Feature/6207 Endpoint api/v1/sign_in now outputs randomized tokens in response upon sign-in by 7riumph · Pull Request #6216 · rubyforgood/casa

7riumph · 2025-02-06T23:08:13Z

What github issue is this PR for, if any?

Resolves #6207

What changed, and why?

Volunteers api/v1/sign_in endpoint now outputs secured randomized tokens upon sign-in.

Dropped token column from users table
Added api_credentials table to be used for users model for greater separation of concerns (SoC)
Utilized SHA-256 hash to ensure raw tokens are never stored in db ( api_token_digest & refresh_token_digest )
Created models/api_credentials and concern/api.rb for further api concern separation and utility

Why?: To ensure compliance with apples review process, and enhance security with an applicable industry standard.

How is this tested? (please write tests!) 💖💪

New tests:

Authentication Helper Function tests (14 in total) → spec/models/api_credential_spec.rb
Credentials Factory Definition → spec/factories/api_credential.rb

Updated tests ( no more token column ):

BaseController test → spec/requests/api/v1/base_spec.rb
SessionController test → spec/requests/api/v1/users/sessions_spec.rb
Users Factory Definition → spec/factories/users.rb

Deployment & Documentation:

Deployment task → lib/tasks/deployment/20230822145532_populate_api_tokens.rake
Swagger Documentation → swagger/v1/swagger.yaml
More Swagger→ spec/swagger_helper.rb

Screenshots please :)

Example output with updated api/v1/sign_in endpoint blueprint

Feelings gif (optional)

xihai01 · 2025-02-07T00:45:28Z

looks good to me so far 🔥

I think instead of storing the token and refresh token as plaintext in the db, we can store it as a hash
like what shen suggested

Then the client would be provided the plaintext versions of the tokens and whenever they call the api, the hash versions will be compared

compwron · 2025-02-07T01:58:19Z

    if @user
+
+      @user.regenerate_session_token!
+      @user.regenerate_refresh_token!


don't do this twice?

It is actually for two separate tokens. The plan is the session_token expires quickly and is repeatedly replaced for as long as the refresh_token is valid to maintain access.

Token regeneration is now handled in the blueprint before being passed to the session controller.

compwron · 2025-02-07T01:58:50Z

 #  receive_email_notifications   :boolean          default(TRUE)
 #  receive_reimbursement_email   :boolean          default(FALSE)
 #  receive_sms_notifications     :boolean          default(FALSE), not null
+#  refresh_token                 :string


maybe make a new type of user, ApiUser?

Looking into this, may complicate authorization. I'll just create a completely new table for api/v1 credentials so the user model and roles inheriting from it aren't overloaded.

Additionally, will attempt to do more compartmentalizing this PR through a concern :)

Created the concern and imported into models/user.rb

compwron · 2025-02-07T01:59:09Z

  after_create :create_preference_set
  before_update :record_previous_email
  has_secure_token :token, length: 36
+  has_secure_token :refresh_token, length: 36


36 what? seconds, minutes, days, weeks?

Vague syntax refers to token length, in this case. The token is 36 characters long.

Tokens are now in a credentials table

…or greater separation of concerns (SoC)

… User Model

…ctions (randomization)

…comment

…ement and test BaseController for signed-in user endpoints)

xihai01 · 2025-02-12T20:54:51Z

+  before_save :generate_refresh_token
+
+  # Securely confirm/deny that Hash in db is same as current users token Hash
+  def authenticate_api_token(api_token)


does these functions return boolean value?
if so, the naming should be consistent with other similar functions starting with the is_....

Yes, returns a boolean. How's Something like "is_api_token_valid"?

yes that would be perfect
also follows ruby conventions too

xihai01 · 2025-02-12T20:59:20Z

+  def change
+    create_table :api_credentials do |t|
+      t.references :user, null: false, foreign_key: true
+      t.string :api_token


you're also storing the plain text tokens in the table?

nvm I think you created a migration to remove them right?

Yeah, originally added 2 unneeded token columns then created a migration to remove them.

xihai01 · 2025-02-12T21:03:11Z


    # Put your task implementation HERE.
-    User.where(token: nil).each do |user|
+    User.find_each do |user|


is it possible to create a separate deployment task for populating the api tokens?
so we don't touch the sms stuff

Get the concern, but this task was not made as part of the original SMS epic. History is you originally created the file here then Sam Williams or schoork added our sms and your token addition to it here

I've edited the task because tokens are in a api_credentials table now.

I see I see
I forgot I originally created this
yea, just leave it then

xihai01

lgtm

7riumph requested review from FireLemons, compwron and elasticspoon as code owners February 6, 2025 23:08

7riumph changed the title ~~Feature/6207~~ Feature/6207 Endpoint api/v1/sign_in now outputs randomized tokens in response upon sign-in Feb 6, 2025

7riumph marked this pull request as draft February 6, 2025 23:17

7riumph changed the title ~~Feature/6207 Endpoint api/v1/sign_in now outputs randomized tokens in response upon sign-in~~ Feature/6207 Endpoint api/v1/sign_in now secured via randomized tokens in response upon sign-in Feb 6, 2025

7riumph changed the title ~~Feature/6207 Endpoint api/v1/sign_in now secured via randomized tokens in response upon sign-in~~ Feature/6207 Endpoint api/v1/sign_in now secured with randomized tokens in response upon sign-in Feb 6, 2025

7riumph changed the title ~~Feature/6207 Endpoint api/v1/sign_in now secured with randomized tokens in response upon sign-in~~ Feature/6207 Endpoint api/v1/sign_in now outputs randomized tokens in response upon sign-in Feb 6, 2025

7riumph requested a review from xihai01 February 6, 2025 23:27

xihai01 reviewed Feb 7, 2025

View reviewed changes

Comment thread app/controllers/api/v1/users/sessions_controller.rb Outdated

compwron reviewed Feb 7, 2025

View reviewed changes

7riumph added 5 commits February 7, 2025 13:47

Created 'api_credentials' table and dropped 'token' from User table f…

3b4908a

…or greater separation of concerns (SoC)

Added new columns to blueprint and connected 'ApiCredential' table to…

d853eb0

… User Model

Utilized SHA-256 Hash to store tokens securely

8701682

Enhanced JSON response, token credentials hash storage and helper fun…

0c9e62d

…ctions (randomization)

Updated Swagger's API Documentation

fb6dc3d

7riumph force-pushed the feature/6207 branch from 3ae80d7 to fb6dc3d Compare February 8, 2025 22:12

7riumph added 7 commits February 8, 2025 15:45

Addressed code climate 'too many methods' check

588ff77

Spec tests for each 'api_credential.rb' method and address error msg …

8387e7b

…comment

Added 'api_credentials' to factory spec

b17d932

Addressed factory referencing old token column error and spec error

0051cff

Enhanced token update precision and addressed more spec errors

9896df4

Fixed reference error

80472cc

Removed test based on deleted 'token' column (future issue(s): reimpl…

778758e

…ement and test BaseController for signed-in user endpoints)

7riumph mentioned this pull request Feb 10, 2025

Endpoint /api/v1/users/sign_out revokes access token and refresh token on request #6222

Closed

3 tasks

7riumph marked this pull request as ready for review February 11, 2025 22:41

7riumph requested a review from xihai01 February 11, 2025 23:06

7riumph requested a review from compwron February 11, 2025 23:06

7riumph mentioned this pull request Feb 12, 2025

Created 'api_credentials' table #6223

Closed

7riumph requested a review from harsohailB February 12, 2025 04:18

xihai01 assigned 7riumph Feb 12, 2025

xihai01 reviewed Feb 12, 2025

View reviewed changes

FireLemons merged commit ede9e67 into rubyforgood:main Feb 19, 2025

This was referenced Feb 19, 2025

Roadmap to Launch 🚀 — for 2025 iOS Cohort rubyforpeace/ios-app#60

Open

api/v1/ for Case Contacts (iOS App) #3942

Open

Update for api feature/6207 rubyforpeace/ios-app#100

Merged

compwron added 🧪 Tests Tests and removed zzz_archived: Tests no-skin-tone labels May 3, 2026

Uh oh!

Conversation

7riumph commented Feb 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What github issue is this PR for, if any?

What changed, and why?

How is this tested? (please write tests!) 💖💪

Screenshots please :)

Feelings gif (optional)

Uh oh!

xihai01 commented Feb 7, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

7riumph Feb 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

7riumph Feb 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

7riumph Feb 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

7riumph Feb 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xihai01 Feb 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xihai01 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

7riumph commented Feb 6, 2025 •

edited

Loading

7riumph Feb 11, 2025 •

edited

Loading

7riumph Feb 13, 2025 •

edited

Loading

7riumph Feb 13, 2025 •

edited

Loading

7riumph Feb 13, 2025 •

edited

Loading

xihai01 Feb 13, 2025 •

edited

Loading