ApiController: check token validity for a given admin

app/controllers/api_controller.rb

@@ -16,6 +16,10 @@ class APIController < ApplicationController
 
   protected
 
+  def valid_token_for_administrateur?(administrateur)
+    administrateur.valid_api_token?(token)
+  end
+
   def default_format_json
     request.format = "json" if !request.params[:format]
   end
@@ -26,6 +30,10 @@ class APIController < ApplicationController
     end
   end
 
+  def token
+    params_token.presence || header_token
+  end
+
   def header_token
     received_token = nil
     authenticate_with_http_token do |token, _options|
@@ -33,4 +41,8 @@ class APIController < ApplicationController
     end
     received_token
   end
+
+  def params_token
+    params[:token]
+  end
 end

app/models/administrateur.rb

@@ -43,6 +43,12 @@ class Administrateur < ApplicationRecord
     api_token
   end
 
+  def valid_api_token?(api_token)
+    BCrypt::Password.new(encrypted_token) == api_token
+  rescue BCrypt::Errors::InvalidHash
+    false
+  end
+
   def registration_state
     if active?
       'Actif'

spec/controllers/api_controller_spec.rb

@@ -1,55 +1,38 @@
 require 'spec_helper'
 
 describe APIController, type: :controller do
-  controller(APIController) do
+  describe 'valid_token_for_administrateur?' do
-    def show
+    let!(:admin) { create(:administrateur) }
-      render json: {}, satus: 200
-    end
 
-    def index
+    subject { controller.send(:'valid_token_for_administrateur?', admin) }
-      render json: {}, satus: 200
+
+    context 'when the admin has not any token' do
+      context 'and the token is not given' do
+        it { is_expected.to be false }
       end
     end
 
-  describe 'GET index' do
+    context 'when the admin has a token' do
-    let!(:administrateur) { create(:administrateur) }
+      let!(:token) { admin.renew_api_token }
-    let!(:administrateur_with_token) { create(:administrateur, :with_api_token) }
 
-    context 'when token is missing' do
+      context 'and the token is given by params' do
-      subject { get :index }
+        before { controller.params[:token] = token }
 
-      it { expect(subject.status).to eq(401) }
+        it { is_expected.to be true }
       end
 
-    context 'when token is empty' do
+      context 'and the token is given by header' do
-      subject { get :index, params: { token: nil } }
-
-      it { expect(subject.status).to eq(401) }
-    end
-
-    context 'when token does not exist' do
-      let(:token) { 'invalid_token' }
-
-      subject { get :index, params: { token: token } }
-
-      it { expect(subject.status).to eq(401) }
-    end
-
-    context 'when token exist in the params' do
-      subject { get :index, params: { token: administrateur_with_token.api_token } }
-
-      it { expect(subject.status).to eq(200) }
-    end
-
-    context 'when token exist in the header' do
         before do
-        valid_headers = { 'Authorization' => "Bearer token=#{administrateur_with_token.api_token}" }
+          valid_headers = { 'Authorization' => "Bearer token=#{token}" }
           request.headers.merge!(valid_headers)
         end
 
-      subject { get(:index) }
+        it { is_expected.to be true }
+      end
 
-      it { expect(subject.status).to eq(200) }
+      context 'and the token is not given' do
+        it { is_expected.to be false }
+      end
     end
   end
 end