model_driven_api 2.3.15 → 2.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3c73a32dcfadaf698e4d904a110a4ab140a235699d6d71b1f064127624dc4832
-  data.tar.gz: f99c45c100d53fc494bdfef2f886dbb1385951caebfbf5754d6a496f019f1fe3
+  metadata.gz: 83d29c7872f8a719a67efea2d255348bf1d45b59cfed6729a8eba63cd58a3679
+  data.tar.gz: 0d351060548decf558e0d7332ca4c580729070d80ddfd94c7656da1cb45e815f
 SHA512:
-  metadata.gz: 1642e0c66e19c6ea3c8a383d3000329d5bba051803c026c40767e05ebadce23bff75e0983fc4a720a3681b28566d41d3d3e0d2f61f2a23f602b89ada4b078681
-  data.tar.gz: 0b31e00c37e1a7511c35b6add9c91428791f8e0c13976f83044d5e52dcb43ef0a70071a04828fdd472e5d783239f7eaeb63669a61b6d3258026e83b47057a050
+  metadata.gz: fd8488a506791ee0394b4f148c8df23a47728603cc9e56ed2de894ff74cd8ed3bb701e3077c9ba2c512cb83478373448c7d34552eefd5995f64c1a5fcd43ad40
+  data.tar.gz: 7afcfeb678f4c9d7609468e8e8fad1c5b59a54c41164c2598e201409cd49024be8d6b5f2dea08d1e58778d1905f410f1a826cea278b9b3e251ab850d853690ca

data/app/commands/authenticate_user.rb

@@ -7,21 +7,23 @@ class AuthenticateUser
     prepend SimpleCommand
     
     def initialize(*args)
-        if !args.email.blank? && !args.password.blank?
-            @email = args.email
-            @password = args.password
-        elsif !args.access_token.blank?
-            @access_token = args.access_token
+        first_arg = args.first
+        if !first_arg[:email].blank? && !first_arg[:password].blank?
+            @email = first_arg[:email]
+            @password = first_arg[:password]
+        elsif !first_arg[:access_token].blank?
+            @access_token = first_arg[:access_token]
         end
     end
     
     def call
-        if !api_user.blank? && result = JsonWebToken.encode(user_id: api_user.id)
+        current_u = api_user
+        if !current_u.blank? && result = JsonWebToken.encode(user_id: current_u.id)
             # The token is created and the api_user exists => Invalidating all the previous tokens
             # Since this is a new login and I don't care from where it comes, new logins always
             # Invalidate older tokens
-            UsedToken.where(user_id: api_user.id).update(valid: false)
-            return result
+            UsedToken.where(user_id: api_user.id).update(is_valid: false) if ENV["ALLOW_MULTISESSIONS"] == "false"
+            return {jwt: result, user: current_u}
         end
         nil
     end
@@ -33,8 +35,7 @@ class AuthenticateUser
     def api_user
         if !email.blank? && !password.blank?
             user = User.find_by(email: email)
-            
-            # Verify the password. You can create a blank method for now.
+            # Verify the password.
             raise AccessDenied if user.blank? && user.authenticate(password).blank?
         elsif !access_token.blank?
             user = User.find_by(access_token: access_token)

data/app/controllers/api/v2/authentication_controller.rb

@@ -5,8 +5,9 @@ class Api::V2::AuthenticationController < ActionController::API
         command = !params[:atoken].blank? && User.column_names.include?("access_token") ? AuthenticateUser.call(access_token: params[:atoken]) : AuthenticateUser.call(email: params[:auth][:email], password: params[:auth][:password])
         
         if command.success?
-            response.headers['Token'] = command.result
-            head :ok
+            response.headers['Token'] = command.result[:jwt]
+            # head :ok
+            render json: command.result[:user].to_json(User.json_attrs), status: 200
         end
     end
 end

data/app/controllers/api/v2/info_controller.rb

@@ -17,7 +17,7 @@ class Api::V2::InfoController < Api::V2::ApplicationController
 
 
   # api :GET, '/api/v2/info/heartbeat'
-  # Just keeps the session alive
+  # Just keeps the session alive by returning a new token
   def heartbeat
     head :ok
   end

data/app/models/used_token.rb

@@ -1,7 +1,3 @@
 class UsedToken < ApplicationRecord
   belongs_to :user, inverse_of: :used_tokens
-
-  rails_admin do
-    visible false
-  end
 end

data/config/routes.rb

@@ -12,6 +12,7 @@ Rails.application.routes.draw do
                 get :translations
                 get :schema
                 get :dsl
+                get :heartbeat
             end
 
             post "authenticate" => "authentication#authenticate"

data/db/migrate/20210528111450_rename_valid_to_is_valid_in_used_token.rb

@@ -0,0 +1,7 @@
+class RenameValidToIsValidInUsedToken < ActiveRecord::Migration[6.0]
+  def change
+    change_table :used_tokens do |t|
+      t.rename :valid, :is_valid
+    end
+  end
+end

data/lib/json_web_token.rb

@@ -3,13 +3,14 @@ class JsonWebToken
     def encode(payload, expiry = 15.minutes.from_now.to_i)
       result = ::JWT.encode(payload.merge(exp: expiry), ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])
       # Store the created token into the DB for later checks if is invalid
-      UsedToken.create(token: result, user_id: payload[:user_id])
+      # In a public environment management, without login, it has no interest, so I don't pollute the DB
+      UsedToken.find_or_create_by(token: result, user_id: payload[:user_id]) if ENV["ALLOW_MULTISESSIONS"] == "false"
       result
     end
     
     def decode(token)
       # Check if the passed token is present and valid into the UsedToken 
-      raise "Token is invalidated by new login" unless UsedToken.exists?(token: token, valid: true)
+      raise "Token is invalidated by new login" unless UsedToken.exists?(token: token, is_valid: true) if ENV["ALLOW_MULTISESSIONS"] == "false"
       body = ::JWT.decode(token, ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])[0]
       ::HashWithIndifferentAccess.new body
     rescue

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 2.3.15
+  version: 2.4.0
 platform: ruby
 authors:
 - Gabriele Tassoni
@@ -147,6 +147,7 @@ files:
 - config/initializers/wrap_parameters.rb
 - config/routes.rb
 - db/migrate/20210519145438_create_used_tokens.rb
+- db/migrate/20210528111450_rename_valid_to_is_valid_in_used_token.rb
 - lib/concerns/api_exception_management.rb
 - lib/concerns/model_driven_api_role.rb
 - lib/concerns/model_driven_api_user.rb