token_authenticate_me 0.4.3 → 0.5.0

data/.rubocop.yml

@@ -1,8 +0,0 @@
-AllCops:
-  Exclude:
-    - '**/templates/*'
-    - '*.gemspec'
-LineLength:
-  Max: 100
-Documentation:
-  Enabled: false

data/CHANGELOG.md

@@ -1,2 +0,0 @@
-## 0.4.2 / 2015-09-08
-* [BUGFIX] fixed bug #26.

data/Gemfile

@@ -1,7 +0,0 @@
-source 'https://rubygems.org'
-
-gemspec
-
-group :test do
-  gem 'active_model_serializers', '~> 0.8.0'
-end

data/config.ru

@@ -1,7 +0,0 @@
-require 'rubygems'
-require 'bundler'
-
-Bundler.require :default, :development
-
-Combustion.initialize!
-run Combustion::Application

data/lib/generators/token_authenticate_me/controllers/templates/password_reset.rb

@@ -1,6 +0,0 @@
-require 'token_authenticate_me/controllers/password_resetable'
-
-class Api::PasswordResetsController < ApplicationController
-  include TokenAuthenticateMe::Controllers::PasswordResetable
-
-end

data/lib/generators/token_authenticate_me/controllers/templates/sessions.rb

@@ -1,6 +0,0 @@
-require 'token_authenticate_me/controllers/sessionable'
-
-class Api::SessionsController < ApplicationController
-  include TokenAuthenticateMe::Controllers::Sessionable
-
-end

data/lib/generators/token_authenticate_me/controllers/templates/users.rb

@@ -1,8 +0,0 @@
-require 'token_authenticate_me/controllers/token_authenticateable'
-
-class Api::V1::UsersController < ApplicationController
-  include ApiMe
-  include TokenAuthenticateMe::Controllers::TokenAuthenticateable
-
-  skip_before_action :authenticate, only: [:create]
-end

data/lib/generators/token_authenticate_me/models/templates/authentication_migration.rb

@@ -1,20 +0,0 @@
-class CreateUsers < ActiveRecord::Migration
-  def up
-    create_table :users do |t|
-      t.string :username,  null: false
-      t.string :email, null: false
-      t.string :password_digest, null: false
-      t.string :reset_password_token
-      t.datetime :reset_password_token_exp
-      t.timestamps
-    end
-
-    add_index :users, :email,                unique: true
-    add_index :users, :username,             unique: true
-    add_index :users, :reset_password_token, unique: true
-  end
-
-  def down
-    drop_table :users
-  end
-end

data/lib/generators/token_authenticate_me/models/templates/authentication_model.rb

@@ -1,11 +0,0 @@
-require 'token_authenticate_me/models/authenticatable'
-
-class User < ActiveRecord::Base
-  include TokenAuthenticateMe::Models::Authenticatable
-
-  has_many :<%= session_model_plural_name %>
-
-  def as_json(options=nil)
-    { <%= authenticate_model_singular_name %>: super(options) }
-  end
-end

data/lib/generators/token_authenticate_me/models/templates/session_migration.rb

@@ -1,17 +0,0 @@
-class CreateSessions < ActiveRecord::Migration
-  def up
-    create_table :sessions do |t|
-      t.string   :key,        null: false
-      t.datetime :expiration
-      t.integer  :user_id
-
-      t.timestamps
-    end
-
-    add_index :sessions, :key, unique: true
-  end
-
-  def down
-    drop_table :sessions
-  end
-end

data/lib/generators/token_authenticate_me/models/templates/session_model.rb

@@ -1,12 +0,0 @@
-require 'token_authenticate_me/models/sessionable'
-
-class Session < ActiveRecord::Base
-  include TokenAuthenticateMe::Models::Sessionable
-
-  belongs_to :<%= authenticate_model_singular_name %>
-
-  def as_json(options={})
-    { <%= session_model_singular_name %>: super({ include: :<%= authenticate_model_singular_name %> }.merge(options)) }
-  end
-
-end

data/lib/token_authenticate_me/controllers/password_resetable.rb

@@ -1,95 +0,0 @@
-require 'active_support/concern'
-
-require 'token_authenticate_me/controllers/token_authenticateable'
-
-module TokenAuthenticateMe
-  module Controllers
-    module PasswordResetable
-      extend ActiveSupport::Concern
-
-      included do
-        include TokenAuthenticateMe::Controllers::TokenAuthenticateable
-
-        skip_before_action :authenticate, only: [:create, :update]
-        before_action :validate_reset_token, only: [:update]
-
-        # Send reset token to user with e-mail address
-        def create
-          @user = User.find_by_email(params[:email])
-
-          if @user
-            send_valid_reset_email(@user)
-          else
-            send_invalid_reset_email(params[:email])
-          end
-
-          render status: 204, nothing: true
-        end
-
-        # Allow user to reset password when the token is valid
-        # and not expired
-        def update
-          @user.update!(
-            password: params[:password],
-            password_confirmation: params[:password_confirmation],
-            reset_password_token: nil,
-            reset_password_token_exp: nil
-          )
-
-          render status: 204, nothing: true
-        rescue ActiveRecord::RecordInvalid => e
-          handle_errors(e)
-        end
-
-        private
-
-        def send_valid_reset_email(user)
-          user.create_reset_token!
-
-          TokenAuthenticateMeMailer.valid_user_reset_password_email(
-            request.base_url,
-            user
-          ).deliver
-        end
-
-        def send_invalid_reset_email(email)
-          TokenAuthenticateMeMailer.invalid_user_reset_password_email(
-            request.base_url,
-            email
-          ).deliver
-        end
-
-        def session_params
-          params.permit(:password, :password_confirmation)
-        end
-
-        def render_errors(errors, status = 422)
-          render(json: { errors: errors }, status: status)
-        end
-
-        def handle_errors(e)
-          render_errors(e.record.errors.messages)
-        end
-
-        def validate_reset_token
-          valid_reset_token? || render_not_found
-        end
-
-        def render_not_found
-          render status: 404, nothing: true
-        end
-
-        def valid_reset_token?
-          # Check for
-          # https://github.com/rails/rails/commit/e8572cf2f94872d81e7145da31d55c6e1b074247
-          # security issue when config.action_dispatch.perform_deep_munge = false is set
-          # which is common for JSON APIs
-          return false if params[:id].class == Array || params[:id].nil?
-
-          @user = User.find_by_reset_password_token(params[:id])
-          @user && @user.reset_password_token_exp > DateTime.now
-        end
-      end
-    end
-  end
-end

data/lib/token_authenticate_me/controllers/sessionable.rb

@@ -1,53 +0,0 @@
-require 'active_support/concern'
-
-require 'token_authenticate_me/controllers/token_authenticateable'
-
-module TokenAuthenticateMe
-  module Controllers
-    module Sessionable
-      extend ActiveSupport::Concern
-
-      include TokenAuthenticateMe::Controllers::TokenAuthenticateable
-
-      included do
-        skip_before_action :authenticate, only: [:create]
-        after_action :cleanup_sessions, only: [:destroy]
-
-        def create
-          resource = User.where('username=? OR email=?', params[:username], params[:username]).first
-          if resource && resource.authenticate(params[:password])
-            @session = Session.create(user_id: resource.id)
-            render json: @session, status: 201
-          else
-            render json: { message: 'Bad credentials' }, status: 401
-          end
-        end
-
-        def show
-          @session = authenticate_token
-          render json: @session
-        end
-
-        def destroy
-          authenticate_token.destroy
-
-          render status: 204, nothing: true
-        rescue
-          render_unauthorized
-        end
-
-        private
-
-        def session_params
-          params.permit(:username, :email, :password)
-        end
-
-        def cleanup_sessions
-          ApiSession.where('expiration < ?', DateTime.now).delete_all
-        rescue
-          Rails.logger.warn 'Error cleaning up old authentication sessions'
-        end
-      end
-    end
-  end
-end

data/lib/token_authenticate_me/controllers/token_authenticateable.rb

@@ -1,52 +0,0 @@
-require 'active_support/concern'
-
-module TokenAuthenticateMe
-  module Controllers
-    module TokenAuthenticateable
-      extend ActiveSupport::Concern
-
-      included do
-        before_action :authenticate
-      end
-
-      protected
-
-      def authenticate
-        authenticate_token || render_unauthorized
-      end
-
-      def current_user
-        if authenticate_token
-          @current_user ||= User.find_by_id(authenticate_token.user_id)
-        else
-          nil
-        end
-      end
-
-      def authenticate_token
-        @session ||= (
-          authenticate_with_http_token(&method(:token_handler)) || authenticate_with_params
-        )
-      end
-
-      def authenticate_with_params
-        token = params[:authentication_token]
-        token_handler(token, {})
-      end
-
-      def render_unauthorized
-        headers['WWW-Authenticate'] = 'Token realm="Application"'
-        render json: 'Bad credentials', status: 401
-      end
-
-      def token_handler(token, _options)
-        session = Session.find_by_key(token)
-        if session && session.expiration > DateTime.now
-          session
-        else
-          false
-        end
-      end
-    end
-  end
-end

data/lib/token_authenticate_me/models/authenticatable.rb

@@ -1,93 +0,0 @@
-require 'active_support/concern'
-
-module TokenAuthenticateMe
-  module Models
-    module Authenticatable
-      extend ActiveSupport::Concern
-
-      included do
-        has_secure_password validations: false
-        attr_accessor :current_password
-
-        validates(
-          :email,
-          presence: true,
-          uniqueness: { case_sensitive: false },
-          format: {
-            with: /\A([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})\z/i,
-            message: 'invalid e-mail address'
-          }
-        )
-
-        validates(
-          :username,
-          format: { with: /\A[a-zA-Z0-9]+\Z/ },
-          presence: true,
-          uniqueness: { case_sensitive: false }
-        )
-
-        validates(
-          :password,
-          presence: true,
-          length: { in: 8..72 },
-          confirmation: true,
-          if: :password_required?
-        )
-
-        validate(
-          :current_password_correct,
-          if: :current_password_required?
-        )
-
-        def attributes
-          {
-            'id' => id,
-            'username' => username,
-            'email' => email,
-            'created_at' => created_at,
-            'updated_at' => updated_at
-          }
-        end
-
-        def create_reset_token!
-          # rubocop:disable Lint/Loop
-          begin
-            self.reset_password_token = SecureRandom.hex
-          end while self.class.exists?(reset_password_token: reset_password_token)
-
-          self.reset_password_token_exp = password_expiration_hours.hours.from_now
-          self.save!
-        end
-
-        def password_expiration_hours
-          8
-        end
-
-        def password=(unencrypted_password)
-          super(unencrypted_password) unless unencrypted_password.blank? && !password_required?
-        end
-
-        def current_password_correct
-          errors.add(:current_password, 'is required to change email and/or password') if current_password.blank? # rubocop:disable Metrics/LineLength
-          errors.add(:current_password, 'is incorrect') unless authenticate(current_password)
-        end
-
-        def current_password_required?
-          !new_record? && (email_changed? || attempting_to_change_password?) && !password_resetting?
-        end
-
-        def password_resetting?
-          reset_password_token_changed? && reset_password_token_exp_changed?
-        end
-
-        def password_required?
-          attempting_to_change_password? || new_record?
-        end
-
-        def attempting_to_change_password?
-          (!password.blank? || !password_confirmation.blank?) && password_digest_changed?
-        end
-      end
-    end
-  end
-end

data/lib/token_authenticate_me/models/sessionable.rb

@@ -1,36 +0,0 @@
-require 'active_support/concern'
-
-module TokenAuthenticateMe
-  module Models
-    module Sessionable
-      extend ActiveSupport::Concern
-
-      included do
-        before_create :generate_unique_key
-
-        def attributes
-          {
-            'key' => key,
-            'expiration' => expiration,
-            'created_at' => created_at,
-            'updated_at' => updated_at
-          }
-        end
-
-        private
-
-        def generate_unique_key
-          begin
-            self.key = SecureRandom.hex
-          end while self.class.exists?(key: key) # rubocop:disable Lint/Loop
-
-          self.expiration = expiration_hours.hours.from_now
-        end
-
-        def expiration_hours
-          24
-        end
-      end
-    end
-  end
-end