model_driven_api 3.4.2 → 3.4.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cc68530c0b5f4519866a975cea9ea23207cec6dc83aad73cd6a61da041760fee
-  data.tar.gz: 5789f8c2a515b3385a6c53da9392fbc21fdb599aa247a9968b5a8a2f6b03f326
+  metadata.gz: ed7db62f6e456f3535221fe7fd09da02dfde4a4ac2c3951a15b229e249ca1706
+  data.tar.gz: fa80dce7d6e7fbca51b884ba7e368117c54308255572861fa4d14e75861360a9
 SHA512:
-  metadata.gz: b58dc845ec1c3d228228e4f0527d8dcb0c82ebe9bf92cd1df86615cd9137a4c93539b076d1c8bb673feb8b6bc68daa7e4b332357995aabc11bb4c297b17dd372
-  data.tar.gz: cbbabc3bb858b9d83d10bc01617f147c1cb9402a6ce65db269b9a41639ea8fedb16ccaed7f5c86dbde3c7a7c98c19f50d552804f6538d0dd33aa3b96a77cf38b
+  metadata.gz: 52d75ac780843f651052880108a662081c92ab55ded13cf8d69f241b979b6ce69b05552aca222ec63c01e9b0426ee7f81902196e13746d8cae89ad3a0280f0ff
+  data.tar.gz: 4854bef7827dbfdaa17ca41d255bcd2b297c42acafb45cca0ef21d399f24d6b704e69b62b1745284bfbb9f4ecd966036a906e339033cb07aefe1ca7766e8974b

data/app/commands/authorize_api_request.rb

@@ -15,18 +15,18 @@ class AuthorizeApiRequest
     
     def api_user
         Rails.logger.debug "AuthorizeApiRequest: api_user -> #{decoded_auth_token}"
-        @api_user ||= User.find(decoded_auth_token[:user_id]) if decoded_auth_token
-        if @api_user
+        @api_user ||= (decoded_auth_token.blank? ? User.find(decoded_auth_token[:user_id]) : nil)
+        unless @api_user.blank
             return @api_user
         else
-            errors.add(:token, "Invalid token")
+            errors.add(:token, "Invalid or Expired token")
             return nil
         end
     end
     
     def decoded_auth_token
         Rails.logger.debug "AuthorizeApiRequest: decoded_auth_token -> http_auth_header -> #{http_auth_header}"
-        @decoded_auth_token ||= JsonWebToken.decode(http_auth_header)
+        @decoded_auth_token ||= (JsonWebToken.decode(http_auth_header) rescue nil)
         @decoded_auth_token
     end
     

data/app/controllers/api/v2/auth/oauth_controller.rb

@@ -1,15 +1,8 @@
 module Api::V2::Auth
   class OauthController < ActionController::API
     def callback
-      email = params['email']
+      user = ThecoreAuthCommons.check_user params['email'], params['given_name'], params['family_name'], params['provider']
 
-      user = User.find_or_create_by(email: email) do |u|
-        u.name = params['given_name']
-        u.surname = params['family_name']
-        u.password = u.password_confirmation = ThecoreAuthCommons.generate_secure_password
-        u.auth_source = params['provider'] # 'google' or 'microsoft'
-        u.admin = true
-      end
       unless user
         render json: { error: "User not registered" }, status: :unauthorized
         return

data/config/routes.rb

@@ -1,9 +1,8 @@
 # require 'ransack'
 
 Rails.application.routes.draw do
-    oauth_test = (ENV['ENTRA_CLIENT_ID'].present? && ENV['ENTRA_CLIENT_SECRET'].present? && ENV['ENTRA_TENANT_ID'].present?) || (ENV['GOOGLE_CLIENT_ID'].present? && ENV['GOOGLE_CLIENT_SECRET'].present?)
     scope ENV.fetch("RAILS_RELATIVE_URL_ROOT", "/") do
-        if oauth_test
+        if ThecoreAuthCommons.oauth_vars?
             # OmniAuth callbacks need these top-level paths:
             match '/auth/:provider/callback', to: redirect('/api/v2/auth/%{provider}/callback'), via: [:get, :post]
             match '/auth/failure', to: redirect('/api/v2/auth/failure'), via: [:get, :post]
@@ -11,7 +10,7 @@ Rails.application.routes.draw do
         namespace :api, constraints: { format: :json } do
             namespace :v2 do
                 # Authentication via Oauth2 only if the environment variable is set
-                if oauth_test
+                if ThecoreAuthCommons.oauth_vars?
                     namespace :auth do
                         # Omniauth routes for OAuth2 authentication
                         match ':provider/callback', to: 'oauth#callback', via: [:get, :post]

data/lib/model_driven_api/version.rb

@@ -1,3 +1,3 @@
 module ModelDrivenApi
-  VERSION = "3.4.2".freeze
+  VERSION = "3.4.4".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 3.4.2
+  version: 3.4.4
 platform: ruby
 authors:
 - Gabriele Tassoni
@@ -132,7 +132,6 @@ files:
 - config/initializers/after_initialize_for_model_driven_api.rb
 - config/initializers/cors_api_thecore.rb
 - config/initializers/knock.rb
-- config/initializers/omniauth.rb
 - config/initializers/time_with_zone.rb
 - config/initializers/wrap_parameters.rb
 - config/routes.rb

data/config/initializers/omniauth.rb

@@ -1,20 +0,0 @@
-Rails.application.config.middleware.use OmniAuth::Builder do
-  provider(
-    :entra_id,
-    {
-      client_id: ENV['ENTRA_CLIENT_ID'],
-      client_secret: ENV['ENTRA_CLIENT_SECRET'],
-      tenant_id: ENV['ENTRA_TENANT_ID'], # Needed for Microsoft
-      scope: 'User.Read',
-      response_type: 'code'
-    }
-  )
-  provider :google_oauth2, ENV['GOOGLE_CLIENT_ID'], ENV['GOOGLE_CLIENT_SECRET'], {
-    scope: 'email,profile',
-    prompt: 'select_account',
-    access_type: 'online'
-  }
-end
-
-OmniAuth.config.allowed_request_methods = [:get, :post]
-OmniAuth.config.silence_get_warning = true