model_driven_api 2.3.11 → 2.3.17

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f318cd8434ed86ff9045ec0a2849774d2d4232f9b057ea70c2313f2255011ff6
-  data.tar.gz: b587c4fee867ea15389db03d191c899061856fc8a53beea17bf7b88f0aa86cf3
+  metadata.gz: aa5e1a3c1035f1a2c765dfc5969845af3c80d70a2e0063e2f42b140b636b751a
+  data.tar.gz: 461d22a194727f614e60227f2ed886b0f8fe92e27a984ed13e8b33f5e73db2e8
 SHA512:
-  metadata.gz: d92b432a32ee4a23c2209f66ab40eb6d2f56bb3fc9b7229da63eba8a105aacdfcfea36b21cb2739f879077e9f736e1b0ba3e5c4d0602b070cc388aaec684cefa
-  data.tar.gz: 330b5cbc65fed482fc7af84368967ae3987047d6235f68b5f8fa1b8757c626dbfcde0f6bdde13d3f644666850f24be6cd9a793ffe6ea528ed78b35d9dc8cb933
+  metadata.gz: a401038c58d3bf9386e5020b4552040a013c5c6867c2df16ae831ebaf90ae7c22a0ed75187bd2f09fcadf00d48958ec314e288fe74767471d2432eaef6f95e39
+  data.tar.gz: 4b03ebfbc44d9158198f1a455a5a294a5436e31af3488714b0a0fd153771aa38f2907d613a4b76a552dcbf463a6c6969821bac3a79a77e4777fd0be5b86dc745

data/app/commands/authenticate_user.rb

@@ -6,26 +6,43 @@ class AuthenticateUser
     end
     prepend SimpleCommand
     
-    def initialize(email, password)
-        @email = email
-        @password = password
+    def initialize(*args)
+        first_arg = args.first
+        if !first_arg[:email].blank? && !first_arg[:password].blank?
+            @email = first_arg[:email]
+            @password = first_arg[:password]
+        elsif !first_arg[:access_token].blank?
+            @access_token = first_arg[:access_token]
+        end
     end
     
     def call
-        JsonWebToken.encode(user_id: api_user.id) if api_user
+        current_u = api_user
+        if !current_u.blank? && result = JsonWebToken.encode(user_id: current_u.id)
+            # The token is created and the api_user exists => Invalidating all the previous tokens
+            # Since this is a new login and I don't care from where it comes, new logins always
+            # Invalidate older tokens
+            UsedToken.where(user_id: api_user.id).update(is_valid: false) if ENV["ALLOW_MULTISESSIONS"] == "false"
+            return result
+        end
+        nil
     end
     
     private
     
-    attr_accessor :email, :password
+    attr_accessor :email, :password, :access_token
     
     def api_user
-        user = User.find_by_email(email)
+        if !email.blank? && !password.blank?
+            user = User.find_by(email: email)
+            # Verify the password.
+            raise AccessDenied if user.blank? && user.authenticate(password).blank?
+        elsif !access_token.blank?
+            user = User.find_by(access_token: access_token)
+        end
+
         raise AccessDenied unless user.present?
         
-        # Verify the password. You can create a blank method for now.
-        raise AccessDenied if user.authenticate(password).blank?
-        
         return user
     end
     

data/app/controllers/api/v2/application_controller.rb

@@ -128,15 +128,12 @@ class Api::V2::ApplicationController < ActionController::API
     end
     
     def authenticate_request
-        # puts request.headers.inspect
         @current_user = nil
-        # puts "Are there wbehooks headers to check for? #{Settings.ns(:security).allowed_authorization_headers}"
         Settings.ns(:security).allowed_authorization_headers.split(",").each do |header|
             # puts "Found header #{header}: #{request.headers[header.underscore.dasherize]}" 
             check_authorization("Authorize#{header}".constantize.call(request.headers, request.raw_post)) if request.headers[header.underscore.dasherize]
         end
         
-        # This is the default one, if the header doesn't have a valid form for one of the other Auth methods, then use this Auth Class
         check_authorization AuthorizeApiRequest.call(request.headers) unless @current_user
         return unauthenticated!(OpenStruct.new({message: @auth_errors})) unless @current_user
         

data/app/controllers/api/v2/authentication_controller.rb

@@ -2,7 +2,7 @@ class Api::V2::AuthenticationController < ActionController::API
     include ::ApiExceptionManagement
 
     def authenticate
-        command = AuthenticateUser.call(params[:auth][:email], params[:auth][:password])
+        command = !params[:atoken].blank? && User.column_names.include?("access_token") ? AuthenticateUser.call(access_token: params[:atoken]) : AuthenticateUser.call(email: params[:auth][:email], password: params[:auth][:password])
         
         if command.success?
             response.headers['Token'] = command.result

data/app/controllers/api/v2/info_controller.rb

@@ -15,6 +15,13 @@ class Api::V2::InfoController < Api::V2::ApplicationController
     render json: ::Role.all.to_json, status: 200
   end
 
+
+  # api :GET, '/api/v2/info/heartbeat'
+  # Just keeps the session alive by returning a new token
+  def heartbeat
+    head :ok
+  end
+
   # GET '/api/v2/info/translations'
   def translations
     render json: I18n.t(".", locale: (params[:locale].presence || :it)).to_json, status: 200

data/app/models/used_token.rb

@@ -0,0 +1,3 @@
+class UsedToken < ApplicationRecord
+  belongs_to :user, inverse_of: :used_tokens
+end

data/config/routes.rb

@@ -12,6 +12,7 @@ Rails.application.routes.draw do
                 get :translations
                 get :schema
                 get :dsl
+                get :heartbeat
             end
 
             post "authenticate" => "authentication#authenticate"

data/db/migrate/20210519145438_create_used_tokens.rb

@@ -0,0 +1,12 @@
+class CreateUsedTokens < ActiveRecord::Migration[6.0]
+  def change
+    create_table :used_tokens do |t|
+      t.string :token
+      t.references :user, null: false, foreign_key: true
+      t.boolean :valid, default: true
+
+      t.timestamps
+    end
+    add_index :used_tokens, :token, unique: true
+  end
+end

data/db/migrate/20210528111450_rename_valid_to_is_valid_in_used_token.rb

@@ -0,0 +1,7 @@
+class RenameValidToIsValidInUsedToken < ActiveRecord::Migration[6.0]
+  def change
+    change_table :used_tokens do |t|
+      t.rename :valid, :is_valid
+    end
+  end
+end

data/lib/concerns/model_driven_api_user.rb

@@ -2,7 +2,7 @@ module ModelDrivenApiUser
     extend ActiveSupport::Concern
     
     included do
-
+        has_many :used_tokens, inverse_of: :user, dependent: :destroy
         ## DSL (AKA what to show in the returned JSON)
         # Use @@json_attrs to drive json rendering for 
         # API model responses (index, show and update ones).

data/lib/json_web_token.rb

@@ -1,14 +1,19 @@
 class JsonWebToken
-    class << self
-      def encode(payload, expiry = 15.minutes.from_now.to_i)
-        ::JWT.encode(payload.merge(exp: expiry), ::Rails.application.credentials.dig(:secret_key_base))
-      end
-      
-      def decode(token)
-        body = ::JWT.decode(token, ::Rails.application.credentials.dig(:secret_key_base))[0]
-        ::HashWithIndifferentAccess.new body
-      rescue
-        nil
-      end
+  class << self
+    def encode(payload, expiry = 15.minutes.from_now.to_i)
+      result = ::JWT.encode(payload.merge(exp: expiry), ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])
+      # Store the created token into the DB for later checks if is invalid
+      UsedToken.create(token: result, user_id: payload[:user_id])
+      result
     end
-  end
+    
+    def decode(token)
+      # Check if the passed token is present and valid into the UsedToken 
+      raise "Token is invalidated by new login" unless UsedToken.exists?(token: token, is_valid: true)
+      body = ::JWT.decode(token, ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])[0]
+      ::HashWithIndifferentAccess.new body
+    rescue
+      nil
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 2.3.11
+  version: 2.3.17
 platform: ruby
 authors:
 - Gabriele Tassoni
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-04-01 00:00:00.000000000 Z
+date: 2021-05-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thecore_backend_commons
@@ -139,12 +139,15 @@ files:
 - app/controllers/api/v2/authentication_controller.rb
 - app/controllers/api/v2/info_controller.rb
 - app/controllers/api/v2/users_controller.rb
+- app/models/used_token.rb
 - config/initializers/after_initialize_for_model_driven_api.rb
 - config/initializers/cors_api_thecore.rb
 - config/initializers/knock.rb
 - config/initializers/time_with_zone.rb
 - config/initializers/wrap_parameters.rb
 - config/routes.rb
+- db/migrate/20210519145438_create_used_tokens.rb
+- db/migrate/20210528111450_rename_valid_to_is_valid_in_used_token.rb
 - lib/concerns/api_exception_management.rb
 - lib/concerns/model_driven_api_role.rb
 - lib/concerns/model_driven_api_user.rb
@@ -173,7 +176,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.0.3.1
 signing_key: 
 specification_version: 4
 summary: Convention based RoR engine which uses DB schema introspection to create