From d67e777ea835ed62dc38b518ace5f113aac5e675 Mon Sep 17 00:00:00 2001 From: Maciej Szlosarczyk Date: Wed, 18 Jul 2018 16:24:55 +0300 Subject: [PATCH 01/16] Create a Registrant auth controller --- .../api/v1/registrant/auth_controller.rb | 19 +++++++++++++++ config/application.rb | 2 +- config/routes.rb | 9 +++++++ .../registrant_api_authentication_test.rb | 24 +++++++++++++++++++ 4 files changed, 53 insertions(+), 1 deletion(-) create mode 100644 app/controllers/api/v1/registrant/auth_controller.rb create mode 100644 test/system/api/registrant/registrant_api_authentication_test.rb diff --git a/app/controllers/api/v1/registrant/auth_controller.rb b/app/controllers/api/v1/registrant/auth_controller.rb new file mode 100644 index 000000000..c137a1286 --- /dev/null +++ b/app/controllers/api/v1/registrant/auth_controller.rb @@ -0,0 +1,19 @@ +require 'rails5_api_controller_backport' + +module Api + module V1 + module Registrant + class AuthController < ActionController::API + def eid + login_params = set_eid_params + + render json: login_params + end + + def set_eid_params + params.permit(:ident, :first_name, :last_name, :country) + end + end + end + end +end diff --git a/config/application.rb b/config/application.rb index 400e72124..1420d3cd3 100644 --- a/config/application.rb +++ b/config/application.rb @@ -36,7 +36,7 @@ module DomainNameRegistry config.i18n.default_locale = :en config.paths.add File.join('app', 'api'), glob: File.join('**', '*.rb') - config.autoload_paths += Dir[Rails.root.join('app', 'api', '*')] + # config.autoload_paths += Dir[Rails.root.join('app', 'api', '*')] # Autoload all model subdirs config.autoload_paths += Dir[Rails.root.join('app', 'models', '**/')] diff --git a/config/routes.rb b/config/routes.rb index 8f50d5587..2bc965a0f 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -18,6 +18,15 @@ Rails.application.routes.draw do mount Repp::API => '/' + namespace :api do + namespace :v1 do + namespace :registrant do + post 'auth/eid', to: 'auth#eid' + post 'auth/username', to: 'auth#username' + end + end + end + # REGISTRAR ROUTES namespace :registrar do resource :dashboard diff --git a/test/system/api/registrant/registrant_api_authentication_test.rb b/test/system/api/registrant/registrant_api_authentication_test.rb new file mode 100644 index 000000000..5ecd7e08a --- /dev/null +++ b/test/system/api/registrant/registrant_api_authentication_test.rb @@ -0,0 +1,24 @@ +require 'test_helper' + +class RegistrantApiAuthenticationTest < ApplicationSystemTestCase + def setup + super + + end + + def teardown + super + + end + + def test_request_creates_user_when_one_does_not_exist + params = { + ident: "30110100103", + first_name: "Jan", + last_name: "Tamm", + country: "ee", + } + + post '/api/v1/registrant/auth/eid', params + end +end From 1c6b838b2bc5c6caa71068e63ef600a5d1836a12 Mon Sep 17 00:00:00 2001 From: Maciej Szlosarczyk Date: Thu, 19 Jul 2018 10:31:31 +0300 Subject: [PATCH 02/16] Add auth-token class --- .../api/v1/registrant/auth_controller.rb | 18 +++++++++++-- app/models/registrant_user.rb | 10 +++++++ lib/auth_token.rb | 26 +++++++++++++++++++ .../registrant_api_authentication_test.rb | 15 ++++++++--- test/test_helper.rb | 2 +- 5 files changed, 65 insertions(+), 6 deletions(-) create mode 100644 lib/auth_token.rb diff --git a/app/controllers/api/v1/registrant/auth_controller.rb b/app/controllers/api/v1/registrant/auth_controller.rb index c137a1286..36bf750a8 100644 --- a/app/controllers/api/v1/registrant/auth_controller.rb +++ b/app/controllers/api/v1/registrant/auth_controller.rb @@ -1,4 +1,5 @@ require 'rails5_api_controller_backport' +require 'auth_token' module Api module V1 @@ -7,11 +8,24 @@ module Api def eid login_params = set_eid_params - render json: login_params + user = RegistrantUser.find_or_create_by_api_data(login_params) + + unless user.valid? + render json: user.errors, status: :bad_request + else + token = create_token(user) + render json: token + end end def set_eid_params - params.permit(:ident, :first_name, :last_name, :country) + params.permit(:ident, :first_name, :last_name) + end + + def create_token(user) + token = AuthToken.new + hash = token.generate_token(user) + hash end end end diff --git a/app/models/registrant_user.rb b/app/models/registrant_user.rb index 12cae0d82..8f742a361 100644 --- a/app/models/registrant_user.rb +++ b/app/models/registrant_user.rb @@ -52,6 +52,16 @@ class RegistrantUser < User u end + def find_or_create_by_api_data(api_data = {}) + estonian_ident = "EE-#{api_data[:ident]}" + + user = find_or_create_by(registrant_ident: estonian_ident) + user.username = "#{api_data[:first_name]}, #{api_data[:last_name]}" + user.save + + user + end + def find_or_create_by_mid_data(response) u = where(registrant_ident: "#{response.user_country}-#{response.user_id_code}").first_or_create u.username = "#{response.user_givenname} #{response.user_surname}" diff --git a/lib/auth_token.rb b/lib/auth_token.rb new file mode 100644 index 000000000..5313d603d --- /dev/null +++ b/lib/auth_token.rb @@ -0,0 +1,26 @@ +class AuthToken + def initialize; end + + def generate_token(user, secret = Rails.application.config.secret_key_base) + cipher = OpenSSL::Cipher::AES.new(256, :CBC) + expires_at = (Time.now.utc + 2.hours).strftime("%F %T %Z") + + data = { + username: user.username, + expires_at: expires_at + } + + hashable = data.to_json + + cipher.encrypt + cipher.key = secret + encrypted = cipher.update(hashable) + cipher.final + base64_encoded = Base64.encode64(encrypted) + + { + access_token: base64_encoded, + expires_at: expires_at, + type: "Bearer" + } + end +end diff --git a/test/system/api/registrant/registrant_api_authentication_test.rb b/test/system/api/registrant/registrant_api_authentication_test.rb index 5ecd7e08a..6789b3d5d 100644 --- a/test/system/api/registrant/registrant_api_authentication_test.rb +++ b/test/system/api/registrant/registrant_api_authentication_test.rb @@ -4,6 +4,8 @@ class RegistrantApiAuthenticationTest < ApplicationSystemTestCase def setup super + @user_hash = {ident: "37010100049", first_name: 'Adam', last_name: 'Baker'} + @existing_user = RegistrantUser.find_or_create_by_api_data(@user_hash) end def teardown @@ -14,11 +16,18 @@ class RegistrantApiAuthenticationTest < ApplicationSystemTestCase def test_request_creates_user_when_one_does_not_exist params = { ident: "30110100103", - first_name: "Jan", - last_name: "Tamm", - country: "ee", + first_name: "John", + last_name: "Smith", } post '/api/v1/registrant/auth/eid', params + assert(User.find_by(registrant_ident: 'EE-30110100103')) + + json = JSON.parse(response.body, symbolize_names: true) + assert_equal([:access_token, :expires_at, :type], json.keys) + end + + def test_request_returns_existing_user + end end diff --git a/test/test_helper.rb b/test/test_helper.rb index 500861f75..56a4a7aeb 100644 --- a/test/test_helper.rb +++ b/test/test_helper.rb @@ -11,7 +11,7 @@ require 'minitest/mock' require 'capybara/rails' require 'capybara/minitest' require 'webmock/minitest' -require 'support/rails5_assetions' # Remove once upgraded to Rails 5 +require 'support/rails5_assertions' # Remove once upgraded to Rails 5 require 'application_system_test_case' From dad57ba52882087e92f77941167e25149f512b17 Mon Sep 17 00:00:00 2001 From: Maciej Szlosarczyk Date: Thu, 19 Jul 2018 11:50:40 +0300 Subject: [PATCH 03/16] Implement the basic interface for the Authentication endpoint * Handle errors as 422 * Require parameters through strong_parameters * Use a custom rescue_from --- .../api/v1/registrant/auth_controller.rb | 27 ++++++++++++------- app/models/registrant_user.rb | 6 ++++- .../registrant_api_authentication_test.rb | 11 ++++++++ test/test_helper.rb | 2 +- 4 files changed, 35 insertions(+), 11 deletions(-) diff --git a/app/controllers/api/v1/registrant/auth_controller.rb b/app/controllers/api/v1/registrant/auth_controller.rb index 36bf750a8..bfd99baad 100644 --- a/app/controllers/api/v1/registrant/auth_controller.rb +++ b/app/controllers/api/v1/registrant/auth_controller.rb @@ -5,21 +5,30 @@ module Api module V1 module Registrant class AuthController < ActionController::API + rescue_from(ActionController::ParameterMissing) do |parameter_missing_exception| + error = {} + error[parameter_missing_exception.param] = ['parameter is required'] + response = { errors: [error] } + render json: response, status: :unprocessable_entity + end + def eid - login_params = set_eid_params + user = RegistrantUser.find_or_create_by_api_data(eid_params) + token = create_token(user) - user = RegistrantUser.find_or_create_by_api_data(login_params) - - unless user.valid? - render json: user.errors, status: :bad_request - else - token = create_token(user) + if token render json: token + else + render json: { error: 'Cannot create generate session token'} end end - def set_eid_params - params.permit(:ident, :first_name, :last_name) + private + + def eid_params + [:ident, :first_name, :last_name].each_with_object(params) do |key, obj| + obj.require(key) + end end def create_token(user) diff --git a/app/models/registrant_user.rb b/app/models/registrant_user.rb index 8f742a361..db851eb6a 100644 --- a/app/models/registrant_user.rb +++ b/app/models/registrant_user.rb @@ -53,10 +53,14 @@ class RegistrantUser < User end def find_or_create_by_api_data(api_data = {}) + return false unless api_data[:ident] + return false unless api_data[:first_name] + return false unless api_data[:last_name] + estonian_ident = "EE-#{api_data[:ident]}" user = find_or_create_by(registrant_ident: estonian_ident) - user.username = "#{api_data[:first_name]}, #{api_data[:last_name]}" + user.username = "#{api_data[:first_name]} #{api_data[:last_name]}" user.save user diff --git a/test/system/api/registrant/registrant_api_authentication_test.rb b/test/system/api/registrant/registrant_api_authentication_test.rb index 6789b3d5d..82b5f48fd 100644 --- a/test/system/api/registrant/registrant_api_authentication_test.rb +++ b/test/system/api/registrant/registrant_api_authentication_test.rb @@ -28,6 +28,17 @@ class RegistrantApiAuthenticationTest < ApplicationSystemTestCase end def test_request_returns_existing_user + assert_no_changes User.count do + post '/api/v1/registrant/auth/eid', @user_hash + end + end + def test_request_documented_parameters_are_required + params = { foo: :bar, test: :test } + + post '/api/v1/registrant/auth/eid', params + json = JSON.parse(response.body, symbolize_names: true) + assert_equal({errors: [{ident: ['parameter is required']}]}, json) + assert_equal(422, response.status) end end diff --git a/test/test_helper.rb b/test/test_helper.rb index 56a4a7aeb..500861f75 100644 --- a/test/test_helper.rb +++ b/test/test_helper.rb @@ -11,7 +11,7 @@ require 'minitest/mock' require 'capybara/rails' require 'capybara/minitest' require 'webmock/minitest' -require 'support/rails5_assertions' # Remove once upgraded to Rails 5 +require 'support/rails5_assetions' # Remove once upgraded to Rails 5 require 'application_system_test_case' From dc8230dcc21a8f13641202ee2fcae780b6eb00e7 Mon Sep 17 00:00:00 2001 From: Maciej Szlosarczyk Date: Fri, 20 Jul 2018 15:21:10 +0300 Subject: [PATCH 04/16] Create AuthTokenCreator and AuthTokenDecryptor classes --- .../api/v1/registrant/auth_controller.rb | 6 +- lib/auth_token.rb | 26 ------- lib/auth_token/auth_token_creator.rb | 41 ++++++++++ lib/auth_token/auth_token_decryptor.rb | 43 +++++++++++ test/fixtures/users.yml | 1 + .../lib/auth_token/auth_token_creator_test.rb | 52 +++++++++++++ .../auth_token/auth_token_decryptor_test.rb | 77 +++++++++++++++++++ .../registrant_api_authentication_test.rb | 8 +- 8 files changed, 221 insertions(+), 33 deletions(-) delete mode 100644 lib/auth_token.rb create mode 100644 lib/auth_token/auth_token_creator.rb create mode 100644 lib/auth_token/auth_token_decryptor.rb create mode 100644 test/lib/auth_token/auth_token_creator_test.rb create mode 100644 test/lib/auth_token/auth_token_decryptor_test.rb diff --git a/app/controllers/api/v1/registrant/auth_controller.rb b/app/controllers/api/v1/registrant/auth_controller.rb index bfd99baad..5de962437 100644 --- a/app/controllers/api/v1/registrant/auth_controller.rb +++ b/app/controllers/api/v1/registrant/auth_controller.rb @@ -1,5 +1,5 @@ require 'rails5_api_controller_backport' -require 'auth_token' +require 'auth_token/auth_token_creator' module Api module V1 @@ -32,8 +32,8 @@ module Api end def create_token(user) - token = AuthToken.new - hash = token.generate_token(user) + token_creator = AuthTokenCreator.create_with_defaults(user) + hash = token_creator.token_in_hash hash end end diff --git a/lib/auth_token.rb b/lib/auth_token.rb deleted file mode 100644 index 5313d603d..000000000 --- a/lib/auth_token.rb +++ /dev/null @@ -1,26 +0,0 @@ -class AuthToken - def initialize; end - - def generate_token(user, secret = Rails.application.config.secret_key_base) - cipher = OpenSSL::Cipher::AES.new(256, :CBC) - expires_at = (Time.now.utc + 2.hours).strftime("%F %T %Z") - - data = { - username: user.username, - expires_at: expires_at - } - - hashable = data.to_json - - cipher.encrypt - cipher.key = secret - encrypted = cipher.update(hashable) + cipher.final - base64_encoded = Base64.encode64(encrypted) - - { - access_token: base64_encoded, - expires_at: expires_at, - type: "Bearer" - } - end -end diff --git a/lib/auth_token/auth_token_creator.rb b/lib/auth_token/auth_token_creator.rb new file mode 100644 index 000000000..2272a3650 --- /dev/null +++ b/lib/auth_token/auth_token_creator.rb @@ -0,0 +1,41 @@ +class AuthTokenCreator + DEFAULT_VALIDITY = 2.hours + + attr_reader :user + attr_reader :key + attr_reader :expires_at + + def self.create_with_defaults(user) + self.new(user, Rails.application.config.secret_key_base, Time.now + DEFAULT_VALIDITY) + end + + def initialize(user, key, expires_at) + @user = user + @key = key + @expires_at = expires_at.utc.strftime("%F %T %Z") + end + + def hashable + { + user_ident: user.registrant_ident, + user_username: user.username, + expires_at: expires_at + }.to_json + end + + def encrypted_token + encryptor = OpenSSL::Cipher::AES.new(256, :CBC) + encryptor.encrypt + encryptor.key = key + encrypted_bytes = encryptor.update(hashable) + encryptor.final + Base64.encode64(encrypted_bytes) + end + + def token_in_hash + { + access_token: encrypted_token, + expires_at: expires_at, + type: 'Bearer' + } + end +end diff --git a/lib/auth_token/auth_token_decryptor.rb b/lib/auth_token/auth_token_decryptor.rb new file mode 100644 index 000000000..1f513bece --- /dev/null +++ b/lib/auth_token/auth_token_decryptor.rb @@ -0,0 +1,43 @@ +class AuthTokenDecryptor + attr_reader :decrypted_data + attr_reader :token + attr_reader :key + attr_reader :user + + def self.create_with_defaults(token) + self.new(token, Rails.application.config.secret_key_base) + end + + def initialize(token, key) + @token = token + @key = key + end + + def decrypt_token + decipher = OpenSSL::Cipher::AES.new(256, :CBC) + decipher.decrypt + decipher.key = key + + base64_decoded = Base64.decode64(token) + plain = decipher.update(base64_decoded) + decipher.final + + @decrypted_data = JSON.parse(plain, symbolize_names: true) + rescue OpenSSL::Cipher::CipherError + false + end + + def valid? + decrypted_data && valid_user? && still_valid? + end + + private + + def valid_user? + @user = RegistrantUser.find_by(registrant_ident: decrypted_data[:user_ident]) + @user&.username == decrypted_data[:user_username] + end + + def still_valid? + decrypted_data[:expires_at] > Time.now + end +end diff --git a/test/fixtures/users.yml b/test/fixtures/users.yml index b20bd8a83..5fd2dc925 100644 --- a/test/fixtures/users.yml +++ b/test/fixtures/users.yml @@ -26,3 +26,4 @@ admin: registrant: type: RegistrantUser registrant_ident: US-1234 + username: Registrant User diff --git a/test/lib/auth_token/auth_token_creator_test.rb b/test/lib/auth_token/auth_token_creator_test.rb new file mode 100644 index 000000000..4fab724c1 --- /dev/null +++ b/test/lib/auth_token/auth_token_creator_test.rb @@ -0,0 +1,52 @@ +require 'test_helper' +require 'openssl' +require_relative '../../../lib/auth_token/auth_token_creator' + +class AuthTokenCreatorTest < ActiveSupport::TestCase + def setup + super + + @user = users(:registrant) + time = Time.zone.parse('2010-07-05 00:30:00 +0000') + @random_bytes = SecureRandom.random_bytes(64) + @token_creator = AuthTokenCreator.new(@user, @random_bytes, time) + end + + def test_hashable_is_constructed_as_expected + expected_hashable = { user_ident: 'US-1234', user_username: 'Registrant User', + expires_at: '2010-07-05 00:30:00 UTC' }.to_json + assert_equal(expected_hashable, @token_creator.hashable) + end + + def test_encrypted_token_is_decryptable + encryptor = OpenSSL::Cipher::AES.new(256, :CBC) + encryptor.decrypt + encryptor.key = @random_bytes + + base64_decoded = Base64.decode64(@token_creator.encrypted_token) + result = encryptor.update(base64_decoded) + encryptor.final + + hashable = { user_ident: 'US-1234', user_username: 'Registrant User', + expires_at: '2010-07-05 00:30:00 UTC' }.to_json + + assert_equal(hashable, result) + end + + def test_token_in_json_returns_expected_values + @token_creator.stub(:encrypted_token, 'super_secure_token') do + token = @token_creator.token_in_hash + assert_equal('2010-07-05 00:30:00 UTC', token[:expires_at]) + assert_equal('Bearer', token[:type]) + end + end + + def test_create_with_defaults_injects_values + travel_to Time.zone.parse('2010-07-05 00:30:00 +0000') + + token_creator_with_defaults = AuthTokenCreator.create_with_defaults(@user) + assert_equal(Rails.application.config.secret_key_base, token_creator_with_defaults.key) + assert_equal('2010-07-05 02:30:00 UTC', token_creator_with_defaults.expires_at) + + travel_back + end +end diff --git a/test/lib/auth_token/auth_token_decryptor_test.rb b/test/lib/auth_token/auth_token_decryptor_test.rb new file mode 100644 index 000000000..d83de7990 --- /dev/null +++ b/test/lib/auth_token/auth_token_decryptor_test.rb @@ -0,0 +1,77 @@ +require 'test_helper' +require_relative '../../../lib/auth_token/auth_token_decryptor' +require_relative '../../../lib/auth_token/auth_token_creator' + +class AuthTokenDecryptorTest < ActiveSupport::TestCase + def setup + super + + travel_to Time.parse("2010-07-05 00:15:00 UTC") + @user = users(:registrant) + + # For testing purposes, the token needs to be random and long enough, hence: + @key = "b8+PtSq1+iXzUVnGEqciKsITNR0KmLl7uPiSTHbteqCoEBdbMLUl3GXlIDWD\nDZp1hIgKWnIMPNEgbuCa/7qccA==\n" + @faulty_key = "FALSE+iXzUVnGEqciKsITNR0KmLl7uPiSTHbteqCoEBdbMLUl3GXlIDWD\nDZp1hIgKWnIMPNEgbuCa/7qccA==\n" + + # this token corresponds to: + # {:user_ident=>"US-1234", :user_username=>"Registrant User", :expires_at=>"2010-07-05 02:15:00 UTC"} + @access_token = "q27NWIsKD5snWj9vZzJ0RcOYvgocEyu7H9yCaDjfmGi54sogovpBeALMPWTZ\nHMcdFQzSiq6b4cI0p5tO0/5UEOHic2jRzNW7mkhi+bn+Y2W9l9TJV0IdiTj9\nbaf+JvlbyaJh6+/eXIm0tuV5E8Ra9Q==\n" + end + + def teardown + super + + travel_back + end + + def test_decrypt_token_returns_a_hash_when_token_is_valid + decryptor = AuthTokenDecryptor.new(@access_token, @key) + + assert(decryptor.decrypt_token.is_a?(Hash)) + end + + def test_decrypt_token_return_false_when_token_is_invalid + faulty_decryptor = AuthTokenDecryptor.new(@access_token, @faulty_key) + refute(faulty_decryptor.decrypt_token) + end + + def test_valid_returns_true_for_valid_token + decryptor = AuthTokenDecryptor.new(@access_token, @key) + decryptor.decrypt_token + + assert(decryptor.valid?) + end + + def test_valid_returns_false_for_invalid_token + faulty_decryptor = AuthTokenDecryptor.new(@access_token, @faulty_key) + faulty_decryptor.decrypt_token + + refute(faulty_decryptor.valid?) + end + + def test_valid_returns_false_for_expired_token + travel_to Time.parse("2010-07-05 10:15:00 UTC") + + decryptor = AuthTokenDecryptor.new(@access_token, @key) + decryptor.decrypt_token + + refute(decryptor.valid?) + end + + def test_returns_false_for_non_existing_user + # This token was created from an admin user and @key. Decrypted, it corresponds to: + # {:user_ident=>nil, :user_username=>"test", :expires_at=>"2010-07-05 00:15:00 UTC"} + other_token = "rMkjgpyRcj2xOnHVwvvQ5RAS0yQepUSrw3XM5BrwM4TMH+h+TBeLve9InC/z\naPneMMnCs0NHQHt1EpH95A2YhX5P3HsyYITRErDmtlzUf21e185q/CUkW5NG\nWa4rar+6\n" + + decryptor = AuthTokenDecryptor.new(other_token, @key) + decryptor.decrypt_token + + refute(decryptor.valid?) + end + + def test_create_with_defaults_injects_values + decryptor = AuthTokenDecryptor.create_with_defaults(@access_token) + + assert_equal(Rails.application.config.secret_key_base, decryptor.key) + end +end diff --git a/test/system/api/registrant/registrant_api_authentication_test.rb b/test/system/api/registrant/registrant_api_authentication_test.rb index 82b5f48fd..72da06fff 100644 --- a/test/system/api/registrant/registrant_api_authentication_test.rb +++ b/test/system/api/registrant/registrant_api_authentication_test.rb @@ -4,7 +4,7 @@ class RegistrantApiAuthenticationTest < ApplicationSystemTestCase def setup super - @user_hash = {ident: "37010100049", first_name: 'Adam', last_name: 'Baker'} + @user_hash = {ident: '37010100049', first_name: 'Adam', last_name: 'Baker'} @existing_user = RegistrantUser.find_or_create_by_api_data(@user_hash) end @@ -15,9 +15,9 @@ class RegistrantApiAuthenticationTest < ApplicationSystemTestCase def test_request_creates_user_when_one_does_not_exist params = { - ident: "30110100103", - first_name: "John", - last_name: "Smith", + ident: '30110100103', + first_name: 'John', + last_name: 'Smith', } post '/api/v1/registrant/auth/eid', params From 35c3f0a5bfa41899d724486a4d0170d9b7b5f145 Mon Sep 17 00:00:00 2001 From: Maciej Szlosarczyk Date: Fri, 20 Jul 2018 16:46:22 +0300 Subject: [PATCH 05/16] Change Base64 encoding to be url_safe, add crude implementation of a Controller --- .../api/v1/registrant/domains_controller.rb | 41 +++++++++++++++++++ config/routes.rb | 3 +- lib/auth_token/auth_token_creator.rb | 2 +- lib/auth_token/auth_token_decryptor.rb | 4 +- .../lib/auth_token/auth_token_creator_test.rb | 3 +- .../auth_token/auth_token_decryptor_test.rb | 4 +- 6 files changed, 50 insertions(+), 7 deletions(-) create mode 100644 app/controllers/api/v1/registrant/domains_controller.rb diff --git a/app/controllers/api/v1/registrant/domains_controller.rb b/app/controllers/api/v1/registrant/domains_controller.rb new file mode 100644 index 000000000..744692d80 --- /dev/null +++ b/app/controllers/api/v1/registrant/domains_controller.rb @@ -0,0 +1,41 @@ +require 'rails5_api_controller_backport' +require 'auth_token/auth_token_decryptor' + +module Api + module V1 + module Registrant + class DomainsController < ActionController::API + before_filter :authenticate + + def index + registrant = ::Registrant.find_by(ident: current_user.registrant_ident) + unless registrant + render json: Domain.all + else + domains = Domain.where(registrant_id: registrant.id) + render json: domains + end + end + + private + + def bearer_token + pattern = /^Bearer / + header = request.headers['Authorization'] + header.gsub(pattern, '') if header && header.match(pattern) + end + + def authenticate + decryptor = AuthTokenDecryptor.create_with_defaults(bearer_token) + decryptor.decrypt_token + + if decryptor.valid? + sign_in decryptor.user + else + render json: { error: "Not authorized" }, status: 403 + end + end + end + end + end +end diff --git a/config/routes.rb b/config/routes.rb index 2bc965a0f..3ae18a7cd 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -22,7 +22,8 @@ Rails.application.routes.draw do namespace :v1 do namespace :registrant do post 'auth/eid', to: 'auth#eid' - post 'auth/username', to: 'auth#username' + + resources :domains, only: [:index] end end end diff --git a/lib/auth_token/auth_token_creator.rb b/lib/auth_token/auth_token_creator.rb index 2272a3650..0597e0489 100644 --- a/lib/auth_token/auth_token_creator.rb +++ b/lib/auth_token/auth_token_creator.rb @@ -28,7 +28,7 @@ class AuthTokenCreator encryptor.encrypt encryptor.key = key encrypted_bytes = encryptor.update(hashable) + encryptor.final - Base64.encode64(encrypted_bytes) + Base64.urlsafe_encode64(encrypted_bytes) end def token_in_hash diff --git a/lib/auth_token/auth_token_decryptor.rb b/lib/auth_token/auth_token_decryptor.rb index 1f513bece..2af4be0a9 100644 --- a/lib/auth_token/auth_token_decryptor.rb +++ b/lib/auth_token/auth_token_decryptor.rb @@ -18,11 +18,11 @@ class AuthTokenDecryptor decipher.decrypt decipher.key = key - base64_decoded = Base64.decode64(token) + base64_decoded = Base64.urlsafe_decode64(token) plain = decipher.update(base64_decoded) + decipher.final @decrypted_data = JSON.parse(plain, symbolize_names: true) - rescue OpenSSL::Cipher::CipherError + rescue OpenSSL::Cipher::CipherError, ArgumentError false end diff --git a/test/lib/auth_token/auth_token_creator_test.rb b/test/lib/auth_token/auth_token_creator_test.rb index 4fab724c1..9d4cdd2c6 100644 --- a/test/lib/auth_token/auth_token_creator_test.rb +++ b/test/lib/auth_token/auth_token_creator_test.rb @@ -15,6 +15,7 @@ class AuthTokenCreatorTest < ActiveSupport::TestCase def test_hashable_is_constructed_as_expected expected_hashable = { user_ident: 'US-1234', user_username: 'Registrant User', expires_at: '2010-07-05 00:30:00 UTC' }.to_json + assert_equal(expected_hashable, @token_creator.hashable) end @@ -23,7 +24,7 @@ class AuthTokenCreatorTest < ActiveSupport::TestCase encryptor.decrypt encryptor.key = @random_bytes - base64_decoded = Base64.decode64(@token_creator.encrypted_token) + base64_decoded = Base64.urlsafe_decode64(@token_creator.encrypted_token) result = encryptor.update(base64_decoded) + encryptor.final hashable = { user_ident: 'US-1234', user_username: 'Registrant User', diff --git a/test/lib/auth_token/auth_token_decryptor_test.rb b/test/lib/auth_token/auth_token_decryptor_test.rb index d83de7990..fbb18d6d3 100644 --- a/test/lib/auth_token/auth_token_decryptor_test.rb +++ b/test/lib/auth_token/auth_token_decryptor_test.rb @@ -15,7 +15,7 @@ class AuthTokenDecryptorTest < ActiveSupport::TestCase # this token corresponds to: # {:user_ident=>"US-1234", :user_username=>"Registrant User", :expires_at=>"2010-07-05 02:15:00 UTC"} - @access_token = "q27NWIsKD5snWj9vZzJ0RcOYvgocEyu7H9yCaDjfmGi54sogovpBeALMPWTZ\nHMcdFQzSiq6b4cI0p5tO0/5UEOHic2jRzNW7mkhi+bn+Y2W9l9TJV0IdiTj9\nbaf+JvlbyaJh6+/eXIm0tuV5E8Ra9Q==\n" + @access_token = "q27NWIsKD5snWj9vZzJ0RcOYvgocEyu7H9yCaDjfmGi54sogovpBeALMPWTZHMcdFQzSiq6b4cI0p5tO0_5UEOHic2jRzNW7mkhi-bn-Y2Wlnw7jhMpxw6VwJR8QEoDzjkcNxnKBN6OKF4nssa60ZQ==" end def teardown @@ -61,7 +61,7 @@ class AuthTokenDecryptorTest < ActiveSupport::TestCase def test_returns_false_for_non_existing_user # This token was created from an admin user and @key. Decrypted, it corresponds to: # {:user_ident=>nil, :user_username=>"test", :expires_at=>"2010-07-05 00:15:00 UTC"} - other_token = "rMkjgpyRcj2xOnHVwvvQ5RAS0yQepUSrw3XM5BrwM4TMH+h+TBeLve9InC/z\naPneMMnCs0NHQHt1EpH95A2YhX5P3HsyYITRErDmtlzUf21e185q/CUkW5NG\nWa4rar+6\n" + other_token = "rMkjgpyRcj2xOnHVwvvQ5RAS0yQepUSrw3XM5BrwM4TMH-h-TBeLve9InC_zaPneMMnCs0NHQHt1EpH95A2Yhdk6Ge6HQ-4gN5L0THDywCO2vHKGucPxbd6g6wOSaOnR" decryptor = AuthTokenDecryptor.new(other_token, @key) decryptor.decrypt_token From 75119aff2eb148859412f9c6e35ba55ba960c92a Mon Sep 17 00:00:00 2001 From: Maciej Szlosarczyk Date: Mon, 23 Jul 2018 12:23:05 +0300 Subject: [PATCH 06/16] Add registrant test class --- test/models/registrant_user_test.rb | 49 +++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 test/models/registrant_user_test.rb diff --git a/test/models/registrant_user_test.rb b/test/models/registrant_user_test.rb new file mode 100644 index 000000000..112b4dbeb --- /dev/null +++ b/test/models/registrant_user_test.rb @@ -0,0 +1,49 @@ +class RegistrantUserTest < ActiveSupport::TestCase + def setup + super + end + + def teardown + super + end + + def test_find_or_create_by_api_data_creates_a_user + user_data = { + ident: '37710100070', + first_name: 'JOHN', + last_name: 'SMITH' + } + + RegistrantUser.find_or_create_by_api_data(user_data) + + user = User.find_by(registrant_ident: 'EE-37710100070') + assert_equal('JOHN SMITH', user.username) + end + + def test_find_or_create_by_mid_data_creates_a_user + user_data = OpenStruct.new(user_country: 'EE', user_id_code: '37710100070', + user_givenname: 'JOHN', user_surname: 'SMITH') + + RegistrantUser.find_or_create_by_mid_data(user_data) + user = User.find_by(registrant_ident: 'EE-37710100070') + assert_equal('JOHN SMITH', user.username) + end + + def test_find_or_create_by_idc_with_legacy_header_creates_a_user + header = '/C=EE/O=ESTEID/OU=authentication/CN=SMITH,JOHN,37710100070/SN=SMITH/GN=JOHN/serialNumber=37710100070' + + RegistrantUser.find_or_create_by_idc_data(header, RegistrantUser::ACCEPTED_ISSUER) + + user = User.find_by(registrant_ident: 'EE-37710100070') + assert_equal('JOHN SMITH', user.username) + end + + def test_find_or_create_by_idc_with_rfc2253_header_creates_a_user + header = 'serialNumber=37710100070,GN=JOHN,SN=SMITH,CN=SMITH\\,JOHN\\,37710100070,OU=authentication,O=ESTEID,C=EE' + + RegistrantUser.find_or_create_by_idc_data(header, RegistrantUser::ACCEPTED_ISSUER) + + user = User.find_by(registrant_ident: 'EE-37710100070') + assert_equal('JOHN SMITH', user.username) + end +end From f92ece54673bb9d04fbb8ad9ba5ffefcc8656580 Mon Sep 17 00:00:00 2001 From: Maciej Szlosarczyk Date: Mon, 23 Jul 2018 14:29:16 +0300 Subject: [PATCH 07/16] Refactor common part of the find_or_create_by_x into a private method --- .../api/v1/registrant/auth_controller.rb | 5 +- app/models/registrant_user.rb | 64 +++++++++++-------- test/models/registrant_user_test.rb | 13 ++++ 3 files changed, 53 insertions(+), 29 deletions(-) diff --git a/app/controllers/api/v1/registrant/auth_controller.rb b/app/controllers/api/v1/registrant/auth_controller.rb index 5de962437..e1bd37b1e 100644 --- a/app/controllers/api/v1/registrant/auth_controller.rb +++ b/app/controllers/api/v1/registrant/auth_controller.rb @@ -26,9 +26,12 @@ module Api private def eid_params - [:ident, :first_name, :last_name].each_with_object(params) do |key, obj| + required_params = [:ident, :first_name, :last_name] + required_params.each_with_object(params) do |key, obj| obj.require(key) end + + params.permit(required_params) end def create_token(user) diff --git a/app/models/registrant_user.rb b/app/models/registrant_user.rb index db851eb6a..da5ddc9f7 100644 --- a/app/models/registrant_user.rb +++ b/app/models/registrant_user.rb @@ -30,48 +30,56 @@ class RegistrantUser < User return false if issuer_organization != ACCEPTED_ISSUER idc_data.force_encoding('UTF-8') + user_data = {} # handling here new and old mode if idc_data.starts_with?("/") - identity_code = idc_data.scan(/serialNumber=(\d+)/).flatten.first - country = idc_data.scan(/^\/C=(.{2})/).flatten.first - first_name = idc_data.scan(%r{/GN=(.+)/serialNumber}).flatten.first - last_name = idc_data.scan(%r{/SN=(.+)/GN}).flatten.first + user_data[:ident] = idc_data.scan(/serialNumber=(\d+)/).flatten.first + user_data[:country_code] = idc_data.scan(/^\/C=(.{2})/).flatten.first + user_data[:first_name] = idc_data.scan(%r{/GN=(.+)/serialNumber}).flatten.first + user_data[:last_name] = idc_data.scan(%r{/SN=(.+)/GN}).flatten.first else parse_str = "," + idc_data - identity_code = parse_str.scan(/,serialNumber=(\d+)/).flatten.first - country = parse_str.scan(/,C=(.{2})/).flatten.first - first_name = parse_str.scan(/,GN=([^,]+)/).flatten.first - last_name = parse_str.scan(/,SN=([^,]+)/).flatten.first + user_data[:ident] = parse_str.scan(/,serialNumber=(\d+)/).flatten.first + user_data[:country_code] = parse_str.scan(/,C=(.{2})/).flatten.first + user_data[:first_name] = parse_str.scan(/,GN=([^,]+)/).flatten.first + user_data[:last_name] = parse_str.scan(/,SN=([^,]+)/).flatten.first end - u = where(registrant_ident: "#{country}-#{identity_code}").first_or_create - u.username = "#{first_name} #{last_name}" - u.save - - u + find_or_create_by_certificate_data(user_data) end - def find_or_create_by_api_data(api_data = {}) - return false unless api_data[:ident] - return false unless api_data[:first_name] - return false unless api_data[:last_name] + def find_or_create_by_api_data(user_data = {}) + return false unless user_data[:ident] + return false unless user_data[:first_name] + return false unless user_data[:last_name] - estonian_ident = "EE-#{api_data[:ident]}" + user_data.each { |k, v| v.upcase! if v.is_a?(String) } + user_data[:country_code] ||= "EE" - user = find_or_create_by(registrant_ident: estonian_ident) - user.username = "#{api_data[:first_name]} #{api_data[:last_name]}" + find_or_create_by_certificate_data(user_data) + end + + def find_or_create_by_mid_data(response) + user_data = { first_name: response.user_givenname, last_name: response.user_surname, + ident: response.user_id_code, country_code: response.user_country } + + find_or_create_by_certificate_data(user_data) + end + + private + + def find_or_create_by_certificate_data(opts = {}) + return unless opts[:first_name] + return unless opts[:last_name] + return unless opts[:ident] + return unless opts[:country_code] + + user = find_or_create_by(registrant_ident: "#{opts[:country_code]}-#{opts[:ident]}") + user.username = "#{opts[:first_name]} #{opts[:last_name]}" user.save user end - - def find_or_create_by_mid_data(response) - u = where(registrant_ident: "#{response.user_country}-#{response.user_id_code}").first_or_create - u.username = "#{response.user_givenname} #{response.user_surname}" - u.save - - u - end end end diff --git a/test/models/registrant_user_test.rb b/test/models/registrant_user_test.rb index 112b4dbeb..86ab5591a 100644 --- a/test/models/registrant_user_test.rb +++ b/test/models/registrant_user_test.rb @@ -20,6 +20,19 @@ class RegistrantUserTest < ActiveSupport::TestCase assert_equal('JOHN SMITH', user.username) end + def test_find_or_create_by_api_data_creates_a_user_after_upcasing_input + user_data = { + ident: '37710100070', + first_name: 'John', + last_name: 'Smith' + } + + RegistrantUser.find_or_create_by_api_data(user_data) + + user = User.find_by(registrant_ident: 'EE-37710100070') + assert_equal('JOHN SMITH', user.username) + end + def test_find_or_create_by_mid_data_creates_a_user user_data = OpenStruct.new(user_country: 'EE', user_id_code: '37710100070', user_givenname: 'JOHN', user_surname: 'SMITH') From 65676ae63721f8d38e419aeb4f0aafc4512cc3bf Mon Sep 17 00:00:00 2001 From: Maciej Szlosarczyk Date: Mon, 23 Jul 2018 15:00:37 +0300 Subject: [PATCH 08/16] Rename private method --- app/models/registrant_user.rb | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/app/models/registrant_user.rb b/app/models/registrant_user.rb index da5ddc9f7..850675f5e 100644 --- a/app/models/registrant_user.rb +++ b/app/models/registrant_user.rb @@ -46,7 +46,7 @@ class RegistrantUser < User user_data[:last_name] = parse_str.scan(/,SN=([^,]+)/).flatten.first end - find_or_create_by_certificate_data(user_data) + find_or_create_by_user_data(user_data) end def find_or_create_by_api_data(user_data = {}) @@ -57,26 +57,26 @@ class RegistrantUser < User user_data.each { |k, v| v.upcase! if v.is_a?(String) } user_data[:country_code] ||= "EE" - find_or_create_by_certificate_data(user_data) + find_or_create_by_user_data(user_data) end def find_or_create_by_mid_data(response) user_data = { first_name: response.user_givenname, last_name: response.user_surname, ident: response.user_id_code, country_code: response.user_country } - find_or_create_by_certificate_data(user_data) + find_or_create_by_user_data(user_data) end private - def find_or_create_by_certificate_data(opts = {}) - return unless opts[:first_name] - return unless opts[:last_name] - return unless opts[:ident] - return unless opts[:country_code] + def find_or_create_by_user_data(user_data = {}) + return unless user_data[:first_name] + return unless user_data[:last_name] + return unless user_data[:ident] + return unless user_data[:country_code] - user = find_or_create_by(registrant_ident: "#{opts[:country_code]}-#{opts[:ident]}") - user.username = "#{opts[:first_name]} #{opts[:last_name]}" + user = find_or_create_by(registrant_ident: "#{user_data[:country_code]}-#{user_data[:ident]}") + user.username = "#{user_data[:first_name]} #{user_data[:last_name]}" user.save user From 8f234a5852ffb29dd702a1f5fda70a9b48f9d96f Mon Sep 17 00:00:00 2001 From: Maciej Szlosarczyk Date: Mon, 23 Jul 2018 16:23:56 +0300 Subject: [PATCH 09/16] Create base controller class --- .../api/v1/registrant/base_controller.rb | 31 +++++++++++++++++++ .../api/v1/registrant/domains_controller.rb | 23 +------------- lib/auth_token/auth_token_decryptor.rb | 2 +- .../auth_token/auth_token_decryptor_test.rb | 5 +++ .../registrant/registrant_api_domains_test.rb | 29 +++++++++++++++++ 5 files changed, 67 insertions(+), 23 deletions(-) create mode 100644 app/controllers/api/v1/registrant/base_controller.rb create mode 100644 test/system/api/registrant/registrant_api_domains_test.rb diff --git a/app/controllers/api/v1/registrant/base_controller.rb b/app/controllers/api/v1/registrant/base_controller.rb new file mode 100644 index 000000000..5b01f94b5 --- /dev/null +++ b/app/controllers/api/v1/registrant/base_controller.rb @@ -0,0 +1,31 @@ +require 'rails5_api_controller_backport' +require 'auth_token/auth_token_decryptor' + +module Api + module V1 + module Registrant + class BaseController < ActionController::API + before_action :authenticate + + private + + def bearer_token + pattern = /^Bearer / + header = request.headers['Authorization'] + header.gsub(pattern, '') if header && header.match(pattern) + end + + def authenticate + decryptor = AuthTokenDecryptor.create_with_defaults(bearer_token) + decryptor.decrypt_token + + if decryptor.valid? + sign_in decryptor.user + else + render json: { error: 'Not authorized' }, status: 403 + end + end + end + end + end +end diff --git a/app/controllers/api/v1/registrant/domains_controller.rb b/app/controllers/api/v1/registrant/domains_controller.rb index 744692d80..cc53e6772 100644 --- a/app/controllers/api/v1/registrant/domains_controller.rb +++ b/app/controllers/api/v1/registrant/domains_controller.rb @@ -4,9 +4,7 @@ require 'auth_token/auth_token_decryptor' module Api module V1 module Registrant - class DomainsController < ActionController::API - before_filter :authenticate - + class DomainsController < BaseController def index registrant = ::Registrant.find_by(ident: current_user.registrant_ident) unless registrant @@ -16,25 +14,6 @@ module Api render json: domains end end - - private - - def bearer_token - pattern = /^Bearer / - header = request.headers['Authorization'] - header.gsub(pattern, '') if header && header.match(pattern) - end - - def authenticate - decryptor = AuthTokenDecryptor.create_with_defaults(bearer_token) - decryptor.decrypt_token - - if decryptor.valid? - sign_in decryptor.user - else - render json: { error: "Not authorized" }, status: 403 - end - end end end end diff --git a/lib/auth_token/auth_token_decryptor.rb b/lib/auth_token/auth_token_decryptor.rb index 2af4be0a9..61146aa4d 100644 --- a/lib/auth_token/auth_token_decryptor.rb +++ b/lib/auth_token/auth_token_decryptor.rb @@ -18,7 +18,7 @@ class AuthTokenDecryptor decipher.decrypt decipher.key = key - base64_decoded = Base64.urlsafe_decode64(token) + base64_decoded = Base64.urlsafe_decode64(token.to_s) plain = decipher.update(base64_decoded) + decipher.final @decrypted_data = JSON.parse(plain, symbolize_names: true) diff --git a/test/lib/auth_token/auth_token_decryptor_test.rb b/test/lib/auth_token/auth_token_decryptor_test.rb index fbb18d6d3..49ca2b820 100644 --- a/test/lib/auth_token/auth_token_decryptor_test.rb +++ b/test/lib/auth_token/auth_token_decryptor_test.rb @@ -35,6 +35,11 @@ class AuthTokenDecryptorTest < ActiveSupport::TestCase refute(faulty_decryptor.decrypt_token) end + def test_decrypt_token_return_false_when_token_is_nil + faulty_decryptor = AuthTokenDecryptor.new(nil, @key) + refute(faulty_decryptor.decrypt_token) + end + def test_valid_returns_true_for_valid_token decryptor = AuthTokenDecryptor.new(@access_token, @key) decryptor.decrypt_token diff --git a/test/system/api/registrant/registrant_api_domains_test.rb b/test/system/api/registrant/registrant_api_domains_test.rb new file mode 100644 index 000000000..e7abe2cae --- /dev/null +++ b/test/system/api/registrant/registrant_api_domains_test.rb @@ -0,0 +1,29 @@ +require 'test_helper' +require 'auth_token/auth_token_creator' + +class RegistrantApiDomainsTest < ApplicationSystemTestCase + def setup + super + + @user = users(:registrant) + @auth_headers = { 'HTTP_AUTHORIZATION' => auth_token } + end + + def test_root_returns_domain_list + get '/api/v1/registrant/domains', {}, @auth_headers + assert_equal(200, response.status) + end + + def test_root_returns_403_without_authorization + get '/api/v1/registrant/domains', {}, {} + assert_equal(403, response.status) + end + + private + + def auth_token + token_creator = AuthTokenCreator.create_with_defaults(@user) + hash = token_creator.token_in_hash + "Bearer #{hash[:access_token]}" + end +end From 42004f933f9bda6f5bfe119a3f6ae50b76ab9ba2 Mon Sep 17 00:00:00 2001 From: Maciej Szlosarczyk Date: Tue, 24 Jul 2018 11:33:51 +0300 Subject: [PATCH 10/16] Add IP block on authentication via EID Also, correct mistakenly used 403 error code. Update aplication-example.yml to include new functionality. --- .../api/v1/registrant/auth_controller.rb | 10 ++++++++++ .../api/v1/registrant/base_controller.rb | 9 ++++++++- .../api/v1/registrant/domains_controller.rb | 6 +++--- config/application-example.yml | 2 ++ .../registrant_api_authentication_test.rb | 14 ++++++++++++++ .../api/registrant/registrant_api_domains_test.rb | 7 +++++-- 6 files changed, 42 insertions(+), 6 deletions(-) diff --git a/app/controllers/api/v1/registrant/auth_controller.rb b/app/controllers/api/v1/registrant/auth_controller.rb index e1bd37b1e..2bbaad973 100644 --- a/app/controllers/api/v1/registrant/auth_controller.rb +++ b/app/controllers/api/v1/registrant/auth_controller.rb @@ -5,6 +5,8 @@ module Api module V1 module Registrant class AuthController < ActionController::API + before_action :check_ip_whitelist + rescue_from(ActionController::ParameterMissing) do |parameter_missing_exception| error = {} error[parameter_missing_exception.param] = ['parameter is required'] @@ -39,6 +41,14 @@ module Api hash = token_creator.token_in_hash hash end + + def check_ip_whitelist + allowed_ips = ENV['registrant_api_auth_allowed_ips'].to_s.split(',').map(&:strip) + + unless allowed_ips.include?(request.ip) || Rails.env.development? + render json: { error: 'Not authorized' }, status: 401 + end + end end end end diff --git a/app/controllers/api/v1/registrant/base_controller.rb b/app/controllers/api/v1/registrant/base_controller.rb index 5b01f94b5..f18fd1eb2 100644 --- a/app/controllers/api/v1/registrant/base_controller.rb +++ b/app/controllers/api/v1/registrant/base_controller.rb @@ -7,6 +7,13 @@ module Api class BaseController < ActionController::API before_action :authenticate + rescue_from(ActionController::ParameterMissing) do |parameter_missing_exception| + error = {} + error[parameter_missing_exception.param] = ['parameter is required'] + response = { errors: [error] } + render json: response, status: :unprocessable_entity + end + private def bearer_token @@ -22,7 +29,7 @@ module Api if decryptor.valid? sign_in decryptor.user else - render json: { error: 'Not authorized' }, status: 403 + render json: { error: 'Not authorized' }, status: 401 end end end diff --git a/app/controllers/api/v1/registrant/domains_controller.rb b/app/controllers/api/v1/registrant/domains_controller.rb index cc53e6772..fdfc6872c 100644 --- a/app/controllers/api/v1/registrant/domains_controller.rb +++ b/app/controllers/api/v1/registrant/domains_controller.rb @@ -7,11 +7,11 @@ module Api class DomainsController < BaseController def index registrant = ::Registrant.find_by(ident: current_user.registrant_ident) - unless registrant - render json: Domain.all - else + if registrant domains = Domain.where(registrant_id: registrant.id) render json: domains + else + render json: [] end end end diff --git a/config/application-example.yml b/config/application-example.yml index 7785aafb5..7a69aa9e2 100644 --- a/config/application-example.yml +++ b/config/application-example.yml @@ -96,6 +96,8 @@ arireg_host: 'http://demo-ariregxml.rik.ee:81/' sk_digi_doc_service_endpoint: 'https://tsp.demo.sk.ee' sk_digi_doc_service_name: 'Testimine' +# Registrant API +registrant_api_auth_allowed_ips: '127.0.0.1,0.0.0.0' #ips, separated with commas # # MISC diff --git a/test/system/api/registrant/registrant_api_authentication_test.rb b/test/system/api/registrant/registrant_api_authentication_test.rb index 72da06fff..94693ddd5 100644 --- a/test/system/api/registrant/registrant_api_authentication_test.rb +++ b/test/system/api/registrant/registrant_api_authentication_test.rb @@ -33,6 +33,20 @@ class RegistrantApiAuthenticationTest < ApplicationSystemTestCase end end + def test_request_returns_401_from_a_not_whitelisted_ip + params = { foo: :bar, test: :test } + @original_whitelist_ip = ENV['registrant_api_auth_allowed_ips'] + ENV['registrant_api_auth_allowed_ips'] = '1.2.3.4' + + post '/api/v1/registrant/auth/eid', params + assert_equal(401, response.status) + json_body = JSON.parse(response.body, symbolize_names: true) + + assert_equal({error: 'Not authorized'}, json_body) + + ENV['registrant_api_auth_allowed_ips'] = @original_whitelist_ip + end + def test_request_documented_parameters_are_required params = { foo: :bar, test: :test } diff --git a/test/system/api/registrant/registrant_api_domains_test.rb b/test/system/api/registrant/registrant_api_domains_test.rb index e7abe2cae..da5813518 100644 --- a/test/system/api/registrant/registrant_api_domains_test.rb +++ b/test/system/api/registrant/registrant_api_domains_test.rb @@ -14,9 +14,12 @@ class RegistrantApiDomainsTest < ApplicationSystemTestCase assert_equal(200, response.status) end - def test_root_returns_403_without_authorization + def test_root_returns_401_without_authorization get '/api/v1/registrant/domains', {}, {} - assert_equal(403, response.status) + assert_equal(401, response.status) + json_body = JSON.parse(response.body, symbolize_names: true) + + assert_equal({error: 'Not authorized'}, json_body) end private From 06f5eb10d4b193e22b831d7e8f8208fec9048a3e Mon Sep 17 00:00:00 2001 From: Maciej Szlosarczyk Date: Tue, 24 Jul 2018 11:54:37 +0300 Subject: [PATCH 11/16] Use inflector rule to acronym Api to API --- app/api/repp/api.rb | 2 +- app/controllers/admin/api_users_controller.rb | 10 +++++----- app/controllers/admin/certificates_controller.rb | 6 +++--- app/controllers/api/v1/registrant/auth_controller.rb | 2 +- app/controllers/api/v1/registrant/base_controller.rb | 2 +- .../api/v1/registrant/domains_controller.rb | 2 +- app/controllers/epp/sessions_controller.rb | 2 +- app/controllers/registrant/sessions_controller.rb | 2 +- app/controllers/registrar/current_user_controller.rb | 2 +- app/controllers/registrar/sessions_controller.rb | 8 ++++---- app/models/ability.rb | 4 ++-- app/models/api_user.rb | 2 +- app/models/concerns/versions.rb | 2 +- app/models/epp/domain.rb | 2 +- app/views/admin/api_users/_form.haml | 2 +- app/views/admin/registrars/_users.html.erb | 4 ++-- config/initializers/inflections.rb | 1 + lib/tasks/import.rake | 10 +++++----- spec/factories/api_user.rb | 2 +- spec/models/api_user_spec.rb | 6 +++--- spec/models/domain_spec.rb | 4 ++-- spec/presenters/user_presenter_spec.rb | 2 +- test/fixtures/users.yml | 4 ++-- .../registrant/registrant_api_authentication_test.rb | 2 +- .../api/registrant/registrant_api_domains_test.rb | 2 +- 25 files changed, 44 insertions(+), 43 deletions(-) diff --git a/app/api/repp/api.rb b/app/api/repp/api.rb index 7858cd625..a726d226c 100644 --- a/app/api/repp/api.rb +++ b/app/api/repp/api.rb @@ -4,7 +4,7 @@ module Repp prefix :repp http_basic do |username, password| - @current_user ||= ApiUser.find_by(username: username, password: password) + @current_user ||= APIUser.find_by(username: username, password: password) if @current_user true else diff --git a/app/controllers/admin/api_users_controller.rb b/app/controllers/admin/api_users_controller.rb index 84344c2e9..e7ac175e8 100644 --- a/app/controllers/admin/api_users_controller.rb +++ b/app/controllers/admin/api_users_controller.rb @@ -1,20 +1,20 @@ module Admin - class ApiUsersController < BaseController + class APIUsersController < BaseController load_and_authorize_resource before_action :set_api_user, only: [:show, :edit, :update, :destroy] def index - @q = ApiUser.includes(:registrar).search(params[:q]) + @q = APIUser.includes(:registrar).search(params[:q]) @api_users = @q.result.page(params[:page]) end def new @registrar = Registrar.find_by(id: params[:registrar_id]) - @api_user = ApiUser.new(registrar: @registrar) + @api_user = APIUser.new(registrar: @registrar) end def create - @api_user = ApiUser.new(api_user_params) + @api_user = APIUser.new(api_user_params) if @api_user.save flash[:notice] = I18n.t('record_created') @@ -55,7 +55,7 @@ module Admin private def set_api_user - @api_user = ApiUser.find(params[:id]) + @api_user = APIUser.find(params[:id]) end def api_user_params diff --git a/app/controllers/admin/certificates_controller.rb b/app/controllers/admin/certificates_controller.rb index a08654db3..f25651c39 100644 --- a/app/controllers/admin/certificates_controller.rb +++ b/app/controllers/admin/certificates_controller.rb @@ -7,12 +7,12 @@ module Admin end def new - @api_user = ApiUser.find(params[:api_user_id]) + @api_user = APIUser.find(params[:api_user_id]) @certificate = Certificate.new(api_user: @api_user) end def create - @api_user = ApiUser.find(params[:api_user_id]) + @api_user = APIUser.find(params[:api_user_id]) crt = certificate_params[:crt].open.read if certificate_params[:crt] csr = certificate_params[:csr].open.read if certificate_params[:csr] @@ -73,7 +73,7 @@ module Admin end def set_api_user - @api_user = ApiUser.find(params[:api_user_id]) + @api_user = APIUser.find(params[:api_user_id]) end def certificate_params diff --git a/app/controllers/api/v1/registrant/auth_controller.rb b/app/controllers/api/v1/registrant/auth_controller.rb index 2bbaad973..656d1b4eb 100644 --- a/app/controllers/api/v1/registrant/auth_controller.rb +++ b/app/controllers/api/v1/registrant/auth_controller.rb @@ -1,7 +1,7 @@ require 'rails5_api_controller_backport' require 'auth_token/auth_token_creator' -module Api +module API module V1 module Registrant class AuthController < ActionController::API diff --git a/app/controllers/api/v1/registrant/base_controller.rb b/app/controllers/api/v1/registrant/base_controller.rb index f18fd1eb2..01101bfb2 100644 --- a/app/controllers/api/v1/registrant/base_controller.rb +++ b/app/controllers/api/v1/registrant/base_controller.rb @@ -1,7 +1,7 @@ require 'rails5_api_controller_backport' require 'auth_token/auth_token_decryptor' -module Api +module API module V1 module Registrant class BaseController < ActionController::API diff --git a/app/controllers/api/v1/registrant/domains_controller.rb b/app/controllers/api/v1/registrant/domains_controller.rb index fdfc6872c..308f81709 100644 --- a/app/controllers/api/v1/registrant/domains_controller.rb +++ b/app/controllers/api/v1/registrant/domains_controller.rb @@ -1,7 +1,7 @@ require 'rails5_api_controller_backport' require 'auth_token/auth_token_decryptor' -module Api +module API module V1 module Registrant class DomainsController < BaseController diff --git a/app/controllers/epp/sessions_controller.rb b/app/controllers/epp/sessions_controller.rb index e3e9f3114..f463f4365 100644 --- a/app/controllers/epp/sessions_controller.rb +++ b/app/controllers/epp/sessions_controller.rb @@ -7,7 +7,7 @@ class Epp::SessionsController < EppController def login success = true - @api_user = ApiUser.find_by(login_params) + @api_user = APIUser.find_by(login_params) webclient_request = ENV['webclient_ips'].split(',').map(&:strip).include?(request.ip) if webclient_request && !Rails.env.test? && !Rails.env.development? diff --git a/app/controllers/registrant/sessions_controller.rb b/app/controllers/registrant/sessions_controller.rb index 80a23eb0a..cb51a94f5 100644 --- a/app/controllers/registrant/sessions_controller.rb +++ b/app/controllers/registrant/sessions_controller.rb @@ -95,6 +95,6 @@ class Registrant::SessionsController < Devise::SessionsController def find_user_by_idc(idc) return User.new unless idc - ApiUser.find_by(identity_code: idc) || User.new + APIUser.find_by(identity_code: idc) || User.new end end diff --git a/app/controllers/registrar/current_user_controller.rb b/app/controllers/registrar/current_user_controller.rb index 266e4b915..3f969ecb2 100644 --- a/app/controllers/registrar/current_user_controller.rb +++ b/app/controllers/registrar/current_user_controller.rb @@ -12,7 +12,7 @@ class Registrar private def new_user - @new_user ||= ApiUser.find(params[:new_user_id]) + @new_user ||= APIUser.find(params[:new_user_id]) end end end diff --git a/app/controllers/registrar/sessions_controller.rb b/app/controllers/registrar/sessions_controller.rb index 11841481d..c369051e6 100644 --- a/app/controllers/registrar/sessions_controller.rb +++ b/app/controllers/registrar/sessions_controller.rb @@ -26,7 +26,7 @@ class Registrar @depp_user.errors.add(:base, :webserver_client_cert_directive_should_be_required) end - @api_user = ApiUser.find_by(username: params[:depp_user][:tag], password: params[:depp_user][:password]) + @api_user = APIUser.find_by(username: params[:depp_user][:tag], password: params[:depp_user][:password]) unless @api_user @depp_user.errors.add(:base, t(:no_such_user)) @@ -53,7 +53,7 @@ class Registrar end def id - @user = ApiUser.find_by_idc_data_and_allowed(request.env['SSL_CLIENT_S_DN'], request.ip) + @user = APIUser.find_by_idc_data_and_allowed(request.env['SSL_CLIENT_S_DN'], request.ip) if @user sign_in(@user, event: :authentication) @@ -150,12 +150,12 @@ class Registrar def find_user_by_idc(idc) return User.new unless idc - ApiUser.find_by(identity_code: idc) || User.new + APIUser.find_by(identity_code: idc) || User.new end def find_user_by_idc_and_allowed(idc) return User.new unless idc - possible_users = ApiUser.where(identity_code: idc) || User.new + possible_users = APIUser.where(identity_code: idc) || User.new possible_users.each do |selected_user| if selected_user.registrar.white_ips.registrar_area.include_ip?(request.ip) return selected_user diff --git a/app/models/ability.rb b/app/models/ability.rb index 97086110b..1bc4ae386 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -10,7 +10,7 @@ class Ability case @user.class.to_s when 'AdminUser' @user.roles&.each { |role| send(role) } - when 'ApiUser' + when 'APIUser' @user.roles&.each { |role| send(role) } when 'RegistrantUser' static_registrant @@ -94,7 +94,7 @@ class Ability can :manage, ContactVersion can :manage, Billing::Price can :manage, User - can :manage, ApiUser + can :manage, APIUser can :manage, AdminUser can :manage, Certificate can :manage, Keyrelay diff --git a/app/models/api_user.rb b/app/models/api_user.rb index ce32c4045..bee04a954 100644 --- a/app/models/api_user.rb +++ b/app/models/api_user.rb @@ -1,6 +1,6 @@ require 'open3' -class ApiUser < User +class APIUser < User include EppErrors def epp_code_map diff --git a/app/models/concerns/versions.rb b/app/models/concerns/versions.rb index 5e2bad90c..50ea935d2 100644 --- a/app/models/concerns/versions.rb +++ b/app/models/concerns/versions.rb @@ -34,7 +34,7 @@ module Versions end def user_from_id_role_username(str) - user = ApiUser.find_by(id: $1) if str =~ /^(\d+)-(ApiUser:|api-)/ + user = APIUser.find_by(id: $1) if str =~ /^(\d+)-(APIUser:|api-)/ unless user.present? user = AdminUser.find_by(id: $1) if str =~ /^(\d+)-AdminUser:/ unless user.present? diff --git a/app/models/epp/domain.rb b/app/models/epp/domain.rb index 749f5310c..49049665c 100644 --- a/app/models/epp/domain.rb +++ b/app/models/epp/domain.rb @@ -490,7 +490,7 @@ class Epp::Domain < Domain def apply_pending_update! preclean_pendings - user = ApiUser.find(pending_json['current_user_id']) + user = APIUser.find(pending_json['current_user_id']) frame = Nokogiri::XML(pending_json['frame']) self.statuses.delete(DomainStatus::PENDING_UPDATE) diff --git a/app/views/admin/api_users/_form.haml b/app/views/admin/api_users/_form.haml index 9a26b9fc8..722b98d0d 100644 --- a/app/views/admin/api_users/_form.haml +++ b/app/views/admin/api_users/_form.haml @@ -38,7 +38,7 @@ = f.label :role, nil, class: 'required' .col-md-7 = select_tag 'api_user[roles][]', - options_for_select(ApiUser::ROLES.map {|x| [x, x] }, @api_user.roles.try(:first)), + options_for_select(APIUser::ROLES.map {|x| [x, x] }, @api_user.roles.try(:first)), class: 'form-control selectize' .checkbox %label{for: 'api_user_active'} diff --git a/app/views/admin/registrars/_users.html.erb b/app/views/admin/registrars/_users.html.erb index f182e4615..d85eaaf36 100644 --- a/app/views/admin/registrars/_users.html.erb +++ b/app/views/admin/registrars/_users.html.erb @@ -6,8 +6,8 @@ - - + + diff --git a/config/initializers/inflections.rb b/config/initializers/inflections.rb index b4eccb451..b4a84b01d 100644 --- a/config/initializers/inflections.rb +++ b/config/initializers/inflections.rb @@ -12,4 +12,5 @@ ActiveSupport::Inflector.inflections(:en) do |inflect| inflect.acronym 'DNS' + inflect.acronym 'API' end diff --git a/lib/tasks/import.rake b/lib/tasks/import.rake index 2fa67a827..1d83ec5ef 100644 --- a/lib/tasks/import.rake +++ b/lib/tasks/import.rake @@ -131,7 +131,7 @@ namespace :import do ips = [] temp = [] - existing_ids = ApiUser.pluck(:legacy_id) + existing_ids = APIUser.pluck(:legacy_id) existing_ips = WhiteIp.pluck(:ipv4) Legacy::Registrar.all.each do |x| @@ -143,7 +143,7 @@ namespace :import do if y.try(:cert) != 'pki' if y.try(:cert) == 'idkaart' - id_users << ApiUser.new({ + id_users << APIUser.new({ username: y.try(:password) ? y.try(:password) : y.try(:password), password: ('a'..'z').to_a.shuffle.first(8).join, identity_code: y.try(:password) ? y.try(:password) : y.try(:password), @@ -152,7 +152,7 @@ namespace :import do legacy_id: y.try(:id) }) else - temp << ApiUser.new({ + temp << APIUser.new({ username: x.handle.try(:strip), password: y.try(:password) ? y.try(:password) : ('a'..'z').to_a.shuffle.first(8).join, registrar_id: Registrar.find_by(legacy_id: x.try(:id)).try(:id), @@ -181,8 +181,8 @@ namespace :import do end end - ApiUser.import id_users, validate: false - ApiUser.import users, validate: false + APIUser.import id_users, validate: false + APIUser.import users, validate: false if ips WhiteIp.import ips, validate: false diff --git a/spec/factories/api_user.rb b/spec/factories/api_user.rb index a3f9623b6..31355f141 100644 --- a/spec/factories/api_user.rb +++ b/spec/factories/api_user.rb @@ -1,7 +1,7 @@ FactoryBot.define do factory :api_user do sequence(:username) { |n| "test#{n}" } - password 'a' * ApiUser.min_password_length + password 'a' * APIUser.min_password_length roles ['super'] registrar diff --git a/spec/models/api_user_spec.rb b/spec/models/api_user_spec.rb index 89feeac6d..b710a05c9 100644 --- a/spec/models/api_user_spec.rb +++ b/spec/models/api_user_spec.rb @@ -1,16 +1,16 @@ require 'rails_helper' -RSpec.describe ApiUser do +RSpec.describe APIUser do context 'with invalid attribute' do before do - @api_user = ApiUser.new + @api_user = APIUser.new end it 'should not be valid' do @api_user.valid? @api_user.errors.full_messages.should match_array([ "Password Password is missing", - "Password is too short (minimum is #{ApiUser.min_password_length} characters)", + "Password is too short (minimum is #{APIUser.min_password_length} characters)", "Registrar Registrar is missing", "Username Username is missing", "Roles is missing" diff --git a/spec/models/domain_spec.rb b/spec/models/domain_spec.rb index 6b282d651..007b1e3de 100644 --- a/spec/models/domain_spec.rb +++ b/spec/models/domain_spec.rb @@ -316,10 +316,10 @@ RSpec.describe Domain do @api_user = create(:api_user) @user.id.should == 1 @api_user.id.should == 2 - ::PaperTrail.whodunnit = '2-ApiUser: testuser' + ::PaperTrail.whodunnit = '2-APIUser: testuser' @domain = create(:domain) - @domain.creator_str.should == '2-ApiUser: testuser' + @domain.creator_str.should == '2-APIUser: testuser' @domain.creator.should == @api_user @domain.creator.should_not == @user diff --git a/spec/presenters/user_presenter_spec.rb b/spec/presenters/user_presenter_spec.rb index ba9e1673f..c0cff114b 100644 --- a/spec/presenters/user_presenter_spec.rb +++ b/spec/presenters/user_presenter_spec.rb @@ -4,7 +4,7 @@ RSpec.describe UserPresenter do let(:presenter) { described_class.new(user: user, view: view) } describe '#login_with_role' do - let(:user) { instance_double(ApiUser, + let(:user) { instance_double(APIUser, login: 'login', roles: %w[role], registrar_name: 'registrar') } diff --git a/test/fixtures/users.yml b/test/fixtures/users.yml index 5fd2dc925..9d3001959 100644 --- a/test/fixtures/users.yml +++ b/test/fixtures/users.yml @@ -1,7 +1,7 @@ api_bestnames: username: test_bestnames password: testtest - type: ApiUser + type: APIUser registrar: bestnames active: true roles: @@ -10,7 +10,7 @@ api_bestnames: api_goodnames: username: test_goodnames password: testtest - type: ApiUser + type: APIUser registrar: goodnames active: true roles: diff --git a/test/system/api/registrant/registrant_api_authentication_test.rb b/test/system/api/registrant/registrant_api_authentication_test.rb index 94693ddd5..9ed518caa 100644 --- a/test/system/api/registrant/registrant_api_authentication_test.rb +++ b/test/system/api/registrant/registrant_api_authentication_test.rb @@ -1,6 +1,6 @@ require 'test_helper' -class RegistrantApiAuthenticationTest < ApplicationSystemTestCase +class RegistrantAPIAuthenticationTest < ApplicationSystemTestCase def setup super diff --git a/test/system/api/registrant/registrant_api_domains_test.rb b/test/system/api/registrant/registrant_api_domains_test.rb index da5813518..ab08b4ba2 100644 --- a/test/system/api/registrant/registrant_api_domains_test.rb +++ b/test/system/api/registrant/registrant_api_domains_test.rb @@ -1,7 +1,7 @@ require 'test_helper' require 'auth_token/auth_token_creator' -class RegistrantApiDomainsTest < ApplicationSystemTestCase +class RegistrantAPIDomainsTest < ApplicationSystemTestCase def setup super From 90b2455032d783acee4f87dca3f16850e70d80d1 Mon Sep 17 00:00:00 2001 From: Maciej Szlosarczyk Date: Tue, 24 Jul 2018 12:18:38 +0300 Subject: [PATCH 12/16] Fix codeclimate issues --- app/controllers/api/v1/registrant/auth_controller.rb | 9 ++++----- app/controllers/api/v1/registrant/base_controller.rb | 4 ++-- app/models/registrant_user.rb | 4 ++-- lib/auth_token/auth_token_creator.rb | 8 ++++---- lib/auth_token/auth_token_decryptor.rb | 2 +- 5 files changed, 13 insertions(+), 14 deletions(-) diff --git a/app/controllers/api/v1/registrant/auth_controller.rb b/app/controllers/api/v1/registrant/auth_controller.rb index 656d1b4eb..0e014da02 100644 --- a/app/controllers/api/v1/registrant/auth_controller.rb +++ b/app/controllers/api/v1/registrant/auth_controller.rb @@ -21,14 +21,14 @@ module API if token render json: token else - render json: { error: 'Cannot create generate session token'} + render json: { error: 'Cannot create generate session token' } end end private def eid_params - required_params = [:ident, :first_name, :last_name] + required_params = %i[ident first_name last_name] required_params.each_with_object(params) do |key, obj| obj.require(key) end @@ -44,10 +44,9 @@ module API def check_ip_whitelist allowed_ips = ENV['registrant_api_auth_allowed_ips'].to_s.split(',').map(&:strip) + return if allowed_ips.include?(request.ip) || Rails.env.development? - unless allowed_ips.include?(request.ip) || Rails.env.development? - render json: { error: 'Not authorized' }, status: 401 - end + render json: { error: 'Not authorized' }, status: :unauthorized end end end diff --git a/app/controllers/api/v1/registrant/base_controller.rb b/app/controllers/api/v1/registrant/base_controller.rb index 01101bfb2..99ff9d90b 100644 --- a/app/controllers/api/v1/registrant/base_controller.rb +++ b/app/controllers/api/v1/registrant/base_controller.rb @@ -19,7 +19,7 @@ module API def bearer_token pattern = /^Bearer / header = request.headers['Authorization'] - header.gsub(pattern, '') if header && header.match(pattern) + header.gsub(pattern, '') if header&.match(pattern) end def authenticate @@ -29,7 +29,7 @@ module API if decryptor.valid? sign_in decryptor.user else - render json: { error: 'Not authorized' }, status: 401 + render json: { error: 'Not authorized' }, status: :unauthorized end end end diff --git a/app/models/registrant_user.rb b/app/models/registrant_user.rb index 850675f5e..889f2ca4c 100644 --- a/app/models/registrant_user.rb +++ b/app/models/registrant_user.rb @@ -54,8 +54,8 @@ class RegistrantUser < User return false unless user_data[:first_name] return false unless user_data[:last_name] - user_data.each { |k, v| v.upcase! if v.is_a?(String) } - user_data[:country_code] ||= "EE" + user_data.each_value { |v| v.upcase! if v.is_a?(String) } + user_data[:country_code] ||= 'EE' find_or_create_by_user_data(user_data) end diff --git a/lib/auth_token/auth_token_creator.rb b/lib/auth_token/auth_token_creator.rb index 0597e0489..9fff8e5cd 100644 --- a/lib/auth_token/auth_token_creator.rb +++ b/lib/auth_token/auth_token_creator.rb @@ -6,20 +6,20 @@ class AuthTokenCreator attr_reader :expires_at def self.create_with_defaults(user) - self.new(user, Rails.application.config.secret_key_base, Time.now + DEFAULT_VALIDITY) + new(user, Rails.application.config.secret_key_base, Time.now + DEFAULT_VALIDITY) end def initialize(user, key, expires_at) @user = user @key = key - @expires_at = expires_at.utc.strftime("%F %T %Z") + @expires_at = expires_at.utc.strftime('%F %T %Z') end def hashable { user_ident: user.registrant_ident, user_username: user.username, - expires_at: expires_at + expires_at: expires_at, }.to_json end @@ -35,7 +35,7 @@ class AuthTokenCreator { access_token: encrypted_token, expires_at: expires_at, - type: 'Bearer' + type: 'Bearer', } end end diff --git a/lib/auth_token/auth_token_decryptor.rb b/lib/auth_token/auth_token_decryptor.rb index 61146aa4d..be6bd99cd 100644 --- a/lib/auth_token/auth_token_decryptor.rb +++ b/lib/auth_token/auth_token_decryptor.rb @@ -5,7 +5,7 @@ class AuthTokenDecryptor attr_reader :user def self.create_with_defaults(token) - self.new(token, Rails.application.config.secret_key_base) + new(token, Rails.application.config.secret_key_base) end def initialize(token, key) From aac76b333cbe598cccf33071cacbcc7fb7bf9b34 Mon Sep 17 00:00:00 2001 From: Maciej Szlosarczyk Date: Tue, 24 Jul 2018 12:53:51 +0300 Subject: [PATCH 13/16] Revert "Use inflector rule to acronym Api to API" This reverts commit 06f5eb10d4b193e22b831d7e8f8208fec9048a3e. --- app/api/repp/api.rb | 2 +- app/controllers/admin/api_users_controller.rb | 10 +++++----- app/controllers/admin/certificates_controller.rb | 6 +++--- app/controllers/api/v1/registrant/auth_controller.rb | 2 +- app/controllers/api/v1/registrant/base_controller.rb | 2 +- .../api/v1/registrant/domains_controller.rb | 2 +- app/controllers/epp/sessions_controller.rb | 2 +- app/controllers/registrant/sessions_controller.rb | 2 +- app/controllers/registrar/current_user_controller.rb | 2 +- app/controllers/registrar/sessions_controller.rb | 8 ++++---- app/models/ability.rb | 4 ++-- app/models/api_user.rb | 2 +- app/models/concerns/versions.rb | 2 +- app/models/epp/domain.rb | 2 +- app/views/admin/api_users/_form.haml | 2 +- app/views/admin/registrars/_users.html.erb | 4 ++-- config/initializers/inflections.rb | 1 - lib/tasks/import.rake | 10 +++++----- spec/factories/api_user.rb | 2 +- spec/models/api_user_spec.rb | 6 +++--- spec/models/domain_spec.rb | 4 ++-- spec/presenters/user_presenter_spec.rb | 2 +- test/fixtures/users.yml | 4 ++-- .../registrant/registrant_api_authentication_test.rb | 2 +- .../api/registrant/registrant_api_domains_test.rb | 2 +- 25 files changed, 43 insertions(+), 44 deletions(-) diff --git a/app/api/repp/api.rb b/app/api/repp/api.rb index a726d226c..7858cd625 100644 --- a/app/api/repp/api.rb +++ b/app/api/repp/api.rb @@ -4,7 +4,7 @@ module Repp prefix :repp http_basic do |username, password| - @current_user ||= APIUser.find_by(username: username, password: password) + @current_user ||= ApiUser.find_by(username: username, password: password) if @current_user true else diff --git a/app/controllers/admin/api_users_controller.rb b/app/controllers/admin/api_users_controller.rb index e7ac175e8..84344c2e9 100644 --- a/app/controllers/admin/api_users_controller.rb +++ b/app/controllers/admin/api_users_controller.rb @@ -1,20 +1,20 @@ module Admin - class APIUsersController < BaseController + class ApiUsersController < BaseController load_and_authorize_resource before_action :set_api_user, only: [:show, :edit, :update, :destroy] def index - @q = APIUser.includes(:registrar).search(params[:q]) + @q = ApiUser.includes(:registrar).search(params[:q]) @api_users = @q.result.page(params[:page]) end def new @registrar = Registrar.find_by(id: params[:registrar_id]) - @api_user = APIUser.new(registrar: @registrar) + @api_user = ApiUser.new(registrar: @registrar) end def create - @api_user = APIUser.new(api_user_params) + @api_user = ApiUser.new(api_user_params) if @api_user.save flash[:notice] = I18n.t('record_created') @@ -55,7 +55,7 @@ module Admin private def set_api_user - @api_user = APIUser.find(params[:id]) + @api_user = ApiUser.find(params[:id]) end def api_user_params diff --git a/app/controllers/admin/certificates_controller.rb b/app/controllers/admin/certificates_controller.rb index f25651c39..a08654db3 100644 --- a/app/controllers/admin/certificates_controller.rb +++ b/app/controllers/admin/certificates_controller.rb @@ -7,12 +7,12 @@ module Admin end def new - @api_user = APIUser.find(params[:api_user_id]) + @api_user = ApiUser.find(params[:api_user_id]) @certificate = Certificate.new(api_user: @api_user) end def create - @api_user = APIUser.find(params[:api_user_id]) + @api_user = ApiUser.find(params[:api_user_id]) crt = certificate_params[:crt].open.read if certificate_params[:crt] csr = certificate_params[:csr].open.read if certificate_params[:csr] @@ -73,7 +73,7 @@ module Admin end def set_api_user - @api_user = APIUser.find(params[:api_user_id]) + @api_user = ApiUser.find(params[:api_user_id]) end def certificate_params diff --git a/app/controllers/api/v1/registrant/auth_controller.rb b/app/controllers/api/v1/registrant/auth_controller.rb index 0e014da02..7ba0e9199 100644 --- a/app/controllers/api/v1/registrant/auth_controller.rb +++ b/app/controllers/api/v1/registrant/auth_controller.rb @@ -1,7 +1,7 @@ require 'rails5_api_controller_backport' require 'auth_token/auth_token_creator' -module API +module Api module V1 module Registrant class AuthController < ActionController::API diff --git a/app/controllers/api/v1/registrant/base_controller.rb b/app/controllers/api/v1/registrant/base_controller.rb index 99ff9d90b..510f16745 100644 --- a/app/controllers/api/v1/registrant/base_controller.rb +++ b/app/controllers/api/v1/registrant/base_controller.rb @@ -1,7 +1,7 @@ require 'rails5_api_controller_backport' require 'auth_token/auth_token_decryptor' -module API +module Api module V1 module Registrant class BaseController < ActionController::API diff --git a/app/controllers/api/v1/registrant/domains_controller.rb b/app/controllers/api/v1/registrant/domains_controller.rb index 308f81709..fdfc6872c 100644 --- a/app/controllers/api/v1/registrant/domains_controller.rb +++ b/app/controllers/api/v1/registrant/domains_controller.rb @@ -1,7 +1,7 @@ require 'rails5_api_controller_backport' require 'auth_token/auth_token_decryptor' -module API +module Api module V1 module Registrant class DomainsController < BaseController diff --git a/app/controllers/epp/sessions_controller.rb b/app/controllers/epp/sessions_controller.rb index f463f4365..e3e9f3114 100644 --- a/app/controllers/epp/sessions_controller.rb +++ b/app/controllers/epp/sessions_controller.rb @@ -7,7 +7,7 @@ class Epp::SessionsController < EppController def login success = true - @api_user = APIUser.find_by(login_params) + @api_user = ApiUser.find_by(login_params) webclient_request = ENV['webclient_ips'].split(',').map(&:strip).include?(request.ip) if webclient_request && !Rails.env.test? && !Rails.env.development? diff --git a/app/controllers/registrant/sessions_controller.rb b/app/controllers/registrant/sessions_controller.rb index cb51a94f5..80a23eb0a 100644 --- a/app/controllers/registrant/sessions_controller.rb +++ b/app/controllers/registrant/sessions_controller.rb @@ -95,6 +95,6 @@ class Registrant::SessionsController < Devise::SessionsController def find_user_by_idc(idc) return User.new unless idc - APIUser.find_by(identity_code: idc) || User.new + ApiUser.find_by(identity_code: idc) || User.new end end diff --git a/app/controllers/registrar/current_user_controller.rb b/app/controllers/registrar/current_user_controller.rb index 3f969ecb2..266e4b915 100644 --- a/app/controllers/registrar/current_user_controller.rb +++ b/app/controllers/registrar/current_user_controller.rb @@ -12,7 +12,7 @@ class Registrar private def new_user - @new_user ||= APIUser.find(params[:new_user_id]) + @new_user ||= ApiUser.find(params[:new_user_id]) end end end diff --git a/app/controllers/registrar/sessions_controller.rb b/app/controllers/registrar/sessions_controller.rb index c369051e6..11841481d 100644 --- a/app/controllers/registrar/sessions_controller.rb +++ b/app/controllers/registrar/sessions_controller.rb @@ -26,7 +26,7 @@ class Registrar @depp_user.errors.add(:base, :webserver_client_cert_directive_should_be_required) end - @api_user = APIUser.find_by(username: params[:depp_user][:tag], password: params[:depp_user][:password]) + @api_user = ApiUser.find_by(username: params[:depp_user][:tag], password: params[:depp_user][:password]) unless @api_user @depp_user.errors.add(:base, t(:no_such_user)) @@ -53,7 +53,7 @@ class Registrar end def id - @user = APIUser.find_by_idc_data_and_allowed(request.env['SSL_CLIENT_S_DN'], request.ip) + @user = ApiUser.find_by_idc_data_and_allowed(request.env['SSL_CLIENT_S_DN'], request.ip) if @user sign_in(@user, event: :authentication) @@ -150,12 +150,12 @@ class Registrar def find_user_by_idc(idc) return User.new unless idc - APIUser.find_by(identity_code: idc) || User.new + ApiUser.find_by(identity_code: idc) || User.new end def find_user_by_idc_and_allowed(idc) return User.new unless idc - possible_users = APIUser.where(identity_code: idc) || User.new + possible_users = ApiUser.where(identity_code: idc) || User.new possible_users.each do |selected_user| if selected_user.registrar.white_ips.registrar_area.include_ip?(request.ip) return selected_user diff --git a/app/models/ability.rb b/app/models/ability.rb index 1bc4ae386..97086110b 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -10,7 +10,7 @@ class Ability case @user.class.to_s when 'AdminUser' @user.roles&.each { |role| send(role) } - when 'APIUser' + when 'ApiUser' @user.roles&.each { |role| send(role) } when 'RegistrantUser' static_registrant @@ -94,7 +94,7 @@ class Ability can :manage, ContactVersion can :manage, Billing::Price can :manage, User - can :manage, APIUser + can :manage, ApiUser can :manage, AdminUser can :manage, Certificate can :manage, Keyrelay diff --git a/app/models/api_user.rb b/app/models/api_user.rb index bee04a954..ce32c4045 100644 --- a/app/models/api_user.rb +++ b/app/models/api_user.rb @@ -1,6 +1,6 @@ require 'open3' -class APIUser < User +class ApiUser < User include EppErrors def epp_code_map diff --git a/app/models/concerns/versions.rb b/app/models/concerns/versions.rb index 50ea935d2..5e2bad90c 100644 --- a/app/models/concerns/versions.rb +++ b/app/models/concerns/versions.rb @@ -34,7 +34,7 @@ module Versions end def user_from_id_role_username(str) - user = APIUser.find_by(id: $1) if str =~ /^(\d+)-(APIUser:|api-)/ + user = ApiUser.find_by(id: $1) if str =~ /^(\d+)-(ApiUser:|api-)/ unless user.present? user = AdminUser.find_by(id: $1) if str =~ /^(\d+)-AdminUser:/ unless user.present? diff --git a/app/models/epp/domain.rb b/app/models/epp/domain.rb index 49049665c..749f5310c 100644 --- a/app/models/epp/domain.rb +++ b/app/models/epp/domain.rb @@ -490,7 +490,7 @@ class Epp::Domain < Domain def apply_pending_update! preclean_pendings - user = APIUser.find(pending_json['current_user_id']) + user = ApiUser.find(pending_json['current_user_id']) frame = Nokogiri::XML(pending_json['frame']) self.statuses.delete(DomainStatus::PENDING_UPDATE) diff --git a/app/views/admin/api_users/_form.haml b/app/views/admin/api_users/_form.haml index 722b98d0d..9a26b9fc8 100644 --- a/app/views/admin/api_users/_form.haml +++ b/app/views/admin/api_users/_form.haml @@ -38,7 +38,7 @@ = f.label :role, nil, class: 'required' .col-md-7 = select_tag 'api_user[roles][]', - options_for_select(APIUser::ROLES.map {|x| [x, x] }, @api_user.roles.try(:first)), + options_for_select(ApiUser::ROLES.map {|x| [x, x] }, @api_user.roles.try(:first)), class: 'form-control selectize' .checkbox %label{for: 'api_user_active'} diff --git a/app/views/admin/registrars/_users.html.erb b/app/views/admin/registrars/_users.html.erb index d85eaaf36..f182e4615 100644 --- a/app/views/admin/registrars/_users.html.erb +++ b/app/views/admin/registrars/_users.html.erb @@ -6,8 +6,8 @@
<%= ApiUser.human_attribute_name :username %><%= ApiUser.human_attribute_name :active %><%= APIUser.human_attribute_name :username %><%= APIUser.human_attribute_name :active %>
- - + + diff --git a/config/initializers/inflections.rb b/config/initializers/inflections.rb index b4a84b01d..b4eccb451 100644 --- a/config/initializers/inflections.rb +++ b/config/initializers/inflections.rb @@ -12,5 +12,4 @@ ActiveSupport::Inflector.inflections(:en) do |inflect| inflect.acronym 'DNS' - inflect.acronym 'API' end diff --git a/lib/tasks/import.rake b/lib/tasks/import.rake index 1d83ec5ef..2fa67a827 100644 --- a/lib/tasks/import.rake +++ b/lib/tasks/import.rake @@ -131,7 +131,7 @@ namespace :import do ips = [] temp = [] - existing_ids = APIUser.pluck(:legacy_id) + existing_ids = ApiUser.pluck(:legacy_id) existing_ips = WhiteIp.pluck(:ipv4) Legacy::Registrar.all.each do |x| @@ -143,7 +143,7 @@ namespace :import do if y.try(:cert) != 'pki' if y.try(:cert) == 'idkaart' - id_users << APIUser.new({ + id_users << ApiUser.new({ username: y.try(:password) ? y.try(:password) : y.try(:password), password: ('a'..'z').to_a.shuffle.first(8).join, identity_code: y.try(:password) ? y.try(:password) : y.try(:password), @@ -152,7 +152,7 @@ namespace :import do legacy_id: y.try(:id) }) else - temp << APIUser.new({ + temp << ApiUser.new({ username: x.handle.try(:strip), password: y.try(:password) ? y.try(:password) : ('a'..'z').to_a.shuffle.first(8).join, registrar_id: Registrar.find_by(legacy_id: x.try(:id)).try(:id), @@ -181,8 +181,8 @@ namespace :import do end end - APIUser.import id_users, validate: false - APIUser.import users, validate: false + ApiUser.import id_users, validate: false + ApiUser.import users, validate: false if ips WhiteIp.import ips, validate: false diff --git a/spec/factories/api_user.rb b/spec/factories/api_user.rb index 31355f141..a3f9623b6 100644 --- a/spec/factories/api_user.rb +++ b/spec/factories/api_user.rb @@ -1,7 +1,7 @@ FactoryBot.define do factory :api_user do sequence(:username) { |n| "test#{n}" } - password 'a' * APIUser.min_password_length + password 'a' * ApiUser.min_password_length roles ['super'] registrar diff --git a/spec/models/api_user_spec.rb b/spec/models/api_user_spec.rb index b710a05c9..89feeac6d 100644 --- a/spec/models/api_user_spec.rb +++ b/spec/models/api_user_spec.rb @@ -1,16 +1,16 @@ require 'rails_helper' -RSpec.describe APIUser do +RSpec.describe ApiUser do context 'with invalid attribute' do before do - @api_user = APIUser.new + @api_user = ApiUser.new end it 'should not be valid' do @api_user.valid? @api_user.errors.full_messages.should match_array([ "Password Password is missing", - "Password is too short (minimum is #{APIUser.min_password_length} characters)", + "Password is too short (minimum is #{ApiUser.min_password_length} characters)", "Registrar Registrar is missing", "Username Username is missing", "Roles is missing" diff --git a/spec/models/domain_spec.rb b/spec/models/domain_spec.rb index 007b1e3de..6b282d651 100644 --- a/spec/models/domain_spec.rb +++ b/spec/models/domain_spec.rb @@ -316,10 +316,10 @@ RSpec.describe Domain do @api_user = create(:api_user) @user.id.should == 1 @api_user.id.should == 2 - ::PaperTrail.whodunnit = '2-APIUser: testuser' + ::PaperTrail.whodunnit = '2-ApiUser: testuser' @domain = create(:domain) - @domain.creator_str.should == '2-APIUser: testuser' + @domain.creator_str.should == '2-ApiUser: testuser' @domain.creator.should == @api_user @domain.creator.should_not == @user diff --git a/spec/presenters/user_presenter_spec.rb b/spec/presenters/user_presenter_spec.rb index c0cff114b..ba9e1673f 100644 --- a/spec/presenters/user_presenter_spec.rb +++ b/spec/presenters/user_presenter_spec.rb @@ -4,7 +4,7 @@ RSpec.describe UserPresenter do let(:presenter) { described_class.new(user: user, view: view) } describe '#login_with_role' do - let(:user) { instance_double(APIUser, + let(:user) { instance_double(ApiUser, login: 'login', roles: %w[role], registrar_name: 'registrar') } diff --git a/test/fixtures/users.yml b/test/fixtures/users.yml index 9d3001959..5fd2dc925 100644 --- a/test/fixtures/users.yml +++ b/test/fixtures/users.yml @@ -1,7 +1,7 @@ api_bestnames: username: test_bestnames password: testtest - type: APIUser + type: ApiUser registrar: bestnames active: true roles: @@ -10,7 +10,7 @@ api_bestnames: api_goodnames: username: test_goodnames password: testtest - type: APIUser + type: ApiUser registrar: goodnames active: true roles: diff --git a/test/system/api/registrant/registrant_api_authentication_test.rb b/test/system/api/registrant/registrant_api_authentication_test.rb index 9ed518caa..94693ddd5 100644 --- a/test/system/api/registrant/registrant_api_authentication_test.rb +++ b/test/system/api/registrant/registrant_api_authentication_test.rb @@ -1,6 +1,6 @@ require 'test_helper' -class RegistrantAPIAuthenticationTest < ApplicationSystemTestCase +class RegistrantApiAuthenticationTest < ApplicationSystemTestCase def setup super diff --git a/test/system/api/registrant/registrant_api_domains_test.rb b/test/system/api/registrant/registrant_api_domains_test.rb index ab08b4ba2..da5813518 100644 --- a/test/system/api/registrant/registrant_api_domains_test.rb +++ b/test/system/api/registrant/registrant_api_domains_test.rb @@ -1,7 +1,7 @@ require 'test_helper' require 'auth_token/auth_token_creator' -class RegistrantAPIDomainsTest < ApplicationSystemTestCase +class RegistrantApiDomainsTest < ApplicationSystemTestCase def setup super From 3adb85001a435651654b316c9f619a46a4d7064a Mon Sep 17 00:00:00 2001 From: Maciej Szlosarczyk Date: Thu, 26 Jul 2018 10:39:58 +0300 Subject: [PATCH 14/16] Insert space into configuration example --- config/application-example.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/application-example.yml b/config/application-example.yml index 7a69aa9e2..b9917e69e 100644 --- a/config/application-example.yml +++ b/config/application-example.yml @@ -97,7 +97,7 @@ sk_digi_doc_service_endpoint: 'https://tsp.demo.sk.ee' sk_digi_doc_service_name: 'Testimine' # Registrant API -registrant_api_auth_allowed_ips: '127.0.0.1,0.0.0.0' #ips, separated with commas +registrant_api_auth_allowed_ips: '127.0.0.1, 0.0.0.0' #ips, separated with commas # # MISC From ed1afb78f6ae6705df38d9cbaca3c80e56029838 Mon Sep 17 00:00:00 2001 From: Maciej Szlosarczyk Date: Mon, 30 Jul 2018 10:30:57 +0300 Subject: [PATCH 15/16] Make tests conform with #924 --- .../api/registrant/registrant_api_authentication_test.rb | 2 +- .../api/registrant/registrant_api_domains_test.rb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) rename test/{system => integration}/api/registrant/registrant_api_authentication_test.rb (95%) rename test/{system => integration}/api/registrant/registrant_api_domains_test.rb (92%) diff --git a/test/system/api/registrant/registrant_api_authentication_test.rb b/test/integration/api/registrant/registrant_api_authentication_test.rb similarity index 95% rename from test/system/api/registrant/registrant_api_authentication_test.rb rename to test/integration/api/registrant/registrant_api_authentication_test.rb index 94693ddd5..cdcd53025 100644 --- a/test/system/api/registrant/registrant_api_authentication_test.rb +++ b/test/integration/api/registrant/registrant_api_authentication_test.rb @@ -1,6 +1,6 @@ require 'test_helper' -class RegistrantApiAuthenticationTest < ApplicationSystemTestCase +class RegistrantApiAuthenticationTest < ActionDispatch::IntegrationTest def setup super diff --git a/test/system/api/registrant/registrant_api_domains_test.rb b/test/integration/api/registrant/registrant_api_domains_test.rb similarity index 92% rename from test/system/api/registrant/registrant_api_domains_test.rb rename to test/integration/api/registrant/registrant_api_domains_test.rb index da5813518..1c91d4775 100644 --- a/test/system/api/registrant/registrant_api_domains_test.rb +++ b/test/integration/api/registrant/registrant_api_domains_test.rb @@ -1,7 +1,7 @@ require 'test_helper' require 'auth_token/auth_token_creator' -class RegistrantApiDomainsTest < ApplicationSystemTestCase +class RegistrantApiDomainsTest < ActionDispatch::IntegrationTest def setup super From c1ea79615f5d751141d5056331e898fd6658b7c8 Mon Sep 17 00:00:00 2001 From: Maciej Szlosarczyk Date: Mon, 30 Jul 2018 11:07:44 +0300 Subject: [PATCH 16/16] Make API return errors array --- app/controllers/api/v1/registrant/auth_controller.rb | 2 +- app/controllers/api/v1/registrant/base_controller.rb | 2 +- .../api/registrant/registrant_api_authentication_test.rb | 4 ++-- .../integration/api/registrant/registrant_api_domains_test.rb | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/app/controllers/api/v1/registrant/auth_controller.rb b/app/controllers/api/v1/registrant/auth_controller.rb index 7ba0e9199..5be48f558 100644 --- a/app/controllers/api/v1/registrant/auth_controller.rb +++ b/app/controllers/api/v1/registrant/auth_controller.rb @@ -46,7 +46,7 @@ module Api allowed_ips = ENV['registrant_api_auth_allowed_ips'].to_s.split(',').map(&:strip) return if allowed_ips.include?(request.ip) || Rails.env.development? - render json: { error: 'Not authorized' }, status: :unauthorized + render json: { errors: ['Not authorized'] }, status: :unauthorized end end end diff --git a/app/controllers/api/v1/registrant/base_controller.rb b/app/controllers/api/v1/registrant/base_controller.rb index 510f16745..bc5fa21d7 100644 --- a/app/controllers/api/v1/registrant/base_controller.rb +++ b/app/controllers/api/v1/registrant/base_controller.rb @@ -29,7 +29,7 @@ module Api if decryptor.valid? sign_in decryptor.user else - render json: { error: 'Not authorized' }, status: :unauthorized + render json: { errors: ['Not authorized'] }, status: :unauthorized end end end diff --git a/test/integration/api/registrant/registrant_api_authentication_test.rb b/test/integration/api/registrant/registrant_api_authentication_test.rb index cdcd53025..14ef1c879 100644 --- a/test/integration/api/registrant/registrant_api_authentication_test.rb +++ b/test/integration/api/registrant/registrant_api_authentication_test.rb @@ -42,7 +42,7 @@ class RegistrantApiAuthenticationTest < ActionDispatch::IntegrationTest assert_equal(401, response.status) json_body = JSON.parse(response.body, symbolize_names: true) - assert_equal({error: 'Not authorized'}, json_body) + assert_equal({ errors: ['Not authorized'] }, json_body) ENV['registrant_api_auth_allowed_ips'] = @original_whitelist_ip end @@ -52,7 +52,7 @@ class RegistrantApiAuthenticationTest < ActionDispatch::IntegrationTest post '/api/v1/registrant/auth/eid', params json = JSON.parse(response.body, symbolize_names: true) - assert_equal({errors: [{ident: ['parameter is required']}]}, json) + assert_equal({ errors: [{ ident: ['parameter is required'] }] }, json) assert_equal(422, response.status) end end diff --git a/test/integration/api/registrant/registrant_api_domains_test.rb b/test/integration/api/registrant/registrant_api_domains_test.rb index 1c91d4775..2d0b83903 100644 --- a/test/integration/api/registrant/registrant_api_domains_test.rb +++ b/test/integration/api/registrant/registrant_api_domains_test.rb @@ -19,7 +19,7 @@ class RegistrantApiDomainsTest < ActionDispatch::IntegrationTest assert_equal(401, response.status) json_body = JSON.parse(response.body, symbolize_names: true) - assert_equal({error: 'Not authorized'}, json_body) + assert_equal({ errors: ['Not authorized'] }, json_body) end private
<%= APIUser.human_attribute_name :username %><%= APIUser.human_attribute_name :active %><%= ApiUser.human_attribute_name :username %><%= ApiUser.human_attribute_name :active %>