RubyGems - rails-identity - Versions diffs - 0.0.1 - Mend

rails-identity 0.0.1

Files changed (90) hide show

checksums.yaml +7 -0
data/MIT-LICENSE +20 -0
data/Rakefile +37 -0
data/app/assets/javascripts/rails_identity/application.js +13 -0
data/app/assets/javascripts/rails_identity/sessions.js +2 -0
data/app/assets/javascripts/rails_identity/users.js +2 -0
data/app/assets/stylesheets/rails_identity/application.css +15 -0
data/app/assets/stylesheets/rails_identity/sessions.css +4 -0
data/app/assets/stylesheets/rails_identity/users.css +4 -0
data/app/controllers/rails_identity/application_controller.rb +200 -0
data/app/controllers/rails_identity/sessions_controller.rb +108 -0
data/app/controllers/rails_identity/users_controller.rb +168 -0
data/app/helpers/rails_identity/application_helper.rb +19 -0
data/app/helpers/rails_identity/sessions_helper.rb +4 -0
data/app/helpers/rails_identity/users_helper.rb +4 -0
data/app/jobs/rails_identity/sessions_cleanup_job.rb +13 -0
data/app/mailers/application_mailer.rb +4 -0
data/app/mailers/rails_identity/user_mailer.rb +14 -0
data/app/models/rails_identity/session.rb +44 -0
data/app/models/rails_identity/user.rb +48 -0
data/app/views/layouts/mailer.html.erb +5 -0
data/app/views/layouts/mailer.text.erb +1 -0
data/app/views/layouts/rails_identity/application.html.erb +14 -0
data/app/views/rails_identity/user_mailer/email_verification.html.erb +12 -0
data/app/views/rails_identity/user_mailer/email_verification.text.erb +13 -0
data/app/views/rails_identity/user_mailer/password_reset.html.erb +14 -0
data/app/views/rails_identity/user_mailer/password_reset.text.erb +15 -0
data/config/routes.rb +7 -0
data/db/migrate/20160323210013_create_rails_identity_users.rb +13 -0
data/db/migrate/20160323210017_create_rails_identity_sessions.rb +12 -0
data/db/migrate/20160401223433_add_reset_token_to_users.rb +5 -0
data/db/migrate/20160411215917_add_verification_token_to_users.rb +10 -0
data/db/migrate/20160414145851_add_api_key_to_users.rb +5 -0
data/lib/rails_identity/engine.rb +9 -0
data/lib/rails_identity/version.rb +3 -0
data/lib/rails_identity.rb +52 -0
data/lib/tasks/rails_identity_tasks.rake +4 -0
data/test/controllers/rails_identity/sessions_controller_test.rb +192 -0
data/test/controllers/rails_identity/users_controller_test.rb +253 -0
data/test/dummy/README.rdoc +28 -0
data/test/dummy/Rakefile +6 -0
data/test/dummy/app/assets/javascripts/application.js +13 -0
data/test/dummy/app/assets/stylesheets/application.css +15 -0
data/test/dummy/app/controllers/application_controller.rb +5 -0
data/test/dummy/app/helpers/application_helper.rb +2 -0
data/test/dummy/app/views/layouts/application.html.erb +14 -0
data/test/dummy/bin/bundle +3 -0
data/test/dummy/bin/rails +4 -0
data/test/dummy/bin/rake +4 -0
data/test/dummy/bin/setup +29 -0
data/test/dummy/config/application.rb +26 -0
data/test/dummy/config/boot.rb +5 -0
data/test/dummy/config/database.yml +25 -0
data/test/dummy/config/environment.rb +5 -0
data/test/dummy/config/environments/development.rb +41 -0
data/test/dummy/config/environments/production.rb +79 -0
data/test/dummy/config/environments/test.rb +42 -0
data/test/dummy/config/initializers/assets.rb +11 -0
data/test/dummy/config/initializers/backtrace_silencers.rb +7 -0
data/test/dummy/config/initializers/cookies_serializer.rb +3 -0
data/test/dummy/config/initializers/filter_parameter_logging.rb +4 -0
data/test/dummy/config/initializers/inflections.rb +16 -0
data/test/dummy/config/initializers/mime_types.rb +4 -0
data/test/dummy/config/initializers/session_store.rb +3 -0
data/test/dummy/config/initializers/wrap_parameters.rb +14 -0
data/test/dummy/config/locales/en.yml +23 -0
data/test/dummy/config/routes.rb +4 -0
data/test/dummy/config/secrets.yml +22 -0
data/test/dummy/config.ru +4 -0
data/test/dummy/db/development.sqlite3 +0 -0
data/test/dummy/db/schema.rb +42 -0
data/test/dummy/db/test.sqlite3 +0 -0
data/test/dummy/log/development.log +215 -0
data/test/dummy/log/test.log +280622 -0
data/test/dummy/public/404.html +67 -0
data/test/dummy/public/422.html +67 -0
data/test/dummy/public/500.html +66 -0
data/test/dummy/public/favicon.ico +0 -0
data/test/dummy/tmp/cache/A5C/3F0/rails-identity-0.0.1-session-1 +0 -0
data/test/fixtures/rails_identity/sessions.yml +36 -0
data/test/fixtures/rails_identity/users.yml +24 -0
data/test/integration/navigation_test.rb +10 -0
data/test/jobs/rails_identity/sessions_cleanup_job_test.rb +9 -0
data/test/mailers/previews/rails_identity/user_mailer_preview.rb +6 -0
data/test/mailers/rails_identity/user_mailer_test.rb +9 -0
data/test/models/rails_identity/session_test.rb +26 -0
data/test/models/rails_identity/user_test.rb +54 -0
data/test/rails_identity_test.rb +7 -0
data/test/test_helper.rb +33 -0
metadata +297 -0

data/app/models/rails_identity/session.rb ADDED Viewed

@@ -0,0 +1,44 @@
+module RailsIdentity
+  class Session < ActiveRecord::Base
+    include UUIDModel
+    # does not act as paranoid!
+    belongs_to :user, foreign_key: "user_uuid", primary_key: "uuid"
+    validates :user, presence: true
+    ##
+    # Creates a session object. The attributes must include user. The secret
+    # to the JWT is generated here and is unique to the session being
+    # created. Since the JWT includes the session id, the secret can be
+    # retrieved.
+    #
+    def initialize(attributes = {})
+      seconds = attributes.delete(:seconds) || (24 * 3600 * 14)
+      super
+      self.uuid = UUIDTools::UUID.timestamp_create().to_s
+      iat = Time.now.to_i
+      payload = {
+        user_uuid: self.user_uuid,
+        session_uuid: self.uuid,
+        role: self.user.role,
+        iat: iat,
+        exp: iat + seconds
+      }
+      self.secret = UUIDTools::UUID.random_create
+      self.token = JWT.encode(payload, self.secret, 'HS256')
+    end
+    ##
+    # Determines if the session has expired or not.
+    #
+    def expired?
+      begin
+        JWT.decode self.token, nil, false
+      rescue JWT::ExpiredSignature
+        return true
+      end
+      return false
+    end
+  end
+end

data/app/models/rails_identity/user.rb ADDED Viewed

@@ -0,0 +1,48 @@
+module RailsIdentity
+  class User < ActiveRecord::Base
+    include UUIDModel
+    acts_as_paranoid
+    has_secure_password
+    validates :username, presence: true, uniqueness: true,
+              format: { with: /\A([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})\z/i,
+                        on: [:create, :update] }
+    validates :password, confirmation: true
+    before_save :default_role
+    alias_attribute :email, :username
+    ##
+    # Initializes the user. User is not verified initially. The user has one
+    # hour to get verified. After that, a PATCH request must be made to
+    # re-issue the verification token.
+    #
+    def initialize(attributes = {})
+      super
+      session = Session.new(user: self, seconds: 3600)
+      self.verification_token = session.token
+      self.verified = false
+    end
+    ##
+    # Sets the default the role for the user if not set.
+    #
+    def default_role
+      self.role ||= Roles::USER
+    end
+    ##
+    # This method will generate a reset token that lasts for an hour.
+    #
+    def issue_token(kind)
+      session = Session.new(user: self, seconds: 3600)
+      session.save
+      if kind == :reset_token
+        self.reset_token = session.token
+      elsif kind == :verification_token
+        self.verification_token = session.token
+      end
+    end
+  end
+end

data/app/views/layouts/mailer.html.erb ADDED Viewed

@@ -0,0 +1,5 @@
+<html>
+  <body>
+    <%= yield %>
+  </body>
+</html>

data/app/views/layouts/mailer.text.erb ADDED Viewed

	@@ -0,0 +1 @@
1	+ <%= yield %>

data/app/views/layouts/rails_identity/application.html.erb ADDED Viewed

@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>RailsIdentity</title>
+  <%= stylesheet_link_tag    "rails_identity/application", media: "all" %>
+  <%= javascript_include_tag "rails_identity/application" %>
+  <%= csrf_meta_tags %>
+</head>
+<body>
+<%= yield %>
+</body>
+</html>

data/app/views/rails_identity/user_mailer/email_verification.html.erb ADDED Viewed

@@ -0,0 +1,12 @@
+<p>Dear <%= @user.username %>,</p>
+<p>Please confirm your account with rails-identity by making a PATCH request
+on the current user with a provided verification token. For example,
+<pre>http PATCH /users/current token=<%= @user.verification_token %>
+verified=true</pre> will confirm the account. Here is the verification
+token:</p>
+<pre><%= @user.verification_token %></pre>
+<p>Thank you for using rails-identity</p>
+<p><b>rails-identity</b></p>

data/app/views/rails_identity/user_mailer/email_verification.text.erb ADDED Viewed

@@ -0,0 +1,13 @@
+Dear <%= @user.username %>,
+Please confirm your account with rails-identity by making a PATCH request
+on the current user with a provided verification token. For example,
+http PATCH /users/current token=<%= @user.verification_token %> verified=true
+will confirm the account. Here is the verification token:
+<%= @user.verification_token %>
+Thank you for using rails-identity,
+rails-identity

data/app/views/rails_identity/user_mailer/password_reset.html.erb ADDED Viewed

@@ -0,0 +1,14 @@
+<p>Dear <%= @user.username %>,</p>
+<p>You have requested to reset your password. Here are the user UUID and
+reset token. Make a PATCH request on the UUID with the reset token to set a
+new password. For instance, <pre>http PATCH /users/current token=<%=
+@user.reset_token %> password=reallysecret
+password_confirmation=reallysecret</pre> will set the password to
+<pre>reallysecret</pre> for the user to whom the reset token was issued.
+Here is the reset token:</p>
+<pre><%= @user.reset_token %></pre>
+<p>Good luck! :)</p>
+<p><b>rails-identity</b></p>

data/app/views/rails_identity/user_mailer/password_reset.text.erb ADDED Viewed

@@ -0,0 +1,15 @@
+Dear <%= @user.username %>,
+You have requested to reset your password. Here are the user UUID and reset
+token. Make a PATCH request on the UUID with the reset token to set a new
+password. For instance,
+http PATCH /users/current token=...  password=reallysecret password_confirmation=reallysecret
+will set the password to "reallysecret" (without quotes) for the user to
+whom the reset token was issued.
+Here is the reset token: @user.reset_token
+Good luck! :)
+rails-identity

data/config/routes.rb ADDED Viewed

@@ -0,0 +1,7 @@
+RailsIdentity::Engine.routes.draw do
+  resources :sessions
+  match 'sessions(/:id)' => 'sessions#options', via: [:options]
+  resources :users
+  match 'users(/:id)' => 'users#options', via: [:options]
+end

data/db/migrate/20160323210013_create_rails_identity_users.rb ADDED Viewed

@@ -0,0 +1,13 @@
+class CreateRailsIdentityUsers < ActiveRecord::Migration
+  def change
+    create_table :rails_identity_users do |t|
+      t.string :uuid, primary_key: true, null: false
+      t.string :username
+      t.string :password_digest
+      t.integer :role
+      t.string :metadata
+      t.datetime :deleted_at, index: true
+      t.timestamps null: false
+    end
+  end
+end

data/db/migrate/20160323210017_create_rails_identity_sessions.rb ADDED Viewed

@@ -0,0 +1,12 @@
+class CreateRailsIdentitySessions < ActiveRecord::Migration
+  def change
+    create_table :rails_identity_sessions do |t|
+      t.string :uuid, primary_key: true, null: false
+      t.string :user_uuid, null: false
+      t.string :token, null: false
+      t.string :secret, null: false
+      t.string :metadata
+      t.timestamps null: false
+    end
+  end
+end

data/db/migrate/20160401223433_add_reset_token_to_users.rb ADDED Viewed

@@ -0,0 +1,5 @@
+class AddResetTokenToUsers < ActiveRecord::Migration
+  def change
+    add_column :rails_identity_users, :reset_token, :string
+  end
+end

data/db/migrate/20160411215917_add_verification_token_to_users.rb ADDED Viewed

@@ -0,0 +1,10 @@
+class AddVerificationTokenToUsers < ActiveRecord::Migration
+  def change
+    add_column :rails_identity_users, :verification_token, :string
+    add_column :rails_identity_users, :verified, :boolean, default: false
+    # Assign true for existing accounts since they existed without
+    # a verification token.
+    users = RailsIdentity::User.update_all(verified: true)
+  end
+end

data/db/migrate/20160414145851_add_api_key_to_users.rb ADDED Viewed

@@ -0,0 +1,5 @@
+class AddApiKeyToUsers < ActiveRecord::Migration
+  def change
+    add_column :rails_identity_users, :api_key, :string
+  end
+end

data/lib/rails_identity/engine.rb ADDED Viewed

@@ -0,0 +1,9 @@
+Gem.loaded_specs['rails-identity'].dependencies.each do |d|
+ require d.name
+end
+module RailsIdentity
+  class Engine < ::Rails::Engine
+    isolate_namespace RailsIdentity
+  end
+end

data/lib/rails_identity/version.rb ADDED Viewed

@@ -0,0 +1,3 @@
+module RailsIdentity
+  VERSION = "0.0.1"
+end

data/lib/rails_identity.rb ADDED Viewed

@@ -0,0 +1,52 @@
+require "rails_identity/engine"
+module RailsIdentity
+  # App MUST monkey patch this constant
+  MAILER_EMAIL = "no-reply@rails-identity.com"
+  # To be able to break cache when backwards compatibility breaks
+  CACHE_PREFIX = "rails-identity-#{RailsIdentity::VERSION}"
+  # Fixed set of roles.
+  module Roles
+    PUBLIC = 0
+    USER = 10
+    ADMIN = 100
+    OWNER = 1000
+  end
+  # Errors defined by RailsIdentity
+  module Errors
+    class InvalidTokenError < StandardError; end
+    class ObjectNotFoundError < StandardError; end
+    class UnauthorizedError < StandardError; end
+    class InvalidOldPasswordError < StandardError; end
+    class InvalidResetTokenError < StandardError; end
+  end
+  # This module is a mixin that allows the model to use UUIDs instead of
+  # normal IDs. By including this module, the model class declares that the
+  # primary key is called "uuid" and an UUID is generated right before
+  # save(). You may assign an UUID prior to save, in which case, no new UUID
+  # will be generated.
+  module UUIDModel
+    def self.included(klass)
+      # Triggered when this module is included.
+      klass.primary_key = "uuid"
+      klass.before_create :generate_uuid
+    end
+    def generate_uuid()
+      # Generates an UUID for the model object only if it hasn't been assigned
+      # one yet.
+      if self.uuid.nil?
+        self.uuid = UUIDTools::UUID.timestamp_create().to_s
+      end
+    end
+  end
+end

data/lib/tasks/rails_identity_tasks.rake ADDED Viewed

@@ -0,0 +1,4 @@
+# desc "Explaining what the task does"
+# task :rails_identity do
+#   # Task goes here
+# end

data/test/controllers/rails_identity/sessions_controller_test.rb ADDED Viewed

@@ -0,0 +1,192 @@
+require 'test_helper'
+module RailsIdentity
+  class SessionsControllerTest < ActionController::TestCase
+    setup do
+      Rails.cache.clear
+      @routes = Engine.routes
+      @session = rails_identity_sessions(:one)
+      @token = @session.token
+    end
+    test "public can see options" do
+      get :options
+      assert_response :success
+    end
+    test "user can list all his sessions" do
+      get :index, token: @token
+      assert_response :success
+      sessions = assigns(:sessions)
+      assert_not_nil sessions
+      all_his_sessions = Session.where(user: @session.user)
+      assert_equal sessions.length, all_his_sessions.length
+      sessions.each do |session|
+        assert session.user == @session.user
+      end
+    end
+    test "user can list all his sessions using user id in routing" do
+      get :index, user_id: @session.user.uuid, token: @token
+      assert_response :success
+      sessions = assigns(:sessions)
+      assert_not_nil sessions
+      all_his_sessions = Session.where(user: @session.user)
+      assert_equal sessions.length, all_his_sessions.length
+      sessions.each do |session|
+        assert session.user == @session.user
+      end
+    end
+    test "user cannot list expired session" do
+      session = Session.new(user: @session.user, seconds: -1)
+      session.save()
+      get :index, user_id: session.user.uuid, token: @token
+      assert_response :success
+      json = JSON.parse(@response.body)
+      assert_equal 1, json.length
+    end
+    test "user cannot list other's sessions" do
+      get :index, user_id: rails_identity_users(:two), token: @token
+      assert_response 401
+    end
+    test "public cannot list sessions" do
+      get :index
+      assert_response 401
+    end
+    test "create a session" do
+      user = rails_identity_users(:one)
+      post :create, username: user.username, password: "password"
+      assert_response :success
+      session = assigns(:session)
+      assert_not_nil session
+      json = JSON.parse(@response.body)
+      assert json.has_key?("token")
+      assert !json.has_key?("secret")
+    end
+    test "cannot create a session if not verified" do
+      user = rails_identity_users(:one)
+      user.verified = false
+      user.save()
+      post :create, username: user.username, password: "password"
+      assert_response 401
+    end
+    test "cannot create a session with non-existent username" do
+      post :create, username: 'idontexist', password: "secret"
+      assert_response 401
+      json = JSON.parse(@response.body)
+      assert json["errors"].length == 1
+    end
+    test "cannot create a session without username" do
+      post :create, password: "secret"
+      assert_response 401
+      json = JSON.parse(@response.body)
+      assert json["errors"].length == 1
+    end
+    test "cannot create a session without a password" do
+      post :create, username: rails_identity_users(:one).username
+      assert_response 401
+      json = JSON.parse(@response.body)
+      assert json["errors"].length == 1
+    end
+    test "cannot create a session with a wrong password" do
+      post :create, username: rails_identity_users(:one).username, password: "notsecret"
+      assert_response 401
+      json = JSON.parse(@response.body)
+      assert json["errors"].length == 1
+    end
+    test "public cannot create sessions" do
+      get :index
+      assert_response 401
+    end
+    test "show a session" do
+      get :show, id: 1, token: @token
+      assert_response 200
+      json = JSON.parse(@response.body)
+      assert_equal @token, json["token"]
+      # Do a quick cache check
+      session = Rails.cache.fetch("#{CACHE_PREFIX}-session-#{json["uuid"]}")
+      assert_not_nil session
+      assert_equal @token, session.token
+    end
+    test "show a current session" do
+      get :show, id: "current", token: @token
+      assert_response 200
+      json = JSON.parse(@response.body)
+      assert_equal @token, json["token"]
+    end
+    test "cannot show other's session" do
+      get :show, id: 2, token: @token
+      assert_response 401
+    end
+    test "cannot show expired session" do
+      session = Session.new(user: @session.user, seconds: -1)
+      session.save()
+      get :show, id: session.uuid, token: @token
+      assert_response 404
+    end
+    test "public cannot show session" do
+      get :show, id:1
+      assert_response 401
+    end
+    test "admin can show other's session" do
+      @session = rails_identity_sessions(:admin_one)
+      @token = @session.token
+      get :show, id: 1, token: @token
+      assert_response :success
+      json = JSON.parse(@response.body)
+      session = rails_identity_sessions(:one)
+      assert_equal session.token, json["token"]
+    end
+    test "cannot show a nonexisting session" do
+      get :show, id: 999, token: @token
+      assert_response 404
+      json = JSON.parse(@response.body)
+      assert json["errors"].length == 1
+    end
+    test "delete a session" do
+      delete :destroy, id: 1, token: @token
+      assert_response 204
+    end
+    test "delete a current session" do
+      delete :destroy, id: "current", token: @token
+      assert_response 204
+    end
+    test "cannot delete a non-existent session" do
+      delete :destroy, id: 999, token: @token
+      assert_response 404
+    end
+    test "cannot delete other's session" do
+      delete :destroy, id: 2, token: @token
+      assert_response 401
+    end
+    test "admin can delete other's session" do
+      @session = rails_identity_sessions(:admin_one)
+      @token = @session.token
+      delete :destroy, id: 1, token: @token
+      assert_response :success
+    end
+  end
+end