Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
31,869 Commits 242 Branches 502 Tags 901 MiB
Commit Graph

94 Commits

Author SHA1 Message Date
Blake Erickson f03b293e6a
FEATURE: Header based auth for API requests (#7129) 
Now you can also make authenticated API requests by passing the
`api_key` and `api_username` in the HTTP header instead of query params.

The new header values are: `Api-key` and `Api-Username`.

Here is an example in cURL:

``` text
curl -i -sS -X POST "http://127.0.0.1:3000/categories" \
  -H "Content-Type: multipart/form-data;" \
  -H "Api-Key: 7aa202bec1ff70563bc0a3d102feac0a7dd2af96b5b772a9feaf27485f9d31a2" \
  -H "Api-Username: system" \
  -F "name=7c1c0ed93583cba7124b745d1bd56b32" \
  -F "color=49d9e9" \
  -F "text_color=f0fcfd"
```

There is also support for `Api-User-Id` and `Api-User-External-Id`
instead of specifying the username along with the key.
 2019-03-08 09:13:31 -07:00
David Taylor fc7938f7e0
REFACTOR: Migrate GoogleOAuth2Authenticator to use ManagedAuthenticator (#7120) 
https://meta.discourse.org/t/future-social-authentication-improvements/94691/3
 2019-03-07 11:31:04 +00:00
Joffrey JAFFEUX 703c724cf3
REFACTOR: Migrate InstagramAuthenticator to use ManagedAuthenticator (#7081) 2019-03-04 14:54:28 +01:00
David Taylor b907924c93 FIX: ManagedAuthenticator should automatically update last_used time 2019-02-27 15:29:26 +00:00
Guo Xiang Tan 2fe9617dc1 Fix rubocop. 2019-01-22 18:37:55 +08:00
Guo Xiang Tan d32900292d FIX: Don't update `User#last_seen_at` when PG is in readonly take 3. 2019-01-22 18:07:48 +08:00
Guo Xiang Tan 3c6a8a2bb1 Partially revert 4466fcf1bc. 2019-01-21 15:41:01 +08:00
Guo Xiang Tan 4466fcf1bc FIX: Don't update `User#last_seen_at` when PG is readonly take 2. 2019-01-21 13:49:08 +08:00
Guo Xiang Tan c732ae9ca9 FIX: Don't update `User#last_seen_at` when PG is in readonly. 2019-01-21 13:29:29 +08:00
David Taylor 3fedb2ad20 DEV: Style and performance improvements 
Follow-up from 9db8291
 2018-12-11 09:58:20 +00:00
David Taylor 9db829134c
FIX: Use database to persist metadata during social registration (#6750) 
Previously was using the cookie_store, which is limited to 4kb. This caused issues for providers sending large volumes of metadata about a user.
 2018-12-10 15:10:06 +00:00
Sam 502a0fe778 FIX: support connecting GitHub with existing accounts 2018-12-10 09:27:00 +11:00
David Taylor 160d29b18a
REFACTOR: Migrate TwitterAuthenticator to use ManagedAuthenticator (#6739) 
No changes to functionality. TwitterAuthenticator goes from 136 lines to 24, and all twitter-specific logic elsewhere has been deleted 🎉
 2018-12-07 15:39:06 +00:00
David Taylor 86f8734bc0 FIX: Prioritize explicit 'connect' over matching by email 
This is an edge case that was previously handled by TwitterAuthenticator, but not FacebookAuthenticator.
 2018-12-07 15:05:51 +00:00
David Taylor 3cad3f9df1 DEV: Add profile fetching support to `ManagedAuthenticator` 2018-12-07 15:05:51 +00:00
David Taylor e117deb2ba FIX: Improve avatar loading, and add tests 
Follow-up from 4e2cc9c
 2018-12-04 15:09:32 +00:00
David Taylor 9248ad1905 DEV: Enable `Style/SingleLineMethods` and `Style/Semicolon` in Rubocop (#6717) 2018-12-04 11:48:13 +08:00
David Taylor 208005f9c9 REFACTOR: Migrate FacebookAuthenticator to use ManagedAuthenticator 
Changes to functionality
  - Removed syncing of user metadata including gender, location etc.
    These are no longer available to standard Facebook applications.
  - Removed the remote 'revoke' functionality. No other providers have
    it, and it does not appear to be standard practice in other apps.
  - The 'facebook_no_email' event is no longer logged. The system can
    cope fine with a missing email address.

Data is migrated to the new user_associated_accounts table.
facebook_user_infos can be dropped once we are confident the data has
been migrated successfully.
 2018-11-30 11:18:11 +00:00
David Taylor 534e1b1b18 DEV: Introduce Auth::ManagedAuthenticator 
A generic implementation of Auth::Authenticator which stores data in the
new UserAssociatedAccount model. This should help significantly reduce the duplicated
logic across different auth providers.
 2018-11-30 11:18:11 +00:00
David Taylor 56e0f47bcd FIX: Do not update `last_seen` for API access 
This regressed in 2dc3a50. I have now added tests for the behavior.
 2018-10-25 13:38:57 +01:00
Sam 45f01e637b FIX: when associating Github account disassociate others 
There are some cases where an email floats from one GitHub account to another
if this happens just take over the Github mapping record
 2018-10-10 15:46:50 +11:00
David Taylor ac89a728f8 DEV: Remove autospec hacks for social auth providers 
This was causing erratic test failures. Autospec continues to work after
removing, so this 5-year-old code is no longer needed.
 2018-10-09 12:42:57 +01:00
Guo Xiang Tan 3b337bfc6b Revert "FIX: Don't rate limit admin and staff constraints when matching routes." 
This reverts commit 651b50b1a1.
 2018-09-04 14:27:21 +08:00
Guo Xiang Tan 651b50b1a1 FIX: Don't rate limit admin and staff constraints when matching routes. 
* When an error is raised when checking route constraints, we
  can only return true/false which either lets the request
  through or return a 404 error. Therefore, we just skip
  rate limiting here and let the controller handle the
  rate limiting.
 2018-09-04 13:52:58 +08:00
Sam 272de95175 FIX: client duplicate registration should be cleaned up 
If for any reason we are unable to correct client id on a user api key
invalidate old keys for client/user
 2018-08-22 12:56:49 +10:00
David Taylor 5f1fd0019b FEATURE: Allow revoke and connect for GitHub logins 2018-07-27 17:18:53 +01:00
David Taylor 6296f63804 FEATURE: Revoke and connect for Yahoo logins 2018-07-27 16:20:47 +01:00
David Taylor 9c72c00206 FEATURE: Revoke and reconnect for Twitter logins 2018-07-27 12:28:51 +01:00
David Taylor fa399ce1c5 FEATURE: Add revoke and reconnect functionality for google logins 2018-07-25 16:03:14 +01:00
David Taylor eda1462b3b
FEATURE: List, revoke and reconnect associated accounts. Phase 1 (#6099) 
Listing connections is supported for all built-in auth providers. Revoke and reconnect is currently only implemented for Facebook.
 2018-07-23 16:51:57 +01:00
David Taylor 2dc3a50dac FIX: Do not update `last seen` time for suspended users 2018-07-18 16:04:57 +01:00
Guo Xiang Tan 7fc8a36529 DEV: Take 2 Queue jobs in tests by default. 
On my machine this cuts the time taken to run our test suite
from ~11mins to ~9mins.
 2018-05-31 16:23:23 +08:00
Guo Xiang Tan 56e9ff6853 Revert "DEV: Queue jobs in tests by default." 
Too risky for now

This reverts commit be28154d3b.
 2018-05-31 15:34:46 +08:00
Guo Xiang Tan be28154d3b DEV: Queue jobs in tests by default. 2018-05-31 14:45:47 +08:00
Guo Xiang Tan 543b7cddfb FIX: Extra comma resulted in Github auth email result being an array. 
https://meta.discourse.org/t/github-2fa-flow-broken/88674
 2018-05-30 12:15:12 +08:00
Sam d366f8d888 remove hack that destabliazed tese suite 2018-05-24 10:48:16 +10:00
OsamaSayegh f6d412465b FIX: apply automatic group rules when using social login providers 2018-05-23 02:26:07 +03:00
Régis Hanol 2cf6fb7359 FIX: always unstage users when they log in 2018-05-13 17:00:02 +02:00
Sam 3a06cb461e FEATURE: remove support for legacy auth tokens 2018-05-04 10:12:10 +10:00
Vinoth Kannan c5d26992d4 Prefer to use primary email for new user creation over other available emails 2018-03-19 17:10:35 +05:30
Sam 215c0d5569 FEATURE: allow system api to target users via external id or user id 
usage ?api_key=XYZ&api_user_external_id=ABC
usage ?api_key=XYZ&api_user_id=123
 2018-01-12 17:40:18 +11:00
Vinoth Kannan 988b13ac77 FIX: GitHub auth always asking to verify email for new users (#5487) 2018-01-12 15:17:29 +11:00
Sam 81b3a4a3da improve spec 2017-12-15 11:42:51 +11:00
Sam 67aecff59c FEATURE: store twitter supplied email for auditing 2017-12-14 15:54:32 +11:00
Guo Xiang Tan 6ade508f39 FIX: Prevent 'rack.input' missing error. 2017-12-12 16:40:35 +08:00
Sam 68d3c2c74f FEATURE: add global rate limiter for admin api 60 per minute 
Also move configuration of admin and user api rate limiting into global
settings. This is not intended to be configurable per site
 2017-12-11 11:07:22 +11:00
Sam dd70ef3abf Revert "Revert "PERF: improve speed of rate limiter"" 
This reverts commit 2373d85239.
 2017-12-04 21:23:11 +11:00
Sam 2373d85239 Revert "PERF: improve speed of rate limiter" 
This reverts commit a9bcdd7f27.
 2017-12-04 21:19:28 +11:00
Sam a9bcdd7f27 PERF: improve speed of rate limiter 
Also

- adds a global rate limiter option
- cleans up usage in tests
- fixes freeze_time so it handles clock_gettime
 2017-12-04 18:17:30 +11:00
Arpit Jalan 804b4f32f8 better error message when API authentication fails 2017-10-20 20:05:34 +05:30