Sign-up, email verification and settings

# The three steps of sign-up, driven against the models the controllers wrap:
# create the account and mint a verification token, spend the token, then sign
# in. Standalone Active Record with an in-memory SQLite database; no server,
# no network, no mail delivery (the outbox below stands in for the mailer).
require "active_record"
require "active_support/core_ext/integer/time"
require "active_support/messages/metadata"

ActiveRecord::Base.establish_connection(adapter: "sqlite3", database: ":memory:")
# In an app this verifier is built from secret_key_base; a standalone script sets it.
ActiveSupport::Messages::Metadata.use_message_serializer_for_metadata = true
ActiveRecord::Base.generated_token_verifier = ActiveSupport::MessageVerifier.new(
  "kaksha-example-signing-key", digest: "SHA256", serializer: :json_allow_marshal, url_safe: true
)

ActiveRecord::Schema.verbose = false
ActiveRecord::Schema.define do
  create_table :users do |t|
    t.string :email_address, null: false
    t.string :password_digest, null: false
    t.datetime :verified_at
    t.timestamps
  end
  add_index :users, :email_address, unique: true

  create_table :sessions do |t|
    t.references :user, null: false
    t.string :ip_address
    t.string :user_agent
    t.timestamps
  end
end

class User < ActiveRecord::Base
  has_many :sessions, dependent: :destroy
  has_secure_password

  normalizes :email_address, with: ->(value) { value.to_s.strip.downcase }
  validates :email_address, presence: true, format: { with: /\A[^@\s]+@[^@\s]+\.[^@\s]+\z/ },
    uniqueness: true
  validates :password, length: { minimum: 12 }, if: -> { password.present? }

  generates_token_for :email_verification, expires_in: 2.days do
    email_address
  end

  def verified? = verified_at.present?
end

class Session < ActiveRecord::Base
  belongs_to :user
end

# What RegistrationsController#create does, without the HTTP around it.
class Registration
  attr_reader :user

  def initialize(attributes)
    @user = User.new(attributes)
  end

  def save
    return false unless user.save
    OUTBOX << { to: user.email_address, link: "/email_verification/#{user.generate_token_for(:email_verification)}" }
    true
  end

  def errors = user.errors.full_messages
end

OUTBOX = []
SIGNED_UP = { email_address: "  Asha.Verma@Example.com ", password: "monsoon-ledger-7", password_confirmation: "monsoon-ledger-7" }

puts "== Step 1: the sign-up form posts once =="
first = Registration.new(SIGNED_UP)
puts "  saved? #{first.save}"
asha = first.user
puts "  stored email  #{asha.email_address.inspect}"
puts "  verified?     #{asha.verified?}"
puts "  mail queued   #{OUTBOX.size} to #{OUTBOX.first[:to].inspect}"
puts "  link          #{OUTBOX.first[:link][0, 46]}…"

puts "\n== The same form posted with bad input =="
[
  ["mistyped confirmation", { email_address: "rahul@example.com", password: "monsoon-ledger-7", password_confirmation: "monsoon-ledger-8" }],
  ["password too short", { email_address: "rahul@example.com", password: "kaksha", password_confirmation: "kaksha" }],
  ["an address already signed up", { email_address: "ASHA.VERMA@example.com", password: "monsoon-ledger-7", password_confirmation: "monsoon-ledger-7" }],
].each do |label, attributes|
  attempt = Registration.new(attributes)
  puts "  #{label}: saved? #{attempt.save} -> #{attempt.errors.join('; ')}"
end
puts "  users in the table: #{User.count}"

puts "\n== Step 2: the link in the mail is spent =="
token = OUTBOX.first[:link].split("/").last
found = User.find_by_token_for(:email_verification, token)
puts "  token resolves to #{found&.email_address.inspect}"
found.update!(verified_at: Time.current)
puts "  verified? #{found.verified?}"
puts "  a tampered token resolves to #{User.find_by_token_for(:email_verification, token.sub(/.\z/, 'x')).inspect}"

puts "\n== Step 3: the sign-in form posts the same pair =="
signed_in = User.authenticate_by(email_address: "asha.verma@example.com", password: "monsoon-ledger-7")
puts "  right password  -> #{signed_in&.email_address.inspect}"
puts "  wrong password  -> #{User.authenticate_by(email_address: 'asha.verma@example.com', password: 'monsoon-ledger-8').inspect}"
puts "  unknown address -> #{User.authenticate_by(email_address: 'nobody@example.com', password: 'monsoon-ledger-7').inspect}"

session = signed_in.sessions.create!(ip_address: "203.0.113.9", user_agent: "Mozilla/5.0 (Android 16; Mobile)")
puts "  session rows for Asha: #{signed_in.sessions.count} (id #{session.id}, from #{session.ip_address})"

puts "\n== The gate an unverified account meets =="
rahul = User.create!(email_address: "rahul@example.com", password: "monsoon-ledger-9", password_confirmation: "monsoon-ledger-9")
[signed_in, rahul].each do |user|
  allowed = user.verified? ? "may enrol students" : "may read only, until the address is verified"
  puts "  #{user.email_address}: verified? #{user.verified?} -> #{allowed}"
end

== Step 1: the sign-up form posts once ==
  saved? true
  stored email  "asha.verma@example.com"
  verified?     false
  mail queued   1 to "asha.verma@example.com"
  link          /email_verification/eyJfcmFpbHMiOnsiZGF0YSI6Wz…

== The same form posted with bad input ==
  mistyped confirmation: saved? false -> Password confirmation doesn't match Password
  password too short: saved? false -> Password is too short (minimum is 12 characters)
  an address already signed up: saved? false -> Email address has already been taken
  users in the table: 1

== Step 2: the link in the mail is spent ==
  token resolves to "asha.verma@example.com"
  verified? true
  a tampered token resolves to nil

== Step 3: the sign-in form posts the same pair ==
  right password  -> "asha.verma@example.com"
  wrong password  -> nil
  unknown address -> nil
  session rows for Asha: 1 (id 1, from 203.0.113.9)

== The gate an unverified account meets ==
  asha.verma@example.com: verified? true -> may enrol students
  rahul@example.com: verified? false -> may read only, until the address is verified

# What a token from generates_token_for really is, and the three ways it stops
# working: the value in its block changes, its window runs out, or a byte of it
# is altered. The run also decodes one token, because what the block returns
# travels inside it as readable JSON. Standalone Active Record, in-memory
# SQLite, no server and no network; the clock is moved with travel_to.
require "active_record"
require "active_support/core_ext/integer/time"
require "active_support/messages/metadata"
require "active_support/testing/time_helpers"
require "base64"
require "json"

include ActiveSupport::Testing::TimeHelpers

ActiveRecord::Base.establish_connection(adapter: "sqlite3", database: ":memory:")
# An app builds this verifier from secret_key_base, with the serializer and the
# metadata setting that config.load_defaults 8.1 chooses; a standalone script
# sets the same three things by hand.
ActiveSupport::Messages::Metadata.use_message_serializer_for_metadata = true
ActiveRecord::Base.generated_token_verifier = ActiveSupport::MessageVerifier.new(
  "kaksha-example-signing-key", digest: "SHA256", serializer: :json_allow_marshal, url_safe: true
)

ActiveRecord::Schema.verbose = false
ActiveRecord::Schema.define do
  create_table :users do |t|
    t.string :email_address, null: false
    t.string :password_digest, null: false
    t.timestamps
  end
end

class User < ActiveRecord::Base
  has_secure_password
  normalizes :email_address, with: ->(value) { value.to_s.strip.downcase }

  generates_token_for :email_verification, expires_in: 2.days do
    email_address
  end
end

asha = User.create!(email_address: "old@example.com", password: "monsoon-ledger-7")
travel_to Time.utc(2031, 5, 10, 9, 0, 0)
token = asha.generate_token_for(:email_verification)

puts "== One token, minted for old@example.com =="
puts "  length #{token.length} characters, dots: #{token.count('.')}"
payload, signature = token.split("--")
puts "  the part before the dashes decodes to:"
puts "    #{JSON.parse(Base64.urlsafe_decode64(payload)).to_json}"
puts "  the part after them is the signature: #{signature[0, 16]}… (#{signature.length} characters)"
puts "  resolves to #{User.find_by_token_for(:email_verification, token)&.email_address.inspect}"

puts "\n== The email changes, and the token dies with it =="
asha.update!(email_address: "new@example.com")
puts "  row now holds #{asha.reload.email_address.inspect}"
puts "  the old token resolves to #{User.find_by_token_for(:email_verification, token).inspect}"
fresh = asha.generate_token_for(:email_verification)
puts "  a token minted now resolves to #{User.find_by_token_for(:email_verification, fresh)&.email_address.inspect}"

puts "\n== The two-day window =="
[
  ["1 day, 23 hours later", 1.day + 23.hours],
  ["2 days and a minute later", 2.days + 1.minute],
].each do |label, ahead|
  travel_to Time.utc(2031, 5, 10, 9, 0, 0) + ahead
  puts "  #{label}: #{User.find_by_token_for(:email_verification, fresh)&.email_address.inspect}"
end

puts "\n== What the bang version does with a dead token =="
begin
  User.find_by_token_for!(:email_verification, fresh)
rescue => error
  puts "  find_by_token_for! raised #{error.class}"
end
puts "  find_by_token_for  returned #{User.find_by_token_for(:email_verification, fresh).inspect}"

puts "\n== A byte changed in transit =="
travel_to Time.utc(2031, 5, 10, 9, 30, 0)
inside_window = asha.generate_token_for(:email_verification)
altered = inside_window.sub(/.\z/) { |char| char == "A" ? "B" : "A" }
puts "  altered token resolves to #{User.find_by_token_for(:email_verification, altered).inspect}"
puts "  untouched token resolves to #{User.find_by_token_for(:email_verification, inside_window)&.email_address.inspect}"
travel_back

== One token, minted for old@example.com ==
  length 220 characters, dots: 0
  the part before the dashes decodes to:
    {"_rails":{"data":[1,"old@example.com"],"exp":"2031-05-12T09:00:00.000Z","pur":"User\nemail_verification\n172800"}}
  the part after them is the signature: 1e161333c9aefcc7… (64 characters)
  resolves to "old@example.com"

== The email changes, and the token dies with it ==
  row now holds "new@example.com"
  the old token resolves to nil
  a token minted now resolves to "new@example.com"

== The two-day window ==
  1 day, 23 hours later: "new@example.com"
  2 days and a minute later: nil

== What the bang version does with a dead token ==
  find_by_token_for! raised ActiveSupport::MessageVerifier::InvalidSignature
  find_by_token_for  returned nil

== A byte changed in transit ==
  altered token resolves to nil
  untouched token resolves to "new@example.com"

# Two settings forms that change a credential: the password, which asks for the
# current one through password_challenge, and the email address, which is held
# in unconfirmed_email until a token sent to the new address comes back. Each
# "post" loads the record again, as a request would. Standalone Active Record
# with an in-memory SQLite database; the outbox stands in for the mailer.
require "active_record"
require "active_support/core_ext/integer/time"
require "active_support/messages/metadata"

ActiveRecord::Base.establish_connection(adapter: "sqlite3", database: ":memory:")
ActiveSupport::Messages::Metadata.use_message_serializer_for_metadata = true
ActiveRecord::Base.generated_token_verifier = ActiveSupport::MessageVerifier.new(
  "kaksha-example-signing-key", digest: "SHA256", serializer: :json_allow_marshal, url_safe: true
)

ActiveRecord::Schema.verbose = false
ActiveRecord::Schema.define do
  create_table :users do |t|
    t.string :email_address, null: false
    t.string :unconfirmed_email
    t.string :password_digest, null: false
    t.timestamps
  end
  create_table :sessions do |t|
    t.references :user, null: false
    t.string :ip_address
    t.timestamps
  end
end

OUTBOX = []

class User < ActiveRecord::Base
  has_many :sessions, dependent: :destroy
  has_secure_password

  normalizes :email_address, :unconfirmed_email, with: ->(value) { value.to_s.strip.downcase.presence }
  validates :password, length: { minimum: 12 }, if: -> { password.present? }
  validates :unconfirmed_email, format: { with: /\A[^@\s]+@[^@\s]+\.[^@\s]+\z/ }, allow_nil: true

  # The block returns the address being claimed, so the link dies when the claim changes.
  generates_token_for :email_change, expires_in: 2.days do
    unconfirmed_email
  end

  def confirm_email_change!
    previous = email_address
    update!(email_address: unconfirmed_email, unconfirmed_email: nil)
    OUTBOX << { to: previous, subject: "Your Kaksha sign-in address was changed" }
  end
end

class Session < ActiveRecord::Base
  belongs_to :user
end

ID = User.create!(email_address: "asha.verma@example.com", password: "monsoon-ledger-7").id
2.times { |n| Session.create!(user_id: ID, ip_address: "203.0.113.#{9 + n}") }

# Every form below starts from a freshly loaded record, as a new request does.
def asha = User.find(ID)

puts "== The password form, with the wrong current password =="
user = asha
puts "  update returned #{user.update(password: 'chasing-kites-11', password_confirmation: 'chasing-kites-11', password_challenge: 'monsoon-ledger-0')}"
puts "  errors: #{user.errors.full_messages.join('; ')}"
puts "  the stored digest still accepts the old password: #{!!asha.authenticate('monsoon-ledger-7')}"

puts "\n== The same form, with the current password =="
user = asha
puts "  update returned #{user.update(password: 'chasing-kites-11', password_confirmation: 'chasing-kites-11', password_challenge: 'monsoon-ledger-7')}"
puts "  old password now: #{!!asha.authenticate('monsoon-ledger-7')}"
puts "  new password now: #{!!asha.authenticate('chasing-kites-11')}"
puts "  sessions before signing the other browsers out: #{Session.where(user_id: ID).count}"
kept = Session.where(user_id: ID).order(:id).last
Session.where(user_id: ID).where.not(id: kept.id).destroy_all
puts "  sessions after, keeping only this one (id #{kept.id}): #{Session.where(user_id: ID).count}"

puts "\n== What a missing field and an empty field do =="
no_field = asha
puts "  no password_challenge in the params at all: #{no_field.update(password: 'silent-change-12', password_confirmation: 'silent-change-12')}"
puts "  the password really changed: #{!!asha.authenticate('silent-change-12')}"
blank_field = asha
puts "  password_challenge sent as an empty string: #{blank_field.update(password: 'chasing-kites-11', password_confirmation: 'chasing-kites-11', password_challenge: '')}"
puts "  errors: #{blank_field.errors.full_messages.join('; ')}"
asha.update!(password: "chasing-kites-11", password_confirmation: "chasing-kites-11", password_challenge: "silent-change-12")

puts "\n== The email form writes unconfirmed_email and nothing else =="
user = asha
user.update!(unconfirmed_email: " Asha@Kaksha.example ", password_challenge: "chasing-kites-11")
puts "  email_address      #{user.email_address.inspect}"
puts "  unconfirmed_email  #{user.unconfirmed_email.inspect}"
first_link = user.generate_token_for(:email_change)
OUTBOX << { to: user.unconfirmed_email, subject: "Confirm your new address" }
puts "  mail went to       #{OUTBOX.last[:to].inspect}"

puts "\n== The learner changes their mind and claims a third address =="
asha.update!(unconfirmed_email: "asha.v@kaksha.example", password_challenge: "chasing-kites-11")
puts "  the first link resolves to #{User.find_by_token_for(:email_change, first_link).inspect}"
second_link = asha.generate_token_for(:email_change)
puts "  the second link resolves to #{User.find_by_token_for(:email_change, second_link)&.unconfirmed_email.inspect}"

puts "\n== Confirming swaps the columns and tells the old address =="
User.find_by_token_for(:email_change, second_link).confirm_email_change!
puts "  email_address      #{asha.email_address.inspect}"
puts "  unconfirmed_email  #{asha.unconfirmed_email.inspect}"
puts "  the used link now resolves to #{User.find_by_token_for(:email_change, second_link).inspect}"
puts "  outbox:"
OUTBOX.each { |mail| puts "    to #{mail[:to]}: #{mail[:subject]}" }

== The password form, with the wrong current password ==
  update returned false
  errors: Password challenge is invalid
  the stored digest still accepts the old password: true

== The same form, with the current password ==
  update returned true
  old password now: false
  new password now: true
  sessions before signing the other browsers out: 2
  sessions after, keeping only this one (id 2): 1

== What a missing field and an empty field do ==
  no password_challenge in the params at all: true
  the password really changed: true
  password_challenge sent as an empty string: false
  errors: Password challenge is invalid

== The email form writes unconfirmed_email and nothing else ==
  email_address      "asha.verma@example.com"
  unconfirmed_email  "asha@kaksha.example"
  mail went to       "asha@kaksha.example"

== The learner changes their mind and claims a third address ==
  the first link resolves to nil
  the second link resolves to "asha.v@kaksha.example"

== Confirming swaps the columns and tells the old address ==
  email_address      "asha.v@kaksha.example"
  unconfirmed_email  nil
  the used link now resolves to nil
  outbox:
    to asha@kaksha.example: Confirm your new address
    to asha.verma@example.com: Your Kaksha sign-in address was changed

# A data export and an account deletion, both done by a job rather than inside
# the request: the controller only enqueues, and the rows change when the job
# runs. The deletion keeps the fee receipts an accounts team must keep and
# removes the person from them. Standalone Active Record and Active Job with
# the test queue adapter; in-memory SQLite, no server, no network.
require "active_record"
require "active_job"
require "json"
require "logger"

ActiveRecord::Base.establish_connection(adapter: "sqlite3", database: ":memory:")
ActiveJob::Base.queue_adapter = :test
ActiveJob::Base.logger = Logger.new(IO::NULL)

ActiveRecord::Schema.verbose = false
ActiveRecord::Schema.define do
  create_table :users do |t|
    t.string :email_address, null: false
    t.string :password_digest, null: false
    t.datetime :deletion_requested_at
    t.timestamps
  end
  create_table :sessions do |t|
    t.references :user, null: false
    t.string :ip_address
    t.timestamps
  end
  create_table :enrolments do |t|
    t.references :user, null: false
    t.string :batch_name
    t.timestamps
  end
  create_table :receipts do |t|
    t.references :user, null: true
    t.string :number, null: false
    t.string :payer_name
    t.integer :amount_paise, null: false
    t.timestamps
  end
end

class User < ActiveRecord::Base
  has_many :sessions, dependent: :destroy
  has_many :enrolments, dependent: :destroy
  has_many :receipts, dependent: :nullify
  has_secure_password
end

class Session < ActiveRecord::Base; belongs_to :user; end
class Enrolment < ActiveRecord::Base; belongs_to :user; end
class Receipt < ActiveRecord::Base; belongs_to :user, optional: true; end

DOWNLOADS = {}

class ExportAccountJob < ActiveJob::Base
  def perform(user_id)
    user = User.find(user_id)
    DOWNLOADS[user_id] = {
      account: { email_address: user.email_address, joined_on: "2031-02-04" },
      sessions: user.sessions.order(:id).map { |s| { ip_address: s.ip_address } },
      enrolments: user.enrolments.order(:id).map { |e| { batch: e.batch_name } },
      receipts: user.receipts.order(:id).map { |r| { number: r.number, amount_in_rupees: r.amount_paise / 100 } },
    }
  end
end

class DeleteAccountJob < ActiveJob::Base
  def perform(user_id)
    user = User.find_by(id: user_id)
    return unless user # the job may run twice; the second run has nothing to do

    user.receipts.update_all(payer_name: "Deleted account")
    user.destroy!
  end
end

asha = User.create!(email_address: "asha.verma@example.com", password: "monsoon-ledger-7")
2.times { |n| asha.sessions.create!(ip_address: "203.0.113.#{9 + n}") }
asha.enrolments.create!(batch_name: "Class 10 maths, morning")
asha.enrolments.create!(batch_name: "Class 10 science, evening")
asha.receipts.create!(number: "KK-2031-0041", payer_name: "Asha Verma", amount_paise: 450_000)
asha.receipts.create!(number: "KK-2031-0098", payer_name: "Asha Verma", amount_paise: 450_000)

def queue = ActiveJob::Base.queue_adapter
def run_queue!
  jobs = queue.enqueued_jobs.dup
  queue.enqueued_jobs.clear
  jobs.each { |job| ActiveJob::Base.execute(job.except(:job).merge("job_class" => job[:job].to_s)) }
  jobs.size
end

puts "== The export request only enqueues =="
ExportAccountJob.perform_later(asha.id)
puts "  jobs waiting: #{queue.enqueued_jobs.size} (#{queue.enqueued_jobs.first[:job]})"
puts "  download ready for the user? #{DOWNLOADS.key?(asha.id)}"
puts "  jobs run now: #{run_queue!}"
puts "  download ready for the user? #{DOWNLOADS.key?(asha.id)}"
puts "\n  what the file holds:"
puts JSON.pretty_generate(DOWNLOADS[asha.id]).lines.map { |line| "    #{line}" }.join

puts "\n== The deletion request marks the row and enqueues =="
asha.update!(deletion_requested_at: Time.utc(2031, 5, 10, 9, 0, 0))
DeleteAccountJob.perform_later(asha.id)
puts "  deletion_requested_at #{asha.deletion_requested_at.iso8601}"
puts "  user rows #{User.count}, sessions #{Session.count}, enrolments #{Enrolment.count}, receipts #{Receipt.count}"

puts "\n== When the job runs =="
run_queue!
puts "  user rows #{User.count}, sessions #{Session.count}, enrolments #{Enrolment.count}, receipts #{Receipt.count}"
Receipt.order(:id).each do |receipt|
  puts "  receipt #{receipt.number}: user_id #{receipt.user_id.inspect}, payer #{receipt.payer_name.inspect}, ₹#{receipt.amount_paise / 100}"
end

puts "\n== The same job delivered twice =="
DeleteAccountJob.perform_later(asha.id)
puts "  jobs run: #{run_queue!}; user rows #{User.count}, receipts #{Receipt.count}"

== The export request only enqueues ==
  jobs waiting: 1 (ExportAccountJob)
  download ready for the user? false
  jobs run now: 1
  download ready for the user? true

  what the file holds:
    {
      "account": {
        "email_address": "asha.verma@example.com",
        "joined_on": "2031-02-04"
      },
      "sessions": [
        {
          "ip_address": "203.0.113.9"
        },
        {
          "ip_address": "203.0.113.10"
        }
      ],
      "enrolments": [
        {
          "batch": "Class 10 maths, morning"
        },
        {
          "batch": "Class 10 science, evening"
        }
      ],
      "receipts": [
        {
          "number": "KK-2031-0041",
          "amount_in_rupees": 4500
        },
        {
          "number": "KK-2031-0098",
          "amount_in_rupees": 4500
        }
      ]
    }

== The deletion request marks the row and enqueues ==
  deletion_requested_at 2031-05-10T09:00:00Z
  user rows 1, sessions 2, enrolments 2, receipts 2

== When the job runs ==
  user rows 0, sessions 0, enrolments 0, receipts 2
  receipt KK-2031-0041: user_id nil, payer "Deleted account", ₹4500
  receipt KK-2031-0098: user_id nil, payer "Deleted account", ₹4500

== The same job delivered twice ==
  jobs run: 1; user rows 0, receipts 2