rails-auth 1.2.0 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e92a07d5339d2ad6e64b821ba2e1b4026de10c31
-  data.tar.gz: aaac5ccbcf152561ad1e1f682d06f02ecd9f6bb8
+  metadata.gz: c432f32235dc33950f7dcbf27391d078d11f75a7
+  data.tar.gz: 2ba052d755a2e63d84792cfb6d28031481aecbc7
 SHA512:
-  metadata.gz: 49a8941a641613a737835bba767ae859afeeed873c6de7034a3ca9d644ee784900fc5bda5f99e2f8d2382c4a86c47087d497f2add7ad0f6b1f38275c3d1cafe4
-  data.tar.gz: 4fc77b8fc2b2200766c8277658a78d790e6acbe1b3b3172fe82b5c18b23c41c732e5e24e3c7007490d9fa6688a30d32db221f7efefe40c224c87d13c58c92ebc
+  metadata.gz: 5e39291a8adc7c55bcc2b05dfba07facad0a85ae00b4ff6420e4000687dd8fa5221c034c0b5fff1c49b507552e62c76feb8dc355fab59e2f38270f77e3632d84
+  data.tar.gz: f59dd32a03589e53196f25c54b4d3cb61f5dfe90a781c7346d6a2cfee63d242a07f7793c2817917a649d2d3a7770374c06b057a4ceaa5bcca0c68f7fb7093a96

data/CHANGES.md

@@ -1,3 +1,9 @@
+### 1.3.0 (2016-07-16)
+
+* [#30](https://github.com/square/rails-auth/pull/30)
+  Render JSON error responses from Rails::Auth::ErrorPage.
+  ([@tarcieri])
+
 ### 1.2.0 (2016-07-11)
 
 * [#28](https://github.com/square/rails-auth/pull/28)

data/lib/rails/auth/error_page/middleware.rb

@@ -3,17 +3,36 @@ module Rails
     module ErrorPage
       # Render an error page in the event Rails::Auth::NotAuthorizedError is raised
       class Middleware
-        def initialize(app, page_body: nil)
+        def initialize(app, page_body: nil, json_body: { message: "Access denied" })
           raise TypeError, "page_body must be a String" unless page_body.is_a?(String)
 
           @app       = app
           @page_body = page_body.freeze
+          @json_body = json_body.to_json
         end
 
         def call(env)
           @app.call(env)
         rescue Rails::Auth::NotAuthorizedError
-          [403, { "Content-Type" => "text/html" }, [@page_body]]
+          access_denied(env)
+        end
+
+        private
+
+        def access_denied(env)
+          case response_format(env)
+          when :json
+            [403, { "X-Powered-By" => "rails-auth", "Content-Type" => "application/json" }, [@json_body]]
+          else
+            [403, { "X-Powered-By" => "rails-auth", "Content-Type" => "text/html" }, [@page_body]]
+          end
+        end
+
+        def response_format(env)
+          accept_format = env["HTTP_ACCEPT"]
+          return :json if accept_format && accept_format.downcase.start_with?("application/json")
+          return :json if env["PATH_INFO"] && env["PATH_INFO"].end_with?(".json")
+          nil
         end
       end
     end

data/lib/rails/auth/version.rb

@@ -3,6 +3,6 @@
 module Rails
   # Pluggable authentication and authorization for Rack/Rails
   module Auth
-    VERSION = "1.2.0".freeze
+    VERSION = "1.3.0".freeze
   end
 end

data/spec/rails/auth/error_page/middleware_spec.rb

@@ -4,23 +4,52 @@ RSpec.describe Rails::Auth::ErrorPage::Middleware do
 
   subject(:middleware) { described_class.new(app, page_body: error_page) }
 
-  context "access granted" do
-    let(:code) { 200 }
-    let(:app)  { ->(env) { [code, env, "Hello, world!"] } }
+  context "unspecified content type" do
+    describe "access granted" do
+      let(:code) { 200 }
+      let(:app)  { ->(env) { [code, env, "Hello, world!"] } }
 
-    it "renders the expected response" do
-      response = middleware.call(request)
-      expect(response.first).to eq code
+      it "renders the expected response" do
+        response = middleware.call(request)
+        expect(response.first).to eq code
+      end
+    end
+
+    describe "access denied" do
+      let(:app) { ->(_env) { raise(Rails::Auth::NotAuthorizedError, "not authorized!") } }
+
+      it "renders the error page" do
+        code, _env, body = middleware.call(request)
+        expect(code).to eq 403
+        expect(body).to eq [error_page]
+      end
     end
   end
 
-  context "access denied" do
-    let(:app) { ->(_env) { raise(Rails::Auth::NotAuthorizedError, "not authorized!") } }
+  context "JSON content type" do
+    let(:app)     { ->(_env) { raise(Rails::Auth::NotAuthorizedError, "not authorized!") } }
+    let(:message) { { message: "Access denied" }.to_json }
+
+    context "via request path" do
+      let(:request) { Rack::MockRequest.env_for("https://www.example.com/foobar.json?x=1&y=2") }
+
+      it "renders a JSON response" do
+        code, env, body = middleware.call(request)
+        expect(code).to eq 403
+        expect(env["Content-Type"]).to eq "application/json"
+        expect(body).to eq [message]
+      end
+    end
+
+    context "via Accept header" do
+      it "renders a JSON response" do
+        request["HTTP_ACCEPT"] = "application/json"
 
-    it "renders the error page" do
-      code, _env, body = middleware.call(request)
-      expect(code).to eq 403
-      expect(body).to eq [error_page]
+        code, env, body = middleware.call(request)
+        expect(code).to eq 403
+        expect(env["Content-Type"]).to eq "application/json"
+        expect(body).to eq [message]
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails-auth
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.3.0
 platform: ruby
 authors:
 - Tony Arcieri
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-07-12 00:00:00.000000000 Z
+date: 2016-07-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack