Feature/6207 Endpoint api/v1/sign_in now outputs randomized tokens in response upon sign-in #6216

7riumph · 2025-02-06T23:08:13Z

What github issue is this PR for, if any?

Resolves #6207

What changed, and why?

Volunteers api/v1/sign_in endpoint now outputs secured randomized tokens upon sign-in.

Dropped token column from users table
Added api_credentials table to be used for users model for greater separation of concerns (SoC)
Utilized SHA-256 hash to ensure raw tokens are never stored in db ( api_token_digest & refresh_token_digest )
Created models/api_credentials and concern/api.rb for further api concern separation and utility

Why?: To ensure compliance with apples review process, and enhance security with an applicable industry standard.

How is this tested? (please write tests!) 💖💪

New tests:

Authentication Helper Function tests (14 in total) → spec/models/api_credential_spec.rb
Credentials Factory Definition → spec/factories/api_credential.rb

Updated tests ( no more token column ):

BaseController test → spec/requests/api/v1/base_spec.rb
SessionController test → spec/requests/api/v1/users/sessions_spec.rb
Users Factory Definition → spec/factories/users.rb

Deployment & Documentation:

Deployment task → lib/tasks/deployment/20230822145532_populate_api_tokens.rake
Swagger Documentation → swagger/v1/swagger.yaml
More Swagger→ spec/swagger_helper.rb

Screenshots please :)

Example output with updated api/v1/sign_in endpoint blueprint

Feelings gif (optional)

xihai01 · 2025-02-07T00:45:28Z

looks good to me so far 🔥

I think instead of storing the token and refresh token as plaintext in the db, we can store it as a hash
like what shen suggested

Then the client would be provided the plaintext versions of the tokens and whenever they call the api, the hash versions will be compared

app/controllers/api/v1/users/sessions_controller.rb

compwron · 2025-02-07T01:58:19Z

app/controllers/api/v1/users/sessions_controller.rb

@@ -2,6 +2,10 @@ class Api::V1::Users::SessionsController < Api::V1::BaseController
  def create
    load_resource
    if @user
+
+      @user.regenerate_session_token!
+      @user.regenerate_refresh_token!


don't do this twice?

It is actually for two separate tokens. The plan is the session_token expires quickly and is repeatedly replaced for as long as the refresh_token is valid to maintain access.

Token regeneration is now handled in the blueprint before being passed to the session controller.

compwron · 2025-02-07T01:58:50Z

app/models/supervisor.rb

@@ -81,10 +81,13 @@ def recently_unassigned_volunteers
 #  receive_email_notifications   :boolean          default(TRUE)
 #  receive_reimbursement_email   :boolean          default(FALSE)
 #  receive_sms_notifications     :boolean          default(FALSE), not null
+#  refresh_token                 :string


maybe make a new type of user, ApiUser?

Looking into this, may complicate authorization. I'll just create a completely new table for api/v1 credentials so the user model and roles inheriting from it aren't overloaded.

Additionally, will attempt to do more compartmentalizing this PR through a concern :)

Created the concern and imported into models/user.rb

compwron · 2025-02-07T01:59:09Z

app/models/user.rb

  after_create :skip_email_confirmation_upon_creation
  after_create :create_preference_set
  before_update :record_previous_email
  has_secure_token :token, length: 36
+  has_secure_token :refresh_token, length: 36


36 what? seconds, minutes, days, weeks?

Vague syntax refers to token length, in this case. The token is 36 characters long.

Tokens are now in a credentials table

…or greater separation of concerns (SoC)

… User Model

…ctions (randomization)

…comment

…ement and test BaseController for signed-in user endpoints)

xihai01 · 2025-02-12T20:54:51Z

app/models/api_credential.rb

+  before_save :generate_refresh_token
+
+  # Securely confirm/deny that Hash in db is same as current users token Hash
+  def authenticate_api_token(api_token)


does these functions return boolean value?
if so, the naming should be consistent with other similar functions starting with the is_....

Yes, returns a boolean. How's Something like "is_api_token_valid"?

yes that would be perfect
also follows ruby conventions too

xihai01 · 2025-02-12T20:59:20Z

db/migrate/20250207080511_create_api_credentials.rb

+  def change
+    create_table :api_credentials do |t|
+      t.references :user, null: false, foreign_key: true
+      t.string :api_token


you're also storing the plain text tokens in the table?

nvm I think you created a migration to remove them right?

Yeah, originally added 2 unneeded token columns then created a migration to remove them.

xihai01 · 2025-02-12T21:03:11Z

lib/tasks/deployment/20230822145532_populate_api_tokens.rake

@@ -4,9 +4,9 @@ namespace :after_party do
    puts "Running deploy task 'populate_api_tokens'" unless Rails.env.test?

    # Put your task implementation HERE.
-    User.where(token: nil).each do |user|
+    User.find_each do |user|


is it possible to create a separate deployment task for populating the api tokens?
so we don't touch the sms stuff

Get the concern, but this task was not made as part of the original SMS epic. History is you originally created the file here then Sam Williams or schoork added our sms and your token addition to it here

I've edited the task because tokens are in a api_credentials table now.

I see I see
I forgot I originally created this
yea, just leave it then

xihai01

lgtm

7riumph requested review from compwron, FireLemons and elasticspoon as code owners February 6, 2025 23:08

github-actions bot added ruby Pull requests that update Ruby code Tests! 🎉💖👏 labels Feb 6, 2025

7riumph changed the title ~~Feature/6207~~ Feature/6207 Endpoint api/v1/sign_in now outputs randomized tokens in response upon sign-in Feb 6, 2025

7riumph marked this pull request as draft February 6, 2025 23:17

7riumph changed the title ~~Feature/6207 Endpoint api/v1/sign_in now outputs randomized tokens in response upon sign-in~~ Feature/6207 Endpoint api/v1/sign_in now secured via randomized tokens in response upon sign-in Feb 6, 2025

7riumph changed the title ~~Feature/6207 Endpoint api/v1/sign_in now secured via randomized tokens in response upon sign-in~~ Feature/6207 Endpoint api/v1/sign_in now secured with randomized tokens in response upon sign-in Feb 6, 2025

7riumph changed the title ~~Feature/6207 Endpoint api/v1/sign_in now secured with randomized tokens in response upon sign-in~~ Feature/6207 Endpoint api/v1/sign_in now outputs randomized tokens in response upon sign-in Feb 6, 2025

7riumph requested a review from xihai01 February 6, 2025 23:27

xihai01 reviewed Feb 7, 2025

View reviewed changes

app/controllers/api/v1/users/sessions_controller.rb Outdated Show resolved Hide resolved

compwron reviewed Feb 7, 2025

View reviewed changes

7riumph added 5 commits February 7, 2025 13:47

Created 'api_credentials' table and dropped 'token' from User table f…

3b4908a

…or greater separation of concerns (SoC)

Added new columns to blueprint and connected 'ApiCredential' table to…

d853eb0

… User Model

Utilized SHA-256 Hash to store tokens securely

8701682

Enhanced JSON response, token credentials hash storage and helper fun…

0c9e62d

…ctions (randomization)

Updated Swagger's API Documentation

fb6dc3d

7riumph force-pushed the feature/6207 branch from 3ae80d7 to fb6dc3d Compare February 8, 2025 22:12

7riumph added 7 commits February 8, 2025 15:45

Addressed code climate 'too many methods' check

588ff77

Spec tests for each 'api_credential.rb' method and address error msg …

8387e7b

…comment

Added 'api_credentials' to factory spec

b17d932

Addressed factory referencing old token column error and spec error

0051cff

Enhanced token update precision and addressed more spec errors

9896df4

Fixed reference error

80472cc

Removed test based on deleted 'token' column (future issue(s): reimpl…

778758e

…ement and test BaseController for signed-in user endpoints)

7riumph mentioned this pull request Feb 10, 2025

Endpoint /api/v1/users/sign_out revokes access token and refresh token on request #6222

Open

3 tasks

7riumph marked this pull request as ready for review February 11, 2025 22:41

7riumph requested review from xihai01 and compwron February 11, 2025 23:06

7riumph mentioned this pull request Feb 12, 2025

Created 'api_credentials' table #6223

Closed

7riumph requested a review from harsohailB February 12, 2025 04:18

xihai01 assigned 7riumph Feb 12, 2025

xihai01 reviewed Feb 12, 2025

View reviewed changes

FireLemons merged commit ede9e67 into rubyforgood:main Feb 19, 2025
17 checks passed

This was referenced Feb 19, 2025

Roadmap to Launch 🚀 — for 2025 CtC CASA iOS Cohort ctc-casa-ios/ios-app#60

Open

api/v1/ for Case Contacts (iOS App) #3942

Open

Update for api feature/6207 ctc-casa-ios/ios-app#100

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature/6207 Endpoint api/v1/sign_in now outputs randomized tokens in response upon sign-in #6216

Feature/6207 Endpoint api/v1/sign_in now outputs randomized tokens in response upon sign-in #6216

7riumph commented Feb 6, 2025 •

edited

Loading

xihai01 commented Feb 7, 2025

compwron Feb 7, 2025

7riumph Feb 7, 2025

7riumph Feb 11, 2025

compwron Feb 7, 2025

7riumph Feb 7, 2025

7riumph Feb 11, 2025 •

edited

Loading

compwron Feb 7, 2025

7riumph Feb 7, 2025

7riumph Feb 11, 2025

xihai01 Feb 12, 2025

7riumph Feb 13, 2025 •

edited

Loading

xihai01 Feb 13, 2025

xihai01 Feb 12, 2025

xihai01 Feb 12, 2025

7riumph Feb 13, 2025 •

edited

Loading

xihai01 Feb 13, 2025

xihai01 Feb 12, 2025

7riumph Feb 13, 2025 •

edited

Loading

xihai01 Feb 13, 2025 •

edited

Loading

xihai01 left a comment

Feature/6207 Endpoint api/v1/sign_in now outputs randomized tokens in response upon sign-in #6216

Feature/6207 Endpoint api/v1/sign_in now outputs randomized tokens in response upon sign-in #6216

Conversation

7riumph commented Feb 6, 2025 • edited Loading

What github issue is this PR for, if any?

What changed, and why?

How is this tested? (please write tests!) 💖💪

Screenshots please :)

Feelings gif (optional)

xihai01 commented Feb 7, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

7riumph Feb 11, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

7riumph Feb 13, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

7riumph Feb 13, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

7riumph Feb 13, 2025 • edited Loading

Choose a reason for hiding this comment

xihai01 Feb 13, 2025 • edited Loading

Choose a reason for hiding this comment

xihai01 left a comment

Choose a reason for hiding this comment

7riumph commented Feb 6, 2025 •

edited

Loading

7riumph Feb 11, 2025 •

edited

Loading

7riumph Feb 13, 2025 •

edited

Loading

7riumph Feb 13, 2025 •

edited

Loading

7riumph Feb 13, 2025 •

edited

Loading

xihai01 Feb 13, 2025 •

edited

Loading