model_driven_api 2.4.1 → 2.4.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3acd8a7365111aab30d8ff8d2b99b42205e30d379c8a3e1d4ed67afed159058c
-  data.tar.gz: 73d6cca889e4bf7aa08816567e52f274576f1e67cefb1e233c3f2e820c389086
+  metadata.gz: 1ed6351d23e6db1dca7d4fffe1ac0e532d12492c404cdf37763afd644fc5cca5
+  data.tar.gz: 3003182226f97c82f510c5b5e3b38a78cd851eab30378035cb939afdc94a863c
 SHA512:
-  metadata.gz: 4cc64b956182b5dbfcc7c0778c18da6e94b5f52525868595f4a8fdfd2c1bc3149b4d9b667ba89d21549ae7668d4251c95e0b57bbfe6a6b71319fc0de06793749
-  data.tar.gz: 4d175e1264cc0db245fe67e80bee381dcf05ee1402ee3ce6c42717a6db8abe852294b6608c2a10f4569a31c2337695ae5038760b661a9d3078748cbf1e7fceb6
+  metadata.gz: 56ab41d307daf87674df375320d361d525bb941367dd7be9f95b3f9f0568f4ff91b243215720ba1e13fcb46130ce6dd2a60b780ca50700c97ec92ed87d0d6e8a
+  data.tar.gz: 2d4cbb4267a876d13ddd5f18a6bf89a794afccdb0cbc418c4080a5adf3716a80e9a9346529a80f0f18b78e9623cf1b0c3e06db5c2b61069c4618b8ace6cdab96

data/README.md

@@ -140,6 +140,14 @@ Once the JWT has been retrieved, the **Authenticated Request**s must use it in a
 
 ```
 Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxLCJleHAiOjE1OTA3NzQyMzR9.Z-1yECp55VD560UcB7gIhgVWJNjn8HUerG5s4TVSRko
+```
+
+ #### Token Refresh
+ 
+If issued during the token validity period, this will just return a new JWT to be used during following API request.
+
+```bash
+:GET http://localhost:3000/api/v2/info/heartbeat
 ```
 
 ### CRUD Actions
@@ -299,7 +307,7 @@ Something like this can be retrieved:
 By issuing this GET request:
 
 ```bash
-GET http://localhost:3000/api/v2/info/roles
+GET http://localhost:3000/api/v2/info/schema
 ```
 
 You will get something like:

data/app/commands/authenticate_user.rb

@@ -22,7 +22,7 @@ class AuthenticateUser
             # The token is created and the api_user exists => Invalidating all the previous tokens
             # Since this is a new login and I don't care from where it comes, new logins always
             # Invalidate older tokens
-            UsedToken.where(user_id: api_user.id).update(is_valid: false) if ENV["ALLOW_MULTISESSIONS"] == "false"
+            UsedToken.where(user_id: current_u.id).update(is_valid: false) if ENV["ALLOW_MULTISESSIONS"] == "false"
             return {jwt: result, user: current_u}
         end
         nil
@@ -36,7 +36,7 @@ class AuthenticateUser
         if !email.blank? && !password.blank?
             user = User.find_by(email: email)
             # Verify the password.
-            raise AccessDenied if user.blank? && user.authenticate(password).blank?
+            user = nil if user.blank? || user.authenticate(password).blank?
         elsif !access_token.blank?
             user = User.find_by(access_token: access_token)
         end

data/app/commands/authorize_machine_2_machine.rb

@@ -0,0 +1,31 @@
+class AuthorizeMachine2Machine
+    prepend SimpleCommand
+    
+    def initialize(headers = {})
+        @headers = headers
+    end
+    
+    def call
+        api_user
+    end
+    
+    private
+    
+    attr_reader :headers
+    
+    def api_user
+        token = http_auth_header
+        user = User.find_by(access_token: token) unless token.blank?
+        @api_user = user if user
+        @api_user || errors.add(:token, "Invalid token") && nil
+    end
+    
+    def http_auth_header
+        if headers['Authorization'].present?
+            return headers['Authorization'].split(' ').last
+        else
+            errors.add(:token, "Missing token")
+        end
+        nil
+    end
+end

data/app/controllers/api/v2/application_controller.rb

@@ -16,8 +16,8 @@ class Api::V2::ApplicationController < ActionController::API
         authorize! :index, @model
 
         # Custom Action
-        status, result = check_for_custom_action
-        return render json: result, status: 200 if status == true
+        status, result, status_number = check_for_custom_action
+        return render json: result, status: (status_number.presence || 200) if status == true
 
         # Normal Index Action with Ransack querying
         # Keeping this automation can be too dangerous and lead to unpredicted results
@@ -52,8 +52,8 @@ class Api::V2::ApplicationController < ActionController::API
         authorize! :show, @record_id
 
         # Custom Show Action
-        status, result = check_for_custom_action
-        return render json: result, status: 200 if status == true
+        status, result, status_number = check_for_custom_action
+        return render json: result, status: (status_number.presence || 200) if status == true
 
         # Normal Show
         result = @record.to_json(json_attrs)
@@ -65,8 +65,8 @@ class Api::V2::ApplicationController < ActionController::API
         authorize! :create, @record
 
         # Custom Action
-        status, result = check_for_custom_action
-        return render json: result, status: 200 if status == true
+        status, result, status_number = check_for_custom_action
+        return render json: result, status: (status_number.presence || 200) if status == true
 
         # Normal Create Action
         # Keeping this automation can be too dangerous and lead to unpredicted results
@@ -80,8 +80,8 @@ class Api::V2::ApplicationController < ActionController::API
         authorize! :update, @record
 
         # Custom Action
-        status, result = check_for_custom_action
-        return render json: result, status: 200 if status == true
+        status, result, status_number = check_for_custom_action
+        return render json: result, status: (status_number.presence || 200) if status == true
 
         # Normal Update Action
         # Raisl 6 vs Rails 6.1
@@ -93,8 +93,8 @@ class Api::V2::ApplicationController < ActionController::API
         authorize! :destroy, @record
 
         # Custom Action
-        status, result = check_for_custom_action
-        return render json: result, status: 200 if status == true
+        status, result, status_number = check_for_custom_action
+        return render json: result, status: (status_number.presence || 200) if status == true
 
         # Normal Destroy Action
         return api_error(status: 500) unless @record.destroy
@@ -114,8 +114,9 @@ class Api::V2::ApplicationController < ActionController::API
             resource = "custom_action_#{params[:do]}"
             raise NoMethodError unless @model.respond_to?(resource)
             # return true, MultiJson.dump(params[:id].blank? ? @model.send(resource, params) : @model.send(resource, params[:id].to_i, params))
-            puts json_attrs
-            return true, @model.send(resource, params).to_json(json_attrs)
+            # puts json_attrs
+            body, status = @model.send(resource, params)
+            return true, body.to_json(json_attrs), status
         end
         # if it's here there is no custom action in the request querystring
         return false
@@ -131,8 +132,8 @@ class Api::V2::ApplicationController < ActionController::API
     def authenticate_request
         @current_user = nil
         Settings.ns(:security).allowed_authorization_headers.split(",").each do |header|
-            # puts "Found header #{header}: #{request.headers[header.underscore.dasherize]}" 
-            check_authorization("Authorize#{header}".constantize.call(request.headers, request.raw_post)) if request.headers[header.underscore.dasherize]
+            # puts "Found header #{header}: #{request.headers[header]}" 
+            check_authorization("Authorize#{header}".constantize.call(request.headers)) # if request.headers[header]
         end
         
         check_authorization AuthorizeApiRequest.call(request.headers) unless @current_user

data/app/controllers/api/v2/info_controller.rb

@@ -73,4 +73,9 @@ class Api::V2::InfoController < Api::V2::ApplicationController
     end
     render json: pivot.to_json, status: 200
   end
+
+  def settings
+    render json: ThecoreSettings::Setting.pluck(:ns, :key, :raw).inject({}){|result, array| (result[array.first] ||= {})[array.second] = array.third; result }.to_json, status: 200
+  end
+
 end

data/config/routes.rb

@@ -13,6 +13,7 @@ Rails.application.routes.draw do
                 get :schema
                 get :dsl
                 get :heartbeat
+                get :settings
             end
 
             post "authenticate" => "authentication#authenticate"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 2.4.1
+  version: 2.4.5
 platform: ruby
 authors:
 - Gabriele Tassoni
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-09-07 00:00:00.000000000 Z
+date: 2022-02-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thecore_backend_commons
@@ -123,7 +123,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.2'
 description: Ruby on Rails REST APIs built by convention using the DB schema as the
-  foundation.
+  foundation, please see README for mode of use.
 email:
 - gabriele.tassoni@gmail.com
 executables: []
@@ -135,6 +135,7 @@ files:
 - Rakefile
 - app/commands/authenticate_user.rb
 - app/commands/authorize_api_request.rb
+- app/commands/authorize_machine_2_machine.rb
 - app/controllers/api/v2/application_controller.rb
 - app/controllers/api/v2/authentication_controller.rb
 - app/controllers/api/v2/info_controller.rb