Chris@1295: # Redmine - project management software
Chris@1295: # Copyright (C) 2006-2013  Jean-Philippe Lang
Chris@1295: #
Chris@1295: # This program is free software; you can redistribute it and/or
Chris@1295: # modify it under the terms of the GNU General Public License
Chris@1295: # as published by the Free Software Foundation; either version 2
Chris@1295: # of the License, or (at your option) any later version.
Chris@1295: #
Chris@1295: # This program is distributed in the hope that it will be useful,
Chris@1295: # but WITHOUT ANY WARRANTY; without even the implied warranty of
Chris@1295: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
Chris@1295: # GNU General Public License for more details.
Chris@1295: #
Chris@1295: # You should have received a copy of the GNU General Public License
Chris@1295: # along with this program; if not, write to the Free Software
Chris@1295: # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
Chris@1295: 
Chris@1295: class Token < ActiveRecord::Base
Chris@1295:   belongs_to :user
Chris@1295:   validates_uniqueness_of :value
Chris@1295: 
Chris@1295:   before_create :delete_previous_tokens, :generate_new_token
Chris@1295: 
Chris@1295:   @@validity_time = 1.day
Chris@1295: 
Chris@1295:   def generate_new_token
Chris@1295:     self.value = Token.generate_token_value
Chris@1295:   end
Chris@1295: 
Chris@1295:   # Return true if token has expired
Chris@1295:   def expired?
Chris@1295:     return Time.now > self.created_on + @@validity_time
Chris@1295:   end
Chris@1295: 
Chris@1295:   # Delete all expired tokens
Chris@1295:   def self.destroy_expired
Chris@1295:     Token.delete_all ["action NOT IN (?) AND created_on < ?", ['feeds', 'api'], Time.now - @@validity_time]
Chris@1295:   end
Chris@1295: 
Chris@1295:   # Returns the active user who owns the key for the given action
Chris@1295:   def self.find_active_user(action, key, validity_days=nil)
Chris@1295:     user = find_user(action, key, validity_days)
Chris@1295:     if user && user.active?
Chris@1295:       user
Chris@1295:     end
Chris@1295:   end
Chris@1295: 
Chris@1295:   # Returns the user who owns the key for the given action
Chris@1295:   def self.find_user(action, key, validity_days=nil)
Chris@1295:     token = find_token(action, key, validity_days)
Chris@1295:     if token
Chris@1295:       token.user
Chris@1295:     end
Chris@1295:   end
Chris@1295: 
Chris@1295:   # Returns the token for action and key with an optional
Chris@1295:   # validity duration (in number of days)
Chris@1295:   def self.find_token(action, key, validity_days=nil)
Chris@1295:     action = action.to_s
Chris@1295:     key = key.to_s
Chris@1295:     return nil unless action.present? && key =~ /\A[a-z0-9]+\z/i
Chris@1295: 
Chris@1295:     token = Token.where(:action => action, :value => key).first
Chris@1295:     if token && (token.action == action) && (token.value == key) && token.user
Chris@1295:       if validity_days.nil? || (token.created_on > validity_days.days.ago)
Chris@1295:         token
Chris@1295:       end
Chris@1295:     end
Chris@1295:   end
Chris@1295: 
Chris@1295:   def self.generate_token_value
Chris@1295:     Redmine::Utils.random_hex(20)
Chris@1295:   end
Chris@1295: 
Chris@1295:   private
Chris@1295: 
Chris@1295:   # Removes obsolete tokens (same user and action)
Chris@1295:   def delete_previous_tokens
Chris@1295:     if user
Chris@1295:       Token.delete_all(['user_id = ? AND action = ?', user.id, action])
Chris@1295:     end
Chris@1295:   end
Chris@1295: end