api_guard 0.5.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 16c29cefc6fd22302a55e87e7ec5f52d6fc4936640ee190cad692646cbe37cc7
-  data.tar.gz: daa21cfa0052dc034fc5e5c18c380a9ee3eac72e3d1490db895798dc2f31c9f7
+  metadata.gz: 664b5fd08385f8cb690e350127d83bdeb8228264ccf179bc2a4242841e27e114
+  data.tar.gz: 6c94a5a7867c4ce5aa186f4f18fbfd4706b654818de791e23b8d83827e58fcf1
 SHA512:
-  metadata.gz: 6daaca97ec4dd5d3c4f9938642edc77b2fc25a8854985d6b305e4ce1e83b20dd52b2056fed4e0e9d8b6e14f9f0049391afe42c40f455983d9386556fc1bca37c
-  data.tar.gz: a3feb57d806c7581a6679833a2cb0f41328e8b9a9077acd5504898173527b7ae30778d846efbbac4106d52abea65c35300e6714f2aa0cc2cb3016e1dd2b1eb2f
+  metadata.gz: 4d5b0b0145c8c2c82a4a679c2ece7249e397ec3ad497dc9336388fff6d6830e76f70078336a50b790ace86f374967840c99535b86989bb2bec570d30fbe5b912
+  data.tar.gz: e90af09ed86e505eb7a38f489f3347fbfc9f906f7d141748c4c4bc28365cf165cbfa668832eceef29e744dcb9ea929e4b568181730cd6337023183b64cd5cd40

data/README.md

@@ -1,9 +1,8 @@
 # API Guard
 
 [![Version](https://img.shields.io/gem/v/api_guard.svg?color=green)](https://rubygems.org/gems/api_guard)
-[![Build Status](https://github.com/Gokul595/api_guard/workflows/build/badge.svg?branch=master)](https://github.com/Gokul595/api_guard/actions?query=workflow%3Abuild)
+[![Build Status](https://github.com/Gokul595/api_guard/workflows/build-master/badge.svg?branch=master)](https://github.com/Gokul595/api_guard/actions?query=workflow%3Abuild-master)
 [![Maintainability](https://api.codeclimate.com/v1/badges/ced3e74a26a66ed915cb/maintainability)](https://codeclimate.com/github/Gokul595/api_guard/maintainability)
-[![Test Coverage](https://api.codeclimate.com/v1/badges/ced3e74a26a66ed915cb/test_coverage)](https://codeclimate.com/github/Gokul595/api_guard/test_coverage)
 
 
 [JSON Web Token (JWT)](https://jwt.io/) based authentication solution with token refreshing & blacklisting for APIs 
@@ -203,6 +202,8 @@ To authenticate the API request just add this before_action in the controller:
 before_action :authenticate_and_set_user
 ```
 
+>**Note:** It is possible to authenticate with more than one resource, e.g. `authenticate_and_set_user_or_admin` will permit tokens issued for users or admins.
+
 Send the access token got in sign in API in the Authorization header in the API request as below. 
 Also, make sure you add "Bearer" before the access token in the header value.
 
@@ -423,7 +424,7 @@ To include token refreshing in your application you need to create a table to st
 Use below command to create a model `RefeshToken` with columns to store the token and the user reference
 
 ```bash
-$ rails generate model refresh_token token:string:uniq user:references
+$ rails generate model refresh_token token:string:uniq user:references expire_at:datetime
 ```
 
 Then, run migration to create the `refresh_tokens` table
@@ -452,11 +453,11 @@ api_guard_associations refresh_token: 'refresh_tokens', blacklisted_token: 'blac
 
 ### Token blacklisting
 
-To include token blacklisting in your application you need to create a table to store the refresh tokens. This will be 
+To include token blacklisting in your application you need to create a table to store the blacklisted tokens. This will be 
 used to blacklist a JWT access token from future use. The access token will be blacklisted on successful sign out of the 
 resource.
 
-Use below command to create a model `RefeshToken` with columns to store the token and the user reference
+Use below command to create a model `BlacklistedToken` with columns to store the token and the user reference
 
 ```bash
 $ rails generate model blacklisted_token token:string user:references expire_at:datetime

data/lib/api_guard/jwt_auth/authentication.rb

@@ -9,8 +9,8 @@ module ApiGuard
         method_name = name.to_s
 
         if method_name.start_with?('authenticate_and_set_')
-          resource_name = method_name.split('authenticate_and_set_')[1]
-          authenticate_and_set_resource(resource_name)
+          resource_names = method_name.split('authenticate_and_set_')[1].split('_or_')
+          authenticate_and_set_resources(resource_names)
         else
           super
         end
@@ -20,9 +20,9 @@ module ApiGuard
         method_name.to_s.start_with?('authenticate_and_set_') || super
       end
 
-      # Authenticate the JWT token and set resource
-      def authenticate_and_set_resource(resource_name)
-        @resource_name = resource_name
+      # Authenticate the JWT token and set resources
+      def authenticate_and_set_resources(resource_names)
+        @resource_names = resource_names
 
         @token = request.headers['Authorization']&.split('Bearer ')&.last
         return render_error(401, message: I18n.t('api_guard.access_token.missing')) unless @token
@@ -58,7 +58,7 @@ module ApiGuard
       # Defines "current_{{resource_name}}" method and "@current_{{resource_name}}" instance variable
       # that returns "resource" value
       def define_current_resource_accessors(resource)
-        self.class.send(:define_method, "current_#{@resource_name}") do
+        define_singleton_method("current_#{@resource_name}") do
           instance_variable_get("@current_#{@resource_name}") ||
             instance_variable_set("@current_#{@resource_name}", resource)
         end
@@ -72,15 +72,25 @@ module ApiGuard
       def authenticate_token
         return unless decode_token
 
+        @resource_name = set_resource_name_from_token(@resource_names)
+        return if @resource_name.nil?
+
         resource = find_resource_from_token(@resource_name.classify.constantize)
 
         if resource && valid_issued_at?(resource) && !blacklisted?(resource)
           define_current_resource_accessors(resource)
-        else
-          render_error(401, message: I18n.t('api_guard.access_token.invalid'))
         end
       end
 
+      def set_resource_name_from_token(resource_names)
+        resource_names.each do |name|
+          resource_id = @decoded_token[:"#{name}_id"]
+          return name if resource_id.present?
+        end
+
+        return nil
+      end
+
       def find_resource_from_token(resource_class)
         resource_id = @decoded_token[:"#{@resource_name}_id"]
         return if resource_id.blank?

data/lib/api_guard/jwt_auth/json_web_token.rb

@@ -34,7 +34,8 @@ module ApiGuard
       # Also, create refresh token if enabled for the resource.
       #
       # This creates expired JWT token if the argument 'expired_token' is true which can be used for testing.
-      def jwt_and_refresh_token(resource, resource_name, expired_token = false)
+      # This creates expired refresh token if the argument 'expired_refresh_token' is true which can be used for testing.
+      def jwt_and_refresh_token(resource, resource_name, expired_token = false, expired_refresh_token = false)
         payload = {
           "#{resource_name}_id": resource.id,
           exp: expired_token ? token_issued_at : token_expire_at,
@@ -44,7 +45,7 @@ module ApiGuard
         # Add custom data in the JWT token payload
         payload.merge!(resource.jwt_token_payload) if resource.respond_to?(:jwt_token_payload)
 
-        [encode(payload), new_refresh_token(resource)]
+        [encode(payload), new_refresh_token(resource, expired_refresh_token)]
       end
 
       # Create tokens and set response headers

data/lib/api_guard/jwt_auth/refresh_jwt_token.rb

@@ -4,6 +4,11 @@ module ApiGuard
   module JwtAuth
     # Common module for refresh token functionality
     module RefreshJwtToken
+
+      def refresh_token_expire_at
+        @refresh_token_expire_at ||= (Time.now.utc + ApiGuard.refresh_token_validity)
+      end
+
       def refresh_token_association(resource)
         resource.class.refresh_token_association
       end
@@ -18,7 +23,7 @@ module ApiGuard
       end
 
       def find_refresh_token_of(resource, refresh_token)
-        refresh_tokens_for(resource).find_by_token(refresh_token)
+        refresh_tokens_for(resource).where(token: refresh_token).where('expire_at IS NULL OR expire_at > ?', Time.now.utc).first
       end
 
       # Generate and return unique refresh token for the resource
@@ -30,10 +35,11 @@ module ApiGuard
       end
 
       # Create a new refresh_token for the current resource
-      def new_refresh_token(resource)
+      # This creates expired refresh_token if the argument 'expired_refresh_token' is true which can be used for testing.
+      def new_refresh_token(resource, expired_refresh_token = false)
         return unless refresh_token_enabled?(resource)
 
-        refresh_tokens_for(resource).create(token: uniq_refresh_token(resource)).token
+        refresh_tokens_for(resource).create(token: uniq_refresh_token(resource), expire_at: expired_refresh_token ? Time.now.utc : refresh_token_expire_at).token
       end
 
       def destroy_all_refresh_tokens(resource)

data/lib/api_guard/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ApiGuard
-  VERSION = '0.5.0'
+  VERSION = '0.6.0'
 end

data/lib/api_guard.rb

@@ -14,6 +14,9 @@ module ApiGuard
   mattr_accessor :token_validity
   self.token_validity = 1.day
 
+  mattr_accessor :refresh_token_validity
+  self.refresh_token_validity = 2.weeks
+
   mattr_accessor :token_signing_secret
   self.token_signing_secret = nil
 

data/lib/generators/api_guard/initializer/templates/initializer.rb

@@ -4,6 +4,10 @@ ApiGuard.setup do |config|
   # Validity of the JWT access token
   # Default: 1 day
   # config.token_validity = 1.day
+    
+  # Validity of the refresh token
+  # Default: 2 weeks
+  # config.refresh_token_validity = 2.weeks
 
   # Secret key for signing (encoding & decoding) the JWT access token
   # Default: 'secret_key_base' from Rails secrets

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: api_guard
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Gokul Murali
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-09-13 00:00:00.000000000 Z
+date: 2022-03-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt
@@ -195,7 +195,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
+rubygems_version: 3.0.8
 signing_key:
 specification_version: 4
 summary: Rails API authentication made easy