Module: JwtAuthenticable::Auth

Includes:
Exceptions, Responses
Defined in:
lib/jwt_authenticable/auth.rb

Overview

Module that adds jwt authentication methods to the client

Instance Method Summary collapse

Methods included from Responses

#accepted, #access_denied, #created, #destroyed, #no_content, #not_found, #payload_too_large, #render_page, #render_resource, #render_success_resource, #unauthorized, #unprocessable_entity, #validation_error

Instance Method Details

#algorithm ⇒ Object 



52
53
54
 
# File 'lib/jwt_authenticable/auth.rb', line 52

def algorithm
  supported_algos.find { |algo| algo == JwtAuthenticable.config.algorithm } || 'HS256'
end

#authenticate_user! ⇒ Object

Authenticates a user.

Raises:

  • MissingAuthScope if the jwt does not have the right scope



14
15
16
17
18
 
# File 'lib/jwt_authenticable/auth.rb', line 14

def authenticate_user!
  validate_jwt_token! token: authorization_token!
rescue MissingAuth, MissingAuthScope, InvalidAuthScheme, JWT::VerificationError, JWT::ExpiredSignature => e
  unauthorized(e.message)
end

#authorization_token! ⇒ String

Note:

For now we only support Bearer schema with JWT

Extracts the authorization token from the Authorization header

Returns:

  • the JWT token string

Raises:

  • Authorization header not present or empty

  • Authorization scheme not understood or not supported



40
41
42
43
44
45
46
47
48
49
50
 
# File 'lib/jwt_authenticable/auth.rb', line 40

def authorization_token!
  raise InvalidIncluder unless defined? request

  auth_token = request.headers['Authorization']
  auth_token ||= request.cookies['bearer_token']

  raise MissingAuth if auth_token.nil? || auth_token == ''
  raise InvalidAuthScheme if auth_token[0..6] != 'Bearer '

  auth_token[7..]
end

#supported_algos ⇒ Object 



56
57
58
 
# File 'lib/jwt_authenticable/auth.rb', line 56

def supported_algos
  SUPPORTED_ALGOS.flat_map { |algo_class| algo_class.const_get(:SUPPORTED) }
end

#validate_jwt_token!(token:) ⇒ Hash

Validate that the JWT token signature and the following claims are valid:

- exp
- scope

Parameters:

  • JWT token string (just the token, with the header, payload and signature separated by ‘.’)

  • Whether to validate the token as a researcher’s or a participant’s

Returns:

  • the JWT payload

Raises:

  • AuthorizationError if the user is trying to login with the incorrect rights.



29
30
31
32
33
 
# File 'lib/jwt_authenticable/auth.rb', line 29

def validate_jwt_token!(token:)
  # NOTE: it is still safe if JWT_SECRET_KEY is not set. The method will trigger a JWT exception
  JWT.decode(token, JwtAuthenticable.config.jwt_secret_key, true,
             { algorithm: algorithm }).first
end