bookingsync-engine 4.0.1 → 6.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 1e682837dca15bd556e399c58a64744e5779aea9
-  data.tar.gz: 8ed995c29acdda9688394ff1b74d9c7162d60b8d
+SHA256:
+  metadata.gz: 76d677891a37b6bf242cc2ecdccac253d00e74d980c4c674f1e4e258a23c27aa
+  data.tar.gz: 6bbe344b51c76817b5f91e5db0196a8ff651a8ed668c15e8c24f809357fe7568
 SHA512:
-  metadata.gz: 2011800c2f0f947f871695ed2e5c8685e6b9cf1a8086ab098fbe7b77a8aca374086a8a07481f66a39954392dba96769afe045bdd59c21801fc5604d70d18823b
-  data.tar.gz: d9d6d2170c82c3c22e2751830af0acad3b30b347246c7ca9117506f993cbee03f37b9178010387c9b2ceff20aad070a2a39d5bfea6f6c3a3c9f1ce1f699b8276
+  metadata.gz: 0105eb59ada39b9121ad1aad63e72f7c8f9d1d717ef9cfa85ad5189b9aedf06aa61bc165265289ca55e783546ce2713f720fe26d900116b3cbe5f9d84a921587
+  data.tar.gz: 850bbffb9e6233f2c15009073a463ecfed670bb46db08a5b62afd5abdd8dcb5df0eee57f580872a1603cc84f897dcd4997d2d7e09c8361b384d63a2535b54640

data/app/views/sessions/failure.html.erb

@@ -2,4 +2,6 @@
 
 <p>Error: <%= @error_message %></p>
 
-<a href="/auth/bookingsync">Sign in again</a>
+<%= form_tag("/auth/bookingsync", method: :post) do %>
+  <button type="submit">Sign in again</button>
+<% end %>

data/lib/bookingsync-engine.rb

@@ -1,5 +1,3 @@
-require "bookingsync"
-
 module BookingSyncEngine
   cattr_accessor :support_multi_applications
   self.support_multi_applications = false
@@ -10,6 +8,15 @@ module BookingSyncEngine
   cattr_accessor :multi_app_model
   self.multi_app_model = -> { ::Account }
 
+  cattr_accessor :oauth_client_connection_options
+  self.oauth_client_connection_options = { request: { timeout: 2 } }
+
+  cattr_accessor :token_refresh_timeout_retry_count
+  self.token_refresh_timeout_retry_count = 2
+
+  cattr_accessor :bookingsync_id_key
+  self.bookingsync_id_key = :synced_id
+
   def self.setup
     yield self
   end
@@ -22,3 +29,5 @@ module BookingSyncEngine
     support_multi_applications? ? multi_app_model.call : single_app_model.call
   end
 end
+
+require "bookingsync"

data/lib/bookingsync/engine.rb

@@ -7,8 +7,8 @@ module BookingSync
     initializer "bookingsync.add_omniauth" do |app|
       app.middleware.use OmniAuth::Builder do
         provider :bookingsync,
-          BookingSyncEngine.support_multi_applications? ? nil : ENV["BOOKINGSYNC_APP_ID"],
-          BookingSyncEngine.support_multi_applications? ? nil : ENV["BOOKINGSYNC_APP_SECRET"],
+          ::BookingSyncEngine.support_multi_applications? ? nil : ENV["BOOKINGSYNC_APP_ID"],
+          ::BookingSyncEngine.support_multi_applications? ? nil : ENV["BOOKINGSYNC_APP_SECRET"],
           scope: ENV["BOOKINGSYNC_SCOPE"],
           setup: -> (env) {
             if url = ENV["BOOKINGSYNC_URL"]
@@ -18,7 +18,7 @@ module BookingSync
               verify: ENV["BOOKINGSYNC_VERIFY_SSL"] != "false"
             }
 
-            if BookingSyncEngine.support_multi_applications?
+            if ::BookingSyncEngine.support_multi_applications?
               credentials = BookingSync::Engine::CredentialsResolver.new(env["HTTP_HOST"]).call
               if credentials.valid?
                 env["omniauth.strategy"].options[:client_id] = credentials.client_id
@@ -76,16 +76,24 @@ module BookingSync
     #
     # @return [OAuth2::Client] configured OAuth client
     def self.oauth_client(client_id: ENV["BOOKINGSYNC_APP_ID"], client_secret: ENV["BOOKINGSYNC_APP_SECRET"])
+      connection_options = {
+        headers: { accept: "application/vnd.api+json" }
+      }.merge(::BookingSyncEngine.oauth_client_connection_options)
+
       client_options = {
         site: ENV["BOOKINGSYNC_URL"] || 'https://www.bookingsync.com',
-        connection_opts: { headers: { accept: "application/vnd.api+json" } }
+        connection_opts: connection_options
       }
       client_options[:ssl] = { verify: ENV['BOOKINGSYNC_VERIFY_SSL'] != 'false' }
       OAuth2::Client.new(client_id, client_secret, client_options)
     end
 
     def self.application_token(client_id: ENV["BOOKINGSYNC_APP_ID"], client_secret: ENV["BOOKINGSYNC_APP_SECRET"])
-      oauth_client(client_id: client_id, client_secret: client_secret).client_credentials.get_token
+      token_refresh_timeout_attempts_allowed = ::BookingSyncEngine.token_refresh_timeout_retry_count + 1
+
+      BookingSync::Engine::Retryable.perform(times: token_refresh_timeout_attempts_allowed, errors: [Faraday::TimeoutError]) do
+        oauth_client(client_id: client_id, client_secret: client_secret).client_credentials.get_token
+      end
     end
   end
 end
@@ -94,3 +102,4 @@ require "bookingsync/engine/application_credentials"
 require "bookingsync/engine/credentials_resolver"
 require "bookingsync/engine/api_client"
 require "bookingsync/engine/models"
+require "bookingsync/engine/retryable"

data/lib/bookingsync/engine/auth_helpers.rb

@@ -1,3 +1,5 @@
+require "repost"
+
 module BookingSync::Engine::AuthHelpers
   extend ActiveSupport::Concern
 
@@ -16,7 +18,7 @@ module BookingSync::Engine::AuthHelpers
     return if session[:account_id].nil?
 
     @current_account ||=
-      BookingSyncEngine.account_model.find_by_host_and_synced_id(request.host, session[:account_id])
+      ::BookingSyncEngine.account_model.find_by_host_and_bookingsync_id_key(request.host, session[:account_id])
   end
 
   # Callback after account is authorized.
@@ -25,7 +27,7 @@ module BookingSync::Engine::AuthHelpers
   #
   # @param account [Account] the just authorized account
   def account_authorized(account)
-    session[:account_id] = account.synced_id.to_s
+    session[:account_id] = account.public_send(BookingSyncEngine.bookingsync_id_key).to_s
   end
 
   # Clear authorization if the account passed from the BookingSync app store
@@ -58,20 +60,32 @@ module BookingSync::Engine::AuthHelpers
 
   # Request a new authorization.
   def request_authorization!
-    if request.xhr?
-      request_authorization_for_xhr!
-    elsif BookingSync::Engine.embedded
-      request_authorization_for_embedded!
-    else
-      request_authorization_for_standalone!
+    respond_to do |format|
+      format.html do
+        if request.xhr?
+          request_authorization_for_xhr!
+        elsif BookingSync::Engine.embedded
+          request_authorization_for_embedded!
+        else
+          request_authorization_for_standalone!
+        end
+      end
+
+      format.json do
+        head :unauthorized
+      end
+
+      format.api_json do
+        head :unauthorized
+      end
     end
   end
 
   # Request a new authorization for Ajax requests.
   #
-  # Renders the new authorization path with 401 Unauthorized status by default.
+  # Renders the new auto submit form with 401 Unauthorized status by default.
   def request_authorization_for_xhr!
-    render plain: new_authorization_url, status: :unauthorized
+    render html: auto_submit_form_html, status: :unauthorized
   end
 
   # Request a new authorization for Embedded Apps.
@@ -79,23 +93,23 @@ module BookingSync::Engine::AuthHelpers
   # Load the new authorization path using Javascript by default.
   def request_authorization_for_embedded!
     allow_bookingsync_iframe
-    render html: ("<script type='text/javascript'>top.location.href = " +
-      "'#{new_authorization_path}';</script>").html_safe
+    render html: auto_submit_form_html
   end
 
   # Request a new authorization for Standalone Apps.
   #
   # Redirects to new authorization path by default.
   def request_authorization_for_standalone!
-    redirect_to new_authorization_path
+    render html: auto_submit_form_html
   end
 
-  # Path to which the user should be redirected to start a new
+  # Path which will be used in POST request to start a new
   # Authorization process.
   #
-  # Default to /auth/bookingsync/?account_id=SESSION_BOOKINGSYNC_ACCOUNT_ID
+  # Default to /auth/bookingsync
+  NEW_AUTHORIZATION_URL = "/auth/bookingsync".freeze
   def new_authorization_path
-    "/auth/bookingsync/?account_id=#{session[:_bookingsync_account_id]}"
+    NEW_AUTHORIZATION_URL
   end
 
   def new_authorization_url
@@ -141,4 +155,12 @@ module BookingSync::Engine::AuthHelpers
   def store_bookingsync_account_id # :nodoc:
     session[:_bookingsync_account_id] = params.delete(:_bookingsync_account_id)
   end
+
+  def auto_submit_form_html
+    Repost::Senpai.perform(
+      new_authorization_path,
+      params: { account_id: session[:_bookingsync_account_id] },
+      options: { authenticity_token: Rack::Protection::AuthenticityToken.token(session) }
+    ).html_safe
+  end
 end

data/lib/bookingsync/engine/models/account.rb

@@ -3,12 +3,12 @@ module BookingSync::Engine::Models::Account
   include BookingSync::Engine::Models::BaseAccount
 
   included do
-    validates :synced_id, uniqueness: true
+    validates BookingSyncEngine.bookingsync_id_key, uniqueness: true
   end
 
   module ClassMethods
     def from_omniauth(auth, _host)
-      account = find_or_initialize_by(synced_id: auth.uid, provider: auth.provider)
+      account = find_or_initialize_by(BookingSyncEngine.bookingsync_id_key => auth.uid, provider: auth.provider)
 
       account.tap do |account|
         account.name = auth.info.business_name
@@ -17,8 +17,14 @@ module BookingSync::Engine::Models::Account
       end
     end
 
+    def find_by_host_and_bookingsync_id_key(_host, bookingsync_id)
+      find_by(BookingSyncEngine.bookingsync_id_key => bookingsync_id)
+    end
+
+    # DEPRECATED: Please use find_by_host_and_bookingsync_id_key instead.
     def find_by_host_and_synced_id(_host, synced_id)
-      find_by(synced_id: synced_id)
+      warn("DEPRECATED: find_by_host_and_synced_id is deprecated, use #find_by_host_and_bookingsync_id_key instead. It will be removed with the release of version 6 of this gem. Called from #{Gem.location_of_caller.join(":")}")
+      find_by_host_and_bookingsync_id_key(nil, synced_id)
     end
   end
 

data/lib/bookingsync/engine/models/base_account.rb

@@ -10,7 +10,7 @@ module BookingSync::Engine::Models::BaseAccount
       token_options = {}
       if oauth_refresh_token
         token_options[:refresh_token] = oauth_refresh_token
-        token_options[:expires_at]    = oauth_expires_at
+        token_options[:expires_at]    = oauth_expires_at && oauth_expires_at.to_i
       end
 
       token = OAuth2::AccessToken.new(oauth_client, oauth_access_token, token_options)
@@ -40,12 +40,14 @@ module BookingSync::Engine::Models::BaseAccount
     self.oauth_expires_at     = token.expires_at
   end
 
-  private
-
   def refresh_token!(current_token = token)
-    @token = current_token.refresh!.tap do |new_token|
-      update_token(new_token)
-      save!
+    token_refresh_timeout_attempts_allowed = ::BookingSyncEngine.token_refresh_timeout_retry_count + 1
+
+    BookingSync::Engine::Retryable.perform(times: token_refresh_timeout_attempts_allowed, errors: [Faraday::TimeoutError]) do
+      @token = current_token.refresh!.tap do |new_token|
+        update_token(new_token)
+        save!
+      end
     end
   end
 end

data/lib/bookingsync/engine/models/multi_applications_account.rb

@@ -3,7 +3,7 @@ module BookingSync::Engine::Models::MultiApplicationsAccount
   include BookingSync::Engine::Models::BaseAccount
 
   included do
-    validates :synced_id, uniqueness: { scope: :host }
+    validates BookingSyncEngine.bookingsync_id_key, uniqueness: { scope: :host }
   end
 
   module ClassMethods
@@ -13,7 +13,7 @@ module BookingSync::Engine::Models::MultiApplicationsAccount
                              "multi application support"
       end
 
-      account = find_or_initialize_by(host: host, synced_id: auth.uid, provider: auth.provider)
+      account = find_or_initialize_by(host: host, provider: auth.provider, BookingSyncEngine.bookingsync_id_key => auth.uid)
 
       account.tap do |account|
         account.name = auth.info.business_name
@@ -22,8 +22,14 @@ module BookingSync::Engine::Models::MultiApplicationsAccount
       end
     end
 
+    def find_by_host_and_bookingsync_id_key(host, bookingsync_id)
+      find_by(host: host, BookingSyncEngine.bookingsync_id_key => bookingsync_id)
+    end
+
+    # DEPRECATED: Please use find_by_host_and_bookingsync_id_key instead.
     def find_by_host_and_synced_id(host, synced_id)
-      find_by(host: host, synced_id: synced_id)
+      warn("DEPRECATED: find_by_host_and_synced_id is deprecated, use #find_by_host_and_bookingsync_id_key instead. It will be removed with the release of version 5 of this gem. Called from #{Gem.location_of_caller.join(":")}")
+      find_by_host_and_bookingsync_id_key(host, synced_id)
     end
   end
 

data/lib/bookingsync/engine/retryable.rb

@@ -0,0 +1,16 @@
+class BookingSync::Engine::Retryable
+  def self.perform(times:, errors:, before_retry: ->(_error) {})
+    executed = 0
+    begin
+      executed += 1
+      yield
+    rescue *errors => error
+      if executed < times
+        before_retry.call(error)
+        retry
+      else
+        raise error
+      end
+    end
+  end
+end

data/lib/bookingsync/engine/version.rb

@@ -1,3 +1,3 @@
 module BookingSync
-  ENGINE_VERSION = "4.0.1"
+  ENGINE_VERSION = "6.0.0"
 end

data/spec/controllers/authenticated_controller_spec.rb

@@ -1,15 +1,19 @@
 require "spec_helper"
 
 RSpec.describe AuthenticatedController, type: :controller do
+  before do
+    Mime::Type.register "application/vnd.api+json", :api_json
+  end
+
   describe "GET index" do
     context "when engine is embedded" do
       before { BookingSync::Engine.embedded! }
 
-      it "redirects to auth using js" do
+      it "renders autosubmitted form" do
         get :index
         expect(response.status).to eq(200)
-        expect(response.body).to eq(
-          "<script type='text/javascript'>top.location.href = '/auth/bookingsync/?account_id=';</script>")
+        expect(response.body).to include("action='/auth/bookingsync' method='post'")
+        expect(response.body).to include("<input type='hidden' name='account_id' value=''>")
         expect(response.header["Content-Type"]).to include("text/html")
       end
     end
@@ -17,12 +21,11 @@ RSpec.describe AuthenticatedController, type: :controller do
     context "when engine is standalone" do
       before { BookingSync::Engine.standalone! }
 
-      it "redirects to auth using 302 redirect" do
+      it "renders autosubmitted form" do
         get :index
-        expect(response.status).to eq(302)
-        expect(response.redirect_url).to eq("http://test.host/auth/bookingsync/?account_id=")
-        expect(response.body).to eq(
-          "<html><body>You are being <a href=\"http://test.host/auth/bookingsync/?account_id=\">redirected</a>.</body></html>")
+        expect(response.status).to eq(200)
+        expect(response.body).to include("action='/auth/bookingsync' method='post'")
+        expect(response.body).to include("<input type='hidden' name='account_id' value=''>")
       end
     end
   end
@@ -31,20 +34,41 @@ RSpec.describe AuthenticatedController, type: :controller do
     context "when engine is embedded" do
       before { BookingSync::Engine.embedded! }
 
-      it "renders the target url in response" do
+      it "renders autosubmitted form" do
         get :index, xhr: true
         expect(response.status).to eq(401)
-        expect(response.body).to eq("http://test.host/auth/bookingsync/?account_id=")
+        expect(response.body).to include("action='/auth/bookingsync' method='post'")
+        expect(response.body).to include("<input type='hidden' name='account_id' value=''>")
       end
     end
 
     context "when engine is standalone" do
       before { BookingSync::Engine.standalone! }
 
-      it "renders the target url in response" do
+      it "renders autosubmitted form" do
         get :index, xhr: true
         expect(response.status).to eq(401)
-        expect(response.body).to eq("http://test.host/auth/bookingsync/?account_id=")
+        expect(response.body).to include("action='/auth/bookingsync' method='post'")
+        expect(response.body).to include("<input type='hidden' name='account_id' value=''>")
+      end
+    end
+  end
+
+  describe "API request" do
+    it "returns 401 without response body" do
+      get :index, format: :json
+      expect(response.status).to eq(401)
+      expect(response.body).to eq("")
+    end
+
+    context "with vnd.api+json content type" do
+      it "returns 401 without response body" do
+        request.headers["CONTENT_TYPE"] = "application/vnd.api+json"
+        request.headers["ACCEPT"] = "application/vnd.api+json"
+
+        get :index
+        expect(response.status).to eq(401)
+        expect(response.body).to eq("")
       end
     end
   end

data/spec/dummy/app/assets/config/manifest.js

@@ -0,0 +1,3 @@
+//= link_tree ../images
+//= link_directory ../javascripts .js
+//= link_directory ../stylesheets .css

data/spec/dummy/config/initializers/bookingsync-engine.rb

@@ -1,3 +1,11 @@
+# temporarily change default to make sure initializer override works great
+BookingSyncEngine.module_eval do
+  self.bookingsync_id_key = :customized_key
+end
+
+# and now override to fix breaking specs
 BookingSyncEngine.setup do |setup|
   setup.multi_app_model = -> { ::MultiApplicationsAccount }
+
+  setup.bookingsync_id_key = :synced_id
 end

data/spec/dummy/db/migrate/20190623220013_add_custom_booking_sync_key_id_to_accounts.rb

@@ -0,0 +1,5 @@
+class AddCustomBookingSyncKeyIdToAccounts < ActiveRecord::Migration[5.2]
+  def change
+    add_column :accounts, :customized_key, :integer
+  end
+end

data/spec/dummy/db/migrate/20190623220132_add_custom_booking_sync_key_id_to_multi_applications_accounts.rb

@@ -0,0 +1,5 @@
+class AddCustomBookingSyncKeyIdToMultiApplicationsAccounts < ActiveRecord::Migration[5.2]
+  def change
+    add_column :multi_applications_accounts, :customized_key, :integer
+  end
+end

data/spec/dummy/db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2018_11_30_063104) do
+ActiveRecord::Schema.define(version: 2019_06_23_220132) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -24,6 +24,7 @@ ActiveRecord::Schema.define(version: 2018_11_30_063104) do
     t.string "oauth_access_token"
     t.string "oauth_refresh_token"
     t.string "oauth_expires_at"
+    t.integer "customized_key"
     t.index ["synced_id"], name: "index_accounts_on_synced_id"
   end
 
@@ -48,6 +49,7 @@ ActiveRecord::Schema.define(version: 2018_11_30_063104) do
     t.string "oauth_refresh_token"
     t.string "oauth_expires_at"
     t.string "host", null: false
+    t.integer "customized_key"
     t.index ["host", "synced_id"], name: "index_multi_applications_accounts_on_host_and_synced_id", unique: true
     t.index ["host"], name: "index_multi_applications_accounts_on_host"
     t.index ["synced_id"], name: "index_multi_applications_accounts_on_synced_id"