File lib/rodauth/features/jwt.rb, line 103
def json_request?
  return @json_request if defined?(@json_request)
  @json_request = request.content_type =~ json_request_content_type_regexp
end

# File lib/rodauth/features/jwt.rb, line 197
def json_response
  @json_response ||= {}
end

# File lib/rodauth/features/jwt.rb, line 175
def jwt_payload
  return @jwt_payload if defined?(@jwt_payload)
  @jwt_payload = JWT.decode(jwt_token, jwt_secret, true, jwt_decode_opts.merge(:algorithm=>jwt_algorithm))[0]
rescue JWT::DecodeError
  @jwt_payload = false
end

# File lib/rodauth/features/jwt.rb, line 108
def jwt_secret
  raise ArgumentError, "jwt_secret not set"
end

# File lib/rodauth/features/jwt.rb, line 112
def jwt_session_hash
  jwt_session_key ? {jwt_session_key=>session} : session
end

# File lib/rodauth/features/jwt.rb, line 120
def jwt_token
  return @jwt_token if defined?(@jwt_token)

  if (v = request.env['HTTP_AUTHORIZATION']) && v !~ jwt_authorization_ignore
    @jwt_token = v.sub(jwt_authorization_remove, '')
  end
end

# File lib/rodauth/features/account_expiration.rb, line 26
def last_account_activity_at
  get_activity_timestamp(session_value, account_activity_last_activity_column)
end

# File lib/rodauth/features/account_expiration.rb, line 30
def last_account_login_at
  get_activity_timestamp(session_value, account_activity_last_login_column)
end

# File lib/rodauth/features/remember.rb, line 84
def load_memory
  return if session[session_key]
  return unless cookie = request.cookies[remember_cookie_key]
  id, key = cookie.split('_', 2)
  return unless id && key

  unless (actual = active_remember_key_ds(id).get(remember_key_column)) && timing_safe_eql?(key, actual)
    forget_login
    return
  end

  session[session_key] = id
  account = account_from_session
  session.delete(session_key)

  unless account
    remove_remember_key(id)
    forget_login
    return 
  end

  before_load_memory
  update_session

  set_session_value(remembered_session_key, true)
  if extend_remember_deadline?
    active_remember_key_ds(id).update(remember_deadline_column=>Sequel.date_add(Sequel::CURRENT_TIMESTAMP, remember_period))
    remember_login
  end
  after_load_memory
end

# File lib/rodauth/features/base.rb, line 466
def loaded_templates
  []
end

# File lib/rodauth/features/lockout.rb, line 132
def locked_out?
  if t = convert_timestamp(account_lockouts_ds.get(account_lockouts_deadline_column))
    if Time.now < t
      true
    else
      unlock_account
      false
    end
  else
    false
  end
end

# File lib/rodauth/features/remember.rb, line 162
def logged_in_via_remember_key?
  !!session[remembered_session_key]
end

# File lib/rodauth/features/login_password_requirements_base.rb, line 34
def login_confirm_label
  "Confirm #{login_label}"
end

# File lib/rodauth/features/login_password_requirements_base.rb, line 79
def login_does_not_meet_requirements_message
  "invalid login#{", #{login_requirement_message}" if login_requirement_message}"
end

# File lib/rodauth/features/reset_password.rb, line 211
def login_failed_reset_password_request_form
  render("reset-password-request")
end

# File lib/rodauth/features/create_account.rb, line 94
def login_form_footer
  super + create_account_link
end

# File lib/rodauth/features/login_password_requirements_base.rb, line 103
def login_meets_email_requirements?(login)
  return true unless require_email_address_logins?
  if login =~ /\A[^,;@ \r\n]+@[^,@; \r\n]+\.[^,@; \r\n]+\z/
    return true
  end
  @login_requirement_message = 'not a valid email address'
  return false
end

# File lib/rodauth/features/login_password_requirements_base.rb, line 91
def login_meets_length_requirements?(login)
  if login_minimum_length > login.length
    @login_requirement_message = login_too_short_message
    false
  elsif login_maximum_length < login.length
    @login_requirement_message = login_too_long_message
    false
  else
    true
  end
end

# File lib/rodauth/features/login_password_requirements_base.rb, line 42
def login_meets_requirements?(login)
  login_meets_length_requirements?(login) && \
    login_meets_email_requirements?(login)
end

# File lib/rodauth/features/base.rb, line 192
def login_required
  set_redirect_error_status(login_required_error_status)
  set_redirect_error_flash require_login_error_flash
  redirect require_login_redirect
end

# File lib/rodauth/features/login_password_requirements_base.rb, line 83
def login_too_long_message
  "maximum #{login_maximum_length} characters"
end

# File lib/rodauth/features/login_password_requirements_base.rb, line 87
def login_too_short_message
  "minimum #{login_minimum_length} characters"
end

# File lib/rodauth/features/logout.rb, line 33
def logout
  clear_session
end

# File lib/rodauth/features/password_grace_period.rb, line 7
def modifications_require_password?
  return false unless super
  !password_recently_entered?
end

# File lib/rodauth/features/create_account.rb, line 102
def new_account(login)
  @account = _new_account(login)
end

# File lib/rodauth/features/recovery_codes.rb, line 226
def new_recovery_code
  random_key
end

# File lib/rodauth/features/single_session.rb, line 47
def no_longer_active_session
  clear_session
  set_redirect_error_flash single_session_error_flash
  redirect single_session_redirect
end

# File lib/rodauth/features/base.rb, line 274
def only_json?
  scope.class.opts[:rodauth_json] == :only
end

# File lib/rodauth/features/base.rb, line 161
def open_account?
  skip_status_checks? || account[account_status_column] == account_open_status_value 
end

# File lib/rodauth/features/otp.rb, line 263
def otp_add_key
  _otp_add_key(otp_key)
  super if defined?(super)
end

# File lib/rodauth/features/otp.rb, line 223
def otp_auth_form_footer
  super if defined?(super)
end

# File lib/rodauth/features/otp.rb, line 244
def otp_exists?
  !otp_key.nil?
end

# File lib/rodauth/features/otp.rb, line 290
def otp_issuer
  request.host
end

# File lib/rodauth/features/otp.rb, line 339
def otp_key_ds
  db[otp_keys_table].where(otp_keys_id_column=>session_value)
end

# File lib/rodauth/features/otp.rb, line 282
def otp_locked_out?
  otp_key_ds.get(otp_keys_failures_column) >= otp_auth_failures_limit
end

# File lib/rodauth/features/otp.rb, line 232
def otp_lockout_error_flash
  "Authentication code use locked out due to numerous failures.#{super if defined?(super)}"
end

# File lib/rodauth/features/otp.rb, line 227
def otp_lockout_redirect
  return super if defined?(super)
  default_redirect
end

# File lib/rodauth/features/otp.rb, line 317
def otp_new_secret
  ROTP::Base32.random_base32
end

# File lib/rodauth/features/otp.rb, line 294
def otp_provisioning_name
  account[login_column]
end

# File lib/rodauth/features/otp.rb, line 286
def otp_provisioning_uri
  otp.provisioning_uri(otp_provisioning_name)
end

# File lib/rodauth/features/otp.rb, line 298
def otp_qr_code
  RQRCode::QRCode.new(otp_provisioning_uri).as_svg(:module_size=>8)
end

# File lib/rodauth/features/otp.rb, line 274
def otp_record_authentication_failure
  otp_key_ds.update(otp_keys_failures_column=>Sequel.identifier(otp_keys_failures_column) + 1)
end

# File lib/rodauth/features/otp.rb, line 258
def otp_remove
  otp_key_ds.delete
  super if defined?(super)
end

# File lib/rodauth/features/otp.rb, line 278
def otp_remove_auth_failures
  otp_key_ds.update(otp_keys_failures_column=>0)
end

# File lib/rodauth/features/otp.rb, line 308
def otp_tmp_key(secret)
  _otp_tmp_key(secret)
  clear_cached_otp
end

# File lib/rodauth/features/otp.rb, line 268
def otp_update_last_use
  otp_key_ds.
    where(Sequel.date_add(otp_keys_last_use_column, :seconds=>(otp_interval||30)) < Sequel::CURRENT_TIMESTAMP).
    update(otp_keys_last_use_column=>Sequel::CURRENT_TIMESTAMP) == 1
end

# File lib/rodauth/features/otp.rb, line 248
def otp_valid_code?(ot_pass)
  return false unless otp_exists?
  ot_pass = ot_pass.gsub(/\s+/, '')
  if drift = otp_drift
    otp.verify_with_drift(ot_pass, drift)
  else
    otp.verify(ot_pass)
  end
end

# File lib/rodauth/features/otp.rb, line 313
def otp_valid_key?(secret)
  secret =~ /\A[a-z2-7]{16}\z/
end

# File lib/rodauth/features/base.rb, line 305
def param(key)
  param_or_nil(key).to_s
end

# File lib/rodauth/features/base.rb, line 311
def param_or_nil(key)
  value = request.params[key]
  value.to_s unless value.nil?
end

# File lib/rodauth/features/change_password_notify.rb, line 26
def password_changed_email_body
  render('password-changed-email')
end

# File lib/rodauth/features/login_password_requirements_base.rb, line 38
def password_confirm_label
  "Confirm #{password_label}"
end

# File lib/rodauth/features/login_password_requirements_base.rb, line 118
def password_does_not_contain_null_byte?(password)
  return true unless password.include?("\0")
  @password_requirement_message = 'contains null byte'
  false
end

# File lib/rodauth/features/login_password_requirements_base.rb, line 71
def password_does_not_meet_requirements_message
  "invalid password, does not meet requirements#{" (#{password_requirement_message})" if password_requirement_message}"
end

# File lib/rodauth/features/disallow_password_reuse.rb, line 44
def password_doesnt_match_previous_password?(password)
  match = if use_database_authentication_functions?
    salts = previous_password_ds.
      select_map([previous_password_id_column, Sequel.function(function_name(:rodauth_get_previous_salt), previous_password_id_column).as(:salt)])
    return true if salts.empty?

    salts.any? do |hash_id, salt|
      db.get(Sequel.function(function_name(:rodauth_previous_password_hash_match), hash_id, BCrypt::Engine.hash_secret(password, salt)))
    end
  else
    # :nocov:
    previous_password_ds.select_map(previous_password_hash_column).any?{|hash| BCrypt::Password.new(hash) == password}
    # :nocov:
  end

  return true unless match
  @password_requirement_message = password_same_as_previous_password_message
  false
end

# File lib/rodauth/features/password_expiration.rb, line 106
def password_expiration_ds
  db[password_expiration_table].where(password_expiration_id_column=>account_id)
end

# File lib/rodauth/features/password_expiration.rb, line 67
def password_expired?
  if password_changed_at = session[password_changed_at_session_key]
    return password_changed_at + require_password_change_after < Time.now.to_i
  end

  account_from_session
  if password_changed_at = get_password_changed_at
    set_session_value(password_changed_at_session_key, password_changed_at.to_i)
    password_changed_at + require_password_change_after < Time.now
  else
    set_session_value(password_changed_at_session_key, password_expiration_default ? 0 : 2147483647)
    password_expiration_default
  end
end

# File lib/rodauth/features/password_complexity.rb, line 54
def password_has_enough_character_groups?(password)
  return true if password.length > password_max_length_for_groups_check
  return true if password_character_groups.select{|re| password =~ re}.length >= password_min_groups
  @password_requirement_message = password_not_enough_character_groups_message
  false
end

# File lib/rodauth/features/password_complexity.rb, line 61
def password_has_no_invalid_pattern?(password)
  return true unless password_invalid_pattern
  return true if password !~ password_invalid_pattern
  @password_requirement_message = password_invalid_pattern_message
  false
end

# File lib/rodauth/features/login_password_requirements_base.rb, line 136
def password_hash(password)
  BCrypt::Password.create(password, :cost=>password_hash_cost)
end

# File lib/rodauth/features/login_password_requirements_base.rb, line 125
def password_hash_cost
  BCrypt::Engine::MIN_COST
end

# File lib/rodauth/features/base.rb, line 456
def password_hash_ds
  db[password_hash_table].where(password_hash_id_column=>account_id)
end

# File lib/rodauth/features/base.rb, line 288
def password_match?(password)
  if hash = get_password_hash
    if account_password_hash_column || !use_database_authentication_functions?
      BCrypt::Password.new(hash) == password
    else
      db.get(Sequel.function(function_name(:rodauth_valid_password_hash), account_id, BCrypt::Engine.hash_secret(password, hash)))
    end 
  end
end

# File lib/rodauth/features/login_password_requirements_base.rb, line 112
def password_meets_length_requirements?(password)
  return true if password_minimum_length <= password.length
  @password_requirement_message = password_too_short_message
  false
end

# File lib/rodauth/features/disallow_common_passwords.rb, line 12
def password_meets_requirements?(password)
  super && password_not_one_of_the_most_common?(password)
end

# File lib/rodauth/features/password_complexity.rb, line 79
def password_not_in_dictionary?(password)
  return true unless dict = password_dictionary
  return true unless password =~ /\A(?:\d*)([A-Za-z!@$+|][A-Za-z!@$+|0134578]+[A-Za-z!@$+|])(?:\d*)\z/
  word = $1.downcase.tr('!@$+|0134578', 'iastloleastb')
  return true if !dict.include?(word)
  @password_requirement_message = password_in_dictionary_message
  false
end

# File lib/rodauth/features/disallow_common_passwords.rb, line 32
def password_not_one_of_the_most_common?(password)
  return true unless password_one_of_most_common?(password)
  @password_requirement_message = password_is_one_of_the_most_common_message
  false
end

# File lib/rodauth/features/password_complexity.rb, line 68
def password_not_too_many_repeating_characters?(password)
  return true if password_max_repeating_characters < 2
  return true if password !~ /(.)(\1){#{password_max_repeating_characters-1}}/ 
  @password_requirement_message = password_too_many_repeating_characters_message
  false
end

# File lib/rodauth/features/disallow_common_passwords.rb, line 26
def password_one_of_most_common?(password)
  most_common_passwords.include?(password)
end

# File lib/rodauth/features/password_grace_period.rb, line 36
def password_recently_entered?
  return false unless last_password_entry = session[last_password_entry_session_key]
  last_password_entry + password_grace_period > Time.now.to_i
end

# File lib/rodauth/features/reset_password.rb, line 229
def password_reset_ds(id=account_id)
  db[reset_password_table].where(reset_password_id_column=>id)
end

# File lib/rodauth/features/password_complexity.rb, line 75
def password_too_many_repeating_characters_message
  "contains #{password_max_repeating_characters} or more of the same character in a row"
end

# File lib/rodauth/features/login_password_requirements_base.rb, line 75
def password_too_short_message
  "minimum #{password_minimum_length} characters"
end

# File lib/rodauth/features/base.rb, line 278
def post_configure
  require 'bcrypt' if require_bcrypt?
  db.extension :date_arithmetic if use_date_arithmetic?
  route_hash= {}
  self.class.routes.each do |meth|
    route_hash["/#{send("#{meth.to_s.sub(/\Ahandle_/, '')}_route")}"] = meth
  end
  self.class.route_hash = route_hash.freeze
end

# File lib/rodauth/features/disallow_password_reuse.rb, line 76
def previous_password_ds
  db[previous_password_hash_table].where(previous_password_account_id_column=>account_id)
end

# File lib/rodauth/features/base.rb, line 485
def raises_uniqueness_violation?(&block)
  transaction(:savepoint=>:only, &block)
  false
rescue unique_constraint_violation_class => e
  e
end

# File lib/rodauth/features/base.rb, line 327
def random_key
  SecureRandom.urlsafe_base64(32)
end

# File lib/rodauth/features/recovery_codes.rb, line 188
def recovery_code_match?(code)
  recovery_codes.each do |s|
    if timing_safe_eql?(code, s)
      recovery_codes_ds.where(recovery_codes_column=>code).delete
      if recovery_codes_primary?
        add_recovery_code
      end
      return true
    end
  end
  false
end

# File lib/rodauth/features/recovery_codes.rb, line 238
def recovery_codes_ds
  db[recovery_codes_table].where(recovery_codes_id_column=>session_value)
end

# File lib/rodauth/features/recovery_codes.rb, line 230
def recovery_codes_primary?
  (features & [:otp, :sms_codes]).empty?
end

# File lib/rodauth/features/recovery_codes.rb, line 184
def recovery_codes_remove
  recovery_codes_ds.delete
end

# File lib/rodauth/features/base.rb, line 318
def redirect(path)
  request.redirect(path)
end

# File lib/rodauth/features/remember.rb, line 193
def remember_key_ds(id=account_id)
  db[remember_table].where(remember_id_column=>id)
end

# File lib/rodauth/features/remember.rb, line 116
def remember_login
  get_remember_key
  opts = Hash[remember_cookie_options]
  opts[:value] = "#{account_id}_#{remember_key_value}"
  opts[:expires] = convert_timestamp(active_remember_key_ds.get(remember_deadline_column))
  ::Rack::Utils.set_cookie_header!(response.headers, remember_cookie_key, opts)
end

# File lib/rodauth/features/lockout.rb, line 240
def remove_lockout_metadata
  account_login_failures_ds.delete
  account_lockouts_ds.delete
end

# File lib/rodauth/features/remember.rb, line 154
def remove_remember_key(id=account_id)
  remember_key_ds(id).delete
end

# File lib/rodauth/features/reset_password.rb, line 157
def remove_reset_password_key
  password_reset_ds.delete
end

# File lib/rodauth/features/verify_account.rb, line 150
def remove_verify_account_key
  verify_account_ds.delete
end

# File lib/rodauth/features/verify_login_change.rb, line 93
def remove_verify_login_change_key
  verify_login_change_ds.delete
end

# File lib/rodauth/features/base.rb, line 270
def render(page)
  _view(:render, page)
end

# File lib/rodauth/features/base.rb, line 114
def request
  scope.request
end

# File lib/rodauth/features/base.rb, line 347
def require_account
  require_authentication
  require_account_session
end

# File lib/rodauth/features/base.rb, line 352
def require_account_session
  unless account_from_session
    clear_session
    login_required
  end
end

# File lib/rodauth/features/base.rb, line 228
def require_authentication
  require_login
end

# File lib/rodauth/features/password_expiration.rb, line 60
def require_current_password
  if authenticated? && password_expired? && password_change_needed_redirect != request.path_info
    set_redirect_error_flash password_expiration_error_flash
    redirect password_change_needed_redirect
  end
end

# File lib/rodauth/features/base.rb, line 220
def require_login
  login_required unless logged_in?
end

# File lib/rodauth/features/otp.rb, line 236
def require_otp_setup
  unless otp_exists?
    set_redirect_error_status(two_factor_not_setup_error_status)
    set_redirect_error_flash two_factor_not_setup_error_flash
    redirect two_factor_need_setup_redirect
  end
end

# File lib/rodauth/features/sms_codes.rb, line 357
def require_sms_available
  require_sms_setup

  if sms_locked_out?
    set_redirect_error_status(lockout_error_status)
    set_redirect_error_flash sms_lockout_error_flash
    redirect sms_lockout_redirect
  end
end

# File lib/rodauth/features/sms_codes.rb, line 349
def require_sms_not_setup
  if sms_setup?
    set_redirect_error_status(sms_already_setup_error_status)
    set_redirect_error_flash sms_already_setup_error_flash
    redirect sms_already_setup_redirect
  end
end

# File lib/rodauth/features/sms_codes.rb, line 341
def require_sms_setup
  unless sms_setup?
    set_redirect_error_status(two_factor_not_setup_error_status)
    set_redirect_error_flash sms_not_setup_error_flash
    redirect sms_needs_setup_redirect
  end
end

# File lib/rodauth/features/two_factor_base.rb, line 66
def require_two_factor_authenticated
  unless two_factor_authenticated?
    set_redirect_error_status(two_factor_need_authentication_error_status)
    set_redirect_error_flash two_factor_need_authentication_error_flash
    redirect _two_factor_auth_required_redirect
  end
end

# File lib/rodauth/features/two_factor_base.rb, line 58
def require_two_factor_not_authenticated
  if two_factor_authenticated?
    set_redirect_error_status(two_factor_already_authenticated_error_status)
    set_redirect_error_flash two_factor_already_authenticated_error_flash
    redirect two_factor_already_authenticated_redirect
  end
end

# File lib/rodauth/features/two_factor_base.rb, line 50
def require_two_factor_setup
  unless uses_two_factor_authentication?
    set_redirect_error_status(two_factor_not_setup_error_status)
    set_redirect_error_flash two_factor_not_setup_error_flash
    redirect two_factor_need_setup_redirect
  end
end

# File lib/rodauth/features/reset_password.rb, line 215
def reset_password_email_body
  render('reset-password-email')
end

# File lib/rodauth/features/reset_password.rb, line 169
def reset_password_email_link
  token_link(reset_password_route, reset_password_key_param, reset_password_key_value)
end

# File lib/rodauth/features/reset_password.rb, line 223
def reset_password_key_insert_hash
  hash = {reset_password_id_column=>account_id, reset_password_key_column=>reset_password_key_value}
  set_deadline_value(hash, reset_password_deadline_column, reset_password_deadline_interval)
  hash
end

# File lib/rodauth/features/reset_password.rb, line 183
def reset_password_request_link
  "<p><a href=\"#{prefix}/#{reset_password_request_route}\">Forgot Password?</a></p>"
end

# File lib/rodauth/features/single_session.rb, line 19
def reset_single_session_key
  if logged_in?
    single_session_ds.update(single_session_key_column=>random_key)
  end
end

# File lib/rodauth/features/base.rb, line 118
def response
  scope.response
end

# File lib/rodauth/features/base.rb, line 476
def retry_on_uniqueness_violation(&block)
  if raises_uniqueness_violation?(&block)
    yield
  end
end

# File lib/rodauth/features/jwt.rb, line 211
def return_json_response
  response.status ||= json_response_error_status if json_response[json_response_error_key]
  set_jwt
  response['Content-Type'] ||= json_response_content_type
  response.write(_json_response_body(json_response))
  request.halt
end

# File lib/rodauth/features/base.rb, line 130
def route!
  if meth = self.class.route_hash[request.remaining_path]
    send(meth)
  end

  nil
end

# File lib/rodauth/features/create_account.rb, line 106
def save_account
  id = nil
  raised = raises_uniqueness_violation?{id = db[accounts_table].insert(account)}

  if raised
    @login_requirement_message = 'already an account with this login'
  end

  if id
    account[account_id_column] = id
  end

  id && !raised
end

# File lib/rodauth/features/change_password_notify.rb, line 18
def send_password_changed_email
  create_password_changed_email.deliver!
end

# File lib/rodauth/features/reset_password.rb, line 165
def send_reset_password_email
  create_reset_password_email.deliver!
end

# File lib/rodauth/features/lockout.rb, line 201
def send_unlock_account_email
  @unlock_account_key_value = get_unlock_account_key
  create_unlock_account_email.deliver!
end

# File lib/rodauth/features/verify_account.rb, line 187
def send_verify_account_email
  create_verify_account_email.deliver!
end

# File lib/rodauth/features/verify_login_change.rb, line 105
def send_verify_login_change_email(login)
  create_verify_login_change_email(login).deliver!
end

# File lib/rodauth/features/base.rb, line 122
def session
  scope.session
end

# File lib/rodauth/features/session_expiration.rb, line 43
def session_expiration_redirect
  require_login_redirect
end

# File lib/rodauth/features/jwt.rb, line 116
def session_jwt
  JWT.encode(jwt_session_hash, jwt_secret, jwt_algorithm)
end

# File lib/rodauth/features/base.rb, line 152
def session_value
  session[session_key]
end

# File lib/rodauth/features/base.rb, line 512
def set_deadline_value(hash, column, interval)
  if set_deadline_values?
    # :nocov:
    hash[column] = Sequel.date_add(Sequel::CURRENT_TIMESTAMP, interval)
    # :nocov:
  end
end

# File lib/rodauth/features/base.rb, line 385
def set_deadline_values?
  db.database_type == :mysql
end

# File lib/rodauth/features/base.rb, line 204
def set_error_flash(message)
  flash.now[flash_error_key] = message
end

# File lib/rodauth/features/account_expiration.rb, line 48
def set_expired
  update_activity(account_id, account_activity_expired_column)
  after_account_expiration
end

# File lib/rodauth/features/base.rb, line 138
def set_field_error(field, error)
  (@field_errors ||= {})[field] = error
end

# File lib/rodauth/features/http_basic_auth.rb, line 53
def set_http_basic_auth_error_response
  response.status = 401
  response.headers["WWW-Authenticate"] = "Basic realm=\"#{http_basic_auth_realm}\""
end

# File lib/rodauth/features/jwt.rb, line 219
def set_jwt
  set_jwt_token(session_jwt)
end

# File lib/rodauth/features/jwt.rb, line 128
def set_jwt_token(token)
  response.headers['Authorization'] = token
end

# File lib/rodauth/features/password_grace_period.rb, line 41
def set_last_password_entry
  session[last_password_entry_session_key] = Time.now.to_i
end

# File lib/rodauth/features/create_account.rb, line 98
def set_new_account_password(password)
  account[account_password_hash_column] = password_hash(password)
end

# File lib/rodauth/features/base.rb, line 212
def set_notice_flash(message)
  flash[flash_notice_key] = message
end

# File lib/rodauth/features/base.rb, line 216
def set_notice_now_flash(message)
  flash.now[flash_notice_key] = message
end

# File lib/rodauth/features/disallow_password_reuse.rb, line 18
def set_password(password)
  hash = super
  add_previous_password_hash(hash)
  hash
end

# File lib/rodauth/features/base.rb, line 208
def set_redirect_error_flash(message)
  flash[flash_error_key] = message
end

# File lib/rodauth/features/base.rb, line 364
def set_redirect_error_status(status)
end

# File lib/rodauth/features/base.rb, line 367
def set_response_error_status(status)
  response.status = status
end

# File lib/rodauth/features/base.rb, line 520
def set_session_value(key, value)
  session[key] = value
end

# File lib/rodauth/features/base.rb, line 198
def set_title(title)
  if title_instance_variable
    scope.instance_variable_set(title_instance_variable, title)
  end
end

# File lib/rodauth/features/verify_account.rb, line 239
def setup_account_verification
  generate_verify_account_key_value
  create_verify_account_key
  send_verify_account_email
end

# File lib/rodauth/features/lockout.rb, line 245
def show_lockout_page
  set_response_error_status lockout_error_status
  set_error_flash login_lockout_error_flash
  response.write unlock_account_request_view
  request.halt
end

# File lib/rodauth/features/single_session.rb, line 81
def single_session_ds
  db[single_session_table].
    where(single_session_id_column=>session_value)
end

# File lib/rodauth/features/close_account.rb, line 79
def skip_status_checks?
  false
end

# File lib/rodauth/features/sms_codes.rb, line 422
def sms_auth_message(code)
  "SMS authentication code for #{request.host} is #{code}"
end

# File lib/rodauth/features/sms_codes.rb, line 464
def sms_available?
  sms && !sms_needs_confirmation? && !sms_locked_out?
end

# File lib/rodauth/features/sms_codes.rb, line 443
def sms_code
  sms[sms_code_column]
end

# File lib/rodauth/features/sms_codes.rb, line 447
def sms_code_issued_at
  convert_timestamp(sms[sms_issued_at_column])
end

# File lib/rodauth/features/sms_codes.rb, line 367
def sms_code_match?(code)
  return false unless sms_current_auth?
  timing_safe_eql?(code, sms_code)
end

# File lib/rodauth/features/sms_codes.rb, line 478
def sms_codes_primary?
  !features.include?(:otp)
end

# File lib/rodauth/features/recovery_codes.rb, line 165
def sms_confirm
  super if defined?(super)
  add_recovery_codes(recovery_codes_limit - recovery_codes.length)
end

# File lib/rodauth/features/sms_codes.rb, line 382
def sms_confirm_failure
  sms_ds.delete
end

# File lib/rodauth/features/sms_codes.rb, line 426
def sms_confirm_message(code)
  "SMS confirmation code for #{request.host} is #{code}"
end

# File lib/rodauth/features/sms_codes.rb, line 372
def sms_confirmation_match?(code)
  sms_needs_confirmation? && sms_code_match?(code)
end

# File lib/rodauth/features/sms_codes.rb, line 472
def sms_current_auth?
  sms_code && sms_code_issued_at + sms_code_allowed_seconds > Time.now
end

# File lib/rodauth/features/recovery_codes.rb, line 177
def sms_disable
  super if defined?(super)
  unless recovery_codes_primary?
    recovery_codes_remove
  end
end

# File lib/rodauth/features/sms_codes.rb, line 506
def sms_ds
  db[sms_codes_table].where(sms_id_column=>session_value)
end

# File lib/rodauth/features/sms_codes.rb, line 451
def sms_failures
  sms[sms_failures_column]
end

# File lib/rodauth/features/sms_codes.rb, line 468
def sms_locked_out?
  sms_failures >= sms_failure_limit
end

# File lib/rodauth/features/sms_codes.rb, line 418
def sms_lockout_redirect
  _two_factor_auth_required_redirect
end

# File lib/rodauth/features/sms_codes.rb, line 460
def sms_needs_confirmation?
  sms && sms_failures.nil?
end

# File lib/rodauth/features/sms_codes.rb, line 486
def sms_new_auth_code
  SecureRandom.random_number(10**sms_auth_code_length).to_s.rjust(sms_auth_code_length, "0")
end

# File lib/rodauth/features/sms_codes.rb, line 490
def sms_new_confirm_code
  SecureRandom.random_number(10**sms_confirm_code_length).to_s.rjust(sms_confirm_code_length, "0")
end

# File lib/rodauth/features/sms_codes.rb, line 482
def sms_normalize_phone(phone)
  phone.to_s.gsub(/\D+/, '')
end

# File lib/rodauth/features/sms_codes.rb, line 439
def sms_phone
  sms[sms_phone_column]
end

# File lib/rodauth/features/sms_codes.rb, line 434
def sms_record_failure
  update_sms(sms_failures_column=>Sequel.expr(sms_failures_column)+1)
  sms[sms_failures_column] = sms_ds.get(sms_failures_column)
end

# File lib/rodauth/features/sms_codes.rb, line 393
def sms_remove_failures
  update_sms(sms_failures_column => 0, sms_code_column => nil)
end

# File lib/rodauth/features/sms_codes.rb, line 494
def sms_send(phone, message)
  raise NotImplementedError, "sms_send needs to be defined in the Rodauth configuration for SMS sending to work"
end

# File lib/rodauth/features/sms_codes.rb, line 402
def sms_send_auth_code
  code = sms_new_auth_code
  sms_set_code(code)
  sms_send(sms_phone, sms_auth_message(code))
end

# File lib/rodauth/features/sms_codes.rb, line 408
def sms_send_confirm_code
  code = sms_new_confirm_code
  sms_set_code(code)
  sms_send(sms_phone, sms_confirm_message(code))
end

# File lib/rodauth/features/sms_codes.rb, line 430
def sms_set_code(code)
 update_sms(sms_code_column=>code, sms_issued_at_column=>Sequel::CURRENT_TIMESTAMP)
end

# File lib/rodauth/features/sms_codes.rb, line 386
def sms_setup(phone_number)
  # Cannot handle uniqueness violation here, as the phone number given may not match the
  # one in the table.
  sms_ds.insert(sms_id_column=>session_value, sms_phone_column=>phone_number)
  remove_instance_variable(:@sms) if instance_variable_defined?(:@sms)
end

# File lib/rodauth/features/sms_codes.rb, line 455
def sms_setup?
  return false unless sms
  !sms_needs_confirmation?
end

# File lib/rodauth/features/sms_codes.rb, line 414
def sms_valid_phone?(phone)
  phone.length >= sms_phone_min_length
end

# File lib/rodauth/features/email_base.rb, line 45
def split_token(token)
  token.split(token_separator, 2)
end

# File lib/rodauth/features/base.rb, line 445
def template_path(page)
  File.join(File.dirname(__FILE__), '../../../templates', "#{page}.str")
end

# File lib/rodauth/features/http_basic_auth.rb, line 58
def throw_basic_auth_error(*args)
  set_http_basic_auth_error_response
  throw_error(*args) 
end

# File lib/rodauth/features/base.rb, line 371
def throw_error(field, error)
  set_field_error(field, error)
  throw :rodauth_error
end

# File lib/rodauth/features/base.rb, line 376
def throw_error_status(status, field, error)
  set_response_error_status(status)
  throw_error(field, error)
end

# File lib/rodauth/features/base.rb, line 342
def timing_safe_eql?(provided, actual)
  provided = provided.to_s
  Rack::Utils.secure_compare(provided.ljust(actual.length), actual) && provided.length == actual.length
end