3b32b29937
* Update specs for doorkeeper test * Add bang * Create #authenticate * Create /api/articles/ endpoint * Update specs * Update me.json.jbuilder * Fix typo and spacing * Support pagination for #me * Update #authenticate! to support cookies * Make per_page a param * Disable method-complexity check * Enable refresh_token * Create /api/users/me endpoint
82 lines
2.4 KiB
Ruby
82 lines
2.4 KiB
Ruby
class Api::V0::ApiController < ApplicationController
|
|
def cors_set_access_control_headers
|
|
headers["Access-Control-Allow-Origin"] = "*"
|
|
headers["Access-Control-Allow-Methods"] = "POST, GET, PUT, DELETE, OPTIONS"
|
|
headers["Access-Control-Allow-Headers"] = "Origin, Content-Type, Accept, Authorization, Token"
|
|
headers["Access-Control-Max-Age"] = "1728000"
|
|
end
|
|
|
|
def cors_preflight_check
|
|
return unless request.method == "OPTIONS"
|
|
|
|
headers["Access-Control-Allow-Origin"] = "*"
|
|
headers["Access-Control-Allow-Methods"] = "POST, GET, PUT, DELETE, OPTIONS"
|
|
headers["Access-Control-Allow-Headers"] = "X-Requested-With, X-Prototype-Version, Token"
|
|
headers["Access-Control-Max-Age"] = "1728000"
|
|
|
|
render text: "", content_type: "text/plain"
|
|
end
|
|
|
|
rescue_from ActionController::ParameterMissing do |exc|
|
|
error_unprocessable_entity(exc.message)
|
|
end
|
|
|
|
rescue_from ActiveRecord::RecordInvalid do |exc|
|
|
error_unprocessable_entity(exc.message)
|
|
end
|
|
|
|
rescue_from ActiveRecord::RecordNotFound do |_exc|
|
|
error_not_found
|
|
end
|
|
|
|
protected
|
|
|
|
def error_unprocessable_entity(message)
|
|
render json: { error: message, status: 422 }, status: :unprocessable_entity
|
|
end
|
|
|
|
def error_unauthorized
|
|
render json: { error: "unauthorized", status: 401 }, status: :unauthorized
|
|
end
|
|
|
|
def error_not_found
|
|
render json: { error: "not found", status: 404 }, status: :not_found
|
|
end
|
|
|
|
def authenticate!
|
|
if doorkeeper_token
|
|
@user = User.find(doorkeeper_token.resource_owner_id)
|
|
return error_unauthorized unless @user
|
|
elsif request.headers["api-key"]
|
|
authenticate_with_api_key!
|
|
elsif current_user
|
|
@user = current_user
|
|
else
|
|
error_unauthorized
|
|
end
|
|
end
|
|
|
|
def authenticate_with_api_key_or_current_user!
|
|
if request.headers["api-key"]
|
|
authenticate_with_api_key!
|
|
else
|
|
@user = current_user
|
|
end
|
|
end
|
|
|
|
def authenticate_with_api_key!
|
|
api_key = request.headers["api-key"]
|
|
return error_unauthorized unless api_key
|
|
|
|
api_secret = ApiSecret.includes(:user).find_by(secret: api_key)
|
|
return error_unauthorized unless api_secret
|
|
|
|
# guard against timing attacks
|
|
# see <https://www.slideshare.net/NickMalcolm/timing-attacks-and-ruby-on-rails>
|
|
if ActiveSupport::SecurityUtils.secure_compare(api_secret.secret, api_key)
|
|
@user = api_secret.user
|
|
else
|
|
error_unauthorized
|
|
end
|
|
end
|
|
end
|