devise-api 0.1.2 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4f6b2f86ff9cf332790f64f74212b25afff00bc6ff02ffe66389925db4b8fdc6
-  data.tar.gz: a7e8420897cf4e587a73a297d2121fcd0d20f4750deb01e9a7685bf4e635059b
+  metadata.gz: 7d47e2be72c7d15e0c0de4535943a208d8d37e7d2b801de167ccf5f5c8e3d08e
+  data.tar.gz: 87d42ee2c7784370789032608d0caa634f5a703c7c4cbb15139c82d34ca26664
 SHA512:
-  metadata.gz: d5a5ec029117561416f93e6748f278f8489aeef2ec4ce832bce7136790a7587d93de2f5490bbbbfe4a202ccb4275c2f371012e435fdb7cb077999189372039f5
-  data.tar.gz: 43cad74cafb53ce017ebcf1e7ae41e250138eb9d8b0407ee89baf4ed8e2137394d4008f60c7c4f1f7116859aca43571361906a95ebbc1888348f71884f03a817
+  metadata.gz: 6b6045dbf6c5906a5ef70de320d39df12f79b1c7599ce91851c98e61be2449959b0f7e263ad3a795d21070d56b9a84944d4799e1a5156fee8ae90039f8c9642e
+  data.tar.gz: b92e03c4fdb2d18eb3d3cf1ca690782e9f9149362b27b4535ccae3c739dbae3e14550b9e5d4535da6a3aa7658ee25936b59e49c937a3093b90b88d9477ca0f13

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    devise-api (0.1.2)
+    devise-api (0.1.3)
       devise (>= 4.7.2)
       dry-configurable (~> 1.0, >= 1.0.1)
       dry-initializer (>= 3.1.1)

data/README.md

@@ -91,6 +91,8 @@ Devise.setup do |config|
     api.refresh_token.generator = ->(_resource_owner) { Devise.friendly_token(60) }
     api.refresh_token.expires_in_infinite = ->(_resource_owner) { false }
 
+    # Sign up
+    api.sign_up.enabled = true
 
     # Authorization
     api.authorization.key = 'Authorization'

data/app/controllers/devise/api/tokens_controller.rb

@@ -1,15 +1,23 @@
 # frozen_string_literal: true
 
+# rubocop:disable Metrics/ClassLength
 module Devise
   module Api
     class TokensController < Devise.api.config.base_controller.constantize
       skip_before_action :verify_authenticity_token, raise: false
-      before_action :authenticate_devise_api_token!, only: %i[info refresh]
+      before_action :authenticate_devise_api_token!, only: %i[info]
 
       respond_to :json
 
       # rubocop:disable Metrics/AbcSize
       def sign_up
+        unless Devise.api.config.sign_up.enabled
+          error_response = Devise::Api::Responses::ErrorResponse.new(request, error: :sign_up_disabled,
+                                                                              resource_class: resource_class)
+
+          return render json: error_response.body, status: error_response.status
+        end
+
         Devise.api.config.before_sign_up.call(sign_up_params, request, resource_class)
 
         service = Devise::Api::ResourceOwnerService::SignUp.new(params: sign_up_params,
@@ -103,9 +111,23 @@ module Devise
           return render json: error_response.body, status: error_response.status
         end
 
-        Devise.api.config.before_refresh.call(current_devise_api_token, request)
+        if current_devise_api_refresh_token.blank?
+          error_response = Devise::Api::Responses::ErrorResponse.new(request, error: :invalid_token,
+                                                                              resource_class: resource_class)
+
+          return render json: error_response.body, status: error_response.status
+        end
+
+        if current_devise_api_refresh_token.revoked?
+          error_response = Devise::Api::Responses::ErrorResponse.new(request, error: :revoked_token,
+                                                                              resource_class: resource_class)
+
+          render json: error_response.body, status: error_response.status
+        end
+
+        Devise.api.config.before_refresh.call(current_devise_api_refresh_token, request)
 
-        service = Devise::Api::TokensService::Refresh.new(devise_api_token: current_devise_api_token).call
+        service = Devise::Api::TokensService::Refresh.new(devise_api_token: current_devise_api_refresh_token).call
 
         if service.success?
           token_response = Devise::Api::Responses::TokenResponse.new(request, token: service.success,
@@ -141,6 +163,15 @@ module Devise
 
         resource_owner.update_tracked_fields!(request)
       end
+
+      def current_devise_api_refresh_token
+        return @current_devise_api_refresh_token if @current_devise_api_refresh_token
+
+        token = find_devise_api_token
+        devise_api_token_model = Devise.api.config.base_token_model.constantize
+        @current_devise_api_refresh_token = devise_api_token_model.find_by(refresh_token: token)
+      end
     end
   end
 end
+# rubocop:enable Metrics/ClassLength

data/app/services/devise/api/tokens_service/create.rb

@@ -8,7 +8,7 @@ module Devise
         option :previous_refresh_token, type: Types::String | Types::Nil, default: proc { nil }
 
         def call
-          return Failure(:invalid_resource_owner) unless resource_owner.respond_to?(:access_tokens)
+          return Failure(error: :invalid_resource_owner) unless resource_owner.respond_to?(:access_tokens)
 
           devise_api_token = yield create_devise_api_token
 

data/app/services/devise/api/tokens_service/refresh.rb

@@ -8,7 +8,7 @@ module Devise
         option :resource_owner, default: proc { devise_api_token.resource_owner }
 
         def call
-          return Failure(:expired_refresh_token) if devise_api_token.refresh_token_expired?
+          return Failure(error: :expired_refresh_token) if devise_api_token.refresh_token_expired?
 
           devise_api_token = yield create_devise_api_token
           Success(devise_api_token)

data/config/locales/en.yml

@@ -8,6 +8,7 @@ en:
         expired_refresh_token: "Refresh token has expired"
         revoked_token: "Token has been revoked"
         refresh_token_disabled: "Refresh token is disabled for this application"
+        sign_up_disabled: "Sign up is disabled for this application"
         invalid_refresh_token: "Refresh token is invalid"
         invalid_email: "Email is invalid"
         invalid_resource_owner: "Resource owner is invalid"

data/lib/devise/api/configuration.rb

@@ -20,6 +20,10 @@ module Devise
         setting :expires_in_infinite, default: proc { |_resource_owner| false }, reader: true
       end
 
+      setting :sign_up, reader: true do
+        setting :enabled, default: true, reader: true
+      end
+
       setting :authorization, reader: true do
         setting :key, default: 'Authorization', reader: true
         setting :scheme, default: 'Bearer', reader: true

data/lib/devise/api/controllers/helpers.rb

@@ -38,18 +38,11 @@ module Devise
         end
 
         def current_devise_api_token
-          token = find_devise_api_token
+          return @current_devise_api_token if @current_devise_api_token
 
+          token = find_devise_api_token
           devise_api_token_model = Devise.api.config.base_token_model.constantize
-
-          if Devise.api.config.refresh_token.enabled
-            return devise_api_token_model
-                   .where(access_token: token)
-                   .or(devise_api_token_model.where(refresh_token: token))
-                     &.first
-          end
-
-          devise_api_token_model.find_by(access_token: token)
+          @current_devise_api_token = devise_api_token_model.find_by(access_token: token)
         end
 
         def current_devise_api_user
@@ -58,6 +51,10 @@ module Devise
 
         private
 
+        def resource_class
+          current_devise_api_user&.class
+        end
+
         def extract_devise_api_token_from_params
           params[Devise.api.config.authorization.params_key]
         end

data/lib/devise/api/responses/error_response.rb

@@ -12,6 +12,7 @@ module Devise
           expired_refresh_token
           revoked_token
           refresh_token_disabled
+          sign_up_disabled
           invalid_refresh_token
           invalid_email
           invalid_resource_owner
@@ -112,6 +113,7 @@ module Devise
           invalid_email_error? ||
             invalid_refresh_token_error? ||
             refresh_token_disabled_error? ||
+            sign_up_disabled_error? ||
             invalid_resource_owner_error?
         end
       end

data/lib/devise/api/token.rb

@@ -41,7 +41,7 @@ module Devise
       end
 
       def inactive?
-        revoked? && expired?
+        revoked? || expired?
       end
 
       def expired?
@@ -51,7 +51,7 @@ module Devise
       end
 
       def refresh_token_expired?
-        return false unless Devise.api.config.refresh_token.expires_in_infinite.call(resource_owner)
+        return false if Devise.api.config.refresh_token.expires_in_infinite.call(resource_owner)
 
         Time.now.utc > refresh_token_expires_at
       end

data/lib/devise/api/version.rb

@@ -2,6 +2,6 @@
 
 module Devise
   module Api
-    VERSION = '0.1.2'
+    VERSION = '0.1.3'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise-api
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
 platform: ruby
 authors:
 - nejdetkadir
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-05-30 00:00:00.000000000 Z
+date: 2023-08-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: devise