module Rodauth

    # File lib/rodauth/features/email_auth.rb
258 def _account_from_email_auth_key(token)
259   account_from_key(token, account_open_status_value){|id| get_email_auth_key(id)}
260 end

    # File lib/rodauth/features/base.rb
635 def _account_from_login(login)
636   ds = db[accounts_table].where(login_column=>login)
637   ds = ds.select(*account_select) if account_select
638   ds = ds.where(account_status_column=>[account_unverified_status_value, account_open_status_value]) unless skip_status_checks?
639   ds.first
640 end

    # File lib/rodauth/features/jwt_refresh.rb
111 def _account_from_refresh_token(token)
112   id, token_id, key = _account_refresh_token_split(token)
113 
114   unless key &&
115          (id == session_value.to_s) &&
116          (actual = get_active_refresh_token(id, token_id)) &&
117          timing_safe_eql?(key, convert_token_key(actual)) &&
118          jwt_refresh_token_match?(key)
119     return
120   end
121 
122   ds = account_ds(id)
123   ds = ds.where(account_status_column=>account_open_status_value) unless skip_status_checks?
124   ds.first
125 end

    # File lib/rodauth/features/reset_password.rb
270 def _account_from_reset_password_key(token)
271   account_from_key(token, account_open_status_value){|id| get_password_reset_key(id)}
272 end

    # File lib/rodauth/features/base.rb
642 def _account_from_session
643   ds = account_ds(session_value)
644   ds = ds.where(account_session_status_filter) unless skip_status_checks?
645   ds.first
646 end

    # File lib/rodauth/features/lockout.rb
315 def _account_from_unlock_key(token)
316   account_from_key(token){|id| account_lockouts_ds(id).get(account_lockouts_key_column)}
317 end

    # File lib/rodauth/features/verify_account.rb
328 def _account_from_verify_account_key(token)
329   account_from_key(token, account_unverified_status_value){|id| get_verify_account_key(id)}
330 end

    # File lib/rodauth/features/verify_login_change.rb
212 def _account_from_verify_login_change_key(token)
213   account_from_key(token) do |id|
214     @verify_login_change_new_login, key = get_verify_login_change_login_and_key(id)
215     key
216   end
217 end

    # File lib/rodauth/features/jwt_refresh.rb
127 def _account_refresh_token_split(token)
128   id, token = split_token(token)
129   return unless id && token
130 
131   token_id, key = split_token(token)
132   return unless token_id && key
133 
134   [id, token_id, key]
135 end

    # File lib/rodauth/features/base.rb
471 def _around_rodauth
472   yield
473 end

    # File lib/rodauth/features/email_auth.rb
192 def _email_auth_request
193   if email_auth_email_recently_sent?
194     set_redirect_error_flash email_auth_email_recently_sent_error_flash
195     redirect email_auth_email_recently_sent_redirect
196   end
197 
198   generate_email_auth_key_value
199   transaction do
200     before_email_auth_request
201     create_email_auth_key
202     send_email_auth_email
203     after_email_auth_request
204   end
205 
206   set_notice_flash email_auth_email_sent_notice_flash
207 end

    # File lib/rodauth/features/email_auth.rb
187 def _email_auth_request_and_redirect
188   _email_auth_request
189   redirect email_auth_email_sent_redirect
190 end

    # File lib/rodauth/features/base.rb
652 def _field_attributes(field)
653   nil
654 end

    # File lib/rodauth/features/base.rb
656 def _field_error_attributes(field)
657   " aria-invalid=\"true\" aria-describedby=\"#{field}_error_message\" "
658 end

    # File lib/rodauth/features/base.rb
660 def _formatted_field_error(field, error)
661   "<span class=\"#{input_field_error_message_class}\" id=\"#{field}_error_message\">#{error}</span>"
662 end

    # File lib/rodauth/features/remember.rb
194 def _get_remember_cookie
195   request.cookies[remember_cookie_key]
196 end

    # File lib/rodauth/features/json.rb
167 def _json_response_body(hash)
168   request.send(:convert_to_json, hash)
169 end

    # File lib/rodauth/features/jwt.rb
110 def _jwt_decode_opts
111   jwt_decode_opts
112 end

    # File lib/rodauth/features/login.rb
149 def _login(auth_type)
150   warn("Deprecated #_login method called, use #login instead.")
151   login(auth_type)
152 end

    # File lib/rodauth/features/login.rb
144 def _login_form_footer
145   return '' if _login_form_footer_links.empty?
146   render('login-form-footer')
147 end

    # File lib/rodauth/features/create_account.rb
117 def _login_form_footer_links
118   super << [10, create_account_path, create_account_link_text]
119 end

    # File lib/rodauth/features/email_auth.rb
177 def _multi_phase_login_forms
178   forms = super
179   forms << [30, email_auth_request_form, :_email_auth_request_and_redirect] if valid_login_entered? && allow_email_auth?
180   forms
181 end

    # File lib/rodauth/features/create_account.rb
121 def _new_account(login)
122   acc = {login_column=>login}
123   unless skip_status_checks?
124     acc[account_status_column] = account_initial_status_value
125   end
126   acc
127 end

    # File lib/rodauth/features/otp.rb
408 def _otp
409   otp_class.new(otp_user_key, :issuer=>otp_issuer, :digits=>otp_digits, :interval=>otp_interval)
410 end

    # File lib/rodauth/features/otp.rb
397 def _otp_add_key(secret)
398   # Uniqueness errors can't be handled here, as we can't be sure the secret provided
399   # is the same as the current secret.
400   otp_key_ds.insert(otp_keys_id_column=>session_value, otp_keys_column=>secret)
401 end

    # File lib/rodauth/features/otp.rb
403 def _otp_key
404   @otp_user_key = nil
405   otp_key_ds.get(otp_keys_column)
406 end

    # File lib/rodauth/features/otp.rb
391 def _otp_tmp_key(secret)
392   @otp_tmp_key = true
393   @otp_user_key = nil
394   @otp_key = secret
395 end

    # File lib/rodauth/features/recovery_codes.rb
255 def _recovery_codes
256   recovery_codes_ds.select_map(recovery_codes_column)
257 end

    # File lib/rodauth/features/json.rb
156 def _return_json_response
157   response.status ||= json_response_error_status if json_response[json_response_error_key]
158   response['Content-Type'] ||= json_response_content_type
159   response.write(_json_response_body(json_response))
160   request.halt
161 end

    # File lib/rodauth/features/lockout.rb
174 def _setup_account_lockouts_hash(account_id, key)
175   hash = {account_lockouts_id_column=>account_id, account_lockouts_key_column=>key}
176   set_deadline_value(hash, account_lockouts_deadline_column, account_lockouts_deadline_interval)
177   hash
178 end

    # File lib/rodauth/features/sms_codes.rb
499 def _sms
500   sms_ds.first
501 end

   # File lib/rodauth/features/confirm_password.rb
79 def _two_factor_auth_links
80   links = (super if defined?(super)) || []
81   if authenticated_by.length == 1 && !authenticated_by.include?('password') && has_password?
82     links << [5, confirm_password_path, confirm_password_link_text]
83   end
84   links
85 end

    # File lib/rodauth/features/otp.rb
347 def _two_factor_remove_all_from_session
348   two_factor_remove_session('totp')
349   super
350 end

    # File lib/rodauth/features/otp.rb
341 def _two_factor_remove_links
342   links = super
343   links << [20, otp_disable_path, otp_disable_link_text] if otp_exists?
344   links
345 end

    # File lib/rodauth/features/otp.rb
335 def _two_factor_setup_links
336   links = super
337   links << [20, otp_setup_path, otp_setup_link_text] unless otp_exists?
338   links
339 end

   # File lib/rodauth/features/change_login.rb
83 def _update_login(login)
84   updated = nil
85   raised = raises_uniqueness_violation?{updated = update_account({login_column=>login}, account_ds.exclude(login_column=>login)) == 1}
86   if raised
87     set_login_requirement_error_message(:already_an_account_with_this_login, already_an_account_with_this_login_message)
88   end
89   updated && !raised
90 end

    # File lib/rodauth/features/base.rb
784 def _view(meth, page)
785   scope.send(meth, _view_opts(page))
786 end

    # File lib/rodauth/features/base.rb
769 def _view_opts(page)
770   opts = template_opts.dup
771   opts[:locals] = opts[:locals] ? opts[:locals].dup : {}
772   opts[:locals][:rodauth] = self
773   opts[:cache] = cache_templates
774   opts[:cache_key] = :"rodauth_#{page}"
775 
776   opts = scope.send(:find_template, scope.send(:parse_template_opts, page, opts))
777   unless File.file?(scope.send(:template_path, opts))
778     opts[:path] = template_path(page)
779   end
780 
781   opts
782 end

    # File lib/rodauth/features/account_expiration.rb
104 def account_activity_ds(account_id)
105   db[account_activity_table].
106     where(account_activity_id_column=>account_id)
107 end

    # File lib/rodauth/features/base.rb
672 def account_ds(id=account_id)
673   raise ArgumentError, "invalid account id passed to account_ds" unless id
674   ds = db[accounts_table].where(account_id_column=>id)
675   ds = ds.select(*account_select) if account_select
676   ds
677 end

   # File lib/rodauth/features/account_expiration.rb
54 def account_expired?
55   columns = [account_activity_last_activity_column, account_activity_last_login_column, account_activity_expired_column]
56   last_activity, last_login, expired = account_activity_ds(account_id).get(columns)
57   return true if expired
58   timestamp = convert_timestamp(expire_account_on_last_activity? ? last_activity : last_login)
59   return false unless timestamp
60   timestamp < Time.now - expire_account_after
61 end

   # File lib/rodauth/features/account_expiration.rb
35 def account_expired_at
36   get_activity_timestamp(account_id, account_activity_expired_column)
37 end

    # File lib/rodauth/features/email_auth.rb
136 def account_from_email_auth_key(key)
137   @account = _account_from_email_auth_key(key)
138 end

   # File lib/rodauth/features/email_base.rb
65 def account_from_key(token, status_id=nil)
66   id, key = split_token(token)
67   return unless id && key
68 
69   return unless actual = yield(id)
70 
71   unless timing_safe_eql?(key, convert_email_token_key(actual))
72     if hmac_secret && allow_raw_email_token?
73       return unless timing_safe_eql?(key, actual)
74     else
75       return
76     end
77   end
78   ds = account_ds(id)
79   ds = ds.where(account_status_column=>status_id) if status_id && !skip_status_checks?
80   ds.first
81 end

    # File lib/rodauth/features/base.rb
252 def account_from_login(login)
253   @account = _account_from_login(login)
254 end

   # File lib/rodauth/features/jwt_refresh.rb
88 def account_from_refresh_token(token)
89   @account = _account_from_refresh_token(token)
90 end

   # File lib/rodauth/features/password_expiration.rb
45 def account_from_reset_password_key(key)
46   if a = super
47     check_password_change_allowed
48   end
49   a
50 end

    # File lib/rodauth/features/base.rb
345 def account_from_session
346   @account = _account_from_session
347 end

    # File lib/rodauth/features/lockout.rb
225 def account_from_unlock_key(key)
226   @account = _account_from_unlock_key(key)
227 end

    # File lib/rodauth/features/verify_account.rb
208 def account_from_verify_account_key(key)
209   @account = _account_from_verify_account_key(key)
210 end

    # File lib/rodauth/features/verify_login_change.rb
122 def account_from_verify_login_change_key(key)
123   @account = _account_from_verify_login_change_key(key)
124 end

    # File lib/rodauth/features/base.rb
242 def account_id
243   account[account_id_column]
244 end

   # File lib/rodauth/features/verify_account_grace_period.rb
74 def account_in_unverified_grace_period?
75   return false unless account || (session_value && account_from_session)
76   account[account_status_column] == account_unverified_status_value &&
77     verify_account_grace_period &&
78     !verify_account_ds.where(Sequel.date_add(verification_requested_at_column, :seconds=>verify_account_grace_period) > Sequel::CURRENT_TIMESTAMP).empty?
79 end

    # File lib/rodauth/features/base.rb
341 def account_initial_status_value
342   account_open_status_value
343 end

    # File lib/rodauth/features/lockout.rb
311 def account_lockouts_ds(id=account_id)
312   db[account_lockouts_table].where(account_lockouts_id_column=>id)
313 end

    # File lib/rodauth/features/lockout.rb
307 def account_login_failures_ds
308   db[account_login_failures_table].where(account_login_failures_id_column=>account_id)
309 end

    # File lib/rodauth/features/base.rb
272 def account_password_hash_column
273   nil
274 end

    # File lib/rodauth/features/base.rb
664 def account_session_status_filter
665   {account_status_column=>account_open_status_value}
666 end

    # File lib/rodauth/features/webauthn.rb
262 def account_webauthn_ids
263   webauthn_keys_ds.select_map(webauthn_keys_webauthn_id_column)
264 end

    # File lib/rodauth/features/webauthn.rb
266 def account_webauthn_usage
267   webauthn_keys_ds.select_hash(webauthn_keys_webauthn_id_column, webauthn_keys_last_use_column)
268 end

    # File lib/rodauth/features/webauthn.rb
270 def account_webauthn_user_id
271   unless webauthn_id = webauthn_user_ids_ds.get(webauthn_user_ids_webauthn_id_column)
272     webauthn_id = WebAuthn.generate_user_id
273     if e = raised_uniqueness_violation do
274           webauthn_user_ids_ds.insert(
275             webauthn_user_ids_account_id_column => webauthn_account_id,
276             webauthn_user_ids_webauthn_id_column => webauthn_id
277           )
278         end
279       # If two requests to create a webauthn user id are sent at the same time and an insert
280       # is attempted for both, one will fail with a unique constraint violation.  In that case
281       # it is safe for the second one to use the webauthn user id inserted by the other request.
282       # If there is still no webauthn user id at this point, then we'll just reraise the
283       # exception.
284       # :nocov:
285       raise e unless webauthn_id = webauthn_user_ids_ds.get(webauthn_user_ids_webauthn_id_column)
286       # :nocov:
287     end
288   end
289 
290   webauthn_id
291 end

    # File lib/rodauth/features/remember.rb
222 def active_remember_key_ds(id=account_id)
223   remember_key_ds(id).where(Sequel.expr(remember_deadline_column) > Sequel::CURRENT_TIMESTAMP)
224 end

    # File lib/rodauth/features/active_sessions.rb
170 def active_sessions_ds
171   db[active_sessions_table].
172     where(active_sessions_account_id_column=>session_value)
173 end

    # File lib/rodauth/features/active_sessions.rb
139 def active_sessions_insert_hash
140   {active_sessions_account_id_column => session_value, active_sessions_session_id_column => compute_hmac(active_sessions_key)}
141 end

    # File lib/rodauth/features/active_sessions.rb
143 def active_sessions_update_hash
144   {active_sessions_last_use_column => Sequel::CURRENT_TIMESTAMP}
145 end

   # File lib/rodauth/features/active_sessions.rb
65 def add_active_session
66   key = generate_active_sessions_key
67   set_session_value(session_id_session_key, key)
68   if e = raises_uniqueness_violation?{active_sessions_ds.insert(active_sessions_insert_hash)}
69     handle_duplicate_active_session_id(e)
70   end
71   nil
72 end

   # File lib/rodauth/features/audit_logging.rb
39 def add_audit_log(account_id, action)
40   if hash = audit_log_insert_hash(account_id, action)
41     audit_log_ds.insert(hash)
42   end
43 end

    # File lib/rodauth/features/base.rb
172 def add_field_error_class(field)
173   if field_error(field)
174     " #{input_field_error_class}"
175   end
176 end

   # File lib/rodauth/features/disallow_password_reuse.rb
25 def add_previous_password_hash(hash) 
26   ds = previous_password_ds
27 
28   unless @dont_check_previous_password
29     keep_before = ds.reverse(previous_password_id_column).
30       limit(nil, previous_passwords_to_check).
31       get(previous_password_id_column)
32 
33     if keep_before
34       ds.where(Sequel.expr(previous_password_id_column) <= keep_before).
35         delete
36     end
37   end
38 
39   # This should never raise uniqueness violations, as it uses a serial primary key
40   ds.insert(previous_password_account_id_column=>account_id, previous_password_hash_column=>hash)
41 end

    # File lib/rodauth/features/recovery_codes.rb
186 def add_recovery_code
187   # This should never raise uniqueness violations unless the recovery code is the same, and the odds of that
188   # are 1/256**32 assuming a good random number generator.  Still, attempt to handle that case by retrying
189   # on such a uniqueness violation.
190   retry_on_uniqueness_violation do
191     recovery_codes_ds.insert(recovery_codes_id_column=>session_value, recovery_codes_column=>new_recovery_code)
192   end
193 end

    # File lib/rodauth/features/recovery_codes.rb
176 def add_recovery_codes(number)
177   return if number <= 0
178   transaction do
179     number.times do
180       add_recovery_code
181     end
182   end
183   remove_instance_variable(:@recovery_codes)
184 end

    # File lib/rodauth/features/remember.rb
173 def add_remember_key
174   hash = {remember_id_column=>account_id, remember_key_column=>remember_key_value}
175   set_deadline_value(hash, remember_deadline_column, remember_deadline_interval)
176 
177   if e = raised_uniqueness_violation{remember_key_ds.insert(hash)}
178     # If inserting into the remember key table causes a violation, we can pull the
179     # existing row from the table.  If there is no invalid row, we can then reraise.
180     raise e unless @remember_key_value = active_remember_key_ds.get(remember_key_column)
181   end
182 end

    # File lib/rodauth/features/recovery_codes.rb
150 def add_webauthn_credential(_)
151   super if defined?(super)
152   auto_add_missing_recovery_codes
153 end

   # File lib/rodauth/features/change_password_notify.rb
31 def after_change_password
32   super
33   send_password_changed_email
34 end

    # File lib/rodauth/features/account_expiration.rb
 99 def after_close_account
100   super if defined?(super)
101   account_activity_ds(account_id).delete
102 end

   # File lib/rodauth/features/disallow_password_reuse.rb
87 def after_create_account
88   if account_password_hash_column && !(respond_to?(:verify_account_set_password?) && verify_account_set_password?)
89     add_previous_password_hash(password_hash(param(password_param)))
90   end
91   super if defined?(super)
92 end

    # File lib/rodauth/features/email_auth.rb
215 def after_login
216   # Remove the email auth key after any login, even if
217   # it is a password login.  This is done to invalidate
218   # the email login when a user has a password and requests
219   # email authentication, but then remembers their password
220   # and doesn't need the link.  At that point, the link
221   # that allows login access to the account becomes a
222   # security liability, and it is best to remove it.
223   remove_email_auth_key
224   super
225 end

    # File lib/rodauth/features/email_auth.rb
158 def after_login_entered_during_multi_phase_login
159   # If forcing email auth, just send the email link.
160   _email_auth_request_and_redirect if force_email_auth?
161 
162   super
163 end

    # File lib/rodauth/features/lockout.rb
265 def after_login_failure
266   invalid_login_attempted
267   super
268 end

    # File lib/rodauth/features/remember.rb
198 def after_logout
199   forget_login
200   super if defined?(super)
201 end

    # File lib/rodauth/features/recovery_codes.rb
220 def after_otp_disable
221   super if defined?(super)
222   auto_remove_recovery_codes
223 end

    # File lib/rodauth/features/active_sessions.rb
108 def after_refresh_token
109   super if defined?(super)
110   if prev_key = session[session_id_session_key]
111     key = generate_active_sessions_key
112     set_session_value(session_id_session_key, key)
113     active_sessions_ds.
114       where(active_sessions_session_id_column => compute_hmac(prev_key)).
115       update(active_sessions_session_id_column => compute_hmac(key))
116   end
117 end

   # File lib/rodauth/features/password_grace_period.rb
39 def after_reset_password
40   super if defined?(super)
41   @last_password_entry = Time.now.to_i
42 end

    # File lib/rodauth/features/recovery_codes.rb
225 def after_sms_disable
226   super if defined?(super)
227   auto_remove_recovery_codes
228 end

    # File lib/rodauth/features/recovery_codes.rb
230 def after_webauthn_remove
231   super if defined?(super)
232   auto_remove_recovery_codes
233 end

    # File lib/rodauth/features/email_auth.rb
211 def allow_email_auth?
212   defined?(super) ? super : true
213 end

    # File lib/rodauth/features/verify_account.rb
173 def allow_resending_verify_account_email?
174   account[account_status_column] == account_unverified_status_value
175 end

    # File lib/rodauth/features/base.rb
280 def already_logged_in
281   nil
282 end

   # File lib/rodauth/features/argon2.rb
61 def argon2_hash_algorithm?(hash)
62   hash.start_with?('$argon2id$')
63 end

   # File lib/rodauth/features/argon2.rb
50 def argon2_hash_cost
51   {t_cost: 1, m_cost: 3}
52 end

   # File lib/rodauth/features/argon2.rb
65 def argon2_password_hash_match?(hash, password)
66   ::Argon2::Password.verify_password(password, hash)
67 end

   # File lib/rodauth/features/audit_logging.rb
83 def audit_log_ds
84   ds = db[audit_logging_table]
85   # :nocov:
86   if db.database_type == :postgres
87   # :nocov:
88     # For PostgreSQL, use RETURNING NULL. This allows the feature
89     # to be used with INSERT but not SELECT permissions on the
90     # table, useful for audit logging where the database user
91     # the application is running as should not need to read the
92     # logs.
93     ds = ds.returning(nil)
94   end
95   ds
96 end

   # File lib/rodauth/features/audit_logging.rb
45 def audit_log_insert_hash(account_id, action)
46   if message = audit_log_message(action)
47     {
48       audit_logging_account_id_column => account_id,
49       audit_logging_message_column => message,
50       audit_logging_metadata_column => serialize_audit_log_metadata(audit_log_metadata(action))
51     }
52   end
53 end

   # File lib/rodauth/features/audit_logging.rb
63 def audit_log_message(action)
64   meth = :"audit_log_message_for_#{action}"
65   if respond_to?(meth, true)
66     send(meth)
67   else
68     audit_log_message_default(action)
69   end
70 end

   # File lib/rodauth/features/audit_logging.rb
59 def audit_log_message_default(action)
60   action.to_s
61 end

   # File lib/rodauth/features/audit_logging.rb
72 def audit_log_metadata(action)
73   meth = :"audit_log_metadata_for_#{action}"
74   if respond_to?(meth, true)
75     send(meth)
76   else
77     audit_log_metadata_default
78   end
79 end

    # File lib/rodauth/features/base.rb
123 def auth_class_eval(&block)
124   auth.class_eval(&block)
125 end

    # File lib/rodauth/features/base.rb
333 def authenticated?
334   logged_in?
335 end

    # File lib/rodauth/features/base.rb
416 def authenticated_by
417   session[authenticated_by_session_key]
418 end

    # File lib/rodauth/features/webauthn.rb
242 def authenticated_webauthn_id
243   session[authenticated_webauthn_id_session_key]
244 end

    # File lib/rodauth/features/recovery_codes.rb
243 def auto_add_missing_recovery_codes
244   if auto_add_recovery_codes?
245     add_recovery_codes(recovery_codes_limit - recovery_codes.length)
246   end
247 end

    # File lib/rodauth/features/recovery_codes.rb
249 def auto_remove_recovery_codes
250   if auto_remove_recovery_codes? && (%w'totp webauthn sms_code' & possible_authentication_methods).empty?
251     recovery_codes_remove
252   end
253 end

    # File lib/rodauth/features/base.rb
202 def autocomplete_for_field?(_param)
203   mark_input_fields_with_autocomplete?
204 end

    # File lib/rodauth/features/base.rb
429 def autologin_session(autologin_type)
430   login_session('autologin')
431   set_session_value(autologin_type_session_key, autologin_type)
432 end

    # File lib/rodauth/features/base.rb
425 def autologin_type
426   session[autologin_type_session_key]
427 end

    # File lib/rodauth/features/otp.rb
386 def base32_encode(data, length)
387   chars = 'abcdefghijklmnopqrstuvwxyz234567'
388   length.times.map{|i|chars[data[i].ord % 32]}.join
389 end

    # File lib/rodauth/features/base.rb
451 def base_url
452   url = String.new("#{request.scheme}://#{domain}")
453   url << ":#{request.port}" if request.port != Rack::Request::DEFAULT_PORTS[request.scheme]
454   url
455 end

   # File lib/rodauth/features/verify_account_grace_period.rb
47 def before_change_login_route
48   unless verified_account?
49     set_redirect_error_flash unverified_change_login_error_flash
50     redirect unverified_change_login_redirect
51   end
52   super if defined?(super)
53 end

   # File lib/rodauth/features/password_expiration.rb
90 def before_change_password_route
91   check_password_change_allowed
92   super
93 end

   # File lib/rodauth/features/disallow_password_reuse.rb
77 def before_create_account_route
78   super if defined?(super)
79   @dont_check_previous_password = true
80 end

    # File lib/rodauth/features/lockout.rb
253 def before_login_attempt
254   if locked_out?
255     show_lockout_page
256   end
257   super
258 end

    # File lib/rodauth/features/active_sessions.rb
124 def before_logout
125   if param_or_nil(global_logout_param)
126     remove_all_active_sessions
127   else
128     remove_current_session
129   end
130   super
131 end

    # File lib/rodauth/features/json.rb
115 def before_otp_setup_route
116   super if defined?(super)
117   if use_json? && otp_keys_use_hmac? && !param_or_nil(otp_setup_raw_param)
118     _otp_tmp_key(otp_new_secret)
119     json_response[otp_setup_param] = otp_user_key
120     json_response[otp_setup_raw_param] = otp_key
121   end
122 end

   # File lib/rodauth/features/account_expiration.rb
79 def before_reset_password
80   check_account_expiration
81   super if defined?(super)
82 end

   # File lib/rodauth/features/account_expiration.rb
84 def before_reset_password_request
85   check_account_expiration
86   super if defined?(super)
87 end

    # File lib/rodauth/features/json.rb
124 def before_rodauth
125   if json_request?
126     if json_check_accept? && (accept = request.env['HTTP_ACCEPT']) && accept !~ json_accept_regexp
127       response.status = 406
128       json_response[json_response_error_key] = json_not_accepted_error_message
129       _return_json_response
130     end
131 
132     unless request.post?
133       response.status = 405
134       response.headers['Allow'] = 'POST'
135       json_response[json_response_error_key] = json_non_post_error_message
136       return_json_response
137     end
138   elsif only_json?
139     response.status = json_response_error_status
140     response.write non_json_request_error_message
141     request.halt
142   end
143 
144   super
145 end

   # File lib/rodauth/features/account_expiration.rb
89 def before_unlock_account
90   check_account_expiration
91   super if defined?(super)
92 end

   # File lib/rodauth/features/account_expiration.rb
94 def before_unlock_account_request
95   check_account_expiration
96   super if defined?(super)
97 end

   # File lib/rodauth/features/webauthn_verify_account.rb
30 def before_verify_account
31   super
32   if features.include?(:json) && use_json? && !param_or_nil(webauthn_setup_param)
33     cred = new_webauthn_credential
34     json_response[webauthn_setup_param] = cred.as_json
35     json_response[webauthn_setup_challenge_param] = cred.challenge
36     json_response[webauthn_setup_challenge_hmac_param] = compute_hmac(cred.challenge)
37   end
38   @webauthn_credential = webauthn_setup_credential_from_form_submission
39   add_webauthn_credential(@webauthn_credential)
40 end

   # File lib/rodauth/features/disallow_password_reuse.rb
82 def before_verify_account_route
83   super if defined?(super)
84   @dont_check_previous_password = true
85 end

   # File lib/rodauth/features/json.rb
70 def before_view_recovery_codes
71   super if defined?(super)
72   if use_json?
73     json_response[:codes] = recovery_codes
74     json_response[json_response_success_key] ||= "" if include_success_messages?
75   end
76 end

   # File lib/rodauth/features/json.rb
88 def before_webauthn_auth_route
89   super if defined?(super)
90   if use_json? && !param_or_nil(webauthn_auth_param)
91     cred = webauth_credential_options_for_get
92     json_response[webauthn_auth_param] = cred.as_json
93     json_response[webauthn_auth_challenge_param] = cred.challenge
94     json_response[webauthn_auth_challenge_hmac_param] = compute_hmac(cred.challenge)
95   end
96 end

    # File lib/rodauth/features/json.rb
 98 def before_webauthn_login_route
 99   super if defined?(super)
100   if use_json? && !param_or_nil(webauthn_auth_param) && account_from_login(param(login_param))
101     cred = webauth_credential_options_for_get
102     json_response[webauthn_auth_param] = cred.as_json
103     json_response[webauthn_auth_challenge_param] = cred.challenge
104     json_response[webauthn_auth_challenge_hmac_param] = compute_hmac(cred.challenge)
105   end
106 end

    # File lib/rodauth/features/json.rb
108 def before_webauthn_remove_route
109   super if defined?(super)
110   if use_json? && !param_or_nil(webauthn_remove_param)
111     json_response[webauthn_remove_param] = account_webauthn_usage
112   end
113 end

   # File lib/rodauth/features/json.rb
78 def before_webauthn_setup_route
79   super if defined?(super)
80   if use_json? && !param_or_nil(webauthn_setup_param)
81     cred = new_webauthn_credential
82     json_response[webauthn_setup_param] = cred.as_json
83     json_response[webauthn_setup_challenge_param] = cred.challenge
84     json_response[webauthn_setup_challenge_hmac_param] = compute_hmac(cred.challenge)
85   end
86 end

    # File lib/rodauth/features/base.rb
374 def button(value, opts={})
375   scope.render(button_opts(value, opts))
376 end

    # File lib/rodauth/features/base.rb
365 def button_opts(value, opts)
366   opts = Hash[template_opts].merge!(opts)
367   opts[:locals] = {:value=>value, :opts=>opts}
368   opts[:path] = template_path('button')
369   opts[:cache] = cache_templates
370   opts[:cache_key] = :rodauth_button
371   opts
372 end

    # File lib/rodauth/features/recovery_codes.rb
172 def can_add_recovery_codes?
173   recovery_codes.length < recovery_codes_limit
174 end

    # File lib/rodauth/features/base.rb
539 def catch_error(&block)
540   catch(:rodauth_error, &block)
541 end

   # File lib/rodauth/features/change_login.rb
68 def change_login(login)
69   if account_ds.get(login_column).downcase == login.downcase
70     set_login_requirement_error_message(:same_as_current_login, same_as_current_login_message)
71     return false
72   end
73 
74   update_login(login)
75 end

    # File lib/rodauth/features/verify_login_change.rb
138 def change_login_notice_flash
139   change_login_needs_verification_notice_flash
140 end

   # File lib/rodauth/features/change_login.rb
64 def change_login_requires_password?
65   modifications_require_password?
66 end

   # File lib/rodauth/features/change_password.rb
68 def change_password_requires_password?
69   modifications_require_password?
70 end

   # File lib/rodauth/features/account_expiration.rb
63 def check_account_expiration
64   if account_expired?
65     set_expired unless account_expired_at
66     set_redirect_error_flash account_expiration_error_flash
67     redirect account_expiration_redirect
68   end
69   update_last_login
70 end

   # File lib/rodauth/features/active_sessions.rb
51 def check_active_session
52   if logged_in? && !currently_active_session?
53     no_longer_active_session
54   end
55 end

    # File lib/rodauth/features/base.rb
276 def check_already_logged_in
277   already_logged_in if logged_in?
278 end

    # File lib/rodauth/features/base.rb
349 def check_csrf
350   scope.check_csrf!(check_csrf_opts, &check_csrf_block)
351 end

    # File lib/rodauth/features/base.rb
597 def check_csrf?
598   scope.opts[:rodauth_route_csrf]
599 end

   # File lib/rodauth/features/password_expiration.rb
30 def check_password_change_allowed
31   if password_changed_at = get_password_changed_at
32     if password_changed_at > Time.now - allow_password_change_after
33       set_redirect_error_flash password_not_changeable_yet_error_flash
34       redirect password_not_changeable_yet_redirect
35     end
36   end
37 end

   # File lib/rodauth/features/session_expiration.rb
15 def check_session_expiration
16   return unless logged_in?
17 
18   unless session.has_key?(session_last_activity_session_key) && session.has_key?(session_created_session_key)
19     if session_expiration_default
20       expire_session
21     end
22 
23     return
24   end
25 
26   time = Time.now.to_i
27 
28   if session[session_last_activity_session_key] + session_inactivity_timeout < time
29     expire_session
30   end
31   set_session_value(session_last_activity_session_key, time)
32 
33   if session[session_created_session_key] + max_session_lifetime < time
34     expire_session
35   end
36 end

   # File lib/rodauth/features/single_session.rb
51 def check_single_session
52   if logged_in? && !currently_active_session?
53     no_longer_active_session
54   end
55 end

    # File lib/rodauth/features/otp.rb
352 def clear_cached_otp
353   remove_instance_variable(:@otp) if defined?(@otp)
354 end

    # File lib/rodauth/features/lockout.rb
170 def clear_invalid_login_attempts
171   unlock_account
172 end

    # File lib/rodauth/features/base.rb
292 def clear_session
293   if scope.respond_to?(:clear_session)
294     scope.clear_session
295   else
296     session.clear
297   end
298 end

   # File lib/rodauth/features/close_account.rb
66 def close_account
67   unless skip_status_checks?
68     update_account(account_status_column=>account_closed_status_value)
69   end
70 
71   unless account_password_hash_column
72     password_hash_ds.delete
73   end
74 end

   # File lib/rodauth/features/close_account.rb
62 def close_account_requires_password?
63   modifications_require_password?
64 end

    # File lib/rodauth/features/base.rb
236 def compute_hmac(data)
237   s = [compute_raw_hmac(data)].pack('m').chomp!("=\n")
238   s.tr!('+/', '-_')
239   s
240 end

    # File lib/rodauth/features/base.rb
648 def compute_raw_hmac(data)
649   OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, hmac_secret, data)
650 end

   # File lib/rodauth/features/confirm_password.rb
63 def confirm_password
64   authenticated_by.delete('autologin')
65   authenticated_by.delete('remember')
66   authenticated_by.delete('email_auth')
67   authenticated_by.delete('password')
68   authenticated_by.unshift("password")
69   remove_session_value(autologin_type_session_key)
70   nil
71 end

   # File lib/rodauth/features/confirm_password.rb
73 def confirm_password_redirect
74   remove_session_value(confirm_password_redirect_session_key) || default_redirect
75 end

   # File lib/rodauth/features/email_base.rb
61 def convert_email_token_key(key)
62   convert_token_key(key)
63 end

    # File lib/rodauth/features/base.rb
517 def convert_session_key(key)
518   key = "#{session_key_prefix}#{key}".to_sym if session_key_prefix
519   scope.opts[:sessions_convert_symbols] ? key.to_s : key
520 end

    # File lib/rodauth/features/base.rb
684 def convert_timestamp(timestamp)
685   timestamp = db.to_application_timestamp(timestamp) if timestamp.is_a?(String)
686   timestamp
687 end

    # File lib/rodauth/features/base.rb
483 def convert_token_key(key)
484   if key && hmac_secret
485     compute_hmac(key)
486   else
487     key
488   end
489 end

    # File lib/rodauth/features/verify_account.rb
232 def create_account_autologin?
233   false
234 end

    # File lib/rodauth/features/verify_account.rb
193 def create_account_notice_flash
194   verify_account_email_sent_notice_flash
195 end

    # File lib/rodauth/features/verify_account.rb
236 def create_account_set_password?
237   return false if verify_account_set_password?
238   super
239 end

   # File lib/rodauth/features/email_base.rb
32 def create_email(subject, body)
33   create_email_to(email_to, subject, body)
34 end

    # File lib/rodauth/features/email_auth.rb
236 def create_email_auth_email
237   create_email(email_auth_email_subject, email_auth_email_body)
238 end

    # File lib/rodauth/features/email_auth.rb
107 def create_email_auth_key
108   transaction do
109     if email_auth_key_value = get_email_auth_key(account_id)
110       set_email_auth_email_last_sent
111       @email_auth_key_value = email_auth_key_value
112     elsif e = raised_uniqueness_violation{email_auth_ds.insert(email_auth_key_insert_hash)}
113       # If inserting into the email auth table causes a violation, we can pull the
114       # existing email auth key from the table, or reraise.
115       raise e unless @email_auth_key_value = get_email_auth_key(account_id)
116     end
117   end
118 end

   # File lib/rodauth/features/email_base.rb
36 def create_email_to(to, subject, body)
37   m = Mail.new
38   m.from = email_from
39   m.to = to
40   m.subject = "#{email_subject_prefix}#{subject}"
41   m.body = body
42   m
43 end

   # File lib/rodauth/features/change_password_notify.rb
23 def create_password_changed_email
24   create_email(password_changed_email_subject, password_changed_email_body)
25 end

    # File lib/rodauth/features/reset_password.rb
244 def create_reset_password_email
245   create_email(reset_password_email_subject, reset_password_email_body)
246 end

    # File lib/rodauth/features/reset_password.rb
169 def create_reset_password_key
170   transaction do
171     if reset_password_key_value = get_password_reset_key(account_id)
172       set_reset_password_email_last_sent
173       @reset_password_key_value = reset_password_key_value
174     elsif e = raised_uniqueness_violation{password_reset_ds.insert(reset_password_key_insert_hash)}
175       # If inserting into the reset password table causes a violation, we can pull the
176       # existing reset password key from the table, or reraise.
177       raise e unless @reset_password_key_value = get_password_reset_key(account_id)
178     end
179   end
180 end

    # File lib/rodauth/features/lockout.rb
291 def create_unlock_account_email
292   create_email(unlock_account_email_subject, unlock_account_email_body)
293 end

    # File lib/rodauth/features/verify_account.rb
316 def create_verify_account_email
317   create_email(verify_account_email_subject, verify_account_email_body)
318 end

    # File lib/rodauth/features/verify_account.rb
299 def create_verify_account_key
300   ds = verify_account_ds
301   transaction do
302     if ds.empty?
303       if e = raised_uniqueness_violation{ds.insert(verify_account_key_insert_hash)}
304         # If inserting into the verify account table causes a violation, we can pull the
305         # key from the verify account table, or reraise.
306         raise e unless @verify_account_key_value = get_verify_account_key(account_id)
307       end
308     end
309   end
310 end

    # File lib/rodauth/features/verify_login_change.rb
200 def create_verify_login_change_email(login)
201   create_email_to(login, verify_login_change_email_subject, verify_login_change_email_body)
202 end

    # File lib/rodauth/features/verify_login_change.rb
178 def create_verify_login_change_key(login)
179   ds = verify_login_change_ds
180   transaction do
181     ds.where((Sequel::CURRENT_TIMESTAMP > verify_login_change_deadline_column) | ~Sequel.expr(verify_login_change_login_column=>login)).delete
182     if e = raised_uniqueness_violation{ds.insert(verify_login_change_key_insert_hash(login))}
183       old_login, key = get_verify_login_change_login_and_key(account_id)
184       # If inserting into the verify login change table causes a violation, we can pull the
185       # key from the verify login change table if the logins match, or reraise.
186       @verify_login_change_key_value = if old_login.downcase == login.downcase
187         key
188       end
189       raise e unless @verify_login_change_key_value
190     end
191   end
192 end

    # File lib/rodauth/features/base.rb
353 def csrf_tag(path=request.path)
354   return unless scope.respond_to?(:csrf_tag)
355 
356   if use_request_specific_csrf_tokens?
357     scope.csrf_tag(path)
358   else
359     # :nocov:
360     scope.csrf_tag
361     # :nocov:
362   end
363 end

   # File lib/rodauth/features/active_sessions.rb
37 def currently_active_session?
38   return false unless session_id = session[session_id_session_key]
39 
40   remove_inactive_sessions
41   ds = active_sessions_ds.
42     where(active_sessions_session_id_column => compute_hmac(session_id))
43 
44   if update_current_session?
45     ds.update(active_sessions_update_hash) == 1
46   else
47     ds.count == 1
48   end
49 end

    # File lib/rodauth/features/base.rb
475 def database_function_password_match?(name, hash_id, password, salt)
476   db.get(Sequel.function(function_name(name), hash_id, password_hash_using_salt(password, salt)))
477 end

    # File lib/rodauth/features/base.rb
260 def db
261   Sequel::DATABASES.first
262 end

   # File lib/rodauth/features/close_account.rb
76 def delete_account
77   account_ds.delete
78 end

   # File lib/rodauth/features/close_account.rb
80 def delete_account_on_close?
81   skip_status_checks?
82 end

    # File lib/rodauth/features/remember.rb
169 def disable_remember_login
170   remove_remember_key
171 end

    # File lib/rodauth/features/base.rb
457 def domain
458   request.host
459 end

    # File lib/rodauth/features/email_auth.rb
254 def email_auth_ds(id=account_id)
255   db[email_auth_table].where(email_auth_id_column=>id)
256 end

    # File lib/rodauth/features/email_auth.rb
240 def email_auth_email_body
241   render('email-auth-email')
242 end

    # File lib/rodauth/features/email_auth.rb
144 def email_auth_email_link
145   token_link(email_auth_route, email_auth_key_param, email_auth_key_value)
146 end

    # File lib/rodauth/features/email_auth.rb
183 def email_auth_email_recently_sent?
184   (email_last_sent = get_email_auth_email_last_sent) && (Time.now - email_last_sent < email_auth_skip_resend_email_within)
185 end

    # File lib/rodauth/features/email_auth.rb
248 def email_auth_key_insert_hash
249   hash = {email_auth_id_column=>account_id, email_auth_key_column=>email_auth_key_value}
250   set_deadline_value(hash, email_auth_deadline_column, email_auth_deadline_interval)
251   hash
252 end

    # File lib/rodauth/features/email_auth.rb
154 def email_auth_request_form
155   render('email-auth-request-form')
156 end

   # File lib/rodauth/features/email_base.rb
45 def email_from
46   "webmaster@#{domain}"
47 end

   # File lib/rodauth/features/email_base.rb
49 def email_to
50   account[login_column]
51 end

   # File lib/rodauth/features/session_expiration.rb
38 def expire_session
39   clear_session
40   set_redirect_error_status session_expiration_error_status
41   set_error_reason :session_expired
42   set_redirect_error_flash session_expiration_error_flash
43   redirect session_expiration_redirect
44 end

   # File lib/rodauth/features/argon2.rb
42 def extract_password_hash_cost(hash)
43   return super unless argon2_hash_algorithm?(hash )
44 
45   /\A\$argon2id\$v=\d+\$m=(\d+),t=(\d+)/ =~ hash
46   { t_cost: $2.to_i, m_cost: Math.log2($1.to_i).to_i }
47 end

    # File lib/rodauth/features/base.rb
135 def features
136   self.class.features
137 end

    # File lib/rodauth/features/base.rb
210 def field_attributes(field)
211   _field_attributes(field) || default_field_attributes
212 end

    # File lib/rodauth/features/base.rb
167 def field_error(field)
168   return nil unless @field_errors
169   @field_errors[field]
170 end

    # File lib/rodauth/features/base.rb
214 def field_error_attributes(field)
215   if field_error(field)
216     _field_error_attributes(field)
217   end
218 end

    # File lib/rodauth/features/base.rb
151 def flash
152   scope.flash
153 end

    # File lib/rodauth/features/remember.rb
152 def forget_login
153   opts = Hash[remember_cookie_options]
154   opts[:path] = "/" unless opts.key?(:path)
155   ::Rack::Utils.delete_cookie_header!(response.headers, remember_cookie_key, opts)
156 end

    # File lib/rodauth/features/base.rb
220 def formatted_field_error(field)
221   if error = field_error(field)
222     _formatted_field_error(field, error)
223   end
224 end

    # File lib/rodauth/features/base.rb
601 def function_name(name)
602   if db.database_type == :mssql
603     # :nocov:
604     "dbo.#{name}"
605     # :nocov:
606   else
607     name
608   end
609 end

    # File lib/rodauth/features/active_sessions.rb
135 def generate_active_sessions_key
136   @active_sessions_key = random_key
137 end

    # File lib/rodauth/features/email_auth.rb
232 def generate_email_auth_key_value
233   @email_auth_key_value = random_key
234 end

    # File lib/rodauth/features/jwt_refresh.rb
181 def generate_refresh_token
182   hash = jwt_refresh_token_insert_hash
183   [account_id, jwt_refresh_token_ds.insert(hash), convert_token_key(hash[jwt_refresh_token_key_column])].join(token_separator)
184 end

    # File lib/rodauth/features/remember.rb
210 def generate_remember_key_value
211   @remember_key_value = random_key
212 end

    # File lib/rodauth/features/reset_password.rb
240 def generate_reset_password_key_value
241   @reset_password_key_value = random_key
242 end

    # File lib/rodauth/features/lockout.rb
275 def generate_unlock_account_key
276   random_key
277 end

    # File lib/rodauth/features/verify_account.rb
295 def generate_verify_account_key_value
296   @verify_account_key_value = random_key
297 end

    # File lib/rodauth/features/verify_login_change.rb
174 def generate_verify_login_change_key_value
175   @verify_login_change_key_value = random_key
176 end

    # File lib/rodauth/features/jwt_refresh.rb
154 def get_active_refresh_token(account_id, token_id)
155   jwt_refresh_token_account_ds(account_id).
156     where(Sequel::CURRENT_TIMESTAMP > jwt_refresh_token_deadline_column).
157     delete
158 
159   jwt_refresh_token_account_token_ds(account_id, token_id).
160     get(jwt_refresh_token_key_column)
161 end

    # File lib/rodauth/features/account_expiration.rb
109 def get_activity_timestamp(account_id, column)
110   convert_timestamp(account_activity_ds(account_id).get(column))
111 end

    # File lib/rodauth/features/email_auth.rb
124 def get_email_auth_email_last_sent
125   if column = email_auth_email_last_sent_column
126     if ts = email_auth_ds.get(column)
127       convert_timestamp(ts)
128     end
129   end
130 end

    # File lib/rodauth/features/email_auth.rb
148 def get_email_auth_key(id)
149   ds = email_auth_ds(id)
150   ds.where(Sequel::CURRENT_TIMESTAMP > email_auth_deadline_column).delete
151   ds.get(email_auth_key_column)
152 end

   # File lib/rodauth/features/password_expiration.rb
26 def get_password_changed_at
27   convert_timestamp(password_expiration_ds.get(password_expiration_changed_at_column))
28 end

    # File lib/rodauth/features/base.rb
623 def get_password_hash
624   if account_password_hash_column
625     (account || account_from_session)[account_password_hash_column]
626   elsif use_database_authentication_functions?
627     db.get(Sequel.function(function_name(:rodauth_get_salt), account ? account_id : session_value))
628   else
629     # :nocov:
630     password_hash_ds.get(password_hash_column)
631     # :nocov:
632   end
633 end