FFS-2403: Token-based authentication #431
Conversation
app/app/models/api_access_token.rb
Outdated
| has_secure_password :access_token, validations: false | ||
|
|
||
| before_create do | ||
| self.access_token = SecureRandom.urlsafe_base64 | ||
| end |
There was a problem hiding this comment.
@tdooner I'm not sure if this is right... but seems okay, I guess. has_secure_password makes available the authenticate_*** method and that's what I used to validate.
app/app/models/user.rb
Outdated
| def self.find_by_valid_access_token(token) | ||
| ApiAccessToken.all.find { |t| t.authenticate_access_token(token) }&.user | ||
| end |
There was a problem hiding this comment.
I'm not sure what others think but this method was a bit hard to name because it both finds a user by a given token through validating that token against all tokens. Which seems slow. I'm not sure how else token lookup is supposed to work.
There was a problem hiding this comment.
Like maybe you could do something fancier in SQL, i don't know.
| @cbv_flow_invitation = CbvInvitationService.new(event_logger).invite(cbv_flow_invitation_params, @current_user) | ||
|
|
There was a problem hiding this comment.
I wonder if the current_user helper is possible here... but that might hook into whatever Devise has got going on and I'm not sure if that's a can of worms or not...
| before do | ||
| request.headers["Authorization"] = "Bearer #{api_access_token.access_token}" | ||
| end |
There was a problem hiding this comment.
I wish there was a nicer helper for this kind of thing
| FactoryBot.define do | ||
| factory :api_access_token do | ||
| end | ||
| end |
There was a problem hiding this comment.
Feel like I could just put this into the User factor to generate tokens as part of a trait
allthesignals
changed the title
# Conflicts: # app/db/schema.rb # docs/app/rendered/database-schema.pdf
|
Created those env variables. I'll go ahead and merge. |
|
Ugh I misnamed something, fixing |
Ticket
Resolves FFS-2403.
Changes
Adds API Access Tokens, associates with a User, provides some methods to create and find/validate a user by token. Protects the invitations api with token auth.
Context for reviewers
We switched to a different method of encrypting the token so that we could search for the token itself.
Acceptance testing
:alert: Deploy block! @ffs-eng I just merged PR [#123] and will be doing acceptance testing in demo - please don't deploy until I'm finished!)