model_driven_api 2.3.13 → 2.3.19

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a5497bdb2727e103fa3727595ca62bbaf065b9135dd9bfbc8674f21506929dd0
-  data.tar.gz: ad09cdae9730b0f5c7983eb478c660ef8cc1c13d1d2c1cb13cd9a143b67f4029
+  metadata.gz: d38e64a791f7147bdc145e1767814ac885fcf75ff5031cf30743b96d8717fb32
+  data.tar.gz: 213dc7345b1061bca3a93826ac9c52b63e97bee20891aca0569f0e14ce11f565
 SHA512:
-  metadata.gz: 719fcf3175dced8eaea5e238551d7d143edc185e9131c44ae9bf5358509de252da07491c27c16f485644c782f73c8f351379744c60f20bc803b074f024ecdbb8
-  data.tar.gz: ad157de69fbd575e5a9197594901b811a0cb1e74f25eb49146c011fbec9d32ebd6874e8712f2ef8edff4799d9e46cd04e2040c5cbe7c48b3a04e7f428917ab5a
+  metadata.gz: 5d435ae0c87967fcdfb1517cf1f353588635efb1df3a657b555f9d622bd7aff36c684c8c8cfaf764926edaf93109ddabc813867dbb62000a7b92d220c1d1a93e
+  data.tar.gz: 609644b3be46a961b594e95fc601bc48393095a6bf090679094d5227427856ced680c83d0fb44d489589d3e2433d145473bc080a90a8574040c77cfbb59ab47f

data/app/commands/authenticate_user.rb

@@ -6,26 +6,43 @@ class AuthenticateUser
     end
     prepend SimpleCommand
     
-    def initialize(email, password)
-        @email = email
-        @password = password
+    def initialize(*args)
+        first_arg = args.first
+        if !first_arg[:email].blank? && !first_arg[:password].blank?
+            @email = first_arg[:email]
+            @password = first_arg[:password]
+        elsif !first_arg[:access_token].blank?
+            @access_token = first_arg[:access_token]
+        end
     end
     
     def call
-        JsonWebToken.encode(user_id: api_user.id) if api_user
+        current_u = api_user
+        if !current_u.blank? && result = JsonWebToken.encode(user_id: current_u.id)
+            # The token is created and the api_user exists => Invalidating all the previous tokens
+            # Since this is a new login and I don't care from where it comes, new logins always
+            # Invalidate older tokens
+            UsedToken.where(user_id: api_user.id).update(is_valid: false) if ENV["ALLOW_MULTISESSIONS"] == "false"
+            return result
+        end
+        nil
     end
     
     private
     
-    attr_accessor :email, :password
+    attr_accessor :email, :password, :access_token
     
     def api_user
-        user = User.find_by_email(email)
+        if !email.blank? && !password.blank?
+            user = User.find_by(email: email)
+            # Verify the password.
+            raise AccessDenied if user.blank? && user.authenticate(password).blank?
+        elsif !access_token.blank?
+            user = User.find_by(access_token: access_token)
+        end
+
         raise AccessDenied unless user.present?
         
-        # Verify the password. You can create a blank method for now.
-        raise AccessDenied if user.authenticate(password).blank?
-        
         return user
     end
     

data/app/controllers/api/v2/authentication_controller.rb

@@ -2,7 +2,7 @@ class Api::V2::AuthenticationController < ActionController::API
     include ::ApiExceptionManagement
 
     def authenticate
-        command = AuthenticateUser.call(params[:auth][:email], params[:auth][:password])
+        command = !params[:atoken].blank? && User.column_names.include?("access_token") ? AuthenticateUser.call(access_token: params[:atoken]) : AuthenticateUser.call(email: params[:auth][:email], password: params[:auth][:password])
         
         if command.success?
             response.headers['Token'] = command.result

data/app/controllers/api/v2/info_controller.rb

@@ -15,6 +15,13 @@ class Api::V2::InfoController < Api::V2::ApplicationController
     render json: ::Role.all.to_json, status: 200
   end
 
+
+  # api :GET, '/api/v2/info/heartbeat'
+  # Just keeps the session alive by returning a new token
+  def heartbeat
+    head :ok
+  end
+
   # GET '/api/v2/info/translations'
   def translations
     render json: I18n.t(".", locale: (params[:locale].presence || :it)).to_json, status: 200

data/app/models/used_token.rb

@@ -0,0 +1,3 @@
+class UsedToken < ApplicationRecord
+  belongs_to :user, inverse_of: :used_tokens
+end

data/config/routes.rb

@@ -12,6 +12,7 @@ Rails.application.routes.draw do
                 get :translations
                 get :schema
                 get :dsl
+                get :heartbeat
             end
 
             post "authenticate" => "authentication#authenticate"

data/db/migrate/20210519145438_create_used_tokens.rb

@@ -0,0 +1,12 @@
+class CreateUsedTokens < ActiveRecord::Migration[6.0]
+  def change
+    create_table :used_tokens do |t|
+      t.string :token
+      t.references :user, null: false, foreign_key: true
+      t.boolean :valid, default: true
+
+      t.timestamps
+    end
+    add_index :used_tokens, :token, unique: true
+  end
+end

data/db/migrate/20210528111450_rename_valid_to_is_valid_in_used_token.rb

@@ -0,0 +1,7 @@
+class RenameValidToIsValidInUsedToken < ActiveRecord::Migration[6.0]
+  def change
+    change_table :used_tokens do |t|
+      t.rename :valid, :is_valid
+    end
+  end
+end

data/lib/concerns/model_driven_api_user.rb

@@ -2,7 +2,7 @@ module ModelDrivenApiUser
     extend ActiveSupport::Concern
     
     included do
-
+        has_many :used_tokens, inverse_of: :user, dependent: :destroy
         ## DSL (AKA what to show in the returned JSON)
         # Use @@json_attrs to drive json rendering for 
         # API model responses (index, show and update ones).

data/lib/json_web_token.rb

@@ -1,14 +1,20 @@
 class JsonWebToken
-    class << self
-      def encode(payload, expiry = 15.minutes.from_now.to_i)
-        ::JWT.encode(payload.merge(exp: expiry), ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])
-      end
-      
-      def decode(token)
-        body = ::JWT.decode(token, ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])[0]
-        ::HashWithIndifferentAccess.new body
-      rescue
-        nil
-      end
+  class << self
+    def encode(payload, expiry = 15.minutes.from_now.to_i)
+      result = ::JWT.encode(payload.merge(exp: expiry), ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])
+      # Store the created token into the DB for later checks if is invalid
+      # In a public environment management, without login, it has no interest, so I don't pollute the DB
+      UsedToken.find_or_create_by(token: result, user_id: payload[:user_id]) if ENV["ALLOW_MULTISESSIONS"] == "false"
+      result
     end
-  end
+    
+    def decode(token)
+      # Check if the passed token is present and valid into the UsedToken 
+      raise "Token is invalidated by new login" unless UsedToken.exists?(token: token, is_valid: true) if ENV["ALLOW_MULTISESSIONS"] == "false"
+      body = ::JWT.decode(token, ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])[0]
+      ::HashWithIndifferentAccess.new body
+    rescue
+      nil
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 2.3.13
+  version: 2.3.19
 platform: ruby
 authors:
 - Gabriele Tassoni
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-04-12 00:00:00.000000000 Z
+date: 2021-05-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thecore_backend_commons
@@ -139,12 +139,15 @@ files:
 - app/controllers/api/v2/authentication_controller.rb
 - app/controllers/api/v2/info_controller.rb
 - app/controllers/api/v2/users_controller.rb
+- app/models/used_token.rb
 - config/initializers/after_initialize_for_model_driven_api.rb
 - config/initializers/cors_api_thecore.rb
 - config/initializers/knock.rb
 - config/initializers/time_with_zone.rb
 - config/initializers/wrap_parameters.rb
 - config/routes.rb
+- db/migrate/20210519145438_create_used_tokens.rb
+- db/migrate/20210528111450_rename_valid_to_is_valid_in_used_token.rb
 - lib/concerns/api_exception_management.rb
 - lib/concerns/model_driven_api_role.rb
 - lib/concerns/model_driven_api_user.rb
@@ -173,7 +176,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.0.3.1
 signing_key: 
 specification_version: 4
 summary: Convention based RoR engine which uses DB schema introspection to create