Module: DeviseTokenAuth::Concerns::User

Extended by:
ActiveSupport::Concern
Defined in:
app/models/devise_token_auth/concerns/user.rb

Instance Method Summary collapse

Instance Method Details

#build_auth_header(token, client_id = 'default') ⇒ Object 



84
85
86
87
88
89
90
91
 
# File 'app/models/devise_token_auth/concerns/user.rb', line 84

def build_auth_header(token, client_id='default')
  client_id ||= 'default'

  # client may use expiry to prevent validation request if expired
  expiry = self.tokens[client_id]['expiry']

  return "token=#{token} client=#{client_id} expiry=#{expiry} uid=#{self.uid}"
end

#build_auth_url(base_url, args) ⇒ Object 



94
95
96
97
98
99
 
# File 'app/models/devise_token_auth/concerns/user.rb', line 94

def build_auth_url(base_url, args)
  args[:uid]    = self.uid
  args[:expiry] = self.tokens[args[:client_id]]['expiry']

  generate_url(base_url, args)
end

#create_new_auth_token(client_id = nil) ⇒ Object

update user's auth token (should happen on each request)



60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
 
# File 'app/models/devise_token_auth/concerns/user.rb', line 60

def create_new_auth_token(client_id=nil)
  client_id  ||= SecureRandom.urlsafe_base64(nil, false)
  last_token ||= nil
  token        = SecureRandom.urlsafe_base64(nil, false)
  token_hash   = BCrypt::Password.create(token)
  expiry       = (Time.now + DeviseTokenAuth.token_lifespan).to_i

  if self.tokens[client_id] and self.tokens[client_id]['token']
    last_token = self.tokens[client_id]['token']
  end

  self.tokens[client_id] = {
    token:      token_hash,
    expiry:     expiry,
    last_token: last_token,
    updated_at: Time.now
 }

  self.save!

  return build_auth_header(token, client_id)
end

#extend_batch_buffer(token, client_id) ⇒ Object 



102
103
104
105
106
107
 
# File 'app/models/devise_token_auth/concerns/user.rb', line 102

def extend_batch_buffer(token, client_id)
  self.tokens[client_id]['updated_at'] = Time.now
  self.save!

  return build_auth_header(token, client_id)
end

#valid_token?(token, client_id = 'default') ⇒ Boolean

Returns:

  • (Boolean) 


25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
 
# File 'app/models/devise_token_auth/concerns/user.rb', line 25

def valid_token?(token, client_id='default')
  client_id ||= 'default'

  return false unless self.tokens[client_id]

  return true if (
    # ensure that expiry and token are set
    self.tokens[client_id]['expiry'] and
    self.tokens[client_id]['token'] and

    # ensure that the token was created within the last two weeks
    DateTime.strptime(self.tokens[client_id]['expiry'].to_s, '%s') > DeviseTokenAuth.token_lifespan.ago and

    # ensure that the token is valid
    BCrypt::Password.new(self.tokens[client_id]['token']) == token
  )

  return true if (
    # ensure that the last token and its creation time exist
    self.tokens[client_id]['updated_at'] and
    self.tokens[client_id]['last_token'] and

    # ensure that previous token falls within the batch buffer throttle time of the last request
    Time.parse(self.tokens[client_id]['updated_at']) > Time.now - DeviseTokenAuth.batch_request_buffer_throttle and

    # ensure that the token is valid
    BCrypt::Password.new(self.tokens[client_id]['last_token']) == token
  )

  # return false if none of the above conditions are met
  return false
end