aptible-auth 0.11.3 → 0.11.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 93d75943842f3e5ed625c2da64dc0c7ee83ffd69
-  data.tar.gz: 84e6d466d82a90fb85060294a5b93f1a9702925d
+  metadata.gz: f84b4c267178de22880242466b3cf1094be20fb6
+  data.tar.gz: f77b05461a7db6598902a9bdfbb8140691e493b9
 SHA512:
-  metadata.gz: 73d27eeac4954a579d97e8148f23f1a96316825e7b95c6641870db5296b6a5bdbf789e0ff12a587fc3e7cb0536c6a4d457ca2fb8a58b15f9e7950f47657a8a86
-  data.tar.gz: bd1bf9f3fd30a2d2196807507a754c9183d85a9fc0f6cdf424f465caf837b30958e13a6793fc7fcf94b5dc0fa28024fb98361e2f4ccac5b878624c6eb40a8412
+  metadata.gz: 8a373677f9e0aadfae4220f181ceb31eea72ad3b756960bdf56b2e6039ee99156470101b4f256dca089345d13dbabdc0cc9e9e0c052d8074adbbdc4be83572d5
+  data.tar.gz: 2a187d5ad9ded64e5d2a0689c43bf49f429230eff390425af7136507172edab58ef129b4bb3a679e96ebad851838c3fc6138b6fbecf2383418769dbd2175cc33

data/lib/aptible/auth/token.rb

@@ -3,44 +3,70 @@ require 'oauth2'
 module Aptible
   module Auth
     class Token < Resource
-      attr_accessor :access_token, :refresh_token, :expires_at
+      # Unlike other resources, tokens aren't created in a REST fashion.
+      # Instead, they're created via OAuth grants. This means we need to
+      # override the way HyperResource / aptible-resource normally do things
+      # and plug in an OAuth library.
+      #
+      # To do so, we take control of the creation arguments and feed them into
+      # the OAuth2 library (in Token.create!), and then feed the response back
+      # to HyperResource (in Token#apply_oauth_response).
+      belongs_to :user
+      belongs_to :actor
+
+      field :access_token
+      field :refresh_token
+      field :expires_at
 
       def self.create(options)
+        # For backwards compatibility: we used to throw in .create (which isn't
+        # consistent with other resources), and we probably need to continue
+        # doing this. We also need to continue throwing a OAuth2::Error.
         token = new
         token.process_options(options)
         token
       end
 
+      def self.create!(options)
+        Token.create(options)
+      rescue OAuth2::Error => e
+        # Rethrow OAuth2::Error as HyperResource::ResponseError for
+        # aptible-resource to handle
+        raise HyperResource::ResponseError.new(e.code, response: e.response,
+                                                       cause: e)
+      end
+
       def authenticate_user(email, password, options = {})
         options[:scope] ||= 'manage'
-        response = oauth.password.get_token(email, password, options)
-        parse_oauth_response(response)
+        oauth_token = oauth.password.get_token(email, password, options)
+        apply_oauth_response(oauth_token)
       end
 
       def authenticate_client(id, secret, subject, options = {})
         options[:scope] ||= 'manage'
-        response = oauth.assertion.get_token({
+        oauth_token = oauth.assertion.get_token({
           iss: id,
           sub: subject
         }.merge(signing_params_from_secret(secret).merge(options)))
-        parse_oauth_response(response)
+        apply_oauth_response(oauth_token)
       end
 
       def authenticate_impersonate(subject_token, subject_token_type, options)
         # TODO: This duplicates aptible-resource, is it worth extracting?
-        token = case token = options.delete(:token)
-                when Aptible::Resource::Base then token.access_token
-                when Fridge::AccessToken then token.to_s
-                when String then token
-                else bearer_token
-                end
+        actor_token = \
+          case actor_token = options.delete(:token)
+          when Aptible::Resource::Base then actor_token.access_token
+          when Fridge::AccessToken then actor_token.to_s
+          when String then actor_token
+          else bearer_token
+          end
 
         # TODO: Do we want to check whether the token is non-nil at this stage?
         options[:scope] ||= 'manage'
-        response = oauth.token_exchange.get_token(
-          token, 'urn:ietf:params:oauth:token-type:jwt',
+        oauth_token = oauth.token_exchange.get_token(
+          actor_token, 'urn:ietf:params:oauth:token-type:jwt',
           subject_token, subject_token_type, options)
-        parse_oauth_response(response)
+        apply_oauth_response(oauth_token)
       end
 
       def oauth
@@ -68,12 +94,34 @@ module Aptible
         end
       end
 
+      def token
+        # If the user set an arbitrary token, then we'll return that one,
+        # otherwise we'll fall back to the Token itself, which makes it
+        # possible to create a token and immediately access it #user or #actor
+        # methods.
+        # NOTE: Setting the token after the fact probably doesn't work anyway,
+        # since the Authorization header won't be updated.
+        @token || access_token
+      end
+
+      def expires_at
+        # The Auth API returns the expiry as a timestamp (i.e. an Integer), but
+        # our API client knows only to handle times as strings. This overrides
+        # the field method for expires_at to return a Time despite the
+        # underlying API field being an Integer.
+        Time.at(attributes[:expires_at])
+      end
+
       private
 
-      def parse_oauth_response(response)
-        @access_token = response.token
-        @refresh_token = response.refresh_token
-        @expires_at = Time.at(response.expires_at)
+      def apply_oauth_response(oauth_token)
+        # apply() + loaded is what HyperResource normally does after
+        # deserializing a response back from the API. On top of that, we need
+        # to set the Authorization header so that the token can be used to make
+        # further API requests (e.g. accessing token#user or token#actor).
+        adapter.apply(oauth_token.to_hash, self)
+        self.loaded = true
+        headers['Authorization'] = "Bearer #{bearer_token}"
         self
       end
 

data/lib/aptible/auth/version.rb

@@ -1,5 +1,5 @@
 module Aptible
   module Auth
-    VERSION = '0.11.3'
+    VERSION = '0.11.5'
   end
 end

data/spec/aptible/auth/token_spec.rb

@@ -5,9 +5,16 @@ describe Aptible::Auth::Token do
   let(:response) { double OAuth2::AccessToken }
 
   before { subject.stub(:oauth) { oauth } }
-  before { response.stub(:token) }
-  before { response.stub(:refresh_token) }
-  before { response.stub(:expires_at) { Time.now.to_i } }
+  let(:expires_at) { Time.now - Random.rand(1000) }
+  before do
+    response.stub(:to_hash) do
+      {
+        access_token: 'access_token',
+        refresh_token: nil,
+        expires_at: expires_at.to_i
+      }
+    end
+  end
 
   describe '.create' do
     it 'should call #authenticate_user if passed :email and :password' do
@@ -60,10 +67,20 @@ describe Aptible::Auth::Token do
     end
 
     it 'should set the access_token' do
-      oauth.stub_chain(:password, :get_token, :token) { 'access_token' }
       subject.authenticate_user(*args)
       expect(subject.access_token).to eq 'access_token'
     end
+
+    it 'should set the Authorization header' do
+      subject.authenticate_user(*args)
+      expect(subject.headers['Authorization']).to eq 'Bearer access_token'
+    end
+
+    it 'should set the expires_at property' do
+      subject.authenticate_user(*args)
+      expect(subject.expires_at).to be_a Time
+      expect(subject.expires_at.to_i).to eq expires_at.to_i
+    end
   end
 
   describe '#authenticate_client' do
@@ -96,10 +113,29 @@ describe Aptible::Auth::Token do
     end
 
     it 'should set the access_token' do
-      oauth.stub_chain(:assertion, :get_token, :token) { 'access_token' }
       subject.authenticate_client(*args)
       expect(subject.access_token).to eq 'access_token'
     end
+
+    it 'should set the Authorization header' do
+      subject.authenticate_client(*args)
+      expect(subject.headers['Authorization']).to eq 'Bearer access_token'
+    end
+  end
+
+  describe '#authenticate_impersonate' do
+    let(:args) { ['foo@bar.com', 'aptible:user:email', {}] }
+    before { oauth.stub_chain(:token_exchange, :get_token) { response } }
+
+    it 'should set the access_token' do
+      subject.authenticate_impersonate(*args)
+      expect(subject.access_token).to eq 'access_token'
+    end
+
+    it 'should set the Authorization header' do
+      subject.authenticate_impersonate(*args)
+      expect(subject.headers['Authorization']).to eq 'Bearer access_token'
+    end
   end
 
   describe '#signing_params_from_secret' do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aptible-auth
 version: !ruby/object:Gem::Version
-  version: 0.11.3
+  version: 0.11.5
 platform: ruby
 authors:
 - Frank Macreery
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-05-06 00:00:00.000000000 Z
+date: 2016-06-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aptible-billing