Class: TokensController

Inherits:
ActionController::Base
  • Object
show all
Defined in:
app/controllers/tokens_controller.rb

Instance Method Summary collapse

Instance Method Details

#accept ⇒ Object 



30
31
32
33
34
35
36
37
38
39
40
 
# File 'app/controllers/tokens_controller.rb', line 30

def accept
  dev = TrustedDevice.where('user_id = ? AND control_system_id = ? AND one_time_key = ? AND (expires IS NULL OR expires > ?)', 
      session[:token], session[:system], session[:key], Time.now).first

  if dev.present?
    dev.accept_key
    render :nothing => true # success!
  else
    render :nothing => true, :status => :forbidden  # 403
  end
end

#authenticate ⇒ Object

Allowed through by application controller



10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
 
# File 'app/controllers/tokens_controller.rb', line 10

def authenticate  # Allowed through by application controller
  #
  # Auth(gen)
  # check the system matches (set user and system in session)
  # respond with success
  #
  dev = TrustedDevice.(params[:key], true) # true means gen the next key
  if params[:system].present? && dev.present? && params[:system].to_i == dev.control_system_id
    session[:token] = dev.user_id
    session[:system] = dev.control_system_id
    session[:key] = params[:key]
    cookies.permanent[:next_key] = {:value => dev.next_key, :path => URI.parse(request.referer).path}

    render :nothing => true # success!
  else
    render :nothing => true, :status => :forbidden  # 403
  end
end

#create ⇒ Object 



55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
 
# File 'app/controllers/tokens_controller.rb', line 55

def create
  #
  # Application controller ensures we are logged in as real user
  # Ensure the user can access the control system requested (the control system does this too)
  # Generate key, populate the session
  #
  user = session[:user].present? ? User.find(session[:user]) : nil # We have to be authed to get here
  sys = user.control_systems.where('control_systems.id = ?', params[:system]).first unless user.nil?
  if user.present? && sys.present?

    dev = TrustedDevice.new
    dev.reason = params[:trusted_device][:reason]
    dev.user = user
    dev.control_system = sys
    dev.save

    if !dev.new_record?
      cookies.permanent[:next_key] = {:value => dev.one_time_key, :path => URI.parse(request.referer).path}
      render :json => {} # success!
    else
      render :json => dev.errors.messages, :status => :not_acceptable  # 406
    end
  else
    if user.present?
      render :json => {:control => 'could not find the system selected'}, :status => :forbidden  # 403
    else
      render :json => {:you => 'are not authorised'}, :status => :forbidden  # 403
    end
  end
end

#new ⇒ Object

Build a new session for the interface if the existing one has expired This maintains the csrf security We don’t want to reset the session if a valid user is already authenticated either



48
49
50
51
52
 
# File 'app/controllers/tokens_controller.rb', line 48

def new
  reset_session unless session[:user].present?

  render :text => form_authenticity_token
end

#servers ⇒ Object 



87
88
89
 
# File 'app/controllers/tokens_controller.rb', line 87

def servers
  render :json => Server.where(:online => true).all
end