Skip to content

Commit e197971

Browse files
committed
Fix cookie overflow. Warden resource serialization
1 parent bff833a commit e197971

File tree

8 files changed

+119
-11
lines changed

8 files changed

+119
-11
lines changed

lib/graphql_devise/schema_plugin.rb

+6
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ def initialize(query: nil, mutation: nil, authenticate_default: true, resource_l
1111

1212
# Must happen on initialize so operations are loaded before the types are added to the schema on GQL < 1.10
1313
load_fields
14+
reconfigure_warden!
1415
end
1516

1617
def use(schema_definition)
@@ -92,6 +93,11 @@ def authenticate_option(field, trace_data)
9293
end
9394
end
9495

96+
def reconfigure_warden!
97+
Devise.class_variable_set(:@@warden_configured, nil)
98+
Devise.configure_warden!
99+
end
100+
95101
def load_fields
96102
@resource_loaders.each do |resource_loader|
97103
raise Error, 'Invalid resource loader instance' unless resource_loader.instance_of?(GraphqlDevise::ResourceLoader)

spec/dummy/app/controllers/api/v1/graphql_controller.rb

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ def execute_params(item)
2323
{
2424
operation_name: item[:operationName],
2525
variables: ensure_hash(item[:variables]),
26-
context: graphql_context(:user)
26+
context: graphql_context([:user, :schema_user])
2727
}
2828
end
2929

spec/dummy/app/graphql/dummy_schema.rb

+2-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,8 @@ class DummySchema < GraphQL::Schema
1313
:check_password_token
1414
]
1515
),
16-
GraphqlDevise::ResourceLoader.new('Guest', only: [:logout])
16+
GraphqlDevise::ResourceLoader.new('Guest', only: [:logout]),
17+
GraphqlDevise::ResourceLoader.new('SchemaUser')
1718
]
1819
)
1920

spec/dummy/app/models/schema_user.rb

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
class SchemaUser < ApplicationRecord
2+
devise :database_authenticatable,
3+
:recoverable,
4+
:trackable,
5+
:validatable,
6+
:confirmable
7+
8+
include GraphqlDevise::Concerns::Model
9+
10+
validates :name, presence: true
11+
end
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
class CreateSchemaUsers < ActiveRecord::Migration[6.0]
2+
def change
3+
create_table :schema_users do |t|
4+
## Required
5+
t.string :provider, null: false, default: 'email'
6+
t.string :uid, null: false, default: ''
7+
8+
## Database authenticatable
9+
t.string :encrypted_password, null: false, default: ''
10+
11+
## Recoverable
12+
t.string :reset_password_token
13+
t.datetime :reset_password_sent_at
14+
t.boolean :allow_password_change, default: false
15+
16+
## Confirmable
17+
t.string :confirmation_token
18+
t.datetime :confirmed_at
19+
t.datetime :confirmation_sent_at
20+
21+
# Trackable
22+
t.datetime :current_sign_in_at
23+
t.datetime :last_sign_in_at
24+
t.string :last_sign_in_ip
25+
t.string :current_sign_in_ip
26+
t.integer :sign_in_count
27+
28+
## User Info
29+
t.string :name
30+
t.string :email
31+
32+
## Tokens
33+
t.text :tokens
34+
35+
t.timestamps
36+
end
37+
38+
add_index :schema_users, :email, unique: true
39+
add_index :schema_users, [:uid, :provider], unique: true
40+
add_index :schema_users, :reset_password_token, unique: true
41+
add_index :schema_users, :confirmation_token, unique: true
42+
add_index :schema_users, :unlock_token, unique: true
43+
end
44+
end

spec/dummy/db/schema.rb

+28-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
#
1111
# It's strongly recommended that you check this file into your version control system.
1212

13-
ActiveRecord::Schema.define(version: 2020_06_21_182414) do
13+
ActiveRecord::Schema.define(version: 2020_06_23_003142) do
1414

1515
create_table "admins", force: :cascade do |t|
1616
t.string "provider", default: "email", null: false
@@ -53,6 +53,33 @@
5353
t.index ["uid", "provider"], name: "index_guests_on_uid_and_provider", unique: true
5454
end
5555

56+
create_table "schema_users", force: :cascade do |t|
57+
t.string "provider", default: "email", null: false
58+
t.string "uid", default: "", null: false
59+
t.string "encrypted_password", default: "", null: false
60+
t.string "reset_password_token"
61+
t.datetime "reset_password_sent_at"
62+
t.boolean "allow_password_change", default: false
63+
t.string "confirmation_token"
64+
t.datetime "confirmed_at"
65+
t.datetime "confirmation_sent_at"
66+
t.datetime "current_sign_in_at"
67+
t.datetime "last_sign_in_at"
68+
t.string "last_sign_in_ip"
69+
t.string "current_sign_in_ip"
70+
t.integer "sign_in_count"
71+
t.string "name"
72+
t.string "email"
73+
t.text "tokens"
74+
t.datetime "created_at", precision: 6, null: false
75+
t.datetime "updated_at", precision: 6, null: false
76+
t.index "\"unlock_token\"", name: "index_schema_users_on_unlock_token", unique: true
77+
t.index ["confirmation_token"], name: "index_schema_users_on_confirmation_token", unique: true
78+
t.index ["email"], name: "index_schema_users_on_email", unique: true
79+
t.index ["reset_password_token"], name: "index_schema_users_on_reset_password_token", unique: true
80+
t.index ["uid", "provider"], name: "index_schema_users_on_uid_and_provider", unique: true
81+
end
82+
5683
create_table "users", force: :cascade do |t|
5784
t.string "provider", default: "email", null: false
5885
t.string "uid", default: "", null: false

spec/factories/schema_users.rb

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
FactoryBot.define do
2+
factory :schema_user do
3+
name { Faker::FunnyName.two_word_name }
4+
email { Faker::Internet.unique.email }
5+
password { Faker::Internet.password }
6+
7+
trait :confirmed do
8+
confirmed_at { Time.zone.now }
9+
end
10+
end
11+
end

spec/requests/user_controller_spec.rb

+16-8
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434
it 'raises an invalid resource_name error' do
3535
expect { post_request('/api/v1/failing') }.to raise_error(
3636
GraphqlDevise::Error,
37-
'Invalid resource_name `fail` provided to `graphql_context`. Possible values are: [:user, :admin, :guest, :users_customer].'
37+
'Invalid resource_name `fail` provided to `graphql_context`. Possible values are: [:user, :admin, :guest, :users_customer, :schema_user].'
3838
)
3939
end
4040
end
@@ -55,9 +55,17 @@
5555
context 'when user is authenticated' do
5656
let(:headers) { user.create_new_auth_token }
5757

58-
it 'allow to perform the query' do
58+
it 'allows to perform the query' do
5959
expect(json_response[:data][:privateField]).to eq('Field will always require authentication')
6060
end
61+
62+
context 'when using a SchemaUser' do
63+
let(:headers) { create(:schema_user, :confirmed).create_new_auth_token }
64+
65+
it 'allows to perform the query' do
66+
expect(json_response[:data][:privateField]).to eq('Field will always require authentication')
67+
end
68+
end
6169
end
6270

6371
context 'when user is not authenticated' do
@@ -75,7 +83,7 @@
7583
context 'when user is authenticated' do
7684
let(:headers) { user.create_new_auth_token }
7785

78-
it 'allow to perform the query' do
86+
it 'allows to perform the query' do
7987
expect(json_response[:data][:privateField]).to eq('Field will always require authentication')
8088
end
8189
end
@@ -105,7 +113,7 @@
105113
context 'when user is authenticated' do
106114
let(:headers) { user.create_new_auth_token }
107115

108-
it 'allow to perform the query' do
116+
it 'allows to perform the query' do
109117
expect(json_response[:data][:dummyMutation]).to eq('Necessary so GraphQL gem does not complain about empty mutation type')
110118
end
111119
end
@@ -125,7 +133,7 @@
125133
context 'when user is authenticated' do
126134
let(:headers) { user.create_new_auth_token }
127135

128-
it 'allow to perform the query' do
136+
it 'allows to perform the query' do
129137
expect(json_response[:data][:dummyMutation]).to eq('Necessary so GraphQL gem does not complain about empty mutation type')
130138
end
131139
end
@@ -160,7 +168,7 @@
160168
context 'when user is authenticated' do
161169
let(:headers) { user.create_new_auth_token }
162170

163-
it 'allow to perform the query' do
171+
it 'allows to perform the query' do
164172
expect(json_response[:data][:user]).to match(
165173
email: user.email,
166174
id: user.id
@@ -183,7 +191,7 @@
183191
context 'when user is authenticated' do
184192
let(:headers) { user.create_new_auth_token }
185193

186-
it 'allow to perform the query' do
194+
it 'allows to perform the query' do
187195
expect(json_response[:data][:user]).to match(
188196
email: user.email,
189197
id: user.id
@@ -193,7 +201,7 @@
193201

194202
context 'when user is not authenticated' do
195203
# Interpreter schema fields are public unless specified otherwise (plugin setting)
196-
it 'allow to perform the query' do
204+
it 'allows to perform the query' do
197205
expect(json_response[:data][:user]).to match(
198206
email: user.email,
199207
id: user.id

0 commit comments

Comments
 (0)