Sergei Poljanski
d91a72f603
Add /admin/users to create, edit, disable and delete accounts with the per-area permission grid. New users get a one-time invite link (48 h) by email; the admin also sees it once, so an account without email can still be onboarded. Forgotten passwords get a 1 h reset link with the same answer for unknown accounts. Only token hashes are stored. Guards against escalation and lockout: a user manager can only grant flags they hold and cannot touch flags they lack; only superusers change superuser accounts; nobody can disable or delete themselves; the last active superuser stays. Logins, user changes, and bingo and invoice actions are recorded in an audit log at /admin/audit. Read timestamps as UTC: they are all written with Time.now.utc, and on a UTC+4 host a fresh 1 h token read back as already expired. Assisted-by: Claude:opus-5
101 lines
2.5 KiB
Ruby
101 lines
2.5 KiB
Ruby
require 'mail'
|
|
|
|
module Mailer
|
|
module_function
|
|
|
|
def configure!
|
|
Mail.defaults do
|
|
delivery_method :smtp,
|
|
address: ENV.fetch('SMTP_ADDR'),
|
|
port: ENV.fetch('SMTP_PORT').to_i,
|
|
user_name: ENV.fetch('SMTP_USER'),
|
|
password: ENV.fetch('SMTP_PASSWORD'),
|
|
authentication: :plain,
|
|
enable_starttls_auto: true
|
|
end
|
|
end
|
|
|
|
def notify_owner(name:, email:, subject:, message:, ip:)
|
|
from = ENV.fetch('MAIL_FROM')
|
|
to = ENV.fetch('MAIL_TO')
|
|
subj = subject.to_s.strip.empty? ? 'Contact form submission' : subject.to_s.strip
|
|
body = <<~BODY
|
|
New contact form submission on asxp.io.
|
|
|
|
From: #{name} <#{email}>
|
|
Subject: #{subj}
|
|
IP: #{ip}
|
|
Time: #{Time.now.utc.iso8601}
|
|
|
|
---
|
|
#{message}
|
|
BODY
|
|
|
|
Mail.deliver do
|
|
from from
|
|
to to
|
|
reply_to email
|
|
subject "[asxp.io] #{subj}"
|
|
body body
|
|
end
|
|
end
|
|
|
|
def confirm_visitor(name:, email:, subject:, message:)
|
|
from = ENV.fetch('MAIL_FROM')
|
|
to = ENV.fetch('MAIL_TO')
|
|
subj = subject.to_s.strip.empty? ? '(blank)' : subject.to_s.strip
|
|
body = <<~BODY
|
|
Hi #{name},
|
|
|
|
Thanks for contacting IE Sergei Poljanski. I've received your message
|
|
and will get back to you as soon as possible.
|
|
|
|
For your records, here's what you sent:
|
|
|
|
Subject: #{subj}
|
|
|
|
#{message}
|
|
|
|
--
|
|
IE Sergei Poljanski
|
|
ie@asxp.io · https://asxp.io
|
|
BODY
|
|
|
|
Mail.deliver do
|
|
from from
|
|
to email
|
|
reply_to to
|
|
subject 'Thanks for contacting IE Sergei Poljanski'
|
|
body body
|
|
end
|
|
end
|
|
|
|
# Invite / password-reset email with a one-time link.
|
|
def account_link(to:, username:, url:, kind:)
|
|
from = ENV.fetch('MAIL_FROM')
|
|
subj, intro, ttl =
|
|
if kind == 'invite'
|
|
['Your asxp.io admin account', "An account \"#{username}\" was created for you on the asxp.io admin.\nSet your password here:", '48 hours']
|
|
else
|
|
['Reset your asxp.io admin password', "Someone (hopefully you) asked to reset the password for \"#{username}\".\nSet a new one here:", '1 hour']
|
|
end
|
|
body = <<~BODY
|
|
#{intro}
|
|
|
|
#{url}
|
|
|
|
The link works once and expires in #{ttl}. If you didn't expect this
|
|
email, ignore it.
|
|
|
|
--
|
|
asxp.io
|
|
BODY
|
|
|
|
Mail.deliver do
|
|
from from
|
|
to to
|
|
subject subj
|
|
body body
|
|
end
|
|
end
|
|
end
|