groovestack-auth 0.1.5 → 0.1.6

data/lib/graphql/user/mutations.rb

@@ -1,63 +0,0 @@
-# frozen_string_literal: true
-
-module GraphQL
-  module User
-    module Mutations
-      class Update < ::Groovestack::Base::GraphQL::Base::Mutation
-        argument :current_password, String, required: false
-        argument :email, String, required: false
-        argument :id, ID, required: true
-        argument :image, String, required: false
-        argument :language, String, required: false
-        argument :name, String, required: false
-        argument :password, String, required: false
-        argument :roles, [String], required: false
-
-        type ::GraphQL::User::Type
-
-        def current_user
-          context[:current_resource]
-        end
-
-        def perform(id:, **attrs)
-          obj = id == current_user&.id ? current_user : ::User.find(id)
-
-          return update_with_password!(obj, **attrs) if attrs.keys.intersect?(%i[password current_password])
-
-          if !current_user.admin? && attrs[:roles].present?
-            raise GraphQL::ExecutionError,
-                  'Validation Failed: only admins can update user roles'
-          end
-
-          obj.update!(attrs)
-
-          obj
-        end
-
-        def update_with_password!(user, **attrs) # rubocop:disable Metrics/AbcSize
-          unless current_user&.id == user.id
-            raise GraphQL::ExecutionError,
-                  'Validation Failed: user can only update their own password'
-          end
-
-          ::User.transaction do
-            # if password isn't set yet, allow them to set it
-            user.password = attrs[:current_password] = attrs[:password] unless user.email_provider?
-
-            raise GraphQL::ExecutionError, user.errors.full_messages.join(' ') unless user.update_with_password(attrs)
-
-            context[:bypass_sign_in].call user.reload, scope: :user
-          end
-
-          user
-        end
-      end
-
-      extend ActiveSupport::Concern
-
-      included do
-        field :update_user, mutation: ::GraphQL::User::Mutations::Update, description: 'update user'
-      end
-    end
-  end
-end

data/lib/graphql/user/queries.rb

@@ -1,40 +0,0 @@
-# frozen_string_literal: true
-
-module GraphQL
-  module User
-    module Queries
-      extend ActiveSupport::Concern
-
-      included do
-        include ::Groovestack::Base::GraphQL::Providers::ReactAdmin::Resource
-
-        react_admin_resource :users, graphql_path: 'GraphQL'
-
-        def User(id:) # rubocop:disable Naming/MethodName
-          id == 'me' ? current_user : ::User.find(id)
-        end
-      end
-
-      def current_user
-        context[:current_resource]
-      end
-
-      def users_scope(base_scope:, sort_field: nil, sort_order: nil, filter: {}) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity
-        scope = base_scope
-        scope = scope.where(id: filter.ids) if filter.ids.present?
-
-        if filter.q.present?
-          scope = scope.where(id: scope.fuzzysearch(filter.q)).or(scope.where(id: scope.emailsearch(filter.q)))
-        end
-        scope = scope.fuzzysearch(filter.name) if filter.name.present?
-        scope = scope.with_roles(filter.roles) if filter.roles.present?
-
-        return scope if sort_field.blank?
-
-        sort_field = 'last_sign_in_at' if sort_field == 'last_login_at'
-
-        scope.order({ sort_field.underscore => sort_order || 'desc' })
-      end
-    end
-  end
-end

data/lib/graphql/user/type.rb

@@ -1,30 +0,0 @@
-# frozen_string_literal: true
-
-module GraphQL
-  module User
-    class Type < ::Groovestack::Base::GraphQL::Base::Object
-      include ::Groovestack::Base::GraphQL::Types::TypeResolver
-
-      description 'An user'
-
-      field :created_at, ::GraphQL::Types::ISO8601DateTime, null: false, description: 'created at'
-      field :id, ID, null: false, description: 'id'
-      field :updated_at, ::GraphQL::Types::ISO8601DateTime, null: false, description: 'updated at'
-
-      field :email, String, null: true, description: 'email'
-      field :has_email_provider, Boolean, null: true, description: 'user has email provider',
-                                          method: :email_provider?
-      field :image, String, null: true, description: 'user image url'
-      field :language, String, null: true, description: 'user language'
-      field :name, String, null: true, description: 'name'
-      field :roles, [String], null: true, description: 'roles'
-
-      # devise fields
-      field :last_login_at, ::GraphQL::Types::ISO8601DateTime, null: true, description: 'last login in at',
-                                                               method: :last_sign_in_at
-      field :sign_in_count, Integer, null: true, description: 'sign in count'
-
-      field :identities, [::GraphQL::Identity::Type], null: false, description: 'identities'
-    end
-  end
-end

data/lib/groovestack/auth/authenticated_api_controller.rb

@@ -1,13 +0,0 @@
-# frozen_string_literal: true
-
-require 'devise_token_auth/concerns/resource_finder'
-require 'devise_token_auth/concerns/set_user_by_token'
-
-module Groovestack
-  module Auth
-    class AuthenticatedApiController < ApplicationController
-      include GraphqlDevise::SetUserByToken
-      include Devise::Controllers::Helpers
-    end
-  end
-end

data/lib/groovestack/auth/omniauth_callbacks_controller.rb

@@ -1,111 +0,0 @@
-# frozen_string_literal: true
-
-require 'devise_helper'
-require 'devise_controller'
-require 'devise_token_auth/concerns/resource_finder'
-require 'devise_token_auth/concerns/set_user_by_token'
-require 'devise_token_auth/application_controller'
-require 'devise_token_auth/omniauth_callbacks_controller'
-
-module Groovestack
-  module Auth
-    class OmniauthCallbacksController < DeviseTokenAuth::OmniauthCallbacksController
-      def verified_request?
-        # required b/c apple uses POST to callback and resets the origin header
-        # source: https://github.com/rails/rails/blob/6b93fff8af32ef5e91f4ec3cfffb081d0553faf0/actionpack/lib/action_controller/metal/request_forgery_protection.rb#L442C11-L442C27
-
-        apple_success_callback_request? || super
-      end
-
-      def apple_success_callback_request?
-        params[:action] == 'verified' && params[:provider] == 'apple' && request.headers['Origin'] == 'https://appleid.apple.com'
-      end
-
-      def auth_hash
-        @auth_hash ||= request.env['omniauth.auth'] # goes through plain old omniauth so need to override
-      end
-
-      def resource_class(_mapping = nil)
-        # TODO: this is required b/c their code relies on the resource_class
-        # method which expects access to the 'dta.omniauth.params' which we
-        # don't currently have access through b/c we are going directly
-        # through omniauth
-
-        return @resource_class if defined?(@resource_class)
-
-        raise 'No resource_class found' if @resource.blank?
-
-        @resource_class = @resource.class
-
-        @resource_class
-      end
-
-      def create_auth_params
-        @auth_params = {
-          auth_token: @token.token,
-          client_id: @token.client,
-          # uid:        @resource.uid,
-          expiry: @token.expiry,
-          config: @config,
-          id: @resource.id
-        }
-        @auth_params.merge!(oauth_registration: true) if @oauth_registration
-        @auth_params
-      end
-
-      def get_resource_from_auth_hash # rubocop:disable Naming/AccessorMethodName
-        # invitation_token = request.env.dig('omniauth.params', 'invitation_token')
-        language = request.env.dig('omniauth.params', 'language')
-
-        c_user = begin
-          current_user
-        rescue StandardError
-          nil
-        end
-
-        identity_params = {
-          auth: auth_hash,
-          current_user: c_user,
-          user_attrs: {
-            defaults: {
-              roles: Groovestack::Config::App.generate_config[:has_admins] ? [] : [Users::Roles::Role::ADMIN]
-            },
-            priority: {
-              language: language
-            }
-          }
-        }
-
-        @resource = Identity.find_or_create_from_omniauth!(**identity_params).user
-
-        @resource
-      end
-
-      def verified # rubocop:disable Metrics/AbcSize
-        omniauth_success do
-          set_token_in_cookie(@resource, @token)
-
-          redirect_url = if redirect_options.present? || request.env['omniauth.origin'].split('?').size > 1
-                           DeviseTokenAuth::Url.generate(request.env['omniauth.origin'], redirect_options)
-                         else
-                           request.env['omniauth.origin'].split('?').first # get rid of occasional trailing ?
-                         end
-
-          redirect_to redirect_url
-
-          return
-        end
-      end
-
-      def omniauth_failure
-        @error = params[:message]
-        # render_data_or_redirect('authFailure', omniauth_failure_error: @error)
-
-        ::Groovestack::Base.notify_error('Groovestack::Auth::OmniauthCallbacksController.omniauth_failure', @error)
-
-        data = { omniauth_failure_error: @error }.merge(redirect_options)
-        redirect_to DeviseTokenAuth::Url.generate(session['omniauth.origin'], data)
-      end
-    end
-  end
-end

data/lib/groovestack/auth/schema_plugin.rb

@@ -1,19 +0,0 @@
-# frozen_string_literal: true
-
-module Groovestack
-  module Auth
-    module SchemaPlugin
-      extend ActiveSupport::Concern
-
-      included do
-        use GraphqlDevise::SchemaPlugin.new(
-          query: Types::QueryType,
-          mutation: Types::MutationType,
-          resource_loaders: [
-            GraphqlDevise::ResourceLoader.new(User)
-          ]
-        )
-      end
-    end
-  end
-end

data/lib/identity.rb

@@ -1,31 +0,0 @@
-# frozen_string_literal: true
-
-class Identity < ActiveRecord::Base
-  belongs_to :user
-
-  def self.find_or_create_from_omniauth!(auth:, current_user: nil, user_attrs: {}) # rubocop:disable Metrics/AbcSize
-    where(provider: auth.provider, uid: auth.uid).first_or_create! do |identity|
-      # TODO
-      # possible cases
-      # 1. user exists in the system (i.e. we found an email for them)
-      # 2. user does not exist in the system (i.e. oauth email doesn't match anything in the system
-
-      user = current_user || User.find_by(email: auth.info.email)
-      user_attrs_to_assign = user_attrs[:priority] || {}
-
-      if user.nil?
-        user_attrs_to_assign = user_attrs_to_assign.merge(user_attrs[:defaults] || {})
-        user = User.new
-      end
-
-      attrs = auth['info'].to_hash.slice(*user.attribute_names)
-      user.assign_attributes(attrs.merge(user_attrs_to_assign))
-
-      # user.skip_confirmation!
-      user.save!
-
-      identity.omniauth_data = auth
-      identity.user = user
-    end
-  end
-end

data/lib/user.rb

@@ -1,53 +0,0 @@
-# frozen_string_literal: true
-
-require 'jsonb_accessor'
-
-class User < ActiveRecord::Base
-  include Users::Roles
-
-  if defined?(Devise)
-    extend ::Devise::Models
-
-    # Include default devise modules. Others available are:
-    # :confirmable, :lockable, :timeoutable
-
-    devise :database_authenticatable, :registerable,
-           :recoverable, :rememberable, :trackable, :validatable
-  end
-
-  has_many :identities, dependent: :destroy
-
-  scope :fuzzysearch, ->(q) { where('name::text ilike ?', "%#{q}%".gsub(/\s/, '%').squeeze('%')) }
-  scope :emailsearch, ->(qemail) { where('email::text ilike ?', "#{qemail}%") }
-
-  # GraphqlDevise overrides (due to omniauthable relying on new Identity model)
-  # NOTE: DeviseTokenAuth User.provider & User.uid columns are removed
-  # TODO: can we remove this overrides?
-
-  def provider
-    # will probably need to pick from identities eventually
-    nil
-  end
-
-  def uid
-    nil
-  end
-
-  def email_provider?
-    encrypted_password.present?
-  end
-
-  def build_auth_headers(token, client = 'default') # rubocop:disable Metrics/AbcSize
-    # client may use expiry to prevent validation request if expired
-    # must be cast as string or headers will break
-    expiry = tokens[client]['expiry'] || tokens[client][:expiry]
-    headers = {
-      DeviseTokenAuth.headers_names[:'access-token'] => token,
-      DeviseTokenAuth.headers_names[:'token-type'] => 'Bearer',
-      DeviseTokenAuth.headers_names[:client] => client,
-      DeviseTokenAuth.headers_names[:expiry] => expiry.to_s,
-      DeviseTokenAuth.headers_names[:id] => id
-    }
-    headers.merge(build_bearer_token(headers))
-  end
-end

data/lib/users/roles.rb

@@ -1,42 +0,0 @@
-# frozen_string_literal: true
-
-module Users
-  module Roles
-    extend ActiveSupport::Concern
-
-    included do
-      scope :with_roles, ->(roles) { jsonb_contains(:roles, roles) }
-      scope :admins, -> { with_roles(:admin) }
-
-      module Role
-        ADMIN = 'admin'
-      end
-
-      ROLES = [
-        Role::ADMIN
-      ].freeze
-
-      def add_roles(roles)
-        self.roles |= roles
-      end
-
-      def add_role(role)
-        add_roles([role])
-      end
-
-      def admin!
-        add_role(User::Role::ADMIN)
-        save!
-      end
-
-      def admin?
-        roles.include? User::Role::ADMIN
-      end
-
-      # TODO: rname role?
-      def has_role?(role) # rubocop:disable Naming/PredicateName
-        roles.include? role.to_s
-      end
-    end
-  end
-end