openstax_api 5.4.1 → 5.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1dc5b2c90e25d34d79c536abcff2d88f983664cb
-  data.tar.gz: ed966473c4626c179c7f003d1bae2fa0fb1f2a77
+  metadata.gz: fe4d093b6653d00d111551c80f7da820b55c26b2
+  data.tar.gz: 565ebe49772bf335c96888b845b79a350729d653
 SHA512:
-  metadata.gz: e7e9a454aae1dbd6ea4aa9cb886dcd78dc85ed29ef05efd1c21defae4b735e74317eee3d87044c6c7d7e68f0bb3ffa80b40cdda4376904c11c852d7c06f9b892
-  data.tar.gz: ec778b17bb2069b387c4091167c4c0ff3c33779c34fa7d495193474445e7a83e4fd59dafdc35af86732af358da29e5c2ac33751863a7b847d687652c59a2556b
+  metadata.gz: b63f46064aba41549ba4da1c313105f9a183ee48b77798c3e126912e37309c9e455ceff695f0b467c0a5bce7db3a12030c4261b70520d1099fdd9767c24269df
+  data.tar.gz: 5eaa288ed181f73230f274c71783827fc0a055af6a52c3907091f4778a82f0424e7eda89a1a7618edbf88d39932959f2079b2c4694c4fa1da4c8b7234e771f43

data/app/controllers/openstax/api/v1/api_controller.rb

@@ -8,25 +8,29 @@ module OpenStax
         include OpenStax::Api::Roar
         include OpenStax::Api::Apipie
 
-        before_action :doorkeeper_authorize!, :unless => :session_user?
-        skip_before_filter :verify_authenticity_token, :unless => :session_user?
-
         respond_to :json
 
+        # Always force JSON requests and send the Date header in the response
         before_filter :force_json_content_type
         after_filter :set_date_header
 
+        # Doorkeeper is used and CSRF protection is disabled only if a token is present
+        before_filter :doorkeeper_authorize!, if: :token_user?
+        skip_before_filter :verify_authenticity_token, if: :token_user?
+
+        # CORS is enabled unless the user is logged in via a cookie
+        before_filter :set_cors_preflight_headers, unless: :session_user?
+        after_filter :set_cors_headers, unless: :session_user?
+
         # Keep old current_user method so we can use it
-        alias_method :current_session_user,
-                     OpenStax::Api.configuration.current_user_method
+        alias_method :current_session_user, OpenStax::Api.configuration.current_user_method
 
         # Ensure we will never again confuse human users and api users
         undef_method OpenStax::Api.configuration.current_user_method
 
         # Always return an ApiUser
         def current_api_user
-          @current_api_user ||= ApiUser.new(doorkeeper_token,
-                                            lambda { current_session_user })
+          @current_api_user ||= ApiUser.new(doorkeeper_token, lambda { current_session_user })
         end
 
         def current_application
@@ -40,11 +44,14 @@ module OpenStax
         protected
 
         def session_user?
-          !!current_session_user && doorkeeper_token.blank?
+          !current_session_user.nil? && \
+          (!current_session_user.respond_to?(:is_anonymous?) || \
+           !current_session_user.is_anonymous?) && \
+          doorkeeper_token.nil?
         end
 
-        def set_date_header
-          response.date = Time.now unless response.date?
+        def token_user?
+          !doorkeeper_token.nil?
         end
 
         def force_json_content_type
@@ -53,6 +60,24 @@ module OpenStax
           request.env['action_dispatch.request.content_type'] = 'application/json'
         end
 
+        def set_date_header
+          response.date = Time.now unless response.date?
+        end
+
+        def set_cors_preflight_headers
+          if request.method == 'OPTIONS'
+            headers['Access-Control-Allow-Origin'] = '*'
+            headers['Access-Control-Allow-Methods'] = 'GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS'
+            headers['Access-Control-Max-Age'] = '1728000'
+
+            render :text => '', :content_type => 'text/plain'
+          end
+        end
+
+        def set_cors_headers
+          headers['Access-Control-Allow-Origin'] = '*'
+        end
+
       end
 
     end

data/lib/openstax/api/version.rb

@@ -1,5 +1,5 @@
 module OpenStax
   module Api
-    VERSION = "5.4.1"
+    VERSION = "5.4.2"
   end
 end

data/spec/controllers/openstax/api/v1/api_controller_spec.rb

@@ -106,11 +106,29 @@ module OpenStax
             get 'dummy'
             expect(Time.parse(response.headers['Date'])).to be_within(1.second).of(Time.now)
           end
+        end
+
+        context 'cors' do
+          before(:each) do
+            instance_variable_set('@controller', dummy_controller)
+          end
+
+          it 'sets the CORS headers for anonymous users' do
+            get 'dummy'
+            expect(response.headers['Access-Control-Allow-Origin']).to eq '*'
+          end
+
+          it 'sets the CORS headers for token users' do
+            token = Doorkeeper::AccessToken.create!.token
+            @request.headers['Authorization'] = "Bearer #{token}"
+            get 'dummy'
+            expect(response.headers['Access-Control-Allow-Origin']).to eq '*'
+          end
 
-          it 'does not set the Date header for unsuccessful API calls' do
+          it 'does not set the CORS headers for session users' do
+            @controller.present_user = user
             get 'dummy'
-            expect(response.headers['WWW-Authenticate']).to include "error=\"invalid_token\""
-            expect(response.headers).not_to have_key('Date')
+            expect(response.headers['Access-Control-Allow-Origin']).to be_nil
           end
         end