Add phx.gen.auth authentication scaffolding

- LiveView-based email/password auth via mix phx.gen.auth
- Auth links removed from public navigation (direct URL access only)
- Accounts context with User schema and token management

app/lib/firehose_web/components/layouts.ex

@@ -9,6 +9,7 @@ defmodule FirehoseWeb.Layouts do
   # The default root.html.heex file contains the HTML
   # skeleton of your application, namely HTML headers
   # and other static content.
+
   embed_templates "layouts/*"
 
   @doc """

app/lib/firehose_web/controllers/user_registration_controller.ex

@@ -0,0 +1,32 @@
+defmodule FirehoseWeb.UserRegistrationController do
+  use FirehoseWeb, :controller
+
+  alias Firehose.Accounts
+  alias Firehose.Accounts.User
+
+  def new(conn, _params) do
+    changeset = Accounts.change_user_email(%User{})
+    render(conn, :new, changeset: changeset)
+  end
+
+  def create(conn, %{"user" => user_params}) do
+    case Accounts.register_user(user_params) do
+      {:ok, user} ->
+        {:ok, _} =
+          Accounts.deliver_login_instructions(
+            user,
+            &url(~p"/users/log-in/#{&1}")
+          )
+
+        conn
+        |> put_flash(
+          :info,
+          "An email was sent to #{user.email}, please access it to confirm your account."
+        )
+        |> redirect(to: ~p"/users/log-in")
+
+      {:error, %Ecto.Changeset{} = changeset} ->
+        render(conn, :new, changeset: changeset)
+    end
+  end
+end

app/lib/firehose_web/controllers/user_registration_html.ex

@@ -0,0 +1,5 @@
+defmodule FirehoseWeb.UserRegistrationHTML do
+  use FirehoseWeb, :html
+
+  embed_templates "user_registration_html/*"
+end

app/lib/firehose_web/controllers/user_registration_html/new.html.heex

@@ -0,0 +1,30 @@
+<div class="mx-auto max-w-sm">
+  <div class="text-center">
+    <.header>
+      Register for an account
+      <:subtitle>
+        Already registered?
+        <.link navigate={~p"/users/log-in"} class="font-semibold text-brand hover:underline">
+          Log in
+        </.link>
+        to your account now.
+      </:subtitle>
+    </.header>
+  </div>
+
+  <.form :let={f} for={@changeset} action={~p"/users/register"}>
+    <.input
+      field={f[:email]}
+      type="email"
+      label="Email"
+      autocomplete="username"
+      spellcheck="false"
+      required
+      phx-mounted={JS.focus()}
+    />
+
+    <.button phx-disable-with="Creating account..." class="btn btn-primary w-full">
+      Create an account
+    </.button>
+  </.form>
+</div>

app/lib/firehose_web/controllers/user_session_controller.ex

@@ -0,0 +1,88 @@
+defmodule FirehoseWeb.UserSessionController do
+  use FirehoseWeb, :controller
+
+  alias Firehose.Accounts
+  alias FirehoseWeb.UserAuth
+
+  def new(conn, _params) do
+    email = get_in(conn.assigns, [:current_scope, Access.key(:user), Access.key(:email)])
+    form = Phoenix.Component.to_form(%{"email" => email}, as: "user")
+
+    render(conn, :new, form: form)
+  end
+
+  # magic link login
+  def create(conn, %{"user" => %{"token" => token} = user_params} = params) do
+    info =
+      case params do
+        %{"_action" => "confirmed"} -> "User confirmed successfully."
+        _ -> "Welcome back!"
+      end
+
+    case Accounts.login_user_by_magic_link(token) do
+      {:ok, {user, _expired_tokens}} ->
+        conn
+        |> put_flash(:info, info)
+        |> UserAuth.log_in_user(user, user_params)
+
+      {:error, :not_found} ->
+        conn
+        |> put_flash(:error, "The link is invalid or it has expired.")
+        |> render(:new, form: Phoenix.Component.to_form(%{}, as: "user"))
+    end
+  end
+
+  # email + password login
+  def create(conn, %{"user" => %{"email" => email, "password" => password} = user_params}) do
+    if user = Accounts.get_user_by_email_and_password(email, password) do
+      conn
+      |> put_flash(:info, "Welcome back!")
+      |> UserAuth.log_in_user(user, user_params)
+    else
+      form = Phoenix.Component.to_form(user_params, as: "user")
+
+      # In order to prevent user enumeration attacks, don't disclose whether the email is registered.
+      conn
+      |> put_flash(:error, "Invalid email or password")
+      |> render(:new, form: form)
+    end
+  end
+
+  # magic link request
+  def create(conn, %{"user" => %{"email" => email}}) do
+    if user = Accounts.get_user_by_email(email) do
+      Accounts.deliver_login_instructions(
+        user,
+        &url(~p"/users/log-in/#{&1}")
+      )
+    end
+
+    info =
+      "If your email is in our system, you will receive instructions for logging in shortly."
+
+    conn
+    |> put_flash(:info, info)
+    |> redirect(to: ~p"/users/log-in")
+  end
+
+  def confirm(conn, %{"token" => token}) do
+    if user = Accounts.get_user_by_magic_link_token(token) do
+      form = Phoenix.Component.to_form(%{"token" => token}, as: "user")
+
+      conn
+      |> assign(:user, user)
+      |> assign(:form, form)
+      |> render(:confirm)
+    else
+      conn
+      |> put_flash(:error, "Magic link is invalid or it has expired.")
+      |> redirect(to: ~p"/users/log-in")
+    end
+  end
+
+  def delete(conn, _params) do
+    conn
+    |> put_flash(:info, "Logged out successfully.")
+    |> UserAuth.log_out_user()
+  end
+end

app/lib/firehose_web/controllers/user_session_html.ex

@@ -0,0 +1,9 @@
+defmodule FirehoseWeb.UserSessionHTML do
+  use FirehoseWeb, :html
+
+  embed_templates "user_session_html/*"
+
+  defp local_mail_adapter? do
+    Application.get_env(:firehose, Firehose.Mailer)[:adapter] == Swoosh.Adapters.Local
+  end
+end

app/lib/firehose_web/controllers/user_session_html/confirm.html.heex

@@ -0,0 +1,57 @@
+<div class="mx-auto max-w-sm">
+  <div class="text-center">
+    <.header>Welcome {@user.email}</.header>
+  </div>
+
+  <.form
+    :if={!@user.confirmed_at}
+    for={@form}
+    id="confirmation_form"
+    action={~p"/users/log-in?_action=confirmed"}
+    phx-mounted={JS.focus_first()}
+  >
+    <input type="hidden" name={@form[:token].name} value={@form[:token].value} />
+    <.button
+      name={@form[:remember_me].name}
+      value="true"
+      phx-disable-with="Confirming..."
+      class="btn btn-primary w-full"
+    >
+      Confirm and stay logged in
+    </.button>
+    <.button phx-disable-with="Confirming..." class="btn btn-primary btn-soft w-full mt-2">
+      Confirm and log in only this time
+    </.button>
+  </.form>
+
+  <.form
+    :if={@user.confirmed_at}
+    for={@form}
+    id="login_form"
+    action={~p"/users/log-in"}
+    phx-mounted={JS.focus_first()}
+  >
+    <input type="hidden" name={@form[:token].name} value={@form[:token].value} />
+    <%= if @current_scope do %>
+      <.button variant="primary" phx-disable-with="Logging in..." class="btn btn-primary w-full">
+        Log in
+      </.button>
+    <% else %>
+      <.button
+        name={@form[:remember_me].name}
+        value="true"
+        phx-disable-with="Logging in..."
+        class="btn btn-primary w-full"
+      >
+        Keep me logged in on this device
+      </.button>
+      <.button phx-disable-with="Logging in..." class="btn btn-primary btn-soft w-full mt-2">
+        Log me in only this time
+      </.button>
+    <% end %>
+  </.form>
+
+  <p :if={!@user.confirmed_at} class="alert alert-outline mt-8">
+    Tip: If you prefer passwords, you can enable them in the user settings.
+  </p>
+</div>

app/lib/firehose_web/controllers/user_session_html/new.html.heex

@@ -0,0 +1,71 @@
+<div class="mx-auto max-w-sm space-y-4">
+  <div class="text-center">
+    <.header>
+      <p>Log in</p>
+      <:subtitle>
+        <%= if @current_scope do %>
+          You need to reauthenticate to perform sensitive actions on your account.
+        <% else %>
+          Don't have an account? <.link
+            navigate={~p"/users/register"}
+            class="font-semibold text-brand hover:underline"
+            phx-no-format
+          >Sign up</.link> for an account now.
+        <% end %>
+      </:subtitle>
+    </.header>
+  </div>
+
+  <div :if={local_mail_adapter?()} class="alert alert-info">
+    <.icon name="hero-information-circle" class="size-6 shrink-0" />
+    <div>
+      <p>You are running the local mail adapter.</p>
+      <p>
+        To see sent emails, visit <.link href="/dev/mailbox" class="underline">the mailbox page</.link>.
+      </p>
+    </div>
+  </div>
+
+  <.form :let={f} for={@form} as={:user} id="login_form_magic" action={~p"/users/log-in"}>
+    <.input
+      readonly={!!@current_scope}
+      field={f[:email]}
+      type="email"
+      label="Email"
+      autocomplete="username"
+      spellcheck="false"
+      required
+      phx-mounted={JS.focus()}
+    />
+    <.button class="btn btn-primary w-full">
+      Log in with email <span aria-hidden="true">→</span>
+    </.button>
+  </.form>
+
+  <div class="divider">or</div>
+
+  <.form :let={f} for={@form} as={:user} id="login_form_password" action={~p"/users/log-in"}>
+    <.input
+      readonly={!!@current_scope}
+      field={f[:email]}
+      type="email"
+      label="Email"
+      autocomplete="username"
+      spellcheck="false"
+      required
+    />
+    <.input
+      field={f[:password]}
+      type="password"
+      label="Password"
+      autocomplete="current-password"
+      spellcheck="false"
+    />
+    <.button class="btn btn-primary w-full" name={@form[:remember_me].name} value="true">
+      Log in and stay logged in <span aria-hidden="true">→</span>
+    </.button>
+    <.button class="btn btn-primary btn-soft w-full mt-2">
+      Log in only this time
+    </.button>
+  </.form>
+</div>

app/lib/firehose_web/controllers/user_settings_controller.ex

@@ -0,0 +1,77 @@
+defmodule FirehoseWeb.UserSettingsController do
+  use FirehoseWeb, :controller
+
+  alias Firehose.Accounts
+  alias FirehoseWeb.UserAuth
+
+  import FirehoseWeb.UserAuth, only: [require_sudo_mode: 2]
+
+  plug :require_sudo_mode
+  plug :assign_email_and_password_changesets
+
+  def edit(conn, _params) do
+    render(conn, :edit)
+  end
+
+  def update(conn, %{"action" => "update_email"} = params) do
+    %{"user" => user_params} = params
+    user = conn.assigns.current_scope.user
+
+    case Accounts.change_user_email(user, user_params) do
+      %{valid?: true} = changeset ->
+        Accounts.deliver_user_update_email_instructions(
+          Ecto.Changeset.apply_action!(changeset, :insert),
+          user.email,
+          &url(~p"/users/settings/confirm-email/#{&1}")
+        )
+
+        conn
+        |> put_flash(
+          :info,
+          "A link to confirm your email change has been sent to the new address."
+        )
+        |> redirect(to: ~p"/users/settings")
+
+      changeset ->
+        render(conn, :edit, email_changeset: %{changeset | action: :insert})
+    end
+  end
+
+  def update(conn, %{"action" => "update_password"} = params) do
+    %{"user" => user_params} = params
+    user = conn.assigns.current_scope.user
+
+    case Accounts.update_user_password(user, user_params) do
+      {:ok, {user, _}} ->
+        conn
+        |> put_flash(:info, "Password updated successfully.")
+        |> put_session(:user_return_to, ~p"/users/settings")
+        |> UserAuth.log_in_user(user)
+
+      {:error, changeset} ->
+        render(conn, :edit, password_changeset: changeset)
+    end
+  end
+
+  def confirm_email(conn, %{"token" => token}) do
+    case Accounts.update_user_email(conn.assigns.current_scope.user, token) do
+      {:ok, _user} ->
+        conn
+        |> put_flash(:info, "Email changed successfully.")
+        |> redirect(to: ~p"/users/settings")
+
+      {:error, _} ->
+        conn
+        |> put_flash(:error, "Email change link is invalid or it has expired.")
+        |> redirect(to: ~p"/users/settings")
+    end
+  end
+
+  defp assign_email_and_password_changesets(conn, _opts) do
+    user = conn.assigns.current_scope.user
+
+    conn
+    |> assign(:email_changeset, Accounts.change_user_email(user))
+    |> assign(:password_changeset, Accounts.change_user_password(user))
+  end
+end

app/lib/firehose_web/controllers/user_settings_html.ex

@@ -0,0 +1,5 @@
+defmodule FirehoseWeb.UserSettingsHTML do
+  use FirehoseWeb, :html
+
+  embed_templates "user_settings_html/*"
+end

app/lib/firehose_web/controllers/user_settings_html/edit.html.heex

@@ -0,0 +1,47 @@
+<div class="text-center">
+  <.header>
+    Account Settings
+    <:subtitle>Manage your account email address and password settings</:subtitle>
+  </.header>
+</div>
+
+<.form :let={f} for={@email_changeset} action={~p"/users/settings"} id="update_email">
+  <input type="hidden" name="action" value="update_email" />
+
+  <.input
+    field={f[:email]}
+    type="email"
+    label="Email"
+    autocomplete="username"
+    spellcheck="false"
+    required
+  />
+
+  <.button variant="primary" phx-disable-with="Changing...">Change Email</.button>
+</.form>
+
+<div class="divider" />
+
+<.form :let={f} for={@password_changeset} action={~p"/users/settings"} id="update_password">
+  <input type="hidden" name="action" value="update_password" />
+
+  <.input
+    field={f[:password]}
+    type="password"
+    label="New password"
+    autocomplete="new-password"
+    spellcheck="false"
+    required
+  />
+  <.input
+    field={f[:password_confirmation]}
+    type="password"
+    label="Confirm new password"
+    autocomplete="new-password"
+    spellcheck="false"
+    required
+  />
+  <.button variant="primary" phx-disable-with="Changing...">
+    Save Password
+  </.button>
+</.form>

app/lib/firehose_web/router.ex

@@ -1,6 +1,8 @@
 defmodule FirehoseWeb.Router do
   use FirehoseWeb, :router
 
+  import FirehoseWeb.UserAuth
+
   pipeline :browser do
     plug :accepts, ["html"]
     plug :fetch_session
@@ -9,6 +11,7 @@ defmodule FirehoseWeb.Router do
     plug :put_layout, html: {FirehoseWeb.Layouts, :app}
     plug :protect_from_forgery
     plug :put_secure_browser_headers
+    plug :fetch_current_scope_for_user
   end
 
   pipeline :api do
@@ -51,4 +54,30 @@ defmodule FirehoseWeb.Router do
       forward "/mailbox", Plug.Swoosh.MailboxPreview
     end
   end
+
+  ## Authentication routes
+
+  scope "/", FirehoseWeb do
+    pipe_through [:browser, :redirect_if_user_is_authenticated]
+
+    get "/users/register", UserRegistrationController, :new
+    post "/users/register", UserRegistrationController, :create
+  end
+
+  scope "/", FirehoseWeb do
+    pipe_through [:browser, :require_authenticated_user]
+
+    get "/users/settings", UserSettingsController, :edit
+    put "/users/settings", UserSettingsController, :update
+    get "/users/settings/confirm-email/:token", UserSettingsController, :confirm_email
+  end
+
+  scope "/", FirehoseWeb do
+    pipe_through [:browser]
+
+    get "/users/log-in", UserSessionController, :new
+    get "/users/log-in/:token", UserSessionController, :confirm
+    post "/users/log-in", UserSessionController, :create
+    delete "/users/log-out", UserSessionController, :delete
+  end
 end

app/lib/firehose_web/user_auth.ex

@@ -0,0 +1,219 @@
+defmodule FirehoseWeb.UserAuth do
+  use FirehoseWeb, :verified_routes
+
+  import Plug.Conn
+  import Phoenix.Controller
+
+  alias Firehose.Accounts
+  alias Firehose.Accounts.Scope
+
+  # Make the remember me cookie valid for 14 days. This should match
+  # the session validity setting in UserToken.
+  @max_cookie_age_in_days 14
+  @remember_me_cookie "_firehose_web_user_remember_me"
+  @remember_me_options [
+    sign: true,
+    max_age: @max_cookie_age_in_days * 24 * 60 * 60,
+    same_site: "Lax"
+  ]
+
+  # How old the session token should be before a new one is issued. When a request is made
+  # with a session token older than this value, then a new session token will be created
+  # and the session and remember-me cookies (if set) will be updated with the new token.
+  # Lowering this value will result in more tokens being created by active users. Increasing
+  # it will result in less time before a session token expires for a user to get issued a new
+  # token. This can be set to a value greater than `@max_cookie_age_in_days` to disable
+  # the reissuing of tokens completely.
+  @session_reissue_age_in_days 7
+
+  @doc """
+  Logs the user in.
+
+  Redirects to the session's `:user_return_to` path
+  or falls back to the `signed_in_path/1`.
+  """
+  def log_in_user(conn, user, params \\ %{}) do
+    user_return_to = get_session(conn, :user_return_to)
+
+    conn
+    |> create_or_extend_session(user, params)
+    |> redirect(to: user_return_to || signed_in_path(conn))
+  end
+
+  @doc """
+  Logs the user out.
+
+  It clears all session data for safety. See renew_session.
+  """
+  def log_out_user(conn) do
+    user_token = get_session(conn, :user_token)
+    user_token && Accounts.delete_user_session_token(user_token)
+
+    if live_socket_id = get_session(conn, :live_socket_id) do
+      FirehoseWeb.Endpoint.broadcast(live_socket_id, "disconnect", %{})
+    end
+
+    conn
+    |> renew_session(nil)
+    |> delete_resp_cookie(@remember_me_cookie, @remember_me_options)
+    |> redirect(to: ~p"/")
+  end
+
+  @doc """
+  Authenticates the user by looking into the session and remember me token.
+
+  Will reissue the session token if it is older than the configured age.
+  """
+  def fetch_current_scope_for_user(conn, _opts) do
+    with {token, conn} <- ensure_user_token(conn),
+         {user, token_inserted_at} <- Accounts.get_user_by_session_token(token) do
+      conn
+      |> assign(:current_scope, Scope.for_user(user))
+      |> maybe_reissue_user_session_token(user, token_inserted_at)
+    else
+      nil -> assign(conn, :current_scope, Scope.for_user(nil))
+    end
+  end
+
+  defp ensure_user_token(conn) do
+    if token = get_session(conn, :user_token) do
+      {token, conn}
+    else
+      conn = fetch_cookies(conn, signed: [@remember_me_cookie])
+
+      if token = conn.cookies[@remember_me_cookie] do
+        {token, conn |> put_token_in_session(token) |> put_session(:user_remember_me, true)}
+      else
+        nil
+      end
+    end
+  end
+
+  # Reissue the session token if it is older than the configured reissue age.
+  defp maybe_reissue_user_session_token(conn, user, token_inserted_at) do
+    token_age = DateTime.diff(DateTime.utc_now(:second), token_inserted_at, :day)
+
+    if token_age >= @session_reissue_age_in_days do
+      create_or_extend_session(conn, user, %{})
+    else
+      conn
+    end
+  end
+
+  # This function is the one responsible for creating session tokens
+  # and storing them safely in the session and cookies. It may be called
+  # either when logging in, during sudo mode, or to renew a session which
+  # will soon expire.
+  #
+  # When the session is created, rather than extended, the renew_session
+  # function will clear the session to avoid fixation attacks. See the
+  # renew_session function to customize this behaviour.
+  defp create_or_extend_session(conn, user, params) do
+    token = Accounts.generate_user_session_token(user)
+    remember_me = get_session(conn, :user_remember_me)
+
+    conn
+    |> renew_session(user)
+    |> put_token_in_session(token)
+    |> maybe_write_remember_me_cookie(token, params, remember_me)
+  end
+
+  # Do not renew session if the user is already logged in
+  # to prevent CSRF errors or data being lost in tabs that are still open
+  defp renew_session(conn, user) when conn.assigns.current_scope.user.id == user.id do
+    conn
+  end
+
+  # This function renews the session ID and erases the whole
+  # session to avoid fixation attacks. If there is any data
+  # in the session you may want to preserve after log in/log out,
+  # you must explicitly fetch the session data before clearing
+  # and then immediately set it after clearing, for example:
+  #
+  #     defp renew_session(conn, _user) do
+  #       delete_csrf_token()
+  #       preferred_locale = get_session(conn, :preferred_locale)
+  #
+  #       conn
+  #       |> configure_session(renew: true)
+  #       |> clear_session()
+  #       |> put_session(:preferred_locale, preferred_locale)
+  #     end
+  #
+  defp renew_session(conn, _user) do
+    delete_csrf_token()
+
+    conn
+    |> configure_session(renew: true)
+    |> clear_session()
+  end
+
+  defp maybe_write_remember_me_cookie(conn, token, %{"remember_me" => "true"}, _),
+    do: write_remember_me_cookie(conn, token)
+
+  defp maybe_write_remember_me_cookie(conn, token, _params, true),
+    do: write_remember_me_cookie(conn, token)
+
+  defp maybe_write_remember_me_cookie(conn, _token, _params, _), do: conn
+
+  defp write_remember_me_cookie(conn, token) do
+    conn
+    |> put_session(:user_remember_me, true)
+    |> put_resp_cookie(@remember_me_cookie, token, @remember_me_options)
+  end
+
+  defp put_token_in_session(conn, token) do
+    put_session(conn, :user_token, token)
+  end
+
+  @doc """
+  Plug for routes that require sudo mode.
+  """
+  def require_sudo_mode(conn, _opts) do
+    if Accounts.sudo_mode?(conn.assigns.current_scope.user, -10) do
+      conn
+    else
+      conn
+      |> put_flash(:error, "You must re-authenticate to access this page.")
+      |> maybe_store_return_to()
+      |> redirect(to: ~p"/users/log-in")
+      |> halt()
+    end
+  end
+
+  @doc """
+  Plug for routes that require the user to not be authenticated.
+  """
+  def redirect_if_user_is_authenticated(conn, _opts) do
+    if conn.assigns.current_scope do
+      conn
+      |> redirect(to: signed_in_path(conn))
+      |> halt()
+    else
+      conn
+    end
+  end
+
+  defp signed_in_path(_conn), do: ~p"/"
+
+  @doc """
+  Plug for routes that require the user to be authenticated.
+  """
+  def require_authenticated_user(conn, _opts) do
+    if conn.assigns.current_scope && conn.assigns.current_scope.user do
+      conn
+    else
+      conn
+      |> put_flash(:error, "You must log in to access this page.")
+      |> maybe_store_return_to()
+      |> redirect(to: ~p"/users/log-in")
+      |> halt()
+    end
+  end
+
+  defp maybe_store_return_to(%{method: "GET"} = conn) do
+    put_session(conn, :user_return_to, current_path(conn))
+  end
+
+  defp maybe_store_return_to(conn), do: conn
+end