simple_token_authentication 1.9.1 → 1.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 9f0598cbfab98dc89e4bd6a1ec862ef0c190b11e
-  data.tar.gz: 69e2239f4d6d51c230056f61051e6f1cc05a633f
+  metadata.gz: b4c32afa7541d97b6932847b957f50466ee24038
+  data.tar.gz: 06e65364bd75dd8378af724e6d73a66c22934fdd
 SHA512:
-  metadata.gz: c0eded2ae10fcb6bed035abb0f0c2715c7914aab698e51bf825e469dcb79e1f499088db73a30bb4ef722129a3ce80714ecf4ceac083face887df7514011d7802
-  data.tar.gz: c6ac775ebb4f855edb1799463af719bbf885de8ca7c2f2e8cad1e76a10ffba3f23f106a1c0dfddd87ca31f479efdf9de48e382c2d61394b686bd7210007ccd1d
+  metadata.gz: 5e1fd325345ff24df707a2a9c7a9f008d36a41702336e20671011c2ad22565416f8dbcd4f8f75e3fca885f924dddecc52a0b0c094aa77fe66e6e8238d4f9633a
+  data.tar.gz: f46a13bc9a3ef51a55e4ea0d9101d90fa723f139e1a658c2a2dc85a2d71282a3346edb22ceadef0b86d24582a92e13a1e756f674edfd9d0c49bdc123eba1b5b6

data/README.md

@@ -101,7 +101,7 @@ class ApplicationController < ActionController::Base # or ActionController::API
 
   # Security note: controllers with no-CSRF protection must disable the Devise fallback,
   # see #49 for details.
-  # acts_as_token_authentication_handler_for User, fallback_to_devise: false
+  # acts_as_token_authentication_handler_for User, fallback: :none
 
   # The token authentication requirement can target specific controller actions:
   # acts_as_token_authentication_handler_for User, only: [:create, :update, :destroy]
@@ -112,12 +112,12 @@ class ApplicationController < ActionController::Base # or ActionController::API
   # acts_as_token_authentication_handler_for User, if: lambda { |controller| controller.request.format.json? }
 
   # Several token authenticatable models can be handled by the same controller.
-  # If so, for all of them except the last, the fallback_to_devise should be disabled.
+  # If so, for all of them except the last, the fallback should be set to :none.
   #
   # Please do notice that the order of declaration defines the order of precedence.
   #
-  # acts_as_token_authentication_handler_for Admin, fallback_to_devise: false
-  # acts_as_token_authentication_handler_for SpecialUser, fallback_to_devise: false
+  # acts_as_token_authentication_handler_for Admin, fallback: :none
+  # acts_as_token_authentication_handler_for SpecialUser, fallback: :none
   # acts_as_token_authentication_handler_for User # the last fallback is up to you
 
   # Aliases can be defined for namespaced models:
@@ -236,11 +236,15 @@ X-User-Token 1G8_s7P-V-4MGojaKD7a
 
 In fact, you can mix both methods and provide the `user_email` with one and the `user_token` with the other, even if it would be a freak thing to do.
 
-### Integration with other authentication methods
+### Integration with other authentication and authorization methods
 
-If sign-in is successful, no other authentication method will be run, but if it doesn't (the authentication params were missing, or incorrect) then Devise takes control and tries to `authenticate_user!` with its own modules. That behaviour can however be modified for any controller through the **fallback_to_devise** option.
+If sign-in is successful, no other authentication method will be run, but if it doesn't (the authentication params were missing, or incorrect) then Devise takes control and tries to `authenticate_user!` with its own modules. That behaviour can however be modified for any controller through the **fallback** option (which defaults to `fallback: :devise`).
 
-**Important**: Please do notice that controller actions without CSRF protection **must** disable the Devise fallback for [security reasons][csrf]. Since Rails enables CSRF protection by default, this configuration requirement should only affect controllers where you have disabled it, which may be the case of API controllers.
+When `fallabck: :exception` is set, then an exception is raised on token authentication failure. The resulting controller behaviour is very similar to the behaviour induced by using the Devise `authenticate_user!` callback instead of `authenticate_user`. That setting allows, for example, to prevent unauthenticated users to accede API controllers while disabling the default fallback to Devise.
+
+**Important**: Please do notice that controller actions without CSRF protection **must** disable the Devise fallback for [security reasons][csrf] (both `fallback: :exception` and `fallback: :none` will disable the Devise fallback). Since Rails enables CSRF protection by default, this configuration requirement should only affect controllers where you have disabled it specifically, which may be the case of API controllers.
+
+To use no fallback when token authentication fails, set `fallback: :none`.
 
   [csrf]: https://github.com/gonzalo-bulnes/simple_token_authentication/issues/49
 

data/lib/simple_token_authentication.rb

@@ -6,6 +6,7 @@ module SimpleTokenAuthentication
   extend Configuration
 
   NoAdapterAvailableError = Class.new(LoadError)
+  InvalidOptionValue = Class.new(RuntimeError)
 
   private
 

data/lib/simple_token_authentication/{fallback_authentication_handler.rb → devise_fallback_handler.rb}

@@ -1,5 +1,11 @@
 module SimpleTokenAuthentication
-  class FallbackAuthenticationHandler
+  class DeviseFallbackHandler
+
+    # Fallback to the Devise authentication strategies.
+    def fallback!(controller, entity)
+      authenticate_entity!(controller, entity)
+    end
+
     # Devise authentication is performed through a controller
     # which includes Devise::Controllers::Helpers
     # See http://rdoc.info/github/plataformatec/devise/master/\

data/lib/simple_token_authentication/exception_fallback_handler.rb

@@ -0,0 +1,9 @@
+module SimpleTokenAuthentication
+  class ExceptionFallbackHandler
+    # Notifies the failure of authentication to Warden in the same DEvise does.
+    # Does result in an HTTP 401 response in a Devise context.
+    def fallback!(controller, entity)
+      throw(:warden, scope: entity.name_underscore.to_sym) if controller.send("current_#{entity.name_underscore}").nil?
+    end
+  end
+end

data/lib/simple_token_authentication/token_authentication_handler.rb

@@ -2,7 +2,8 @@ require 'active_support/concern'
 require 'devise'
 
 require 'simple_token_authentication/entities_manager'
-require 'simple_token_authentication/fallback_authentication_handler'
+require 'simple_token_authentication/devise_fallback_handler'
+require 'simple_token_authentication/exception_fallback_handler'
 require 'simple_token_authentication/sign_in_handler'
 require 'simple_token_authentication/token_comparator'
 
@@ -14,10 +15,10 @@ module SimpleTokenAuthentication
       private_class_method :define_token_authentication_helpers_for
       private_class_method :set_token_authentication_hooks
       private_class_method :entities_manager
-      private_class_method :fallback_authentication_handler
+      private_class_method :fallback_handler
 
       private :authenticate_entity_from_token!
-      private :authenticate_entity_from_fallback!
+      private :fallback!
       private :token_correct?
       private :perform_sign_in!
       private :token_comparator
@@ -34,8 +35,8 @@ module SimpleTokenAuthentication
       end
     end
 
-    def authenticate_entity_from_fallback!(entity, fallback_authentication_handler)
-      fallback_authentication_handler.authenticate_entity!(self, entity)
+    def fallback!(entity, fallback_handler)
+      fallback_handler.fallback!(self, entity)
     end
 
     def token_correct?(record, entity, token_comparator)
@@ -95,7 +96,7 @@ module SimpleTokenAuthentication
         model_alias = options[:as] || options['as']
         entity = entities_manager.find_or_create_entity(model, model_alias)
         options = SimpleTokenAuthentication.parse_options(options)
-        define_token_authentication_helpers_for(entity, fallback_authentication_handler)
+        define_token_authentication_helpers_for(entity, fallback_handler(options))
         set_token_authentication_hooks(entity, options)
       end
 
@@ -109,15 +110,19 @@ module SimpleTokenAuthentication
       end
 
       # Private: Get one (always the same) object which behaves as a fallback authentication handler
-      def fallback_authentication_handler
+      def fallback_handler(options)
         if class_variable_defined?(:@@fallback_authentication_handler)
           class_variable_get(:@@fallback_authentication_handler)
         else
-          class_variable_set(:@@fallback_authentication_handler, FallbackAuthenticationHandler.new)
+          if options[:fallback] == :exception
+            class_variable_set(:@@fallback_authentication_handler, ExceptionFallbackHandler.new)
+          else
+            class_variable_set(:@@fallback_authentication_handler, DeviseFallbackHandler.new)
+          end
         end
       end
 
-      def define_token_authentication_helpers_for(entity, fallback_authentication_handler)
+      def define_token_authentication_helpers_for(entity, fallback_handler)
 
         method_name = "authenticate_#{entity.name_underscore}_from_token"
         method_name_bang = method_name + '!'
@@ -130,7 +135,7 @@ module SimpleTokenAuthentication
           define_method method_name_bang.to_sym do
             lambda do |_entity|
               authenticate_entity_from_token!(_entity)
-              authenticate_entity_from_fallback!(_entity, fallback_authentication_handler)
+              fallback!(_entity, fallback_handler)
             end.call(entity)
           end
         end

data/lib/simple_token_authentication/version.rb

@@ -1,3 +1,3 @@
 module SimpleTokenAuthentication
-  VERSION = "1.9.1"
+  VERSION = "1.10.0"
 end

data/spec/lib/simple_token_authentication/{fallback_authentication_handler_spec.rb → devise_fallback_handler_spec.rb}

@@ -1,9 +1,11 @@
 require 'spec_helper'
 
-describe SimpleTokenAuthentication::FallbackAuthenticationHandler do
+describe SimpleTokenAuthentication::DeviseFallbackHandler do
 
   it_behaves_like 'an authentication handler'
 
+  it_behaves_like 'a fallback handler'
+
   describe '#authenticate_entity!' do
 
     it 'delegates authentication to Devise::Controllers::Helpers through a controller', private: true do
@@ -21,4 +23,17 @@ describe SimpleTokenAuthentication::FallbackAuthenticationHandler do
       expect(response).to eq 'Devise response.'
     end
   end
+
+  describe '#fallback!' do
+
+    it 'does #authenticate_entity!', private: true do
+      entity = double()
+      allow(@entity).to receive_message_chain(:name_underscore).and_return('entity')
+      controller = double()
+
+      expect(subject).to receive(:authenticate_entity!).with(controller, entity)
+
+      subject.send(:fallback!, controller, entity)
+    end
+  end
 end

data/spec/lib/simple_token_authentication/exception_fallback_handler_spec.rb

@@ -0,0 +1,39 @@
+require 'spec_helper'
+
+describe SimpleTokenAuthentication::ExceptionFallbackHandler do
+
+  it_behaves_like 'a fallback handler'
+
+  describe '#fallback!' do
+
+    context 'when authentication failed' do
+
+      before(:each) do
+        @entity = double()
+        allow(@entity).to receive_message_chain(:name_underscore).and_return('entity')
+        @controller = double()
+
+        allow(@controller).to receive(:current_entity).and_return(nil)
+      end
+
+      it 'delegates exception throwing to Warden', private: true do
+        expect{ subject.fallback!(@controller, @entity) }.to throw_symbol(:warden, scope: :entity)
+      end
+    end
+
+    context 'when authentication was successful' do
+
+      before(:each) do
+        @entity = double()
+        allow(@entity).to receive_message_chain(:name_underscore).and_return('entity')
+        @controller = double()
+
+        allow(@controller).to receive(:current_entity).and_return('some entity')
+      end
+
+      it 'does not throw any exception', private: true do
+        expect{ subject.fallback!(@controller, @entity) }.not_to throw_symbol(:warden, scope: :entity)
+      end
+    end
+  end
+end

data/spec/lib/simple_token_authentication/token_authentication_handler_spec.rb

@@ -78,10 +78,6 @@ describe 'Any class which includes SimpleTokenAuthentication::TokenAuthenticatio
   describe '.entities_manager' do
 
     before(:each) do
-      # The private tag is here to keep the following examples out of
-      # the public documentation.
-      subject.send :public_class_method, :entities_manager
-
       allow(SimpleTokenAuthentication::EntitiesManager).to receive(:new)
         .and_return('a EntitiesManager instance')
     end
@@ -90,65 +86,104 @@ describe 'Any class which includes SimpleTokenAuthentication::TokenAuthenticatio
 
       it 'creates a new EntitiesManager instance', private: true do
         expect(SimpleTokenAuthentication::EntitiesManager).to receive(:new)
-        expect(subject.entities_manager).to eq 'a EntitiesManager instance'
+        expect(subject.send(:entities_manager)).to eq 'a EntitiesManager instance'
       end
     end
 
     context 'when a EntitiesManager instance was already created' do
 
       before(:each) do
-        subject.entities_manager
+        subject.send(:entities_manager)
         # let's make any new EntitiesManager distinct from the first
         allow(SimpleTokenAuthentication::EntitiesManager).to receive(:new)
         .and_return('another EntitiesManager instance')
       end
 
       it 'returns that instance', private: true do
-        expect(subject.entities_manager).to eq 'a EntitiesManager instance'
+        expect(subject.send(:entities_manager)).to eq 'a EntitiesManager instance'
       end
 
       it 'does not create a new EntitiesManager instance', private: true do
         expect(SimpleTokenAuthentication::EntitiesManager).not_to receive(:new)
-        expect(subject.entities_manager).not_to eq 'another EntitiesManager instance'
+        expect(subject.send(:entities_manager)).not_to eq 'another EntitiesManager instance'
       end
     end
   end
 
-  describe '.fallback_authentication_handler' do
+  describe '.fallback_handler' do
 
     before(:each) do
-      # The private tag is here to keep the following examples out of
-      # the public documentation.
-      subject.send :public_class_method, :fallback_authentication_handler
-
-      allow(SimpleTokenAuthentication::FallbackAuthenticationHandler).to receive(:new)
-        .and_return('a FallbackAuthenticationHandler instance')
+      allow(SimpleTokenAuthentication::DeviseFallbackHandler).to receive(:new)
+        .and_return('a DeviseFallbackHandler instance')
+      allow(SimpleTokenAuthentication::ExceptionFallbackHandler).to receive(:new)
+        .and_return('an ExceptionFallbackHandler instance')
     end
 
-    context 'when called for the first time' do
+    context 'when the Devise fallback is enabled', fallback_option: true do
+
+      before(:each) do
+        @options = { fallback: :devise }
+      end
+
+      context 'when called for the first time' do
 
-      it 'creates a new FallbackAuthenticationHandler instance', private: true do
-        expect(SimpleTokenAuthentication::FallbackAuthenticationHandler).to receive(:new)
-        expect(subject.fallback_authentication_handler).to eq 'a FallbackAuthenticationHandler instance'
+        it 'creates a new DeviseFallbackHandler instance', private: true do
+          expect(SimpleTokenAuthentication::DeviseFallbackHandler).to receive(:new)
+          expect(subject.send(:fallback_handler, @options)).to eq 'a DeviseFallbackHandler instance'
+        end
+      end
+
+      context 'when a DeviseFallbackHandler instance was already created' do
+
+        before(:each) do
+          subject.send(:fallback_handler, @options)
+          # let's make any new DeviseFallbackHandler distinct from the first
+          allow(SimpleTokenAuthentication::DeviseFallbackHandler).to receive(:new)
+          .and_return('another DeviseFallbackHandler instance')
+        end
+
+        it 'returns that instance', private: true do
+          expect(subject.send(:fallback_handler, @options)).to eq 'a DeviseFallbackHandler instance'
+        end
+
+        it 'does not create a new DeviseFallbackHandler instance', private: true do
+          expect(SimpleTokenAuthentication::DeviseFallbackHandler).not_to receive(:new)
+          expect(subject.send(:fallback_handler, @options)).not_to eq 'another DeviseFallbackHandler instance'
+        end
       end
     end
 
-    context 'when a FallbackAuthenticationHandler instance was already created' do
+    context 'when the Exception fallback is enabled', fallback_option: true do
 
       before(:each) do
-        subject.fallback_authentication_handler
-        # let's make any new FallbackAuthenticationHandler distinct from the first
-        allow(SimpleTokenAuthentication::FallbackAuthenticationHandler).to receive(:new)
-        .and_return('another FallbackAuthenticationHandler instance')
+        @options = { fallback: :exception }
       end
 
-      it 'returns that instance', private: true do
-        expect(subject.fallback_authentication_handler).to eq 'a FallbackAuthenticationHandler instance'
+      context 'when called for the first time' do
+
+        it 'creates a new ExceptionFallbackHandler instance', private: true do
+          expect(SimpleTokenAuthentication::ExceptionFallbackHandler).to receive(:new)
+          expect(subject.send(:fallback_handler, @options)).to eq 'an ExceptionFallbackHandler instance'
+        end
       end
 
-      it 'does not create a new FallbackAuthenticationHandler instance', private: true do
-        expect(SimpleTokenAuthentication::FallbackAuthenticationHandler).not_to receive(:new)
-        expect(subject.fallback_authentication_handler).not_to eq 'another FallbackAuthenticationHandler instance'
+      context 'when a ExceptionFallbackHandler instance was already created' do
+
+        before(:each) do
+          subject.send(:fallback_handler, @options)
+          # let's make any new ExceptionFallbackHandler distinct from the first
+          allow(SimpleTokenAuthentication::ExceptionFallbackHandler).to receive(:new)
+          .and_return('another ExceptionFallbackHandler instance')
+        end
+
+        it 'returns that instance', private: true do
+          expect(subject.send(:fallback_handler, @options)).to eq 'an ExceptionFallbackHandler instance'
+        end
+
+        it 'does not create a new ExceptionFallbackHandler instance', private: true do
+          expect(SimpleTokenAuthentication::ExceptionFallbackHandler).not_to receive(:new)
+          expect(subject.send(:fallback_handler, @options)).not_to eq 'another ExceptionFallbackHandler instance'
+        end
       end
     end
   end

data/spec/support/spec_for_fallback_handler_interface.rb

@@ -0,0 +1,8 @@
+RSpec.shared_examples 'a fallback handler' do
+
+  let(:fallback_handler) { described_class.new() }
+
+  it 'responds to :fallback!', private: true do
+    expect(fallback_handler).to respond_to :fallback!
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: simple_token_authentication
 version: !ruby/object:Gem::Version
-  version: 1.9.1
+  version: 1.10.0
 platform: ruby
 authors:
 - Gonzalo Bulnes Guilpain
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-04-28 00:00:00.000000000 Z
+date: 2015-06-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionmailer
@@ -152,9 +152,10 @@ files:
 - lib/simple_token_authentication/adapters/rails_adapter.rb
 - lib/simple_token_authentication/adapters/rails_api_adapter.rb
 - lib/simple_token_authentication/configuration.rb
+- lib/simple_token_authentication/devise_fallback_handler.rb
 - lib/simple_token_authentication/entities_manager.rb
 - lib/simple_token_authentication/entity.rb
-- lib/simple_token_authentication/fallback_authentication_handler.rb
+- lib/simple_token_authentication/exception_fallback_handler.rb
 - lib/simple_token_authentication/sign_in_handler.rb
 - lib/simple_token_authentication/token_authentication_handler.rb
 - lib/simple_token_authentication/token_comparator.rb
@@ -173,10 +174,11 @@ files:
 - spec/lib/simple_token_authentication/adapters/rails_adapter_spec.rb
 - spec/lib/simple_token_authentication/adapters/rails_api_adapter_spec.rb
 - spec/lib/simple_token_authentication/configuration_spec.rb
+- spec/lib/simple_token_authentication/devise_fallback_handler_spec.rb
 - spec/lib/simple_token_authentication/entities_manager_spec.rb
 - spec/lib/simple_token_authentication/entity_spec.rb
 - spec/lib/simple_token_authentication/errors_spec.rb
-- spec/lib/simple_token_authentication/fallback_authentication_handler_spec.rb
+- spec/lib/simple_token_authentication/exception_fallback_handler_spec.rb
 - spec/lib/simple_token_authentication/sign_in_handler_spec.rb
 - spec/lib/simple_token_authentication/token_authentication_handler_spec.rb
 - spec/lib/simple_token_authentication/token_comparator_spec.rb
@@ -188,6 +190,7 @@ files:
 - spec/support/spec_for_authentication_handler_interface.rb
 - spec/support/spec_for_configuration_option_interface.rb
 - spec/support/spec_for_entities_manager_interface.rb
+- spec/support/spec_for_fallback_handler_interface.rb
 - spec/support/spec_for_sign_in_handler_interface.rb
 - spec/support/spec_for_token_comparator_interface.rb
 - spec/support/spec_for_token_generator_interface.rb
@@ -212,7 +215,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.6
+rubygems_version: 2.4.7
 signing_key: 
 specification_version: 4
 summary: Simple (but safe) token authentication for Rails apps or API with Devise.
@@ -220,12 +223,13 @@ test_files:
 - spec/lib/simple_token_authentication_spec.rb
 - spec/lib/simple_token_authentication/entities_manager_spec.rb
 - spec/lib/simple_token_authentication/sign_in_handler_spec.rb
-- spec/lib/simple_token_authentication/fallback_authentication_handler_spec.rb
+- spec/lib/simple_token_authentication/exception_fallback_handler_spec.rb
 - spec/lib/simple_token_authentication/token_comparator_spec.rb
 - spec/lib/simple_token_authentication/configuration_spec.rb
 - spec/lib/simple_token_authentication/token_generator_spec.rb
 - spec/lib/simple_token_authentication/acts_as_token_authenticatable_spec.rb
 - spec/lib/simple_token_authentication/acts_as_token_authentication_handler_spec.rb
+- spec/lib/simple_token_authentication/devise_fallback_handler_spec.rb
 - spec/lib/simple_token_authentication/token_authentication_handler_spec.rb
 - spec/lib/simple_token_authentication/errors_spec.rb
 - spec/lib/simple_token_authentication/adapters/active_record_adapter_spec.rb
@@ -245,6 +249,7 @@ test_files:
 - spec/support/spec_for_adapter.rb
 - spec/support/specs_for_token_authentication_handler_interface.rb
 - spec/support/spec_for_token_comparator_interface.rb
+- spec/support/spec_for_fallback_handler_interface.rb
 - spec/support/spec_for_configuration_option_interface.rb
 - spec/support/spec_for_sign_in_handler_interface.rb
 - spec/support/dummy_classes_helper.rb