Class: DeviseTokenAuth::OmniauthCallbacksController

Inherits:
ApplicationController
  • Object
show all
Defined in:
app/controllers/devise_token_auth/omniauth_callbacks_controller.rb

Instance Method Summary collapse

Instance Method Details

#assert_is_devise_resource! ⇒ Object

ensure that this controller responds to :devise_controller? conditionals. this is used primarily for access to the parameter sanitizers.



144
145
146
 
# File 'app/controllers/devise_token_auth/omniauth_callbacks_controller.rb', line 144

def assert_is_devise_resource!
  true
end

#assign_provider_attrs(user, auth_hash) ⇒ Object

break out provider attribute assignment for easy method extension



75
76
77
78
79
80
81
82
 
# File 'app/controllers/devise_token_auth/omniauth_callbacks_controller.rb', line 75

def assign_provider_attrs(user, auth_hash)
  user.assign_attributes({
    nickname: auth_hash['info']['nickname'],
    name:     auth_hash['info']['name'],
    image:    auth_hash['info']['image'],
    email:    auth_hash['info']['email']
  })
end

#auth_hash ⇒ Object

this sesison value is set by the redirect_callbacks method. its purpose is to persist the omniauth auth hash value thru a redirect. the value must be destroyed immediatly after it is accessed by omniauth_success



137
138
139
140
 
# File 'app/controllers/devise_token_auth/omniauth_callbacks_controller.rb', line 137

def auth_hash
  @_auth_hash ||= session.delete('dta.omniauth.auth')
  @_auth_hash
end

#devise_mapping ⇒ Object

necessary for access to devise_parameter_sanitizers



149
150
151
152
153
154
155
 
# File 'app/controllers/devise_token_auth/omniauth_callbacks_controller.rb', line 149

def devise_mapping
  if omniauth_params
    Devise.mappings[omniauth_params['resource_class'].underscore.to_sym]
  else
    request.env['devise.mapping']
  end
end

#generate_url(url, params = {}) ⇒ Object 



157
158
159
160
161
162
163
164
165
166
167
168
169
 
# File 'app/controllers/devise_token_auth/omniauth_callbacks_controller.rb', line 157

def generate_url(url, params = {})
  auth_url = url

  # ensure that hash-bang is present BEFORE querystring for angularjs
  unless url.match(/#/)
    auth_url += '#'
  end

  # add query AFTER hash-bang
  auth_url += "?#{params.to_query}"

  return auth_url
end

#omniauth_failure ⇒ Object 



85
86
87
88
89
90
91
 
# File 'app/controllers/devise_token_auth/omniauth_callbacks_controller.rb', line 85

def omniauth_failure
  @error = params[:message]

  respond_to do |format|
    format.html { render :layout => "omniauth_response", :template => "devise_token_auth/omniauth_failure" }
  end
end

#omniauth_params ⇒ Object

this will be determined differently depending on the action that calls it. redirect_callbacks is called upon returning from successful omniauth authentication, and the target params live in an omniauth-specific request.env variable. this variable is then persisted thru the redirect using our own dta.omniauth.params session var. the omniauth_success method will access that session var and then destroy it immediately after use.



125
126
127
128
129
130
131
132
 
# File 'app/controllers/devise_token_auth/omniauth_callbacks_controller.rb', line 125

def omniauth_params
  if request.env['omniauth.params']
    request.env['omniauth.params']
  else
    @_omniauth_params ||= session.delete('dta.omniauth.params')
    @_omniauth_params
  end
end

#omniauth_success ⇒ Object 



21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
 
# File 'app/controllers/devise_token_auth/omniauth_callbacks_controller.rb', line 21

def omniauth_success
  # find or create user by provider and provider uid
  @resource = resource_class.where({
    uid:      auth_hash['uid'],
    provider: auth_hash['provider']
  }).first_or_initialize

  # create token info
  @client_id = SecureRandom.urlsafe_base64(nil, false)
  @token     = SecureRandom.urlsafe_base64(nil, false)
  @expiry    = (Time.now + DeviseTokenAuth.token_lifespan).to_i

  @auth_origin_url = generate_url(omniauth_params['auth_origin_url'], {
    token:     @token,
    client_id: @client_id,
    uid:       @resource.uid,
    expiry:    @expiry
  })

  # set crazy password for new oauth users. this is only used to prevent
  # access via email sign-in.
  unless @resource.id
    p = SecureRandom.urlsafe_base64(nil, false)
    @resource.password = p
    @resource.password_confirmation = p
  end

  @resource.tokens[@client_id] = {
    token: BCrypt::Password.create(@token),
    expiry: @expiry
  }

  # sync user info with provider, update/generate auth token
  assign_provider_attrs(@resource, auth_hash)

  # assign any additional (whitelisted) attributes
  extra_params = whitelisted_params
  @resource.assign_attributes(extra_params) if extra_params

  # don't send confirmation email!!!
  @resource.skip_confirmation!

  (:user, @resource, store: false, bypass: false)

  @resource.save!

  # render user info to javascript postMessage communication window
  respond_to do |format|
    format.html { render :layout => "omniauth_response", :template => "devise_token_auth/omniauth_success" }
  end
end

#redirect_callbacks ⇒ Object

intermediary route for successful omniauth authentication. omniauth does not support multiple models, so we must resort to this terrible hack.



8
9
10
11
12
13
14
15
16
17
18
19
 
# File 'app/controllers/devise_token_auth/omniauth_callbacks_controller.rb', line 8

def redirect_callbacks
  # derive target redirect route from 'resource_class' param, which was set
  # before authentication.
  devise_mapping = request.env['omniauth.params']['resource_class'].underscore.to_sym
  redirect_route = "#{Devise.mappings[devise_mapping].as_json["path_prefix"]}/#{params[:provider]}/callback"

  # preserve omniauth info for success route
  session['dta.omniauth.auth'] = request.env['omniauth.auth']
  session['dta.omniauth.params'] = request.env['omniauth.params']

  redirect_to redirect_route
end

#resource_class ⇒ Object

pull resource class from omniauth return



108
109
110
111
112
 
# File 'app/controllers/devise_token_auth/omniauth_callbacks_controller.rb', line 108

def resource_class
  if omniauth_params
    omniauth_params['resource_class'].constantize
  end
end

#resource_name ⇒ Object 



114
115
116
 
# File 'app/controllers/devise_token_auth/omniauth_callbacks_controller.rb', line 114

def resource_name
  resource_class
end

#whitelisted_params ⇒ Object

derive allowed params from the standard devise parameter sanitizer



95
96
97
98
99
100
101
102
103
104
105
 
# File 'app/controllers/devise_token_auth/omniauth_callbacks_controller.rb', line 95

def whitelisted_params
  whitelist = devise_parameter_sanitizer.for(:sign_up)

  whitelist.inject({}){|coll, key|
    param = omniauth_params[key.to_s]
    if param
      coll[key] = param
    end
    coll
  }
end