model_driven_api 2.3.0 → 2.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f44af97e4b4d3635094fafe61cbc0fe879edd45bc99747b2d115c1a5109530bf
-  data.tar.gz: db8ab368cef3ad69ea706c39652599319ef99391f98961f7718c7fb3768ea1a3
+  metadata.gz: 315cd43dc90a24097cd08e0ee261ba26b94b8b2e1a9f640416b68b7366b0352e
+  data.tar.gz: 47a36df93c41c8bcb0a32d832d3b7067e1b9894eda39c313fc0c18cdf17ced2d
 SHA512:
-  metadata.gz: 0244e9a0f3b56fa736e85337e059e746c00367c177bb638eeea034382852bd56d2c04866c3a37f4edc21944003e87a6d0c1dc17defe7ad8e610a8780145a06e8
-  data.tar.gz: dd602eb587d3cab355e2e2537dfcba69ba3039881b58307cd27b6fb0f1fcb0058a2176e7274877716aa94c6c5c45c0faeb58c4632282c86f483411dcc680be22
+  metadata.gz: 8d121bf09e8f799dc08ba1b7a5cb5c1b17b6d810eaee6a4c32886733f1e1133a770618bcc2c31ebbf5876f377d017244ad68d63b9d76770dfdcd4e779e09c313
+  data.tar.gz: c47b0e7fc8a63f96eb238cc8b6d8601b15e0d534b00151717ac333fff86f764998bb7857a471037c918bb25c24b89fe4ab7a63186683209c98e48eb4f18ffb4f

data/README.md

@@ -422,7 +422,7 @@ Once loaded the tests inside the insomnia application, please right click on the
 
 ## TODO
 
-* Add a Trust management for API consumers, to have some low level interactions happen between API client and server done without the need for giving a USERNAME and a PASSWORD.
+* Document the new feature (from version 2.3.3) to add Authentication methods which override the JWT described above. Useful for Webhooks and machine2machine trusted dialogues.
 
 ## References
 Thanks to all these people for ideas:

data/app/commands/authenticate_user.rb

@@ -1,7 +1,7 @@
 class AuthenticateUser
     class AccessDenied < StandardError
-        def message
-            "AuthenticationError"
+        def message more = "AuthenticationError"
+            more
         end
     end
     prepend SimpleCommand

data/app/controllers/api/v2/application_controller.rb

@@ -21,7 +21,7 @@ class Api::V2::ApplicationController < ActionController::API
 
         # Normal Index Action with Ransack querying
         @q = (@model.column_names.include?("user_id") ? @model.where(user_id: current_user.id) : @model).ransack(@query.presence|| params[:q])
-        @records_all = @q.result(distinct: true)
+        @records_all = @q.result # (distinct: true) Removing, but I'm not sure, with it I cannot sort in postgres for associated records (throws an exception on misuse of sort with distinct)
         page = (@page.presence || params[:page])
         per = (@per.presence || params[:per])
         pages_info = (@pages_info.presence || params[:pages_info])
@@ -107,15 +107,34 @@ class Api::V2::ApplicationController < ActionController::API
             # call an unwanted method in the AR Model.
             resource = "custom_action_#{params[:do]}"
             raise NoMethodError unless @model.respond_to?(resource)
-            return true, MultiJson.dump(params[:id].blank? ? @model.send(resource, params) : @model.send(resource, params[:id].to_i, params))
+            # return true, MultiJson.dump(params[:id].blank? ? @model.send(resource, params) : @model.send(resource, params[:id].to_i, params))
+            return true, MultiJson.dump(@model.send(resource, params))
         end
         # if it's here there is no custom action in the request querystring
         return false
     end
+
+    def class_exists?(class_name)
+        klass = Module.const_get(class_name)
+        return klass.is_a?(Class)
+    rescue NameError
+        return false
+    end
     
     def authenticate_request
-        @current_user = AuthorizeApiRequest.call(request.headers).result
-        return unauthenticated! unless @current_user
+        # puts request.headers.inspect
+        @current_user = nil
+        # puts "Are there wbehooks headers to check for? #{Settings.ns(:security).allowed_authorization_headers}"
+        Settings.ns(:security).allowed_authorization_headers.split(",").each do |header|
+            # puts "Found header #{header}: #{request.headers[header.underscore.dasherize]}" 
+            check_authorization("Authorize#{header}".constantize.call(request.headers, request.raw_post)) if request.headers[header.underscore.dasherize]
+        end
+        return unauthenticated!(OpenStruct.new({message: @auth_errors})) unless @current_user
+        
+        # This is the default one, if the header doesn't have a valid form for one of the other Auth methods, then use this Auth Class
+        check_authorization AuthorizeApiRequest.call(request.headers) unless @current_user
+        return unauthenticated!(OpenStruct.new({message: @auth_errors})) unless @current_user
+        
         current_user = @current_user
         params[:current_user_id] = @current_user.id
         # Now every time the user fires off a successful GET request, 
@@ -147,6 +166,14 @@ class Api::V2::ApplicationController < ActionController::API
         return not_found! if (!@model.new.is_a? ActiveRecord::Base rescue false)
     end
 
+    def check_authorization cmd
+        if cmd.success?
+            @current_user = cmd.result 
+        else
+            @auth_errors = cmd.errors
+        end
+    end
+
     # Nullifying strong params for API
     def params
         request.parameters

data/lib/concerns/api_exception_management.rb

@@ -33,7 +33,7 @@ module ApiExceptionManagement
         
         def api_error(status: 500, errors: [])
             # puts errors.full_messages if !Rails.env.production? && errors.respond_to?(:full_messages)
-            head status && return if errors.empty?
+            head status && return if errors.blank?
             
             # For retrocompatibility, I try to send back only strings, as errors
             errors_response = if errors.respond_to?(:full_messages) 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 2.3.0
+  version: 2.3.5
 platform: ruby
 authors:
 - Gabriele Tassoni
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-11-03 00:00:00.000000000 Z
+date: 2021-02-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thecore_backend_commons