devise_jwt_auth 0.1.0

data/app/controllers/devise_jwt_auth/refresh_token_controller.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module DeviseJwtAuth
+  class RefreshTokenController < DeviseJwtAuth::ApplicationController
+    before_action :set_user_by_refresh_token
+
+    def show
+      if @resource
+        yield @resource if block_given?
+        render_refresh_token_success
+      else
+        render_refresh_token_error
+      end
+    end
+
+    protected
+    def resource_data
+      response_data = @resource.as_json
+      response_data['type'] = @resource.class.name.parameterize if json_api?
+      response_data
+    end
+
+    def render_refresh_token_success
+      response_data = {
+        status: 'success',
+        data:   resource_data
+      }
+
+      response_data.merge!(@resource.create_named_token_pair) if active_for_authentication?
+      render json: response_data
+    end
+
+    def render_refresh_token_error
+      render_error(401, I18n.t('devise_jwt_auth.token_validations.invalid'))
+    end
+
+    def active_for_authentication?
+      !@resource.respond_to?(:active_for_authentication?) || @resource.active_for_authentication?
+    end
+  end
+end

data/app/controllers/devise_jwt_auth/registrations_controller.rb

@@ -0,0 +1,203 @@
+# frozen_string_literal: true
+
+module DeviseJwtAuth
+  class RegistrationsController < DeviseJwtAuth::ApplicationController
+    before_action :set_user_by_token, only: [:destroy, :update]
+    before_action :validate_sign_up_params, only: :create
+    before_action :validate_account_update_params, only: :update
+    # skip_after_action :update_auth_header, only: [:create, :destroy]
+
+    def create
+      build_resource
+
+      unless @resource.present?
+        raise DeviseJwtAuth::Errors::NoResourceDefinedError,
+              "#{self.class.name} #build_resource does not define @resource,"\
+              ' execution stopped.'
+      end
+
+      # give redirect value from params priority
+      @redirect_url = params.fetch(
+        :confirm_success_url,
+        DeviseJwtAuth.default_confirm_success_url
+      )
+
+      # success redirect url is required
+      if confirmable_enabled? && !@redirect_url
+        return render_create_error_missing_confirm_success_url
+      end
+
+      # if whitelist is set, validate redirect_url against whitelist
+      return render_create_error_redirect_url_not_allowed if blacklisted_redirect_url?(@redirect_url)
+
+      # override email confirmation, must be sent manually from ctrl
+      callback_name = defined?(ActiveRecord) && resource_class < ActiveRecord::Base ? :commit : :create
+      resource_class.set_callback(callback_name, :after, :send_on_create_confirmation_instructions)
+      resource_class.skip_callback(callback_name, :after, :send_on_create_confirmation_instructions)
+
+      if @resource.respond_to? :skip_confirmation_notification!
+        # Fix duplicate e-mails by disabling Devise confirmation e-mail
+        @resource.skip_confirmation_notification!
+      end
+
+      if @resource.save
+        yield @resource if block_given?
+
+        unless @resource.confirmed?
+          # user will require email authentication
+          @resource.send_confirmation_instructions({
+            client_config: params[:config_name],
+            redirect_url: @redirect_url
+          })
+        end
+
+        update_refresh_token_cookie if active_for_authentication?
+
+        render_create_success
+      else
+        clean_up_passwords @resource
+        render_create_error
+      end
+    end
+
+    def update
+      if @resource
+        if @resource.send(resource_update_method, account_update_params)
+          yield @resource if block_given?
+          render_update_success
+        else
+          render_update_error
+        end
+      else
+        render_update_error_user_not_found
+      end
+    end
+
+    def destroy
+      if @resource
+        @resource.destroy
+        yield @resource if block_given?
+        render_destroy_success
+      else
+        render_destroy_error
+      end
+    end
+
+    def sign_up_params
+      params.permit(*params_for_resource(:sign_up))
+    end
+
+    def account_update_params
+      params.permit(*params_for_resource(:account_update))
+    end
+
+    protected
+
+    def build_resource
+      @resource            = resource_class.new(sign_up_params)
+      @resource.provider   = provider
+
+      # honor devise configuration for case_insensitive_keys
+      if resource_class.case_insensitive_keys.include?(:email)
+        @resource.email = sign_up_params[:email].try(:downcase)
+      else
+        @resource.email = sign_up_params[:email]
+      end
+    end
+
+    def render_create_error_missing_confirm_success_url
+      response = {
+        status: 'error',
+        data:   resource_data
+      }
+      message = I18n.t('devise_jwt_auth.registrations.missing_confirm_success_url')
+      render_error(422, message, response)
+    end
+
+    def render_create_error_redirect_url_not_allowed
+      response = {
+        status: 'error',
+        data:   resource_data
+      }
+      message = I18n.t('devise_jwt_auth.registrations.redirect_url_not_allowed', redirect_url: @redirect_url)
+      render_error(422, message, response)
+    end
+
+    def render_create_success
+      response_data = {
+        status: 'success',
+        data:   resource_data
+      }
+
+      response_data.merge!(@resource.create_named_token_pair) if active_for_authentication?
+      render json: response_data
+    end
+
+    def render_create_error
+      render json: {
+        status: 'error',
+        data:   resource_data,
+        errors: resource_errors
+      }, status: 422
+    end
+
+    def render_update_success
+      render json: {
+        status: 'success',
+        data:   resource_data
+      }
+    end
+
+    def render_update_error
+      render json: {
+        status: 'error',
+        errors: resource_errors
+      }, status: 422
+    end
+
+    def render_update_error_user_not_found
+      render_error(404, I18n.t('devise_jwt_auth.registrations.user_not_found'), status: 'error')
+    end
+
+    def render_destroy_success
+      render json: {
+        status: 'success',
+        message: I18n.t('devise_jwt_auth.registrations.account_with_uid_destroyed', uid: @resource.uid)
+      }
+    end
+
+    def render_destroy_error
+      render_error(404, I18n.t('devise_jwt_auth.registrations.account_to_destroy_not_found'), status: 'error')
+    end
+
+    private
+
+    def resource_update_method
+      if DeviseJwtAuth.check_current_password_before_update == :attributes
+        'update_with_password'
+      elsif DeviseJwtAuth.check_current_password_before_update == :password && account_update_params.key?(:password)
+        'update_with_password'
+      elsif account_update_params.key?(:current_password)
+        'update_with_password'
+      else
+        'update'
+      end
+    end
+
+    def validate_sign_up_params
+      validate_post_data sign_up_params, I18n.t('errors.messages.validate_sign_up_params')
+    end
+
+    def validate_account_update_params
+      validate_post_data account_update_params, I18n.t('errors.messages.validate_account_update_params')
+    end
+
+    def validate_post_data which, message
+      render_error(:unprocessable_entity, message, status: 'error') if which.empty?
+    end
+
+    def active_for_authentication?
+      !@resource.respond_to?(:active_for_authentication?) || @resource.active_for_authentication?
+    end
+  end
+end

data/app/controllers/devise_jwt_auth/sessions_controller.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+# see http://www.emilsoman.com/blog/2013/05/18/building-a-tested/
+module DeviseJwtAuth
+  class SessionsController < DeviseJwtAuth::ApplicationController
+    before_action :set_user_by_token, only: [:destroy]
+    after_action :reset_session, only: [:destroy]
+
+    def new
+      render_new_error
+    end
+
+    def create
+      # Check
+      field = (resource_params.keys.map(&:to_sym) & resource_class.authentication_keys).first
+
+      @resource = nil
+      if field
+        q_value = get_case_insensitive_field_from_resource_params(field)
+
+        @resource = find_resource(field, q_value)
+      end
+
+      if @resource && valid_params?(field, q_value) && (!@resource.respond_to?(:active_for_authentication?) || @resource.active_for_authentication?)
+        valid_password = @resource.valid_password?(resource_params[:password])
+        if (@resource.respond_to?(:valid_for_authentication?) && !@resource.valid_for_authentication? { valid_password }) || !valid_password
+          return render_create_error_bad_credentials
+        end
+        @token = @resource.create_token
+        @resource.save
+
+        sign_in(:user, @resource, store: false, bypass: false)
+
+        yield @resource if block_given?
+
+        render_create_success
+      elsif @resource && !(!@resource.respond_to?(:active_for_authentication?) || @resource.active_for_authentication?)
+        if @resource.respond_to?(:locked_at) && @resource.locked_at
+          render_create_error_account_locked
+        else
+          render_create_error_not_confirmed
+        end
+      else
+        render_create_error_bad_credentials
+      end
+    end
+
+    def destroy
+      # remove auth instance variables so that after_action does not run
+      user = remove_instance_variable(:@resource) if @resource
+      # client = @token.client if @token.client
+      # @token.clear!
+
+      if user # && client && user.tokens[client]
+        # user.tokens.delete(client)
+        # user.save!
+
+        yield user if block_given?
+
+        render_destroy_success
+      else
+        render_destroy_error
+      end
+    end
+
+    protected
+
+    def valid_params?(key, val)
+      resource_params[:password] && key && val
+    end
+
+    def get_auth_params
+      auth_key = nil
+      auth_val = nil
+
+      # iterate thru allowed auth keys, use first found
+      resource_class.authentication_keys.each do |k|
+        if resource_params[k]
+          auth_val = resource_params[k]
+          auth_key = k
+          break
+        end
+      end
+
+      # honor devise configuration for case_insensitive_keys
+      if resource_class.case_insensitive_keys.include?(auth_key)
+        auth_val.downcase!
+      end
+
+      { key: auth_key, val: auth_val }
+    end
+
+    def render_new_error
+      render_error(405, I18n.t('devise_jwt_auth.sessions.not_supported'))
+    end
+
+    def render_create_success
+      render json: {
+        data: resource_data(resource_json: @resource.token_validation_response)
+      }
+    end
+
+    def render_create_error_not_confirmed
+      render_error(401, I18n.t('devise_jwt_auth.sessions.not_confirmed', email: @resource.email))
+    end
+
+    def render_create_error_account_locked
+      render_error(401, I18n.t('devise.mailer.unlock_instructions.account_lock_msg'))
+    end
+
+    def render_create_error_bad_credentials
+      render_error(401, I18n.t('devise_jwt_auth.sessions.bad_credentials'))
+    end
+
+    def render_destroy_success
+      render json: {
+        success:true
+      }, status: 200
+    end
+
+    def render_destroy_error
+      render_error(404, I18n.t('devise_jwt_auth.sessions.user_not_found'))
+    end
+
+    private
+
+    def resource_params
+      params.permit(*params_for_resource(:sign_in))
+    end
+  end
+end

data/app/controllers/devise_jwt_auth/unlocks_controller.rb

@@ -0,0 +1,99 @@
+# frozen_string_literal: true
+
+module DeviseJwtAuth
+  class UnlocksController < DeviseJwtAuth::ApplicationController
+    # skip_after_action :update_auth_header, only: [:create, :show]
+
+    # this action is responsible for generating unlock tokens and
+    # sending emails
+    def create
+      return render_create_error_missing_email unless resource_params[:email]
+
+      @email = get_case_insensitive_field_from_resource_params(:email)
+      @resource = find_resource(:email, @email)
+
+      if @resource
+        yield @resource if block_given?
+
+        @resource.send_unlock_instructions(
+          email: @email,
+          provider: 'email',
+          client_config: params[:config_name]
+        )
+
+        if @resource.errors.empty?
+          return render_create_success
+        else
+          render_create_error @resource.errors
+        end
+      else
+        render_not_found_error
+      end
+    end
+
+    def show
+      @resource = resource_class.unlock_access_by_token(params[:unlock_token])
+
+      if @resource.persisted?
+        # token = @resource.create_token
+        # @resource.save!
+        yield @resource if block_given?
+
+        redirect_header_options = { unlock: true }
+        redirect_headers = @resource.create_named_token_pair.
+                             merge(redirect_header_options)
+
+        # TODO: add a refresh token cookie in the response.
+        update_refresh_token_cookie
+        redirect_url = after_unlock_path_for(@resource)
+        redirect_to_link = DeviseJwtAuth::Url.generate(redirect_url, redirect_headers)
+
+        # redirect_headers = build_redirect_headers(token.token,
+        #                                           token.client,
+        #                                           redirect_header_options)
+        # redirect_to(@resource.build_auth_url(after_unlock_path_for(@resource),
+        #                                      redirect_headers))
+
+        redirect_to redirect_to_link
+      else
+        render_show_error
+      end
+    end
+
+    private
+    def after_unlock_path_for(resource)
+      #TODO: This should probably be a configuration option at the very least.
+      '/'
+    end
+
+    def render_create_error_missing_email
+      render_error(401, I18n.t('devise_jwt_auth.unlocks.missing_email'))
+    end
+
+    def render_create_success
+      render json: {
+        success: true,
+        message: I18n.t('devise_jwt_auth.unlocks.sended', email: @email)
+      }
+    end
+
+    def render_create_error(errors)
+      render json: {
+        success: false,
+        errors: errors
+      }, status: 400
+    end
+
+    def render_show_error
+      raise ActionController::RoutingError, 'Not Found'
+    end
+
+    def render_not_found_error
+      render_error(404, I18n.t('devise_jwt_auth.unlocks.user_not_found', email: @email))
+    end
+
+    def resource_params
+      params.permit(:email, :unlock_token, :config)
+    end
+  end
+end