cadenero 0.0.2.b8 → 0.0.2.b10

checksums.yaml

@@ -1,15 +1,15 @@
 ---
 !binary "U0hBMQ==":
   metadata.gz: !binary |-
-    MjFhZjQ5ZWY0MGI1ZDU0OGYwOTEwNWNjN2ZiZGNkZmUwNzgwMDI5ZA==
+    MWI1NGU5NDk3MjQwNWM2YTQ2ZDY5ZDFhODllNGI1ZGY4YTZhOTFhZg==
   data.tar.gz: !binary |-
-    OTczMTk0ZGE1NTg3ZTUzNzZkOTI5NjE0Y2VkY2Q4NWEwYzJlY2QzMw==
+    OTA4OTBmMGE1MmZlMDU4ZmUzMjZjODZjMmU5NWJiNDZhNjMzNzk2Zg==
 !binary "U0hBNTEy":
   metadata.gz: !binary |-
-    YzY4OTE2NmNjYzcwZGU0ZDdiYzJlZTI4YzcyZDdhNjZjNTQxZWZkNTU2ZGU2
-    YTYzZTg4MDVlYjQ0YWNhNmRmYWQwYjIxMjViZjliZjE5ZWJmMDZlZGQ3ZTE4
-    ZTc4ODMwMmQyZTEyN2JkY2RhMWUwZGUxNzM1YTFhNTAzZTcyMDE=
+    ODAyNTk5ZGY4Njk3MmU2NjY1NDhlZjNjNDUzYzg0NDI1MDlkYjVmZmFjNTlh
+    YWMxMTM4M2Q4NWU0OWExMzJiMjkzMDhlZDQzZmFlMTYxODc5ZjRjOGMwMDBk
+    ZjFiZDlhYTlkYzIwYTJlZmE5ZTEwODcwZDBjZWU3M2JkYTM5ZTM=
   data.tar.gz: !binary |-
-    ZDhkYzE0YTc4OWEyNmZjZDNiM2Y0MGI5Mjk0ZmQwMWY3OTZiNDNhOTg4YTg4
-    MTNjZjNhZGE0MWYwOTA2NTNhN2Y0NGVhNjAwZTk4NTZmZjdhZmIxMmNhY2Vk
-    NTU4OGZkMTQxYWUyYzMwODgxYzhiY2VkMTRjMmNhYTE0OWY5MDc=
+    ODZjYzFjOTc1OWJlN2M2MjZlMDcxY2MwMzRkZWNiODE4YzFlZmQ2NjlkZGU0
+    ZDNkMzA3NGQzNTBjNjRiNmE0Y2Y2MjZkNGY0NDBmZjllOWFhMzVmODY1ZDMx
+    NmE0NmJkZjk0Zjc3YmZmOTdjZDhkMzk0OWJhMGIwMTlmNDliNWY=

data/README.md

@@ -15,7 +15,9 @@ Authentication Engine for Rails.API multitenant RESTful APIs based on Warden. It
 * Is RESTful API
 * Allows you to have multiple roles (or models/scopes) signed in at the same time
 
-## Information
+# Information
+
+## About Cadenero
 
 ### Why Cadenero?
 **"Cadenero"** is the spanish word for ["Bouncer (doorman)"](http://en.wikipedia.org/wiki/Bouncer_(doorman\)). The main function of **Cadenero** is to be a resource for authenticating consumers of the services that the API provides. As the real bouncers, **Cadenero** aims to provide security, check authorized access, to refuse entry for intoxication, aggressive behavior or non-compliance with statutory or establishment rules.
@@ -26,8 +28,8 @@ You can use [Warden](https://github.com/hassox/warden) or [Devise](https://githu
 
 #### Preconditions
 
-##### Postgresql
-You should have a Postgresql server (for downloading see: http://www.postgresql.org/download/). If you are using OSX, you can install using [Homebrew](http://mxcl.github.io/homebrew/) for that you can follow the following this [instructions](http://www.moncefbelyamani.com/how-to-install-postgresql-on-a-mac-with-homebrew-and-lunchy/)
+##### PostgreSQL
+You should have a PostgreSQL server (for downloading see: http://www.postgresql.org/download/). If you are using OSX, you can install using [Homebrew](http://mxcl.github.io/homebrew/) for that you can follow the following this [instructions](http://www.moncefbelyamani.com/how-to-install-postgresql-on-a-mac-with-homebrew-and-lunchy/)
 
 ##### Ruby 1.9.x or 2.x
 For that we recommend that you use [rbenv](https://github.com/sstephenson/rbenv) with [ruby-build](https://github.com/sstephenson/ruby-build) or [rvm](https://rvm.io/)
@@ -49,7 +51,8 @@ Generate first your Rails app as usual using:
 
 In the `Gemfile` add the following lines:
 ```ruby
-    gem 'cadenero', '~> 0.0.2.b8'
+    gem 'cadenero', '~> 0.0.2.b10'
+    gem "strong_parameters", "~> 0.2.1"
 
     group :development, :test do
       gem 'rspec-rails', '~> 2.14.0'
@@ -159,7 +162,7 @@ You can review the YARD docs in: http://rubydoc.info/github/AgilTec/cadenero/fra
 - [ ] Examples of use and demo
 
 ### Versions
-**Cadenero** aims to adhere to [Semantic Versioning 2.0.0](http://semver.org/) the current version is: 0.0.2-b8 meaning MAJOR.MINOR.PATCH format. Violations of this scheme should be reported as bugs. Specifically, if a minor or patch version is released that breaks backward compatibility, that version should be immediately yanked and/or a new version should be immediately released that restores compatibility. Breaking changes to the public API will only be introduced with new major versions. As a result of this policy, you can (and should) specify a dependency on this gem using the [Pessimistic Version Constraint](http://docs.rubygems.org/read/chapter/16#page74) with two digits of precision. For example:
+**Cadenero** aims to adhere to [Semantic Versioning 2.0.0](http://semver.org/) the current version is: 0.0.2-b10 meaning MAJOR.MINOR.PATCH format. Violations of this scheme should be reported as bugs. Specifically, if a minor or patch version is released that breaks backward compatibility, that version should be immediately yanked and/or a new version should be immediately released that restores compatibility. Breaking changes to the public API will only be introduced with new major versions. As a result of this policy, you can (and should) specify a dependency on this gem using the [Pessimistic Version Constraint](http://docs.rubygems.org/read/chapter/16#page74) with two digits of precision. For example:
 
 ```
     spec.add_dependency 'cadenero', '~> 1.0'
@@ -171,6 +174,8 @@ If you discover a problem with **Cadenero**, we would like to know about it. How
 
 https://github.com/AgilTec/cadenero/wiki/Bug-reports
 
+To submit the bug or issue go to: https://github.com/AgilTec/cadenero/issues
+
 If you found a security bug, do *NOT* use the GitHub issue tracker. Send an email to the maintainers listed at the bottom of the README please.
 
 ### Contributing
@@ -186,6 +191,11 @@ You will usually want to write tests for your changes using BDD tools as RSpec,
 
 To run the test suite, go into **Cadenero**'s top-level directory and run `bundle install` and `rspec spec`.  For the tests to pass, you will need to have a Postgresql server running on your system.
 
+If you have not contribute before in a Github repo please review first:
+
+  * [Fork A Repo](https://help.github.com/articles/fork-a-repo)
+  * [Using Pull Requests](https://help.github.com/articles/using-pull-requests)
+
 #### Running the Specs
 **Cadenero** use [RSpec](https://github.com/rspec/rspec) and [Capybara](https://github.com/jnicklas/capybara). To run the specs you only need to do:
 
@@ -201,6 +211,8 @@ You can `binstub` the command bins to avoid writing `bundle exec`. You only need
     $ bundle binstubs rake
 ```
 
+## About Dependencies and Inspirations
+
 ### Warden
 
 **Cadenero** is based on [Warden](https://github.com/hassox/warden), which is a general Rack authentication framework created by Daniel Neighman. We encourage you to read more about Warden here: https://github.com/hassox/warden/wiki
@@ -212,12 +224,15 @@ Some code and architectural decisions in **Cadenero** have been inspired for the
 
 **Cadenero** is a Rails::API Engine, Rails::API is a subset of a normal Rails application, created for applications that don't require all functionality that a complete Rails application provides. It is a bit more lightweight, and consequently a bit faster than a normal Rails application. The main example for its usage is in API applications only, where you usually don't need the entire Rails middleware stack nor template generation. Rails::API was created by Santiago Pastorino. We encourage you to read more about Rails::API here: https://github.com/rails-api/rails-api
 
-### Multitenancy with Rails And subscriptions too!
+### Multitenancy
+**Cadenero** use [Apartment](https://github.com/influitive/apartment) for Database multi-tenancy for Rack. **Cadenero** creates a new PostgreSQL Schema (like a NameSpace) for each account with subdomain, this means that each account has access only to its own information in that Schema. If you want to persist models that will have information that should be namespaced by the account Schemas rather than use the usual `rake db:migrate` for creating the tables you should use `rake apartment:migrate`. **Cadenero** creates for you the required `config.database_names` required for Apartment. We encourage you to review the [Apartment README](https://github.com/influitive/apartment/blob/development/README.md) to have more details
+
+#### Multitenancy with Rails And subscriptions too!
 Parts of the code of **Cadenero** have been based on the excellent work of [Ryan Bigg](https://github.com/radar) in his book ["Multitenancy with Rails And subscriptions too!"](https://leanpub.com/multi-tenancy-rails) but modified to be use in a RESTful API
 
 ### Maintainers
 
-* Manuel Vidaurre (https://github.com/mvidaurre)
+* [Manuel Vidaurre](https://github.com/mvidaurre)
 
 ## License
 

data/app/controllers/cadenero/application_controller.rb

@@ -4,5 +4,6 @@
 #
 module Cadenero
   class ApplicationController < ::ApplicationController
+    include ActiveModel::ForbiddenAttributesProtection
   end
 end

data/app/controllers/cadenero/v1/account/users_controller.rb

@@ -20,9 +20,9 @@ module Cadenero
       #   fulfilled and resulted in a new resource being created.
       def create
         account = Cadenero::V1::Account.where(subdomain: request.subdomain).first
-        @user = account.users.create(params[:user])
+        @user = account.users.create(user_params)
         force_authentication!(@user)
-        render json: @user, status: :created
+        render json: @user, serializer: UserSerializer, status: :created
       end
 
       # Send as JSON the user that match the params[:user]
@@ -36,6 +36,13 @@ module Cadenero
         @users = current_account.users
         render json: @users, status: :ok
       end
+
+      private
+      
+      # Permited parameters using strong parameters format
+      def user_params
+        params.require(:user).permit(:email, :password, :password_confirmation)
+      end
     end
   end
 end

data/app/controllers/cadenero/v1/accounts_controller.rb

@@ -20,10 +20,10 @@ module Cadenero
       # @return render JSON of [Cadenero::V1::Account] created and the status 201 Created: The request has been
       #   fulfilled and resulted in a new resource being created.
       def create
-        @account = Cadenero::V1::Account.create_with_owner(params[:account])
+        @account = Cadenero::V1::Account.create_with_owner(account_params)
         if @account.valid?
           force_authentication!(@account.owner)
-          render json: @account, status: :created
+          render json: @account, serializer: AccountSerializer, status: :created
         else
           @data = {
             errors: @account.errors
@@ -31,6 +31,13 @@ module Cadenero
           render json: @data, status: :unprocessable_entity
         end
       end
+
+      private
+      
+      # Permited parameters using strong parameters format
+      def account_params
+        params.require(:account).permit(:name, :subdomain, owner_attributes: [:email, :password, :password_confirmation])
+      end
     end
   end
 end

data/app/extenders/controllers/application_controller_decorator.rb

@@ -30,7 +30,7 @@
 
 # Check to see if there is an authenticated user
   def user_signed_in?
-    unless env['action_dispatch.request.parameters']["auth_token"].nil?
+    unless env['action_dispatch.request.parameters'].nil? || env['action_dispatch.request.parameters']["auth_token"].nil?
       env['warden'].logout(:user)
       env['warden'].authenticate(:token_authentication, scope: :user)
     end

data/app/models/cadenero/member.rb

@@ -2,11 +2,8 @@ module Cadenero
   # Defines that a Cadenero::User is member of an Cadenero::V1::Account
   class Member < ActiveRecord::Base
     include Cadenero::AuthToken
-    attr_accessible :account_id, :user_id
     belongs_to :account,  :class_name => "Cadenero::V1::Account"
     belongs_to :user,  :class_name => "Cadenero::User"
     after_create :ensure_auth_token!
-
   end
-  
 end

data/app/models/cadenero/user.rb

@@ -1,7 +1,6 @@
 module Cadenero
   # Defines a user of one or more accounts for the multitenant Rails App
   class User < ActiveRecord::Base
-    attr_accessible :email, :password, :password_confirmation
     has_secure_password
     has_many :accounts, class_name: "Cadenero::V1::Account", foreign_key: "owner_id"
     has_many :members, class_name: "Cadenero::Member"

data/app/models/cadenero/v1/account.rb

@@ -7,7 +7,6 @@ module Cadenero::V1
     has_many :users, :through => :members,  :class_name => "Cadenero::User"
 
     accepts_nested_attributes_for :owner
-    attr_accessible :name, :subdomain, :owner_attributes, :owner
     validates :subdomain, :presence => true, :uniqueness => true
     validates :owner, :presence => true
     after_create :ensure_auth_token!

data/app/serializers/cadenero/account_serializer.rb

@@ -2,7 +2,7 @@ module Cadenero
   # JSON Serializaer for the Cadenero::V1::Account Model
   class AccountSerializer < ActiveModel::Serializer
     embed :ids
-    attributes :id, :name, :subdomain, :authentication_token
+    attributes :id, :name, :subdomain, :auth_token
     has_one :owner
     has_many :users
   end

data/config/initializers/apartment.rb

@@ -7,8 +7,8 @@ Apartment.configure do |config|
   config.excluded_models = ["Cadenero::V1::Account",
                              "Cadenero::Member",
                              "Cadenero::User"]
-  # Dynamically get database names to migrate
-  # config.database_names = lambda{ Account.pluck(:database_name) }
 end
 
+# Dynamically get database names to migrate
+# config.database_names = lambda{ Account.pluck(:database_name) }
 Apartment.database_names = lambda{ Cadenero::V1::Account.pluck(:subdomain)}

data/config/initializers/strong_parameters.rb

@@ -0,0 +1 @@
+ActionController::API.send :include, ActionController::StrongParameters

data/lib/cadenero/testing_support/authentication_helpers.rb

@@ -99,7 +99,7 @@ module Cadenero
       # @param  [Cadenero::V1::Account] account
       # @return [String] email  for the last response user
       def successful_sign_up_user_in_existing_account_with_session(account, suffix=nil)
-        url = "http://#{account.subdomain}.example.com/" 
+        url = "http://#{account.subdomain}.example.com/"
         sign_up_user url, suffix
         expect(last_request.url).to eq "#{url}v1/users"
         get "#{url}v1/users/#{json_last_response_body['user']['id']}"

data/lib/cadenero/testing_support/database_cleaning.rb

@@ -25,9 +25,9 @@ module Cadenero
           connection = ActiveRecord::Base.connection.raw_connection
           schemas = connection.query(%Q{
             SELECT 'drop schema ' || nspname || ' cascade;'
-            from pg_namespace 
-            where nspname != 'public' 
-            AND nspname NOT LIKE 'pg_%'  
+            from pg_namespace
+            where nspname != 'public'
+            AND nspname NOT LIKE 'pg_%'
             AND nspname != 'information_schema';
           })
           schemas.each do |query|

data/lib/cadenero/version.rb

@@ -1,3 +1,3 @@
 module Cadenero
-  VERSION = "0.0.2.b8" # Current VERSION of Cadenero
+  VERSION = "0.0.2.b10" # Current VERSION of Cadenero
 end

data/spec/dummy/config/application.rb

@@ -47,7 +47,7 @@ module Dummy
     # This will create an empty whitelist of attributes available for mass-assignment for all models
     # in your app. As such, your models will need to explicitly whitelist or blacklist accessible
     # parameters by using an attr_accessible or attr_protected declaration.
-    config.active_record.whitelist_attributes = true
+    config.active_record.whitelist_attributes = false
 
     # Enable the asset pipeline
     config.assets.enabled = true

data/spec/dummy/config/environments/development.rb

@@ -6,7 +6,7 @@ Dummy::Application.configure do
   # since you don't have to restart the web server when you make code changes.
   config.cache_classes = false
 
-  config.ember.variant = :development
+  # config.ember.variant = :development
 
   # Log error messages when you accidentally call methods on nil.
   config.whiny_nils = true

data/spec/dummy/config/environments/production.rb

@@ -4,7 +4,7 @@ Dummy::Application.configure do
   # Code is not reloaded between requests
   config.cache_classes = true
 
-  config.ember.variant = :production
+  # config.ember.variant = :production
 
   # Full error reports are disabled and caching is turned on
   config.consider_all_requests_local       = false

data/spec/dummy/config/environments/test.rb

@@ -7,7 +7,7 @@ Dummy::Application.configure do
   # and recreated between test runs. Don't rely on the data there!
   config.cache_classes = true
 
-  config.ember.variant = :development
+  # config.ember.variant = :development
 
   # Configure static asset server for tests with Cache-Control for performance
   config.serve_static_assets = true