Class: ApiEngineBase::ApplicationController

Inherits:
ActionController::API
  • Object
show all
Defined in:
app/controllers/api_engine_base/application_controller.rb

Constant Summary collapse

AUTHENTICATION_HEADER = 
"Authentication"
AUTHENTICATION_EXPIRE_HEADER = 
"X-Authentication-Expire"
AUTHENTICATION_WITH_RESET = 
"X-Authentication-Reset"

Instance Method Summary collapse

Instance Method Details

#authenticate_user!(bypass_email_validation: false) ⇒ Object

Authenticate user via the passed in header AUTHENTICATION_HEADER=“Bearer: value”



18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
 
# File 'app/controllers/api_engine_base/application_controller.rb', line 18

def authenticate_user!(bypass_email_validation: false)
  raw_token = request.headers[AUTHENTICATION_HEADER]
  if raw_token.nil?
    status = 401
    schema = ApiEngineBase::Schema::Error::Base.new(status:, message: "Bearer token missing")
    render(json: schema.to_h, status:)
    return false
  end

  token = raw_token.split("Bearer:")[1].strip
  with_reset = safe_boolean(value: request.headers[AUTHENTICATION_WITH_RESET])
  result = ApiEngineBase::Jwt::AuthenticateUser.(token:, bypass_email_validation:, with_reset:)
  if result.success?
    @current_user = result.user
    response.set_header(AUTHENTICATION_EXPIRE_HEADER, result.expires_at)
    if with_reset
      response.set_header(AUTHENTICATION_WITH_RESET, result.generated_token)
    end
    true
  else
    status = 401
    schema = ApiEngineBase::Schema::Error::Base.new(status:, message: result.msg)
    render(json: schema.to_h, status:)
    # Must return false so callbacks know to halt propagation
    false
  end
end

#authenticate_user_without_email_verification! ⇒ Object

Authenticate user via the passed in header without validating email



48
49
50
 
# File 'app/controllers/api_engine_base/application_controller.rb', line 48

def authenticate_user_without_email_verification!
  authenticate_user!(bypass_email_validation: true)
end

#authorize_user! ⇒ Object

After Authenticating user, see if the user needs authorization on the route



54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
 
# File 'app/controllers/api_engine_base/application_controller.rb', line 54

def authorize_user!
  if current_user.nil?
    Rails.logger.error { "Current User is not defined. This means that authenticate_user! was not called" }
    status = 401
    schema = ApiEngineBase::Schema::Error::Base.new(status:, message: "Bearer token missing")
    render(json: schema.to_h, status:)
    return false
  end
  result = ApiEngineBase::Authorize::Validate.(user: current_user, controller: self.class, method: params[:action])

  if result.success?
    @current_user = result.user
    true
  else
    # Current user is not authorized for the current Controller#action
    status = 403
    schema = ApiEngineBase::Schema::Error::Base.new(status:, message: result.msg)
    render(json: schema.to_h, status:)
    # Must return false so callbacks know to halt propagation
    false
  end
end

#current_user ⇒ Object 



77
78
79
 
# File 'app/controllers/api_engine_base/application_controller.rb', line 77

def current_user
  @current_user ||= nil
end

#safe_boolean(value:) ⇒ Object 



9
10
11
12
13
 
# File 'app/controllers/api_engine_base/application_controller.rb', line 9

def safe_boolean(value:)
  return nil unless [true, false, "true", "false", "0", "1", 0, 1].include?(value)

  ActiveModel::Type::Boolean.new.cast(value)
end