module Unrestful::JwtSecured

Private Instance Methods

auth_token() click to toggle source
# File lib/unrestful/jwt_secured.rb, line 22
def auth_token
  JsonWebToken.verify(http_token)
end
authenticate_request!() click to toggle source
# File lib/unrestful/jwt_secured.rb, line 10
def authenticate_request!
  @auth_payload, @auth_header = auth_token
  raise AuthError, 'Insufficient scope' unless scope_included
end
class_assigned_scopes() click to toggle source
# File lib/unrestful/jwt_secured.rb, line 33
def class_assigned_scopes
  class_assigned_scopes = self.class.assigned_scopes[@method] || []
  # ensure that we have a scope defined for this method, and that it has an array value
  if class_assigned_scopes.nil? || class_assigned_scopes.empty? || !class_assigned_scopes.is_a?(Array)
    raise "#{self.class.name} MUST declare a \"scopes\" hash that INCLUDES key \"#{@method}\" with value of an array of permissions"
  end
  class_assigned_scopes
rescue NoMethodError
  raise "#{self.class.name} MUST implement ::Unrestful::RpcController AND declare \"scopes\" for each method request, with its corresponding array of permissions"
end
http_token() click to toggle source
# File lib/unrestful/jwt_secured.rb, line 15
def http_token
  if request.headers['Authorization'].present?
    # strip off the Bearer
    request.headers['Authorization'].split(' ').last
  end
end
scope_included() click to toggle source
# File lib/unrestful/jwt_secured.rb, line 26
def scope_included
  permissions_required = class_assigned_scopes
  permissions_present = @auth_payload['permissions'] || []
  # ensure that we have the required permission to call the method
  (permissions_present & permissions_required).any?
end