solidus_jwt 1.0.0 → 1.1.0

data/bin/setup

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+IFS=$'\n\t'
+set -vx
+
+gem install bundler --conservative
+bundle update
+bin/rake clobber

data/config/locales/en.yml

@@ -2,4 +2,5 @@
 # See https://github.com/svenfuchs/rails-i18n/tree/master/rails%2Flocale for starting points.
 
 en:
-  hello: Hello world
+  solidus_jwt:
+    invalid_credentials: invalid username or password

data/db/migrate/20191212083655_add_foreign_key_to_users_table.rb

@@ -0,0 +1,5 @@
+class AddForeignKeyToUsersTable < ActiveRecord::Migration[5.2]
+  def change
+    add_foreign_key :solidus_jwt_tokens, Spree.user_class.table_name, column: :user_id, on_delete: :cascade
+  end
+end

data/lib/generators/solidus_jwt/install/install_generator.rb

@@ -3,16 +3,6 @@ module SolidusJwt
     class InstallGenerator < Rails::Generators::Base
       class_option :auto_run_migrations, type: :boolean, default: false
 
-      def add_javascripts
-        append_file 'vendor/assets/javascripts/spree/frontend/all.js', "//= require spree/frontend/solidus_jwt\n"
-        append_file 'vendor/assets/javascripts/spree/backend/all.js', "//= require spree/backend/solidus_jwt\n"
-      end
-
-      def add_stylesheets
-        inject_into_file 'vendor/assets/stylesheets/spree/frontend/all.css', " *= require spree/frontend/solidus_jwt\n", before: /\*\//, verbose: true
-        inject_into_file 'vendor/assets/stylesheets/spree/backend/all.css', " *= require spree/backend/solidus_jwt\n", before: /\*\//, verbose: true
-      end
-
       def add_migrations
         run 'bundle exec rake railties:install:migrations FROM=solidus_jwt'
       end
@@ -22,7 +12,7 @@ module SolidusJwt
         if run_migrations
           run 'bundle exec rake db:migrate'
         else
-          puts 'Skipping rake db:migrate, don\'t forget to run it!'
+          puts 'Skipping rake db:migrate, don\'t forget to run it!' # rubocop:disable Rails/Output
         end
       end
     end

data/lib/solidus_jwt.rb

@@ -1,9 +1,11 @@
 require 'jwt'
 
 require 'solidus_core'
+require 'solidus_support'
 require 'solidus_auth_devise'
 require 'solidus_jwt/engine'
 
+require 'solidus_jwt/devise_strategies/base'
 require 'solidus_jwt/devise_strategies/password'
 require 'solidus_jwt/devise_strategies/refresh_token'
 

data/lib/solidus_jwt/concerns/decodeable.rb

@@ -4,12 +4,16 @@ module SolidusJwt
     # Decode a token generated by SolidusJwt
     # @see https://github.com/jwt/ruby-jwt
     #
+    # @example decode a token.
+    #   SolidusJwt.decode('abc.123.efg')
+    #   #=> [{"sub"=>"1234567890", "name"=>"John Doe", "iat"=>1516239022}, {"alg"=>"HS256", "typ"=>"JWT"}]
+    #
     # @param token [String] The token to decode
     # @return [Array<Hash>]
     #
     def decode(token)
       JWT.decode(token, SolidusJwt::Config.jwt_secret, true,
-                 algorithm: SolidusJwt::Config.jwt_algorithm)
+        algorithm: SolidusJwt::Config.jwt_algorithm)
     end
   end
 end

data/lib/solidus_jwt/concerns/encodeable.rb

@@ -4,6 +4,16 @@ module SolidusJwt
     # Encode a specified payload
     # @see https://github.com/jwt/ruby-jwt
     #
+    # @example encode data into token
+    #   payload = {
+    #     sub: 1,
+    #     iat: DateTime.current.to_i,
+    #     exp: 1.hour.from_now.to_i
+    #   }
+    #
+    #   SolidusJwt.encode payload: payload
+    #   #=> 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOjEsImlhdCI6MTU4NDEzMjExOCwiZXhwIjoxNTg0MTM1NzE4LCJpc3MiOiJzb2xpZHVzIn0.OKZOGlawx435GdgKp2AGD8SKxW7sqn0h-Ef2qdVSxqQ'
+    #
     # @param payload [Hash] Attributes to place within the jwt
     # @param expires_in [Integer] How long until token expires in Seconds (*Optional*).
     #   Note that if no expires at is set, then the token will last forever.
@@ -15,12 +25,12 @@ module SolidusJwt
       current_time = Time.current.to_i
 
       # @see https://github.com/jwt/ruby-jwt#support-for-reserved-claim-names
-      jwt_payload[:exp] ||= current_time + expires_in if expires_in.present?
+      jwt_payload[:exp] ||= current_time + expires_in.to_i if expires_in.present?
       jwt_payload[:iat] ||= current_time
       jwt_payload[:iss] ||= 'solidus'
 
       JWT.encode(jwt_payload, SolidusJwt::Config.jwt_secret,
-                 SolidusJwt::Config.jwt_algorithm)
+        SolidusJwt::Config.jwt_algorithm)
     end
   end
 end

data/lib/solidus_jwt/devise_strategies/base.rb

@@ -0,0 +1,23 @@
+module SolidusJwt
+  module DeviseStrategies
+    class Base < Devise::Strategies::Authenticatable
+      def valid?
+        valid_grant_type? && valid_params?
+      end
+
+      private
+
+      def grant_type
+        params[:grant_type]
+      end
+
+      def valid_grant_type?
+        raise NotImplementedError
+      end
+
+      def valid_params?
+        raise NotImplementedError
+      end
+    end
+  end
+end

data/lib/solidus_jwt/devise_strategies/password.rb

@@ -1,13 +1,7 @@
 module SolidusJwt
   module DeviseStrategies
-    class Password < Devise::Strategies::Base
-      def valid?
-        valid_grant_type? && valid_params?
-      end
-
+    class Password < Base
       def authenticate!
-        resource = mapping.to.find_for_database_authentication(auth_hash)
-
         block = proc { resource.valid_password?(password) }
 
         if resource&.valid_for_authentication?(&block)
@@ -20,12 +14,12 @@ module SolidusJwt
 
       private
 
-      def auth_hash
-        { email: username }
+      def resource
+        @resource ||= mapping.to.find_for_database_authentication(auth_hash)
       end
 
-      def grant_type
-        params[:grant_type]
+      def auth_hash
+        { email: username }
       end
 
       def username

data/lib/solidus_jwt/devise_strategies/refresh_token.rb

@@ -1,17 +1,14 @@
 module SolidusJwt
   module DeviseStrategies
-    class RefreshToken < Devise::Strategies::Base
-      def valid?
-        valid_grant_type? && valid_params?
-      end
-
+    class RefreshToken < Base
       def authenticate!
-        resource = SolidusJwt::Token.find_by(auth_hash)
         return fail!(:invalid) if resource.nil? || resource.user.nil?
 
         block = proc do
           # If we honor then mark the refresh token as stale for one time use
+          # rubocop:disable Rails/SkipsModelValidations
           resource.honor? && resource.update_columns(active: false)
+          # rubocop:enable Rails/SkipsModelValidations
         end
 
         if resource.user.valid_for_authentication?(&block)
@@ -23,12 +20,12 @@ module SolidusJwt
 
       private
 
-      def auth_hash
-        { auth_type: :refresh, token: refresh_token }
+      def resource
+        @resource ||= SolidusJwt::Token.find_by(auth_hash)
       end
 
-      def grant_type
-        params[:grant_type]
+      def auth_hash
+        { auth_type: :refresh, token: refresh_token }
       end
 
       def refresh_token

data/lib/solidus_jwt/distributor/devise.rb

@@ -5,7 +5,7 @@ module SolidusJwt
         # Send back json web token in redirect header
         if try_spree_current_user
           response.headers['X-SPREE-TOKEN'] = try_spree_current_user.
-            generate_jwt_token(expires_in: SolidusJwt::Config.jwt_expiration)
+                                              generate_jwt_token(expires_in: SolidusJwt::Config.jwt_expiration)
         end
 
         super

data/lib/solidus_jwt/engine.rb

@@ -1,22 +1,16 @@
+require 'spree/core'
+
 module SolidusJwt
   class Engine < Rails::Engine
-    require 'spree/core'
-    isolate_namespace Spree
+    include SolidusSupport::EngineExtensions::Decorators
+
+    isolate_namespace ::Spree
+
     engine_name 'solidus_jwt'
 
     # use rspec for tests
     config.generators do |g|
       g.test_framework :rspec
     end
-
-    def self.activate
-      decorator_pattern = File.join(__dir__, '../../app/**/*_decorator*.rb')
-
-      Dir.glob(decorator_pattern) do |c|
-        Rails.configuration.cache_classes ? require(c) : load(c)
-      end
-    end
-
-    config.to_prepare(&method(:activate).to_proc)
   end
 end

data/lib/solidus_jwt/version.rb

@@ -1,11 +1,3 @@
 module SolidusJwt
-  MAJOR = 1
-  MINOR = 0
-  PATCH = 0
-  PRERELEASE = nil
-
-  def self.version
-    version = [MAJOR, MINOR, PATCH].join('.')
-    [version, PRERELEASE].compact.join('.')
-  end
+  VERSION = '1.1.0'
 end

data/solidus_jwt.gemspec

@@ -0,0 +1,36 @@
+require_relative 'lib/solidus_jwt/version'
+
+Gem::Specification.new do |s|
+  s.name        = 'solidus_jwt'
+  s.version     = SolidusJwt::VERSION
+  s.summary     = 'Add Json Web Tokens to Solidus API'
+  s.description = 'Add Json Web Tokens to Solidus API'
+  s.license     = 'BSD-3-Clause'
+
+  s.author    = 'Taylor Scott'
+  s.email     = 't.skukx@gmail.com'
+  s.homepage  = 'https://github.com/skukx/solidus_jwt'
+
+  s.metadata['homepage_uri'] = s.homepage
+  s.metadata['source_code_uri'] = s.homepage
+
+  s.required_ruby_version = Gem::Requirement.new('~> 2.4')
+
+  # Specify which files should be added to the gem when it is released.
+  # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
+  files = Dir.chdir(__dir__) { `git ls-files -z`.split("\x0") }
+
+  s.files = files.grep_v(%r{^(test|spec|features)/})
+  s.test_files = files.grep(%r{^(test|spec|features)/})
+  s.bindir = "exe"
+  s.executables = files.grep(%r{^exe/}) { |f| File.basename(f) }
+  s.require_paths = ["lib"]
+
+  s.add_dependency 'jwt'
+  s.add_dependency 'solidus_auth_devise'
+  s.add_dependency 'solidus_core', ['>= 2.0.0', '< 3']
+  s.add_dependency 'solidus_support', '~> 0.4.0'
+
+  s.add_development_dependency 'byebug'
+  s.add_development_dependency 'solidus_dev_support'
+end

data/spec/lib/solidus_jwt/config_spec.rb

@@ -0,0 +1,5 @@
+require 'spec_helper'
+
+RSpec.describe SolidusJwt::Config do
+  it { is_expected.to be_kind_of SolidusJwt::Preferences }
+end

data/spec/lib/solidus_jwt/devise_strategies/password_spec.rb

@@ -0,0 +1,76 @@
+require 'spec_helper'
+require 'spree/testing_support/factories/user_factory'
+
+RSpec.describe SolidusJwt::DeviseStrategies::Password do
+  let(:request) { instance_double('ActionController::Request') }
+  let(:strategy) { described_class.new(nil, :spree_user) }
+
+  let(:params) do
+    {
+      username: user.email,
+      password: password,
+      grant_type: 'password'
+    }
+  end
+
+  let(:headers) { {} }
+  let(:user) { FactoryBot.create(:user, password: password) }
+  let(:password) { 'secret' }
+
+  before do
+    allow(request).to receive(:headers).and_return(:headers)
+
+    allow(strategy).to receive(:request).and_return(request)
+    allow(strategy).to receive(:params).and_return(params)
+  end
+
+  describe '#valid?' do
+    subject { strategy.valid? }
+
+    it { is_expected.to be true }
+
+    context 'when username is missing' do
+      before { params.delete(:username) }
+
+      it { is_expected.to be false }
+    end
+
+    context 'when password is missing' do
+      before { params.delete(:password) }
+
+      it { is_expected.to be false }
+    end
+
+    context 'when grant_type is not password' do
+      before { params[:grant_type] = 'invalid' }
+
+      it { is_expected.to be false }
+    end
+  end
+
+  describe '#authenticate!' do
+    subject { strategy.authenticate! }
+
+    it { is_expected.to be :success }
+
+    context 'when auth is invalid' do
+      let(:params) do
+        {
+          username: user.email,
+          password: 'invalid',
+          grant_type: password
+        }
+      end
+
+      it { is_expected.to be :failure }
+    end
+
+    context 'when user is not valid for authentication' do
+      before do
+        allow_any_instance_of(Spree::User).to receive(:valid_for_authentication?).and_return(false) # rubocop:disable RSpec/AnyInstance
+      end
+
+      it { is_expected.to be :failure }
+    end
+  end
+end

data/spec/lib/solidus_jwt/devise_strategies/refresh_token_spec.rb

@@ -0,0 +1,72 @@
+require 'spec_helper'
+require 'spree/testing_support/factories/user_factory'
+
+RSpec.describe SolidusJwt::DeviseStrategies::RefreshToken do
+  let(:request) { instance_double('ActionController::Request') }
+  let(:strategy) { described_class.new(nil, :spree_user) }
+
+  let(:params) do
+    {
+      refresh_token: token.token,
+      grant_type: 'refresh_token'
+    }
+  end
+
+  let(:headers) { {} }
+  let(:user) { FactoryBot.create(:user, password: password) }
+  let(:password) { 'secret' }
+  let(:token) { user.auth_tokens.create! }
+
+  before do
+    allow(request).to receive(:headers).and_return(:headers)
+
+    allow(strategy).to receive(:request).and_return(request)
+    allow(strategy).to receive(:params).and_return(params)
+  end
+
+  describe '#valid?' do
+    subject { strategy.valid? }
+
+    it { is_expected.to be true }
+
+    context 'when refresh_token is missing' do
+      before { params.delete(:refresh_token) }
+
+      it { is_expected.to be false }
+    end
+
+    context 'when grant_type is not refresh_token' do
+      before { params[:grant_type] = 'invalid' }
+
+      it { is_expected.to be false }
+    end
+  end
+
+  describe '#authenticate!' do
+    subject { strategy.authenticate! }
+
+    it { is_expected.to be :success }
+
+    context 'when token is not honorable' do
+      before do
+        allow_any_instance_of(SolidusJwt::Token).to receive(:honor?).and_return false # rubocop:disable RSpec/AnyInstance
+      end
+
+      it { is_expected.to be :failure }
+    end
+
+    context 'when user is not valid for authentication' do
+      before do
+        allow_any_instance_of(Spree::User).to receive(:valid_for_authentication?).and_return(false) # rubocop:disable RSpec/AnyInstance
+      end
+
+      it { is_expected.to be :failure }
+    end
+
+    context 'when token is used more than once' do
+      before { strategy.authenticate! }
+
+      it { is_expected.to be :failure }
+    end
+  end
+end