Chris@1494: # Redmine - project management software
Chris@1494: # Copyright (C) 2006-2014  Jean-Philippe Lang
Chris@1494: #
Chris@1494: # This program is free software; you can redistribute it and/or
Chris@1494: # modify it under the terms of the GNU General Public License
Chris@1494: # as published by the Free Software Foundation; either version 2
Chris@1494: # of the License, or (at your option) any later version.
Chris@1494: #
Chris@1494: # This program is distributed in the hope that it will be useful,
Chris@1494: # but WITHOUT ANY WARRANTY; without even the implied warranty of
Chris@1494: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
Chris@1494: # GNU General Public License for more details.
Chris@1494: #
Chris@1494: # You should have received a copy of the GNU General Public License
Chris@1494: # along with this program; if not, write to the Free Software
Chris@1494: # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
Chris@1494: 
Chris@1494: class Token < ActiveRecord::Base
Chris@1494:   belongs_to :user
Chris@1494:   validates_uniqueness_of :value
Chris@1494: 
Chris@1494:   before_create :delete_previous_tokens, :generate_new_token
Chris@1494: 
Chris@1494:   @@validity_time = 1.day
Chris@1494: 
Chris@1494:   def generate_new_token
Chris@1494:     self.value = Token.generate_token_value
Chris@1494:   end
Chris@1494: 
Chris@1494:   # Return true if token has expired
Chris@1494:   def expired?
Chris@1494:     return Time.now > self.created_on + @@validity_time
Chris@1494:   end
Chris@1494: 
Chris@1494:   # Delete all expired tokens
Chris@1494:   def self.destroy_expired
Chris@1494:     Token.delete_all ["action NOT IN (?) AND created_on < ?", ['feeds', 'api'], Time.now - @@validity_time]
Chris@1494:   end
Chris@1494: 
Chris@1494:   # Returns the active user who owns the key for the given action
Chris@1494:   def self.find_active_user(action, key, validity_days=nil)
Chris@1494:     user = find_user(action, key, validity_days)
Chris@1494:     if user && user.active?
Chris@1494:       user
Chris@1494:     end
Chris@1494:   end
Chris@1494: 
Chris@1494:   # Returns the user who owns the key for the given action
Chris@1494:   def self.find_user(action, key, validity_days=nil)
Chris@1494:     token = find_token(action, key, validity_days)
Chris@1494:     if token
Chris@1494:       token.user
Chris@1494:     end
Chris@1494:   end
Chris@1494: 
Chris@1494:   # Returns the token for action and key with an optional
Chris@1494:   # validity duration (in number of days)
Chris@1494:   def self.find_token(action, key, validity_days=nil)
Chris@1494:     action = action.to_s
Chris@1494:     key = key.to_s
Chris@1494:     return nil unless action.present? && key =~ /\A[a-z0-9]+\z/i
Chris@1494: 
Chris@1494:     token = Token.where(:action => action, :value => key).first
Chris@1494:     if token && (token.action == action) && (token.value == key) && token.user
Chris@1494:       if validity_days.nil? || (token.created_on > validity_days.days.ago)
Chris@1494:         token
Chris@1494:       end
Chris@1494:     end
Chris@1494:   end
Chris@1494: 
Chris@1494:   def self.generate_token_value
Chris@1494:     Redmine::Utils.random_hex(20)
Chris@1494:   end
Chris@1494: 
Chris@1494:   private
Chris@1494: 
Chris@1494:   # Removes obsolete tokens (same user and action)
Chris@1494:   def delete_previous_tokens
Chris@1494:     if user
Chris@1494:       Token.delete_all(['user_id = ? AND action = ?', user.id, action])
Chris@1494:     end
Chris@1494:   end
Chris@1494: end