model_driven_api 2.4.3 → 2.4.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2f587fb3dc87ca59c5a9cfa3bd03137481b64bb691d69324b956a68f43316018
-  data.tar.gz: 92ad2b21cd10fceab0c7b0d5439048a9d01fdfa8f8d8c64046c1e451279666d2
+  metadata.gz: fe7f4f3089407a7bdb2a1f4174c9c134599fbe2a3ffd7c4bd1fa8d45424fabfe
+  data.tar.gz: 1a863a98f07a3311782c8b6d4c8123ba6318ffa1476a056f35ed62fd75b25f3c
 SHA512:
-  metadata.gz: 74e867b8007e9d8234321cb569e4e2d5505dc2347ba563a9e71dfc1e8a7ff30a3eea4264c6e79c51a5b3e74d8a70b1b220064530c6dfa9962dc05fba57066440
-  data.tar.gz: 8bcf5ae78e32f788fd62ec66df1b3d46614b47b74c59e0a9d05f72d9efa8cf8fbc2996f67f23a9d1428e700203d54ae1a1af12957c051e49f3378bda7e5e7733
+  metadata.gz: 79cf4fd763c17311165ada17fa4067f9151914e62aaa494eb9661dfbe5c41a7d2248c92caf1803518c430eba6d1dd77692a4148db3a18b681618775a51151f59
+  data.tar.gz: 38b734d317dbb08b3b7bfce009b5636e38d1647cfd3bf40dea78703dfec89356fe09bcdbd2013a096b4c06a9456c10a9bc5419b512d125a757d1e588e77fab52

data/app/commands/authenticate_user.rb

@@ -22,7 +22,7 @@ class AuthenticateUser
             # The token is created and the api_user exists => Invalidating all the previous tokens
             # Since this is a new login and I don't care from where it comes, new logins always
             # Invalidate older tokens
-            UsedToken.where(user_id: api_user.id).update(is_valid: false) if ENV["ALLOW_MULTISESSIONS"] == "false"
+            UsedToken.where(user_id: current_u.id).update(is_valid: false) if ENV["ALLOW_MULTISESSIONS"] == "false"
             return {jwt: result, user: current_u}
         end
         nil
@@ -36,7 +36,7 @@ class AuthenticateUser
         if !email.blank? && !password.blank?
             user = User.find_by(email: email)
             # Verify the password.
-            raise AccessDenied if user.blank? && user.authenticate(password).blank?
+            user = nil if user.blank? || user.authenticate(password).blank?
         elsif !access_token.blank?
             user = User.find_by(access_token: access_token)
         end

data/app/commands/authorize_machine_2_machine.rb

@@ -0,0 +1,31 @@
+class AuthorizeMachine2Machine
+    prepend SimpleCommand
+    
+    def initialize(headers = {})
+        @headers = headers
+    end
+    
+    def call
+        api_user
+    end
+    
+    private
+    
+    attr_reader :headers
+    
+    def api_user
+        token = http_auth_header
+        user = User.find_by(access_token: token) unless token.blank?
+        @api_user = user if user
+        @api_user || errors.add(:token, "Invalid token") && nil
+    end
+    
+    def http_auth_header
+        if headers['Authorization'].present?
+            return headers['Authorization'].split(' ').last
+        else
+            errors.add(:token, "Missing token")
+        end
+        nil
+    end
+end

data/app/controllers/api/v2/application_controller.rb

@@ -131,8 +131,8 @@ class Api::V2::ApplicationController < ActionController::API
     def authenticate_request
         @current_user = nil
         Settings.ns(:security).allowed_authorization_headers.split(",").each do |header|
-            # puts "Found header #{header}: #{request.headers[header.underscore.dasherize]}" 
-            check_authorization("Authorize#{header}".constantize.call(request.headers, request.raw_post)) if request.headers[header.underscore.dasherize]
+            # puts "Found header #{header}: #{request.headers[header]}" 
+            check_authorization("Authorize#{header}".constantize.call(request.headers)) # if request.headers[header]
         end
         
         check_authorization AuthorizeApiRequest.call(request.headers) unless @current_user

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 2.4.3
+  version: 2.4.4
 platform: ruby
 authors:
 - Gabriele Tassoni
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-01-25 00:00:00.000000000 Z
+date: 2022-02-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thecore_backend_commons
@@ -135,6 +135,7 @@ files:
 - Rakefile
 - app/commands/authenticate_user.rb
 - app/commands/authorize_api_request.rb
+- app/commands/authorize_machine_2_machine.rb
 - app/controllers/api/v2/application_controller.rb
 - app/controllers/api/v2/authentication_controller.rb
 - app/controllers/api/v2/info_controller.rb