digix_devise_token_auth 0.1.44

data/app/controllers/devise_token_auth/token_validations_controller.rb

@@ -0,0 +1,29 @@
+module DeviseTokenAuth
+  class TokenValidationsController < DeviseTokenAuth::ApplicationController
+    skip_before_action :assert_is_devise_resource!, :only => [:validate_token]
+    before_action :set_user_by_token, :only => [:validate_token]
+
+    def validate_token
+      # @resource will have been set by set_user_by_token concern
+      if @resource
+        yield @resource if block_given?
+        render_validate_token_success
+      else
+        render_validate_token_error
+      end
+    end
+
+    protected
+
+    def render_validate_token_success
+      render json: {
+        success: true,
+        data: resource_data(resource_json: @resource.token_validation_response)
+      }
+    end
+
+    def render_validate_token_error
+      render_error(401, I18n.t("devise_token_auth.token_validations.invalid"))
+    end
+  end
+end

data/app/controllers/devise_token_auth/unlocks_controller.rb

@@ -0,0 +1,89 @@
+module DeviseTokenAuth
+  class UnlocksController < DeviseTokenAuth::ApplicationController
+    skip_after_action :update_auth_header, :only => [:create, :show]
+
+    # this action is responsible for generating unlock tokens and
+    # sending emails
+    def create
+      unless resource_params[:email]
+        return render_create_error_missing_email
+      end
+
+      @email = get_case_insensitive_field_from_resource_params(:email)
+      @resource = find_resource(:email, @email)
+
+      if @resource
+        yield @resource if block_given?
+
+        @resource.send_unlock_instructions({
+          email: @email,
+          provider: 'email',
+          client_config: params[:config_name]
+        })
+
+        if @resource.errors.empty?
+          return render_create_success
+        else
+          render_create_error @resource.errors
+        end
+      else
+        render_not_found_error
+      end
+    end
+
+    def show
+      @resource = resource_class.unlock_access_by_token(params[:unlock_token])
+
+      if @resource && @resource.id
+        client_id, token = @resource.create_token
+        @resource.save!
+        yield @resource if block_given?
+
+        redirect_header_options = {unlock: true}
+        redirect_headers = build_redirect_headers(token,
+                                                  client_id,
+                                                  redirect_header_options)
+        redirect_to(@resource.build_auth_url(after_unlock_path_for(@resource),
+                                             redirect_headers))
+      else
+        render_show_error
+      end
+    end
+
+    private
+    def after_unlock_path_for(resource)
+      #TODO: This should probably be a configuration option at the very least.
+      '/'
+    end
+
+    def render_create_error_missing_email
+      render_error(401, I18n.t("devise_token_auth.unlocks.missing_email"))
+    end
+
+    def render_create_success
+      render json: {
+        success: true,
+        message: I18n.t("devise_token_auth.unlocks.sended", email: @email)
+      }
+    end
+
+    def render_create_error(errors)
+      render json: {
+        success: false,
+        errors: errors,
+      }, status: 400
+    end
+
+    def render_show_error
+      raise ActionController::RoutingError.new('Not Found')
+    end
+
+    def render_not_found_error
+      render_error(404, I18n.t("devise_token_auth.unlocks.user_not_found", email: @email))
+    end
+
+    def resource_params
+      params.permit(:email, :unlock_token, :config)
+    end
+  end
+end

data/app/models/devise_token_auth/concerns/user.rb

@@ -0,0 +1,260 @@
+require 'bcrypt'
+
+module DeviseTokenAuth::Concerns::User
+  extend ActiveSupport::Concern
+
+  def self.tokens_match?(token_hash, token)
+    @token_equality_cache ||= {}
+
+    key = "#{token_hash}/#{token}"
+    result = @token_equality_cache[key] ||= (::BCrypt::Password.new(token_hash) == token)
+    if @token_equality_cache.size > 10000
+      @token_equality_cache = {}
+    end
+    result
+  end
+
+  included do
+    # Hack to check if devise is already enabled
+    unless self.method_defined?(:devise_modules)
+      devise :database_authenticatable, :registerable,
+          :recoverable, :trackable, :validatable, :confirmable
+    else
+      self.devise_modules.delete(:omniauthable)
+    end
+
+    unless tokens_has_json_column_type?
+      serialize :tokens, JSON
+    end
+
+    if DeviseTokenAuth.default_callbacks
+      include DeviseTokenAuth::Concerns::UserOmniauthCallbacks
+    end
+
+    # can't set default on text fields in mysql, simulate here instead.
+    after_save :set_empty_token_hash
+    after_initialize :set_empty_token_hash
+
+    # get rid of dead tokens
+    before_save :destroy_expired_tokens
+
+    # remove old tokens if password has changed
+    before_save :remove_tokens_after_password_reset
+
+    # don't use default devise email validation
+    def email_required?; false; end
+    def email_changed?; false; end
+    def will_save_change_to_email?; false; end
+
+    def password_required?
+      return false unless provider == 'email'
+      super
+    end
+
+    # override devise method to include additional info as opts hash
+    def send_confirmation_instructions(opts={})
+      generate_confirmation_token! unless @raw_confirmation_token
+
+      # fall back to "default" config name
+      opts[:client_config] ||= "default"
+      opts[:to] = unconfirmed_email if pending_reconfirmation?
+      opts[:redirect_url] ||= DeviseTokenAuth.default_confirm_success_url
+
+      send_devise_notification(:confirmation_instructions, @raw_confirmation_token, opts)
+    end
+
+    # override devise method to include additional info as opts hash
+    def send_reset_password_instructions(opts={})
+      token = set_reset_password_token
+
+      # fall back to "default" config name
+      opts[:client_config] ||= "default"
+
+      send_devise_notification(:reset_password_instructions, token, opts)
+      token
+    end
+
+    # override devise method to include additional info as opts hash
+    def send_unlock_instructions(opts={})
+      raw, enc = Devise.token_generator.generate(self.class, :unlock_token)
+      self.unlock_token = enc
+      save(validate: false)
+
+      # fall back to "default" config name
+      opts[:client_config] ||= "default"
+
+      send_devise_notification(:unlock_instructions, raw, opts)
+      raw
+    end
+  end
+
+  def create_token(client_id: nil, token: nil, expiry: nil, **token_extras)
+    client_id ||= SecureRandom.urlsafe_base64(nil, false)
+    token     ||= SecureRandom.urlsafe_base64(nil, false)
+    expiry    ||= (Time.now + token_lifespan).to_i
+
+    self.tokens[client_id] = {
+      token: BCrypt::Password.create(token),
+      expiry: expiry
+    }.merge!(token_extras)
+
+    [client_id, token, expiry]
+  end
+
+  module ClassMethods
+    protected
+
+    def tokens_has_json_column_type?
+      database_exists? && table_exists? && self.columns_hash['tokens'] && self.columns_hash['tokens'].type.in?([:json, :jsonb])
+    end
+
+    def database_exists?
+      ActiveRecord::Base.connection_pool.with_connection { |con| con.active? } rescue false
+    end
+  end
+
+
+  def valid_token?(token, client_id='default')
+    return false unless tokens[client_id]
+    return true if token_is_current?(token, client_id)
+    return true if token_can_be_reused?(token, client_id)
+
+    # return false if none of the above conditions are met
+    return false
+  end
+
+
+  # this must be done from the controller so that additional params
+  # can be passed on from the client
+  def send_confirmation_notification?; false; end
+
+
+  def token_is_current?(token, client_id)
+    # ghetto HashWithIndifferentAccess
+    expiry     = tokens[client_id]['expiry'] || tokens[client_id][:expiry]
+    token_hash = tokens[client_id]['token'] || tokens[client_id][:token]
+
+    return true if (
+      # ensure that expiry and token are set
+      expiry && token &&
+
+      # ensure that the token has not yet expired
+      DateTime.strptime(expiry.to_s, '%s') > Time.now &&
+
+      # ensure that the token is valid
+      DeviseTokenAuth::Concerns::User.tokens_match?(token_hash, token)
+    )
+  end
+
+
+  # allow batch requests to use the previous token
+  def token_can_be_reused?(token, client_id)
+    # ghetto HashWithIndifferentAccess
+    updated_at = tokens[client_id]['updated_at'] || tokens[client_id][:updated_at]
+    last_token = tokens[client_id]['last_token'] || tokens[client_id][:last_token]
+
+    return true if (
+      # ensure that the last token and its creation time exist
+      updated_at && last_token &&
+
+      # ensure that previous token falls within the batch buffer throttle time of the last request
+      Time.parse(updated_at) > Time.now - DeviseTokenAuth.batch_request_buffer_throttle &&
+
+      # ensure that the token is valid
+      ::BCrypt::Password.new(last_token) == token
+    )
+  end
+
+
+  # update user's auth token (should happen on each request)
+  def create_new_auth_token(client_id=nil)
+    now = Time.now
+
+    client_id, token = create_token(
+      client_id: client_id,
+      expiry: (now + token_lifespan).to_i,
+      last_token: tokens.fetch(client_id, {})['token'],
+      updated_at: now
+    )
+
+    update_auth_header(token, client_id)
+  end
+
+  def build_auth_header(token, client_id='default')
+    # client may use expiry to prevent validation request if expired
+    # must be cast as string or headers will break
+    expiry = tokens[client_id]['expiry'] || tokens[client_id][:expiry]
+
+    {
+      DeviseTokenAuth.headers_names[:"access-token"] => token,
+      DeviseTokenAuth.headers_names[:"token-type"]   => "Bearer",
+      DeviseTokenAuth.headers_names[:"client"]       => client_id,
+      DeviseTokenAuth.headers_names[:"expiry"]       => expiry.to_s,
+      DeviseTokenAuth.headers_names[:"uid"]          => uid
+    }
+  end
+
+  def update_auth_header(token, client_id='default')
+    headers = build_auth_header(token, client_id)
+    while tokens.length > 0 && DeviseTokenAuth.max_number_of_devices < tokens.length
+      oldest_client_id, _tk = tokens.min_by { |_cid, v| v[:expiry] || v["expiry"] }
+      tokens.delete(oldest_client_id)
+    end
+
+    save!
+
+    headers
+  end
+
+
+  def build_auth_url(base_url, args)
+    args[:uid]    = uid
+    args[:expiry] = tokens[args[:client_id]]['expiry']
+
+    DeviseTokenAuth::Url.generate(base_url, args)
+  end
+
+
+  def extend_batch_buffer(token, client_id)
+    self.tokens[client_id]['updated_at'] = Time.now
+    update_auth_header(token, client_id)
+  end
+
+  def confirmed?
+    devise_modules.exclude?(:confirmable) || super
+  end
+
+  def token_validation_response
+    as_json(except: [:tokens, :created_at, :updated_at])
+  end
+
+  def token_lifespan
+    DeviseTokenAuth.token_lifespan
+  end
+
+  protected
+
+  def set_empty_token_hash
+    self.tokens ||= {} if has_attribute?(:tokens)
+  end
+
+  def destroy_expired_tokens
+    if tokens
+      tokens.delete_if do |cid, v|
+        expiry = v[:expiry] || v["expiry"]
+        DateTime.strptime(expiry.to_s, '%s') < Time.now
+      end
+    end
+  end
+
+  def remove_tokens_after_password_reset
+    should_remove_old_tokens = DeviseTokenAuth.remove_tokens_after_password_reset &&
+                               encrypted_password_changed? && tokens && tokens.many?
+
+    if should_remove_old_tokens
+      client_id, token_data = tokens.max_by { |cid, v| v[:expiry] || v["expiry"] }
+      self.tokens = {client_id => token_data}
+    end
+  end
+
+end

data/app/models/devise_token_auth/concerns/user_omniauth_callbacks.rb

@@ -0,0 +1,26 @@
+module DeviseTokenAuth::Concerns::UserOmniauthCallbacks
+  extend ActiveSupport::Concern
+
+  included do
+    validates :email, presence: true,if: :email_provider?
+    validates :email, email: true, allow_nil: true, allow_blank: true, if: :email_provider?
+    validates_presence_of :uid, unless: :email_provider?
+
+    # only validate unique emails among email registration users
+    validates :email, uniqueness: { scope: :provider }, on: :create, if: :email_provider?
+
+    # keep uid in sync with email
+    before_save :sync_uid
+    before_create :sync_uid
+  end
+
+  protected
+
+  def email_provider?
+    provider == 'email'
+  end
+
+  def sync_uid
+    self.uid = email if provider == 'email'
+  end
+end

data/app/validators/email_validator.rb

@@ -0,0 +1,21 @@
+class EmailValidator < ActiveModel::EachValidator
+  def validate_each(record, attribute, value)
+    unless value =~ /\A([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})\z/i
+      record.errors[attribute] << email_invalid_message
+    end
+  end
+
+  private
+
+  def email_invalid_message
+    # Try strictly set message:
+    message = options[:message]
+
+    if message.nil?
+      # Try DeviceTokenAuth translations or fallback to ActiveModel translations
+      message = I18n.t(:'errors.messages.not_email', default: :'errors.messages.invalid')
+    end
+
+    message
+  end
+end

data/app/views/devise/mailer/confirmation_instructions.html.erb

@@ -0,0 +1,5 @@
+<p><%= t(:welcome).capitalize + ' ' + @email %>!</p>
+
+<p><%= t '.confirm_link_msg' %> </p>
+
+<p><%= link_to t('.confirm_account_link'), confirmation_url(@resource, {confirmation_token: @token, config: message['client-config'].to_s, redirect_url: message['redirect-url']}).html_safe %></p>

data/app/views/devise/mailer/reset_password_instructions.html.erb

@@ -0,0 +1,8 @@
+<p><%= t(:hello).capitalize %> <%= @resource.email %>!</p>
+
+<p><%= t '.request_reset_link_msg' %></p>
+
+<p><%= link_to t('.password_change_link'), edit_password_url(@resource, reset_password_token: @token, config: message['client-config'].to_s, redirect_url: message['redirect-url'].to_s).html_safe %></p>
+
+<p><%= t '.ignore_mail_msg' %></p>
+<p><%= t '.no_changes_msg' %></p>

data/app/views/devise/mailer/unlock_instructions.html.erb

@@ -0,0 +1,7 @@
+<p><%= t :hello %> <%= @resource.email %>!</p>
+
+<p><%= t '.account_lock_msg' %></p>
+
+<p><%= t '.unlock_link_msg' %></p>
+
+<p><%= link_to t('.unlock_link'), unlock_url(@resource, unlock_token: @token, config: message['client-config'].to_s) %></p>