cybertooth-io / ermahgerd-rails-api-jwt Goto Github PK
View Code? Open in Web Editor NEWRails 5+ API, JWT_Session, Pundit, JSONAPI, Sidekiq, PostgreSQL.
Rails 5+ API, JWT_Session, Pundit, JSONAPI, Sidekiq, PostgreSQL.
New table off of a session that tracks user last seen. Can write this information using sidekiq task. What information to store with each record?
ip_address
- the ip address that the session originated fromresource_path
- the resource request pathIt would be ideal to create a worker that tracks the success or failure of refresh tokens. On malicious refresh attempts, we should also find the Session
from the supplied RUID and mark it as invalidated.
On Update, we should permit the password
and password_confirmed
fields. Put it in the self.updatable_fields
override. Test it.
On Create, we should build a before a hook that automatically creates a password
and password_confirmed
field should it have not been passed in the payload. Put it in the self.creatable_fields
override.
@bradf83 has recommended we just go full OAuth. Doorkeeper might be our ticket.
It's always nice to have the last of some user. For example, last seen would be the USERS
' most recently created SESSION_ACTIVITIES
record. This could be a column derived in a VIEW
and could easily be rendered as a relationship to a USERS
record.
CREATE VIEW users_last_activities AS
SELECT users.id,
(
SELECT MAX(sa.created_at)
FROM session_activities sa INNER JOIN sessions s
ON sa.session_id=s.id
WHERE s.user_id=users.id
),
...
FROM users
Other last ideas from projects I've worked on:
Record the date that an account was activated on. Could also record when the account is deactivated. How about when reactivated?!? Vicious circle.
Originally posted by @nadnoslen in #3
Right now this simply raises a JWTSessions::Errors::Unauthorized
Originally posted by @nadnoslen in #3
This will be used to collect the user that is authenticated. Keeps it clean from the User
model.
Make room for authenticating in one of two ways:
CookieAuthenticationsController
)TokenAuthenticationsController
)Worth a shot to see what the big deal is. Probably a performance blip
Search and replace: cppdist-com-rails
Originally posted by @nadnoslen in #3
We already store the RUID
inside the database's Session
table. When a request to invalidate occurs, we ask JWTSessions::Session
to locate the refresh token by RUID
and invalidate it. We could at the same time effectively expire/destroy the associated access token as the refresh token maintains a reference to the access token.
If that doesn't work, we could store both the RUID
(refresh) & UID
(access) in our Sessions
table.
Check out https://github.com/tuwukee/jwt_sessions#flush-sessions in the jwt_sessions gem.
Is this even possible with JWTSessions? What do we need? I think we will need to save the UID (access token identifier) in the Sessions table.
Originally posted by @nadnoslen in #3
Invitation should expire.
Expired invitations should permit visiting user to click a link to send additional invitation to self.
New invitation_status
enum on User
model with the following choices: Uninvited
, Invited
, and Accepted
. This is a system status, it will never be updated through the API
Administrator
- no brainer. Can do pretty much everything CRUD-wise
Member
or User
or Authenticated User
or Guest
- a basic authenticated user that is restricted in some manner
Dan doesn't love the role named User
because it seems redundant. Brad doesn't like Guest
as he associates anonymous access with the phrase. Brad also dislikes Member
.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.