devise_token_auth 0.1.1 → 1.3.0

data/app/controllers/devise_token_auth/registrations_controller.rb

@@ -1,34 +1,205 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth
-  class RegistrationsController < Devise::RegistrationsController
-    include Devise::Controllers::Helpers
+  class RegistrationsController < DeviseTokenAuth::ApplicationController
+    before_action :set_user_by_token, only: [:destroy, :update]
+    before_action :validate_sign_up_params, only: :create
+    before_action :validate_account_update_params, only: :update
+    skip_after_action :update_auth_header, only: [:create, :destroy]
 
-    prepend_before_filter :require_no_authentication, :only => [ :create ]
+    def create
+      build_resource
 
-    respond_to :json
+      unless @resource.present?
+        raise DeviseTokenAuth::Errors::NoResourceDefinedError,
+              "#{self.class.name} #build_resource does not define @resource,"\
+              ' execution stopped.'
+      end
 
-    def create
-      @resource            = User.new(resource_params)
-      @resource.uid        = resource_params[:email]
-      @resource.provider   = "email"
-      @resource.auth_token = SecureRandom.urlsafe_base64(nil, false)
+      # give redirect value from params priority
+      @redirect_url = params.fetch(
+        :confirm_success_url,
+        DeviseTokenAuth.default_confirm_success_url
+      )
+
+      # success redirect url is required
+      if confirmable_enabled? && !@redirect_url
+        return render_create_error_missing_confirm_success_url
+      end
+
+      # if whitelist is set, validate redirect_url against whitelist
+      return render_create_error_redirect_url_not_allowed if blacklisted_redirect_url?(@redirect_url)
+
+      # override email confirmation, must be sent manually from ctrl
+      callback_name = defined?(ActiveRecord) && resource_class < ActiveRecord::Base ? :commit : :create
+      resource_class.set_callback(callback_name, :after, :send_on_create_confirmation_instructions)
+      resource_class.skip_callback(callback_name, :after, :send_on_create_confirmation_instructions)
+
+      if @resource.respond_to? :skip_confirmation_notification!
+        # Fix duplicate e-mails by disabling Devise confirmation e-mail
+        @resource.skip_confirmation_notification!
+      end
 
       if @resource.save
-        render json: {
-          status: 'success',
-          data:   @resource.as_json
-        }
+        yield @resource if block_given?
+
+        unless @resource.confirmed?
+          # user will require email authentication
+          @resource.send_confirmation_instructions({
+            client_config: params[:config_name],
+            redirect_url: @redirect_url
+          })
+        end
+
+        if active_for_authentication?
+          # email auth has been bypassed, authenticate user
+          @token = @resource.create_token
+          @resource.save!
+          update_auth_header
+        end
+
+        render_create_success
       else
         clean_up_passwords @resource
-        render status: 403, json: {
-          status: 'error',
-          data:   @resource.as_json,
-          errors: @resource.errors.full_messages
-        }
+        render_create_error
+      end
+    end
+
+    def update
+      if @resource
+        if @resource.send(resource_update_method, account_update_params)
+          yield @resource if block_given?
+          render_update_success
+        else
+          render_update_error
+        end
+      else
+        render_update_error_user_not_found
+      end
+    end
+
+    def destroy
+      if @resource
+        @resource.destroy
+        yield @resource if block_given?
+        render_destroy_success
+      else
+        render_destroy_error
+      end
+    end
+
+    def sign_up_params
+      params.permit(*params_for_resource(:sign_up))
+    end
+
+    def account_update_params
+      params.permit(*params_for_resource(:account_update))
+    end
+
+    protected
+
+    def build_resource
+      @resource            = resource_class.new(sign_up_params)
+      @resource.provider   = provider
+
+      # honor devise configuration for case_insensitive_keys
+      if resource_class.case_insensitive_keys.include?(:email)
+        @resource.email = sign_up_params[:email].try(:downcase)
+      else
+        @resource.email = sign_up_params[:email]
+      end
+    end
+
+    def render_create_error_missing_confirm_success_url
+      response = {
+        status: 'error',
+        data:   resource_data
+      }
+      message = I18n.t('devise_token_auth.registrations.missing_confirm_success_url')
+      render_error(422, message, response)
+    end
+
+    def render_create_error_redirect_url_not_allowed
+      response = {
+        status: 'error',
+        data:   resource_data
+      }
+      message = I18n.t('devise_token_auth.registrations.redirect_url_not_allowed', redirect_url: @redirect_url)
+      render_error(422, message, response)
+    end
+
+    def render_create_success
+      render json: {
+        status: 'success',
+        data:   resource_data
+      }
+    end
+
+    def render_create_error
+      render json: {
+        status: 'error',
+        data:   resource_data,
+        errors: resource_errors
+      }, status: 422
+    end
+
+    def render_update_success
+      render json: {
+        status: 'success',
+        data:   resource_data
+      }
+    end
+
+    def render_update_error
+      render json: {
+        status: 'error',
+        errors: resource_errors
+      }, status: 422
+    end
+
+    def render_update_error_user_not_found
+      render_error(404, I18n.t('devise_token_auth.registrations.user_not_found'), status: 'error')
+    end
+
+    def render_destroy_success
+      render json: {
+        status: 'success',
+        message: I18n.t('devise_token_auth.registrations.account_with_uid_destroyed', uid: @resource.uid)
+      }
+    end
+
+    def render_destroy_error
+      render_error(404, I18n.t('devise_token_auth.registrations.account_to_destroy_not_found'), status: 'error')
+    end
+
+    private
+
+    def resource_update_method
+      if DeviseTokenAuth.check_current_password_before_update == :attributes
+        'update_with_password'
+      elsif DeviseTokenAuth.check_current_password_before_update == :password && account_update_params.key?(:password)
+        'update_with_password'
+      elsif account_update_params.key?(:current_password)
+        'update_with_password'
+      else
+        'update'
       end
     end
 
-    def resource_params
-      params.permit(:email, :password, :password_confirmation, :confirm_success_url, :confirm_error_url)
+    def validate_sign_up_params
+      validate_post_data sign_up_params, I18n.t('errors.messages.validate_sign_up_params')
+    end
+
+    def validate_account_update_params
+      validate_post_data account_update_params, I18n.t('errors.messages.validate_account_update_params')
+    end
+
+    def validate_post_data which, message
+      render_error(:unprocessable_entity, message, status: 'error') if which.empty?
+    end
+
+    def active_for_authentication?
+      !@resource.respond_to?(:active_for_authentication?) || @resource.active_for_authentication?
     end
   end
 end

data/app/controllers/devise_token_auth/sessions_controller.rb

@@ -1,44 +1,153 @@
+# frozen_string_literal: true
+
 # see http://www.emilsoman.com/blog/2013/05/18/building-a-tested/
 module DeviseTokenAuth
-  class SessionsController < Devise::SessionsController
-    prepend_before_filter :require_no_authentication, :only => [:create]
-    include Devise::Controllers::Helpers
+  class SessionsController < DeviseTokenAuth::ApplicationController
+    before_action :set_user_by_token, only: [:destroy]
+    after_action :reset_session, only: [:destroy]
 
-    respond_to :json
+    def new
+      render_new_error
+    end
 
     def create
-      resource = User.find_by_email(resource_params[:email])
+      if field = (resource_params.keys.map(&:to_sym) & resource_class.authentication_keys).first
+        q_value = get_case_insensitive_field_from_resource_params(field)
+
+        @resource = find_resource(field, q_value)
+      end
 
-      unless resource and valid_params? and resource.valid_password?(params[:password])
-        render json: {
-          success: false,
-          errors: ["Invalid login credentials. Please try again."]
-        }, status: 401
+      if @resource && valid_params?(field, q_value) && (!@resource.respond_to?(:active_for_authentication?) || @resource.active_for_authentication?)
+        valid_password = @resource.valid_password?(resource_params[:password])
+        if (@resource.respond_to?(:valid_for_authentication?) && !@resource.valid_for_authentication? { valid_password }) || !valid_password
+          return render_create_error_bad_credentials
+        end
 
-      else
-        sign_in(:user, resource, store: false)
+        create_and_assign_token
+
+        sign_in(@resource, scope: :user, store: false, bypass: false)
 
-        render json: {
-          success: true,
-          data: resource.as_json
-        }
+        yield @resource if block_given?
+
+        render_create_success
+      elsif @resource && !Devise.paranoid && !(!@resource.respond_to?(:active_for_authentication?) || @resource.active_for_authentication?)
+        if @resource.respond_to?(:locked_at) && @resource.locked_at
+          render_create_error_account_locked
+        else
+          render_create_error_not_confirmed
+        end
+      else
+        hash_password_in_paranoid_mode
+        render_create_error_bad_credentials
       end
     end
 
     def destroy
-      sign_out(resource_name)
+      # remove auth instance variables so that after_action does not run
+      user = remove_instance_variable(:@resource) if @resource
+      client = @token.client
+      @token.clear!
+
+      if user && client && user.tokens[client]
+        user.tokens.delete(client)
+        user.save!
+
+        if DeviseTokenAuth.cookie_enabled
+          # If a cookie is set with a domain specified then it must be deleted with that domain specified
+          # See https://api.rubyonrails.org/classes/ActionDispatch/Cookies.html
+          cookies.delete(DeviseTokenAuth.cookie_name, domain: DeviseTokenAuth.cookie_attributes[:domain])
+        end
+
+        yield user if block_given?
+
+        render_destroy_success
+      else
+        render_destroy_error
+      end
+    end
+
+    protected
+
+    def valid_params?(key, val)
+      resource_params[:password] && key && val
+    end
+
+    def get_auth_params
+      auth_key = nil
+      auth_val = nil
+      # iterate thru allowed auth keys, use first found
+      resource_class.authentication_keys.each do |k|
+        if resource_params[k]
+          auth_val = resource_params[k]
+          auth_key = k
+          break
+        end
+      end
+
+      # honor devise configuration for case_insensitive_keys
+      if resource_class.case_insensitive_keys.include?(auth_key)
+        auth_val.downcase!
+      end
 
+      { key: auth_key, val: auth_val }
+    end
+
+    def render_new_error
+      render_error(405, I18n.t('devise_token_auth.sessions.not_supported'))
+    end
+
+    def render_create_success
       render json: {
-        success:true
+        data: resource_data(resource_json: @resource.token_validation_response)
       }
     end
 
-    def valid_params?
-      params[:password] && params[:email]
+    def render_create_error_not_confirmed
+      render_error(401, I18n.t('devise_token_auth.sessions.not_confirmed', email: @resource.email))
+    end
+
+    def render_create_error_account_locked
+      render_error(401, I18n.t('devise.mailer.unlock_instructions.account_lock_msg'))
+    end
+
+    def render_create_error_bad_credentials
+      render_error(401, I18n.t('devise_token_auth.sessions.bad_credentials'))
+    end
+
+    def render_destroy_success
+      render json: {
+        success:true
+      }, status: 200
+    end
+
+    def render_destroy_error
+      render_error(404, I18n.t('devise_token_auth.sessions.user_not_found'))
     end
 
+    private
+
     def resource_params
-      params.permit(:email, :password)
+      params.permit(*params_for_resource(:sign_in))
+    end
+
+    def create_and_assign_token
+      if @resource.respond_to?(:with_lock) && !@resource.changed?
+        @resource.with_lock do
+          @token = @resource.create_token
+          @resource.save!
+        end
+      else
+        @token = @resource.create_token
+        @resource.save!
+      end
+    end
+
+    def hash_password_in_paranoid_mode
+      # In order to avoid timing attacks in paranoid mode, we want the password hash to be
+      # calculated even if no resource has been found. Devise's DatabaseAuthenticatable warden
+      # strategy handles this case similarly:
+      # https://github.com/heartcombo/devise/blob/main/lib/devise/strategies/database_authenticatable.rb
+      resource_class.new.password = resource_params[:password] if Devise.paranoid
     end
   end
 end

data/app/controllers/devise_token_auth/token_validations_controller.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module DeviseTokenAuth
+  class TokenValidationsController < DeviseTokenAuth::ApplicationController
+    skip_before_action :assert_is_devise_resource!, only: [:validate_token]
+    before_action :set_user_by_token, only: [:validate_token]
+
+    def validate_token
+      # @resource will have been set by set_user_by_token concern
+      if @resource
+        yield @resource if block_given?
+        render_validate_token_success
+      else
+        render_validate_token_error
+      end
+    end
+
+    protected
+
+    def render_validate_token_success
+      render json: {
+        success: true,
+        data: resource_data(resource_json: @resource.token_validation_response)
+      }
+    end
+
+    def render_validate_token_error
+      render_error(401, I18n.t('devise_token_auth.token_validations.invalid'))
+    end
+  end
+end

data/app/controllers/devise_token_auth/unlocks_controller.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+module DeviseTokenAuth
+  class UnlocksController < DeviseTokenAuth::ApplicationController
+    skip_after_action :update_auth_header, only: [:create, :show]
+
+    # this action is responsible for generating unlock tokens and
+    # sending emails
+    def create
+      return render_create_error_missing_email unless resource_params[:email]
+
+      @email = get_case_insensitive_field_from_resource_params(:email)
+      @resource = find_resource(:email, @email)
+
+      if @resource
+        yield @resource if block_given?
+
+        @resource.send_unlock_instructions(
+          email: @email,
+          provider: 'email',
+          client_config: params[:config_name]
+        )
+
+        if @resource.errors.empty?
+          return render_create_success
+        else
+          render_create_error @resource.errors
+        end
+      else
+        render_not_found_error
+      end
+    end
+
+    def show
+      @resource = resource_class.unlock_access_by_token(params[:unlock_token])
+
+      if @resource.persisted?
+        token = @resource.create_token
+        @resource.save!
+        yield @resource if block_given?
+
+        redirect_header_options = { unlock: true }
+        redirect_headers = build_redirect_headers(token.token,
+                                                  token.client,
+                                                  redirect_header_options)
+        redirect_to(@resource.build_auth_url(after_unlock_path_for(@resource),
+                                             redirect_headers),
+                                             redirect_options)
+      else
+        render_show_error
+      end
+    end
+
+    private
+    def after_unlock_path_for(resource)
+      #TODO: This should probably be a configuration option at the very least.
+      '/'
+    end
+
+    def render_create_error_missing_email
+      render_error(401, I18n.t('devise_token_auth.unlocks.missing_email'))
+    end
+
+    def render_create_success
+      render json: {
+        success: true,
+        message: success_message('unlocks', @email)
+      }
+    end
+
+    def render_create_error(errors)
+      render json: {
+        success: false,
+        errors: errors
+      }, status: 400
+    end
+
+    def render_show_error
+      raise ActionController::RoutingError, 'Not Found'
+    end
+
+    def render_not_found_error
+      if Devise.paranoid
+        render_create_success
+      else
+        render_error(404, I18n.t('devise_token_auth.unlocks.user_not_found', email: @email))
+      end
+    end
+
+    def resource_params
+      params.permit(:email, :unlock_token, :config)
+    end
+  end
+end

data/app/models/devise_token_auth/concerns/active_record_support.rb

@@ -0,0 +1,18 @@
+module DeviseTokenAuth::Concerns::ActiveRecordSupport
+  extend ActiveSupport::Concern
+
+  included do
+    if Rails.gem_version >= Gem::Version.new("7.1.0.a")
+      serialize :tokens, coder: DeviseTokenAuth::Concerns::TokensSerialization
+    else
+      serialize :tokens, DeviseTokenAuth::Concerns::TokensSerialization
+    end
+  end
+
+  class_methods do
+    # It's abstract replacement .find_by
+    def dta_find_by(attrs = {})
+      find_by(attrs)
+    end
+  end
+end

data/app/models/devise_token_auth/concerns/confirmable_support.rb

@@ -0,0 +1,28 @@
+module DeviseTokenAuth::Concerns::ConfirmableSupport
+  extend ActiveSupport::Concern
+
+  included do
+    # Override standard devise `postpone_email_change?` method
+    # for not to use `devise_will_save_change_to_email?` methods.
+    def postpone_email_change?
+      postpone = self.class.reconfirmable &&
+        email_value_in_database != email &&
+        !@bypass_confirmation_postpone &&
+        self.email.present? &&
+        (!@skip_reconfirmation_in_callback || !email_value_in_database.nil?)
+      @bypass_confirmation_postpone = false
+      postpone
+    end
+  end
+
+  protected
+
+  def email_value_in_database
+    rails51 = Rails.gem_version >= Gem::Version.new("5.1.x")
+    if rails51 && respond_to?(:email_in_database)
+      email_in_database
+    else
+      email_was
+    end
+  end
+end

data/app/models/devise_token_auth/concerns/mongoid_support.rb

@@ -0,0 +1,19 @@
+module DeviseTokenAuth::Concerns::MongoidSupport
+  extend ActiveSupport::Concern
+
+  def as_json(options = {})
+    options[:except] = (options[:except] || []) + [:_id]
+    hash = super(options)
+    hash['id'] = to_param
+    hash
+  end
+
+  class_methods do
+    # It's abstract replacement .find_by
+    def dta_find_by(attrs = {})
+      find_by(attrs)
+    rescue Mongoid::Errors::DocumentNotFound
+      nil
+    end
+  end
+end

data/app/models/devise_token_auth/concerns/tokens_serialization.rb

@@ -0,0 +1,31 @@
+module DeviseTokenAuth::Concerns::TokensSerialization
+  extend self
+  # Serialization hash to json
+  def dump(object)
+    JSON.generate(object && object.transform_values do |token|
+      serialize_updated_at(token).compact
+    end.compact)
+  end
+
+  # Deserialization json to hash
+  def load(json)
+    case json
+    when String
+      JSON.parse(json)
+    when NilClass
+      {}
+    else
+      json
+    end
+  end
+
+  private
+
+  def serialize_updated_at(token)
+    updated_at_key = ['updated_at', :updated_at].find(&token.method(:[]))
+
+    return token unless token[updated_at_key].respond_to?(:iso8601)
+
+    token.merge updated_at_key => token[updated_at_key].iso8601
+  end
+end