services/api/app/controllers/user_sessions_controller.rb

   1 class UserSessionsController < ApplicationController
   2   before_filter :require_auth_scope, :only => [ :destroy ]
   3
   4   skip_before_filter :find_object_by_uuid
   5   skip_before_filter :render_404_if_no_object
   6
   7   respond_to :html
   8
   9   # omniauth callback method
  10   def create
  11     omniauth = env['omniauth.auth']
  12
  13     identity_url_ok = (omniauth['info']['identity_url'].length > 0) rescue false
  14     unless identity_url_ok
  15       # Whoa. This should never happen.
  16       logger.error "UserSessionsController.create: omniauth object missing/invalid"
  17       logger.error "omniauth.pretty_inspect():\n\n#{omniauth.pretty_inspect()}"
  18
  19       return redirect_to login_failure_url
  20     end
  21
  22     user = User.find_by_identity_url(omniauth['info']['identity_url'])
  23     if not user
  24       # Check for permission to log in to an existing User record with
  25       # a different identity_url
  26       Link.where("link_class = ? and name = ? and tail_uuid = ? and head_uuid like ?",
  27                  'permission',
  28                  'can_login',
  29                  omniauth['info']['email'],
  30                  User.uuid_like_pattern).each do |link|
  31         if prefix = link.properties['identity_url_prefix']
  32           if prefix == omniauth['info']['identity_url'][0..prefix.size-1]
  33             user = User.find_by_uuid(link.head_uuid)
  34             break if user
  35           end
  36         end
  37       end
  38     end
  39     if not user
  40       # New user registration
  41       user = User.new(:email => omniauth['info']['email'],
  42                       :first_name => omniauth['info']['first_name'],
  43                       :last_name => omniauth['info']['last_name'],
  44                       :identity_url => omniauth['info']['identity_url'],
  45                       :is_active => Rails.configuration.new_users_are_active,
  46                       :owner_uuid => system_user_uuid)
  47       act_as_system_user do
  48         user.save or raise Exception.new(user.errors.messages)
  49       end
  50     else
  51       user.email = omniauth['info']['email']
  52       user.first_name = omniauth['info']['first_name']
  53       user.last_name = omniauth['info']['last_name']
  54       if user.identity_url.nil?
  55         # First login to a pre-activated account
  56         user.identity_url = omniauth['info']['identity_url']
  57       end
  58     end
  59
  60     # prevent ArvadosModel#before_create and _update from throwing
  61     # "unauthorized":
  62     Thread.current[:user] = user
  63
  64     user.save or raise Exception.new(user.errors.messages)
  65
  66     omniauth.delete('extra')
  67
  68     # Give the authenticated user a cookie for direct API access
  69     session[:user_id] = user.id
  70     session[:api_client_uuid] = nil
  71     session[:api_client_trusted] = true # full permission to see user's secrets
  72
  73     @redirect_to = root_path
  74     if params.has_key?(:return_to)
  75       return send_api_token_to(params[:return_to], user)
  76     end
  77     redirect_to @redirect_to
  78   end
  79
  80   # Omniauth failure callback
  81   def failure
  82     flash[:notice] = params[:message]
  83   end
  84
  85   # logout - Clear our rack session BUT essentially redirect to the provider
  86   # to clean up the Devise session from there too !
  87   def logout
  88     session[:user_id] = nil
  89
  90     flash[:notice] = 'You have logged off'
  91     return_to = params[:return_to] || root_url
  92     redirect_to "#{CUSTOM_PROVIDER_URL}/users/sign_out?redirect_uri=#{CGI.escape return_to}"
  93   end
  94
  95   # login - Just bounce to /auth/joshid. The only purpose of this function is
  96   # to save the return_to parameter (if it exists; see the application
  97   # controller). /auth/joshid bypasses the application controller.
  98   def login
  99     if current_user and params[:return_to]
 100       # Already logged in; just need to send a token to the requesting
 101       # API client.
 102       #
 103       # FIXME: if current_user has never authorized this app before,
 104       # ask for confirmation here!
 105
 106       send_api_token_to(params[:return_to], current_user)
 107     elsif params[:return_to]
 108       redirect_to "/auth/joshid?return_to=#{CGI.escape(params[:return_to])}"
 109     else
 110       redirect_to "/auth/joshid"
 111     end
 112   end
 113
 114   def send_api_token_to(callback_url, user)
 115     # Give the API client a token for making API calls on behalf of
 116     # the authenticated user
 117
 118     # Stub: automatically register all new API clients
 119     api_client_url_prefix = callback_url.match(%r{^.*?://[^/]+})[0] + '/'
 120     act_as_system_user do
 121       @api_client = ApiClient.find_or_create_by_url_prefix api_client_url_prefix
 122     end
 123
 124     api_client_auth = ApiClientAuthorization.
 125       new(user: user,
 126           api_client: @api_client,
 127           created_by_ip_address: remote_ip,
 128           scopes: ["all"])
 129     api_client_auth.save!
 130
 131     if callback_url.index('?')
 132       callback_url += '&'
 133     else
 134       callback_url += '?'
 135     end
 136     callback_url += 'api_token=' + api_client_auth.api_token
 137     redirect_to callback_url
 138   end
 139 end