Init the project.
This commit is contained in:
@@ -0,0 +1,109 @@
|
||||
defmodule DecentralisedBookIndex.Accounts.Token do
|
||||
use Ash.Resource,
|
||||
otp_app: :decentralised_book_index,
|
||||
domain: DecentralisedBookIndex.Accounts,
|
||||
authorizers: [Ash.Policy.Authorizer],
|
||||
extensions: [AshAuthentication.TokenResource],
|
||||
data_layer: AshPostgres.DataLayer
|
||||
|
||||
postgres do
|
||||
table "tokens"
|
||||
repo DecentralisedBookIndex.Repo
|
||||
end
|
||||
|
||||
actions do
|
||||
defaults [:read]
|
||||
|
||||
read :expired do
|
||||
description "Look up all expired tokens."
|
||||
filter expr(expires_at < now())
|
||||
end
|
||||
|
||||
read :get_token do
|
||||
description "Look up a token by JTI or token, and an optional purpose."
|
||||
get? true
|
||||
argument :token, :string, sensitive?: true
|
||||
argument :jti, :string, sensitive?: true
|
||||
argument :purpose, :string, sensitive?: false
|
||||
|
||||
prepare AshAuthentication.TokenResource.GetTokenPreparation
|
||||
end
|
||||
|
||||
action :revoked?, :boolean do
|
||||
description "Returns true if a revocation token is found for the provided token"
|
||||
argument :token, :string, sensitive?: true
|
||||
argument :jti, :string, sensitive?: true
|
||||
|
||||
run AshAuthentication.TokenResource.IsRevoked
|
||||
end
|
||||
|
||||
create :revoke_token do
|
||||
description "Revoke a token. Creates a revocation token corresponding to the provided token."
|
||||
accept [:extra_data]
|
||||
argument :token, :string, allow_nil?: false, sensitive?: true
|
||||
|
||||
change AshAuthentication.TokenResource.RevokeTokenChange
|
||||
end
|
||||
|
||||
create :store_token do
|
||||
description "Stores a token used for the provided purpose."
|
||||
accept [:extra_data, :purpose]
|
||||
argument :token, :string, allow_nil?: false, sensitive?: true
|
||||
change AshAuthentication.TokenResource.StoreTokenChange
|
||||
end
|
||||
|
||||
destroy :expunge_expired do
|
||||
description "Deletes expired tokens."
|
||||
change filter expr(expires_at < now())
|
||||
end
|
||||
|
||||
update :revoke_all_stored_for_subject do
|
||||
description "Revokes all stored tokens for a specific subject."
|
||||
accept [:extra_data]
|
||||
argument :subject, :string, allow_nil?: false, sensitive?: true
|
||||
change AshAuthentication.TokenResource.RevokeAllStoredForSubjectChange
|
||||
end
|
||||
end
|
||||
|
||||
policies do
|
||||
bypass AshAuthentication.Checks.AshAuthenticationInteraction do
|
||||
description "AshAuthentication can interact with the token resource"
|
||||
authorize_if always()
|
||||
end
|
||||
|
||||
policy always() do
|
||||
description "No one aside from AshAuthentication can interact with the tokens resource."
|
||||
forbid_if always()
|
||||
end
|
||||
end
|
||||
|
||||
attributes do
|
||||
attribute :jti, :string do
|
||||
primary_key? true
|
||||
public? true
|
||||
allow_nil? false
|
||||
sensitive? true
|
||||
end
|
||||
|
||||
attribute :subject, :string do
|
||||
allow_nil? false
|
||||
public? true
|
||||
end
|
||||
|
||||
attribute :expires_at, :utc_datetime do
|
||||
allow_nil? false
|
||||
public? true
|
||||
end
|
||||
|
||||
attribute :purpose, :string do
|
||||
allow_nil? false
|
||||
public? true
|
||||
end
|
||||
|
||||
attribute :extra_data, :map do
|
||||
public? true
|
||||
end
|
||||
|
||||
timestamps()
|
||||
end
|
||||
end
|
||||
@@ -0,0 +1,250 @@
|
||||
defmodule DecentralisedBookIndex.Accounts.User do
|
||||
use Ash.Resource,
|
||||
otp_app: :decentralised_book_index,
|
||||
domain: DecentralisedBookIndex.Accounts,
|
||||
authorizers: [Ash.Policy.Authorizer],
|
||||
extensions: [AshAuthentication],
|
||||
data_layer: AshPostgres.DataLayer
|
||||
|
||||
authentication do
|
||||
add_ons do
|
||||
log_out_everywhere do
|
||||
apply_on_password_change?(true)
|
||||
end
|
||||
|
||||
confirmation :confirm_new_user do
|
||||
monitor_fields [:email]
|
||||
confirm_on_create? true
|
||||
confirm_on_update? false
|
||||
auto_confirm_actions [:sign_in_with_magic_link, :reset_password_with_token]
|
||||
sender DecentralisedBookIndex.Accounts.User.Senders.SendNewUserConfirmationEmail
|
||||
end
|
||||
end
|
||||
|
||||
tokens do
|
||||
enabled? true
|
||||
token_resource DecentralisedBookIndex.Accounts.Token
|
||||
signing_secret DecentralisedBookIndex.Secrets
|
||||
store_all_tokens? true
|
||||
require_token_presence_for_authentication? true
|
||||
end
|
||||
|
||||
strategies do
|
||||
password :password do
|
||||
identity_field :email
|
||||
|
||||
resettable do
|
||||
sender DecentralisedBookIndex.Accounts.User.Senders.SendPasswordResetEmail
|
||||
# these configurations will be the default in a future release
|
||||
password_reset_action_name :reset_password_with_token
|
||||
request_password_reset_action_name :request_password_reset_token
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
postgres do
|
||||
table "users"
|
||||
repo DecentralisedBookIndex.Repo
|
||||
end
|
||||
|
||||
actions do
|
||||
defaults [:read]
|
||||
|
||||
read :get_by_subject do
|
||||
description "Get a user by the subject claim in a JWT"
|
||||
argument :subject, :string, allow_nil?: false
|
||||
get? true
|
||||
prepare AshAuthentication.Preparations.FilterBySubject
|
||||
end
|
||||
|
||||
update :change_password do
|
||||
# Use this action to allow users to change their password by providing
|
||||
# their current password and a new password.
|
||||
|
||||
require_atomic? false
|
||||
accept []
|
||||
argument :current_password, :string, sensitive?: true, allow_nil?: false
|
||||
argument :password, :string, sensitive?: true, allow_nil?: false
|
||||
argument :password_confirmation, :string, sensitive?: true, allow_nil?: false
|
||||
|
||||
validate confirm(:password, :password_confirmation)
|
||||
|
||||
validate {AshAuthentication.Strategy.Password.PasswordValidation,
|
||||
strategy_name: :password, password_argument: :current_password}
|
||||
|
||||
change {AshAuthentication.Strategy.Password.HashPasswordChange, strategy_name: :password}
|
||||
end
|
||||
|
||||
read :sign_in_with_password do
|
||||
description "Attempt to sign in using a email and password."
|
||||
get? true
|
||||
|
||||
argument :email, :ci_string do
|
||||
description "The email to use for retrieving the user."
|
||||
allow_nil? false
|
||||
end
|
||||
|
||||
argument :password, :string do
|
||||
description "The password to check for the matching user."
|
||||
allow_nil? false
|
||||
sensitive? true
|
||||
end
|
||||
|
||||
# validates the provided email and password and generates a token
|
||||
prepare AshAuthentication.Strategy.Password.SignInPreparation
|
||||
|
||||
metadata :token, :string do
|
||||
description "A JWT that can be used to authenticate the user."
|
||||
allow_nil? false
|
||||
end
|
||||
end
|
||||
|
||||
read :sign_in_with_token do
|
||||
# In the generated sign in components, we validate the
|
||||
# email and password directly in the LiveView
|
||||
# and generate a short-lived token that can be used to sign in over
|
||||
# a standard controller action, exchanging it for a standard token.
|
||||
# This action performs that exchange. If you do not use the generated
|
||||
# liveviews, you may remove this action, and set
|
||||
# `sign_in_tokens_enabled? false` in the password strategy.
|
||||
|
||||
description "Attempt to sign in using a short-lived sign in token."
|
||||
get? true
|
||||
|
||||
argument :token, :string do
|
||||
description "The short-lived sign in token."
|
||||
allow_nil? false
|
||||
sensitive? true
|
||||
end
|
||||
|
||||
# validates the provided sign in token and generates a token
|
||||
prepare AshAuthentication.Strategy.Password.SignInWithTokenPreparation
|
||||
|
||||
metadata :token, :string do
|
||||
description "A JWT that can be used to authenticate the user."
|
||||
allow_nil? false
|
||||
end
|
||||
end
|
||||
|
||||
create :register_with_password do
|
||||
description "Register a new user with a email and password."
|
||||
|
||||
argument :email, :ci_string do
|
||||
allow_nil? false
|
||||
end
|
||||
|
||||
argument :password, :string do
|
||||
description "The proposed password for the user, in plain text."
|
||||
allow_nil? false
|
||||
constraints min_length: 8
|
||||
sensitive? true
|
||||
end
|
||||
|
||||
argument :password_confirmation, :string do
|
||||
description "The proposed password for the user (again), in plain text."
|
||||
allow_nil? false
|
||||
sensitive? true
|
||||
end
|
||||
|
||||
# Sets the email from the argument
|
||||
change set_attribute(:email, arg(:email))
|
||||
|
||||
# Hashes the provided password
|
||||
change AshAuthentication.Strategy.Password.HashPasswordChange
|
||||
|
||||
# Generates an authentication token for the user
|
||||
change AshAuthentication.GenerateTokenChange
|
||||
|
||||
# validates that the password matches the confirmation
|
||||
validate AshAuthentication.Strategy.Password.PasswordConfirmationValidation
|
||||
|
||||
metadata :token, :string do
|
||||
description "A JWT that can be used to authenticate the user."
|
||||
allow_nil? false
|
||||
end
|
||||
end
|
||||
|
||||
action :request_password_reset_token do
|
||||
description "Send password reset instructions to a user if they exist."
|
||||
|
||||
argument :email, :ci_string do
|
||||
allow_nil? false
|
||||
end
|
||||
|
||||
# creates a reset token and invokes the relevant senders
|
||||
run {AshAuthentication.Strategy.Password.RequestPasswordReset, action: :get_by_email}
|
||||
end
|
||||
|
||||
read :get_by_email do
|
||||
description "Looks up a user by their email"
|
||||
get? true
|
||||
|
||||
argument :email, :ci_string do
|
||||
allow_nil? false
|
||||
end
|
||||
|
||||
filter expr(email == ^arg(:email))
|
||||
end
|
||||
|
||||
update :reset_password_with_token do
|
||||
argument :reset_token, :string do
|
||||
allow_nil? false
|
||||
sensitive? true
|
||||
end
|
||||
|
||||
argument :password, :string do
|
||||
description "The proposed password for the user, in plain text."
|
||||
allow_nil? false
|
||||
constraints min_length: 8
|
||||
sensitive? true
|
||||
end
|
||||
|
||||
argument :password_confirmation, :string do
|
||||
description "The proposed password for the user (again), in plain text."
|
||||
allow_nil? false
|
||||
sensitive? true
|
||||
end
|
||||
|
||||
# validates the provided reset token
|
||||
validate AshAuthentication.Strategy.Password.ResetTokenValidation
|
||||
|
||||
# validates that the password matches the confirmation
|
||||
validate AshAuthentication.Strategy.Password.PasswordConfirmationValidation
|
||||
|
||||
# Hashes the provided password
|
||||
change AshAuthentication.Strategy.Password.HashPasswordChange
|
||||
|
||||
# Generates an authentication token for the user
|
||||
change AshAuthentication.GenerateTokenChange
|
||||
end
|
||||
end
|
||||
|
||||
policies do
|
||||
bypass AshAuthentication.Checks.AshAuthenticationInteraction do
|
||||
authorize_if always()
|
||||
end
|
||||
|
||||
policy always() do
|
||||
forbid_if always()
|
||||
end
|
||||
end
|
||||
|
||||
attributes do
|
||||
uuid_primary_key :id
|
||||
|
||||
attribute :email, :ci_string do
|
||||
allow_nil? false
|
||||
public? true
|
||||
end
|
||||
|
||||
attribute :hashed_password, :string do
|
||||
allow_nil? false
|
||||
sensitive? true
|
||||
end
|
||||
end
|
||||
|
||||
identities do
|
||||
identity :unique_email, [:email]
|
||||
end
|
||||
end
|
||||
+32
@@ -0,0 +1,32 @@
|
||||
defmodule DecentralisedBookIndex.Accounts.User.Senders.SendNewUserConfirmationEmail do
|
||||
@moduledoc """
|
||||
Sends an email for a new user to confirm their email address.
|
||||
"""
|
||||
|
||||
use AshAuthentication.Sender
|
||||
use DecentralisedBookIndexWeb, :verified_routes
|
||||
|
||||
import Swoosh.Email
|
||||
|
||||
alias DecentralisedBookIndex.Mailer
|
||||
|
||||
@impl true
|
||||
def send(user, token, _) do
|
||||
new()
|
||||
# TODO: Replace with your email
|
||||
|> from({"noreply", "noreply@example.com"})
|
||||
|> to(to_string(user.email))
|
||||
|> subject("Confirm your email address")
|
||||
|> html_body(body(token: token))
|
||||
|> Mailer.deliver!()
|
||||
end
|
||||
|
||||
defp body(params) do
|
||||
url = url(~p"/auth/user/confirm_new_user?#{[confirm: params[:token]]}")
|
||||
|
||||
"""
|
||||
<p>Click this link to confirm your email:</p>
|
||||
<p><a href="#{url}">#{url}</a></p>
|
||||
"""
|
||||
end
|
||||
end
|
||||
@@ -0,0 +1,32 @@
|
||||
defmodule DecentralisedBookIndex.Accounts.User.Senders.SendPasswordResetEmail do
|
||||
@moduledoc """
|
||||
Sends a password reset email
|
||||
"""
|
||||
|
||||
use AshAuthentication.Sender
|
||||
use DecentralisedBookIndexWeb, :verified_routes
|
||||
|
||||
import Swoosh.Email
|
||||
|
||||
alias DecentralisedBookIndex.Mailer
|
||||
|
||||
@impl true
|
||||
def send(user, token, _) do
|
||||
new()
|
||||
# TODO: Replace with your email
|
||||
|> from({"noreply", "noreply@example.com"})
|
||||
|> to(to_string(user.email))
|
||||
|> subject("Reset your password")
|
||||
|> html_body(body(token: token))
|
||||
|> Mailer.deliver!()
|
||||
end
|
||||
|
||||
defp body(params) do
|
||||
url = url(~p"/password-reset/#{params[:token]}")
|
||||
|
||||
"""
|
||||
<p>Click this link to reset your password:</p>
|
||||
<p><a href="#{url}">#{url}</a></p>
|
||||
"""
|
||||
end
|
||||
end
|
||||
Reference in New Issue
Block a user