foobara-auth 0.0.3 → 0.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 451c9723c4313a390e97e6fe35bdd3bc206884d56ce2e79be20fc0f79bf3009a
-  data.tar.gz: b22db603ba6809fc5dca30a2f8e399f9566dbad2d01efbc79d6fe7e9e703176b
+  metadata.gz: 8974dadf886b62fb510f52275ee227a95d74e1fe57b3f8b1fff7242efa3b0949
+  data.tar.gz: 01df20b29400198bf1ffa231586a4f6472748d166598ab088a49b3c116ccb236
 SHA512:
-  metadata.gz: 26d1575261570eac9162959e3724043a018961ecaa6fcde48739722800ee18a7e4c584756d7d3b83e81b3cc6cb96b60785d084c7726d93636464d7356e3d2c01
-  data.tar.gz: a641df324a05554c870d812ead5a7d632b8b135419aede674e785c9f5dd7ecfb3fe2482dda39c96feb919da0e9cc5f7beb9b37f803c4a0e055b81122c58ffe5e
+  metadata.gz: ebbbfd838051b025b66fd40cd324db2037de76a7ea86f72630269697e262071dc4551f0039d2646fffe7a774b38c798c38728d369790b208a7e61eab353566ca
+  data.tar.gz: 7c14f7e424f2ed8e803d94c402a74b971f4dd641cfabba5fc49b0a155d13f6ad6eb6b086582e4ac2f22dea8c76b7d81fb597a0c72ca0fc91f744f6564fb54d4f

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## [0.0.5] - 2025-03-29
+
+- Fix bug duplicating refresh tokens
+
+## [0.0.4] - 2025-03-29
+
+- Do not pass user into RefreshLogin
+
 ## [0.0.3] - 2025-03-28
 
 - Allow not having an email

data/src/login.rb

@@ -116,7 +116,7 @@ module Foobara
 
       def save_new_refresh_token_on_user
         # TODO: maybe override #<< on these objects to dirty the entity??
-        user_to_login.refresh_tokens += [*user_to_login.refresh_tokens, new_refresh_token[:token_record]]
+        user_to_login.refresh_tokens = [new_refresh_token[:token_record], *user_to_login.refresh_tokens]
       end
 
       def tokens

data/src/refresh_login.rb

@@ -18,10 +18,10 @@ module Foobara
       end
 
       depends_on CreateToken, VerifyToken
+      depends_on_entities Types::Token
 
       inputs do
-        user Types::User, :required
-        refresh_token_text :string, :required, :sensitive
+        refresh_token :string, :required, :sensitive
         # Can we get these TTLs off of the refresh token?
         token_ttl :integer, default: 30 * 60
         refresh_token_ttl :integer, default: 7 * 24 * 60 * 60
@@ -34,8 +34,7 @@ module Foobara
 
       def execute
         determine_refresh_token_id_and_secret
-        load_refresh_token
-        validate_refresh_token_belongs_to_user
+        load_refresh_token_record
         verify_refresh_token
         # Delete it instead maybe?
         mark_refresh_token_as_used
@@ -49,25 +48,19 @@ module Foobara
         tokens
       end
 
-      attr_accessor :access_token, :new_refresh_token, :now, :expires_at, :refresh_token,
+      attr_accessor :access_token, :new_refresh_token, :now, :expires_at, :refresh_token_record,
                     :refresh_token_id, :refresh_token_secret, :token_group
 
       def determine_refresh_token_id_and_secret
-        self.refresh_token_id, self.refresh_token_secret = refresh_token_text.split("_")
+        self.refresh_token_id, self.refresh_token_secret = refresh_token.split("_")
       end
 
-      def load_refresh_token
-        self.refresh_token = Types::Token.load(refresh_token_id)
-      end
-
-      def validate_refresh_token_belongs_to_user
-        unless user.refresh_tokens.any? { |token| token.id == refresh_token_id }
-          add_runtime_error(RefreshTokenNotOwnedByUser.new(context: { refresh_token_id: }))
-        end
+      def load_refresh_token_record
+        self.refresh_token_record = Types::Token.load(refresh_token_id)
       end
 
       def verify_refresh_token
-        valid = run_subcommand!(VerifyToken, token_string: refresh_token_text)
+        valid = run_subcommand!(VerifyToken, token_string: refresh_token)
 
         unless valid[:verified]
           add_runtime_error(InvalidRefreshTokenError.new(context: { refresh_token_id: }))
@@ -75,7 +68,7 @@ module Foobara
       end
 
       def mark_refresh_token_as_used
-        refresh_token.use_up!
+        refresh_token_record.use_up!
       end
 
       def determine_timestamps
@@ -93,6 +86,10 @@ module Foobara
         self.access_token = JWT.encode(payload, jwt_secret, "HS256")
       end
 
+      def user
+        @user ||= Types::User.that_owns(refresh_token_record, "refresh_tokens")
+      end
+
       def jwt_secret
         jwt_secret_text = ENV.fetch("JWT_SECRET", nil)
 
@@ -106,7 +103,7 @@ module Foobara
       end
 
       def determine_token_group
-        self.token_group = refresh_token&.token_group || SecureRandom.uuid
+        self.token_group = refresh_token_record&.token_group || SecureRandom.uuid
       end
 
       def generate_new_refresh_token
@@ -115,7 +112,8 @@ module Foobara
 
       def save_new_refresh_token_on_user
         # TODO: maybe override #<< on these objects to dirty the entity??
-        user.refresh_tokens += [*user.refresh_tokens, new_refresh_token[:token_record]]
+        # TODO: DRY this up!!
+        user.refresh_tokens = [new_refresh_token[:token_record], *user.refresh_tokens]
       end
 
       def tokens

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: foobara-auth
 version: !ruby/object:Gem::Version
-  version: 0.0.3
+  version: 0.0.5
 platform: ruby
 authors:
 - Miles Georgi
 bindir: bin
 cert_chain: []
-date: 2025-03-29 00:00:00.000000000 Z
+date: 2025-03-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: argon2