Sign-up e Login via custom API - Funzionerà correttamente?

Sviluppatore
1

Nel nostro caso, abbiamo la necessità di utilizzare Discourse esclusivamente come backend (più o meno come un CMS).

Ho esposto le rotte per la registrazione e l’accesso utilizzando:

skip_before_action :redirect_to_login_if_required, raise: false
skip_before_action :verify_authenticity_token, raise: false

… e ho abilitato le rotte in api_parameter_allowed?. Nella versione finale applicherò un tipo di salt per aggiungere un po’ di sicurezza, ma al momento si tratta solo di una bozza.

… e ho utilizzato il codice sottostante.

Tutto ciò che desidero sapere è se ho dimenticato qualcosa. In futuro probabilmente effettueremo l’accesso con Google, forse anche con Apple, e questo flusso mi permetterebbe di non aprire affatto un browser per le procedure di registrazione e accesso tramite email.

2

I’ve figured out how to do the sign up and login all via API and hopefully everything is fine.

I use this to create a user

      normalized_username = User.normalize_username(username)
    rescue
      normalized_username = nil
    end
    raise PluginError.new(:invalid_signup_username) if !normalized_username.present? || User.username_exists?(normalized_username) || User.reserved_username?(normalized_username)

    # Try like this
    raise PluginError.new(:invalid_signup_email) if (existing_user = User.find_by_email(email))

    begin
      new_user = User.new
      new_user.name = first_name
      new_user.email = email
      new_user.password = password
      new_user.username = username
      new_user.active = false
      new_user.approved = true
      new_user.approved_by_id = -1
      new_user.approved_at = DateTime.now

      new_user.password_required!

      new_user.save

      new_user.email_tokens.create(email: email) unless new_user.email_tokens.active.exists?
      if (email_token = new_user.email_tokens.active.where(email: email)&.first)
        EmailToken.confirm(email_token.token, skip_reviewable: true)
      end

      new_user.update!(active: true)
    rescue => e
      raise e
    end

I use this to sign up a user

new_user = self.class.commit_user_to_db(first_name, email, password, username)

    raise PluginError.new(:error_creating_user_discourse) unless new_user.present? && new_user.is_a?(User) && new_user.approved?

    user_api_key = UserApiKey.create!(
      application_name: "#{application_name}-v#{version}",
      client_id: client_id,
      user_id: new_user.id,
      push_url: "https://api.discourse.org/api/publish_#{platform === Constants::PLATFORMS[:ios] ? 'ios' : ''}#{platform === Constants::PLATFORMS[:android] ? 'android' : ''}",
      scopes: %w[notifications session_info read write message_bus push]
    )

I get the user api key using

    email = params[:email]&.to_s
    password = params[:password]&.to_s

    return render json: PluginError.new(:invalid_login_email) unless email.present?
    return render json: PluginError.new(:invalid_login_password) unless password.present?

    user = User.joins(:user_emails).where({ user_emails: { email: email } })&.first
    return render json: PluginError.new(:invalid_login_email) unless user.present?

    return render json: PluginError.new(:invalid_login_password) unless user.confirm_password?(password)

    #destroy any old keys we had for this client_id
    UserApiKey.where(user_id: user.id, client_id: client_id).destroy_all

    user_api_key = UserApiKey.create!(
      application_name: "#{application_name}-v#{version}",
      client_id: client_id,
      user_id: user.id,
      push_url: "https://api.discourse.org/api/publish_#{platform === Constants::PLATFORMS[:ios] ? 'ios' : ''}#{platform === Constants::PLATFORMS[:android] ? 'android' : ''}",
      scopes: %w[notifications session_info read write message_bus push]
    )

Is this ok from discourse POV?
Our users will never go on the website, and we want to hide it from all places.