module Rodauth

    # File lib/rodauth/features/email_auth.rb
252 def _account_from_email_auth_key(token)
253   account_from_key(token, account_open_status_value){|id| get_email_auth_key(id)}
254 end

    # File lib/rodauth/features/base.rb
595 def _account_from_login(login)
596   ds = db[accounts_table].where(login_column=>login)
597   ds = ds.select(*account_select) if account_select
598   ds = ds.where(account_status_column=>[account_unverified_status_value, account_open_status_value]) unless skip_status_checks?
599   ds.first
600 end

   # File lib/rodauth/features/jwt_refresh.rb
88 def _account_from_refresh_token(token)
89   id, token_id, key = _account_refresh_token_split(token)
90 
91   return unless key
92   return unless actual = get_active_refresh_token(id, token_id)
93   return unless timing_safe_eql?(key, convert_token_key(actual))
94 
95   ds = account_ds(id)
96   ds = ds.where(account_status_column=>account_open_status_value) unless skip_status_checks?
97   ds.first
98 end

    # File lib/rodauth/features/reset_password.rb
265 def _account_from_reset_password_key(token)
266   account_from_key(token, account_open_status_value){|id| get_password_reset_key(id)}
267 end

    # File lib/rodauth/features/base.rb
602 def _account_from_session
603   ds = account_ds(session_value)
604   ds = ds.where(account_session_status_filter) unless skip_status_checks?
605   ds.first
606 end

    # File lib/rodauth/features/lockout.rb
304 def _account_from_unlock_key(token)
305   account_from_key(token){|id| account_lockouts_ds(id).get(account_lockouts_key_column)}
306 end

    # File lib/rodauth/features/verify_account.rb
322 def _account_from_verify_account_key(token)
323   account_from_key(token, account_unverified_status_value){|id| get_verify_account_key(id)}
324 end

    # File lib/rodauth/features/verify_login_change.rb
207 def _account_from_verify_login_change_key(token)
208   account_from_key(token) do |id|
209     @verify_login_change_new_login, key = get_verify_login_change_login_and_key(id)
210     key
211   end
212 end

    # File lib/rodauth/features/jwt_refresh.rb
100 def _account_refresh_token_split(token)
101   id, token = split_token(token)
102   return unless id && token
103 
104   token_id, key = split_token(token)
105   return unless token_id && key
106 
107   [id, token_id, key]
108 end

    # File lib/rodauth/features/email_auth.rb
186 def _email_auth_request
187   if email_auth_email_recently_sent?
188     set_redirect_error_flash email_auth_email_recently_sent_error_flash
189     redirect email_auth_email_recently_sent_redirect
190   end
191 
192   generate_email_auth_key_value
193   transaction do
194     before_email_auth_request
195     create_email_auth_key
196     send_email_auth_email
197     after_email_auth_request
198   end
199 
200   set_notice_flash email_auth_email_sent_notice_flash
201 end

    # File lib/rodauth/features/email_auth.rb
181 def _email_auth_request_and_redirect
182   _email_auth_request
183   redirect email_auth_email_sent_redirect
184 end

    # File lib/rodauth/features/base.rb
612 def _field_attributes(field)
613   nil
614 end

    # File lib/rodauth/features/base.rb
616 def _field_error_attributes(field)
617   " aria-invalid=\"true\" aria-describedby=\"#{field}_error_message\" "
618 end

    # File lib/rodauth/features/base.rb
620 def _formatted_field_error(field, error)
621   "<span class=\"#{input_field_error_message_class}\" id=\"#{field}_error_message\">#{error}</span>"
622 end

    # File lib/rodauth/features/jwt.rb
264 def _json_response_body(hash)
265   request.send(:convert_to_json, hash)
266 end

    # File lib/rodauth/features/login.rb
140 def _login(auth_type)
141   warn("Deprecated #_login method called, use #login instead.")
142   login(auth_type)
143 end

    # File lib/rodauth/features/login.rb
135 def _login_form_footer
136   return '' if _login_form_footer_links.empty?
137   render('login-form-footer')
138 end

    # File lib/rodauth/features/create_account.rb
115 def _login_form_footer_links
116   super << [10, create_account_path, create_account_link_text]
117 end

    # File lib/rodauth/features/email_auth.rb
171 def _multi_phase_login_forms
172   forms = super
173   forms << [30, email_auth_request_form, :_email_auth_request_and_redirect] if valid_login_entered? && allow_email_auth?
174   forms
175 end

    # File lib/rodauth/features/create_account.rb
119 def _new_account(login)
120   acc = {login_column=>login}
121   unless skip_status_checks?
122     acc[account_status_column] = account_initial_status_value
123   end
124   acc
125 end

    # File lib/rodauth/features/otp.rb
403 def _otp
404   otp_class.new(otp_user_key, :issuer=>otp_issuer, :digits=>otp_digits, :interval=>otp_interval)
405 end

    # File lib/rodauth/features/otp.rb
392 def _otp_add_key(secret)
393   # Uniqueness errors can't be handled here, as we can't be sure the secret provided
394   # is the same as the current secret.
395   otp_key_ds.insert(otp_keys_id_column=>session_value, otp_keys_column=>secret)
396 end

    # File lib/rodauth/features/otp.rb
398 def _otp_key
399   @otp_user_key = nil
400   otp_key_ds.get(otp_keys_column)
401 end

    # File lib/rodauth/features/otp.rb
386 def _otp_tmp_key(secret)
387   @otp_tmp_key = true
388   @otp_user_key = nil
389   @otp_key = secret
390 end

    # File lib/rodauth/features/recovery_codes.rb
230 def _recovery_codes
231   recovery_codes_ds.select_map(recovery_codes_column)
232 end

    # File lib/rodauth/features/sms_codes.rb
487 def _sms
488   sms_ds.first
489 end

   # File lib/rodauth/features/confirm_password.rb
78 def _two_factor_auth_links
79   links = (super if defined?(super)) || []
80   if authenticated_by.length == 1 && !authenticated_by.include?('password') && has_password?
81     links << [5, confirm_password_path, confirm_password_link_text]
82   end
83   links
84 end

    # File lib/rodauth/features/otp.rb
342 def _two_factor_remove_all_from_session
343   two_factor_remove_session('totp')
344   super
345 end

    # File lib/rodauth/features/otp.rb
336 def _two_factor_remove_links
337   links = super
338   links << [20, otp_disable_path, otp_disable_link_text] if otp_exists?
339   links
340 end

    # File lib/rodauth/features/otp.rb
330 def _two_factor_setup_links
331   links = super
332   links << [20, otp_setup_path, otp_setup_link_text] unless otp_exists?
333   links
334 end

   # File lib/rodauth/features/change_login.rb
80 def _update_login(login)
81   updated = nil
82   raised = raises_uniqueness_violation?{updated = update_account({login_column=>login}, account_ds.exclude(login_column=>login)) == 1}
83   if raised
84     @login_requirement_message = already_an_account_with_this_login_message
85   end
86   updated && !raised
87 end

    # File lib/rodauth/features/base.rb
740 def _view(meth, page)
741   scope.send(meth, _view_opts(page))
742 end

    # File lib/rodauth/features/base.rb
725 def _view_opts(page)
726   opts = template_opts.dup
727   opts[:locals] = opts[:locals] ? opts[:locals].dup : {}
728   opts[:locals][:rodauth] = self
729   opts[:cache] = cache_templates
730   opts[:cache_key] = :"rodauth_#{page}"
731 
732   opts = scope.send(:find_template, scope.send(:parse_template_opts, page, opts))
733   unless File.file?(scope.send(:template_path, opts))
734     opts[:path] = template_path(page)
735   end
736 
737   opts
738 end

    # File lib/rodauth/features/account_expiration.rb
104 def account_activity_ds(account_id)
105   db[account_activity_table].
106     where(account_activity_id_column=>account_id)
107 end

    # File lib/rodauth/features/base.rb
632 def account_ds(id=account_id)
633   raise ArgumentError, "invalid account id passed to account_ds" unless id
634   ds = db[accounts_table].where(account_id_column=>id)
635   ds = ds.select(*account_select) if account_select
636   ds
637 end

   # File lib/rodauth/features/account_expiration.rb
54 def account_expired?
55   columns = [account_activity_last_activity_column, account_activity_last_login_column, account_activity_expired_column]
56   last_activity, last_login, expired = account_activity_ds(account_id).get(columns)
57   return true if expired
58   timestamp = convert_timestamp(expire_account_on_last_activity? ? last_activity : last_login)
59   return false unless timestamp
60   timestamp < Time.now - expire_account_after
61 end

   # File lib/rodauth/features/account_expiration.rb
35 def account_expired_at
36   get_activity_timestamp(account_id, account_activity_expired_column)
37 end

    # File lib/rodauth/features/email_auth.rb
130 def account_from_email_auth_key(key)
131   @account = _account_from_email_auth_key(key)
132 end

   # File lib/rodauth/features/email_base.rb
61 def account_from_key(token, status_id=nil)
62   id, key = split_token(token)
63   return unless id && key
64 
65   return unless actual = yield(id)
66 
67   unless timing_safe_eql?(key, convert_email_token_key(actual))
68     if hmac_secret && allow_raw_email_token?
69       return unless timing_safe_eql?(key, actual)
70     else
71       return
72     end
73   end
74 
75   ds = account_ds(id)
76   ds = ds.where(account_status_column=>status_id) if status_id && !skip_status_checks?
77   ds.first
78 end

    # File lib/rodauth/features/base.rb
246 def account_from_login(login)
247   @account = _account_from_login(login)
248 end

   # File lib/rodauth/features/jwt_refresh.rb
82 def account_from_refresh_token(token)
83   @account = _account_from_refresh_token(token)
84 end

   # File lib/rodauth/features/password_expiration.rb
45 def account_from_reset_password_key(key)
46   if a = super
47     check_password_change_allowed
48   end
49   a
50 end

    # File lib/rodauth/features/base.rb
337 def account_from_session
338   @account = _account_from_session
339 end

    # File lib/rodauth/features/lockout.rb
214 def account_from_unlock_key(key)
215   @account = _account_from_unlock_key(key)
216 end

    # File lib/rodauth/features/verify_account.rb
203 def account_from_verify_account_key(key)
204   @account = _account_from_verify_account_key(key)
205 end

    # File lib/rodauth/features/verify_login_change.rb
117 def account_from_verify_login_change_key(key)
118   @account = _account_from_verify_login_change_key(key)
119 end

    # File lib/rodauth/features/base.rb
236 def account_id
237   account[account_id_column]
238 end

   # File lib/rodauth/features/verify_account_grace_period.rb
74 def account_in_unverified_grace_period?
75   account || account_from_session
76   account[account_status_column] == account_unverified_status_value &&
77     verify_account_grace_period &&
78     !verify_account_ds.where(Sequel.date_add(verification_requested_at_column, :seconds=>verify_account_grace_period) > Sequel::CURRENT_TIMESTAMP).empty?
79 end

    # File lib/rodauth/features/base.rb
333 def account_initial_status_value
334   account_open_status_value
335 end

    # File lib/rodauth/features/lockout.rb
300 def account_lockouts_ds(id=account_id)
301   db[account_lockouts_table].where(account_lockouts_id_column=>id)
302 end

    # File lib/rodauth/features/lockout.rb
296 def account_login_failures_ds
297   db[account_login_failures_table].where(account_login_failures_id_column=>account_id)
298 end

    # File lib/rodauth/features/base.rb
265 def account_password_hash_column
266   nil
267 end

    # File lib/rodauth/features/base.rb
624 def account_session_status_filter
625   {account_status_column=>account_open_status_value}
626 end

    # File lib/rodauth/features/webauthn.rb
262 def account_webauthn_ids
263   webauthn_keys_ds.select_map(webauthn_keys_webauthn_id_column)
264 end

    # File lib/rodauth/features/webauthn.rb
266 def account_webauthn_usage
267   webauthn_keys_ds.select_hash(webauthn_keys_webauthn_id_column, webauthn_keys_last_use_column)
268 end

    # File lib/rodauth/features/webauthn.rb
270 def account_webauthn_user_id
271   unless webauthn_id = webauthn_user_ids_ds.get(webauthn_user_ids_webauthn_id_column)
272     webauthn_id = WebAuthn.generate_user_id
273     if e = raised_uniqueness_violation do
274           webauthn_user_ids_ds.insert(
275             webauthn_user_ids_account_id_column => webauthn_account_id,
276             webauthn_user_ids_webauthn_id_column => webauthn_id
277           )
278         end
279       # If two requests to create a webauthn user id are sent at the same time and an insert
280       # is attempted for both, one will fail with a unique constraint violation.  In that case
281       # it is safe for the second one to use the webauthn user id inserted by the other request.
282       # If there is still no webauthn user id at this point, then we'll just reraise the
283       # exception.
284       # :nocov:
285       raise e unless webauthn_id = webauthn_user_ids_ds.get(webauthn_user_ids_webauthn_id_column)
286       # :nocov:
287     end
288   end
289 
290   webauthn_id
291 end

    # File lib/rodauth/features/remember.rb
200 def active_remember_key_ds(id=account_id)
201   remember_key_ds(id).where(Sequel.expr(remember_deadline_column) > Sequel::CURRENT_TIMESTAMP)
202 end

    # File lib/rodauth/features/active_sessions.rb
148 def active_sessions_ds
149   db[active_sessions_table].
150     where(active_sessions_account_id_column=>session_value)
151 end

   # File lib/rodauth/features/active_sessions.rb
59 def add_active_session
60   key = random_key
61   set_session_value(session_id_session_key, key)
62   if e = raises_uniqueness_violation? do
63       active_sessions_ds.insert(active_sessions_account_id_column => session_value, active_sessions_session_id_column => compute_hmac(key))
64     end
65     handle_duplicate_active_session_id(e)
66   end
67   nil
68 end

   # File lib/rodauth/features/audit_logging.rb
39 def add_audit_log(account_id, action)
40   if hash = audit_log_insert_hash(account_id, action)
41     audit_log_ds.insert(hash)
42   end
43 end

    # File lib/rodauth/features/base.rb
166 def add_field_error_class(field)
167   if field_error(field)
168     " #{input_field_error_class}"
169   end
170 end

   # File lib/rodauth/features/disallow_password_reuse.rb
25 def add_previous_password_hash(hash) 
26   ds = previous_password_ds
27   keep_before = ds.reverse(previous_password_id_column).
28     limit(nil, previous_passwords_to_check).
29     get(previous_password_id_column)
30 
31   if keep_before
32     ds.where(Sequel.expr(previous_password_id_column) <= keep_before).
33       delete
34   end
35 
36   # This should never raise uniqueness violations, as it uses a serial primary key
37   ds.insert(previous_password_account_id_column=>account_id, previous_password_hash_column=>hash)
38 end

    # File lib/rodauth/features/recovery_codes.rb
182 def add_recovery_code
183   # This should never raise uniqueness violations unless the recovery code is the same, and the odds of that
184   # are 1/256**32 assuming a good random number generator.  Still, attempt to handle that case by retrying
185   # on such a uniqueness violation.
186   retry_on_uniqueness_violation do
187     recovery_codes_ds.insert(recovery_codes_id_column=>session_value, recovery_codes_column=>new_recovery_code)
188   end
189 end

    # File lib/rodauth/features/recovery_codes.rb
172 def add_recovery_codes(number)
173   return if number <= 0
174   transaction do
175     number.times do
176       add_recovery_code
177     end
178   end
179   remove_instance_variable(:@recovery_codes)
180 end

    # File lib/rodauth/features/remember.rb
155 def add_remember_key
156   hash = {remember_id_column=>account_id, remember_key_column=>remember_key_value}
157   set_deadline_value(hash, remember_deadline_column, remember_deadline_interval)
158 
159   if e = raised_uniqueness_violation{remember_key_ds.insert(hash)}
160     # If inserting into the remember key table causes a violation, we can pull the
161     # existing row from the table.  If there is no invalid row, we can then reraise.
162     raise e unless @remember_key_value = active_remember_key_ds.get(remember_key_column)
163   end
164 end

    # File lib/rodauth/features/recovery_codes.rb
146 def add_webauthn_credential(_)
147   super if defined?(super)
148   auto_add_missing_recovery_codes
149 end

   # File lib/rodauth/features/change_password_notify.rb
31 def after_change_password
32   super
33   send_password_changed_email
34 end

    # File lib/rodauth/features/account_expiration.rb
 99 def after_close_account
100   super if defined?(super)
101   account_activity_ds(account_id).delete
102 end

   # File lib/rodauth/features/disallow_password_reuse.rb
72 def after_create_account
73   if account_password_hash_column && !(respond_to?(:verify_account_set_password?) && verify_account_set_password?)
74     add_previous_password_hash(password_hash(param(password_param)))
75   end
76   super if defined?(super)
77 end

    # File lib/rodauth/features/email_auth.rb
209 def after_login
210   # Remove the email auth key after any login, even if
211   # it is a password login.  This is done to invalidate
212   # the email login when a user has a password and requests
213   # email authentication, but then remembers their password
214   # and doesn't need the link.  At that point, the link
215   # that allows login access to the account becomes a
216   # security liability, and it is best to remove it.
217   remove_email_auth_key
218   super
219 end

    # File lib/rodauth/features/email_auth.rb
152 def after_login_entered_during_multi_phase_login
153   # If forcing email auth, just send the email link.
154   _email_auth_request_and_redirect if force_email_auth?
155 
156   super
157 end

    # File lib/rodauth/features/lockout.rb
254 def after_login_failure
255   invalid_login_attempted
256   super
257 end

    # File lib/rodauth/features/remember.rb
176 def after_logout
177   forget_login
178   super if defined?(super)
179 end

    # File lib/rodauth/features/active_sessions.rb
104 def after_refresh_token
105   super if defined?(super)
106   if prev_key = session[session_id_session_key]
107     key = random_key
108     set_session_value(session_id_session_key, key)
109     active_sessions_ds.
110       where(active_sessions_session_id_column => compute_hmac(prev_key)).
111       update(active_sessions_session_id_column => compute_hmac(key))
112   end
113 end

   # File lib/rodauth/features/password_grace_period.rb
39 def after_reset_password
40   super if defined?(super)
41   @last_password_entry = Time.now.to_i
42 end

    # File lib/rodauth/features/email_auth.rb
205 def allow_email_auth?
206   defined?(super) ? super : true
207 end

    # File lib/rodauth/features/verify_account.rb
169 def allow_resending_verify_account_email?
170   account[account_status_column] == account_unverified_status_value
171 end

    # File lib/rodauth/features/base.rb
273 def already_logged_in
274   nil
275 end

   # File lib/rodauth/features/audit_logging.rb
83 def audit_log_ds
84   ds = db[audit_logging_table]
85   # :nocov:
86   if db.database_type == :postgres
87   # :nocov:
88     # For PostgreSQL, use RETURNING NULL. This allows the feature
89     # to be used with INSERT but not SELECT permissions on the
90     # table, useful for audit logging where the database user
91     # the application is running as should not need to read the
92     # logs.
93     ds = ds.returning(nil)
94   end
95   ds
96 end

   # File lib/rodauth/features/audit_logging.rb
45 def audit_log_insert_hash(account_id, action)
46   if message = audit_log_message(action)
47     {
48       audit_logging_account_id_column => account_id,
49       audit_logging_message_column => message,
50       audit_logging_metadata_column => serialize_audit_log_metadata(audit_log_metadata(action))
51     }
52   end
53 end

   # File lib/rodauth/features/audit_logging.rb
63 def audit_log_message(action)
64   meth = :"audit_log_message_for_#{action}"
65   if respond_to?(meth, true)
66     send(meth)
67   else
68     audit_log_message_default(action)
69   end
70 end

   # File lib/rodauth/features/audit_logging.rb
59 def audit_log_message_default(action)
60   action.to_s
61 end

   # File lib/rodauth/features/audit_logging.rb
72 def audit_log_metadata(action)
73   meth = :"audit_log_metadata_for_#{action}"
74   if respond_to?(meth, true)
75     send(meth)
76   else
77     audit_log_metadata_default
78   end
79 end

    # File lib/rodauth/features/base.rb
117 def auth_class_eval(&block)
118   auth.class_eval(&block)
119 end

    # File lib/rodauth/features/base.rb
325 def authenticated?
326   logged_in?
327 end

    # File lib/rodauth/features/base.rb
408 def authenticated_by
409   session[authenticated_by_session_key]
410 end

    # File lib/rodauth/features/webauthn.rb
242 def authenticated_webauthn_id
243   session[authenticated_webauthn_id_session_key]
244 end

    # File lib/rodauth/features/recovery_codes.rb
224 def auto_add_missing_recovery_codes
225   if auto_add_recovery_codes?
226     add_recovery_codes(recovery_codes_limit - recovery_codes.length)
227   end
228 end

    # File lib/rodauth/features/base.rb
196 def autocomplete_for_field?(_param)
197   mark_input_fields_with_autocomplete?
198 end

    # File lib/rodauth/features/base.rb
421 def autologin_session(autologin_type)
422   login_session('autologin')
423   set_session_value(autologin_type_session_key, autologin_type)
424 end

    # File lib/rodauth/features/base.rb
417 def autologin_type
418   session[autologin_type_session_key]
419 end

    # File lib/rodauth/features/otp.rb
381 def base32_encode(data, length)
382   chars = 'abcdefghijklmnopqrstuvwxyz234567'
383   length.times.map{|i|chars[data[i].ord % 32]}.join
384 end

    # File lib/rodauth/features/base.rb
443 def base_url
444   request.base_url
445 end

   # File lib/rodauth/features/verify_account_grace_period.rb
47 def before_change_login_route
48   unless verified_account?
49     set_redirect_error_flash unverified_change_login_error_flash
50     redirect unverified_change_login_redirect
51   end
52   super if defined?(super)
53 end

   # File lib/rodauth/features/password_expiration.rb
90 def before_change_password_route
91   check_password_change_allowed
92   super
93 end

    # File lib/rodauth/features/lockout.rb
242 def before_login_attempt
243   if locked_out?
244     show_lockout_page
245   end
246   super
247 end

    # File lib/rodauth/features/active_sessions.rb
120 def before_logout
121   if param_or_nil(global_logout_param)
122     remove_all_active_sessions
123   else
124     remove_current_session
125   end
126   super
127 end

    # File lib/rodauth/features/jwt.rb
223 def before_otp_setup_route
224   super if defined?(super)
225   if use_jwt? && otp_keys_use_hmac? && !param_or_nil(otp_setup_raw_param)
226     _otp_tmp_key(otp_new_secret)
227     json_response[otp_setup_param] = otp_user_key
228     json_response[otp_setup_raw_param] = otp_key
229   end
230 end

   # File lib/rodauth/features/account_expiration.rb
79 def before_reset_password
80   check_account_expiration
81   super if defined?(super)
82 end

   # File lib/rodauth/features/account_expiration.rb
84 def before_reset_password_request
85   check_account_expiration
86   super if defined?(super)
87 end

    # File lib/rodauth/features/jwt.rb
153 def before_rodauth
154   if json_request?
155     if jwt_check_accept? && (accept = request.env['HTTP_ACCEPT']) && accept !~ json_accept_regexp
156       response.status = 406
157       json_response[json_response_error_key] = json_not_accepted_error_message
158       response['Content-Type'] ||= json_response_content_type
159       response.write(_json_response_body(json_response))
160       request.halt
161     end
162 
163     unless request.post?
164       response.status = 405
165       response.headers['Allow'] = 'POST'
166       json_response[json_response_error_key] = json_non_post_error_message
167       return_json_response
168     end
169   elsif only_json?
170     response.status = json_response_error_status
171     response.write non_json_request_error_message
172     request.halt
173   end
174 
175   super
176 end

   # File lib/rodauth/features/account_expiration.rb
89 def before_unlock_account
90   check_account_expiration
91   super if defined?(super)
92 end

   # File lib/rodauth/features/account_expiration.rb
94 def before_unlock_account_request
95   check_account_expiration
96   super if defined?(super)
97 end

   # File lib/rodauth/features/webauthn_verify_account.rb
30 def before_verify_account
31   super
32   if features.include?(:jwt) && use_jwt? && !param_or_nil(webauthn_setup_param)
33     cred = new_webauthn_credential
34     json_response[webauthn_setup_param] = cred.as_json
35     json_response[webauthn_setup_challenge_param] = cred.challenge
36     json_response[webauthn_setup_challenge_hmac_param] = compute_hmac(cred.challenge)
37   end
38   @webauthn_credential = webauthn_setup_credential_from_form_submission
39   add_webauthn_credential(@webauthn_credential)
40 end

    # File lib/rodauth/features/jwt.rb
178 def before_view_recovery_codes
179   super if defined?(super)
180   if use_jwt?
181     json_response[:codes] = recovery_codes
182     json_response[json_response_success_key] ||= "" if include_success_messages?
183   end
184 end

    # File lib/rodauth/features/jwt.rb
196 def before_webauthn_auth_route
197   super if defined?(super)
198   if use_jwt? && !param_or_nil(webauthn_auth_param)
199     cred = webauth_credential_options_for_get
200     json_response[webauthn_auth_param] = cred.as_json
201     json_response[webauthn_auth_challenge_param] = cred.challenge
202     json_response[webauthn_auth_challenge_hmac_param] = compute_hmac(cred.challenge)
203   end
204 end

    # File lib/rodauth/features/jwt.rb
206 def before_webauthn_login_route
207   super if defined?(super)
208   if use_jwt? && !param_or_nil(webauthn_auth_param) && account_from_login(param(login_param))
209     cred = webauth_credential_options_for_get
210     json_response[webauthn_auth_param] = cred.as_json
211     json_response[webauthn_auth_challenge_param] = cred.challenge
212     json_response[webauthn_auth_challenge_hmac_param] = compute_hmac(cred.challenge)
213   end
214 end

    # File lib/rodauth/features/jwt.rb
216 def before_webauthn_remove_route
217   super if defined?(super)
218   if use_jwt? && !param_or_nil(webauthn_remove_param)
219     json_response[webauthn_remove_param] = account_webauthn_usage
220   end
221 end

    # File lib/rodauth/features/jwt.rb
186 def before_webauthn_setup_route
187   super if defined?(super)
188   if use_jwt? && !param_or_nil(webauthn_setup_param)
189     cred = new_webauthn_credential
190     json_response[webauthn_setup_param] = cred.as_json
191     json_response[webauthn_setup_challenge_param] = cred.challenge
192     json_response[webauthn_setup_challenge_hmac_param] = compute_hmac(cred.challenge)
193   end
194 end

    # File lib/rodauth/features/base.rb
366 def button(value, opts={})
367   scope.render(button_opts(value, opts))
368 end

    # File lib/rodauth/features/base.rb
357 def button_opts(value, opts)
358   opts = Hash[template_opts].merge!(opts)
359   opts[:locals] = {:value=>value, :opts=>opts}
360   opts[:path] = template_path('button')
361   opts[:cache] = cache_templates
362   opts[:cache_key] = :rodauth_button
363   opts
364 end

    # File lib/rodauth/features/recovery_codes.rb
168 def can_add_recovery_codes?
169   recovery_codes.length < recovery_codes_limit
170 end

    # File lib/rodauth/features/base.rb
516 def catch_error(&block)
517   catch(:rodauth_error, &block)
518 end

   # File lib/rodauth/features/change_login.rb
65 def change_login(login)
66   if account_ds.get(login_column).downcase == login.downcase
67     @login_requirement_message = 'same as current login'
68     return false
69   end
70 
71   update_login(login)
72 end

    # File lib/rodauth/features/verify_login_change.rb
133 def change_login_notice_flash
134   "An email has been sent to you with a link to verify your login change"
135 end

   # File lib/rodauth/features/change_login.rb
61 def change_login_requires_password?
62   modifications_require_password?
63 end

   # File lib/rodauth/features/change_password.rb
66 def change_password_requires_password?
67   modifications_require_password?
68 end

   # File lib/rodauth/features/account_expiration.rb
63 def check_account_expiration
64   if account_expired?
65     set_expired unless account_expired_at
66     set_redirect_error_flash account_expiration_error_flash
67     redirect account_expiration_redirect
68   end
69   update_last_login
70 end

   # File lib/rodauth/features/active_sessions.rb
46 def check_active_session
47   if logged_in? && !currently_active_session?
48     no_longer_active_session
49   end
50 end

    # File lib/rodauth/features/base.rb
269 def check_already_logged_in
270   already_logged_in if logged_in?
271 end

    # File lib/rodauth/features/base.rb
341 def check_csrf
342   scope.check_csrf!(check_csrf_opts, &check_csrf_block)
343 end

    # File lib/rodauth/features/base.rb
561 def check_csrf?
562   scope.opts[:rodauth_route_csrf]
563 end

   # File lib/rodauth/features/password_expiration.rb
30 def check_password_change_allowed
31   if password_changed_at = get_password_changed_at
32     if password_changed_at > Time.now - allow_password_change_after
33       set_redirect_error_flash password_not_changeable_yet_error_flash
34       redirect password_not_changeable_yet_redirect
35     end
36   end
37 end

   # File lib/rodauth/features/session_expiration.rb
15 def check_session_expiration
16   return unless logged_in?
17 
18   unless session.has_key?(session_last_activity_session_key) && session.has_key?(session_created_session_key)
19     if session_expiration_default
20       expire_session
21     end
22 
23     return
24   end
25 
26   time = Time.now.to_i
27 
28   if session[session_last_activity_session_key] + session_inactivity_timeout < time
29     expire_session
30   end
31   set_session_value(session_last_activity_session_key, time)
32 
33   if session[session_created_session_key] + max_session_lifetime < time
34     expire_session
35   end
36 end

   # File lib/rodauth/features/single_session.rb
51 def check_single_session
52   if logged_in? && !currently_active_session?
53     no_longer_active_session
54   end
55 end

    # File lib/rodauth/features/otp.rb
347 def clear_cached_otp
348   remove_instance_variable(:@otp) if defined?(@otp)
349 end

    # File lib/rodauth/features/lockout.rb
164 def clear_invalid_login_attempts
165   unlock_account
166 end

    # File lib/rodauth/features/base.rb
285 def clear_session
286   if scope.respond_to?(:clear_session)
287     scope.clear_session
288   else
289     session.clear
290   end
291 end

   # File lib/rodauth/features/close_account.rb
64 def close_account
65   unless skip_status_checks?
66     update_account(account_status_column=>account_closed_status_value)
67   end
68 
69   unless account_password_hash_column
70     password_hash_ds.delete
71   end
72 end

   # File lib/rodauth/features/close_account.rb
60 def close_account_requires_password?
61   modifications_require_password?
62 end

    # File lib/rodauth/features/base.rb
230 def compute_hmac(data)
231   s = [compute_raw_hmac(data)].pack('m').chomp!("=\n")
232   s.tr!('+/', '-_')
233   s
234 end

    # File lib/rodauth/features/base.rb
608 def compute_raw_hmac(data)
609   OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, hmac_secret, data)
610 end

   # File lib/rodauth/features/confirm_password.rb
62 def confirm_password
63   authenticated_by.delete('autologin')
64   authenticated_by.delete('remember')
65   authenticated_by.delete('email_auth')
66   authenticated_by.delete('password')
67   authenticated_by.unshift("password")
68   remove_session_value(autologin_type_session_key)
69   nil
70 end

   # File lib/rodauth/features/confirm_password.rb
72 def confirm_password_redirect
73   remove_session_value(confirm_password_redirect_session_key) || default_redirect
74 end

   # File lib/rodauth/features/email_base.rb
57 def convert_email_token_key(key)
58   convert_token_key(key)
59 end

    # File lib/rodauth/features/base.rb
495 def convert_session_key(key)
496   scope.opts[:sessions_convert_symbols] ? key.to_s : key
497 end

    # File lib/rodauth/features/base.rb
644 def convert_timestamp(timestamp)
645   timestamp = db.to_application_timestamp(timestamp) if timestamp.is_a?(String)
646   timestamp
647 end

    # File lib/rodauth/features/base.rb
461 def convert_token_key(key)
462   if key && hmac_secret
463     compute_hmac(key)
464   else
465     key
466   end
467 end

    # File lib/rodauth/features/verify_account.rb
227 def create_account_autologin?
228   false
229 end

    # File lib/rodauth/features/verify_account.rb
189 def create_account_notice_flash
190   verify_account_email_sent_notice_flash
191 end

    # File lib/rodauth/features/verify_account.rb
231 def create_account_set_password?
232   return false if verify_account_set_password?
233   super
234 end

   # File lib/rodauth/features/email_base.rb
32 def create_email(subject, body)
33   create_email_to(email_to, subject, body)
34 end

    # File lib/rodauth/features/email_auth.rb
230 def create_email_auth_email
231   create_email(email_auth_email_subject, email_auth_email_body)
232 end

    # File lib/rodauth/features/email_auth.rb
101 def create_email_auth_key
102   transaction do
103     if email_auth_key_value = get_email_auth_key(account_id)
104       set_email_auth_email_last_sent
105       @email_auth_key_value = email_auth_key_value
106     elsif e = raised_uniqueness_violation{email_auth_ds.insert(email_auth_key_insert_hash)}
107       # If inserting into the email auth table causes a violation, we can pull the
108       # existing email auth key from the table, or reraise.
109       raise e unless @email_auth_key_value = get_email_auth_key(account_id)
110     end
111   end
112 end

   # File lib/rodauth/features/email_base.rb
36 def create_email_to(to, subject, body)
37   m = Mail.new
38   m.from = email_from
39   m.to = to
40   m.subject = "#{email_subject_prefix}#{subject}"
41   m.body = body
42   m
43 end

   # File lib/rodauth/features/change_password_notify.rb
23 def create_password_changed_email
24   create_email(password_changed_email_subject, password_changed_email_body)
25 end

    # File lib/rodauth/features/reset_password.rb
239 def create_reset_password_email
240   create_email(reset_password_email_subject, reset_password_email_body)
241 end

    # File lib/rodauth/features/reset_password.rb
164 def create_reset_password_key
165   transaction do
166     if reset_password_key_value = get_password_reset_key(account_id)
167       set_reset_password_email_last_sent
168       @reset_password_key_value = reset_password_key_value
169     elsif e = raised_uniqueness_violation{password_reset_ds.insert(reset_password_key_insert_hash)}
170       # If inserting into the reset password table causes a violation, we can pull the
171       # existing reset password key from the table, or reraise.
172       raise e unless @reset_password_key_value = get_password_reset_key(account_id)
173     end
174   end
175 end

    # File lib/rodauth/features/lockout.rb
280 def create_unlock_account_email
281   create_email(unlock_account_email_subject, unlock_account_email_body)
282 end

    # File lib/rodauth/features/verify_account.rb
310 def create_verify_account_email
311   create_email(verify_account_email_subject, verify_account_email_body)
312 end

    # File lib/rodauth/features/verify_account.rb
293 def create_verify_account_key
294   ds = verify_account_ds
295   transaction do
296     if ds.empty?
297       if e = raised_uniqueness_violation{ds.insert(verify_account_key_insert_hash)}
298         # If inserting into the verify account table causes a violation, we can pull the
299         # key from the verify account table, or reraise.
300         raise e unless @verify_account_key_value = get_verify_account_key(account_id)
301       end
302     end
303   end
304 end

    # File lib/rodauth/features/verify_login_change.rb
195 def create_verify_login_change_email(login)
196   create_email_to(login, verify_login_change_email_subject, verify_login_change_email_body)
197 end

    # File lib/rodauth/features/verify_login_change.rb
173 def create_verify_login_change_key(login)
174   ds = verify_login_change_ds
175   transaction do
176     ds.where((Sequel::CURRENT_TIMESTAMP > verify_login_change_deadline_column) | ~Sequel.expr(verify_login_change_login_column=>login)).delete
177     if e = raised_uniqueness_violation{ds.insert(verify_login_change_key_insert_hash(login))}
178       old_login, key = get_verify_login_change_login_and_key(account_id)
179       # If inserting into the verify login change table causes a violation, we can pull the
180       # key from the verify login change table if the logins match, or reraise.
181       @verify_login_change_key_value = if old_login.downcase == login.downcase
182         key
183       end
184       raise e unless @verify_login_change_key_value
185     end
186   end
187 end

    # File lib/rodauth/features/base.rb
345 def csrf_tag(path=request.path)
346   return unless scope.respond_to?(:csrf_tag)
347 
348   if use_request_specific_csrf_tokens?
349     scope.csrf_tag(path)
350   else
351     # :nocov:
352     scope.csrf_tag
353     # :nocov:
354   end
355 end

   # File lib/rodauth/features/active_sessions.rb
32 def currently_active_session?
33   return false unless session_id = session[session_id_session_key]
34 
35   remove_inactive_sessions
36   ds = active_sessions_ds.
37     where(active_sessions_session_id_column => compute_hmac(session_id))
38 
39   if session_inactivity_deadline
40     ds.update(active_sessions_last_use_column => Sequel::CURRENT_TIMESTAMP) == 1
41   else
42     ds.count == 1
43   end
44 end

    # File lib/rodauth/features/base.rb
254 def db
255   Sequel::DATABASES.first
256 end

   # File lib/rodauth/features/close_account.rb
74 def delete_account
75   account_ds.delete
76 end

   # File lib/rodauth/features/close_account.rb
78 def delete_account_on_close?
79   skip_status_checks?
80 end

    # File lib/rodauth/features/remember.rb
151 def disable_remember_login
152   remove_remember_key
153 end

    # File lib/rodauth/features/base.rb
447 def domain
448   request.host
449 end

    # File lib/rodauth/features/email_auth.rb
248 def email_auth_ds(id=account_id)
249   db[email_auth_table].where(email_auth_id_column=>id)
250 end

    # File lib/rodauth/features/email_auth.rb
234 def email_auth_email_body
235   render('email-auth-email')
236 end

    # File lib/rodauth/features/email_auth.rb
138 def email_auth_email_link
139   token_link(email_auth_route, email_auth_key_param, email_auth_key_value)
140 end

    # File lib/rodauth/features/email_auth.rb
177 def email_auth_email_recently_sent?
178   (email_last_sent = get_email_auth_email_last_sent) && (Time.now - email_last_sent < email_auth_skip_resend_email_within)
179 end

    # File lib/rodauth/features/email_auth.rb
242 def email_auth_key_insert_hash
243   hash = {email_auth_id_column=>account_id, email_auth_key_column=>email_auth_key_value}
244   set_deadline_value(hash, email_auth_deadline_column, email_auth_deadline_interval)
245   hash
246 end

    # File lib/rodauth/features/email_auth.rb
148 def email_auth_request_form
149   render('email-auth-request-form')
150 end

   # File lib/rodauth/features/email_base.rb
45 def email_from
46   "webmaster@#{domain}"
47 end

   # File lib/rodauth/features/email_base.rb
49 def email_to
50   account[login_column]
51 end

   # File lib/rodauth/features/session_expiration.rb
38 def expire_session
39   clear_session
40   set_redirect_error_status session_expiration_error_status
41   set_redirect_error_flash session_expiration_error_flash
42   redirect session_expiration_redirect
43 end

    # File lib/rodauth/features/base.rb
129 def features
130   self.class.features
131 end

    # File lib/rodauth/features/base.rb
204 def field_attributes(field)
205   _field_attributes(field) || default_field_attributes
206 end

    # File lib/rodauth/features/base.rb
161 def field_error(field)
162   return nil unless @field_errors
163   @field_errors[field]
164 end

    # File lib/rodauth/features/base.rb
208 def field_error_attributes(field)
209   if field_error(field)
210     _field_error_attributes(field)
211   end
212 end

    # File lib/rodauth/features/base.rb
145 def flash
146   scope.flash
147 end

    # File lib/rodauth/features/remember.rb
136 def forget_login
137   ::Rack::Utils.delete_cookie_header!(response.headers, remember_cookie_key, remember_cookie_options)
138 end

    # File lib/rodauth/features/base.rb
214 def formatted_field_error(field)
215   if error = field_error(field)
216     _formatted_field_error(field, error)
217   end
218 end

    # File lib/rodauth/features/base.rb
565 def function_name(name)
566   if db.database_type == :mssql
567     # :nocov:
568     "dbo.#{name}"
569     # :nocov:
570   else
571     name
572   end
573 end

    # File lib/rodauth/features/email_auth.rb
226 def generate_email_auth_key_value
227   @email_auth_key_value = random_key
228 end

    # File lib/rodauth/features/jwt_refresh.rb
138 def generate_refresh_token
139   hash = jwt_refresh_token_insert_hash
140   [account_id, jwt_refresh_token_ds.insert(hash), convert_token_key(hash[jwt_refresh_token_key_column])].join(token_separator)
141 end

    # File lib/rodauth/features/remember.rb
188 def generate_remember_key_value
189   @remember_key_value = random_key
190 end

    # File lib/rodauth/features/reset_password.rb
235 def generate_reset_password_key_value
236   @reset_password_key_value = random_key
237 end

    # File lib/rodauth/features/lockout.rb
264 def generate_unlock_account_key
265   random_key
266 end

    # File lib/rodauth/features/verify_account.rb
289 def generate_verify_account_key_value
290   @verify_account_key_value = random_key
291 end

    # File lib/rodauth/features/verify_login_change.rb
169 def generate_verify_login_change_key_value
170   @verify_login_change_key_value = random_key
171 end

    # File lib/rodauth/features/jwt_refresh.rb
110 def get_active_refresh_token(account_id, token_id)
111   jwt_refresh_token_account_ds(account_id).
112     where(Sequel::CURRENT_TIMESTAMP > jwt_refresh_token_deadline_column).
113     delete
114 
115   jwt_refresh_token_account_token_ds(account_id, token_id).
116     get(jwt_refresh_token_key_column)
117 end

    # File lib/rodauth/features/account_expiration.rb
109 def get_activity_timestamp(account_id, column)
110   convert_timestamp(account_activity_ds(account_id).get(column))
111 end

    # File lib/rodauth/features/email_auth.rb
118 def get_email_auth_email_last_sent
119   if column = email_auth_email_last_sent_column
120     if ts = email_auth_ds.get(column)
121       convert_timestamp(ts)
122     end
123   end
124 end

    # File lib/rodauth/features/email_auth.rb
142 def get_email_auth_key(id)
143   ds = email_auth_ds(id)
144   ds.where(Sequel::CURRENT_TIMESTAMP > email_auth_deadline_column).delete
145   ds.get(email_auth_key_column)
146 end

   # File lib/rodauth/features/password_expiration.rb
26 def get_password_changed_at
27   convert_timestamp(password_expiration_ds.get(password_expiration_changed_at_column))
28 end

    # File lib/rodauth/features/base.rb
583 def get_password_hash
584   if account_password_hash_column
585     (account || account_from_session)[account_password_hash_column]
586   elsif use_database_authentication_functions?
587     db.get(Sequel.function(function_name(:rodauth_get_salt), account ? account_id : session_value))
588   else
589     # :nocov:
590     password_hash_ds.get(password_hash_column)
591     # :nocov:
592   end
593 end

    # File lib/rodauth/features/reset_password.rb
193 def get_password_reset_key(id)
194   ds = password_reset_ds(id)
195   ds.where(Sequel::CURRENT_TIMESTAMP > reset_password_deadline_column).delete
196   ds.get(reset_password_key_column)
197 end

    # File lib/rodauth/features/remember.rb
140 def get_remember_key
141   unless @remember_key_value = active_remember_key_ds.get(remember_key_column)
142    generate_remember_key_value
143    transaction do
144      remove_remember_key
145      add_remember_key
146    end
147   end
148   nil
149 end

    # File lib/rodauth/features/reset_password.rb
203 def get_reset_password_email_last_sent
204   if column = reset_password_email_last_sent_column
205     if ts = password_reset_ds.get(column)
206       convert_timestamp(ts)
207     end
208   end
209 end

    # File lib/rodauth/features/lockout.rb
226 def get_unlock_account_email_last_sent
227   if column = account_lockouts_email_last_sent_column
228     if ts = account_lockouts_ds.get(column)
229       convert_timestamp(ts)
230     end
231   end
232 end

    # File lib/rodauth/features/lockout.rb
210 def get_unlock_account_key
211   account_lockouts_ds.get(account_lockouts_key_column)
212 end

    # File lib/rodauth/features/verify_account.rb
240 def get_verify_account_email_last_sent
241   if column = verify_account_email_last_sent_column
242     if ts = verify_account_ds.get(column)
243       convert_timestamp(ts)
244     end
245   end
246 end

    # File lib/rodauth/features/verify_account.rb
219 def get_verify_account_key(id)
220   verify_account_ds(id).get(verify_account_key_column)
221 end

    # File lib/rodauth/features/verify_login_change.rb
129 def get_verify_login_change_login_and_key(id)
130   verify_login_change_ds(id).get([verify_login_change_login_column, verify_login_change_key_column])
131 end

   # File lib/rodauth/features/active_sessions.rb
70 def handle_duplicate_active_session_id(_e)
71   # Do nothing by default as session is already tracked.  This will result in
72   # the current session and the existing session with the same id
73   # being tracked together, so that a logout of one will logout
74   # the other, and updating the last use on one will update the other,
75   # but this should be acceptable.  However, this can be overridden if different
76   # behavior is desired.
77 end

    # File lib/rodauth/features/webauthn.rb
344 def handle_webauthn_sign_count_verification_error
345   throw_error_status(invalid_field_error_status, webauthn_auth_param, webauthn_invalid_sign_count_message) 
346 end

    # File lib/rodauth/features/base.rb
575 def has_password?
576   return @has_password if defined?(@has_password)
577   return false unless account || session_value
578   @has_password = !!get_password_hash
579 end

   # File lib/rodauth/features/audit_logging.rb
31 def hook_action(hook_type, action)
32   super
33   # In after_logout, session is already cleared, so use before_logout in that case
34   if (hook_type == :after || action == :logout) && (id = account ? account_id : session_value)
35     add_audit_log(id, action)
36   end
37 end

   # File lib/rodauth/features/http_basic_auth.rb
34 def http_basic_auth
35   return @checked_http_basic_auth if defined?(@checked_http_basic_auth)
36 
37   @checked_http_basic_auth = nil
38   return unless token = ((v = request.env['HTTP_AUTHORIZATION']) && v[/\A *Basic (.*)\Z/, 1])
39 
40   username, password = token.unpack("m*").first.split(/:/, 2)
41   return unless username && password
42 
43   catch_error do
44     unless account_from_login(username)
45       throw_basic_auth_error(login_param, no_matching_login_message)
46     end
47 
48     before_login_attempt
49 
50     unless open_account?
51       throw_basic_auth_error(login_param, no_matching_login_message)
52     end
53 
54     unless password_match?(password)
55       after_login_failure
56       throw_basic_auth_error(password_param, invalid_password_message)
57     end
58 
59     transaction do
60       before_login
61       login_session('password')
62       after_login
63     end
64 
65     @checked_http_basic_auth = true
66     return true
67   end
68 
69   nil
70 end

    # File lib/rodauth/features/active_sessions.rb
141 def inactive_session_cond
142   cond = session_inactivity_deadline_condition
143   cond2 = session_lifetime_deadline_condition
144   return false unless cond || cond2
145   Sequel.|(*[cond, cond2].compact)
146 end

    # File lib/rodauth/features/jwt.rb
244 def include_success_messages?
245   !json_response_success_key.nil?
246 end

    # File lib/rodauth/features/base.rb
172 def input_field_string(param, id, opts={})
173   type = opts.fetch(:type, "text")
174 
175   unless type == "password"
176     value = opts.fetch(:value){scope.h param(param)}
177   end
178 
179   field_class = opts.fetch(:class, "form-control")
180 
181   if autocomplete_for_field?(param) && opts[:autocomplete]
182     autocomplete = "autocomplete=\"#{opts[:autocomplete]}\""
183   end
184 
185   if inputmode_for_field?(param) && opts[:inputmode]
186     inputmode = "inputmode=\"#{opts[:inputmode]}\""
187   end
188 
189   if mark_input_fields_as_required? && opts[:required] != false
190     required = "required=\"required\""
191   end
192 
193   "<input #{opts[:attr]} #{autocomplete} #{inputmode} #{required} #{field_attributes(param)} #{field_error_attributes(param)} type=\"#{type}\" class=\"#{field_class}#{add_field_error_class(param)}\" name=\"#{param}\" id=\"#{id}\" value=\"#{value}\"/> #{formatted_field_error(param) unless opts[:skip_error_message]}"
194 end

    # File lib/rodauth/features/base.rb
200 def inputmode_for_field?(_param)
201   mark_input_fields_with_inputmode?
202 end

    # File lib/rodauth/features/lockout.rb
168 def invalid_login_attempted
169   ds = account_login_failures_ds.
170       where(account_login_failures_id_column=>account_id)
171 
172   number = if db.database_type == :postgres
173     ds.returning(account_login_failures_number_column).
174       with_sql(:update_sql, account_login_failures_number_column=>Sequel.expr(account_login_failures_number_column)+1).
175       single_value
176   else
177     # :nocov:
178     if ds.update(account_login_failures_number_column=>Sequel.expr(account_login_failures_number_column)+1) > 0
179       ds.get(account_login_failures_number_column)
180     end
181     # :nocov:
182   end
183 
184   unless number
185     # Ignoring the violation is safe here.  It may allow slightly more than max_invalid_logins invalid logins before
186     # lockout, but allowing a few extra is OK if the race is lost.
187     ignore_uniqueness_violation{account_login_failures_ds.insert(account_login_failures_id_column=>account_id)}
188     number = 1
189   end
190 
191   if number >= max_invalid_logins
192     @unlock_account_key_value = generate_unlock_account_key
193     hash = {account_lockouts_id_column=>account_id, account_lockouts_key_column=>unlock_account_key_value}
194     set_deadline_value(hash, account_lockouts_deadline_column, account_lockouts_deadline_interval)
195 
196     if e = raised_uniqueness_violation{account_lockouts_ds.insert(hash)}
197       # If inserting into the lockout table raises a violation, we should just be able to pull the already inserted
198       # key out of it.  If that doesn't return a valid key, we should reraise the error.
199       raise e unless @unlock_account_key_value = account_lockouts_ds.get(account_lockouts_key_column)
200 
201       after_account_lockout
202       show_lockout_page
203     else
204       after_account_lockout
205       e
206     end
207   end
208 end