add user subsystem

Author: zalepa

Gemfile

@@ -20,7 +20,7 @@ gem "tailwindcss-rails"
 gem "jbuilder"
 
 # Use Active Model has_secure_password [https://guides.rubyonrails.org/active_model_basics.html#securepassword]
-# gem "bcrypt", "~> 3.1.7"
+gem "bcrypt", "~> 3.1.7"
 
 # Windows does not include zoneinfo files, so bundle the tzinfo-data gem
 gem "tzinfo-data", platforms: %i[ windows jruby ]

Gemfile.lock

@@ -93,6 +93,7 @@ GEM
       metrics (~> 0.12)
       traces (~> 0.18)
     base64 (0.3.0)
+    bcrypt (3.1.21)
     bcrypt_pbkdf (1.1.2)
     bigdecimal (4.0.1)
     bindex (0.8.1)
@@ -503,6 +504,7 @@ PLATFORMS
   x86_64-linux-musl
 
 DEPENDENCIES
+  bcrypt (~> 3.1.7)
   bootsnap
   brakeman
   bundler-audit
@@ -546,6 +548,7 @@ CHECKSUMS
   ast (2.4.3) sha256=954615157c1d6a382bc27d690d973195e79db7f55e9765ac7c481c60bdb4d383
   async (2.36.0) sha256=090623f4c65706664355c9efa6c7bfb86771a513e65cd681c51cb27747530550
   base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
+  bcrypt (3.1.21) sha256=5964613d750a42c7ee5dc61f7b9336fb6caca429ba4ac9f2011609946e4a2dcf
   bcrypt_pbkdf (1.1.2) sha256=c2414c23ce66869b3eb9f643d6a3374d8322dfb5078125c82792304c10b94cf6
   bigdecimal (4.0.1) sha256=8b07d3d065a9f921c80ceaea7c9d4ae596697295b584c296fe599dd0ad01c4a7
   bindex (0.8.1) sha256=7b1ecc9dc539ed8bccfc8cb4d2732046227b09d6f37582ff12e50a5047ceb17e

app/channels/application_cable/connection.rb

@@ -0,0 +1,16 @@
+module ApplicationCable
+  class Connection < ActionCable::Connection::Base
+    identified_by :current_user
+
+    def connect
+      set_current_user || reject_unauthorized_connection
+    end
+
+    private
+      def set_current_user
+        if session = Session.find_by(id: cookies.signed[:session_id])
+          self.current_user = session.user
+        end
+      end
+  end
+end

app/controllers/admin/base_controller.rb

@@ -0,0 +1,7 @@
+module Admin
+  class BaseController < ApplicationController
+    before_action :require_content_admin_or_above
+
+    layout "admin"
+  end
+end

app/controllers/admin/dashboard_controller.rb

@@ -0,0 +1,8 @@
+module Admin
+  class DashboardController < BaseController
+    def show
+      @user_count = User.count
+      @admin_count = User.where(role: [ :content_admin, :site_admin ]).count
+    end
+  end
+end

app/controllers/admin/invitations_controller.rb

@@ -0,0 +1,37 @@
+module Admin
+  class InvitationsController < BaseController
+    before_action :require_site_admin, only: [ :new, :create, :destroy ]
+
+    def index
+      @pending_invitations = Invitation.pending.includes(:invited_by).order(created_at: :desc)
+      @accepted_invitations = Invitation.accepted.includes(:invited_by, :accepted_by).order(accepted_at: :desc)
+    end
+
+    def new
+      @invitation = Invitation.new(role: :content_admin)
+    end
+
+    def create
+      @invitation = Invitation.new(invitation_params)
+      @invitation.invited_by = Current.session.user
+
+      if @invitation.save
+        redirect_to admin_invitations_path, notice: "Invitation created."
+      else
+        render :new, status: :unprocessable_entity
+      end
+    end
+
+    def destroy
+      @invitation = Invitation.find(params[:id])
+      @invitation.destroy
+      redirect_to admin_invitations_path, notice: "Invitation revoked."
+    end
+
+    private
+
+    def invitation_params
+      params.expect(invitation: [ :role ])
+    end
+  end
+end

app/controllers/admin/users_controller.rb

@@ -0,0 +1,9 @@
+module Admin
+  class UsersController < BaseController
+    before_action :require_site_admin
+
+    def index
+      @users = User.order(created_at: :desc)
+    end
+  end
+end

app/controllers/application_controller.rb

@@ -1,4 +1,7 @@
 class ApplicationController < ActionController::Base
+  include Authentication
+  include Authorization
+
   # Only allow modern browsers supporting webp images, web push, badges, import maps, CSS nesting, and CSS :has.
   allow_browser versions: :modern
 

app/controllers/concerns/authentication.rb

@@ -0,0 +1,52 @@
+module Authentication
+  extend ActiveSupport::Concern
+
+  included do
+    before_action :require_authentication
+    helper_method :authenticated?
+  end
+
+  class_methods do
+    def allow_unauthenticated_access(**options)
+      skip_before_action :require_authentication, **options
+    end
+  end
+
+  private
+    def authenticated?
+      resume_session
+    end
+
+    def require_authentication
+      resume_session || request_authentication
+    end
+
+    def resume_session
+      Current.session ||= find_session_by_cookie
+    end
+
+    def find_session_by_cookie
+      Session.find_by(id: cookies.signed[:session_id]) if cookies.signed[:session_id]
+    end
+
+    def request_authentication
+      session[:return_to_after_authenticating] = request.url
+      redirect_to new_session_path
+    end
+
+    def after_authentication_url
+      session.delete(:return_to_after_authenticating) || root_url
+    end
+
+    def start_new_session_for(user)
+      user.sessions.create!(user_agent: request.user_agent, ip_address: request.remote_ip).tap do |session|
+        Current.session = session
+        cookies.signed.permanent[:session_id] = { value: session.id, httponly: true, same_site: :lax }
+      end
+    end
+
+    def terminate_session
+      Current.session.destroy
+      cookies.delete(:session_id)
+    end
+end

app/controllers/concerns/authorization.rb

@@ -0,0 +1,17 @@
+module Authorization
+  extend ActiveSupport::Concern
+
+  private
+
+  def require_site_admin
+    unless Current.session&.user&.site_admin?
+      redirect_to root_path, alert: "You are not authorized to access this page."
+    end
+  end
+
+  def require_content_admin_or_above
+    unless Current.session&.user&.admin?
+      redirect_to root_path, alert: "You are not authorized to access this page."
+    end
+  end
+end