visa 0.0.2 → 0.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f2af2c06bc21beec4d5480f0a38e1a117d0e50a7
-  data.tar.gz: 433dbff707b3de766c194b719548ef204fa5a9d5
+  metadata.gz: e68dd910bddff0bc749609a542200dd7e811007a
+  data.tar.gz: 25f694e143383044baf30b1b68c9ef55a94007ca
 SHA512:
-  metadata.gz: 520a808fc5dc34b4e6e59f48d2dfc3c54be7de21c510b43c0c1c7c012e4c6a24332126453822d8ac9ea987ed52127cd101a1f278399bc45b73068de2c26dcc65
-  data.tar.gz: ea0aa2b9f2a0ff6b71b519df3f32fb611281c306c51bb3d96eb165ec08358f811dd70e157077de42523bd53507956cae55518b7069644bc4e8764d4723ab36c8
+  metadata.gz: a8ad463af5b6a142d4ca8920a62b172972de61e80538361aa8474cf3315f48a7b6869069db2b72ea7e7b93217092d2402b52220cc7ac031a2c96a1cba6544ea9
+  data.tar.gz: 860c20cb5ef89a82b25c1a4da2dfc060e30896ecdd83dd6e52169afdf4bf418d6c36851006ec6fe3afa6c81256a4686cffc04b1e632b9fb06f86abde79cc239a

data/.gitignore

@@ -4,6 +4,7 @@
 /_yardoc/
 /coverage/
 /doc/
+/gemfiles/*.lock
 /pkg/
 /spec/reports/
 /tmp/

data/.travis.yml

@@ -2,4 +2,9 @@ language: ruby
 script: bundle exec rspec spec
 cache: bundler
 rvm:
-  - 2.2
+  - 2.3.1
+gemfile:
+  - gemfiles/4.0.gemfile
+  - gemfiles/4.1.gemfile
+  - gemfiles/4.2.gemfile
+  - gemfiles/5.0.gemfile

data/Appraisals

@@ -0,0 +1,15 @@
+appraise "4.0" do
+  gem "rails", "4.0.13"
+end
+
+appraise "4.1" do
+  gem "rails", "4.1.16"
+end
+
+appraise "4.2" do
+  gem "rails", "4.2.7.1"
+end
+
+appraise "5.0" do
+  gem "rails", "5.0.0.1"
+end

data/README.md

@@ -7,12 +7,72 @@ Multi-token authentication for Rails apps. Built with Devise in mind, but can be
 Something like the following should go in your Gemfile:
 
 ```ruby
-gem 'visa', '~> 0.0.2'
+gem 'visa', '~> 0.0.3'
 ```
 
 ## Usage
 
-TODO: Write usage instructions here
+Visa doesn't try to do too much. You're expected to provide your own controllers or other Rack API endpoints that handle new sessions, and then check that session is active in the rest of your endpoints/controllers.
+
+The authenticated token details are per-session, and stored separately to Devise and other models.
+
+### Setup
+
+First, you'll want to import Visa's migrations for the `Visa::Token` model:
+
+```
+rake visa:install:migrations
+```
+
+Visa, like Devise, can be configured to have varying encryption costs. The default is 10, but you'll probably want it to be just 1 for your test environment. Thus, the following should go in an initialiser:
+
+```ruby
+Visa.encryption_cost = Rails.env.test? ? 1 : 10
+```
+
+### Signing In
+
+Your own code will manage taking email and password parameters and confirming that they're valid.
+
+If they _are_ valid, then you want to create a new `Visa::Token`, and return the access token via JSON or a HTTP header or whatever you like:
+
+```ruby
+visa_token   = Visa::Token.create :tokenable => authenticated_user
+access_token = "#{visa_token.client_id}#{visa_token.secret}"
+```
+
+If they're not, best to return a 403 and a corresponding error message.
+
+### Authenticating
+
+Each authenticated request should use the generated access token, sent through either using a request parameter `access_token`, or a HTTP header `HTTP_AUTHENTICATION`. You can customise the name of the latter in your initialiser via `Visa.request_header`.
+
+Then, in the endpoints/controllers where you're confirming if requests are authenticated:
+
+```ruby
+# Pass in the Rack environment. In Rails, this is request.env:
+visa_request = Visa::Request.new request.env
+
+# Confirm the request is valid (the equivalent of Devise's user_signed_in?):
+visa_request.valid?
+
+# Access the authenticated user (the equivalent of Devise's current_user):
+visa_request.tokenable
+```
+
+### Signing Out
+
+To mark credentials as no longer valid, you can call `invalidate` on the `Visa::Request` instance:
+
+```ruby
+visa_request.invalidate
+```
+
+## Wishlist
+
+It'd be nice to have the token be different on each request, though there are issues here with keeping old token values valid for a small window of time to allow for request lag.
+
+And of course, you should be using HTTPS across all requests to ensure the tokens and other data passed around are as secure as possible.
 
 ## Contributing
 

data/gemfiles/4.0.gemfile

@@ -0,0 +1,7 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rails", "4.0.13"
+
+gemspec :path => "../"

data/gemfiles/4.1.gemfile

@@ -0,0 +1,7 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rails", "4.1.16"
+
+gemspec :path => "../"

data/gemfiles/4.2.gemfile

@@ -0,0 +1,7 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rails", "4.2.7.1"
+
+gemspec :path => "../"

data/gemfiles/5.0.gemfile

@@ -0,0 +1,7 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rails", "5.0.0.1"
+
+gemspec :path => "../"

data/spec/internal/app/controllers/application_controller.rb

@@ -5,7 +5,7 @@ class ApplicationController < ActionController::Base
     if user_signed_in?
       visa_request.touch
     else
-      render text: 'Unauthorised', status: 401
+      render_plain_text 'Unauthorised', status: 401
     end
   end
 
@@ -13,6 +13,14 @@ class ApplicationController < ActionController::Base
     visa_request.tokenable
   end
 
+  def render_plain_text(text, options = {})
+    if Rails::VERSION::MAJOR == 4
+      render options.merge(text: text)
+    else
+      render options.merge(plain: text)
+    end
+  end
+
   def visa_request
     @visa_request ||= Visa::Request.new request.env
   end

data/spec/internal/app/controllers/home_controller.rb

@@ -1,7 +1,7 @@
 class HomeController < ApplicationController
-  before_filter :authenticate_user!
+  before_action :authenticate_user!
 
   def index
-    render text: 'OK'
+    render_plain_text 'OK'
   end
 end

data/spec/requests/requests_spec.rb

@@ -3,14 +3,22 @@ require 'spec_helper'
 RSpec.describe 'Request integration', type: :request do
   let(:token) { Visa::Token.create tokenable: User.create }
 
+  def get_root_with_token(token)
+    if Rails::VERSION::MAJOR == 4
+      get '/', access_token: token
+    else
+      get '/', params: {access_token: token}
+    end
+  end
+
   it 'accepts valid tokens' do
-    get '/', access_token: "#{token.client_id}#{token.secret}"
+    get_root_with_token "#{token.client_id}#{token.secret}"
 
     expect(response.status).to eq(200)
   end
 
   it 'returns 401 when the token is invalid' do
-    get '/', access_token: "#{token.client_id}this-is-invalid"
+    get_root_with_token "#{token.client_id}this-is-invalid"
 
     expect(response.status).to eq(401)
   end
@@ -18,13 +26,13 @@ RSpec.describe 'Request integration', type: :request do
   it 'returns 401 when the token has not been used in two weeks' do
     token.update_column :last_requested_at, 15.days.ago
 
-    get '/', access_token: "#{token.client_id}#{token.secret}"
+    get_root_with_token "#{token.client_id}#{token.secret}"
 
     expect(response.status).to eq(401)
   end
 
   it 'updates the last_requested_at column' do
-    get '/', access_token: "#{token.client_id}#{token.secret}"
+    get_root_with_token "#{token.client_id}#{token.secret}"
 
     token.reload
 

data/visa.gemspec

@@ -1,7 +1,7 @@
 # coding: utf-8
 Gem::Specification.new do |spec|
   spec.name          = 'visa'
-  spec.version       = '0.0.2'
+  spec.version       = '0.0.3'
   spec.authors       = ['Pat Allan']
   spec.email         = ['pat@freelancing-gods.com']
   spec.summary       = %q{Multi-token authentication for Rails apps.}
@@ -16,9 +16,10 @@ Gem::Specification.new do |spec|
 
   spec.add_runtime_dependency     'bcrypt'
   spec.add_runtime_dependency     'rack'
-  spec.add_runtime_dependency     'rails', '~> 4.0'
+  spec.add_runtime_dependency     'rails', '>= 4.0'
 
-  spec.add_development_dependency 'combustion',  '0.5.1'
+  spec.add_development_dependency 'appraisal',   '~> 2.1.0'
+  spec.add_development_dependency 'combustion',  '0.5.5'
   spec.add_development_dependency 'rspec-rails', '~> 3.1'
   spec.add_development_dependency 'sqlite3',     '~> 1.3'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: visa
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.3
 platform: ruby
 authors:
 - Pat Allan
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-01-22 00:00:00.000000000 Z
+date: 2016-11-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bcrypt
@@ -42,30 +42,44 @@ dependencies:
   name: rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '4.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '4.0'
+- !ruby/object:Gem::Dependency
+  name: appraisal
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.1.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.1.0
 - !ruby/object:Gem::Dependency
   name: combustion
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.5.1
+        version: 0.5.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.5.1
+        version: 0.5.5
 - !ruby/object:Gem::Dependency
   name: rspec-rails
   requirement: !ruby/object:Gem::Requirement
@@ -103,6 +117,7 @@ extra_rdoc_files: []
 files:
 - ".gitignore"
 - ".travis.yml"
+- Appraisals
 - Gemfile
 - LICENSE.txt
 - README.md
@@ -111,6 +126,10 @@ files:
 - config.ru
 - db/migrate/1_create_tokens.rb
 - db/migrate/2_add_voided_at.rb
+- gemfiles/4.0.gemfile
+- gemfiles/4.1.gemfile
+- gemfiles/4.2.gemfile
+- gemfiles/5.0.gemfile
 - lib/visa.rb
 - lib/visa/engine.rb
 - lib/visa/request.rb
@@ -147,7 +166,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.2
+rubygems_version: 2.5.1
 signing_key: 
 specification_version: 4
 summary: Multi-token authentication for Rails apps.