Merge pull request #14 from tuanle03/clr-10-create-api-session

[CLR-10] Create Sessions API

Author: tuanle03

Gemfile

@@ -54,6 +54,8 @@ gem 'grape-swagger'
 
 gem 'grape_logging'
 
+gem 'faker'
+
 # Use Sass to process CSS
 # gem "sassc-rails"
 

Gemfile.lock

@@ -127,6 +127,8 @@ GEM
     factory_bot_rails (6.4.2)
       factory_bot (~> 6.4)
       railties (>= 5.0.0)
+    faker (3.2.2)
+      i18n (>= 1.8.11, < 2)
     globalid (1.2.1)
       activesupport (>= 6.1)
     grape (2.0.0)
@@ -315,6 +317,7 @@ DEPENDENCIES
   devise
   devise-jwt
   factory_bot_rails
+  faker
   grape
   grape-swagger
   grape_logging

app/api/application_api.rb

@@ -4,21 +4,14 @@
 require 'grape-swagger'
 require 'grape_logging'
 
-# Grape::Validations.register_validator('length', Validators::LengthValidator)
-# Grape::Validations.register_validator('numeric', Validators::NumericValidator)
-# Grape::Validations.register_validator('gte_date', Validators::GteDateValidator)
-
-# All the API module are defined in this file.
 class ApplicationAPI < Grape::API
   format :json
-  # error_formatter :json
-  # formatter :json, JsonFormatter
-  # default_error_formatter :json
 
   helpers ::Helpers::AuthenticationHelper
-
-  before do
-    process_token
+  helpers do
+    def unauthorized_error!
+      error!('Unauthorized', 401)
+    end
   end
 
   rescue_from Grape::Exceptions::ValidationErrors do |e|

app/api/helpers/authentication_helper.rb

@@ -1,24 +1,18 @@
 module Helpers::AuthenticationHelper
   extend Grape::API::Helpers
 
-  def process_token
-    return unless request.headers['Authorization']
-
-    payload = JWT.decode(request.headers['Authorization'].split(' ')[1], Rails.application.credentials.devise_jwt_secret_key).first
-    @current_user_id = payload['user_id']
-  rescue JWT::ExpiredSignature, JWT::VerificationError, JWT::DecodeError
-    head :unauthorized
-  end
-
-  def authenticate_user!(options = {})
-    head :unauthorized unless signed_in?
+  def authenticate_user!
+    error!('Unauthorized. Invalid or expired token.', 401) unless current_user
   end
 
   def current_user
-    @current_user ||= super || User.find(@current_user_id)
+    @current_user ||=
+      begin
+        token = request.headers['Authorization'].split(' ').last
+        User.find_by(id: JWT.decode(token, Rails.application.credentials.devise_jwt_secret_key)[0]['user_id']) if token
+      rescue JWT::DecodeError
+        nil
+      end
   end
 
-  def signed_in?
-    @current_user_id.present?
-  end
 end

app/api/web/feedbacks_api.rb

@@ -4,12 +4,14 @@ class Web::FeedbacksAPI < Grape::API
       desc 'Create feedback'
       params do
         requires :content, type: String
-        requires :user_id, type: Integer
+        requires :post_id, type: Integer
       end
       post do
+        authenticate_user!
         Feedback.create!({
           content: params[:content],
-          user_id: params[:user_id]
+          user_id: current_user.id,
+          post_id: params[:post_id]
         })
       end
 

app/api/web/sessions_api.rb

@@ -0,0 +1,39 @@
+module API
+  class Web::SessionsAPI < Grape::API
+    namespace :session do
+      desc 'Sign in and retrieve JWT token'
+      params do
+        requires :email, type: String, desc: 'User email'
+        requires :password, type: String, desc: 'User password'
+      end
+      post 'sign_in' do
+        user = User.find_for_database_authentication(email: params[:email])
+        if user && user.valid_password?(params[:password])
+          token = user.generate_jwt
+          status 200
+          {
+            success: true,
+            token: token,
+          }
+        else
+          status 401
+          {
+            success: false,
+            message: 'Invalid email or password',
+          }
+        end
+      end
+
+      desc 'Sign out and revoke JWT token'
+      delete 'sign_out' do
+        authenticate_user!
+        current_user.revoke_jwt(request.headers['Authorization'])
+        status 200
+        {
+          success: true,
+          message: 'Signed out successfully',
+        }
+      end
+    end
+  end
+end

app/api/web_api.rb

@@ -1,6 +1,11 @@
 class WebAPI < Grape::API
+  format :json
+  prefix 'web'
+
+  helpers ::Helpers::AuthenticationHelper
 
   mount Web::FeedbacksAPI
+  mount Web::SessionsAPI
 
   add_swagger_documentation(
     format: :json,

app/models/allowlisted_jwt.rb

@@ -0,0 +1,2 @@
+class AllowlistedJwt < ApplicationRecord
+end

app/models/user.rb

@@ -1,12 +1,29 @@
 class User < ApplicationRecord
-  # Include default devise modules. Others available are:
-  # :confirmable, :lockable, :timeoutable, :trackable and :omniauthable
+  include Devise::JWT::RevocationStrategies::Allowlist
+
+  serialize :revoked_tokens, Array
+
   devise :database_authenticatable, :registerable,
     :recoverable, :rememberable, :validatable,
-    :jwt_authenticatable, jwt_revocation_strategy: Devise::JWT::RevocationStrategies::Null
+    :jwt_authenticatable, jwt_revocation_strategy: self
 
   def generate_jwt
     payload = { user_id: id, exp: 1.day.from_now.to_i }
     JWT.encode(payload, Rails.application.credentials.devise_jwt_secret_key)
   end
+
+  def decode_jwt(token)
+    JWT.decode(token, Rails.application.credentials.devise_jwt_secret_key)
+  end
+
+  def revoke_jwt(token)
+    self.revoked_tokens ||= []
+    self.revoked_tokens << token
+    self.revoked_tokens.uniq!
+    save
+  end
+
+  def jwt_revoked?(token)
+    revoked_tokens.include?(token)
+  end
 end

app/services/user_registration_with_email_service.rb

@@ -0,0 +1,17 @@
+class UserRegistrationWithEmailService
+  attr_reader :email, :token
+
+  def initialize(email)
+    @email = email
+  end
+
+  def register
+    user = User.find_or_initialize_by email: email
+    if user.save
+      @token, payload = Warden::JWTAuth::UserEncoder.new.call(user, :user, nil)
+      user.on_jwt_dispatch(@token, payload)
+    end
+
+    user
+  end
+end