authify-api 0.0.6 → 0.1.0

data/lib/authify/api/controllers/identity.rb

@@ -0,0 +1,49 @@
+module Authify
+  module API
+    module Controllers
+      Identity = proc do
+        helpers do
+          def find(id)
+            Models::Identity.find(id.to_i)
+          end
+
+          def role
+            Array(super).tap do |a|
+              a << :myself if current_user && current_user.identities.include?(resource)
+            end.uniq
+          end
+        end
+
+        index(roles: [:admin, :trusted]) do
+          Models::Identity.all
+        end
+
+        show(roles: [:myself, :admin, :trusted]) do
+          last_modified resource.updated_at
+          next resource
+        end
+
+        create(roles: [:user]) do |attributes|
+          ident = Models::Identity.new attributes
+          current_user.identities << ident
+          current_user.save
+          next ident.id, ident
+        end
+
+        destroy(roles: [:myself, :admin]) do
+          resource.destroy
+        end
+
+        show_many do |ids|
+          Models::Identity.find(ids)
+        end
+
+        has_one :user do
+          pluck(roles: [:myself, :admin, :trusted]) do
+            resource.user
+          end
+        end
+      end
+    end
+  end
+end

data/lib/authify/api/controllers/organization.rb

@@ -6,13 +6,51 @@ module Authify
           def find(id)
             Models::Organization.find(id.to_i)
           end
+
+          def role
+            Array(super).tap do |a|
+              a << :owner if resource && current_user.admin_for?(resource)
+              a << :member if resource && resource.users.include?(current_user)
+            end.uniq
+          end
+
+          def modifiable_fields
+            [
+              :name,
+              :public_email,
+              :gravatar_email,
+              :billing_email,
+              :description,
+              :url,
+              :location
+            ]
+          end
+
+          def filtered_attributes(attributes)
+            attributes.select do |k, _v|
+              modifiable_fields.include?(k)
+            end
+          end
+
+          def filter(collection, fields = {})
+            collection.where(fields)
+          end
+
+          def sort(collection, fields = {})
+            collection.order(fields)
+          end
         end
 
-        index do
+        index(roles: [:admin]) do
           Models::Organization.all
         end
 
-        show do
+        get '/mine' do
+          halt(403) unless can?(:create)
+          serialize_models current_user.organizations
+        end
+
+        show(roles: [:user]) do
           last_modified resource.updated_at
           next resource
         end
@@ -21,24 +59,36 @@ module Authify
           Models::Organization.find(ids)
         end
 
-        destroy do
-          resource.destroy if @current_user.admin_for?(resource)
+        create(roles: [:user]) do |attrs|
+          o = Models::Organization.new(attrs)
+          o.admins << current_user
+          o.save
+          next o
+        end
+
+        update(roles: [:owner, :admin]) do |attrs|
+          resource.update filtered_attributes(attrs)
+          next resource
+        end
+
+        destroy(roles: [:owner, :admin]) do
+          resource.destroy
         end
 
         has_many :users do
-          fetch do
+          fetch(roles: [:owner, :admin, :member]) do
             resource.users
           end
         end
 
         has_many :admins do
-          fetch do
+          fetch(roles: [:owner, :admin, :member]) do
             resource.admins
           end
         end
 
         has_many :groups do
-          fetch do
+          fetch(roles: [:owner, :admin]) do
             resource.groups
           end
         end

data/lib/authify/api/controllers/user.rb

@@ -6,63 +6,102 @@ module Authify
           def find(id)
             Models::User.find(id.to_i)
           end
+
+          def role
+            Array(super).tap do |a|
+              a << :myself if current_user && resource && (resource.id == current_user.id)
+            end.uniq
+          end
+
+          def modifiable_fields
+            [:full_name, :email].tap do |a|
+              a << :admin if role.include?(:admin)
+            end
+          end
+
+          def filtered_attributes(attributes)
+            attributes.select do |k, _v|
+              modifiable_fields.include?(k)
+            end
+          end
+
+          def filter(collection, fields = {})
+            collection.where(fields)
+          end
+
+          def sort(collection, fields = {})
+            collection.order(fields)
+          end
         end
 
-        index do
+        index(roles: [:user, :trusted]) do
           Models::User.all
         end
 
-        show do
+        show(roles: [:user, :trusted]) do
           last_modified resource.updated_at
           next resource
         end
 
+        create(roles: [:admin]) do |attributes|
+          user = Models::User.new filtered_attributes(attributes)
+          user.save
+          next user
+        end
+
         show_many do |ids|
           Models::User.find(ids)
         end
 
-        has_many :api_keys do
-          fetch do
-            resource.api_keys
+        has_many :apikeys do
+          fetch(roles: [:myself, :admin]) do
+            resource.apikeys
           end
 
-          clear do
-            resource.api_keys.destroy_all
+          clear(roles: [:myself, :admin]) do
+            resource.apikeys.destroy_all
             resource.save
           end
 
-          subtract do |rios|
-            refs = rios.map { |attrs| Models::APIKey.new(attrs) }
-            resource.api_keys.destroy(refs)
+          subtract(roles: [:myself, :admin]) do |rios|
+            refs = rios.map { |attrs| Models::APIKey.find(attrs) }
+            # This actually calls #destroy on the keys (we don't need orphaned keys)
+            resource.apikeys.destroy(refs)
             resource.save
           end
         end
 
         has_many :identities do
-          fetch do
+          fetch(roles: [:myself, :admin, :trusted]) do
             resource.identities
           end
 
-          clear do
+          clear(roles: [:myself, :admin]) do
             resource.identities.destroy_all
             resource.save
           end
 
-          subtract do |rios|
+          merge(roles: [:myself]) do |rios|
             refs = rios.map { |attrs| Models::Identities.new(attrs) }
+            resource.identities << refs
+            resource.save
+          end
+
+          subtract(roles: [:myself, :admin]) do |rios|
+            refs = rios.map { |attrs| Models::Identities.find(attrs) }
             resource.identities.destroy(refs)
             resource.save
           end
         end
 
         has_many :organizations do
-          fetch do
+          fetch(roles: [:user, :myself]) do
             resource.organizations
           end
         end
 
         has_many :groups do
-          fetch do
+          fetch(roles: [:myself, :admin]) do
             resource.groups
           end
         end

data/lib/authify/api/helpers/api_user.rb

@@ -4,7 +4,16 @@ module Authify
       # Helper methods for API users
       module APIUser
         def current_user
-          @current_user ||= Models::User.find_by_email(env['user']['username'])
+          email = env.key?(:user) ? env[:user]['username'] : nil
+          @current_user ||= email ? Models::User.find_by_email(email) : nil
+        end
+
+        def remote_app
+          @remote_app ||= if processed_headers.key?('x_authify_access')
+                            access = processed_headers['x_authify_access']
+                            secret = processed_headers['x_authify_secret']
+                            Models::TrustedDelegate.from_access_key(access, secret)
+                          end
         end
 
         def update_current_user(user)
@@ -20,6 +29,12 @@ module Authify
           @current_user = found_user
         end
 
+        def processed_headers
+          @headers ||= request.env.dup.each_with_object({}) do |(k, v), acc|
+            acc[Regexp.last_match(1).downcase] = v if k =~ /^http_(.*)/i
+          end
+        end
+
         # This shouldn't work via API calls
         def auth
           {}

data/lib/authify/api/helpers/jwt_encryption.rb

@@ -5,27 +5,40 @@ module Authify
       module JWTEncryption
         include Core::Helpers::JWTSSL
 
-        def jwt_token
-          JWT.encode jwt_payload(current_user), private_key, 'ES512'
+        def jwt_token(user = nil)
+          user ||= current_user
+          JWT.encode jwt_payload(user), private_key, CONFIG[:jwt][:algorithm]
         end
 
         def jwt_payload(user)
           {
-            exp: Time.now.to_i + 60 * 60,
+            exp: Time.now.to_i + 60 * CONFIG[:jwt][:expiration].to_i,
             iat: Time.now.to_i,
             iss: CONFIG[:jwt][:issuer],
-            scopes: Core::Constants::JWTSCOPES,
+            scopes: Core::Constants::JWTSCOPES.dup.tap do |scopes|
+              scopes << :admin_access if current_user && current_user.admin?
+            end,
             user: {
               username: user.email,
               uid: user.id,
-              organizations: user.organizations.map do |o|
-                               { name: o.name, oid: o.id, admin: o.admins.include?(user) }
-                             end,
-              groups: user.groups.map { |g| { name: g.name, gid: g.id } }
+              organizations: simple_orgs_by_user(user)
             }
           }
         end
 
+        def simple_orgs_by_user(user)
+          user.organizations.map do |o|
+            {
+              name: o.name,
+              oid: o.id,
+              admin: o.admins.include?(user),
+              memberships: o.groups.select { |g| g.users.include?(user) }.map do |g|
+                { name: g.name, gid: g.id }
+              end
+            }
+          end
+        end
+
         def with_jwt(req, scope)
           scopes, user = req.env.values_at :scopes, :user
           set_current_user Models::User.from_username(user['username'])

data/lib/authify/api/models/{api_key.rb → apikey.rb}

@@ -3,6 +3,7 @@ module Authify
     module Models
       # Additional, revocable user access
       class APIKey < ActiveRecord::Base
+        self.table_name = 'apikeys'
         include Core::SecureHashing
         extend Core::SecureHashing
         include JSONAPIUtils
@@ -25,12 +26,25 @@ module Authify
           compare_salted_sha512(unencrypted_string, secret_key_digest)
         end
 
+        def set_access!
+          self.access_key = self.class.generate_access_key
+        end
+
         def set_secret!
-          self.secret_key = self.class.generate_access_key + self.class.generate_access_key
+          self.secret_key = self.class.generate_secret_key
+        end
+
+        def populate!
+          set_access!
+          set_secret!
         end
 
         def self.generate_access_key
-          to_hex(SecureRandom.gen_random(32))[0...32]
+          to_hex(SecureRandom.gen_random(32))[0...20]
+        end
+
+        def self.generate_secret_key
+          to_hex(SecureRandom.gen_random(32))[0...32] + to_hex(SecureRandom.gen_random(32))[0...32]
         end
 
         private

data/lib/authify/api/models/user.rb

@@ -11,9 +11,7 @@ module Authify
         validates_uniqueness_of :email
         validates_format_of :email, with: /[-a-z0-9_+\.+]+\@([-a-z0-9]+\.)+[a-z0-9]{2,4}/i
 
-        validates_presence_of :password_digest
-
-        has_many :api_keys,
+        has_many :apikeys,
                  class_name: 'Authify::API::Models::APIKey',
                  dependent: :destroy
 
@@ -44,7 +42,7 @@ module Authify
         end
 
         def admin_for?(organization)
-          organization.admins.include?(self)
+          admin? || organization.admins.include?(self)
         end
 
         def self.from_api_key(access, secret)

data/lib/authify/api/serializers/{api_key_serializer.rb → apikey_serializer.rb}

@@ -5,7 +5,14 @@ module Authify
       class APIKeySerializer
         include JSONAPI::Serializer
 
+        def type
+          'apikeys'
+        end
+
         attribute :access_key
+        attribute :secret_key
+        attribute :created_at
+
         has_one :user
       end
     end

data/lib/authify/api/serializers/group_serializer.rb

@@ -7,6 +7,8 @@ module Authify
 
         attribute :name
         attribute :description
+        attribute :created_at
+
         has_one :organization
         has_many :users
       end

data/lib/authify/api/serializers/identity_serializer.rb

@@ -0,0 +1,14 @@
+module Authify
+  module API
+    module Serializers
+      # JSON API Serializer for Identity model
+      class IdentitySerializer
+        include JSONAPI::Serializer
+
+        attribute :provider
+        attribute :uid
+        has_one :user
+      end
+    end
+  end
+end

data/lib/authify/api/serializers/organization_serializer.rb

@@ -6,9 +6,17 @@ module Authify
         include JSONAPI::Serializer
 
         attribute :name
+        attribute :public_email
+        attribute :gravatar_email
+        attribute :billing_email
         attribute :description
+        attribute :url
+        attribute :location
+        attribute :created_at
+
         has_many :groups
         has_many :users
+        has_many :admins
       end
     end
   end