model_driven_api 2.4.2 → 2.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8ebbf8c8f9cb0482195ef574b6bab41ec475f902adbf03de770919d2ac0fbd40
-  data.tar.gz: cc1a6d816f3d2a448a80dc91bdd4aab17d83aa303333241a8a401ca4b4b0dcd3
+  metadata.gz: d90e4b33bc0bcd2697f3da58a7fd2425bd9ce21ec85940700f3e61e0ed90e506
+  data.tar.gz: 3e0f911934ba78ff08ca11c95ee37e05ccbe22b91847b8d0a751e8d94521d89d
 SHA512:
-  metadata.gz: '01395a025a0443d82d5e8642b5a83677d4baa85fc09139f90f333c8673a95060afce395adca76e7d0f515f32749d728fa3d5be67c75fb56807b62eeb063ab515'
-  data.tar.gz: 9ec3c4dfed6b399e633cbf8adb208296093057fac04a5e7754c7b5947102e8d14b14c3582c536ecba8f1fa35791400ab4e902991bd5790ce69f4005609847495
+  metadata.gz: e2a5966641ecff5dcb932c5993f487c3935df49dcfb56e9fda6132b5dfc217817c932703e958f85c5a0e5b33555d0ca72c75b90693e9971a0255aa4b65212b27
+  data.tar.gz: bd517e4240a5fc44c993907a93f12d39195f7a223f54ceee68cabb41a2c5ea1f0d0639b2fd39e7ef20722827224bbda6e5f02d3b4d5acfff768b7d134f9b3da1

data/README.md

@@ -140,6 +140,14 @@ Once the JWT has been retrieved, the **Authenticated Request**s must use it in a
 
 ```
 Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxLCJleHAiOjE1OTA3NzQyMzR9.Z-1yECp55VD560UcB7gIhgVWJNjn8HUerG5s4TVSRko
+```
+
+ #### Token Refresh
+ 
+If issued during the token validity period, this will just return a new JWT to be used during following API request.
+
+```bash
+:GET http://localhost:3000/api/v2/info/heartbeat
 ```
 
 ### CRUD Actions
@@ -299,7 +307,7 @@ Something like this can be retrieved:
 By issuing this GET request:
 
 ```bash
-GET http://localhost:3000/api/v2/info/roles
+GET http://localhost:3000/api/v2/info/schema
 ```
 
 You will get something like:

data/app/commands/authenticate_user.rb

@@ -22,7 +22,7 @@ class AuthenticateUser
             # The token is created and the api_user exists => Invalidating all the previous tokens
             # Since this is a new login and I don't care from where it comes, new logins always
             # Invalidate older tokens
-            UsedToken.where(user_id: api_user.id).update(is_valid: false) if ENV["ALLOW_MULTISESSIONS"] == "false"
+            UsedToken.where(user_id: current_u.id).update(is_valid: false) if ENV["ALLOW_MULTISESSIONS"] == "false"
             return {jwt: result, user: current_u}
         end
         nil
@@ -36,7 +36,7 @@ class AuthenticateUser
         if !email.blank? && !password.blank?
             user = User.find_by(email: email)
             # Verify the password.
-            raise AccessDenied if user.blank? && user.authenticate(password).blank?
+            user = nil if user.blank? || user.authenticate(password).blank?
         elsif !access_token.blank?
             user = User.find_by(access_token: access_token)
         end

data/app/commands/authorize_machine_2_machine.rb

@@ -0,0 +1,31 @@
+class AuthorizeMachine2Machine
+    prepend SimpleCommand
+    
+    def initialize(headers = {})
+        @headers = headers
+    end
+    
+    def call
+        api_user
+    end
+    
+    private
+    
+    attr_reader :headers
+    
+    def api_user
+        token = http_auth_header
+        user = User.find_by(access_token: token) unless token.blank?
+        @api_user = user if user
+        @api_user || errors.add(:token, "Invalid token") && nil
+    end
+    
+    def http_auth_header
+        if headers['Authorization'].present?
+            return headers['Authorization'].split(' ').last
+        else
+            errors.add(:token, "Missing token")
+        end
+        nil
+    end
+end

data/app/controllers/api/v2/application_controller.rb

@@ -16,8 +16,8 @@ class Api::V2::ApplicationController < ActionController::API
         authorize! :index, @model
 
         # Custom Action
-        status, result = check_for_custom_action
-        return render json: result, status: 200 if status == true
+        status, result, status_number = check_for_custom_action
+        return render json: result, status: (status_number.presence || 200) if status == true
 
         # Normal Index Action with Ransack querying
         # Keeping this automation can be too dangerous and lead to unpredicted results
@@ -52,8 +52,8 @@ class Api::V2::ApplicationController < ActionController::API
         authorize! :show, @record_id
 
         # Custom Show Action
-        status, result = check_for_custom_action
-        return render json: result, status: 200 if status == true
+        status, result, status_number = check_for_custom_action
+        return render json: result, status: (status_number.presence || 200) if status == true
 
         # Normal Show
         result = @record.to_json(json_attrs)
@@ -65,8 +65,8 @@ class Api::V2::ApplicationController < ActionController::API
         authorize! :create, @record
 
         # Custom Action
-        status, result = check_for_custom_action
-        return render json: result, status: 200 if status == true
+        status, result, status_number = check_for_custom_action
+        return render json: result, status: (status_number.presence || 200) if status == true
 
         # Normal Create Action
         # Keeping this automation can be too dangerous and lead to unpredicted results
@@ -80,8 +80,8 @@ class Api::V2::ApplicationController < ActionController::API
         authorize! :update, @record
 
         # Custom Action
-        status, result = check_for_custom_action
-        return render json: result, status: 200 if status == true
+        status, result, status_number = check_for_custom_action
+        return render json: result, status: (status_number.presence || 200) if status == true
 
         # Normal Update Action
         # Raisl 6 vs Rails 6.1
@@ -93,8 +93,8 @@ class Api::V2::ApplicationController < ActionController::API
         authorize! :destroy, @record
 
         # Custom Action
-        status, result = check_for_custom_action
-        return render json: result, status: 200 if status == true
+        status, result, status_number = check_for_custom_action
+        return render json: result, status: (status_number.presence || 200) if status == true
 
         # Normal Destroy Action
         return api_error(status: 500) unless @record.destroy
@@ -114,8 +114,9 @@ class Api::V2::ApplicationController < ActionController::API
             resource = "custom_action_#{params[:do]}"
             raise NoMethodError unless @model.respond_to?(resource)
             # return true, MultiJson.dump(params[:id].blank? ? @model.send(resource, params) : @model.send(resource, params[:id].to_i, params))
-            puts json_attrs
-            return true, @model.send(resource, params).to_json(json_attrs)
+            # puts json_attrs
+            body, status = @model.send(resource, params)
+            return true, body.to_json(json_attrs), status
         end
         # if it's here there is no custom action in the request querystring
         return false
@@ -131,8 +132,8 @@ class Api::V2::ApplicationController < ActionController::API
     def authenticate_request
         @current_user = nil
         Settings.ns(:security).allowed_authorization_headers.split(",").each do |header|
-            # puts "Found header #{header}: #{request.headers[header.underscore.dasherize]}" 
-            check_authorization("Authorize#{header}".constantize.call(request.headers, request.raw_post)) if request.headers[header.underscore.dasherize]
+            # puts "Found header #{header}: #{request.headers[header]}" 
+            check_authorization("Authorize#{header}".constantize.call(request.headers)) # if request.headers[header]
         end
         
         check_authorization AuthorizeApiRequest.call(request.headers) unless @current_user

data/app/controllers/api/v2/info_controller.rb

@@ -73,4 +73,9 @@ class Api::V2::InfoController < Api::V2::ApplicationController
     end
     render json: pivot.to_json, status: 200
   end
+
+  def settings
+    render json: ThecoreSettings::Setting.pluck(:ns, :key, :raw).inject({}){|result, array| (result[array.first] ||= {})[array.second] = array.third; result }.to_json, status: 200
+  end
+
 end

data/config/routes.rb

@@ -13,6 +13,7 @@ Rails.application.routes.draw do
                 get :schema
                 get :dsl
                 get :heartbeat
+                get :settings
             end
 
             post "authenticate" => "authentication#authenticate"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 2.4.2
+  version: 2.5.0
 platform: ruby
 authors:
 - Gabriele Tassoni
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-09-07 00:00:00.000000000 Z
+date: 2022-02-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thecore_backend_commons
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.1'
+        version: '2.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.1'
+        version: '2.4'
 - !ruby/object:Gem::Dependency
   name: jwt
   requirement: !ruby/object:Gem::Requirement
@@ -135,6 +135,7 @@ files:
 - Rakefile
 - app/commands/authenticate_user.rb
 - app/commands/authorize_api_request.rb
+- app/commands/authorize_machine_2_machine.rb
 - app/controllers/api/v2/application_controller.rb
 - app/controllers/api/v2/authentication_controller.rb
 - app/controllers/api/v2/info_controller.rb