module Rodauth

    # File lib/rodauth/features/email_auth.rb
236 def _account_from_email_auth_key(token)
237   account_from_key(token, account_open_status_value){|id| get_email_auth_key(id)}
238 end

    # File lib/rodauth/features/base.rb
725 def _account_from_login(login)
726   ds = account_table_ds.where(login_column=>login)
727   ds = ds.select(*account_select) if account_select
728   ds = ds.where(account_status_column=>[account_unverified_status_value, account_open_status_value]) unless skip_status_checks?
729   ds.first
730 end

    # File lib/rodauth/features/jwt_refresh.rb
111 def _account_from_refresh_token(token)
112   id, token_id, key = _account_refresh_token_split(token)
113 
114   unless key &&
115          (id.to_s == session_value.to_s) &&
116          (actual = get_active_refresh_token(id, token_id)) &&
117          (timing_safe_eql?(key, convert_token_key(actual)) || (hmac_secret_rotation? && timing_safe_eql?(key, compute_old_hmac(actual)))) &&
118          jwt_refresh_token_match?(key)
119     return
120   end
121 
122   ds = account_ds(id)
123   ds = ds.where(account_session_status_filter) unless skip_status_checks?
124   ds.first
125 end

    # File lib/rodauth/features/reset_password.rb
253 def _account_from_reset_password_key(token)
254   account_from_key(token, account_open_status_value){|id| get_password_reset_key(id)}
255 end

    # File lib/rodauth/features/base.rb
732 def _account_from_session
733   ds = account_ds(session_value)
734   ds = ds.where(account_session_status_filter) unless skip_status_checks?
735   ds.first
736 end

    # File lib/rodauth/features/lockout.rb
297 def _account_from_unlock_key(token)
298   account_from_key(token){|id| account_lockouts_ds(id).get(account_lockouts_key_column)}
299 end

    # File lib/rodauth/features/verify_account.rb
302 def _account_from_verify_account_key(token)
303   account_from_key(token, account_unverified_status_value){|id| get_verify_account_key(id)}
304 end

    # File lib/rodauth/features/verify_login_change.rb
210 def _account_from_verify_login_change_key(token)
211   account_from_key(token) do |id|
212     @verify_login_change_new_login, key = get_verify_login_change_login_and_key(id)
213     key
214   end
215 end

    # File lib/rodauth/features/jwt_refresh.rb
127 def _account_refresh_token_split(token)
128   id, token = split_token(token)
129   id = convert_token_id(id)
130   return unless id && token
131 
132   token_id, key = split_token(token)
133   token_id = convert_token_id(token_id)
134   return unless token_id && key
135 
136   [id, token_id, key]
137 end

    # File lib/rodauth/features/base.rb
531 def _around_rodauth
532   yield
533 end

    # File lib/rodauth/features/email_auth.rb
178 def _email_auth_request
179   if email_auth_email_recently_sent?
180     set_redirect_error_flash email_auth_email_recently_sent_error_flash
181     redirect email_auth_email_recently_sent_redirect
182   end
183 
184   generate_email_auth_key_value
185   transaction do
186     before_email_auth_request
187     create_email_auth_key
188     send_email_auth_email
189     after_email_auth_request
190   end
191 
192   email_auth_email_sent_response
193 end

    # File lib/rodauth/features/base.rb
751 def _field_attributes(field)
752   nil
753 end

    # File lib/rodauth/features/base.rb
755 def _field_error_attributes(field)
756   " aria-invalid=\"true\" aria-describedby=\"#{field}_error_message\" "
757 end

    # File lib/rodauth/features/base.rb
846 def _filter_links(links)
847   links.select!{|_, link| link}
848   links.sort!
849   links
850 end

    # File lib/rodauth/features/base.rb
759 def _formatted_field_error(field, error)
760   "<span class=\"#{input_field_error_message_class}\" id=\"#{field}_error_message\">#{error}</span>"
761 end

    # File lib/rodauth/features/remember.rb
231 def _get_remember_cookie
232   request.cookies[remember_cookie_key]
233 end

    # File lib/rodauth/features/json.rb
189 def _json_response_body(hash)
190   request.send(:convert_to_json, hash)
191 end

    # File lib/rodauth/features/jwt.rb
112 def _jwt_decode_opts
113   jwt_decode_opts
114 end

    # File lib/rodauth/features/jwt.rb
117 def _jwt_decode_secrets
118   secrets = [jwt_secret, jwt_old_secret]
119   secrets.compact!
120   secrets
121 end

    # File lib/rodauth/features/login.rb
167 def _login(auth_type)
168   warn("Deprecated #_login method called, use #login instead.")
169   login(auth_type)
170 end

    # File lib/rodauth/features/login.rb
162 def _login_form_footer
163   return '' if _login_form_footer_links.empty?
164   render('login-form-footer')
165 end

    # File lib/rodauth/features/create_account.rb
117 def _login_form_footer_links
118   super << [10, create_account_path, create_account_link_text]
119 end

    # File lib/rodauth/features/login.rb
147 def _login_response
148   set_notice_flash login_notice_flash
149   redirect(saved_login_redirect || login_redirect)
150 end

    # File lib/rodauth/features/email_auth.rb
168 def _multi_phase_login_forms
169   forms = super
170   forms << [30, email_auth_request_form, :_email_auth_request] if valid_login_entered? && allow_email_auth?
171   forms
172 end

    # File lib/rodauth/features/create_account.rb
121 def _new_account(login)
122   acc = {login_column=>login}
123   unless skip_status_checks?
124     acc[account_status_column] = account_initial_status_value
125   end
126   acc
127 end

    # File lib/rodauth/features/otp.rb
442 def _otp
443   _otp_for_key(otp_user_key)
444 end

    # File lib/rodauth/features/otp.rb
427 def _otp_add_key(secret)
428   # Uniqueness errors can't be handled here, as we can't be sure the secret provided
429   # is the same as the current secret.
430   otp_key_ds.insert(otp_keys_id_column=>session_value, otp_keys_column=>secret)
431 end

    # File lib/rodauth/features/otp.rb
438 def _otp_for_key(key)
439   otp_class.new(key, :issuer=>otp_issuer, :digits=>otp_digits, :interval=>otp_interval)
440 end

    # File lib/rodauth/features/otp.rb
433 def _otp_key
434   @otp_user_key = nil
435   otp_key_ds.get(otp_keys_column)
436 end

    # File lib/rodauth/features/otp.rb
417 def _otp_tmp_key(secret)
418   @otp_tmp_key = true
419   @otp_user_key = nil
420   @otp_key = secret
421 end

    # File lib/rodauth/features/otp.rb
262 def _otp_valid_code?(ot_pass, otp)
263   return false unless otp_exists?
264   ot_pass = ot_pass.gsub(/\s+/, '')
265   if drift = otp_drift
266     if otp.respond_to?(:verify_with_drift)
267       # :nocov:
268       otp.verify_with_drift(ot_pass, drift)
269       # :nocov:
270     else
271       otp.verify(ot_pass, :drift_behind=>drift, :drift_ahead=>drift)
272     end
273   else
274     otp.verify(ot_pass)
275   end
276 end

    # File lib/rodauth/features/otp.rb
424 def _otp_valid_code_for_old_secret
425 end

    # File lib/rodauth/features/webauthn.rb
431 def _override_webauthn_credential_response_verify(webauthn_credential)
432   # no need to override
433 end

    # File lib/rodauth/features/base.rb
535 def _process_raw_hmac(hmac)
536   s = [hmac].pack('m')
537   s.chomp!("=\n")
538   s.tr!('+/', '-_')
539   s
540 end

    # File lib/rodauth/features/recovery_codes.rb
260 def _recovery_codes
261   recovery_codes_ds.select_map(recovery_codes_column)
262 end

    # File lib/rodauth/features/json.rb
179 def _return_json_response
180   response.status ||= json_response_error_status if json_response_error?
181   response['Content-Type'] ||= json_response_content_type
182   return_response _json_response_body(json_response)
183 end

    # File lib/rodauth/features/remember.rb
180 def _set_remember_cookie(account_id, remember_key_value, deadline)
181   opts = Hash[remember_cookie_options]
182   opts[:value] = "#{account_id}_#{convert_token_key(remember_key_value)}"
183   opts[:expires] = convert_timestamp(deadline)
184   opts[:path] = "/" unless opts.key?(:path)
185   opts[:httponly] = true unless opts.key?(:httponly) || opts.key?(:http_only)
186   opts[:secure] = true unless opts.key?(:secure) || !request.ssl?
187   ::Rack::Utils.set_cookie_header!(response.headers, remember_cookie_key, opts)
188 end

    # File lib/rodauth/features/lockout.rb
169 def _setup_account_lockouts_hash(account_id, key)
170   hash = {account_lockouts_id_column=>account_id, account_lockouts_key_column=>key}
171   set_deadline_value(hash, account_lockouts_deadline_column, account_lockouts_deadline_interval)
172   hash
173 end

    # File lib/rodauth/features/sms_codes.rb
524 def _sms
525   sms_ds.first
526 end

    # File lib/rodauth/features/sms_codes.rb
472 def _sms_request_response
473   set_notice_flash sms_request_notice_flash
474   redirect sms_auth_redirect
475 end

    # File lib/rodauth/features/base.rb
894 def _template_opts(opts, page)
895   opts = scope.send(:find_template, scope.send(:parse_template_opts, page, opts))
896   unless File.file?(scope.send(:template_path, opts))
897     opts[:path] = template_path(page)
898   end
899   opts
900 end

   # File lib/rodauth/features/confirm_password.rb
79 def _two_factor_auth_links
80   links = (super if defined?(super)) || []
81   if authenticated_by.length == 1 && !authenticated_by.include?('password') && has_password?
82     links << [5, confirm_password_path, confirm_password_link_text]
83   end
84   links
85 end

    # File lib/rodauth/features/two_factor_base.rb
255 def _two_factor_auth_response
256   saved_two_factor_auth_redirect = remove_session_value(two_factor_auth_redirect_session_key)
257   set_notice_flash two_factor_auth_notice_flash
258   redirect(saved_two_factor_auth_redirect || two_factor_auth_redirect)
259 end

    # File lib/rodauth/features/otp.rb
365 def _two_factor_remove_all_from_session
366   two_factor_remove_session('totp')
367   super
368 end

    # File lib/rodauth/features/otp.rb
359 def _two_factor_remove_links
360   links = super
361   links << [20, otp_disable_path, otp_disable_link_text] if otp_exists?
362   links
363 end

    # File lib/rodauth/features/otp.rb
353 def _two_factor_setup_links
354   links = super
355   links << [20, otp_setup_path, otp_setup_link_text] unless otp_exists?
356   links
357 end

   # File lib/rodauth/features/change_login.rb
83 def _update_login(login)
84   updated = nil
85   raised = raises_uniqueness_violation?{updated = update_account({login_column=>login}, account_ds.exclude(login_column=>login)) == 1}
86   if raised
87     set_login_requirement_error_message(:already_an_account_with_this_login, already_an_account_with_this_login_message)
88   end
89   updated && !raised
90 end

    # File lib/rodauth/features/base.rb
902 def _view(meth, page)
903   scope.send(meth, _view_opts(page))
904 end

    # File lib/rodauth/features/base.rb
883 def _view_opts(page)
884   opts = template_opts.dup
885   opts[:locals] = opts[:locals] ? opts[:locals].dup : {}
886   opts[:locals][:rodauth] = self
887   opts[:cache] = cache_templates
888   opts[:cache_key] = :"rodauth_#{page}"
889   _template_opts(opts, page)
890 end

    # File lib/rodauth/features/base.rb
379 def account!
380   account || (session_value && account_from_session)
381 end

    # File lib/rodauth/features/account_expiration.rb
104 def account_activity_ds(account_id)
105   db[account_activity_table].
106     where(account_activity_id_column=>account_id)
107 end

    # File lib/rodauth/features/base.rb
771 def account_ds(id=account_id)
772   raise ArgumentError, "invalid account id passed to account_ds" unless id
773   ds = account_table_ds.where(account_id_column=>id)
774   ds = ds.select(*account_select) if account_select
775   ds
776 end

   # File lib/rodauth/features/account_expiration.rb
54 def account_expired?
55   columns = [account_activity_last_activity_column, account_activity_last_login_column, account_activity_expired_column]
56   last_activity, last_login, expired = account_activity_ds(account_id).get(columns)
57   return true if expired
58   timestamp = convert_timestamp(expire_account_on_last_activity? ? last_activity : last_login)
59   return false unless timestamp
60   timestamp < Time.now - expire_account_after
61 end

   # File lib/rodauth/features/account_expiration.rb
35 def account_expired_at
36   get_activity_timestamp(account_id, account_activity_expired_column)
37 end

    # File lib/rodauth/features/email_auth.rb
131 def account_from_email_auth_key(key)
132   @account = _account_from_email_auth_key(key)
133 end

   # File lib/rodauth/features/email_base.rb
65 def account_from_key(token, status_id=nil)
66   id, key = split_token(token)
67   id = convert_token_id(id)
68   return unless id && key
69 
70   return unless actual = yield(id)
71 
72   unless (hmac_secret && timing_safe_eql?(key, convert_email_token_key(actual))) ||
73      (hmac_secret_rotation? && timing_safe_eql?(key, compute_old_hmac(actual))) ||
74      ((!hmac_secret || allow_raw_email_token?) && timing_safe_eql?(key, actual))
75     return
76   end
77   ds = account_ds(id)
78   ds = ds.where(account_status_column=>status_id) if status_id && !skip_status_checks?
79   ds.first
80 end

    # File lib/rodauth/features/base.rb
277 def account_from_login(login)
278   @account = _account_from_login(login)
279 end

   # File lib/rodauth/features/jwt_refresh.rb
88 def account_from_refresh_token(token)
89   @account = _account_from_refresh_token(token)
90 end

    # File lib/rodauth/features/remember.rb
211 def account_from_remember_cookie
212   unless id = remembered_session_id
213     # Only set expired cookie if there is already a cookie set.
214     forget_login if _get_remember_cookie
215     return
216   end
217 
218   set_session_value(session_key, id)
219   account_from_session
220   remove_session_value(session_key)
221 
222   unless account
223     remove_remember_key(id)
224     forget_login
225     return
226   end
227 
228   account
229 end

   # File lib/rodauth/features/password_expiration.rb
45 def account_from_reset_password_key(key)
46   if a = super
47     check_password_change_allowed
48   end
49   a
50 end

    # File lib/rodauth/features/base.rb
383 def account_from_session
384   @account = _account_from_session
385 end

    # File lib/rodauth/features/lockout.rb
220 def account_from_unlock_key(key)
221   @account = _account_from_unlock_key(key)
222 end

    # File lib/rodauth/features/verify_account.rb
196 def account_from_verify_account_key(key)
197   @account = _account_from_verify_account_key(key)
198 end

    # File lib/rodauth/features/verify_login_change.rb
120 def account_from_verify_login_change_key(key)
121   @account = _account_from_verify_login_change_key(key)
122 end

   # File lib/rodauth/features/webauthn_autofill.rb
44 def account_from_webauthn_login
45   return super if param_or_nil(login_param)
46 
47   credential_id = webauthn_auth_data["id"]
48   account_id = db[webauthn_keys_table]
49     .where(webauthn_keys_webauthn_id_column => credential_id)
50     .get(webauthn_keys_account_id_column)
51 
52   unless account_id
53     throw_error_reason(:invalid_webauthn_id, invalid_field_error_status, webauthn_auth_param, webauthn_invalid_webauthn_id_message)
54   end
55 
56   @account = account_ds(account_id).first
57 end

    # File lib/rodauth/features/base.rb
267 def account_id
268   account[account_id_column]
269 end

   # File lib/rodauth/features/verify_account_grace_period.rb
85 def account_in_unverified_grace_period?
86   return false unless account!
87   account[account_status_column] == account_unverified_status_value &&
88     verify_account_grace_period &&
89     !verify_account_ds.where(Sequel.date_add(verification_requested_at_column, :seconds=>verify_account_grace_period) > Sequel::CURRENT_TIMESTAMP).empty?
90 end

    # File lib/rodauth/features/base.rb
375 def account_initial_status_value
376   account_open_status_value
377 end

    # File lib/rodauth/features/lockout.rb
293 def account_lockouts_ds(id=account_id)
294   db[account_lockouts_table].where(account_lockouts_id_column=>id)
295 end

    # File lib/rodauth/features/lockout.rb
289 def account_login_failures_ds
290   db[account_login_failures_table].where(account_login_failures_id_column=>account_id)
291 end

    # File lib/rodauth/features/base.rb
301 def account_password_hash_column
302   nil
303 end

    # File lib/rodauth/features/base.rb
763 def account_session_status_filter
764   {account_status_column=>account_open_status_value}
765 end

    # File lib/rodauth/features/base.rb
778 def account_table_ds
779   db[accounts_table]
780 end

    # File lib/rodauth/features/webauthn.rb
271 def account_webauthn_ids
272   webauthn_keys_ds.select_map(webauthn_keys_webauthn_id_column)
273 end

    # File lib/rodauth/features/webauthn.rb
275 def account_webauthn_usage
276   webauthn_keys_ds.select_hash(webauthn_keys_webauthn_id_column, webauthn_keys_last_use_column)
277 end

    # File lib/rodauth/features/webauthn.rb
279 def account_webauthn_user_id
280   unless webauthn_id = webauthn_user_ids_ds.get(webauthn_user_ids_webauthn_id_column)
281     webauthn_id = WebAuthn.generate_user_id
282     if e = raised_uniqueness_violation do
283           webauthn_user_ids_ds.insert(
284             webauthn_user_ids_account_id_column => webauthn_account_id,
285             webauthn_user_ids_webauthn_id_column => webauthn_id
286           )
287         end
288       # If two requests to create a webauthn user id are sent at the same time and an insert
289       # is attempted for both, one will fail with a unique constraint violation.  In that case
290       # it is safe for the second one to use the webauthn user id inserted by the other request.
291       # If there is still no webauthn user id at this point, then we'll just reraise the
292       # exception.
293       # :nocov:
294       raise e unless webauthn_id = webauthn_user_ids_ds.get(webauthn_user_ids_webauthn_id_column)
295       # :nocov:
296     end
297   end
298 
299   webauthn_id
300 end

    # File lib/rodauth/features/remember.rb
259 def active_remember_key_ds(id=account_id)
260   remember_key_ds(id).where(Sequel.expr(remember_deadline_column) > Sequel::CURRENT_TIMESTAMP)
261 end

    # File lib/rodauth/features/active_sessions.rb
199 def active_sessions_ds
200   db[active_sessions_table].
201     where(active_sessions_account_id_column=>session_value)
202 end

    # File lib/rodauth/features/active_sessions.rb
162 def active_sessions_insert_hash
163   {active_sessions_account_id_column => session_value, active_sessions_session_id_column => compute_hmac(active_sessions_key)}
164 end

    # File lib/rodauth/features/active_sessions.rb
166 def active_sessions_update_hash
167   h = {active_sessions_last_use_column => Sequel::CURRENT_TIMESTAMP}
168 
169   if hmac_secret_rotation?
170     h[active_sessions_session_id_column] = compute_hmac(session[session_id_session_key])
171   end
172 
173   h
174 end

   # File lib/rodauth/features/active_sessions.rb
68 def add_active_session
69   key = generate_active_sessions_key
70   set_session_value(session_id_session_key, key)
71   if e = raises_uniqueness_violation?{active_sessions_ds.insert(active_sessions_insert_hash)}
72     handle_duplicate_active_session_id(e)
73   end
74   nil
75 end

   # File lib/rodauth/features/audit_logging.rb
39 def add_audit_log(account_id, action)
40   if hash = audit_log_insert_hash(account_id, action)
41     audit_log_ds.insert(hash)
42   end
43 end

    # File lib/rodauth/features/base.rb
182 def add_field_error_class(field)
183   if field_error(field)
184     " #{input_field_error_class}"
185   end
186 end

   # File lib/rodauth/features/disallow_password_reuse.rb
25 def add_previous_password_hash(hash) 
26   ds = previous_password_ds
27 
28   unless @dont_check_previous_password
29     keep_before = ds.reverse(previous_password_id_column).
30       limit(nil, previous_passwords_to_check).
31       get(previous_password_id_column)
32 
33     if keep_before
34       ds.where(Sequel.expr(previous_password_id_column) <= keep_before).
35         delete
36     end
37   end
38 
39   # This should never raise uniqueness violations, as it uses a serial primary key
40   ds.insert(previous_password_account_id_column=>account_id, previous_password_hash_column=>hash)
41 end

    # File lib/rodauth/features/recovery_codes.rb
187 def add_recovery_code
188   # This should never raise uniqueness violations unless the recovery code is the same, and the odds of that
189   # are 1/256**32 assuming a good random number generator.  Still, attempt to handle that case by retrying
190   # on such a uniqueness violation.
191   retry_on_uniqueness_violation do
192     recovery_codes_ds.insert(recovery_codes_id_column=>session_value, recovery_codes_column=>new_recovery_code)
193   end
194 end

    # File lib/rodauth/features/recovery_codes.rb
177 def add_recovery_codes(number)
178   return if number <= 0
179   transaction do
180     number.times do
181       add_recovery_code
182     end
183   end
184   remove_instance_variable(:@recovery_codes)
185 end

    # File lib/rodauth/features/remember.rb
159 def add_remember_key
160   hash = {remember_id_column=>account_id, remember_key_column=>remember_key_value}
161   set_deadline_value(hash, remember_deadline_column, remember_deadline_interval)
162 
163   if e = raised_uniqueness_violation{remember_key_ds.insert(hash)}
164     # If inserting into the remember key table causes a violation, we can pull the
165     # existing row from the table.  If there is no invalid row, we can then reraise.
166     raise e unless @remember_key_value = active_remember_key_ds.get(remember_key_column)
167   end
168 end

    # File lib/rodauth/features/recovery_codes.rb
151 def add_webauthn_credential(_)
152   super if defined?(super)
153   auto_add_missing_recovery_codes
154 end

   # File lib/rodauth/features/change_password_notify.rb
11 def after_change_password
12   super
13   send_password_changed_email
14 end

    # File lib/rodauth/features/account_expiration.rb
 99 def after_close_account
100   super if defined?(super)
101   account_activity_ds(account_id).delete
102 end

   # File lib/rodauth/features/disallow_password_reuse.rb
87 def after_create_account
88   if account_password_hash_column && !(respond_to?(:verify_account_set_password?) && verify_account_set_password?)
89     add_previous_password_hash(password_hash(param(password_param)))
90   end
91   super if defined?(super)
92 end

    # File lib/rodauth/features/email_auth.rb
201 def after_login
202   # Remove the email auth key after any login, even if
203   # it is a password login.  This is done to invalidate
204   # the email login when a user has a password and requests
205   # email authentication, but then remembers their password
206   # and doesn't need the link.  At that point, the link
207   # that allows login access to the account becomes a
208   # security liability, and it is best to remove it.
209   remove_email_auth_key
210   super
211 end

    # File lib/rodauth/features/email_auth.rb
149 def after_login_entered_during_multi_phase_login
150   # If forcing email auth, just send the email link.
151   _email_auth_request if force_email_auth?
152 
153   super
154 end

    # File lib/rodauth/features/lockout.rb
256 def after_login_failure
257   invalid_login_attempted
258   super
259 end

    # File lib/rodauth/features/remember.rb
235 def after_logout
236   forget_login
237   super if defined?(super)
238 end

    # File lib/rodauth/features/recovery_codes.rb
225 def after_otp_disable
226   super if defined?(super)
227   auto_remove_recovery_codes
228 end

    # File lib/rodauth/features/active_sessions.rb
130 def after_refresh_token
131   super if defined?(super)
132   if prev_key = session[session_id_session_key]
133     key = generate_active_sessions_key
134     set_session_value(session_id_session_key, key)
135     active_sessions_ds.
136       where(active_sessions_session_id_column => compute_hmacs(prev_key)).
137       update(active_sessions_session_id_column => compute_hmac(key))
138   end
139 end

   # File lib/rodauth/features/password_grace_period.rb
39 def after_reset_password
40   super if defined?(super)
41   @last_password_entry = Time.now.to_i
42 end

    # File lib/rodauth/features/recovery_codes.rb
230 def after_sms_disable
231   super if defined?(super)
232   auto_remove_recovery_codes
233 end

    # File lib/rodauth/features/recovery_codes.rb
235 def after_webauthn_remove
236   super if defined?(super)
237   auto_remove_recovery_codes
238 end

    # File lib/rodauth/features/email_auth.rb
197 def allow_email_auth?
198   defined?(super) ? super : true
199 end

    # File lib/rodauth/features/verify_account.rb
163 def allow_resending_verify_account_email?
164   account[account_status_column] == account_unverified_status_value
165 end

    # File lib/rodauth/features/base.rb
309 def already_logged_in
310   nil
311 end

    # File lib/rodauth/features/argon2.rb
105 def argon2_hash_algorithm?(hash)
106   hash.start_with?('$argon2id$')
107 end

   # File lib/rodauth/features/argon2.rb
76 def argon2_hash_cost
77   { t_cost: 1, m_cost: 5, p_cost: 1 }
78 end

    # File lib/rodauth/features/argon2.rb
109 def argon2_password_hash_match?(hash, password)
110   ret = ::Argon2::Password.verify_password(password, hash, argon2_secret)
111 
112   if ret == false && argon2_old_secret != argon2_secret && (ret = ::Argon2::Password.verify_password(password, hash, argon2_old_secret))
113     @update_password_hash = true
114   end
115 
116   ret
117 end

   # File lib/rodauth/features/argon2.rb
60 def argon2_password_hash_using_salt_and_secret(password, salt, secret)
61   argon2_params = Hash[extract_password_hash_cost(salt)]
62   argon2_params[argon2_salt_option] = salt.split('$').last.unpack("m")[0]
63   argon2_params[:secret] = secret
64   ::Argon2::Password.new(argon2_params).create(password)
65 end

   # File lib/rodauth/features/argon2.rb
34 def argon2_salt_option
35   :salt_do_not_supply
36 end

   # File lib/rodauth/features/audit_logging.rb
83 def audit_log_ds
84   ds = db[audit_logging_table]
85   # :nocov:
86   if db.database_type == :postgres
87   # :nocov:
88     # For PostgreSQL, use RETURNING NULL. This allows the feature
89     # to be used with INSERT but not SELECT permissions on the
90     # table, useful for audit logging where the database user
91     # the application is running as should not need to read the
92     # logs.
93     ds = ds.returning(nil)
94   end
95   ds
96 end

   # File lib/rodauth/features/audit_logging.rb
45 def audit_log_insert_hash(account_id, action)
46   if message = audit_log_message(action)
47     {
48       audit_logging_account_id_column => account_id,
49       audit_logging_message_column => message,
50       audit_logging_metadata_column => serialize_audit_log_metadata(audit_log_metadata(action))
51     }
52   end
53 end

   # File lib/rodauth/features/audit_logging.rb
63 def audit_log_message(action)
64   meth = :"audit_log_message_for_#{action}"
65   if respond_to?(meth, true)
66     send(meth)
67   else
68     audit_log_message_default(action)
69   end
70 end

   # File lib/rodauth/features/audit_logging.rb
59 def audit_log_message_default(action)
60   action.to_s
61 end

   # File lib/rodauth/features/audit_logging.rb
72 def audit_log_metadata(action)
73   meth = :"audit_log_metadata_for_#{action}"
74   if respond_to?(meth, true)
75     send(meth)
76   else
77     audit_log_metadata_default
78   end
79 end

    # File lib/rodauth/features/base.rb
132 def auth_class_eval(&block)
133   auth.class_eval(&block)
134 end

    # File lib/rodauth/features/base.rb
362 def authenticated?
363   logged_in?
364 end

    # File lib/rodauth/features/base.rb
461 def authenticated_by
462   session[authenticated_by_session_key]
463 end

    # File lib/rodauth/features/webauthn.rb
251 def authenticated_webauthn_id
252   session[authenticated_webauthn_id_session_key]
253 end

    # File lib/rodauth/features/recovery_codes.rb
248 def auto_add_missing_recovery_codes
249   if auto_add_recovery_codes?
250     add_recovery_codes(recovery_codes_limit - recovery_codes.length)
251   end
252 end

    # File lib/rodauth/features/recovery_codes.rb
254 def auto_remove_recovery_codes
255   if auto_remove_recovery_codes? && (%w'totp webauthn sms_code' & possible_authentication_methods).empty?
256     recovery_codes_remove
257   end
258 end

    # File lib/rodauth/features/base.rb
212 def autocomplete_for_field?(_param)
213   mark_input_fields_with_autocomplete?
214 end

    # File lib/rodauth/features/base.rb
474 def autologin_session(autologin_type)
475   login_session('autologin')
476   set_session_value(autologin_type_session_key, autologin_type)
477 end

    # File lib/rodauth/features/base.rb
470 def autologin_type
471   session[autologin_type_session_key]
472 end

    # File lib/rodauth/features/otp.rb
412 def base32_encode(data, length)
413   chars = 'abcdefghijklmnopqrstuvwxyz234567'
414   length.times.map{|i|chars[data[i].ord % 32]}.join
415 end

    # File lib/rodauth/features/base.rb
511 def base_url
512   url = String.new("#{request.scheme}://#{domain}")
513   url << ":#{request.port}" if request.port != Rack::Request::DEFAULT_PORTS[request.scheme]
514   url
515 end

   # File lib/rodauth/features/verify_account_grace_period.rb
58 def before_change_login_route
59   unless verified_account?
60     set_redirect_error_flash unverified_change_login_error_flash
61     redirect unverified_change_login_redirect
62   end
63   super if defined?(super)
64 end

   # File lib/rodauth/features/password_expiration.rb
90 def before_change_password_route
91   check_password_change_allowed
92   super
93 end

   # File lib/rodauth/features/disallow_password_reuse.rb
77 def before_create_account_route
78   super if defined?(super)
79   @dont_check_previous_password = true
80 end

    # File lib/rodauth/features/lockout.rb
244 def before_login_attempt
245   if locked_out?
246     show_lockout_page
247   end
248   super
249 end

    # File lib/rodauth/features/active_sessions.rb
146 def before_logout
147   if param_or_nil(global_logout_param)
148     remove_remember_key(session_value) if respond_to?(:remove_remember_key)
149     remove_all_active_sessions
150   else
151     remove_current_session
152   end
153   super
154 end

    # File lib/rodauth/features/json.rb
139 def before_otp_setup_route
140   super if defined?(super)
141   if use_json? && otp_keys_use_hmac? && !param_or_nil(otp_setup_raw_param)
142     _otp_tmp_key(otp_new_secret)
143     json_response[otp_setup_param] = otp_user_key
144     json_response[otp_setup_raw_param] = otp_key
145   end
146 end

   # File lib/rodauth/features/account_expiration.rb
79 def before_reset_password
80   check_account_expiration
81   super if defined?(super)
82 end

   # File lib/rodauth/features/account_expiration.rb
84 def before_reset_password_request
85   check_account_expiration
86   super if defined?(super)
87 end

    # File lib/rodauth/features/json.rb
148 def before_rodauth
149   if json_request?
150     if json_check_accept? && (accept = request.env['HTTP_ACCEPT']) && accept !~ json_accept_regexp
151       response.status = 406
152       json_response[json_response_error_key] = json_not_accepted_error_message
153       _return_json_response
154     end
155 
156     unless request.post?
157       response.status = 405
158       response.headers['Allow'] = 'POST'
159       json_response[json_response_error_key] = json_non_post_error_message
160       return_json_response
161     end
162   elsif only_json?
163     response.status = json_response_error_status
164     return_response non_json_request_error_message
165   end
166 
167   super
168 end

   # File lib/rodauth/features/json.rb
85 def before_two_factor_auth_route
86   super if defined?(super)
87   if use_json?
88     json_response[:auth_links] = two_factor_auth_links.sort.map{|_,link| link}
89     json_response[json_response_success_key] ||= "" if include_success_messages?
90     return_json_response
91   end
92 end

   # File lib/rodauth/features/json.rb
75 def before_two_factor_manage_route
76   super if defined?(super)
77   if use_json?
78     json_response[:setup_links] = two_factor_setup_links.sort.map{|_,link| link}
79     json_response[:remove_links] = two_factor_remove_links.sort.map{|_,link| link}
80     json_response[json_response_success_key] ||= "" if include_success_messages?
81     return_json_response
82   end
83 end

   # File lib/rodauth/features/account_expiration.rb
89 def before_unlock_account
90   check_account_expiration
91   super if defined?(super)
92 end

   # File lib/rodauth/features/account_expiration.rb
94 def before_unlock_account_request
95   check_account_expiration
96   super if defined?(super)
97 end

   # File lib/rodauth/features/webauthn_verify_account.rb
30 def before_verify_account
31   super
32   if features.include?(:json) && use_json? && !param_or_nil(webauthn_setup_param)
33     cred = new_webauthn_credential
34     json_response[webauthn_setup_param] = cred.as_json
35     json_response[webauthn_setup_challenge_param] = cred.challenge
36     json_response[webauthn_setup_challenge_hmac_param] = compute_hmac(cred.challenge)
37   end
38   @webauthn_credential = webauthn_setup_credential_from_form_submission
39   add_webauthn_credential(@webauthn_credential)
40 end

   # File lib/rodauth/features/disallow_password_reuse.rb
82 def before_verify_account_route
83   super if defined?(super)
84   @dont_check_previous_password = true
85 end

    # File lib/rodauth/features/json.rb
 94 def before_view_recovery_codes
 95   super if defined?(super)
 96   if use_json?
 97     json_response[:codes] = recovery_codes
 98     json_response[json_response_success_key] ||= "" if include_success_messages?
 99   end
100 end

    # File lib/rodauth/features/json.rb
112 def before_webauthn_auth_route
113   super if defined?(super)
114   if use_json? && !param_or_nil(webauthn_auth_param)
115     cred = webauthn_credential_options_for_get
116     json_response[webauthn_auth_param] = cred.as_json
117     json_response[webauthn_auth_challenge_param] = cred.challenge
118     json_response[webauthn_auth_challenge_hmac_param] = compute_hmac(cred.challenge)
119   end
120 end

    # File lib/rodauth/features/json.rb
122 def before_webauthn_login_route
123   super if defined?(super)
124   if use_json? && !param_or_nil(webauthn_auth_param) && webauthn_login_options?
125     cred = webauthn_credential_options_for_get
126     json_response[webauthn_auth_param] = cred.as_json
127     json_response[webauthn_auth_challenge_param] = cred.challenge
128     json_response[webauthn_auth_challenge_hmac_param] = compute_hmac(cred.challenge)
129   end
130 end

    # File lib/rodauth/features/json.rb
132 def before_webauthn_remove_route
133   super if defined?(super)
134   if use_json? && !param_or_nil(webauthn_remove_param)
135     json_response[webauthn_remove_param] = account_webauthn_usage
136   end
137 end

    # File lib/rodauth/features/json.rb
102 def before_webauthn_setup_route
103   super if defined?(super)
104   if use_json? && !param_or_nil(webauthn_setup_param)
105     cred = new_webauthn_credential
106     json_response[webauthn_setup_param] = cred.as_json
107     json_response[webauthn_setup_challenge_param] = cred.challenge
108     json_response[webauthn_setup_challenge_hmac_param] = compute_hmac(cred.challenge)
109   end
110 end

    # File lib/rodauth/features/base.rb
411 def button(value, opts={})
412   scope.render(button_opts(value, opts))
413 end

    # File lib/rodauth/features/base.rb
403 def button_opts(value, opts)
404   opts = Hash[template_opts].merge!(opts)
405   opts[:locals] = {:value=>value, :opts=>opts}
406   opts[:cache] = cache_templates
407   opts[:cache_key] = :rodauth_button
408   _template_opts(opts, 'button')
409 end

    # File lib/rodauth/features/recovery_codes.rb
173 def can_add_recovery_codes?
174   recovery_codes.length < recovery_codes_limit
175 end

    # File lib/rodauth/features/base.rb
629 def catch_error(&block)
630   catch(:rodauth_error, &block)
631 end

   # File lib/rodauth/features/change_login.rb
68 def change_login(login)
69   if account_ds.get(login_column).downcase == login.downcase
70     set_login_requirement_error_message(:same_as_current_login, same_as_current_login_message)
71     return false
72   end
73 
74   update_login(login)
75 end

    # File lib/rodauth/features/verify_login_change.rb
136 def change_login_notice_flash
137   change_login_needs_verification_notice_flash
138 end

   # File lib/rodauth/features/change_login.rb
64 def change_login_requires_password?
65   modifications_require_password?
66 end

   # File lib/rodauth/features/change_password.rb
68 def change_password_requires_password?
69   modifications_require_password?
70 end

   # File lib/rodauth/features/account_expiration.rb
63 def check_account_expiration
64   if account_expired?
65     set_expired unless account_expired_at
66     set_redirect_error_flash account_expiration_error_flash
67     redirect account_expiration_redirect
68   end
69   update_last_login
70 end

   # File lib/rodauth/features/active_sessions.rb
54 def check_active_session
55   if logged_in? && !currently_active_session?
56     no_longer_active_session
57   end
58 end

    # File lib/rodauth/features/base.rb
305 def check_already_logged_in
306   already_logged_in if logged_in?
307 end

    # File lib/rodauth/features/base.rb
387 def check_csrf
388   scope.check_csrf!(check_csrf_opts, &check_csrf_block)
389 end

    # File lib/rodauth/features/base.rb
687 def check_csrf?
688   scope.opts[:rodauth_route_csrf]
689 end

   # File lib/rodauth/features/password_expiration.rb
30 def check_password_change_allowed
31   if password_changed_at = get_password_changed_at
32     if password_changed_at > Time.now - allow_password_change_after
33       set_redirect_error_flash password_not_changeable_yet_error_flash
34       redirect password_not_changeable_yet_redirect
35     end
36   end
37 end

   # File lib/rodauth/features/session_expiration.rb
15 def check_session_expiration
16   return unless logged_in?
17 
18   unless session.has_key?(session_last_activity_session_key) && session.has_key?(session_created_session_key)
19     if session_expiration_default
20       expire_session
21     end
22 
23     return
24   end
25 
26   time = Time.now.to_i
27 
28   if session[session_last_activity_session_key] + session_inactivity_timeout < time
29     expire_session
30   end
31   set_session_value(session_last_activity_session_key, time)
32 
33   if session[session_created_session_key] + max_session_lifetime < time
34     expire_session
35   end
36 end

   # File lib/rodauth/features/single_session.rb
52 def check_single_session
53   if logged_in? && !currently_active_session?
54     no_longer_active_session
55   end
56 end

    # File lib/rodauth/features/otp.rb
370 def clear_cached_otp
371   remove_instance_variable(:@otp) if defined?(@otp)
372 end

    # File lib/rodauth/features/lockout.rb
165 def clear_invalid_login_attempts
166   unlock_account
167 end

    # File lib/rodauth/features/base.rb
321 def clear_session
322   if scope.respond_to?(:clear_session)
323     scope.clear_session
324   else
325     session.clear
326   end
327 end

   # File lib/rodauth/features/close_account.rb
66 def close_account
67   unless skip_status_checks?
68     update_account(account_status_column=>account_closed_status_value)
69   end
70 
71   unless account_password_hash_column
72     password_hash_ds.delete
73   end
74 end

   # File lib/rodauth/features/close_account.rb
62 def close_account_requires_password?
63   modifications_require_password?
64 end

    # File lib/rodauth/features/base.rb
246 def compute_hmac(data)
247   _process_raw_hmac(compute_raw_hmac(data))
248 end

    # File lib/rodauth/features/base.rb
257 def compute_hmacs(data)
258   hmacs = [compute_hmac(data)]
259 
260   if hmac_old_secret
261     hmacs << compute_old_hmac(data)
262   end
263 
264   hmacs
265 end

    # File lib/rodauth/features/base.rb
251 def compute_old_hmac(data)
252   _process_raw_hmac(compute_raw_hmac_with_secret(data, hmac_old_secret))
253 end

    # File lib/rodauth/features/base.rb
742 def compute_raw_hmac(data)
743   raise ArgumentError, "hmac_secret not set" unless hmac_secret
744   compute_raw_hmac_with_secret(data, hmac_secret)
745 end

    # File lib/rodauth/features/base.rb
747 def compute_raw_hmac_with_secret(data, secret)
748   OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, secret, data)
749 end

   # File lib/rodauth/features/confirm_password.rb
63 def confirm_password
64   authenticated_by.delete('autologin')
65   authenticated_by.delete('remember')
66   authenticated_by.delete('email_auth')
67   authenticated_by.delete('password')
68   authenticated_by.unshift("password")
69   remove_session_value(autologin_type_session_key)
70   nil
71 end

   # File lib/rodauth/features/confirm_password.rb
73 def confirm_password_redirect
74   remove_session_value(confirm_password_redirect_session_key) || default_redirect
75 end

   # File lib/rodauth/features/email_base.rb
61 def convert_email_token_key(key)
62   convert_token_key(key)
63 end

    # File lib/rodauth/features/base.rb
608 def convert_session_key(key)
609   key = :"#{session_key_prefix}#{key}" if session_key_prefix
610   normalize_session_or_flash_key(key)
611 end

    # File lib/rodauth/features/base.rb
787 def convert_timestamp(timestamp)
788   timestamp = db.to_application_timestamp(timestamp) if timestamp.is_a?(String)
789   timestamp
790 end

    # File lib/rodauth/features/base.rb
562 def convert_token_id(id)
563   if convert_token_id_to_integer?
564     convert_token_id_to_integer(id)
565   else
566     id
567   end
568 end

    # File lib/rodauth/features/base.rb
570 def convert_token_id_to_integer(id)
571   if id = (Integer(id, 10) rescue nil)
572     if id > 9223372036854775807 || id < -9223372036854775808
573       # Only allow 64-bit signed integer range to avoid problems on PostgreSQL
574       id = nil
575     end
576   end
577 
578   id
579 end

    # File lib/rodauth/features/base.rb
550 def convert_token_key(key)
551   if key && hmac_secret
552     compute_hmac(key)
553   else
554     key
555   end
556 end

    # File lib/rodauth/features/verify_account.rb
216 def create_account_autologin?
217   false
218 end

    # File lib/rodauth/features/verify_account.rb
183 def create_account_notice_flash
184   verify_account_email_sent_notice_flash
185 end

    # File lib/rodauth/features/verify_account.rb
220 def create_account_set_password?
221   return false if verify_account_set_password?
222   super
223 end

   # File lib/rodauth/features/email_base.rb
40 def create_email(subject, body)
41   create_email_to(email_to, subject, body)
42 end

    # File lib/rodauth/features/email_auth.rb
102 def create_email_auth_key
103   transaction do
104     if email_auth_key_value = get_email_auth_key(account_id)
105       set_email_auth_email_last_sent
106       @email_auth_key_value = email_auth_key_value
107     elsif e = raised_uniqueness_violation{email_auth_ds.insert(email_auth_key_insert_hash)}
108       # If inserting into the email auth table causes a violation, we can pull the
109       # existing email auth key from the table, or reraise.
110       raise e unless @email_auth_key_value = get_email_auth_key(account_id)
111     end
112   end
113 end

   # File lib/rodauth/features/email_base.rb
44 def create_email_to(to, subject, body)
45   m = Mail.new
46   m.from = email_from
47   m.to = to
48   m.subject = "#{email_subject_prefix}#{subject}"
49   m.body = body
50   m
51 end

    # File lib/rodauth/features/reset_password.rb
164 def create_reset_password_key
165   transaction do
166     if reset_password_key_value = get_password_reset_key(account_id)
167       set_reset_password_email_last_sent
168       @reset_password_key_value = reset_password_key_value
169     elsif e = raised_uniqueness_violation{password_reset_ds.insert(reset_password_key_insert_hash)}
170       # If inserting into the reset password table causes a violation, we can pull the
171       # existing reset password key from the table, or reraise.
172       raise e unless @reset_password_key_value = get_password_reset_key(account_id)
173     end
174   end
175 end

    # File lib/rodauth/features/verify_account.rb
281 def create_verify_account_key
282   ds = verify_account_ds
283   transaction do
284     if ds.empty?
285       if e = raised_uniqueness_violation{ds.insert(verify_account_key_insert_hash)}
286         # If inserting into the verify account table causes a violation, we can pull the
287         # key from the verify account table, or reraise.
288         raise e unless @verify_account_key_value = get_verify_account_key(account_id)
289       end
290     end
291   end
292 end

    # File lib/rodauth/features/verify_login_change.rb
198 def create_verify_login_change_email(login)
199   create_email_to(login, verify_login_change_email_subject, verify_login_change_email_body)
200 end

    # File lib/rodauth/features/verify_login_change.rb
176 def create_verify_login_change_key(login)
177   ds = verify_login_change_ds
178   transaction do
179     ds.where((Sequel::CURRENT_TIMESTAMP > verify_login_change_deadline_column) | ~Sequel.expr(verify_login_change_login_column=>login)).delete
180     if e = raised_uniqueness_violation{ds.insert(verify_login_change_key_insert_hash(login))}
181       old_login, key = get_verify_login_change_login_and_key(account_id)
182       # If inserting into the verify login change table causes a violation, we can pull the
183       # key from the verify login change table if the logins match, or reraise.
184       @verify_login_change_key_value = if old_login.downcase == login.downcase
185         key
186       end
187       raise e unless @verify_login_change_key_value
188     end
189   end
190 end

    # File lib/rodauth/features/base.rb
391 def csrf_tag(path=request.path)
392   return unless scope.respond_to?(:csrf_tag)
393 
394   if use_request_specific_csrf_tokens?
395     scope.csrf_tag(path)
396   else
397     # :nocov:
398     scope.csrf_tag
399     # :nocov:
400   end
401 end

   # File lib/rodauth/features/active_sessions.rb
40 def currently_active_session?
41   return false unless session_id = session[session_id_session_key]
42 
43   remove_inactive_sessions
44   ds = active_sessions_ds.
45     where(active_sessions_session_id_column => compute_hmacs(session_id))
46 
47   if update_current_session?
48     ds.update(active_sessions_update_hash) == 1
49   else
50     ds.count == 1
51   end
52 end

    # File lib/rodauth/features/argon2.rb
119 def database_function_password_match?(name, hash_id, password, salt)
120   return true if super
121 
122   if use_argon2? && argon2_hash_algorithm?(salt) && argon2_old_secret != argon2_secret && (ret = db.get(Sequel.function(function_name(name), hash_id, argon2_password_hash_using_salt_and_secret(password, salt, argon2_old_secret))))
123     @update_password_hash = true
124   end
125 
126   !!ret
127 end