model_driven_api 2.3.13 → 2.3.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a5497bdb2727e103fa3727595ca62bbaf065b9135dd9bfbc8674f21506929dd0
-  data.tar.gz: ad09cdae9730b0f5c7983eb478c660ef8cc1c13d1d2c1cb13cd9a143b67f4029
+  metadata.gz: 3c73a32dcfadaf698e4d904a110a4ab140a235699d6d71b1f064127624dc4832
+  data.tar.gz: f99c45c100d53fc494bdfef2f886dbb1385951caebfbf5754d6a496f019f1fe3
 SHA512:
-  metadata.gz: 719fcf3175dced8eaea5e238551d7d143edc185e9131c44ae9bf5358509de252da07491c27c16f485644c782f73c8f351379744c60f20bc803b074f024ecdbb8
-  data.tar.gz: ad157de69fbd575e5a9197594901b811a0cb1e74f25eb49146c011fbec9d32ebd6874e8712f2ef8edff4799d9e46cd04e2040c5cbe7c48b3a04e7f428917ab5a
+  metadata.gz: 1642e0c66e19c6ea3c8a383d3000329d5bba051803c026c40767e05ebadce23bff75e0983fc4a720a3681b28566d41d3d3e0d2f61f2a23f602b89ada4b078681
+  data.tar.gz: 0b31e00c37e1a7511c35b6add9c91428791f8e0c13976f83044d5e52dcb43ef0a70071a04828fdd472e5d783239f7eaeb63669a61b6d3258026e83b47057a050

data/app/commands/authenticate_user.rb

@@ -6,26 +6,42 @@ class AuthenticateUser
     end
     prepend SimpleCommand
     
-    def initialize(email, password)
-        @email = email
-        @password = password
+    def initialize(*args)
+        if !args.email.blank? && !args.password.blank?
+            @email = args.email
+            @password = args.password
+        elsif !args.access_token.blank?
+            @access_token = args.access_token
+        end
     end
     
     def call
-        JsonWebToken.encode(user_id: api_user.id) if api_user
+        if !api_user.blank? && result = JsonWebToken.encode(user_id: api_user.id)
+            # The token is created and the api_user exists => Invalidating all the previous tokens
+            # Since this is a new login and I don't care from where it comes, new logins always
+            # Invalidate older tokens
+            UsedToken.where(user_id: api_user.id).update(valid: false)
+            return result
+        end
+        nil
     end
     
     private
     
-    attr_accessor :email, :password
+    attr_accessor :email, :password, :access_token
     
     def api_user
-        user = User.find_by_email(email)
+        if !email.blank? && !password.blank?
+            user = User.find_by(email: email)
+            
+            # Verify the password. You can create a blank method for now.
+            raise AccessDenied if user.blank? && user.authenticate(password).blank?
+        elsif !access_token.blank?
+            user = User.find_by(access_token: access_token)
+        end
+
         raise AccessDenied unless user.present?
         
-        # Verify the password. You can create a blank method for now.
-        raise AccessDenied if user.authenticate(password).blank?
-        
         return user
     end
     

data/app/controllers/api/v2/authentication_controller.rb

@@ -2,7 +2,7 @@ class Api::V2::AuthenticationController < ActionController::API
     include ::ApiExceptionManagement
 
     def authenticate
-        command = AuthenticateUser.call(params[:auth][:email], params[:auth][:password])
+        command = !params[:atoken].blank? && User.column_names.include?("access_token") ? AuthenticateUser.call(access_token: params[:atoken]) : AuthenticateUser.call(email: params[:auth][:email], password: params[:auth][:password])
         
         if command.success?
             response.headers['Token'] = command.result

data/app/controllers/api/v2/info_controller.rb

@@ -15,6 +15,13 @@ class Api::V2::InfoController < Api::V2::ApplicationController
     render json: ::Role.all.to_json, status: 200
   end
 
+
+  # api :GET, '/api/v2/info/heartbeat'
+  # Just keeps the session alive
+  def heartbeat
+    head :ok
+  end
+
   # GET '/api/v2/info/translations'
   def translations
     render json: I18n.t(".", locale: (params[:locale].presence || :it)).to_json, status: 200

data/app/models/used_token.rb

@@ -0,0 +1,7 @@
+class UsedToken < ApplicationRecord
+  belongs_to :user, inverse_of: :used_tokens
+
+  rails_admin do
+    visible false
+  end
+end

data/db/migrate/20210519145438_create_used_tokens.rb

@@ -0,0 +1,12 @@
+class CreateUsedTokens < ActiveRecord::Migration[6.0]
+  def change
+    create_table :used_tokens do |t|
+      t.string :token
+      t.references :user, null: false, foreign_key: true
+      t.boolean :valid, default: true
+
+      t.timestamps
+    end
+    add_index :used_tokens, :token, unique: true
+  end
+end

data/lib/concerns/model_driven_api_user.rb

@@ -2,7 +2,7 @@ module ModelDrivenApiUser
     extend ActiveSupport::Concern
     
     included do
-
+        has_many :used_tokens, inverse_of: :user, dependent: :destroy
         ## DSL (AKA what to show in the returned JSON)
         # Use @@json_attrs to drive json rendering for 
         # API model responses (index, show and update ones).

data/lib/json_web_token.rb

@@ -1,14 +1,19 @@
 class JsonWebToken
-    class << self
-      def encode(payload, expiry = 15.minutes.from_now.to_i)
-        ::JWT.encode(payload.merge(exp: expiry), ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])
-      end
-      
-      def decode(token)
-        body = ::JWT.decode(token, ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])[0]
-        ::HashWithIndifferentAccess.new body
-      rescue
-        nil
-      end
+  class << self
+    def encode(payload, expiry = 15.minutes.from_now.to_i)
+      result = ::JWT.encode(payload.merge(exp: expiry), ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])
+      # Store the created token into the DB for later checks if is invalid
+      UsedToken.create(token: result, user_id: payload[:user_id])
+      result
     end
-  end
+    
+    def decode(token)
+      # Check if the passed token is present and valid into the UsedToken 
+      raise "Token is invalidated by new login" unless UsedToken.exists?(token: token, valid: true)
+      body = ::JWT.decode(token, ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])[0]
+      ::HashWithIndifferentAccess.new body
+    rescue
+      nil
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 2.3.13
+  version: 2.3.15
 platform: ruby
 authors:
 - Gabriele Tassoni
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-04-12 00:00:00.000000000 Z
+date: 2021-05-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thecore_backend_commons
@@ -139,12 +139,14 @@ files:
 - app/controllers/api/v2/authentication_controller.rb
 - app/controllers/api/v2/info_controller.rb
 - app/controllers/api/v2/users_controller.rb
+- app/models/used_token.rb
 - config/initializers/after_initialize_for_model_driven_api.rb
 - config/initializers/cors_api_thecore.rb
 - config/initializers/knock.rb
 - config/initializers/time_with_zone.rb
 - config/initializers/wrap_parameters.rb
 - config/routes.rb
+- db/migrate/20210519145438_create_used_tokens.rb
 - lib/concerns/api_exception_management.rb
 - lib/concerns/model_driven_api_role.rb
 - lib/concerns/model_driven_api_user.rb
@@ -173,7 +175,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.0.3.1
 signing_key: 
 specification_version: 4
 summary: Convention based RoR engine which uses DB schema introspection to create