credible 0.11.0 → 0.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3600f170c11397baf11f7b350fdc1bcfe5fa9eff0c447743e145affdfb33d2d2
-  data.tar.gz: 1ab495351756b77d942082e1c31c4327154041575e9d1ce35ee519943d9edd7c
+  metadata.gz: 36d4cd634fa34562978e37d5a84169812678c28109d09c58238cb8c5bc2338d5
+  data.tar.gz: edc9471b968557985508ed60f49ae905390b3167d120497b3ea272faed0b423a
 SHA512:
-  metadata.gz: 5ed7e26ed44a7e69d70791aee2c910a9ccc80c340bd26541a6f4679427c76a75b31e1ddd308816f20bb4ee3fcd3031d011679364cafb0c91d8b7256be659ab2c
-  data.tar.gz: bc4bcef987ba1287acc7ead7d6d4c596dd33e6b72f8b5d221352dd81e895be6c0d80f87cd12712f63168b86ab2a3fa916fc8959f15c30c72fe75062b55e6399f
+  metadata.gz: 263ef8576aae2c0b1aaad9d1e5710c2eca33e5812accbe1a5d19827b37782bb3a8109ba5a91f77a41fc16a41834d5c4d040358be44017836ed9a22c54ffe6c0c
+  data.tar.gz: f23153d8e705f201acba1ff85c31016f2e1a1e9076016a66083ef8fb7da21a740c0bd2d5031ec4cf4e881ed0f352e3ac662a4592f599f9f70b7960ba7ab56ae9

data/README.md

@@ -1,18 +1,22 @@
-# Credible
+<h1 id="credible" align="center">Credible</h1>
 
-[![Become a Patron](https://c5.patreon.com/external/logo/become_a_patron_button.png)](https://www.patreon.com/thombruce)
+<p align="center"><strong>Credible</strong> | <a href="https://github.com/thombruce/credible-demo">Demo Repo</a> | <a href="https://github.com/thombruce/helvellyn">Helvellyn</a></p>
 
-[![Gem](https://img.shields.io/gem/v/credible?logo=rubygems)](https://rubygems.org/gems/credible)
-[![GitHub Workflow Status](https://img.shields.io/github/workflow/status/thombruce/credible/CI?logo=github)](https://github.com/thombruce/credible/actions)
-[![Codecov](https://img.shields.io/codecov/c/github/thombruce/credible?logo=codecov)](https://codecov.io/gh/thombruce/credible)
-[![GitHub issues](https://img.shields.io/github/issues-raw/thombruce/credible?logo=github)](https://github.com/thombruce/credible/issues)
+<p align="center"><a href="https://www.patreon.com/thombruce"><img src="https://c5.patreon.com/external/logo/become_a_patron_button.png" alt="Become a Patron"></a></p>
 
-[![License](https://img.shields.io/badge/license-MIT-green.svg)](MIT-LICENSE)
-[![Contributor Covenant](https://img.shields.io/badge/Contributor%20Covenant-v2.0%20adopted-ff69b4.svg)](CODE_OF_CONDUCT.md)
-[![Contributing](https://img.shields.io/badge/contributions-welcome-blue.svg)](CONTRIBUTING.md)
-[![Discord](https://img.shields.io/discord/697123984231366716?color=7289da&label=chat&logo=discord)](https://discord.gg/YMU87db)
+<p align="center"><a href="https://rubygems.org/gems/credible"><img src="https://img.shields.io/gem/v/credible?logo=rubygems" alt="Gem"></a>
+<a href="https://github.com/thombruce/credible/actions"><img src="https://img.shields.io/github/workflow/status/thombruce/credible/CI?logo=github" alt="GitHub Workflow Status"></a>
+<a href="https://codecov.io/gh/thombruce/credible"><img src="https://img.shields.io/codecov/c/github/thombruce/credible?logo=codecov" alt="Codecov"></a>
+<a href="https://github.com/thombruce/credible/issues"><img src="https://img.shields.io/github/issues-raw/thombruce/credible?logo=github" alt="GitHub issues"></a></p>
 
-Credible was extracted from [thombruce/helvellyn](https://github.com/thombruce/helvellyn) and is still a work in progress. The goal is to provide JWT and API token based authentication using [Warden](https://github.com/wardencommunity/warden/) for Rails API applications.
+<p align="center"><a href="MIT-LICENSE"><img src="https://img.shields.io/badge/license-MIT-green.svg" alt="License"></a>
+<a href="CONTRIBUTING.md"><img src="https://img.shields.io/badge/contributions-welcome-blue.svg" alt="Contributing"></a>
+<a href="https://discord.gg/YMU87db"><img src="https://img.shields.io/discord/697123984231366716?color=7289da&label=chat&logo=discord" alt="Discord"></a></p>
+
+<p align="center"><a href="CHANGELOG.md"><img src="https://img.shields.io/badge/Keep%20a%20Changelog-v1.1.0%20adopted-red.svg" alt="Changelog"></a>
+<a href="CODE_OF_CONDUCT.md"><img src="https://img.shields.io/badge/Contributor%20Covenant-v1.4%20adopted-ff69b4.svg" alt="Contributor Covenant"></a></p>
+
+<p align="center">Credible was extracted from <a href="https://github.com/thombruce/helvellyn">thombruce/helvellyn</a> and is still a work in progress. The goal is to provide JWT and API token based authentication using <a href="https://github.com/wardencommunity/warden/">Warden</a> for Rails API applications.</p>
 
 ## Installation
 
@@ -73,6 +77,20 @@ class Session < ApplicationRecord
 end
 ```
 
+## Calling the API
+
+To sign up and create a new user, send params in the form `{ user: { email: 'email@example.com', password: 'Pa$$word123!' } }` to `auth/signup` as a `POST` request. On success, this will return `{ access_token: '...', refresh_token: '...' }` that can be used to persist the user's session.
+
+To sign in a user, send params in the form `{ session: { login: 'email@example.com', password: 'Pa$$word123!' } }` to `auth/login` as a `POST` request. On success, this will return `{ access_token: '...', refresh_token: '...' }` that can be used to persist the user's session.
+
+To sign out a user, send an empty request to `auth/signout` as a `DELETE` request. On success, this will return no content. It will destroy the session in the database and invalidate any existing tokens. Note: If you are using the access token to authenticate the user on a separate server, it will still remain valid until its expiry.
+
+To refresh an access token, send params in the form `{ refresh_token: '...' }` to `auth/refresh` as a `POST` request. On success, this will return `{ access_token: '...', refresh_token: '...' }` that can be used to continue the user's session. Note: This will also invalidate the refresh token used to renew the tokens, and provide a new refresh token for next use.
+
+> **Be careful**
+>
+> Credible is still a work in progress and these routes will be subject to change. I'm thinking about keeping them around as sort of a "classic" mode, but I feel like more resource-oriented routes are also desirable. For example, I want to add a `/tokens` endpoint in place of the existing `/refresh` enpoint, because _refresh what?_ It's just more semantically correct.
+
 ## Mailers
 
 To user Credible's in-built mailers, you must set a hostname for your application. A suitable setting for this in `config/environments/development.rb` might be:

data/app/views/credible/sessions/_session.json.jbuilder

@@ -1,5 +1,7 @@
 json.extract! session, :id, :created_at, :updated_at
 
-json.jwt session.jwt
+json.access_token session.access_token
+json.jwt session.access_token
+json.refresh_token session.refresh_token
 
 # json.url session_url(session, format: :json)

data/app/views/credible/users/_user.json.jbuilder

@@ -1,5 +1,10 @@
 json.extract! user, :id, :email, :created_at, :updated_at
 
-json.jwt @session.jwt if @session
+if @session
+  json.access_token @session.access_token
+  json.jwt @session.access_token
+
+  json.refresh_token @session.refresh_token
+end
 
 json.url user_url(user, format: :json)

data/config/initializers/warden.rb

@@ -3,12 +3,13 @@ Rails.application.config.middleware.use Warden::Manager do |config|
 
   config.default_scope = :session
 
-  config.scope_defaults :session, store: false, strategies: [:jwt, :api_token]
+  config.scope_defaults :session, store: false, strategies: [:jwt, :refresh, :api_token]
 end
 
 # TODO: See here for how Devise initializes Warden: https://github.com/heartcombo/devise/blob/715192a7709a4c02127afb067e66230061b82cf2/lib/devise/rails.rb
 #       It's also worth perusing the mention of 'warden' in the Devise repo. Interesting strategies at work.
 
+# TODO: Change to :access_token, maybe maintain :jwt as alias
 Warden::Strategies.add(:jwt) do
   def valid?
     env['HTTP_AUTHORIZATION']
@@ -25,14 +26,49 @@ Warden::Strategies.add(:jwt) do
       jwt = header.gsub(pattern, '') if header && header.match(pattern)
       token =
         JWT.decode jwt, Rails.application.secrets.secret_key_base, true,
-                   iss: Rails.application.class.module_parent_name, verify_iss: true, algorithm: 'HS256' # [1]
-    rescue JWT::InvalidIssuerError
+                   iss: Rails.application.class.module_parent_name, 
+                   verify_iss: true, verify_iat: true, verify_expiration: true,
+                   algorithm: 'HS256' # [1]
+    rescue JWT::InvalidIssuerError, JWT::InvalidIatError, JWT::ExpiredSignature
       fail!('Could not authenticate')
     end
 
     session = ::Session.find(token[0]['data']['session_id'])
     success!(session)
-  rescue ActiveRecord::RecordNotFound
+  rescue # ActiveRecord::RecordNotFound
+    fail!('Could not authenticate')
+  end
+
+  def store?
+    false
+  end
+end
+
+Warden::Strategies.add(:refresh) do
+  def valid?
+    # params[:refresh_token]
+    env['action_dispatch.request.parameters']['refresh_token'] # https://github.com/wardencommunity/warden/issues/84
+  end
+
+  def env
+    request.env
+  end
+
+  def authenticate!
+    begin
+      jwt = env['action_dispatch.request.parameters']['refresh_token']
+      token =
+        JWT.decode jwt, Rails.application.secrets.secret_key_base, true,
+                   iss: Rails.application.class.module_parent_name, 
+                   verify_iss: true, verify_iat: true, verify_expiration: true,
+                   algorithm: 'HS256' # [1]
+    rescue JWT::InvalidIssuerError, JWT::InvalidIatError, JWT::ExpiredSignature
+      fail!('Could not authenticate')
+    end
+
+    session = ::Session.find(token[0]['data']['session_id'])
+    success!(session)
+  rescue # ActiveRecord::RecordNotFound
     fail!('Could not authenticate')
   end
 

data/config/routes.rb

@@ -2,12 +2,19 @@ Credible::Engine.routes.draw do
   scope format: false, defaults: { format: 'json' } do
     # /auth/login.json
     post 'login', to: 'sessions#create'
+
+    # /auth/refresh.json
+    post 'refresh', to: 'sessions#refresh'
+
     # /auth/reset_password.json
     post 'reset_password', to: 'users#reset_password'
+
     # /auth/signup.json
     post 'signup', to: 'users#create'
+
     # /auth/confirm.json
     get 'confirm/:confirmation_token', to: 'users#confirm', as: :confirmation
+
     # /auth/signout.json
     delete 'signout', to: 'sessions#destroy'
 
@@ -15,6 +22,7 @@ Credible::Engine.routes.draw do
     scope '/account' do
       # /auth/account/sessions/*.json
       resources :sessions, except: [:new, :create, :edit, :update]
+
       # /auth/account/*.json
       resource :user, path: '', except: [:new, :create]
     end

data/lib/credible/controllers/sessions_controller.rb

@@ -5,7 +5,8 @@ module Credible
 
       included do
         before_action :set_session, only: [:show, :destroy]
-        skip_before_action :authenticate!, only: [:new, :create, :fail]
+        skip_before_action :authenticate!, only: [:new, :create, :refresh, :fail]
+        before_action :authenticate_with_refresh_token!, only: [:refresh]
         # skip_after_action :verify_authorized, only: [:fail]
         # TODO: Reevaluate authorization without Pundit
       end
@@ -37,6 +38,19 @@ module Credible
         end
       end
 
+      # POST /refresh
+      # POST /refresh.json
+      def refresh
+        @session = ::Session.new(user: current_user)
+
+        if @session.save
+          current_session.destroy
+          render :show, status: :created, location: @session
+        else
+          render json: @session.errors, status: :unprocessable_entity
+        end
+      end
+
       # DELETE /sessions/1
       # DELETE /sessions/1.json
       # DELETE /sessions/current
@@ -60,6 +74,10 @@ module Credible
       def session_params
         params.require(:session).permit(:login, :password)
       end
+
+      def authenticate_with_refresh_token!
+        warden.authenticate!(:refresh)
+      end
     end
   end
 end

data/lib/credible/session.rb

@@ -9,10 +9,22 @@ module Credible
 
       has_secure_token
 
-      def jwt
+      def access_token
         payload = {
-          data: jwt_data,
-          iss: Rails.application.class.module_parent_name
+          data: access_token_data,
+          iss: Rails.application.class.module_parent_name,
+          iat: Time.now.to_i,
+          exp: Time.now.to_i + 4 * 3600
+        }
+        JWT.encode payload, Rails.application.secrets.secret_key_base, 'HS256' # [1]
+      end
+
+      def refresh_token
+        payload = {
+          data: refresh_token_data,
+          iss: Rails.application.class.module_parent_name,
+          iat: Time.now.to_i,
+          exp: Time.now.to_i + 14 * 24 * 3600
         }
         JWT.encode payload, Rails.application.secrets.secret_key_base, 'HS256' # [1]
       end
@@ -27,7 +39,7 @@ module Credible
 
     private
 
-    def jwt_data
+    def access_token_data
       {
         session_id: id,
         user_id: user.id,
@@ -37,6 +49,12 @@ module Credible
         }
       }
     end
+
+    def refresh_token_data
+      {
+        session_id: id
+      }
+    end
   end
 end
 

data/lib/credible/version.rb

@@ -1,3 +1,3 @@
 module Credible
-  VERSION = '0.11.0'
+  VERSION = '0.12.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: credible
 version: !ruby/object:Gem::Version
-  version: 0.11.0
+  version: 0.12.0
 platform: ruby
 authors:
 - Thom Bruce
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-04-23 00:00:00.000000000 Z
+date: 2020-05-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails