devise_jwt_auth 0.1.0

data/lib/devise_jwt_auth.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+require 'devise'
+
+module DeviseJwtAuth
+end
+
+require 'devise_jwt_auth/engine'
+require 'devise_jwt_auth/controllers/helpers'
+require 'devise_jwt_auth/controllers/url_helpers'
+require 'devise_jwt_auth/url'
+require 'devise_jwt_auth/errors'
+require 'devise_jwt_auth/blacklist'
+require 'devise_jwt_auth/token_factory'

data/lib/devise_jwt_auth/blacklist.rb

@@ -0,0 +1,2 @@
+# don't serialize tokens
+Devise::Models::Authenticatable::BLACKLIST_FOR_SERIALIZATION << :tokens

data/lib/devise_jwt_auth/controllers/helpers.rb

@@ -0,0 +1,161 @@
+# frozen_string_literal: true
+
+module DeviseJwtAuth
+  module Controllers
+    module Helpers
+      extend ActiveSupport::Concern
+
+      module ClassMethods
+        # Define authentication filters and accessor helpers for a group of mappings.
+        # These methods are useful when you are working with multiple mappings that
+        # share some functionality. They are pretty much the same as the ones
+        # defined for normal mappings.
+        #
+        # Example:
+        #
+        #   inside BlogsController (or any other controller, it doesn't matter which):
+        #     devise_group :blogger, contains: [:user, :admin]
+        #
+        #   Generated methods:
+        #     authenticate_blogger!             # Redirects unless user or admin are signed in
+        #     blogger_signed_in?                # Checks whether there is either a user or an admin signed in
+        #     current_blogger                   # Currently signed in user or admin
+        #     current_bloggers                  # Currently signed in user and admin
+        #     render_authenticate_error         # Render error unless user or admin are signed in
+        #
+        #   Use:
+        #     before_action :authenticate_blogger!              # Redirects unless either a user or an admin are authenticated
+        #     before_action ->{ authenticate_blogger! :admin }  # Redirects to the admin login page
+        #     current_blogger :user                             # Preferably returns a User if one is signed in
+        #
+        def devise_jwt_auth_group(group_name, opts = {})
+          mappings = "[#{opts[:contains].map { |m| ":#{m}" }.join(',')}]"
+
+          class_eval <<-METHODS, __FILE__, __LINE__ + 1
+            def authenticate_#{group_name}!(favourite=nil, opts={})
+              unless #{group_name}_signed_in?
+                mappings = #{mappings}
+                mappings.unshift mappings.delete(favourite.to_sym) if favourite
+                mappings.each do |mapping|
+                  set_user_by_token(mapping)
+                end
+
+                unless current_#{group_name}
+                  render_authenticate_error
+                end
+              end
+            end
+
+            def #{group_name}_signed_in?
+              #{mappings}.any? do |mapping|
+                set_user_by_token(mapping)
+              end
+            end
+
+            def current_#{group_name}(favourite=nil)
+              mappings = #{mappings}
+              mappings.unshift mappings.delete(favourite.to_sym) if favourite
+              mappings.each do |mapping|
+                current = set_user_by_token(mapping)
+                return current if current
+              end
+              nil
+            end
+
+            def current_#{group_name.to_s.pluralize}
+              #{mappings}.map do |mapping|
+                set_user_by_token(mapping)
+              end.compact
+            end
+
+            def render_authenticate_error
+              return render json: {
+                errors: [I18n.t('devise.failure.unauthenticated')]
+              }, status: 401
+            end
+
+            if respond_to?(:helper_method)
+              helper_method(
+                "current_#{group_name}",
+                "current_#{group_name.to_s.pluralize}",
+                "#{group_name}_signed_in?",
+                "render_authenticate_error"
+              )
+            end
+          METHODS
+        end
+
+        def log_process_action(payload)
+          payload[:status] ||= 401 unless payload[:exception]
+          super
+        end
+      end
+
+      # Define authentication filters and accessor helpers based on mappings.
+      # These filters should be used inside the controllers as before_actions,
+      # so you can control the scope of the user who should be signed in to
+      # access that specific controller/action.
+      # Example:
+      #
+      #   Roles:
+      #     User
+      #     Admin
+      #
+      #   Generated methods:
+      #     authenticate_user!                   # Signs user in or 401
+      #     authenticate_admin!                  # Signs admin in or 401
+      #     user_signed_in?                      # Checks whether there is a user signed in or not
+      #     admin_signed_in?                     # Checks whether there is an admin signed in or not
+      #     current_user                         # Current signed in user
+      #     current_admin                        # Current signed in admin
+      #     user_session                         # Session data available only to the user scope
+      #     admin_session                        # Session data available only to the admin scope
+      #     render_authenticate_error            # Render error unless user or admin is signed in
+      #
+      #   Use:
+      #     before_action :authenticate_user!  # Tell devise to use :user map
+      #     before_action :authenticate_admin! # Tell devise to use :admin map
+      #
+      def self.define_helpers(mapping) #:nodoc:
+        mapping = mapping.name
+
+        class_eval <<-METHODS, __FILE__, __LINE__ + 1
+          def authenticate_#{mapping}!(opts={})
+            unless current_#{mapping}
+              render_authenticate_error
+            end
+          end
+
+          def #{mapping}_signed_in?
+            !!current_#{mapping}
+          end
+
+          def current_#{mapping}
+            @current_#{mapping} ||= set_user_by_token(:#{mapping})
+          end
+
+          def #{mapping}_session
+            current_#{mapping} && warden.session(:#{mapping})
+          end
+
+          def render_authenticate_error
+            return render json: {
+              errors: [I18n.t('devise.failure.unauthenticated')]
+            }, status: 401
+          end
+        METHODS
+
+        ActiveSupport.on_load(:action_controller) do
+          if respond_to?(:helper_method)
+            helper_method(
+              "current_#{mapping}",
+              "#{mapping}_signed_in?",
+              "#{mapping}_session",
+              'render_authenticate_error'
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/lib/devise_jwt_auth/controllers/url_helpers.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module DeviseJwtAuth
+  module Controllers
+    module UrlHelpers
+      def self.define_helpers(mapping)
+      end
+    end
+  end
+end

data/lib/devise_jwt_auth/engine.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+require 'devise_jwt_auth/rails/routes'
+
+module DeviseJwtAuth
+  class Engine < ::Rails::Engine
+    isolate_namespace DeviseJwtAuth
+
+    initializer 'devise_jwt_auth.url_helpers' do
+      Devise.helpers << DeviseJwtAuth::Controllers::Helpers
+    end
+  end
+
+  mattr_accessor :send_new_access_token_on_each_request,
+                 :refresh_token_lifespan,
+                 :access_token_lifespan,
+                 :refresh_token_name,
+                 :access_token_name,
+                 :refresh_token_encryption_key,
+                 :access_token_encryption_key,
+                 :batch_request_buffer_throttle,
+                 :omniauth_prefix,
+                 :default_confirm_success_url,
+                 :default_password_reset_url,
+                 :redirect_whitelist,
+                 :check_current_password_before_update,
+                 :enable_standard_devise_support,
+                 :update_token_version_after_password_reset,
+                 :default_callbacks,
+                 :bypass_sign_in,
+                 :send_confirmation_email,
+                 :require_client_password_reset_token
+
+  self.send_new_access_token_on_each_request     = false
+  self.refresh_token_lifespan                    = 1.week
+  self.access_token_lifespan                     = 1.day
+  self.refresh_token_name                        = 'refresh-token'
+  self.access_token_name                         = 'access-token'
+  self.refresh_token_encryption_key              = 'your-refresh-token-secret-key-here'
+  self.access_token_encryption_key               = 'your-access-token-secret-key-here'
+  self.batch_request_buffer_throttle             = 5.seconds
+  self.omniauth_prefix                           = '/omniauth'
+  self.default_confirm_success_url               = nil
+  self.default_password_reset_url                = nil
+  self.redirect_whitelist                        = nil
+  self.check_current_password_before_update      = false
+  self.enable_standard_devise_support            = false
+  self.update_token_version_after_password_reset = true
+  self.default_callbacks                         = true
+  self.bypass_sign_in                            = true
+  self.send_confirmation_email                   = false
+  self.require_client_password_reset_token       = false
+
+  def self.setup(&block)
+    yield self
+
+    Rails.application.config.after_initialize do
+      if defined?(::OmniAuth)
+        ::OmniAuth::config.path_prefix = Devise.omniauth_path_prefix = omniauth_prefix
+
+        # Omniauth currently does not pass along omniauth.params upon failure redirect
+        # see also: https://github.com/intridea/omniauth/issues/626
+        OmniAuth::FailureEndpoint.class_eval do
+          def redirect_to_failure
+            message_key = env['omniauth.error.type']
+            origin_query_param = env['omniauth.origin'] ? "&origin=#{CGI.escape(env['omniauth.origin'])}" : ''
+            strategy_name_query_param = env['omniauth.error.strategy'] ? "&strategy=#{env['omniauth.error.strategy'].name}" : ''
+            extra_params = env['omniauth.params'] ? "&#{env['omniauth.params'].to_query}" : ''
+            new_path = "#{env['SCRIPT_NAME']}#{OmniAuth.config.path_prefix}/failure?message=#{message_key}#{origin_query_param}#{strategy_name_query_param}#{extra_params}"
+            Rack::Response.new(['302 Moved'], 302, 'Location' => new_path).finish
+          end
+        end
+
+        # Omniauth currently removes omniauth.params during mocked requests
+        # see also: https://github.com/intridea/omniauth/pull/812
+        OmniAuth::Strategy.class_eval do
+          def mock_callback_call
+            setup_phase
+            @env['omniauth.origin'] = session.delete('omniauth.origin')
+            @env['omniauth.origin'] = nil if env['omniauth.origin'] == ''
+            @env['omniauth.params'] = session.delete('omniauth.params') || {}
+            mocked_auth = OmniAuth.mock_auth_for(name.to_s)
+            if mocked_auth.is_a?(Symbol)
+              fail!(mocked_auth)
+            else
+              @env['omniauth.auth'] = mocked_auth
+              OmniAuth.config.before_callback_phase.call(@env) if OmniAuth.config.before_callback_phase
+              call_app!
+            end
+          end
+        end
+
+      end
+    end
+  end
+end

data/lib/devise_jwt_auth/errors.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module DeviseJwtAuth
+  module Errors
+    class NoResourceDefinedError < StandardError; end
+    class InvalidModel < StandardError; end
+  end
+end

data/lib/devise_jwt_auth/rails/routes.rb

@@ -0,0 +1,118 @@
+# frozen_string_literal: true
+
+module ActionDispatch::Routing
+  class Mapper
+    def mount_devise_jwt_auth_for(resource, opts)
+      # ensure objects exist to simplify attr checks
+      opts[:controllers] ||= {}
+      opts[:skip]        ||= []
+
+      # check for ctrl overrides, fall back to defaults
+      sessions_ctrl          = opts[:controllers][:sessions] || 'devise_jwt_auth/sessions'
+      registrations_ctrl     = opts[:controllers][:registrations] || 'devise_jwt_auth/registrations'
+      passwords_ctrl         = opts[:controllers][:passwords] || 'devise_jwt_auth/passwords'
+      confirmations_ctrl     = opts[:controllers][:confirmations] || 'devise_jwt_auth/confirmations'
+      # token_validations_ctrl = opts[:controllers][:token_validations] || 'devise_jwt_auth/token_validations'
+      refresh_token_ctrl     = opts[:controllers][:refresh_token] || 'devise_jwt_auth/refresh_token'
+      omniauth_ctrl          = opts[:controllers][:omniauth_callbacks] || 'devise_jwt_auth/omniauth_callbacks'
+      unlocks_ctrl           = opts[:controllers][:unlocks] || 'devise_jwt_auth/unlocks'
+
+      # define devise controller mappings
+      controllers = { sessions: sessions_ctrl,
+                      registrations: registrations_ctrl,
+                      passwords: passwords_ctrl,
+                      confirmations: confirmations_ctrl }
+
+      controllers[:unlocks] = unlocks_ctrl if unlocks_ctrl
+
+      # remove any unwanted devise modules
+      opts[:skip].each{ |item| controllers.delete(item) }
+
+      devise_for resource.pluralize.underscore.gsub('/', '_').to_sym,
+                 class_name: resource,
+                 module: :devise,
+                 path: opts[:at].to_s,
+                 controllers: controllers,
+                 skip: opts[:skip] + [:omniauth_callbacks]
+
+      unnest_namespace do
+        # get full url path as if it were namespaced
+        full_path = "#{@scope[:path]}/#{opts[:at]}"
+
+        # get namespace name
+        namespace_name = @scope[:as]
+
+        # clear scope so controller routes aren't namespaced
+        @scope = ActionDispatch::Routing::Mapper::Scope.new(
+          path:         '',
+          shallow_path: '',
+          constraints:  {},
+          defaults:     {},
+          options:      {},
+          parent:       nil
+        )
+
+        mapping_name = resource.underscore.gsub('/', '_')
+        mapping_name = "#{namespace_name}_#{mapping_name}" if namespace_name
+
+        devise_scope mapping_name.to_sym do
+          # path to refresh access tokens
+          get "#{full_path}/refresh_token", controller: refresh_token_ctrl.to_s, action: 'show' if !opts[:skip].include?(:refresh_token)
+          # get "#{full_path}/validate_token", controller: token_validations_ctrl.to_s, action: 'validate_token' if !opts[:skip].include?(:token_validations)
+
+          # omniauth routes. only define if omniauth is installed and not skipped.
+          if defined?(::OmniAuth) && !opts[:skip].include?(:omniauth_callbacks)
+            match "#{full_path}/failure",             controller: omniauth_ctrl, action: 'omniauth_failure', via: [:get]
+            match "#{full_path}/:provider/callback",  controller: omniauth_ctrl, action: 'omniauth_success', via: [:get]
+
+            match "#{DeviseJwtAuth.omniauth_prefix}/:provider/callback", controller: omniauth_ctrl, action: 'redirect_callbacks', via: [:get, :post]
+            match "#{DeviseJwtAuth.omniauth_prefix}/failure", controller: omniauth_ctrl, action: 'omniauth_failure', via: [:get, :post]
+
+            # preserve the resource class thru oauth authentication by setting name of
+            # resource as "resource_class" param
+            match "#{full_path}/:provider", to: redirect{ |params, request|
+              # get the current querystring
+              qs = CGI::parse(request.env['QUERY_STRING'])
+
+              # append name of current resource
+              qs['resource_class'] = [resource]
+              qs['namespace_name'] = [namespace_name] if namespace_name
+
+              set_omniauth_path_prefix!(DeviseJwtAuth.omniauth_prefix)
+
+              redirect_params = {}.tap { |hash| qs.each{ |k, v| hash[k] = v.first } }
+
+              if DeviseJwtAuth.redirect_whitelist
+                redirect_url = request.params['auth_origin_url']
+                unless DeviseJwtAuth::Url.whitelisted?(redirect_url)
+                  message = I18n.t(
+                    'devise_jwt_auth.registrations.redirect_url_not_allowed',
+                    redirect_url: redirect_url
+                  )
+                  redirect_params['message'] = message
+                  next "#{::OmniAuth.config.path_prefix}/failure?#{redirect_params.to_param}"
+                end
+              end
+
+              # re-construct the path for omniauth
+              "#{::OmniAuth.config.path_prefix}/#{params[:provider]}?#{redirect_params.to_param}"
+            }, via: [:get]
+          end
+        end
+      end
+    end
+
+    # this allows us to use namespaced paths without namespacing the routes
+    def unnest_namespace
+      current_scope = @scope.dup
+      yield
+    ensure
+      @scope = current_scope
+    end
+
+    # ignore error about omniauth/multiple model support
+    def set_omniauth_path_prefix!(path_prefix)
+      ::OmniAuth.config.path_prefix = path_prefix
+    end
+  end
+end

data/lib/devise_jwt_auth/token_factory.rb

@@ -0,0 +1,51 @@
+require 'jwt'
+
+module DeviseJwtAuth
+  # A token management factory which allow generate token objects and check them.
+  module TokenFactory
+
+    def self.create_refresh_token(payload)
+      if payload[:exp].blank? && payload['exp'].blank?
+        payload[:exp] = (Time.zone.now + DeviseJwtAuth.refresh_token_lifespan).to_i
+      end
+
+      JWT.encode payload, DeviseJwtAuth.refresh_token_encryption_key
+    end
+
+    def self.create_access_token(payload)
+      if payload[:exp].blank? && payload['exp'].blank?
+        payload[:exp] = (Time.zone.now + DeviseJwtAuth.access_token_lifespan).to_i
+      end
+
+      JWT.encode payload, DeviseJwtAuth.access_token_encryption_key
+    end
+
+    def self.decode_refresh_token(token)
+      JWT.decode(token, DeviseJwtAuth.refresh_token_encryption_key).first
+    rescue JWT::ExpiredSignature
+      {}
+    rescue JWT::DecodeError
+      {}
+    rescue JWT::VerificationError
+      {}
+    rescue NoMethodError
+      {}
+    rescue TypeError
+      {}
+    end
+    
+    def self.decode_access_token(token)
+      JWT.decode(token, DeviseJwtAuth.access_token_encryption_key).first
+    rescue JWT::ExpiredSignature
+      {}
+    rescue JWT::DecodeError
+      {}
+    rescue JWT::VerificationError
+      {}
+    rescue NoMethodError
+      {}
+    rescue TypeError
+      {}
+    end
+  end
+end