devise-api 0.0.0 → 0.1.1

data/app/services/devise/api/resource_owner_service/sign_up.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Devise
+  module Api
+    module ResourceOwnerService
+      class SignUp < Devise::Api::BaseService
+        option :params, type: Types::Hash
+        option :resource_class, type: Types::Class
+
+        def call
+          ActiveRecord::Base.transaction do
+            resource_owner = yield create_resource_owner
+            devise_api_token = yield call_create_devise_api_token_service(resource_owner)
+
+            Success(devise_api_token)
+          end
+        end
+
+        private
+
+        def create_resource_owner
+          resource_owner = resource_class.new(params)
+
+          return Success(resource_owner) if resource_owner.save
+
+          Failure(error: :resource_owner_create_error, record: resource_owner)
+        end
+
+        def call_create_devise_api_token_service(resource_owner)
+          Devise::Api::TokensService::Create.new(resource_owner: resource_owner).call
+        end
+      end
+    end
+  end
+end

data/app/services/devise/api/tokens_service/create.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Devise
+  module Api
+    module TokensService
+      class Create < Devise::Api::BaseService
+        option :resource_owner
+        option :previous_refresh_token, type: Types::String | Types::Nil, default: proc { nil }
+
+        def call
+          return Failure(:invalid_resource_owner) unless resource_owner.respond_to?(:access_tokens)
+
+          devise_api_token = yield create_devise_api_token
+
+          Success(devise_api_token)
+        end
+
+        private
+
+        def authenticate_service
+          Devise::Api::ResourceOwnerService::Authenticate.new(params: params,
+                                                              resource_class: resource_class).call
+        end
+
+        def create_devise_api_token
+          devise_api_token = resource_owner.access_tokens.new(params)
+
+          return Success(devise_api_token) if devise_api_token.save
+
+          Failure(error: :devise_api_token_create_error, record: devise_api_token)
+        end
+
+        def params
+          {
+            access_token: Devise.api.config.base_token_model.constantize.generate_uniq_access_token(resource_owner),
+            refresh_token: Devise.api.config.base_token_model.constantize.generate_uniq_refresh_token(resource_owner),
+            expires_in: Devise.api.config.access_token.expires_in,
+            revoked_at: nil,
+            previous_refresh_token: previous_refresh_token
+          }
+        end
+      end
+    end
+  end
+end

data/app/services/devise/api/tokens_service/refresh.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Devise
+  module Api
+    module TokensService
+      class Refresh < Devise::Api::BaseService
+        option :devise_api_token, type: Types.Instance(Devise.api.base_token_model.constantize)
+        option :resource_owner, default: proc { devise_api_token.resource_owner }
+
+        def call
+          return Failure(:expired_refresh_token) if devise_api_token.refresh_token_expired?
+
+          devise_api_token = yield create_devise_api_token
+          Success(devise_api_token)
+        end
+
+        private
+
+        def create_devise_api_token
+          Devise::Api::TokensService::Create.new(resource_owner: resource_owner,
+                                                 previous_refresh_token: devise_api_token.refresh_token).call
+        end
+      end
+    end
+  end
+end

data/app/services/devise/api/tokens_service/revoke.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Devise
+  module Api
+    module TokensService
+      class Revoke < Devise::Api::BaseService
+        option :devise_api_token, optional: true
+
+        def call
+          return Success(devise_api_token) if devise_api_token.blank?
+          return Success(devise_api_token) if devise_api_token.revoked? || devise_api_token.expired?
+          return Success(devise_api_token) if devise_api_token.update(revoked_at: Time.zone.now)
+
+          Failure(error: :devise_api_token_revoke_error, record: devise_api_token)
+        end
+      end
+    end
+  end
+end

data/config/locales/en.yml

@@ -0,0 +1,22 @@
+en:
+  devise:
+    api:
+      error_response:
+        invalid_authentication: "Email or password is invalid"
+        invalid_token: "Invalid token"
+        expired_token: "Token has expired"
+        expired_refresh_token: "Refresh token has expired"
+        revoked_token: "Token has been revoked"
+        refresh_token_disabled: "Refresh token is disabled for this application"
+        invalid_refresh_token: "Refresh token is invalid"
+        invalid_email: "Email is invalid"
+        invalid_resource_owner: "Resource owner is invalid"
+        resource_owner_create_error: "Resource owner could not be created"
+        devise_api_token_create_error: "Token could not be created"
+        devise_api_token_revoke_error: "Token could not be revoked"
+        lockable:
+          locked: "Your account is locked"
+        confirmable:
+          unconfirmed: "You have to confirm your account before continuing"
+        registerable:
+          signed_up_but_unconfirmed: "A message with a confirmation link has been sent to your email address. Please follow the link to activate your account"

data/devise-api.gemspec

@@ -2,15 +2,18 @@
 
 require_relative 'lib/devise/api/version'
 
+# rubocop:disable Layout/LineLength
 Gem::Specification.new do |spec|
   spec.name = 'devise-api'
   spec.version = Devise::Api::VERSION
   spec.authors = ['nejdetkadir']
   spec.email = ['nejdetkadir.550@gmail.com']
 
-  spec.summary = "It provides support for access tokens and refresh tokens,
-                  which allow you to authenticate API requests and keep the user's
-                  session active for a longer period of time."
+  spec.summary = "The devise-api gem is a convenient way to add authentication to your Ruby on Rails application using the devise gem.
+                 It provides support for access tokens and refresh tokens, which allow you to authenticate API requests and
+                 keep the user's session active for a longer period of time on the client side. It can be installed by adding the gem to your Gemfile,
+                 running migrations, and adding the :api module to your devise model. The gem is fully configurable,
+                 allowing you to set things like token expiration times and token generators."
 
   spec.description = spec.summary
   spec.homepage = "https://github.com/nejdetkadir/#{spec.name}"
@@ -33,9 +36,14 @@ Gem::Specification.new do |spec|
   spec.require_paths = ['lib']
 
   # Uncomment to register a new dependency of your gem
-  spec.add_dependency 'rails', '>= 6.0.0'
   spec.add_dependency 'devise', '>= 4.7.2'
+  spec.add_dependency 'dry-configurable', '~> 1.0', '>= 1.0.1'
+  spec.add_dependency 'dry-initializer', '>= 3.1.1'
+  spec.add_dependency 'dry-monads', '>= 1.6.0'
+  spec.add_dependency 'dry-types', '>= 1.7.0'
+  spec.add_dependency 'rails', '>= 6.0.0'
 
   # For more information and examples about making a new gem, check out our
   # guide at: https://bundler.io/guides/creating_gem.html
 end
+# rubocop:enable Layout/LineLength

data/lib/devise/api/configuration.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'dry-configurable'
+
+module Devise
+  module Api
+    class Configuration
+      include Dry::Configurable
+
+      setting :access_token, reader: true do
+        setting :expires_in, default: 1.hour, reader: true
+        setting :expires_in_infinite, default: proc { |_resource_owner| false }, reader: true
+        setting :generator, default: proc { |_resource_owner| ::Devise.friendly_token(60) }, reader: true
+      end
+
+      setting :refresh_token, reader: true do
+        setting :enabled, default: true, reader: true
+        setting :expires_in, default: 1.week, reader: true
+        setting :generator, default: proc { |_resource_owner| ::Devise.friendly_token(60) }, reader: true
+        setting :expires_in_infinite, default: proc { |_resource_owner| false }, reader: true
+      end
+
+      setting :authorization, reader: true do
+        setting :key, default: 'Authorization', reader: true
+        setting :scheme, default: 'Bearer', reader: true
+        setting :location, default: :both, reader: true # :header or :params or :both
+        setting :params_key, default: 'access_token', reader: true
+      end
+
+      setting :base_token_model, default: 'Devise::Api::Token', reader: true
+      setting :base_controller, default: '::DeviseController', reader: true
+
+      setting :after_successful_sign_in, default: proc { |_resource_owner, _token, _request| }, reader: true
+      setting :after_successful_sign_up, default: proc { |_resource_owner, _token, _request| }, reader: true
+      setting :after_successful_refresh, default: proc { |_resource_owner, _token, _request| }, reader: true
+      setting :after_successful_revoke, default: proc { |_resource_owner, _token, _request| }, reader: true
+
+      setting :before_sign_in, default: proc { |_params, _request, _resource_class| }, reader: true
+      setting :before_sign_up, default: proc { |_params, _request, _resource_class| }, reader: true
+      setting :before_refresh, default: proc { |_token, _request| }, reader: true
+      setting :before_revoke, default: proc { |_token, _request| }, reader: true
+    end
+  end
+end

data/lib/devise/api/controllers/helpers.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+require 'active_support/concern'
+
+module Devise
+  module Api
+    module Controllers
+      module Helpers
+        extend ActiveSupport::Concern
+
+        def authenticate_devise_api_token!
+          if current_devise_api_token.blank?
+            error_response = Devise::Api::Responses::ErrorResponse.new(request, error: :invalid_token,
+                                                                                resource_class: resource_class)
+
+            return render json: error_response.body, status: error_response.status
+          end
+
+          if current_devise_api_token.expired?
+            error_response = Devise::Api::Responses::ErrorResponse.new(request, error: :expired_token,
+                                                                                resource_class: resource_class)
+
+            return render json: error_response.body, status: error_response.status
+          end
+
+          return unless current_devise_api_token.revoked?
+
+          error_response = Devise::Api::Responses::ErrorResponse.new(request, error: :revoked_token,
+                                                                              resource_class: resource_class)
+
+          render json: error_response.body, status: error_response.status
+        end
+
+        def current_devise_api_refresh_token
+          token = find_devise_api_token
+
+          Devise.api.config.base_token_model.constantize.find_by(refresh_token: token)
+        end
+
+        def current_devise_api_token
+          token = find_devise_api_token
+
+          devise_api_token_model = Devise.api.config.base_token_model.constantize
+
+          if Devise.api.config.refresh_token.enabled
+            return devise_api_token_model
+                   .where(access_token: token)
+                   .or(devise_api_token_model.where(refresh_token: token))
+                     &.first
+          end
+
+          devise_api_token_model.find_by(access_token: token)
+        end
+
+        def current_devise_api_user
+          current_devise_api_token&.resource_owner
+        end
+
+        private
+
+        def extract_devise_api_token_from_params
+          params[Devise.api.config.authorization.params_key]
+        end
+
+        def extract_devise_api_token_from_headers
+          token = request.headers[Devise.api.config.authorization.key]
+          unless token.blank?
+            token = begin
+              token.gsub(/^#{Devise.api.config.authorization.scheme} /,
+                         '')
+            rescue StandardError
+              token
+            end
+          end
+          token
+        end
+
+        def find_devise_api_token
+          case Devise.api.config.authorization.location
+          when :header
+            extract_devise_api_token_from_headers
+          when :params
+            extract_devise_api_token_from_params
+          when :both
+            extract_devise_api_token_from_params || extract_devise_api_token_from_headers
+          else
+            raise ArgumentError, 'Invalid authorization location, must be :header, :params or :both'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/devise/api/generators/install_generator.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require 'rails/generators'
+require 'rails/generators/active_record'
+require 'rails/generators/active_model'
+
+module Devise
+  module Api
+    module Generators
+      class InstallGenerator < ::Rails::Generators::Base
+        include ::Rails::Generators::Migration
+        source_root File.expand_path('templates', __dir__)
+        desc 'Generates a migration to add the required fields to the your devise model'
+        namespace 'devise_api:install'
+
+        def install
+          migration_template(
+            'migration.rb.erb',
+            'db/migrate/create_devise_api_tables.rb',
+            migration_version: migration_version
+          )
+
+          copy_file locale_source, locale_destination
+        end
+
+        def self.next_migration_number(path)
+          ActiveRecord::Generators::Base.next_migration_number(path)
+        end
+
+        private
+
+        def locale_source
+          File.expand_path('../../../../config/locales/en.yml', __dir__)
+        end
+
+        def locale_destination
+          'config/locales/devise_api.en.yml'
+        end
+
+        def migration_version
+          "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
+        end
+
+        def primary_key_type
+          fallback = :integer
+
+          begin
+            ActiveRecord::Base.connection.supports_pgcrypto_uuid? ? :uuid : fallback
+          rescue StandardError
+            fallback
+          end
+        end
+
+        def table_defaults_for_primary_key_type
+          return ', type: :uuid' if primary_key_type == :uuid
+
+          ''
+        end
+      end
+    end
+  end
+end

data/lib/devise/api/generators/templates/migration.rb.erb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class CreateDeviseApiTables < ActiveRecord::Migration<%= migration_version %>
+  def change
+    create_table :devise_api_tokens<%= table_defaults_for_primary_key_type %>  do |t|
+      t.belongs_to :resource_owner, null: false<%= table_defaults_for_primary_key_type %>, polymorphic: true, index: true
+      t.string :access_token, null: false, index: true
+      t.string :refresh_token, null: true, index: true
+      t.integer :expires_in, null: false
+      t.datetime :revoked_at, null: true
+      t.string :previous_refresh_token, null: true, index: true
+
+      t.timestamps
+    end
+  end
+end

data/lib/devise/api/rails/engine.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Devise
+  module Api
+    module Rails
+      class Engine < ::Rails::Engine
+        isolate_namespace Devise::Api
+      end
+    end
+  end
+end

data/lib/devise/api/rails/routes.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module ActionDispatch
+  module Routing
+    class Mapper
+      protected
+
+      def devise_api(mapping, controllers)
+        controller = controllers.fetch(:tokens, 'devise/api/tokens')
+        path = mapping.path_names.fetch(:tokens, 'tokens')
+
+        resource :tokens, only: [], controller: controller, path: path do
+          collection do
+            post :revoke, as: :revoke
+            post :refresh, as: :refresh
+            post :sign_up, as: :sign_up
+            post :sign_in, as: :sign_in
+            get :info, as: :info
+          end
+        end
+      end
+    end
+  end
+end

data/lib/devise/api/responses/error_response.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+
+module Devise
+  module Api
+    module Responses
+      class ErrorResponse
+        attr_reader :request, :error, :record, :resource_class
+
+        ERROR_TYPES = %i[
+          invalid_token
+          expired_token
+          expired_refresh_token
+          revoked_token
+          refresh_token_disabled
+          invalid_refresh_token
+          invalid_email
+          invalid_resource_owner
+          resource_owner_create_error
+          devise_api_token_create_error
+          devise_api_token_revoke_error
+          invalid_authentication
+        ].freeze
+
+        ERROR_TYPES.each do |error_type|
+          method_name = error_type.end_with?('_error') ? error_type : "#{error_type}_error"
+
+          define_method("#{method_name}?") do
+            error.eql?(error_type)
+          end
+        end
+
+        def initialize(request, error:, record: nil, resource_class: nil)
+          @request = request
+          @error = error
+          @record = record
+          @resource_class = resource_class
+        end
+
+        def body
+          {
+            error: error,
+            error_description: error_description,
+            lockable: devise_lockable_info,
+            confirmable: devise_confirmable_info
+          }.compact
+        end
+
+        def status
+          return :unauthorized if unauthorized_status?
+          return :bad_request if bad_request_status?
+
+          :unprocessable_entity
+        end
+
+        private
+
+        # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+        def error_description
+          return [I18n.t("devise.api.error_response.#{error}")] if record.blank?
+          if invalid_authentication_error? && devise_lockable_info.present? && record.access_locked?
+            return [I18n.t('devise.api.error_response.lockable.locked')]
+          end
+          if invalid_authentication_error? && devise_confirmable_info.present? && !record.confirmed?
+            return [I18n.t('devise.api.error_response.confirmable.unconfirmed')]
+          end
+          return [I18n.t('devise.api.error_response.invalid_authentication')] if invalid_authentication_error?
+
+          record.errors.full_messages
+        end
+        # rubocop:enable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+
+        def devise_lockable_info
+          unless resource_class.present? &&
+                 resource_class.supported_devise_modules.lockable? &&
+                 invalid_authentication_error?
+            return nil
+          end
+
+          unlock_at = record.access_locked? ? record.locked_at + ::Devise.unlock_in : nil
+
+          {
+            locked: record.access_locked?,
+            max_attempts: ::Devise.maximum_attempts,
+            failed_attemps: record.failed_attempts,
+            locked_at: record.locked_at,
+            unlock_at: unlock_at
+          }.compact
+        end
+
+        def devise_confirmable_info
+          unless resource_class.present? &&
+                 resource_class.supported_devise_modules.confirmable? &&
+                 invalid_authentication_error?
+            return nil
+          end
+
+          {
+            confirmed: record.confirmed?,
+            confirmation_sent_at: record.confirmed? ? nil : record.confirmation_sent_at
+          }.compact
+        end
+
+        def unauthorized_status?
+          invalid_token_error? ||
+            expired_token_error? ||
+            expired_refresh_token_error? ||
+            revoked_token_error? ||
+            invalid_authentication_error?
+        end
+
+        def bad_request_status?
+          invalid_email_error? ||
+            invalid_refresh_token_error? ||
+            refresh_token_disabled_error? ||
+            invalid_resource_owner_error?
+        end
+      end
+    end
+  end
+end

data/lib/devise/api/responses/token_response.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+module Devise
+  module Api
+    module Responses
+      class TokenResponse
+        attr_reader :request, :token, :action, :resource_owner
+
+        ACTIONS = %i[
+          sign_in
+          sign_up
+          refresh
+          revoke
+          info
+        ].freeze
+
+        ACTIONS.each do |act|
+          define_method("#{act}_action?") do
+            action.eql?(act)
+          end
+        end
+
+        def initialize(request, token:, action:)
+          @request = request
+          @token = token
+          @action = action
+          @resource_owner = token&.resource_owner
+        end
+
+        def body
+          return {} if revoke_action?
+          return signed_up_body if sign_up_action?
+          return info_body if info_action?
+
+          default_body
+        end
+
+        def default_body
+          {
+            token: token.access_token,
+            refresh_token: Devise.api.config.refresh_token.enabled ? token.refresh_token : nil,
+            expires_in: token.expires_in,
+            token_type: ::Devise.api.config.authorization.scheme,
+            resource_owner: {
+              id: resource_owner.id,
+              email: resource_owner.email,
+              created_at: resource_owner.created_at,
+              updated_at: resource_owner.updated_at
+            }
+          }.compact
+        end
+
+        def status
+          return :created if sign_up_action?
+          return :no_content if revoke_action?
+
+          :ok
+        end
+
+        private
+
+        def signed_up_body
+          return default_body unless resource_owner.class.supported_devise_modules.confirmable?
+
+          message = resource_owner.confirmed? ? nil : I18n.t('devise.api.registerable.signed_up_but_unconfirmed')
+
+          default_body.merge(confirmable: { confirmed: resource_owner.confirmed?, message: message }.compact)
+        end
+
+        def info_body
+          default_body[:resource_owner]
+        end
+      end
+    end
+  end
+end