api_guard_grape 0.5.5 → 0.5.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 03fd89353f83f1dff916ed717aeb63ab7a957c867f82849e7b9db0c59f8b495e
-  data.tar.gz: 3934bf4a9824a8d81d28e4ec1eed7d4a4a4fa0fc526154375ad35316fdc10c84
+  metadata.gz: 5cbdbe6a99ddb95a194ca2d457a00c632dcd8e70731b6e8bcebf02388c32a7ed
+  data.tar.gz: ded2f1d9537467657b493269e3a06093b2208f871a356f056aaf1179cd8e6e85
 SHA512:
-  metadata.gz: 16190fb470832b3f483d8879dd41dc4eff235fe84a3274ad4ca31ced70f503a165270b9745ed83c4ae894ac614097adde6fb35434a8659fe9e1b154a93c9bfb3
-  data.tar.gz: 6345f644b9a59ffd6da22f9f5284baf2a8ac4ef572a95263d15e73c4f5448bb181f7a891f081edfc27422e5b4ca35293b8eb68c8d16dfa63570b2a6eba61c6b3
+  metadata.gz: 37e5bb2e16a4d3733b630577c070be248fc9d24aa70209434fd0709b2c6efa60b32e3a90b76d08d4d7f127e3a2e0ef48b7ff4832bfd66a1f89f1120a911020ab
+  data.tar.gz: 97c8f918a4de68e43c42b207aeb964a8cd5b7c2ff12658533a61db86921b7b2cdd0e6fcd8f4467faa9e21a9706c527a05afe1f3fe440b4b962c00b99892f3d4e

data/lib/api_guard/jwt_auth/json_web_token.rb

@@ -110,12 +110,10 @@ module ApiGuard
 
     # blacklisted ======================================================
       def self.blacklisted_token_association(resource)
-        debugger
         resource.class.blacklisted_token_association
       end
 
       def self.token_blacklisting_enabled?(resource)
-        debugger
         blacklisted_token_association(resource).present?
       end
 
@@ -138,6 +136,95 @@ module ApiGuard
         blacklisted_tokens_for(current_resource).create(token: @token, expire_at: Time.at(@decoded_token[:exp]).utc)
       end 
 
+
+      def self.method_missing(name, *args)
+        method_name = name.to_s
+
+        if method_name.start_with?('authenticate_and_set_')
+          resource_name = method_name.split('authenticate_and_set_')[1]
+          authenticate_and_set_resource(resource_name)
+        else
+          super
+        end
+      end
+
+      def self.respond_to_missing?(method_name, include_private = false)
+        method_name.to_s.start_with?('authenticate_and_set_') || super
+      end
+
+      # Authenticate the JWT token and set resource
+      def self.authenticate_and_set_resource(resource_name)
+        @resource_name = resource_name
+
+        @token = request.headers['Authorization']&.split('Bearer ')&.last
+        return render_error(401, message: I18n.t('api_guard.access_token.missing')) unless @token
+
+        authenticate_token
+
+        # Render error response only if no resource found and no previous render happened
+        render_error(401, message: I18n.t('api_guard.access_token.invalid')) if !current_resource && !performed?
+      rescue JWT::DecodeError => e
+        if e.message == 'Signature has expired'
+          render_error(401, message: I18n.t('api_guard.access_token.expired'))
+        else
+          render_error(401, message: I18n.t('api_guard.access_token.invalid'))
+        end
+      end
+
+      # Decode the JWT token
+      # and don't verify token expiry for refresh token API request
+      def self.decode_token
+        # TODO: Set token refresh controller dynamic
+        verify_token = (controller_name != 'tokens' || action_name != 'create')
+        @decoded_token = decode(@token, verify_token)
+      end
+
+      # Returns whether the JWT token is issued after the last password change
+      # Returns true if password hasn't changed by the user
+      def self.valid_issued_at?(resource)
+        return true unless ApiGuard.invalidate_old_tokens_on_password_change
+
+        !resource.token_issued_at || @decoded_token[:iat] >= resource.token_issued_at.to_i
+      end
+
+      # Defines "current_{{resource_name}}" method and "@current_{{resource_name}}" instance variable
+      # that returns "resource" value
+      def self.define_current_resource_accessors(resource)
+        define_singleton_method("current_#{@resource_name}") do
+          instance_variable_get("@current_#{@resource_name}") ||
+            instance_variable_set("@current_#{@resource_name}", resource)
+        end
+      end
+
+      # Authenticate the resource with the '{{resource_name}}_id' in the decoded JWT token
+      # and also, check for valid issued at time and not blacklisted
+      #
+      # Also, set "current_{{resource_name}}" method and "@current_{{resource_name}}" instance variable
+      # for accessing the authenticated resource
+      def self.authenticate_token
+        return unless decode_token
+
+        resource = find_resource_from_token(@resource_name.classify.constantize)
+
+        if resource && valid_issued_at?(resource) && !blacklisted?(resource)
+          define_current_resource_accessors(resource)
+        else
+          render_error(401, message: I18n.t('api_guard.access_token.invalid'))
+        end
+      end
+
+      def self.find_resource_from_token(resource_class)
+        resource_id = @decoded_token[:"#{@resource_name}_id"]
+        return if resource_id.blank?
+
+        resource_class.find_by(id: resource_id)
+      end
+
+      def self.current_resource
+        return unless respond_to?("current_#{@resource_name}")
+
+        public_send("current_#{@resource_name}")
+      end
     end
   end
 end

data/lib/api_guard/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ApiGuard
-  VERSION = '0.5.5'
+  VERSION = '0.5.6'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: api_guard_grape
 version: !ruby/object:Gem::Version
-  version: 0.5.5
+  version: 0.5.6
 platform: ruby
 authors:
 - Prateek Singh