grape_devise_token_auth 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 52925f8c667a9fb733ff96c62b0954d58d58d7cd
-  data.tar.gz: fa72880434bd05f866161c0c8da9bc9a0af3cb94
+  metadata.gz: a6c0879cd01d03c9f719c86c7ee0fe21ddba87d2
+  data.tar.gz: bea840a724adba030833ceec4d7418a1eedbd19f
 SHA512:
-  metadata.gz: da3ffa3915aa58fe11c467c9e15dee10cb1f78a09a8faa77a0c3fa5b4e8aaaaa2d3de24bc7c500a1a28b226e91279e5f5441b2b50a3d37be89ae74d56d76abba
-  data.tar.gz: 19b085008ec2b60507a3a968013b78c7ad0bcab3e5cf739cfcae49331c0a6cefe6e79a030a96f12a15f21b874b09fa47115e41420a8503427aa0aafb40f5630b
+  metadata.gz: ed1bd798383fee3650292ffe6553fa40ad3eaaba13416d4f24358bbaea61151e471624c5d515d03d72661381351cebab4d4883693af29bc523f3f292769a1349
+  data.tar.gz: 4be80289b09ad4ad60e96484290ae900faa32352a36eef00f4f6f38bc5d6770728873369cca078f663e6c6ebf1d40087bdda9bb0cca3bd53acfe3307f417321c

data/README.md

@@ -32,7 +32,7 @@ Place this line in an initializer in your rails app or at least somewhere before
 the grape API will get loaded:
 
 ```ruby
-GrapeDeviseTokenAuth.setup!(true)
+GrapeDeviseTokenAuth.setup!
 ```
 
 Within the Grape API:
@@ -47,13 +47,30 @@ class Posts < Grape::API
 end
 ```
 
-including the helpers line allows you to use methods the `current_user` and
-`authenticated?` within the API.
-
 The resource class option allows you to specific the scope that will be
 authenticated, this corresponds to your devise mapping.
 
-All calls will now be authenticated in the above API via rack middleware.
+Individual endpoints can now be authenticated by calling `authenticate_YOUR_MAPPING_HERE!` (e.g. `authenticate_user!`)
+within them.
+
+For Example:
+
+```
+get '/' do
+  authenticate_user!
+  present Post.all
+end
+```
+
+alternatively to portect all routes place the call in a before block:
+
+```
+before do
+  authenticate_user!
+end
+```
+
+[A full example setup can be found here][6]
 
 ## Testing and Example
 
@@ -81,4 +98,4 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
 [3]: https://github.com/plataformatec/devise
 [4]: https://github.com/lynndylanhurley
 [5]: https://github.com/mcordell/rails_grape_auth
-
+[6]: https://github.com/mcordell/rails_grape_auth/blob/7ca6b2f3d989fc23824aaf40fc353fc3e8de40ec/app/api/grape_api/posts.rb

data/lib/grape_devise_token_auth/auth_headers.rb

@@ -0,0 +1,49 @@
+module GrapeDeviseTokenAuth
+  class AuthHeaders
+    extend Forwardable
+
+    def initialize(warden, mapping, request_start, data)
+      @resource = warden.session_serializer.fetch(mapping)
+      @request_start = request_start
+      @data = data
+    end
+
+    def headers
+      return {} unless resource && resource.valid? && client_id
+      auth_headers_from_resource
+    end
+
+    private
+
+    def_delegators :@data, :token, :client_id
+    attr_reader :request_start, :resource
+
+    def batch_request?
+      @batch_request ||= resource.tokens[client_id] &&
+                         resource.tokens[client_id]['updated_at'] &&
+                         within_batch_request_window?
+    end
+
+    def within_batch_request_window?
+      end_of_window = Time.parse(resource.tokens[client_id]['updated_at']) +
+                      GrapeDeviseTokenAuth.batch_request_buffer_throttle
+
+      request_start < end_of_window
+    end
+
+    def auth_headers_from_resource
+      auth_headers = {}
+      resource.with_lock do
+        if !GrapeDeviseTokenAuth.change_headers_on_each_request
+          auth_headers = resource.extend_batch_buffer(token, client_id)
+        elsif batch_request?
+          resource.extend_batch_buffer(token, client_id)
+          # don't set any headers in a batch request
+        else
+          auth_headers = resource.create_new_auth_token(client_id)
+        end
+      end
+      auth_headers
+    end
+  end
+end

data/lib/grape_devise_token_auth/auth_helpers.rb

@@ -3,7 +3,18 @@ module GrapeDeviseTokenAuth
     def self.included(_base)
       Devise.mappings.keys.each do |mapping|
         define_method("current_#{mapping}") do
-          warden.session_serializer.fetch(:user)
+          warden.session_serializer.fetch(mapping)
+        end
+
+        define_method("authenticate_#{mapping}!") do
+          authorizer_data  = AuthorizerData.from_env(env)
+          devise_interface = DeviseInterface.new(authorizer_data)
+          token_authorizer = TokenAuthorizer.new(authorizer_data,
+                                                 devise_interface)
+          user = token_authorizer.authenticate_from_token(mapping)
+          fail Unauthorized unless user
+          devise_interface.set_user_in_warden(mapping, user)
+          user
         end
       end
     end

data/lib/grape_devise_token_auth/authorizer_data.rb

@@ -0,0 +1,27 @@
+module GrapeDeviseTokenAuth
+  class AuthorizerData
+    attr_reader :uid, :client_id, :token, :expiry, :warden
+
+    def initialize(uid, client_id, token, expiry, warden)
+      @uid = uid
+      @client_id = client_id
+      @token = token
+      @expiry = expiry
+      @warden = warden
+    end
+
+    def self.from_env(env)
+      new(
+        env[Configuration::UID_KEY],
+        env[Configuration::CLIENT_KEY] || 'default',
+        env[Configuration::ACCESS_TOKEN_KEY],
+        env[Configuration::EXPIRY_KEY],
+        env['warden']
+      )
+    end
+
+    def token_prerequisites_present?
+      token && uid
+    end
+  end
+end

data/lib/grape_devise_token_auth/configuration.rb

@@ -0,0 +1,19 @@
+module GrapeDeviseTokenAuth
+  class Configuration
+    attr_accessor :batch_request_buffer_throttle, :change_headers_on_each_request, :authenticate_all
+    ACCESS_TOKEN_KEY = 'HTTP_ACCESS_TOKEN'
+    EXPIRY_KEY = 'HTTP_EXPIRY'
+    UID_KEY = 'HTTP_UID'
+    CLIENT_KEY = 'HTTP_CLIENT'
+
+    def initialize
+      @batch_request_buffer_throttle  ||= DeviseTokenAuth.batch_request_buffer_throttle
+      @change_headers_on_each_request ||= DeviseTokenAuth.change_headers_on_each_request
+      @authenticate_all = false
+    end
+
+    def auth_all?
+      @authenticate_all
+    end
+  end
+end

data/lib/grape_devise_token_auth/devise_interface.rb

@@ -0,0 +1,31 @@
+module GrapeDeviseTokenAuth
+  class DeviseInterface
+    def initialize(data)
+      @warden = data.warden
+      @client_id = data.client_id
+    end
+
+    # extracted and simplified from Devise
+    def set_user_in_warden(scope, resource)
+      scope = Devise::Mapping.find_scope!(scope)
+      warden.session_serializer.store(resource, scope)
+    end
+
+    def mapping_to_class(m)
+      mapping = m ? Devise.mappings[m] : Devise.mappings.values.first
+      @resource_class = mapping.to
+    end
+
+    def exisiting_warden_user(resource_class)
+      warden_user =  warden.user(resource_class.to_s.underscore.to_sym)
+      return unless warden_user && warden_user.tokens[@client_id].nil?
+      resource = warden_user
+      resource.create_new_auth_token
+      resource
+    end
+
+    private
+
+    attr_reader :warden
+  end
+end

data/lib/grape_devise_token_auth/middleware.rb

@@ -1,125 +1,59 @@
 module GrapeDeviseTokenAuth
   class Middleware
-    ACCESS_TOKEN_KEY = 'HTTP_ACCESS_TOKEN'
-    EXPIRY_KEY = 'HTTP_EXPIRY'
-    UID_KEY = 'HTTP_UID'
-    CLIENT_KEY = 'HTTP_CLIENT'
+    extend Forwardable
 
     def initialize(app, resource_name)
       @app = app
-      resource_class_from_mapping(resource_name)
+      @resource_name = resource_name
     end
 
     def call(env)
       setup(env)
-      user = authenticate_from_token
-      return unauthorized unless user
-      sign_in_user(user)
-      responses_with_auth_headers(*@app.call(env))
+      begin
+        auth_all
+        responses_with_auth_headers(*@app.call(env))
+      rescue Unauthorized => _e
+        return unauthorized
+      end
     end
 
     private
 
-    attr_reader :uid, :client_id, :token, :expiry, :user, :resource_class, :resource, :warden, :batch_request_buffer_throttle, :request_start
-
-    def setup(env)
-      @request_start = Time.now
-      @uid           = env[UID_KEY]
-      @client_id     = env[CLIENT_KEY] || 'default'
-      @token         = env[ACCESS_TOKEN_KEY]
-      @expiry        = env[EXPIRY_KEY]
-      @warden        = env['warden']
-    end
-
-    def sign_in_user(user)
-      # user already logged in from devise:
-      return resource if resource
-      @resource = user
-      set_user_in_warden(:user, user)
-    end
-
-    #extracted and simplified from Devise
-    def set_user_in_warden(scope, resource)
-      scope    = Devise::Mapping.find_scope!(scope)
-      warden.session_serializer.store(resource, scope)
-    end
-
-    def resource_from_existing_devise_user
-      warden_user =  warden.user(resource_class.to_s.underscore.to_sym)
-      return unless warden_user && warden_user.tokens[client_id].nil?
-      @resource = warden_user
-      @resource.create_new_auth_token
-    end
-
-    def authenticate_from_token(mapping = nil)
-      resource_class_from_mapping(mapping)
-      return nil unless resource_class
-
-      resource_from_existing_devise_user
-      return resource if correct_resource_type_logged_in?
+    attr_reader :authorizer_data, :token_authorizer, :resource, :request_start
+    def_delegators :@authorizer_data, :warden, :token, :client_id
 
-      return nil unless token_request_valid?
-
-      user = resource_class.find_by_uid(uid)
-
-      return nil unless user && user.valid_token?(token, client_id)
-
-      user
-    end
-
-    def token_request_valid?
-      token && uid
-    end
-
-    def correct_resource_type_logged_in?
-      resource && resource.class == resource_class
-    end
-
-    def resource_class_from_mapping(m)
-      mapping = m ? Devise.mappings[m] : Devise.mappings.values.first
-      @resource_class = mapping.to
+    def auth_all
+      return if skip_auth_all?
+      user = token_authorizer.authenticate_from_token(@resource_name)
+      fail Unauthorized unless user
+      sign_in_user(user)
     end
 
-    def valid?
-      keys_present? && !expired?
+    def skip_auth_all?
+      !GrapeDeviseTokenAuth.configuration.auth_all?
     end
 
-    def keys_present?
-      uid.present? && client_id.present? && token.present?
+    def setup(env)
+      @request_start    = Time.now
+      @authorizer_data  = AuthorizerData.from_env(env)
+      @devise_interface = DeviseInterface.new(@authorizer_data)
+      @token_authorizer = TokenAuthorizer.new(@authorizer_data,
+                                              @devise_interface)
     end
 
-    def expired?
-      env[EXPIRY_KEY].to_i < Time.now.to_i
+    def sign_in_user(user)
+      @devise_interface.set_user_in_warden(@resource_name, user)
     end
 
     def responses_with_auth_headers(status, headers, response)
+      auth_headers = AuthHeaders.new(warden, @resource_name, request_start, authorizer_data)
       [
         status,
-        headers.merge(auth_headers),
+        headers.merge(auth_headers.headers),
         response
       ]
     end
 
-    def auth_headers
-      return {} unless resource && resource.valid? && client_id
-      auth_headers_from_resource
-    end
-
-    def auth_headers_from_resource
-      auth_headers = {}
-      resource.with_lock do
-        if !DeviseTokenAuth.change_headers_on_each_request
-          auth_headers = resource.extend_batch_buffer(token, client_id)
-        elsif batch_request?
-          resource.extend_batch_buffer(token, client_id)
-          # don't set any headers in a batch request
-        else
-          auth_headers = resource.create_new_auth_token(client_id)
-        end
-      end
-      auth_headers
-    end
-
     def unauthorized
       [401,
        { 'Content-Type' => 'application/json'
@@ -127,17 +61,5 @@ module GrapeDeviseTokenAuth
        []
       ]
     end
-
-    def batch_request?
-      @batch_request ||= resource.tokens[client_id] &&
-                         resource.tokens[client_id]['updated_at'] &&
-                         within_batch_request_window?
-    end
-
-    def within_batch_request_window?
-      end_of_window = Time.parse(resource.tokens[client_id]['updated_at']) +
-                      DeviseTokenAuth.batch_request_buffer_throttle
-      request_start < end_of_window
-    end
   end
 end

data/lib/grape_devise_token_auth/token_authorizer.rb

@@ -0,0 +1,46 @@
+module GrapeDeviseTokenAuth
+  class TokenAuthorizer
+    extend Forwardable
+
+    def initialize(data, devise_interface)
+      @data = data
+      @devise_interface = devise_interface
+    end
+
+    def authenticate_from_token(mapping = nil)
+      @resource_class =  devise_interface.mapping_to_class(mapping)
+      return nil unless resource_class
+
+      resource_from_existing_devise_user
+      return resource if correct_resource_type_logged_in?
+
+      return nil unless data.token_prerequisites_present?
+      load_user_from_uid
+      return nil unless user_authenticated?
+
+      user
+    end
+
+    private
+
+    attr_accessor :resource_class
+    attr_reader :data, :resource, :user, :devise_interface
+    def_delegators :@data, :warden, :uid, :token, :client_id
+
+    def user_authenticated?
+      user && user.valid_token?(token, client_id)
+    end
+
+    def load_user_from_uid
+      @user = resource_class.find_by_uid(uid)
+    end
+
+    def resource_from_existing_devise_user
+      @resource = @devise_interface.exisiting_warden_user(resource_class)
+    end
+
+    def correct_resource_type_logged_in?
+      resource && resource.class == resource_class
+    end
+  end
+end

data/lib/grape_devise_token_auth/unauthorized.rb

@@ -0,0 +1,4 @@
+module GrapeDeviseTokenAuth
+  class Unauthorized < Exception
+  end
+end

data/lib/grape_devise_token_auth/version.rb

@@ -1,3 +1,3 @@
 module GrapeDeviseTokenAuth
-  VERSION = "0.1.0"
+  VERSION = '0.1.1'
 end

data/lib/grape_devise_token_auth.rb

@@ -1,18 +1,35 @@
-require 'grape_devise_token_auth/version'
-require 'grape_devise_token_auth/middleware'
-require 'grape_devise_token_auth/auth_helpers'
+%w(version middleware auth_helpers authorizer_data unauthorized
+   token_authorizer configuration auth_headers devise_interface).each  do |file|
+     require "grape_devise_token_auth/#{file}"
+   end
+
 require 'grape'
 
 module GrapeDeviseTokenAuth
-  def self.setup!(middleware = false)
-    add_auth_strategy if middleware
-  end
+  class << self
+    extend Forwardable
+
+    def_delegators :configuration, :batch_request_buffer_throttle, :change_headers_on_each_request
+
+    def configuration
+      @configuration ||= Configuration.new
+    end
+
+    def config
+      yield(configuration)
+    end
+
+    def setup!(middleware = false)
+      yield(configuration) if block_given?
+      add_auth_strategy
+    end
 
-  def self.add_auth_strategy
-    Grape::Middleware::Auth::Strategies.add(
-      :grape_devise_token_auth,
-      GrapeDeviseTokenAuth::Middleware,
-      ->(options) { [options[:resource_class]] }
-    )
+    def add_auth_strategy
+      Grape::Middleware::Auth::Strategies.add(
+        :grape_devise_token_auth,
+        GrapeDeviseTokenAuth::Middleware,
+        ->(options) { [options[:resource_class]] }
+      )
+    end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: grape_devise_token_auth
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Michael Cordell
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-06-20 00:00:00.000000000 Z
+date: 2015-06-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -98,8 +98,14 @@ files:
 - bin/setup
 - grape_devise_token_auth.gemspec
 - lib/grape_devise_token_auth.rb
+- lib/grape_devise_token_auth/auth_headers.rb
 - lib/grape_devise_token_auth/auth_helpers.rb
+- lib/grape_devise_token_auth/authorizer_data.rb
+- lib/grape_devise_token_auth/configuration.rb
+- lib/grape_devise_token_auth/devise_interface.rb
 - lib/grape_devise_token_auth/middleware.rb
+- lib/grape_devise_token_auth/token_authorizer.rb
+- lib/grape_devise_token_auth/unauthorized.rb
 - lib/grape_devise_token_auth/version.rb
 homepage: https://github.com/mcordell/grape_devise_token_auth
 licenses: