jro_apps/redmine Commit - r3103:aa9951b38b27

Added an API token for each User to use when making API requests. (#3920)...

Eric Davis -

r3103:aa9951b38b27

parent child

Context file:

r3103:aa9951b38b27

Collapse all files

db/migrate/20091221004949_add_api_keys_for_users.rb created 644 +13 0

			@@ -0,0 +1,13
		1	class AddApiKeysForUsers < ActiveRecord::Migration
		2	def self.up
		3	say_with_time("Generating API keys for active users") do
		4	User.active.all(:include => :api_token).each do \|user\|
		5	user.api_key
		6	end
		7	end
		8	end
		9
		10	def self.down
		11	# No-op
		12	end
		13	end

app/controllers/my_controller.rb +13 0

                  redirect_to :action => 'account'
                end
+               # Create a new API key
+               def reset_api_key
+                 if request.post?
+                   if User.current.api_token
+                     User.current.api_token.destroy
+                     User.current.reload
+                   end
+                   User.current.api_key
+                   flash[:notice] = l(:notice_api_access_key_reseted)
+                 end
+                 redirect_to :action => 'account'
+               end
                # User's page layout configuration
                def page_layout
                  @user = User.current

app/models/user.rb +12 0

                has_many :changesets, :dependent => :nullify
                has_one :preference, :dependent => :destroy, :class_name => 'UserPreference'
                has_one :rss_token, :dependent => :destroy, :class_name => 'Token', :conditions => "action='feeds'"
+               has_one :api_token, :dependent => :destroy, :class_name => 'Token', :conditions => "action='api'"
                belongs_to :auth_source
                # Active non-anonymous users scope
                  token = self.rss_token || Token.create(:user => self, :action => 'feeds')
                  token.value
                end
+               # Return user's API key (a 40 chars long string), used to access the API
+               def api_key
+                 token = self.api_token || Token.create(:user => self, :action => 'api')
+                 token.value
+               end
                # Return an array of project ids for which the user has explicitly turned mail notifications on
                def notified_projects_ids
                  token && token.user.active? ? token.user : nil
                end
+               def self.find_by_api_key(key)
+                 token = Token.find_by_action_and_value('api', key)
+                 token && token.user.active? ? token.user : nil
+               end
                # Makes find_by_mail case-insensitive
                def self.find_by_mail(mail)
                  find(:first, :conditions => ["LOWER(mail) = ?", mail.to_s.downcase])

app/views/my/_sidebar.rhtml +20 -2

		@@ -2,7 +2,25
2	2
3	3	<p><%=l(:field_login)%>: <strong><%= @user.login %></strong><br />
4	4	<%=l(:field_created_on)%>: <%= format_time(@user.created_on) %></p>
	5
	6
	7	<h4><%= l(:label_feeds_access_key) %></h4>
	8
	9	<p>
5	10	<% if @user.rss_token %>
6		<p><%= l(:label_feeds_access_key_created_on, distance_of_time_in_words(Time.now, @user.rss_token.created_on)) %>
7		(<%= link_to l(:button_reset), {:action => 'reset_rss_key'}, :method => :post %>)</p>
	11	<%= l(:label_feeds_access_key_created_on, distance_of_time_in_words(Time.now, @user.rss_token.created_on)) %>
	12	<% else %>
	13	<%= l(:label_missing_feeds_access_key) %>
	14	<% end %>
	15	(<%= link_to l(:button_reset), {:action => 'reset_rss_key'}, :method => :post %>)
	16	</p>
	17
	18	<h4><%= l(:label_api_access_key) %></h4>
	19	<p>
	20	<% if @user.api_token %>
	21	<%= l(:label_api_access_key_created_on, distance_of_time_in_words(Time.now, @user.api_token.created_on)) %>
	22	<% else %>
	23	<%= l(:label_missing_api_access_key) %>
8	24	<% end %>
	25	(<%= link_to l(:button_reset), {:action => 'reset_api_key'}, :method => :post %>)
	26	</p>

app/views/my/account.rhtml +12 0

              <p><%= pref_fields.select :comments_sorting, [[l(:label_chronological_order), 'asc'], [l(:label_reverse_chronological_order), 'desc']] %></p>
              <% end %>
              </div>
+             <% if @user.api_token %>
+             <h3><%=l(:label_api_access_key) %></h3>
+             <div class="box">
+               <p>
+                 <%= link_to_function(l(:text_show), "$('api-access-key').show();")%>
+                 <pre id='api-access-key'><%= @user.api_key %></pre>
+               </p>
+               <%= javascript_tag("$('api-access-key').hide();") %>
+             </div>
+             <% end %>
              </div>
              <% end %>

config/locales/en.yml +7 0

                notice_email_sent: "An email was sent to {{value}}"
                notice_email_error: "An error occurred while sending mail ({{value}})"
                notice_feeds_access_key_reseted: Your RSS access key was reset.
+               notice_api_access_key_reseted: Your API access key was reset.
                notice_failed_to_save_issues: "Failed to save {{count}} issue(s) on {{total}} selected: {{ids}}."
                notice_no_issue_selected: "No issue is selected! Please, check the issues you want to edit."
                notice_account_pending: "Your account was created and is now pending administrator approval."
                label_language_based: Based on user's language
                label_sort_by: "Sort by {{value}}"
                label_send_test_email: Send a test email
+               label_feeds_access_key: RSS access key
+               label_missing_feeds_access_key: Missing a RSS access key
                label_feeds_access_key_created_on: "RSS access key created {{value}} ago"
                label_module_plural: Modules
                label_added_time_by: "Added by {{author}} {{age}} ago"
                label_copy_target: Target
                label_copy_same_as_target: Same as target
                label_display_used_statuses_only: Only display statuses that are used by this tracker
+               label_api_access_key: API access key
+               label_missing_api_access_key: Missing an API access key
+               label_api_access_key_created_on: "API access key created {{value}} ago"
                button_login: Login
                button_submit: Submit
                text_wiki_page_nullify_children: "Keep child pages as root pages"
                text_wiki_page_destroy_children: "Delete child pages and all their descendants"
                text_wiki_page_reassign_children: "Reassign child pages to this parent page"
+               text_show: Show
                default_role_manager: Manager
                default_role_developper: Developer

test/functional/my_controller_test.rb +34 0

		@@ -163,4 +163,38 class MyControllerTest < ActionController::TestCase
163	163	should_redirect_to('my account') {'/my/account' }
164	164	end
165	165	end
	166
	167	context "POST to reset_api_key" do
	168	context "with an existing api_token" do
	169	setup do
	170	@previous_token_value = User.find(2).api_key # Will generate one if it's missing
	171	post :reset_api_key
	172	end
	173
	174	should "destroy the existing token" do
	175	assert_not_equal @previous_token_value, User.find(2).api_key
	176	end
	177
	178	should "create a new token" do
	179	assert User.find(2).api_token
	180	end
	181
	182	should_set_the_flash_to /reset/
	183	should_redirect_to('my account') {'/my/account' }
	184	end
	185
	186	context "with no api_token" do
	187	setup do
	188	assert_nil User.find(2).api_token
	189	post :reset_api_key
	190	end
	191
	192	should "create a new token" do
	193	assert User.find(2).api_token
	194	end
	195
	196	should_set_the_flash_to /reset/
	197	should_redirect_to('my account') {'/my/account' }
	198	end
	199	end
166	200	end

test/unit/user_test.rb +51 -1

		@@ -126,7 +126,9 class UserTest < ActiveSupport::TestCase
126	126	assert !anon.new_record?
127	127	assert_kind_of AnonymousUser, anon
128	128	end
129
	129
	130	should_have_one :rss_token
	131
130	132	def test_rss_key
131	133	assert_nil @jsmith.rss_token
132	134	key = @jsmith.rss_key
		@@ -135,7 +137,55 class UserTest < ActiveSupport::TestCase
135	137	@jsmith.reload
136	138	assert_equal key, @jsmith.rss_key
137	139	end
	140
138	141
	142	should_have_one :api_token
	143
	144	context "User#api_key" do
	145	should "generate a new one if the user doesn't have one" do
	146	user = User.generate_with_protected!(:api_token => nil)
	147	assert_nil user.api_token
	148
	149	key = user.api_key
	150	assert_equal 40, key.length
	151	user.reload
	152	assert_equal key, user.api_key
	153	end
	154
	155	should "return the existing api token value" do
	156	user = User.generate_with_protected!
	157	token = Token.generate!(:action => 'api')
	158	user.api_token = token
	159	assert user.save
	160
	161	assert_equal token.value, user.api_key
	162	end
	163	end
	164
	165	context "User#find_by_api_key" do
	166	should "return nil if no matching key is found" do
	167	assert_nil User.find_by_api_key('zzzzzzzzz')
	168	end
	169
	170	should "return nil if the key is found for an inactive user" do
	171	user = User.generate_with_protected!(:status => User::STATUS_LOCKED)
	172	token = Token.generate!(:action => 'api')
	173	user.api_token = token
	174	user.save
	175
	176	assert_nil User.find_by_api_key(token.value)
	177	end
	178
	179	should "return the user if the key is found for an active user" do
	180	user = User.generate_with_protected!(:status => User::STATUS_ACTIVE)
	181	token = Token.generate!(:action => 'api')
	182	user.api_token = token
	183	user.save
	184
	185	assert_equal user, User.find_by_api_key(token.value)
	186	end
	187	end
	188
139	189	def test_roles_for_project
140	190	# user with a role
141	191	roles = @jsmith.roles_for_project(Project.find(1))

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages