Fixes #37936 - Invalidate jwt for any user or users(API) #10397
Conversation
girijaasoni
changed the title
| end | ||
| end | ||
|
|
||
| api :DELETE, '/users/:id/registration_tokens', N_("Invalidate all JSON Web Tokens (JWTs) for a specific user.") |
There was a problem hiding this comment.
| api :DELETE, '/users/:id/registration_tokens', N_("Invalidate all JSON Web Tokens (JWTs) for a specific user.") | |
| api :DELETE, '/users/:id/registration_tokens', N_("Invalidate all registration tokens for a specific user.") |
girijaasoni
force-pushed
the
jwt-api
branch
2 times, most recently
from
28cdc1b to
85928e7
Compare
|
|
||
| class Api::V2::RegistrationTokensControllerTest < ActionController::TestCase | ||
| test 'user shall invalidate tokens for self' do | ||
| user = User.create :login => "foo", :mail => "[email protected]", :auth_source => auth_sources(:one) |
There was a problem hiding this comment.
You can use FactoryBot.create(:user) here.
| class Api::V2::RegistrationTokensControllerTest < ActionController::TestCase | ||
| test 'user shall invalidate tokens for self' do | ||
| user = User.create :login => "foo", :mail => "[email protected]", :auth_source => auth_sources(:one) | ||
| FactoryBot.build(:jwt_secret, token: 'test_jwt_secret', user: user) |
There was a problem hiding this comment.
You probably want to create the token as part of the user creation, and use the create method - to make sure the token is saved before the action.
| end | ||
|
|
||
| def find_resource(permission = :view_users) | ||
| editing_self? ? User.find(User.current.id) : User.authorized(permission).except_hidden.find(params[:id]) |
There was a problem hiding this comment.
@ekohl what do you think, should we block changes to hidden accounts here?
|
@girijaasoni In the UI PR, we used the term |
@nofaralfasi , we can handle that in the documentation. Registration tokens make more sense from user POV(specially from API POV), as we are creating a new controller. For UI, we are trying to use the existing controller where jwt is used as phrasing. |
girijaasoni
force-pushed
the
jwt-api
branch
7 times, most recently
from
8858b6c to
6d841de
Compare
| raise ::Foreman::Exception.new(N_("No record found for %s"), params[:id]) | ||
| end | ||
| @user.jwt_secret&.destroy | ||
| process_success _('Successfully invalidated JWTs for %s.' % @user.login) |
There was a problem hiding this comment.
@girijaasoni Can we add a newline here as well?
|
@girijaasoni invalidate token for other users doesn't work for invalidating self token. Can we fix that too? |
Link to UI PR: #10357