a40efc6bbd
* Refactoring questions asked of user In this pull request, I'm extracting and normalizing role-based questions asked of the user. Prior to this commit, our codebase has asked two very similar questions of our user model: - `user.has_role?(:admin)` - `user.admin?` In asking `has_role?(:admin)` we are relying on implementation details of the rolify gem. In addition, the `has_role?` question asked throughout controllers or views means that it's harder to create hieararchies of permissions. In favoring `user.admin?` as our question, we can use that indirection as an opportunity to discuss and decide "Should someone with the `:super_admin` role be `user.admin? == true`?" The details of this commit is to do three primary things: 1. Ask the `has_role?` questions in "one place" in the code (e.g. the `Authorizer` module) 2. Extract the role based questions that are on the `User` model and provde backwards compatable delegation. 3. Structure the code so that it's harder to accidentally call `user.has_role?` (e.g., make `User#has_role?` and `User#has_any_role?` private). This is related to #15624 and the updates are informed by discussion in PR #15691. This commit supplants #15691. * Refactoring the liquid tag policy tests * Fixing typo * Bump for travis
81 lines
2.3 KiB
Ruby
81 lines
2.3 KiB
Ruby
module Api
|
|
module V0
|
|
class ApiController < ApplicationController
|
|
protect_from_forgery with: :exception, prepend: true
|
|
|
|
include ValidRequest
|
|
|
|
respond_to :json
|
|
|
|
rescue_from ActionController::ParameterMissing do |exc|
|
|
error_unprocessable_entity(exc.message)
|
|
end
|
|
|
|
rescue_from ActiveRecord::RecordInvalid do |exc|
|
|
error_unprocessable_entity(exc.message)
|
|
end
|
|
|
|
rescue_from ActiveRecord::RecordNotFound, with: :error_not_found
|
|
|
|
rescue_from Pundit::NotAuthorizedError, with: :error_unauthorized
|
|
|
|
protected
|
|
|
|
def error_unprocessable_entity(message)
|
|
render json: { error: message, status: 422 }, status: :unprocessable_entity
|
|
end
|
|
|
|
def error_unauthorized
|
|
render json: { error: "unauthorized", status: 401 }, status: :unauthorized
|
|
end
|
|
|
|
def error_not_found
|
|
render json: { error: "not found", status: 404 }, status: :not_found
|
|
end
|
|
|
|
def authenticate!
|
|
@user = authenticated_user
|
|
return error_unauthorized unless @user && !@user.suspended?
|
|
end
|
|
|
|
def authorize_super_admin
|
|
error_unauthorized unless @user.super_admin?
|
|
end
|
|
|
|
# Checks if the user is authenticated, sets @user to nil otherwise
|
|
def authenticate_with_api_key_or_current_user
|
|
@user = authenticate_with_api_key || current_user
|
|
end
|
|
|
|
# Checks if the user is authenticated, if so sets the variable @user
|
|
# Returns HTTP 401 Unauthorized otherwise
|
|
def authenticate_with_api_key_or_current_user!
|
|
@user = authenticate_with_api_key || current_user
|
|
error_unauthorized unless @user
|
|
end
|
|
|
|
private
|
|
|
|
def authenticate_with_api_key
|
|
api_key = request.headers["api-key"]
|
|
return unless api_key
|
|
|
|
api_secret = ApiSecret.includes(:user).find_by(secret: api_key)
|
|
return unless api_secret
|
|
|
|
# guard against timing attacks
|
|
# see <https://www.slideshare.net/NickMalcolm/timing-attacks-and-ruby-on-rails>
|
|
secure_secret = ActiveSupport::SecurityUtils.secure_compare(api_secret.secret, api_key)
|
|
return api_secret.user if secure_secret
|
|
end
|
|
|
|
def authenticated_user
|
|
if request.headers["api-key"]
|
|
authenticate_with_api_key
|
|
elsif current_user
|
|
current_user
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|