rename to cannery

lib/cannery_web/controllers/email_controller.ex

@@ -0,0 +1,23 @@
+defmodule CanneryWeb.EmailController do
+  @moduledoc """
+  A dev controller used to develop on emails
+  """
+
+  use CanneryWeb, :controller
+  alias Cannery.Accounts.User
+
+  plug :put_layout, {CanneryWeb.LayoutView, :email}
+
+  @sample_assigns %{
+    email: %{subject: "Example subject"},
+    url: "https://cannery.bubbletea.dev/sample_url",
+    user: %User{email: "sample@email.com"}
+  }
+
+  @doc """
+  Debug route used to preview emails
+  """
+  def preview(conn, %{"id" => template}) do
+    render(conn, "#{template |> to_string()}.html", @sample_assigns)
+  end
+end

lib/cannery_web/controllers/home_controller.ex

@@ -0,0 +1,11 @@
+defmodule CanneryWeb.HomeController do
+  @moduledoc """
+  Controller for home page
+  """
+
+  use CanneryWeb, :controller
+
+  def index(conn, _params) do
+    render(conn, "index.html")
+  end
+end

lib/cannery_web/controllers/user_auth.ex

@@ -0,0 +1,191 @@
+defmodule CanneryWeb.UserAuth do
+  @moduledoc """
+  Functions for user session and authentication
+  """
+
+  import Plug.Conn
+  import Phoenix.Controller
+  import CanneryWeb.Gettext
+  alias Cannery.{Accounts, Accounts.User}
+  alias CanneryWeb.HomeLive
+  alias CanneryWeb.Router.Helpers, as: Routes
+
+  # Make the remember me cookie valid for 60 days.
+  # If you want bump or reduce this value, also change
+  # the token expiry itself in UserToken.
+  @max_age 60 * 60 * 24 * 60
+  @remember_me_cookie "_cannery_web_user_remember_me"
+  @remember_me_options [sign: true, max_age: @max_age, same_site: "Lax"]
+
+  @doc """
+  Logs the user in.
+
+  It renews the session ID and clears the whole session
+  to avoid fixation attacks. See the renew_session
+  function to customize this behaviour.
+
+  It also sets a `:live_socket_id` key in the session,
+  so LiveView sessions are identified and automatically
+  disconnected on log out. The line can be safely removed
+  if you are not using LiveView.
+  """
+  def log_in_user(conn, user, params \\ %{})
+
+  def log_in_user(conn, %User{confirmed_at: nil}, _params) do
+    conn
+    |> fetch_flash()
+    |> put_flash(
+      :error,
+      dgettext("errors", "You must confirm your account and log in to access this page.")
+    )
+    |> maybe_store_return_to()
+    |> redirect(to: Routes.user_session_path(conn, :new))
+    |> halt()
+  end
+
+  def log_in_user(conn, user, params) do
+    token = Accounts.generate_user_session_token(user)
+    user_return_to = get_session(conn, :user_return_to)
+
+    conn
+    |> renew_session()
+    |> put_session(:user_token, token)
+    |> put_session(:live_socket_id, "users_sessions:#{Base.url_encode64(token)}")
+    |> maybe_write_remember_me_cookie(token, params)
+    |> redirect(to: user_return_to || signed_in_path(conn))
+  end
+
+  @spec maybe_write_remember_me_cookie(
+          Plug.Conn.t(),
+          String.t() | any(),
+          %{required(String.t()) => String.t()} | any()
+        ) :: Plug.Conn.t()
+  defp maybe_write_remember_me_cookie(conn, token, %{"remember_me" => "true"}) do
+    put_resp_cookie(conn, @remember_me_cookie, token, @remember_me_options)
+  end
+
+  defp maybe_write_remember_me_cookie(conn, _token, _params) do
+    conn
+  end
+
+  # This function renews the session ID and erases the whole
+  # session to avoid fixation attacks. If there is any data
+  # in the session you may want to preserve after log in/log out,
+  # you must explicitly fetch the session data before clearing
+  # and then immediately set it after clearing, for example:
+  #
+  #     defp renew_session(conn) do
+  #       preferred_locale = get_session(conn, :preferred_locale)
+  #
+  #       conn
+  #       |> configure_session(renew: true)
+  #       |> clear_session()
+  #       |> put_session(:preferred_locale, preferred_locale)
+  #     end
+  #
+  defp renew_session(conn) do
+    conn
+    |> configure_session(renew: true)
+    |> clear_session()
+  end
+
+  @doc """
+  Logs the user out.
+
+  It clears all session data for safety. See renew_session.
+  """
+  def log_out_user(conn) do
+    user_token = get_session(conn, :user_token)
+    user_token && Accounts.delete_session_token(user_token)
+
+    if live_socket_id = get_session(conn, :live_socket_id) do
+      CanneryWeb.Endpoint.broadcast(live_socket_id, "disconnect", %{})
+    end
+
+    conn
+    |> renew_session()
+    |> delete_resp_cookie(@remember_me_cookie)
+    |> redirect(to: "/")
+  end
+
+  @doc """
+  Authenticates the user by looking into the session
+  and remember me token.
+  """
+  def fetch_current_user(conn, _opts) do
+    {user_token, conn} = ensure_user_token(conn)
+    user = user_token && Accounts.get_user_by_session_token(user_token)
+    assign(conn, :current_user, user)
+  end
+
+  defp ensure_user_token(conn) do
+    if user_token = get_session(conn, :user_token) do
+      {user_token, conn}
+    else
+      conn = fetch_cookies(conn, signed: [@remember_me_cookie])
+
+      if user_token = conn.cookies[@remember_me_cookie] do
+        {user_token, put_session(conn, :user_token, user_token)}
+      else
+        {nil, conn}
+      end
+    end
+  end
+
+  @doc """
+  Used for routes that require the user to not be authenticated.
+  """
+  def redirect_if_user_is_authenticated(conn, _opts) do
+    if conn.assigns[:current_user] do
+      conn
+      |> redirect(to: signed_in_path(conn))
+      |> halt()
+    else
+      conn
+    end
+  end
+
+  @doc """
+  Used for routes that require the user to be authenticated.
+
+  If you want to enforce the user email is confirmed before
+  they use the application at all, here would be a good place.
+  """
+  def require_authenticated_user(conn, _opts) do
+    if conn.assigns[:current_user] do
+      conn
+    else
+      conn
+      |> put_flash(
+        :error,
+        dgettext("errors", "You must confirm your account and log in to access this page.")
+      )
+      |> maybe_store_return_to()
+      |> redirect(to: Routes.user_session_path(conn, :new))
+      |> halt()
+    end
+  end
+
+  @doc """
+  Used for routes that require the user to be an admin.
+  """
+  def require_role(conn, role: role_atom) do
+    if conn.assigns[:current_user] && conn.assigns.current_user.role == role_atom do
+      conn
+    else
+      conn
+      |> put_flash(:error, dgettext("errors", "You are not authorized to view this page."))
+      |> maybe_store_return_to()
+      |> redirect(to: Routes.live_path(conn, HomeLive))
+      |> halt()
+    end
+  end
+
+  defp maybe_store_return_to(%{method: "GET"} = conn) do
+    put_session(conn, :user_return_to, current_path(conn))
+  end
+
+  defp maybe_store_return_to(conn), do: conn
+
+  defp signed_in_path(_conn), do: "/"
+end

lib/cannery_web/controllers/user_confirmation_controller.ex

@@ -0,0 +1,60 @@
+defmodule CanneryWeb.UserConfirmationController do
+  use CanneryWeb, :controller
+
+  import CanneryWeb.Gettext
+  alias Cannery.Accounts
+
+  def new(conn, _params) do
+    render(conn, "new.html", page_title: gettext("Confirm your account"))
+  end
+
+  def create(conn, %{"user" => %{"email" => email}}) do
+    if user = Accounts.get_user_by_email(email) do
+      Accounts.deliver_user_confirmation_instructions(
+        user,
+        &Routes.user_confirmation_url(conn, :confirm, &1)
+      )
+    end
+
+    # Regardless of the outcome, show an impartial success/error message.
+    conn
+    |> put_flash(
+      :info,
+      dgettext(
+        "prompts",
+        "If your email is in our system and it has not been confirmed yet, " <>
+          "you will receive an email with instructions shortly."
+      )
+    )
+    |> redirect(to: "/")
+  end
+
+  # Do not log in the user after confirmation to avoid a
+  # leaked token giving the user access to the account.
+  def confirm(conn, %{"token" => token}) do
+    case Accounts.confirm_user(token) do
+      {:ok, %{email: email}} ->
+        conn
+        |> put_flash(:info, dgettext("prompts", "%{email} confirmed successfully.", email: email))
+        |> redirect(to: "/")
+
+      :error ->
+        # If there is a current user and the account was already confirmed,
+        # then odds are that the confirmation link was already visited, either
+        # by some automation or by the user themselves, so we redirect without
+        # a warning message.
+        case conn.assigns do
+          %{current_user: %{confirmed_at: confirmed_at}} when not is_nil(confirmed_at) ->
+            redirect(conn, to: "/")
+
+          %{} ->
+            conn
+            |> put_flash(
+              :error,
+              dgettext("errors", "User confirmation link is invalid or it has expired.")
+            )
+            |> redirect(to: "/")
+        end
+    end
+  end
+end

lib/cannery_web/controllers/user_registration_controller.ex

@@ -0,0 +1,77 @@
+defmodule CanneryWeb.UserRegistrationController do
+  use CanneryWeb, :controller
+  import CanneryWeb.Gettext
+  alias Cannery.{Accounts, Accounts.Invites}
+  alias CanneryWeb.{Endpoint, HomeLive}
+
+  def new(conn, %{"invite" => invite_token}) do
+    if Invites.valid_invite_token?(invite_token) do
+      conn |> render_new(invite_token)
+    else
+      conn
+      |> put_flash(:error, dgettext("errors", "Sorry, this invite was not found or expired"))
+      |> redirect(to: Routes.live_path(Endpoint, HomeLive))
+    end
+  end
+
+  def new(conn, _params) do
+    if Accounts.allow_registration?() do
+      conn |> render_new()
+    else
+      conn
+      |> put_flash(:error, dgettext("errors", "Sorry, public registration is disabled"))
+      |> redirect(to: Routes.live_path(Endpoint, HomeLive))
+    end
+  end
+
+  # renders new user registration page
+  defp render_new(conn, invite_token \\ nil) do
+    render(conn, "new.html",
+      changeset: Accounts.change_user_registration(),
+      invite_token: invite_token,
+      page_title: gettext("Register")
+    )
+  end
+
+  def create(conn, %{"user" => %{"invite_token" => invite_token}} = attrs) do
+    if Invites.valid_invite_token?(invite_token) do
+      conn |> create_user(attrs, invite_token)
+    else
+      conn
+      |> put_flash(:error, dgettext("errors", "Sorry, this invite was not found or expired"))
+      |> redirect(to: Routes.live_path(Endpoint, HomeLive))
+    end
+  end
+
+  def create(conn, attrs) do
+    if Accounts.allow_registration?() do
+      conn |> create_user(attrs)
+    else
+      conn
+      |> put_flash(:error, dgettext("errors", "Sorry, public registration is disabled"))
+      |> redirect(to: Routes.live_path(Endpoint, HomeLive))
+    end
+  end
+
+  defp create_user(conn, %{"user" => user_params}, invite_token \\ nil) do
+    case Accounts.register_user(user_params, invite_token) do
+      {:ok, user} ->
+        Accounts.deliver_user_confirmation_instructions(
+          user,
+          &Routes.user_confirmation_url(conn, :confirm, &1)
+        )
+
+        conn
+        |> put_flash(:info, dgettext("prompts", "Please check your email to verify your account"))
+        |> redirect(to: Routes.user_session_path(Endpoint, :new))
+
+      {:error, :invalid_token} ->
+        conn
+        |> put_flash(:error, dgettext("errors", "Sorry, this invite was not found or expired"))
+        |> redirect(to: Routes.live_path(Endpoint, HomeLive))
+
+      {:error, %Ecto.Changeset{} = changeset} ->
+        conn |> render("new.html", changeset: changeset, invite_token: invite_token)
+    end
+  end
+end

lib/cannery_web/controllers/user_reset_password_controller.ex

@@ -0,0 +1,69 @@
+defmodule CanneryWeb.UserResetPasswordController do
+  use CanneryWeb, :controller
+
+  alias Cannery.Accounts
+
+  plug :get_user_by_reset_password_token when action in [:edit, :update]
+
+  def new(conn, _params) do
+    render(conn, "new.html", page_title: gettext("Forgot your password?"))
+  end
+
+  def create(conn, %{"user" => %{"email" => email}}) do
+    if user = Accounts.get_user_by_email(email) do
+      Accounts.deliver_user_reset_password_instructions(
+        user,
+        &Routes.user_reset_password_url(conn, :edit, &1)
+      )
+    end
+
+    # Regardless of the outcome, show an impartial success/error message.
+    conn
+    |> put_flash(
+      :info,
+      dgettext(
+        "prompts",
+        "If your email is in our system, you will receive instructions to " <>
+          "reset your password shortly."
+      )
+    )
+    |> redirect(to: "/")
+  end
+
+  def edit(conn, _params) do
+    render(conn, "edit.html",
+      changeset: Accounts.change_user_password(conn.assigns.user),
+      page_title: gettext("Reset your password")
+    )
+  end
+
+  # Do not log in the user after reset password to avoid a
+  # leaked token giving the user access to the account.
+  def update(conn, %{"user" => user_params}) do
+    case Accounts.reset_user_password(conn.assigns.user, user_params) do
+      {:ok, _} ->
+        conn
+        |> put_flash(:info, dgettext("prompts", "Password reset successfully."))
+        |> redirect(to: Routes.user_session_path(conn, :new))
+
+      {:error, changeset} ->
+        render(conn, "edit.html", changeset: changeset)
+    end
+  end
+
+  defp get_user_by_reset_password_token(conn, _opts) do
+    %{"token" => token} = conn.params
+
+    if user = Accounts.get_user_by_reset_password_token(token) do
+      conn |> assign(:user, user) |> assign(:token, token)
+    else
+      conn
+      |> put_flash(
+        :error,
+        dgettext("errors", "Reset password link is invalid or it has expired.")
+      )
+      |> redirect(to: "/")
+      |> halt()
+    end
+  end
+end

lib/cannery_web/controllers/user_session_controller.ex

@@ -0,0 +1,26 @@
+defmodule CanneryWeb.UserSessionController do
+  use CanneryWeb, :controller
+
+  alias Cannery.Accounts
+  alias CanneryWeb.UserAuth
+
+  def new(conn, _params) do
+    render(conn, "new.html", error_message: nil, page_title: gettext("Log in"))
+  end
+
+  def create(conn, %{"user" => user_params}) do
+    %{"email" => email, "password" => password} = user_params
+
+    if user = Accounts.get_user_by_email_and_password(email, password) do
+      UserAuth.log_in_user(conn, user, user_params)
+    else
+      render(conn, "new.html", error_message: dgettext("errors", "Invalid email or password"))
+    end
+  end
+
+  def delete(conn, _params) do
+    conn
+    |> put_flash(:info, dgettext("prompts", "Logged out successfully."))
+    |> UserAuth.log_out_user()
+  end
+end

lib/cannery_web/controllers/user_settings_controller.ex

@@ -0,0 +1,110 @@
+defmodule CanneryWeb.UserSettingsController do
+  use CanneryWeb, :controller
+  import CanneryWeb.Gettext
+  alias Cannery.Accounts
+  alias CanneryWeb.{HomeLive, UserAuth}
+
+  plug :assign_email_and_password_changesets
+
+  def edit(conn, _params) do
+    render(conn, "edit.html", page_title: gettext("Settings"))
+  end
+
+  def update(%{assigns: %{current_user: user}} = conn, %{
+        "action" => "update_email",
+        "current_password" => password,
+        "user" => user_params
+      }) do
+    case Accounts.apply_user_email(user, password, user_params) do
+      {:ok, applied_user} ->
+        Accounts.deliver_update_email_instructions(
+          applied_user,
+          user.email,
+          &Routes.user_settings_url(conn, :confirm_email, &1)
+        )
+
+        conn
+        |> put_flash(
+          :info,
+          dgettext(
+            "prompts",
+            "A link to confirm your email change has been sent to the new address."
+          )
+        )
+        |> redirect(to: Routes.user_settings_path(conn, :edit))
+
+      {:error, changeset} ->
+        conn |> render("edit.html", email_changeset: changeset)
+    end
+  end
+
+  def update(%{assigns: %{current_user: user}} = conn, %{
+        "action" => "update_password",
+        "current_password" => password,
+        "user" => user_params
+      }) do
+    case Accounts.update_user_password(user, password, user_params) do
+      {:ok, user} ->
+        conn
+        |> put_flash(:info, dgettext("prompts", "Password updated successfully."))
+        |> put_session(:user_return_to, Routes.user_settings_path(conn, :edit))
+        |> UserAuth.log_in_user(user)
+
+      {:error, changeset} ->
+        conn |> render("edit.html", password_changeset: changeset)
+    end
+  end
+
+  def update(
+        %{assigns: %{current_user: user}} = conn,
+        %{"action" => "update_locale", "user" => %{"locale" => locale}}
+      ) do
+    case Accounts.update_user_locale(user, locale) do
+      {:ok, _user} ->
+        conn
+        |> put_flash(:info, dgettext("prompts", "Language updated successfully."))
+        |> redirect(to: Routes.user_settings_path(conn, :edit))
+
+      {:error, changeset} ->
+        conn |> render("edit.html", locale_changeset: changeset)
+    end
+  end
+
+  def confirm_email(%{assigns: %{current_user: user}} = conn, %{"token" => token}) do
+    case Accounts.update_user_email(user, token) do
+      :ok ->
+        conn
+        |> put_flash(:info, dgettext("prompts", "Email changed successfully."))
+        |> redirect(to: Routes.user_settings_path(conn, :edit))
+
+      :error ->
+        conn
+        |> put_flash(
+          :error,
+          dgettext("errors", "Email change link is invalid or it has expired.")
+        )
+        |> redirect(to: Routes.user_settings_path(conn, :edit))
+    end
+  end
+
+  def delete(%{assigns: %{current_user: current_user}} = conn, %{"id" => user_id}) do
+    if user_id == current_user.id do
+      current_user |> Accounts.delete_user!(current_user)
+
+      conn
+      |> put_flash(:error, dgettext("prompts", "Your account has been deleted"))
+      |> redirect(to: Routes.live_path(conn, HomeLive))
+    else
+      conn
+      |> put_flash(:error, dgettext("errors", "Unable to delete user"))
+      |> redirect(to: Routes.user_settings_path(conn, :edit))
+    end
+  end
+
+  defp assign_email_and_password_changesets(%{assigns: %{current_user: user}} = conn, _opts) do
+    conn
+    |> assign(:email_changeset, Accounts.change_user_email(user))
+    |> assign(:password_changeset, Accounts.change_user_password(user))
+    |> assign(:locale_changeset, Accounts.change_user_locale(user))
+  end
+end