Class: AtlasRb::Authentication

Inherits:
Object
  • Object
show all
Extended by:
FaradayHelper
Defined in:
lib/atlas_rb/authentication.rb

Overview

User-facing identity lookups against the Atlas API.

Unlike the resource classes, Authentication threads a real NUID into FaradayHelper#connection's second positional argument. On the relay-signing path that NUID is signed into the assertion sub; Atlas resolves the acting user and their group memberships from the proven sub.

No login round-trip happens here today; auth is assumed to be already provisioned out-of-band (a configured signing key, or ATLAS_JWT). The commented-out code in this file reflects an older flow where a /token endpoint exchanged an NUID for a session token.

Constant Summary

Constants included from FaradayHelper

FaradayHelper::ASSERTION_AUDIENCE, FaradayHelper::ASSERTION_ISSUER, FaradayHelper::ASSERTION_TTL, FaradayHelper::INSTRUMENTATION_EVENT

Class Method Summary collapse

Methods included from FaradayHelper

connection, multipart, read_body, read_raw, system_connection, with_file_part

Class Method Details

.groups(nuid) ⇒ Array<Hash>?

Fetch only the group memberships for an NUID.

Convenience wrapper around the same GET /user call as login; useful when authorization checks only need group names.

Examples:

AtlasRb::Authentication.groups("001234567")
# => [{ "id" => 7, "name" => "Library Staff" }, ...]

Parameters:

  • nuid (String) —

    the user's Northeastern University ID.

Returns:

  • (Array<Hash>, nil) —

    the "groups" array from the user record. nil when Atlas answers 404 — nothing is there to read, or, with a misconfigured ATLAS_URL, the route is not Atlas's at all.

Raises:

  • (AtlasRb::ResourceError) —

    on any non-2xx other than 404 / 410 (an auth or validation envelope, a 5xx, a proxy's 503), carrying Atlas's status and body so the failure is attributable at the boundary.



59
60
61
62
63
64
65
 
# File 'lib/atlas_rb/authentication.rb', line 59

def self.groups(nuid)
  # user_details = login(nuid)
  # token = user_details[:token] ...
  # TODO - need to update atlas login to give back name, id, and token upon logging in
  # result = JSON.parse(connection({ token: token }).post('/users/2/groups')&.body)["user"]["groups"]
  read_body(connection({}, nuid).get('/user')) { |body| AtlasRb::Mash.new(body)["groups"] }
end

.login(nuid, email: nil) ⇒ AtlasRb::Mash?

Look up the Atlas user record for an NUID.

A NUID can hold several accounts (a person's staff/student logins). Pass email: to act as — and read back — a specific one; it rides as a signed acct claim so GET /user resolves that account. Omit it and Atlas returns the person's preferred account.

Examples:

AtlasRb::Authentication.("001234567")
# => { "id" => 42, "name" => "Jane Doe", "groups" => [...] }

Parameters:

  • nuid (String) —

    the user's Northeastern University ID.

  • email (String, nil) (defaults to: nil) —

    optional account email to act as (the acct selector); nil resolves the preferred account.

Returns:

  • (AtlasRb::Mash, nil) —

    the user record returned by GET /user, including at minimum "id", "name", and "groups". nil when Atlas answers 404 — nothing is there to read, or, with a misconfigured ATLAS_URL, the route is not Atlas's at all.

Raises:

  • (AtlasRb::ResourceError) —

    on any non-2xx other than 404 / 410 (an auth or validation envelope, a 5xx, a proxy's 503), carrying Atlas's status and body so the failure is attributable at the boundary.



39
40
41
 
# File 'lib/atlas_rb/authentication.rb', line 39

def self.(nuid, email: nil)
  read_body(connection({}, nuid, account: email).get('/user')) { |body| AtlasRb::Mash.new(body) }
end