Merge branch 'master' into 2903-remove-pi-active-and-success
[arvados.git] / services / api / app / controllers / user_sessions_controller.rb
1 class UserSessionsController < ApplicationController
2   before_filter :require_auth_scope, :only => [ :destroy ]
3
4   skip_before_filter :find_object_by_uuid
5   skip_before_filter :render_404_if_no_object
6
7   respond_to :html
8
9   # omniauth callback method
10   def create
11     omniauth = env['omniauth.auth']
12
13     identity_url_ok = (omniauth['info']['identity_url'].length > 0) rescue false
14     unless identity_url_ok
15       # Whoa. This should never happen.
16       logger.error "UserSessionsController.create: omniauth object missing/invalid"
17       logger.error "omniauth.pretty_inspect():\n\n#{omniauth.pretty_inspect()}"
18
19       return redirect_to login_failure_url
20     end
21
22     user = User.find_by_identity_url(omniauth['info']['identity_url'])
23     if not user
24       # Check for permission to log in to an existing User record with
25       # a different identity_url
26       Link.where("link_class = ? and name = ? and tail_uuid = ? and head_uuid like ?",
27                  'permission',
28                  'can_login',
29                  omniauth['info']['email'],
30                  User.uuid_like_pattern).each do |link|
31         if prefix = link.properties['identity_url_prefix']
32           if prefix == omniauth['info']['identity_url'][0..prefix.size-1]
33             user = User.find_by_uuid(link.head_uuid)
34             break if user
35           end
36         end
37       end
38     end
39     if not user
40       # New user registration
41       user = User.new(:email => omniauth['info']['email'],
42                       :first_name => omniauth['info']['first_name'],
43                       :last_name => omniauth['info']['last_name'],
44                       :identity_url => omniauth['info']['identity_url'],
45                       :is_active => Rails.configuration.new_users_are_active)
46     else
47       user.email = omniauth['info']['email']
48       user.first_name = omniauth['info']['first_name']
49       user.last_name = omniauth['info']['last_name']
50       if user.identity_url.nil?
51         # First login to a pre-activated account
52         user.identity_url = omniauth['info']['identity_url']
53       end
54     end
55
56     # prevent ArvadosModel#before_create and _update from throwing
57     # "unauthorized":
58     Thread.current[:user] = user
59
60     user.save or raise Exception.new(user.errors.messages)
61
62     omniauth.delete('extra')
63
64     # Give the authenticated user a cookie for direct API access
65     session[:user_id] = user.id
66     session[:api_client_uuid] = nil
67     session[:api_client_trusted] = true # full permission to see user's secrets
68
69     @redirect_to = root_path
70     if params.has_key?(:return_to)
71       return send_api_token_to(params[:return_to], user)
72     end
73     redirect_to @redirect_to
74   end
75
76   # Omniauth failure callback
77   def failure
78     flash[:notice] = params[:message]
79   end
80
81   # logout - Clear our rack session BUT essentially redirect to the provider
82   # to clean up the Devise session from there too !
83   def logout
84     session[:user_id] = nil
85
86     flash[:notice] = 'You have logged off'
87     return_to = params[:return_to] || root_url
88     redirect_to "#{CUSTOM_PROVIDER_URL}/users/sign_out?redirect_uri=#{CGI.escape return_to}"
89   end
90
91   # login - Just bounce to /auth/joshid. The only purpose of this function is
92   # to save the return_to parameter (if it exists; see the application
93   # controller). /auth/joshid bypasses the application controller.
94   def login
95     if current_user and params[:return_to]
96       # Already logged in; just need to send a token to the requesting
97       # API client.
98       #
99       # FIXME: if current_user has never authorized this app before,
100       # ask for confirmation here!
101
102       send_api_token_to(params[:return_to], current_user)
103     elsif params[:return_to]
104       redirect_to "/auth/joshid?return_to=#{CGI.escape(params[:return_to])}"
105     else
106       redirect_to "/auth/joshid"
107     end
108   end
109
110   def send_api_token_to(callback_url, user)
111     # Give the API client a token for making API calls on behalf of
112     # the authenticated user
113
114     # Stub: automatically register all new API clients
115     api_client_url_prefix = callback_url.match(%r{^.*?://[^/]+})[0] + '/'
116     act_as_system_user do
117       @api_client = ApiClient.find_or_create_by_url_prefix api_client_url_prefix
118     end
119
120     api_client_auth = ApiClientAuthorization.
121       new(user: user,
122           api_client: @api_client,
123           created_by_ip_address: remote_ip,
124           scopes: ["all"])
125     api_client_auth.save!
126
127     if callback_url.index('?')
128       callback_url += '&'
129     else
130       callback_url += '?'
131     end
132     callback_url += 'api_token=' + api_client_auth.api_token
133     redirect_to callback_url
134   end
135 end