rename to memex

lib/memex/accounts/email.ex

@@ -0,0 +1,48 @@
+defmodule Memex.Email do
+  @moduledoc """
+  Emails that can be sent using Swoosh.
+
+  You can find the base email templates at
+  `lib/Memex_web/templates/layout/email.html.heex` for html emails and
+  `lib/Memex_web/templates/layout/email.txt.heex` for text emails.
+  """
+
+  use Phoenix.Swoosh, view: MemexWeb.EmailView, layout: {MemexWeb.LayoutView, :email}
+  import MemexWeb.Gettext
+  alias Memex.Accounts.User
+  alias MemexWeb.EmailView
+
+  @typedoc """
+  Represents an HTML and text body email that can be sent
+  """
+  @type t() :: Swoosh.Email.t()
+
+  @spec base_email(User.t(), String.t()) :: t()
+  defp base_email(%User{email: email}, subject) do
+    from = Application.get_env(:Memex, Memex.Mailer)[:email_from] || "noreply@localhost"
+    name = Application.get_env(:Memex, Memex.Mailer)[:email_name]
+    new() |> to(email) |> from({name, from}) |> subject(subject)
+  end
+
+  @spec generate_email(key :: String.t(), User.t(), attrs :: map()) :: t()
+  def generate_email("welcome", user, %{"url" => url}) do
+    user
+    |> base_email(dgettext("emails", "Confirm your Memex account"))
+    |> render_body("confirm_email.html", %{user: user, url: url})
+    |> text_body(EmailView.render("confirm_email.txt", %{user: user, url: url}))
+  end
+
+  def generate_email("reset_password", user, %{"url" => url}) do
+    user
+    |> base_email(dgettext("emails", "Reset your Memex password"))
+    |> render_body("reset_password.html", %{user: user, url: url})
+    |> text_body(EmailView.render("reset_password.txt", %{user: user, url: url}))
+  end
+
+  def generate_email("update_email", user, %{"url" => url}) do
+    user
+    |> base_email(dgettext("emails", "Update your Memex email"))
+    |> render_body("update_email.html", %{user: user, url: url})
+    |> text_body(EmailView.render("update_email.txt", %{user: user, url: url}))
+  end
+end

lib/memex/accounts/email_worker.ex

@@ -0,0 +1,13 @@
+defmodule Memex.EmailWorker do
+  @moduledoc """
+  Oban worker that dispatches emails
+  """
+
+  use Oban.Worker, queue: :mailers, tags: ["email"]
+  alias Memex.{Accounts, Email, Mailer}
+
+  @impl Oban.Worker
+  def perform(%Oban.Job{args: %{"email" => email, "user_id" => user_id, "attrs" => attrs}}) do
+    Email.generate_email(email, user_id |> Accounts.get_user!(), attrs) |> Mailer.deliver()
+  end
+end

lib/memex/accounts/invite.ex

@@ -0,0 +1,63 @@
+defmodule Memex.Accounts.Invite do
+  @moduledoc """
+  An invite, created by an admin to allow someone to join their instance. An
+  invite can be enabled or disabled, and can have an optional number of uses if
+  `:uses_left` is defined.
+  """
+
+  use Ecto.Schema
+  import Ecto.Changeset
+  alias Ecto.{Association, Changeset, UUID}
+  alias Memex.Accounts.User
+
+  @primary_key {:id, :binary_id, autogenerate: true}
+  @foreign_key_type :binary_id
+  schema "invites" do
+    field :name, :string
+    field :token, :string
+    field :uses_left, :integer, default: nil
+    field :disabled_at, :naive_datetime
+
+    belongs_to :created_by, User
+
+    has_many :users, User
+
+    timestamps()
+  end
+
+  @type t :: %__MODULE__{
+          id: id(),
+          name: String.t(),
+          token: token(),
+          uses_left: integer() | nil,
+          disabled_at: NaiveDateTime.t(),
+          created_by: User.t() | nil | Association.NotLoaded.t(),
+          created_by_id: User.id() | nil,
+          users: [User.t()] | Association.NotLoaded.t(),
+          inserted_at: NaiveDateTime.t(),
+          updated_at: NaiveDateTime.t()
+        }
+  @type new_invite :: %__MODULE__{}
+  @type id :: UUID.t()
+  @type changeset :: Changeset.t(t() | new_invite())
+  @type token :: String.t()
+
+  @doc false
+  @spec create_changeset(User.t(), token(), attrs :: map()) :: changeset()
+  def create_changeset(%User{id: user_id}, token, attrs) do
+    %__MODULE__{}
+    |> change(token: token, created_by_id: user_id)
+    |> cast(attrs, [:name, :uses_left, :disabled_at])
+    |> validate_required([:name, :token, :created_by_id])
+    |> validate_number(:uses_left, greater_than_or_equal_to: 0)
+  end
+
+  @doc false
+  @spec update_changeset(t() | new_invite(), attrs :: map()) :: changeset()
+  def update_changeset(invite, attrs) do
+    invite
+    |> cast(attrs, [:name, :uses_left, :disabled_at])
+    |> validate_required([:name])
+    |> validate_number(:uses_left, greater_than_or_equal_to: 0)
+  end
+end

lib/memex/accounts/invites.ex

@@ -0,0 +1,198 @@
+defmodule Memex.Accounts.Invites do
+  @moduledoc """
+  The Invites context.
+  """
+
+  import Ecto.Query, warn: false
+  alias Ecto.Multi
+  alias Memex.Accounts.{Invite, User}
+  alias Memex.Repo
+
+  @invite_token_length 20
+
+  @doc """
+  Returns the list of invites.
+
+  ## Examples
+
+      iex> list_invites(%User{id: 123, role: :admin})
+      [%Invite{}, ...]
+
+  """
+  @spec list_invites(User.t()) :: [Invite.t()]
+  def list_invites(%User{role: :admin}) do
+    Repo.all(from i in Invite, order_by: i.name)
+  end
+
+  @doc """
+  Gets a single invite for a user
+
+  Raises `Ecto.NoResultsError` if the Invite does not exist.
+
+  ## Examples
+
+      iex> get_invite!(123, %User{id: 123, role: :admin})
+      %Invite{}
+
+      > get_invite!(456, %User{id: 123, role: :admin})
+      ** (Ecto.NoResultsError)
+
+  """
+  @spec get_invite!(Invite.id(), User.t()) :: Invite.t()
+  def get_invite!(id, %User{role: :admin}) do
+    Repo.get!(Invite, id)
+  end
+
+  @doc """
+  Returns if an invite token is still valid
+
+  ## Examples
+
+      iex> valid_invite_token?("valid_token")
+      %Invite{}
+
+      iex> valid_invite_token?("invalid_token")
+      nil
+  """
+  @spec valid_invite_token?(Invite.token() | nil) :: boolean()
+  def valid_invite_token?(token) when token in [nil, ""], do: false
+
+  def valid_invite_token?(token) do
+    Repo.exists?(
+      from i in Invite,
+        where: i.token == ^token,
+        where: i.disabled_at |> is_nil()
+    )
+  end
+
+  @doc """
+  Uses invite by decrementing uses_left, or marks invite invalid if it's been
+  completely used.
+  """
+  @spec use_invite(Invite.token()) :: {:ok, Invite.t()} | {:error, :invalid_token}
+  def use_invite(invite_token) do
+    Multi.new()
+    |> Multi.run(:invite, fn _changes_so_far, _repo ->
+      invite_token |> get_invite_by_token()
+    end)
+    |> Multi.update(:decrement_invite, fn %{invite: invite} ->
+      decrement_invite_changeset(invite)
+    end)
+    |> Repo.transaction()
+    |> case do
+      {:ok, %{decrement_invite: invite}} -> {:ok, invite}
+      {:error, :invite, :invalid_token, _changes_so_far} -> {:error, :invalid_token}
+    end
+  end
+
+  @spec get_invite_by_token(Invite.token() | nil) :: {:ok, Invite.t()} | {:error, :invalid_token}
+  defp get_invite_by_token(token) when token in [nil, ""], do: {:error, :invalid_token}
+
+  defp get_invite_by_token(token) do
+    Repo.one(
+      from i in Invite,
+        where: i.token == ^token,
+        where: i.disabled_at |> is_nil()
+    )
+    |> case do
+      nil -> {:error, :invalid_token}
+      invite -> {:ok, invite}
+    end
+  end
+
+  @spec get_use_count(Invite.t(), User.t()) :: non_neg_integer()
+  def get_use_count(%Invite{id: invite_id}, %User{role: :admin}) do
+    Repo.one(
+      from u in User,
+        where: u.invite_id == ^invite_id,
+        select: count(u.id)
+    )
+  end
+
+  @spec decrement_invite_changeset(Invite.t()) :: Invite.changeset()
+  defp decrement_invite_changeset(%Invite{uses_left: nil} = invite) do
+    invite |> Invite.update_changeset(%{})
+  end
+
+  defp decrement_invite_changeset(%Invite{uses_left: 1} = invite) do
+    now = NaiveDateTime.utc_now() |> NaiveDateTime.truncate(:second)
+    invite |> Invite.update_changeset(%{uses_left: 0, disabled_at: now})
+  end
+
+  defp decrement_invite_changeset(%Invite{uses_left: uses_left} = invite) do
+    invite |> Invite.update_changeset(%{uses_left: uses_left - 1})
+  end
+
+  @doc """
+  Creates a invite.
+
+  ## Examples
+
+      iex> create_invite(%User{id: 123, role: :admin}, %{field: value})
+      {:ok, %Invite{}}
+
+      iex> create_invite(%User{id: 123, role: :admin}, %{field: bad_value})
+      {:error, %Changeset{}}
+
+  """
+  @spec create_invite(User.t(), attrs :: map()) ::
+          {:ok, Invite.t()} | {:error, Invite.changeset()}
+  def create_invite(%User{role: :admin} = user, attrs) do
+    token =
+      :crypto.strong_rand_bytes(@invite_token_length)
+      |> Base.url_encode64()
+      |> binary_part(0, @invite_token_length)
+
+    Invite.create_changeset(user, token, attrs) |> Repo.insert()
+  end
+
+  @doc """
+  Updates a invite.
+
+  ## Examples
+
+      iex> update_invite(invite, %{field: new_value}, %User{id: 123, role: :admin})
+      {:ok, %Invite{}}
+
+      iex> update_invite(invite, %{field: bad_value}, %User{id: 123, role: :admin})
+      {:error, %Changeset{}}
+
+  """
+  @spec update_invite(Invite.t(), attrs :: map(), User.t()) ::
+          {:ok, Invite.t()} | {:error, Invite.changeset()}
+  def update_invite(invite, attrs, %User{role: :admin}) do
+    invite |> Invite.update_changeset(attrs) |> Repo.update()
+  end
+
+  @doc """
+  Deletes a invite.
+
+  ## Examples
+
+      iex> delete_invite(invite, %User{id: 123, role: :admin})
+      {:ok, %Invite{}}
+
+      iex> delete_invite(invite, %User{id: 123, role: :admin})
+      {:error, %Changeset{}}
+
+  """
+  @spec delete_invite(Invite.t(), User.t()) ::
+          {:ok, Invite.t()} | {:error, Invite.changeset()}
+  def delete_invite(invite, %User{role: :admin}) do
+    invite |> Repo.delete()
+  end
+
+  @doc """
+  Deletes a invite.
+
+  ## Examples
+
+      iex> delete_invite(invite, %User{id: 123, role: :admin})
+      %Invite{}
+
+  """
+  @spec delete_invite!(Invite.t(), User.t()) :: Invite.t()
+  def delete_invite!(invite, %User{role: :admin}) do
+    invite |> Repo.delete!()
+  end
+end

lib/memex/accounts/user.ex

@@ -0,0 +1,214 @@
+defmodule Memex.Accounts.User do
+  @moduledoc """
+  A Memex user
+  """
+
+  use Ecto.Schema
+  import Ecto.Changeset
+  import MemexWeb.Gettext
+  alias Ecto.{Association, Changeset, UUID}
+  alias Memex.Accounts.{Invite, User}
+
+  @derive {Jason.Encoder,
+           only: [
+             :id,
+             :email,
+             :confirmed_at,
+             :role,
+             :locale,
+             :inserted_at,
+             :updated_at
+           ]}
+  @derive {Inspect, except: [:password]}
+  @primary_key {:id, :binary_id, autogenerate: true}
+  @foreign_key_type :binary_id
+  schema "users" do
+    field :email, :string
+    field :password, :string, virtual: true
+    field :hashed_password, :string
+    field :confirmed_at, :naive_datetime
+    field :role, Ecto.Enum, values: [:admin, :user], default: :user
+    field :locale, :string
+
+    has_many :created_invites, Invite, foreign_key: :created_by_id
+
+    belongs_to :invite, Invite
+
+    timestamps()
+  end
+
+  @type t :: %User{
+          id: id(),
+          email: String.t(),
+          password: String.t(),
+          hashed_password: String.t(),
+          confirmed_at: NaiveDateTime.t(),
+          role: role(),
+          locale: String.t() | nil,
+          created_invites: [Invite.t()] | Association.NotLoaded.t(),
+          invite: Invite.t() | nil | Association.NotLoaded.t(),
+          invite_id: Invite.id() | nil,
+          inserted_at: NaiveDateTime.t(),
+          updated_at: NaiveDateTime.t()
+        }
+  @type new_user :: %User{}
+  @type id :: UUID.t()
+  @type changeset :: Changeset.t(t() | new_user())
+  @type role :: :admin | :user
+
+  @doc """
+  A user changeset for registration.
+
+  It is important to validate the length of both email and password.
+  Otherwise databases may truncate the email without warnings, which
+  could lead to unpredictable or insecure behaviour. Long passwords may
+  also be very expensive to hash for certain algorithms.
+
+  ## Options
+
+    * `:hash_password` - Hashes the password so it can be stored securely
+      in the database and ensures the password field is cleared to prevent
+      leaks in the logs. If password hashing is not needed and clearing the
+      password field is not desired (like when using this changeset for
+      validations on a LiveView form), this option can be set to `false`.
+      Defaults to `true`.
+  """
+  @spec registration_changeset(attrs :: map(), Invite.t() | nil) :: changeset()
+  @spec registration_changeset(attrs :: map(), Invite.t() | nil, opts :: keyword()) :: changeset()
+  def registration_changeset(attrs, invite, opts \\ []) do
+    %User{}
+    |> cast(attrs, [:email, :password, :locale])
+    |> put_change(:invite_id, if(invite, do: invite.id))
+    |> validate_email()
+    |> validate_password(opts)
+  end
+
+  @doc """
+  A user changeset for role.
+  """
+  @spec role_changeset(t() | new_user() | changeset(), role()) :: changeset()
+  def role_changeset(user, role) do
+    user |> change(role: role)
+  end
+
+  @spec validate_email(changeset()) :: changeset()
+  defp validate_email(changeset) do
+    changeset
+    |> validate_required([:email])
+    |> validate_format(:email, ~r/^[^\s]+@[^\s]+$/,
+      message: dgettext("errors", "must have the @ sign and no spaces")
+    )
+    |> validate_length(:email, max: 160)
+    |> unsafe_validate_unique(:email, Memex.Repo)
+    |> unique_constraint(:email)
+  end
+
+  @spec validate_password(changeset(), opts :: keyword()) ::
+          changeset()
+  defp validate_password(changeset, opts) do
+    changeset
+    |> validate_required([:password])
+    |> validate_length(:password, min: 12, max: 80)
+    # |> validate_format(:password, ~r/[a-z]/, message: "at least one lower case character")
+    # |> validate_format(:password, ~r/[A-Z]/, message: "at least one upper case character")
+    # |> validate_format(:password, ~r/[!?@#$%^&*_0-9]/, message: "at least one digit or punctuation character")
+    |> maybe_hash_password(opts)
+  end
+
+  @spec maybe_hash_password(changeset(), opts :: keyword()) :: changeset()
+  defp maybe_hash_password(changeset, opts) do
+    hash_password? = Keyword.get(opts, :hash_password, true)
+    password = get_change(changeset, :password)
+
+    if hash_password? && password && changeset.valid? do
+      changeset
+      |> put_change(:hashed_password, Bcrypt.hash_pwd_salt(password))
+      |> delete_change(:password)
+    else
+      changeset
+    end
+  end
+
+  @doc """
+  A user changeset for changing the email.
+
+  It requires the email to change otherwise an error is added.
+  """
+  @spec email_changeset(t(), attrs :: map()) :: changeset()
+  def email_changeset(user, attrs) do
+    user
+    |> cast(attrs, [:email])
+    |> validate_email()
+    |> case do
+      %{changes: %{email: _}} = changeset -> changeset
+      %{} = changeset -> add_error(changeset, :email, dgettext("errors", "did not change"))
+    end
+  end
+
+  @doc """
+  A user changeset for changing the password.
+
+  ## Options
+
+    * `:hash_password` - Hashes the password so it can be stored securely
+      in the database and ensures the password field is cleared to prevent
+      leaks in the logs. If password hashing is not needed and clearing the
+      password field is not desired (like when using this changeset for
+      validations on a LiveView form), this option can be set to `false`.
+      Defaults to `true`.
+  """
+  @spec password_changeset(t(), attrs :: map()) :: changeset()
+  @spec password_changeset(t(), attrs :: map(), opts :: keyword()) :: changeset()
+  def password_changeset(user, attrs, opts \\ []) do
+    user
+    |> cast(attrs, [:password])
+    |> validate_confirmation(:password, message: dgettext("errors", "does not match password"))
+    |> validate_password(opts)
+  end
+
+  @doc """
+  Confirms the account by setting `confirmed_at`.
+  """
+  @spec confirm_changeset(t() | changeset()) :: changeset()
+  def confirm_changeset(user_or_changeset) do
+    now = NaiveDateTime.utc_now() |> NaiveDateTime.truncate(:second)
+    user_or_changeset |> change(confirmed_at: now)
+  end
+
+  @doc """
+  Verifies the password.
+
+  If there is no user or the user doesn't have a password, we call
+  `Bcrypt.no_user_verify/0` to avoid timing attacks.
+  """
+  @spec valid_password?(t(), String.t()) :: boolean()
+  def valid_password?(%User{hashed_password: hashed_password}, password)
+      when is_binary(hashed_password) and byte_size(password) > 0 do
+    Bcrypt.verify_pass(password, hashed_password)
+  end
+
+  def valid_password?(_invalid_user, _invalid_password) do
+    Bcrypt.no_user_verify()
+    false
+  end
+
+  @doc """
+  Validates the current password otherwise adds an error to the changeset.
+  """
+  @spec validate_current_password(changeset(), String.t()) :: changeset()
+  def validate_current_password(changeset, password) do
+    if valid_password?(changeset.data, password),
+      do: changeset,
+      else: changeset |> add_error(:current_password, dgettext("errors", "is not valid"))
+  end
+
+  @doc """
+  A changeset for changing the user's locale
+  """
+  @spec locale_changeset(t() | changeset(), locale :: String.t() | nil) :: changeset()
+  def locale_changeset(user_or_changeset, locale) do
+    user_or_changeset
+    |> cast(%{"locale" => locale}, [:locale])
+    |> validate_required(:locale)
+  end
+end

lib/memex/accounts/user_token.ex

@@ -0,0 +1,161 @@
+defmodule Memex.Accounts.UserToken do
+  @moduledoc """
+  Schema for a user's session token
+  """
+
+  use Ecto.Schema
+  import Ecto.Query
+  alias Ecto.{Association, UUID}
+  alias Memex.Accounts.User
+
+  @hash_algorithm :sha256
+  @rand_size 32
+
+  # It is very important to keep the reset password token expiry short,
+  # since someone with access to the email may take over the account.
+  @reset_password_validity_in_days 1
+  @confirm_validity_in_days 7
+  @change_email_validity_in_days 7
+  @session_validity_in_days 60
+
+  @primary_key {:id, :binary_id, autogenerate: true}
+  @foreign_key_type :binary_id
+  schema "users_tokens" do
+    field :token, :binary
+    field :context, :string
+    field :sent_to, :string
+
+    belongs_to :user, User
+
+    timestamps(updated_at: false)
+  end
+
+  @type t :: %__MODULE__{
+          id: id(),
+          token: token(),
+          context: String.t(),
+          sent_to: String.t(),
+          user: User.t() | Association.NotLoaded.t(),
+          user_id: User.id() | nil,
+          inserted_at: NaiveDateTime.t()
+        }
+  @type new_user_token :: %__MODULE__{}
+  @type id :: UUID.t()
+  @type token :: binary()
+
+  @doc """
+  Generates a token that will be stored in a signed place,
+  such as session or cookie. As they are signed, those
+  tokens do not need to be hashed.
+  """
+  def build_session_token(user) do
+    token = :crypto.strong_rand_bytes(@rand_size)
+    {token, %__MODULE__{token: token, context: "session", user_id: user.id}}
+  end
+
+  @doc """
+  Checks if the token is valid and returns its underlying lookup query.
+
+  The query returns the user found by the token.
+  """
+  def verify_session_token_query(token) do
+    query =
+      from token in token_and_context_query(token, "session"),
+        join: user in assoc(token, :user),
+        where: token.inserted_at > ago(@session_validity_in_days, "day"),
+        select: user
+
+    {:ok, query}
+  end
+
+  @doc """
+  Builds a token with a hashed counter part.
+
+  The non-hashed token is sent to the user email while the
+  hashed part is stored in the database, to avoid reconstruction.
+  The token is valid for a week as long as users don't change
+  their email.
+  """
+  def build_email_token(user, context) do
+    build_hashed_token(user, context, user.email)
+  end
+
+  defp build_hashed_token(user, context, sent_to) do
+    token = :crypto.strong_rand_bytes(@rand_size)
+    hashed_token = :crypto.hash(@hash_algorithm, token)
+
+    {Base.url_encode64(token, padding: false),
+     %__MODULE__{
+       token: hashed_token,
+       context: context,
+       sent_to: sent_to,
+       user_id: user.id
+     }}
+  end
+
+  @doc """
+  Checks if the token is valid and returns its underlying lookup query.
+
+  The query returns the user found by the token.
+  """
+  def verify_email_token_query(token, context) do
+    case Base.url_decode64(token, padding: false) do
+      {:ok, decoded_token} ->
+        hashed_token = :crypto.hash(@hash_algorithm, decoded_token)
+        days = days_for_context(context)
+
+        query =
+          from token in token_and_context_query(hashed_token, context),
+            join: user in assoc(token, :user),
+            where: token.inserted_at > ago(^days, "day") and token.sent_to == user.email,
+            select: user
+
+        {:ok, query}
+
+      :error ->
+        :error
+    end
+  end
+
+  defp days_for_context("confirm"), do: @confirm_validity_in_days
+  defp days_for_context("reset_password"), do: @reset_password_validity_in_days
+
+  @doc """
+  Checks if the token is valid and returns its underlying lookup query.
+
+  The query returns the user token record.
+  """
+  def verify_change_email_token_query(token, context) do
+    case Base.url_decode64(token, padding: false) do
+      {:ok, decoded_token} ->
+        hashed_token = :crypto.hash(@hash_algorithm, decoded_token)
+
+        query =
+          from token in token_and_context_query(hashed_token, context),
+            where: token.inserted_at > ago(@change_email_validity_in_days, "day")
+
+        {:ok, query}
+
+      :error ->
+        :error
+    end
+  end
+
+  @doc """
+  Returns the given token with the given context.
+  """
+  def token_and_context_query(token, context) do
+    from __MODULE__, where: [token: ^token, context: ^context]
+  end
+
+  @doc """
+  Gets all tokens for the given user for the given contexts.
+  """
+  def user_and_contexts_query(user, :all) do
+    from t in __MODULE__, where: t.user_id == ^user.id
+  end
+
+  def user_and_contexts_query(user, [_ | _] = contexts) do
+    from t in __MODULE__, where: t.user_id == ^user.id and t.context in ^contexts
+  end
+end