devise-api 0.1.2 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4f6b2f86ff9cf332790f64f74212b25afff00bc6ff02ffe66389925db4b8fdc6
-  data.tar.gz: a7e8420897cf4e587a73a297d2121fcd0d20f4750deb01e9a7685bf4e635059b
+  metadata.gz: 2d86e2276841e4ca3ae7497278542d686da38368f5f5cdf76629abd463c7976f
+  data.tar.gz: 3f33438f2a503b0f1bd510e6020c0d88f61a82715aff8b701a1872a4901ffb75
 SHA512:
-  metadata.gz: d5a5ec029117561416f93e6748f278f8489aeef2ec4ce832bce7136790a7587d93de2f5490bbbbfe4a202ccb4275c2f371012e435fdb7cb077999189372039f5
-  data.tar.gz: 43cad74cafb53ce017ebcf1e7ae41e250138eb9d8b0407ee89baf4ed8e2137394d4008f60c7c4f1f7116859aca43571361906a95ebbc1888348f71884f03a817
+  metadata.gz: acea2091463ddb32d14df2c6b6aaf88e55549796b79ba35855ffdd08f3f78e8a5e5d9f305f48a855a2f3d17aa2cee2c8e7fce7ce07efda222af9de785a9f57cf
+  data.tar.gz: 8cecc648a297705d7d7f82420aa48fd6f4ed7d8899ba721cf0002cbae34f9f1e3fae5032877a4efa826f609c50592f894f9407adeeed6a12c7ca856b2dd9c5d2

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    devise-api (0.1.2)
+    devise-api (0.1.3)
       devise (>= 4.7.2)
       dry-configurable (~> 1.0, >= 1.0.1)
       dry-initializer (>= 3.1.1)
@@ -259,6 +259,7 @@ GEM
 PLATFORMS
   arm64-darwin-21
   arm64-darwin-22
+  arm64-darwin-23
 
 DEPENDENCIES
   awesome_print

data/README.md

@@ -91,6 +91,9 @@ Devise.setup do |config|
     api.refresh_token.generator = ->(_resource_owner) { Devise.friendly_token(60) }
     api.refresh_token.expires_in_infinite = ->(_resource_owner) { false }
 
+    # Sign up
+    api.sign_up.enabled = true
+    api.sign_up.extra_fields = []
 
     # Authorization
     api.authorization.key = 'Authorization'
@@ -114,8 +117,8 @@ Devise.setup do |config|
     # Before callbacks
     api.before_sign_in = ->(_params, _request, _resource_class) { }
     api.before_sign_up = ->(_params, _request, _resource_class) { }
-    api.before_refresh = ->(_params, _request, _resource_class) { }
-    api.before_revoke = ->(_params, _request, _resource_class) { }
+    api.before_refresh = ->(_token_model, _request) { }
+    api.before_revoke = ->(_token_model, _request) { }
   end
 end
 ```
@@ -155,10 +158,12 @@ module Devise::Api::Responses::TokenResponseDecorator
 end
 ```
 
-Then you need to prepend your decorator to the response class. For example:
+Then you need to load and prepend your decorator to the response class. For example:
 
 ```ruby
 # config/initializers/devise.rb
+require 'devise/api/responses/token_response_decorator' # Either do this or autoload the lib directory
+
 Devise.setup do |config|
 end
 

data/app/controllers/devise/api/tokens_controller.rb

@@ -1,15 +1,24 @@
 # frozen_string_literal: true
 
+# rubocop:disable Metrics/ClassLength
 module Devise
   module Api
     class TokensController < Devise.api.config.base_controller.constantize
+      wrap_parameters false
       skip_before_action :verify_authenticity_token, raise: false
-      before_action :authenticate_devise_api_token!, only: %i[info refresh]
+      before_action :authenticate_devise_api_token!, only: %i[info]
 
       respond_to :json
 
       # rubocop:disable Metrics/AbcSize
       def sign_up
+        unless Devise.api.config.sign_up.enabled
+          error_response = Devise::Api::Responses::ErrorResponse.new(request, error: :sign_up_disabled,
+                                                                              resource_class: resource_class)
+
+          return render json: error_response.body, status: error_response.status
+        end
+
         Devise.api.config.before_sign_up.call(sign_up_params, request, resource_class)
 
         service = Devise::Api::ResourceOwnerService::SignUp.new(params: sign_up_params,
@@ -103,9 +112,23 @@ module Devise
           return render json: error_response.body, status: error_response.status
         end
 
-        Devise.api.config.before_refresh.call(current_devise_api_token, request)
+        if current_devise_api_refresh_token.blank?
+          error_response = Devise::Api::Responses::ErrorResponse.new(request, error: :invalid_token,
+                                                                              resource_class: resource_class)
+
+          return render json: error_response.body, status: error_response.status
+        end
+
+        if current_devise_api_refresh_token.revoked?
+          error_response = Devise::Api::Responses::ErrorResponse.new(request, error: :revoked_token,
+                                                                              resource_class: resource_class)
 
-        service = Devise::Api::TokensService::Refresh.new(devise_api_token: current_devise_api_token).call
+          return render json: error_response.body, status: error_response.status
+        end
+
+        Devise.api.config.before_refresh.call(current_devise_api_refresh_token, request)
+
+        service = Devise::Api::TokensService::Refresh.new(devise_api_token: current_devise_api_refresh_token).call
 
         if service.success?
           token_response = Devise::Api::Responses::TokenResponse.new(request, token: service.success,
@@ -127,7 +150,7 @@ module Devise
       private
 
       def sign_up_params
-        params.permit(*resource_class.authentication_keys,
+        params.permit(*Devise.api.config.sign_up.extra_fields, *resource_class.authentication_keys,
                       *::Devise::ParameterSanitizer::DEFAULT_PERMITTED_ATTRIBUTES[:sign_up]).to_h
       end
 
@@ -141,6 +164,15 @@ module Devise
 
         resource_owner.update_tracked_fields!(request)
       end
+
+      def current_devise_api_refresh_token
+        return @current_devise_api_refresh_token if @current_devise_api_refresh_token
+
+        token = find_devise_api_token
+        devise_api_token_model = Devise.api.config.base_token_model.constantize
+        @current_devise_api_refresh_token = devise_api_token_model.find_by(refresh_token: token)
+      end
     end
   end
 end
+# rubocop:enable Metrics/ClassLength

data/app/services/devise/api/tokens_service/create.rb

@@ -8,7 +8,7 @@ module Devise
         option :previous_refresh_token, type: Types::String | Types::Nil, default: proc { nil }
 
         def call
-          return Failure(:invalid_resource_owner) unless resource_owner.respond_to?(:access_tokens)
+          return Failure(error: :invalid_resource_owner) unless resource_owner.respond_to?(:access_tokens)
 
           devise_api_token = yield create_devise_api_token
 

data/app/services/devise/api/tokens_service/refresh.rb

@@ -8,7 +8,7 @@ module Devise
         option :resource_owner, default: proc { devise_api_token.resource_owner }
 
         def call
-          return Failure(:expired_refresh_token) if devise_api_token.refresh_token_expired?
+          return Failure(error: :expired_refresh_token) if devise_api_token.refresh_token_expired?
 
           devise_api_token = yield create_devise_api_token
           Success(devise_api_token)

data/config/locales/en.yml

@@ -8,6 +8,7 @@ en:
         expired_refresh_token: "Refresh token has expired"
         revoked_token: "Token has been revoked"
         refresh_token_disabled: "Refresh token is disabled for this application"
+        sign_up_disabled: "Sign up is disabled for this application"
         invalid_refresh_token: "Refresh token is invalid"
         invalid_email: "Email is invalid"
         invalid_resource_owner: "Resource owner is invalid"

data/lib/devise/api/configuration.rb

@@ -20,6 +20,11 @@ module Devise
         setting :expires_in_infinite, default: proc { |_resource_owner| false }, reader: true
       end
 
+      setting :sign_up, reader: true do
+        setting :enabled, default: true, reader: true
+        setting :extra_fields, default: [], reader: true
+      end
+
       setting :authorization, reader: true do
         setting :key, default: 'Authorization', reader: true
         setting :scheme, default: 'Bearer', reader: true

data/lib/devise/api/controllers/helpers.rb

@@ -38,18 +38,11 @@ module Devise
         end
 
         def current_devise_api_token
-          token = find_devise_api_token
+          return @current_devise_api_token if @current_devise_api_token
 
+          token = find_devise_api_token
           devise_api_token_model = Devise.api.config.base_token_model.constantize
-
-          if Devise.api.config.refresh_token.enabled
-            return devise_api_token_model
-                   .where(access_token: token)
-                   .or(devise_api_token_model.where(refresh_token: token))
-                     &.first
-          end
-
-          devise_api_token_model.find_by(access_token: token)
+          @current_devise_api_token = devise_api_token_model.find_by(access_token: token)
         end
 
         def current_devise_api_user
@@ -58,6 +51,10 @@ module Devise
 
         private
 
+        def resource_class
+          current_devise_api_user&.class
+        end
+
         def extract_devise_api_token_from_params
           params[Devise.api.config.authorization.params_key]
         end

data/lib/devise/api/responses/error_response.rb

@@ -12,6 +12,7 @@ module Devise
           expired_refresh_token
           revoked_token
           refresh_token_disabled
+          sign_up_disabled
           invalid_refresh_token
           invalid_email
           invalid_resource_owner
@@ -112,6 +113,7 @@ module Devise
           invalid_email_error? ||
             invalid_refresh_token_error? ||
             refresh_token_disabled_error? ||
+            sign_up_disabled_error? ||
             invalid_resource_owner_error?
         end
       end

data/lib/devise/api/responses/token_response.rb

@@ -41,15 +41,19 @@ module Devise
             refresh_token: Devise.api.config.refresh_token.enabled ? token.refresh_token : nil,
             expires_in: token.expires_in,
             token_type: ::Devise.api.config.authorization.scheme,
-            resource_owner: {
-              id: resource_owner.id,
-              email: resource_owner.email,
-              created_at: resource_owner.created_at,
-              updated_at: resource_owner.updated_at
-            }
+            resource_owner: default_resource_owner
           }.compact
         end
 
+        def default_resource_owner
+          keys_to_extract = %i[id email created_at updated_at]
+          if Devise.api.config.sign_up.extra_fields.present?
+            keys_to_extract |= Devise.api.config.sign_up.extra_fields.map(&:to_sym)
+          end
+
+          resource_owner.slice(*keys_to_extract)
+        end
+
         def status
           return :created if sign_up_action?
           return :no_content if revoke_action?

data/lib/devise/api/token.rb

@@ -41,7 +41,7 @@ module Devise
       end
 
       def inactive?
-        revoked? && expired?
+        revoked? || expired?
       end
 
       def expired?
@@ -51,7 +51,7 @@ module Devise
       end
 
       def refresh_token_expired?
-        return false unless Devise.api.config.refresh_token.expires_in_infinite.call(resource_owner)
+        return false if Devise.api.config.refresh_token.expires_in_infinite.call(resource_owner)
 
         Time.now.utc > refresh_token_expires_at
       end

data/lib/devise/api/version.rb

@@ -2,6 +2,6 @@
 
 module Devise
   module Api
-    VERSION = '0.1.2'
+    VERSION = '0.2.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise-api
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.2.0
 platform: ruby
 authors:
 - nejdetkadir
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-05-30 00:00:00.000000000 Z
+date: 2024-09-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: devise
@@ -166,7 +166,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.12
+rubygems_version: 3.5.18
 signing_key:
 specification_version: 4
 summary: The devise-api gem is a convenient way to add authentication to your Ruby