services/api/app/controllers/user_sessions_controller.rb

   1 class UserSessionsController < ApplicationController
   2   before_filter :require_auth_scope, :only => [ :destroy ]
   3
   4   skip_before_filter :find_object_by_uuid
   5   skip_before_filter :render_404_if_no_object
   6
   7   respond_to :html
   8
   9   # omniauth callback method
  10   def create
  11     omniauth = env['omniauth.auth']
  12
  13     identity_url_ok = (omniauth['info']['identity_url'].length > 0) rescue false
  14     unless identity_url_ok
  15       # Whoa. This should never happen.
  16       logger.error "UserSessionsController.create: omniauth object missing/invalid"
  17       logger.error "omniauth.pretty_inspect():\n\n#{omniauth.pretty_inspect()}"
  18
  19       return redirect_to login_failure_url
  20     end
  21
  22     user = User.find_by_identity_url(omniauth['info']['identity_url'])
  23     if not user
  24       # Check for permission to log in to an existing User record with
  25       # a different identity_url
  26       Link.where("link_class = ? and name = ? and tail_uuid = ? and head_uuid like ?",
  27                  'permission',
  28                  'can_login',
  29                  omniauth['info']['email'],
  30                  User.uuid_like_pattern).each do |link|
  31         if prefix = link.properties['identity_url_prefix']
  32           if prefix == omniauth['info']['identity_url'][0..prefix.size-1]
  33             user = User.find_by_uuid(link.head_uuid)
  34             break if user
  35           end
  36         end
  37       end
  38     end
  39     if not user
  40       # New user registration
  41       user = User.new(:email => omniauth['info']['email'],
  42                       :first_name => omniauth['info']['first_name'],
  43                       :last_name => omniauth['info']['last_name'],
  44                       :identity_url => omniauth['info']['identity_url'],
  45                       :is_active => Rails.configuration.new_users_are_active)
  46     else
  47       user.email = omniauth['info']['email']
  48       user.first_name = omniauth['info']['first_name']
  49       user.last_name = omniauth['info']['last_name']
  50       if user.identity_url.nil?
  51         # First login to a pre-activated account
  52         user.identity_url = omniauth['info']['identity_url']
  53       end
  54     end
  55
  56     # prevent ArvadosModel#before_create and _update from throwing
  57     # "unauthorized":
  58     Thread.current[:user] = user
  59
  60     user.save or raise Exception.new(user.errors.messages)
  61
  62     omniauth.delete('extra')
  63
  64     # Give the authenticated user a cookie for direct API access
  65     session[:user_id] = user.id
  66     session[:api_client_uuid] = nil
  67     session[:api_client_trusted] = true # full permission to see user's secrets
  68
  69     @redirect_to = root_path
  70     if params.has_key?(:return_to)
  71       return send_api_token_to(params[:return_to], user)
  72     end
  73     redirect_to @redirect_to
  74   end
  75
  76   # Omniauth failure callback
  77   def failure
  78     flash[:notice] = params[:message]
  79   end
  80
  81   # logout - Clear our rack session BUT essentially redirect to the provider
  82   # to clean up the Devise session from there too !
  83   def logout
  84     session[:user_id] = nil
  85
  86     flash[:notice] = 'You have logged off'
  87     return_to = params[:return_to] || root_url
  88     redirect_to "#{CUSTOM_PROVIDER_URL}/users/sign_out?redirect_uri=#{CGI.escape return_to}"
  89   end
  90
  91   # login - Just bounce to /auth/joshid. The only purpose of this function is
  92   # to save the return_to parameter (if it exists; see the application
  93   # controller). /auth/joshid bypasses the application controller.
  94   def login
  95     if current_user and params[:return_to]
  96       # Already logged in; just need to send a token to the requesting
  97       # API client.
  98       #
  99       # FIXME: if current_user has never authorized this app before,
 100       # ask for confirmation here!
 101
 102       send_api_token_to(params[:return_to], current_user)
 103     elsif params[:return_to]
 104       redirect_to "/auth/joshid?return_to=#{CGI.escape(params[:return_to])}"
 105     else
 106       redirect_to "/auth/joshid"
 107     end
 108   end
 109
 110   def send_api_token_to(callback_url, user)
 111     # Give the API client a token for making API calls on behalf of
 112     # the authenticated user
 113
 114     # Stub: automatically register all new API clients
 115     api_client_url_prefix = callback_url.match(%r{^.*?://[^/]+})[0] + '/'
 116     act_as_system_user do
 117       @api_client = ApiClient.find_or_create_by_url_prefix api_client_url_prefix
 118     end
 119
 120     api_client_auth = ApiClientAuthorization.
 121       new(user: user,
 122           api_client: @api_client,
 123           created_by_ip_address: remote_ip,
 124           scopes: ["all"])
 125     api_client_auth.save!
 126
 127     if callback_url.index('?')
 128       callback_url += '&'
 129     else
 130       callback_url += '?'
 131     end
 132     callback_url += 'api_token=' + api_client_auth.api_token
 133     redirect_to callback_url
 134   end
 135 end