signinable 2.0.16 → 3.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 98c939505c7a77333b6244200b4e2f1e6337cd00ab721773db89333910d4b0b4
-  data.tar.gz: 32917bd4f4f2671a9727f17c8b57b83f852fbd7b5c7259e6abe3f72b69669896
+  metadata.gz: c4cb3c9ed394555e10d075ec1b4ef7dfc401e81b1914abaff0ac79a34ed8adb1
+  data.tar.gz: d5a98fbe31a1db70c9739eb444bca9f1e070596853a5ef26911839c18d00289f
 SHA512:
-  metadata.gz: 4728c3a79d4d85443e8d92a51a156409bb616a4be5782ad236ffe8c5006a8a60bd777655c38559dc390fffc2fc447aef0cedd08c2beeb4d142731e238337f326
-  data.tar.gz: 1f0ae333d9cd6d4b53338a50b0a16fd2ec592ff7f5dfc87d400958eeddf33a51b8f6386172ecb2754291d811925637ac548968373030bfee09005107499cc06e
+  metadata.gz: a2922803d96c5617d587f7a695acc7a6bb902c73a218b0bbbf38f9f1859d9e86da00635a2cd6b6ab1eca6030ac2e46558921749a3204e3fc93ad9d68d5bb6ed0
+  data.tar.gz: aaeed33569ef9f0a6298671076a2aac3496874b02cd4a27f4e505d94d8a4859b9d0c23b5a99a289ceef6c7a9052e0947aaa434da4845aa82bc586b32755637b4

data/app/models/signin.rb

@@ -13,33 +13,24 @@ class Signin < ActiveRecord::Base
   scope :active, -> { where('expiration_time IS NULL OR expiration_time > ?', Time.zone.now) }
 
   before_validation on: :create do
-    self.token = generate_token
+    self.token = self.class.generate_token
   end
 
   serialize :custom_data if ActiveRecord::Base.connection.instance_values['config'][:adapter].match('mysql')
 
   def expire!
-    renew!(period: 0, ip: ip, user_agent: user_agent)
+    update!(
+      ip: ip,
+      user_agent: user_agent,
+      expiration_time: Time.current
+    )
   end
 
   def expired?
-    expireable? && expiration_time.past?
+    expiration_time.past?
   end
 
-  def expireable?
-    !expiration_time.nil?
-  end
-
-  def renew!(period:, ip:, user_agent:, refresh_token: false)
-    update_hash = { ip: ip, user_agent: user_agent }
-    update_hash[:expiration_time] = Time.zone.now + period if expireable?
-    update_hash[:token] = generate_token if refresh_token
-    update!(update_hash)
-  end
-
-  private
-
-  def generate_token
+  def self.generate_token
     SecureRandom.urlsafe_base64(rand(50..100))
   end
 end

data/db/migrate/20220814152804_change_signinable_id_to_string.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+migration_kls = Rails::VERSION::MAJOR > 4 ? ActiveRecord::Migration[5.0] : ActiveRecord::Migration
+class ChangeSigninableIdToString < migration_kls
+  def self.up
+    change_column :signins, :signinable_id, :string, null: false
+  end
+
+  def self.down
+    change_column :signins, :signinable_id, :integer, null: false
+  end
+end

data/lib/signinable/model_additions.rb

@@ -9,16 +9,14 @@ module Signinable
       DEFAULT_REFRESH_EXP = 7200
       DEFAULT_JWT_EXP = 900
 
-      cattr_reader :refresh_exp
       cattr_reader :simultaneous_signings
-      cattr_reader :signin_restrictions
       cattr_reader :jwt_secret
       cattr_reader :jwt_exp
+      cattr_reader :refresh_exp
 
       def signinable(options = {})
         self.refresh_exp = options.fetch(:refresh_exp, DEFAULT_REFRESH_EXP)
         self.simultaneous_signings = options.fetch(:simultaneous, true)
-        self.signin_restrictions = options[:restrictions]
         self.jwt_secret = options.fetch(:jwt_secret)
         self.jwt_exp = options.fetch(:jwt_exp, DEFAULT_JWT_EXP)
 
@@ -27,21 +25,19 @@ module Signinable
         attr_accessor :jwt
       end
 
-      def authenticate_with_token(jwt, ip, user_agent, skip_restrictions: [])
+      def authenticate_with_token(jwt, ip, user_agent)
         jwt_payload = extract_jwt_payload(jwt)
-        return refresh_jwt(jwt, ip, user_agent, skip_restrictions: skip_restrictions) unless jwt_payload
+        return nil unless jwt_payload
 
-        signinable = find_by(primary_key => jwt_payload['signinable_id'])
+        jwt = refresh_jwt(jwt_payload[:data], ip, user_agent) if jwt_payload[:expired]
+
+        signinable = find_by(primary_key => jwt_payload[:data]['signinable_id'])
         return nil unless signinable
 
         signinable.jwt = jwt
         signinable
       end
 
-      def check_signin_permission(signin, restrictions_to_check, skip_restrictions)
-        signin_permitted?(signin, restrictions_to_check, skip_restrictions)
-      end
-
       def expiration_period
         return refresh_exp.call if refresh_exp.respond_to?(:call)
 
@@ -60,101 +56,78 @@ module Signinable
         )
       end
 
-      def refresh_jwt(jwt, ip, user_agent, skip_restrictions: [])
-        token = refresh_token_from_jwt(jwt)
-        return nil unless token
+      def refresh_jwt(jwt_payload, ip, user_agent)
+        old_token = jwt_payload['refresh_token']
+        new_token = Signin.generate_token
 
-        signin = Signin.find_by(token: token)
+        result = Signin.where(token: old_token)
+                       .active
+                       .update_all(
+                         token: new_token,
+                         expiration_time: expiration_period.seconds.from_now,
+                         ip: ip,
+                         user_agent: user_agent
+                       )
 
-        return unless signin
-        return nil if signin.expired?
-        return nil unless check_signin_permission(signin, { ip: ip, user_agent: user_agent }, skip_restrictions)
+        return if result.zero?
 
-        signin.renew!(period: expiration_period, ip: ip, user_agent: user_agent, refresh_token: true)
-        signin.signinable.jwt = generate_jwt(signin.token, signin.signinable_id)
-        signin.signinable
+        generate_jwt(new_token, jwt_payload['signinable_id'])
       end
 
-      def refresh_token_from_jwt(jwt)
-        JWT.decode(jwt, jwt_secret, true, { verify_expiration: false, algorithm: 'HS256' })[0]['refresh_token']
+      def extract_jwt_payload(jwt)
+        {
+          data: JWT.decode(jwt, jwt_secret, true, { algorithm: 'HS256' })[0],
+          expired: false
+        }
       rescue JWT::DecodeError
-        nil
+        begin
+          {
+            data: JWT.decode(jwt, jwt_secret, true, { verify_expiration: false, algorithm: 'HS256' })[0],
+            expired: true
+          }
+        rescue JWT::DecodeError
+          nil
+        end
       end
 
       private
 
       cattr_writer :refresh_exp
       cattr_writer :simultaneous_signings
-      cattr_writer :signin_restrictions
       cattr_writer :jwt_secret
       cattr_writer :jwt_exp
-
-      def extract_jwt_payload(jwt)
-        JWT.decode(jwt, jwt_secret, true, { algorithm: 'HS256' })[0]
-      rescue JWT::DecodeError
-        nil
-      end
-
-      def signin_permitted?(signin, restrictions_to_check, skip_restrictions)
-        restriction_fields = signin_restriction_fields(signin, skip_restrictions)
-
-        restrictions_to_check.slice(*restriction_fields).each do |field, value|
-          return false unless signin.send(field) == value
-        end
-
-        true
-      end
-
-      def signin_restriction_fields(signin, skip_restrictions)
-        fields = if signin_restrictions.respond_to?(:call)
-                   signin_restrictions.call(signin.signinable)
-                 elsif signin_restrictions.is_a?(Array)
-                   signin_restrictions
-                 else
-                   []
-                 end
-        (fields - skip_restrictions) & ALLOWED_RESTRICTIONS
-      end
     end
 
-    def signin(ip, user_agent, referer, permanent: false, custom_data: {})
-      expires_in = self.class.expiration_period
-      expiration_time = expires_in.zero? || permanent ? nil : expires_in.seconds.from_now
+    def signin(ip, user_agent, referer, custom_data: {})
       Signin.where(signinable: self).active.map(&:expire!) unless self.class.simultaneous_signings
+
       signin = Signin.create!(
         signinable: self,
         ip: ip,
         referer: referer,
         user_agent: user_agent,
-        expiration_time: expiration_time,
+        expiration_time: self.class.expiration_period.seconds.from_now,
         custom_data: custom_data
       )
 
       self.jwt = self.class.generate_jwt(signin.token, signin.signinable_id)
-    end
 
-    def signout(jwt, ip, user_agent, skip_restrictions: [])
-      token = self.class.refresh_token_from_jwt(jwt)
-      return unless token
+      signin
+    end
 
-      signin = Signin.find_by_token(token)
+    def signout(jwt)
+      jwt_payload = self.class.extract_jwt_payload(jwt)
+      return unless jwt_payload
+      return if jwt_payload[:expired]
 
+      signin = Signin.find_by(token: jwt_payload[:data]['refresh_token'])
       return unless signin
       return if signin.expired?
-      return unless self.class.check_signin_permission(
-        signin,
-        { ip: ip, user_agent: user_agent },
-        skip_restrictions
-      )
 
       signin.expire!
 
       true
     end
-
-    def last_signin
-      signins.active.last
-    end
   end
 end
 

data/lib/signinable/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Signinable
-  VERSION = '2.0.16'
+  VERSION = '3.0.1'
 end

data/spec/dummy/config/application.rb

@@ -9,5 +9,6 @@ require 'signinable'
 
 module Dummy
   class Application < Rails::Application
+    config.load_defaults 7.0
   end
 end