about summary refs log tree commit diff
path: root/app/models
diff options
context:
space:
mode:
authorEugen Rochko <eugen@zeonfederated.com>2017-06-25 23:51:32 +0200
committerGitHub <noreply@github.com>2017-06-25 23:51:32 +0200
commited7dc1704dc3ce82567d9aac366b095f02ce181f (patch)
treeeb05f60470367fc111c0258e7e3bc06cc779f9d0 /app/models
parent436ce03772c8c87a215cdcd88020edfb8c241d38 (diff)
Bind web UI access tokens to sessions (#3940)
* Add overview of active sessions

* Better display of browser/platform name

* Improve how browser information is stored and displayed for sessions overview

* Fix test

* Fix #2347 - Bind web UI access token to session

When you logout, session also destroys the access token, so it's no longer
valid. If access token is destroyed some other way, the session is also
destroyed, requiring a re-login.

Fix #1681 - Add scheduler to remove revoked access tokens and grants

* Fix test
Diffstat (limited to 'app/models')
-rw-r--r--app/models/session_activation.rb44
1 files changed, 34 insertions, 10 deletions
diff --git a/app/models/session_activation.rb b/app/models/session_activation.rb
index 75339b5f7..02a918e8a 100644
--- a/app/models/session_activation.rb
+++ b/app/models/session_activation.rb
@@ -3,16 +3,23 @@
 #
 # Table name: session_activations
 #
-#  id         :integer          not null, primary key
-#  user_id    :integer          not null
-#  session_id :string           not null
-#  created_at :datetime         not null
-#  updated_at :datetime         not null
-#  user_agent :string           default(""), not null
-#  ip         :inet
+#  id              :integer          not null, primary key
+#  user_id         :integer          not null
+#  session_id      :string           not null
+#  created_at      :datetime         not null
+#  updated_at      :datetime         not null
+#  user_agent      :string           default(""), not null
+#  ip              :inet
+#  access_token_id :integer
 #
 
 class SessionActivation < ApplicationRecord
+  belongs_to :access_token, class_name: 'Doorkeeper::AccessToken', dependent: :destroy
+
+  delegate :token,
+           to: :access_token,
+           allow_nil: true
+
   def detection
     @detection ||= Browser.new(user_agent)
   end
@@ -25,9 +32,8 @@ class SessionActivation < ApplicationRecord
     detection.platform.id
   end
 
-  before_save do
-    self.user_agent = '' if user_agent.nil?
-  end
+  before_create :assign_access_token
+  before_save   :assign_user_agent
 
   class << self
     def active?(id)
@@ -53,4 +59,22 @@ class SessionActivation < ApplicationRecord
       where('session_id != ?', id).destroy_all
     end
   end
+
+  private
+
+  def assign_user_agent
+    self.user_agent = '' if user_agent.nil?
+  end
+
+  def assign_access_token
+    superapp = Doorkeeper::Application.find_by(superapp: true)
+
+    return if superapp.nil?
+
+    self.access_token = Doorkeeper::AccessToken.create!(application_id: superapp.id,
+                                                        resource_owner_id: user_id,
+                                                        scopes: 'read write follow',
+                                                        expires_in: Doorkeeper.configuration.access_token_expires_in,
+                                                        use_refresh_token: Doorkeeper.configuration.refresh_token_enabled?)
+  end
 end