authify-api 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1ad42a62cd052be494876ad2448c87fadc49d779
-  data.tar.gz: 63e6a369a12ea65833c62330d6f1df2a25ed1473
+  metadata.gz: 3fca257750d3b6838d69bf82accc2509efedec36
+  data.tar.gz: 3e7bffd8e96c2eaa0fac52f0f7cbc7511e0d8a4d
 SHA512:
-  metadata.gz: c17f797d481991ff2237c8c9d16b965670094394609a9b0e20fd1745ca6b84de4610a843ee8010bc999f4815975d0cc12aeb678966232f8fc0137b50c2835d80
-  data.tar.gz: 0eb621c92eaa49877952c8b3cf03741056af7084170c05af708ba0d921dbc4f62d741bdddefa5cad85975a4457ba593a494302324abb62478cd20ff470faf31e
+  metadata.gz: 0f6224388bec7ae3b38a11c3447950ef5bec48b9505aaade543c9cd517cb643897189bfc077df39fc19a103ab13276b7edb53756981a800b95a4d3b0d43875fe
+  data.tar.gz: 1169b5cd8efe0660d3ff7fbf533e1dd086dcea7bc30e7824fadcd80dfeeab3c5daff5267b8a669a1ccbcb1077c2763bc59006539c2cdabcecc8e6cd198b2b69f

data/README.md

@@ -22,7 +22,9 @@ Nearly all API endpoints available via Authify implement the [{json:api}](http:/
 * `GET /jwt/key` - Returns Content Type: `application/json`. This endpoint returns a JSON Object with the key `data` whose value is a PEM-encoded ECDSA public key, which should be used to verify the signature made by the Authify service.
 * `GET /jwt/meta` - Returns Content Type: `application/json`. This endpoint returns a JSON Object with the keys `algorithm`, `issuer`, and `expiration` that describe the kind of JWTs produced by this service.
 * `POST /jwt/token` - Returns (and only accepts) Content Type: `application/json`. This endpoint is used to obtain a [JWT](https://en.wikipedia.org/wiki/JSON_Web_Token). This endpoint expects a JSON Object with either the keys `access_key` and `secret_key` _OR_ `email` and `password`. There is no firm requirement to use either pair for any particular purpose, but for scenarios where the credentials may be stored, the `access_key` and `secret_key` may be used since those can easily be revoked if necessary. Upon successful authentication, the endpoint provides a JSON Object with the key `jwt` and a signed JWT. There should be nothing highly sensitive embedded in the JWT. The JWT defaults to expiring every 15 minutes.
-* `POST /registration/signup` - Returns (and only accepts) Content Type: `application/json`. This endpoint is used to signup for an account with Authify. This endpoint expects a JSON Object, requiring the keys `email` and `password`, with `name` and `via` being optional. If `via` is provided, then it must be a JSON Object with the keys `provider` and `uid`, otherwise it will be ignored. The `via` key is used to add an alternate identity (meaning they logged-in through an integration, like Github). This endpoint returns a JSON Object with the keys `id`, `email`, and `jwt` on success.
+* `POST /registration/signup` - Returns (and only accepts) Content Type: `application/json`. This endpoint is used to signup for an account with Authify. This endpoint expects a JSON Object, requiring the keys `email` and `password`, with `name` and `via` being optional. If `via` is provided, then it must be a JSON Object with the keys `provider` and `uid`, otherwise it will be ignored. The `via` key is used to add an alternate identity (meaning they logged-in through an integration, like Github), and is only trusted from trusted delegates (meaning it will be ignored for anonymous calls to this endpoint). This endpoint returns a JSON Object with the keys `id`, `email`, and `verified`, on success. If the user is registered by a trusted delegate *and* `via` options were provided, the users is implicitly trusted and a `jwt` key will also be provided for authentication.
+* `POST /registration/verify` - Returns (and only accepts) Content Type: `application/json`. This endpoint is used to verify a registered user's email address. This endpoint expects a JSON Object, requiring the keys `email`, `password`, and `token`. This endpoint returns a JSON Object with the keys `id`, `email`, `verified`, and `jwt` on success.
+* `POST /registration/forgot_password` - Returns (and only accepts) Content Type: `application/json`. This endpoint serves two related purposes: it is used to trigger resetting a forgotten (or non-existent) password and it is used to actually set the value of a user's password. The difference in which operation is performed is based on the POST data. When provided a JSON Object with only the key `email`, the endpoint sends the user an email with a verification token, returning an empty JSON Object as a result. When provided a JSON Object with the keys `email`, `password`, and `token`, the endpoint verifies that the token matches, then sets the user's password, returning a JSON Object with the keys `id`, `email`, `verified`, and `jwt` on success.
 
 All other endpoints adhere to the {json:api} specification and can be found at the following base paths:
 
@@ -60,7 +62,7 @@ The Authify API services supports the following configuration settings, managed
 
 * `AUTHIFY_DB_URL` - The URL used by [ActiveRecord](http://guides.rubyonrails.org/configuring.html#configuring-a-database) to connect to the database. Currently supports `mysql2://` or `sqlite3://` URLs, though any driver supported by ActiveRecord should work if the required gems are installed. Defaults to `mysql2://root@localhost:3306/authifydb`.
 * `AUTHIFY_PUBKEY_PATH` - The path on the filesystem to the PEM-encoded, public ECDSA key. Defaults to `~/.authify/ssl/public.pem`.
-* `AUTHIFY_PRIVKEY_PATH` - The path on the filesystem to the PEM-encoded, private ECDSA key. Currently, Authify only supports an [ECDSA](https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm) keys. Options include using a `secp521r1` curve and the [SHA-512](https://en.wikipedia.org/wiki/SHA-2) hashing algorithm (called `ES512`), a `secp384r1` curve and the SHA-384 hashing algorithm (called `ES384`), or a `prime256v1` curve and the SHA-256 hashing algorithm (called `ES256`). See `AUTHIFY_JWT_ALGORITHM` below for information on how to configure Authify's algorithm to match the public and private keys you provide. The keys you specify **must** match the ECDSA algortihm and curve used to create them. 
+* `AUTHIFY_PRIVKEY_PATH` - The path on the filesystem to the PEM-encoded, private ECDSA key. Currently, Authify only supports an [ECDSA](https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm) keys. Options include using a `secp521r1` curve and the [SHA-512](https://en.wikipedia.org/wiki/SHA-2) hashing algorithm (called `ES512`), a `secp384r1` curve and the SHA-384 hashing algorithm (called `ES384`), or a `prime256v1` curve and the SHA-256 hashing algorithm (called `ES256`). See `AUTHIFY_JWT_ALGORITHM` below for information on how to configure Authify's algorithm to match the public and private keys you provide. The keys you specify **must** match the ECDSA algortihm and curve used to create them.
 * `AUTHIFY_JWT_ISSUER` - The name of the issuer ([iss field](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields)) used when creating the JWT. This **must** match on any service that verifies the JWT (meaning any service relying on Authify for authentication), and it **must** be the same for all services that integrate with Authify.
 * `AUTHIFY_JWT_ALGORITHM` - The name of the [JWA](https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40) algorithm to use when loading keys and creating or verifying JWT signatures. Valid values are `ES256`, `ES384`, or `ES512`. Defaults to `ES512`. This **must** match the curve and algorithm used to produce the public and private keys found at `AUTHIFY_PUBKEY_PATH` and `AUTHIFY_PRIVKEY_PATH`, respectively. Note that the curves `prime256v1` (also called NIST P-256) used by `ES256` and `secp384r1` (also called NIST P-384) used by `ES384`, while offering a wider range of compatible SSL libraries, are described as unsafe on [SafeCurves](https://safecurves.cr.yp.to/) for several reasons described there.
 * `AUTHIFY_JWT_EXPIRATION` - How long should a JWT be valid (in minutes). Defaults to 15. Too small of a value will mean a lot more requests to the API; too high increases the possibility of viable keys being captured.
@@ -108,10 +110,6 @@ curl \
     "name": "Some User",
     "email": "someuser@mycompany.com",
     "password": "b@d!dea",
-    "via": {
-      "provider": "github",
-      "uid": "1234567"
-    }
   }' \
   https://auth.mycompany.com/registration/signup
 ```
@@ -122,11 +120,37 @@ This will return JSON similar to the following:
 {
   "id": 172,
   "email": "someuser@mycompany.com",
+  "verified": false
+}
+```
+
+As you can see, Authify is stating that while you have registered a user, their email address has not been verified. They should receive an email containing a one-time verification token, valid for an hour. Verify the email by POSTing something similar to:
+
+```shell
+curl \
+  -H 'Content-Type: application/json' \
+  -H 'Accept: application/json' \
+  --data \
+  '{
+    "email": "someuser@mycompany.com",
+    "password": "b@d!dea",
+    "token": "c7994995c89039ab"
+  }' \
+  https://auth.mycompany.com/registration/verify
+```
+
+This will return JSON similar to the following:
+
+```javascript
+{
+  "id": 172,
+  "email": "someuser@mycompany.com",
+  "verified": true,
   "jwt": "eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzUxMiJ9.eyJleHAiOjE0ODY0ODcyODcsImlhdCI6MTQ4NjQ4MzY4NywiaXNzIjoiTXkgQXdlc29tZSBDb21wYW55IEluYy4iLCJzY29wZXMiOlsidXNlcl9hY2Nlc3MiXSwidXNlciI6eyJ1c2VybmFtZSI6ImZvb0BiYXIuY29tIiwidWlkIjoyLCJvcmdhbml6YXRpb25zIjpbXSwiZ3JvdXBzIjpbXX19.AWfPpKX9mP03Djz3-LMneJdEVsXQm_4GOPVCdkfiiBeIR4pVLKTVrNoNdlNgSEkZEeUw1RPsVxpAR7wDgB4cNcYiAP3fNaD8OPyWfOQAV0lTvDUSH3YU39cZAVwvbX9HleOHBLrFGBbui5wSvfi7WZZlH808psiuUAVhBOe7mfrNiHGB"
 }
 ```
 
-You'll need the JWT (found at key `jwt`) for the next step.
+The user is now verified. You'll need the JWT (found at key `jwt`) for the next step.
 
 #### Create an API key set
 
@@ -187,7 +211,7 @@ curl \
   -H 'Accept: application/json' \
   -H 'Content-Type: application/json' \
   --data \
-  '{ 
+  '{
     "access_key": "5f4abd1c6423ef02d1ec42e1cddaf5f8",
     "secret_key": "fb97aa7d4e48f3e4bbb2930161a423fa8308393426c3612940da03f22cf36879"
    }' \

data/Rakefile

@@ -12,7 +12,7 @@ end
 RSpec::Core::RakeTask.new(:spec)
 RuboCop::RakeTask.new(:rubocop)
 
-task default: %i(spec rubocop)
+task default: %i[spec rubocop]
 
 desc 'Start the demo using `rackup`'
 task :start do

data/lib/authify/api/controllers/apikey.rb

@@ -18,7 +18,7 @@ module Authify
           Models::APIKey.all
         end
 
-        show(roles: %i(myself admin)) do
+        show(roles: %i[myself admin]) do
           last_modified resource.updated_at
           next resource, exclude: [:secret_key]
         end
@@ -31,7 +31,7 @@ module Authify
           next key.id, key
         end
 
-        destroy(roles: %i(myself admin)) do
+        destroy(roles: %i[myself admin]) do
           resource.destroy
         end
 
@@ -40,7 +40,7 @@ module Authify
         end
 
         has_one :user do
-          pluck(roles: %i(myself admin)) do
+          pluck(roles: %i[myself admin]) do
             resource.user
           end
         end

data/lib/authify/api/controllers/group.rb

@@ -19,7 +19,7 @@ module Authify
           Models::Group.all
         end
 
-        show(roles: %i(admin owner)) do
+        show(roles: %i[admin owner]) do
           last_modified resource.updated_at
           next resource
         end
@@ -30,7 +30,7 @@ module Authify
           next g
         end
 
-        destroy(roles: %i(admin owner)) do
+        destroy(roles: %i[admin owner]) do
           resource.destroy
         end
 
@@ -39,23 +39,23 @@ module Authify
         end
 
         has_many :users do
-          fetch(roles: %i(admin owner)) do
+          fetch(roles: %i[admin owner]) do
             resource.users
           end
 
-          replace(roles: %i(admin owner)) do |rios|
+          replace(roles: %i[admin owner]) do |rios|
             refs = rios.map { |attrs| Models::User.find(attrs) }
             resource.users = refs
             resource.save
           end
 
-          merge(roles: %i(admin owner)) do |rios|
+          merge(roles: %i[admin owner]) do |rios|
             refs = rios.map { |attrs| Models::User.find(attrs) }
             resource.users << refs
             resource.save
           end
 
-          subtract(roles: %i(admin owner)) do |rios|
+          subtract(roles: %i[admin owner]) do |rios|
             refs = rios.map { |attrs| Models::User.find(attrs) }
             # This only removes the linkage, not the actual users
             resource.users.delete(refs)

data/lib/authify/api/controllers/identity.rb

@@ -14,11 +14,11 @@ module Authify
           end
         end
 
-        index(roles: %i(admin trusted)) do
+        index(roles: %i[admin trusted]) do
           Models::Identity.all
         end
 
-        show(roles: %i(myself admin trusted)) do
+        show(roles: %i[myself admin trusted]) do
           last_modified resource.updated_at
           next resource
         end
@@ -30,7 +30,7 @@ module Authify
           next ident.id, ident
         end
 
-        destroy(roles: %i(myself admin)) do
+        destroy(roles: %i[myself admin]) do
           resource.destroy
         end
 
@@ -39,7 +39,7 @@ module Authify
         end
 
         has_one :user do
-          pluck(roles: %i(myself admin trusted)) do
+          pluck(roles: %i[myself admin trusted]) do
             resource.user
           end
         end

data/lib/authify/api/controllers/organization.rb

@@ -15,7 +15,7 @@ module Authify
           end
 
           def modifiable_fields
-            %i(
+            %i[
               name
               public_email
               gravatar_email
@@ -23,7 +23,7 @@ module Authify
               description
               url
               location
-            )
+            ]
           end
 
           def filtered_attributes(attributes)
@@ -41,7 +41,7 @@ module Authify
           end
         end
 
-        index(roles: %i(admin user)) do
+        index(roles: %i[admin user]) do
           Models::Organization.includes(:users, :groups, :admins)
         end
 
@@ -72,29 +72,29 @@ module Authify
           next o.id, o
         end
 
-        update(roles: %i(owner admin)) do |attrs|
+        update(roles: %i[owner admin]) do |attrs|
           resource.update filtered_attributes(attrs)
           next resource
         end
 
-        destroy(roles: %i(owner admin)) do
+        destroy(roles: %i[owner admin]) do
           resource.destroy
         end
 
         has_many :users do
-          fetch(roles: %i(owner admin member)) do
+          fetch(roles: %i[owner admin member]) do
             resource.users
           end
         end
 
         has_many :admins do
-          fetch(roles: %i(owner admin member)) do
+          fetch(roles: %i[owner admin member]) do
             resource.admins
           end
         end
 
         has_many :groups do
-          fetch(roles: %i(owner admin member)) do
+          fetch(roles: %i[owner admin member]) do
             resource.groups
           end
         end

data/lib/authify/api/controllers/user.rb

@@ -14,7 +14,7 @@ module Authify
           end
 
           def modifiable_fields
-            %i(full_name email).tap do |a|
+            %i[full_name email].tap do |a|
               a << :admin if role.include?(:admin)
             end
           end
@@ -34,11 +34,11 @@ module Authify
           end
         end
 
-        index(roles: %i(user trusted)) do
+        index(roles: %i[user trusted]) do
           Models::User.all
         end
 
-        show(roles: %i(user trusted)) do
+        show(roles: %i[user trusted]) do
           last_modified resource.updated_at
           next resource
         end
@@ -49,7 +49,7 @@ module Authify
           next user
         end
 
-        update(roles: %i(admin myself)) do |attrs|
+        update(roles: %i[admin myself]) do |attrs|
           # Necessary because #password= is overridden for Models::User
           new_pass = attrs[:password] if attrs && attrs.key?(:password)
           resource.update filtered_attributes(attrs)
@@ -63,16 +63,16 @@ module Authify
         end
 
         has_many :apikeys do
-          fetch(roles: %i(myself admin)) do
+          fetch(roles: %i[myself admin]) do
             resource.apikeys
           end
 
-          clear(roles: %i(myself admin)) do
+          clear(roles: %i[myself admin]) do
             resource.apikeys.destroy_all
             resource.save
           end
 
-          subtract(roles: %i(myself admin)) do |rios|
+          subtract(roles: %i[myself admin]) do |rios|
             refs = rios.map { |attrs| Models::APIKey.find(attrs) }
             # This actually calls #destroy on the keys (we don't need orphaned keys)
             resource.apikeys.destroy(refs)
@@ -81,11 +81,11 @@ module Authify
         end
 
         has_many :identities do
-          fetch(roles: %i(myself admin trusted)) do
+          fetch(roles: %i[myself admin trusted]) do
             resource.identities
           end
 
-          clear(roles: %i(myself admin)) do
+          clear(roles: %i[myself admin]) do
             resource.identities.destroy_all
             resource.save
           end
@@ -96,7 +96,7 @@ module Authify
             resource.save
           end
 
-          subtract(roles: %i(myself admin)) do |rios|
+          subtract(roles: %i[myself admin]) do |rios|
             refs = rios.map { |attrs| Models::Identity.find(attrs) }
             resource.identities.destroy(refs)
             resource.save
@@ -104,13 +104,13 @@ module Authify
         end
 
         has_many :organizations do
-          fetch(roles: %i(user myself admin)) do
+          fetch(roles: %i[user myself admin]) do
             resource.organizations
           end
         end
 
         has_many :groups do
-          fetch(roles: %i(myself admin)) do
+          fetch(roles: %i[myself admin]) do
             resource.groups
           end
         end

data/lib/authify/api/services/jwt_provider.rb

@@ -12,11 +12,11 @@ module Authify
         before '*' do
           content_type 'application/json'
           headers 'Access-Control-Allow-Origin' => '*',
-                  'Access-Control-Allow-Methods' => %w(
+                  'Access-Control-Allow-Methods' => %w[
                     OPTIONS
                     GET
                     POST
-                  )
+                  ]
 
           begin
             unless request.get? || request.options?

data/lib/authify/api/services/registration.rb

@@ -12,11 +12,11 @@ module Authify
         before '*' do
           content_type 'application/json'
           headers 'Access-Control-Allow-Origin' => '*',
-                  'Access-Control-Allow-Methods' => %w(
+                  'Access-Control-Allow-Methods' => %w[
                     OPTIONS
                     GET
                     POST
-                  )
+                  ]
 
           begin
             unless request.get? || request.options?
@@ -63,6 +63,31 @@ module Authify
           response.to_json
         end
 
+        post '/forgot_password' do
+          email = @parsed_body[:email]
+          token = @parsed_body[:token]
+          halt(200, '{}') unless Models::User.exists?(email: email)
+          halt(403, 'Missing Parameters') unless email
+
+          found_user = Models::User.find_by_email(email)
+          if token && @parsed_body[:password] && found_user.verify(token)
+            found_user.verified = true
+            found_user.password = @parsed_body[:password]
+            found_user.save
+            {
+              id: found_user.id,
+              email: found_user.email,
+              verified: found_user.verified?,
+              jwt: jwt_token(found_user)
+            }.to_json
+          else
+            found_user.verified = false
+            found_user.set_verification_token!
+            found_user.save
+            halt(200, '{}')
+          end
+        end
+
         post '/verify' do
           email = @parsed_body[:email]
           password = @parsed_body[:password]

data/lib/authify/api/version.rb

@@ -2,7 +2,7 @@ module Authify
   module API
     VERSION = [
       0, # Major
-      2, # Minor
+      3, # Minor
       0  # Patch
     ].join('.')
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authify-api
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Jonathan Gnagy
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-03-29 00:00:00.000000000 Z
+date: 2017-04-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: authify-core