Administrateur: do not save api_token in clear text anymore

This commit is contained in:
simon lehericey 2018-09-26 17:22:36 +02:00
parent 16566b46c0
commit 88f7e888c3
3 changed files with 7 additions and 14 deletions

View file

@ -39,7 +39,7 @@ class Administrateur < ApplicationRecord
def renew_api_token def renew_api_token
api_token = Administrateur.generate_unique_secure_token api_token = Administrateur.generate_unique_secure_token
encrypted_token = BCrypt::Password.create(api_token) encrypted_token = BCrypt::Password.create(api_token)
update(api_token: api_token, encrypted_token: encrypted_token) update(encrypted_token: encrypted_token)
api_token api_token
end end

View file

@ -33,21 +33,15 @@ describe Administrateur, type: :model do
end end
describe "#renew_api_token" do describe "#renew_api_token" do
let(:administrateur) { create(:administrateur) } let!(:administrateur) { create(:administrateur) }
let!(:token) { administrateur.renew_api_token }
before do it { expect(BCrypt::Password.new(administrateur.encrypted_token)).to eq(token) }
administrateur.renew_api_token
administrateur.reload
end
it { expect(administrateur.api_token).to be_present }
it { expect(administrateur.api_token).not_to eq(administrateur.encrypted_token) }
it { expect(BCrypt::Password.new(administrateur.encrypted_token)).to eq(administrateur.api_token) }
context 'when it s called twice' do context 'when it s called twice' do
let!(:previous_token) { administrateur.api_token } let!(:new_token) { administrateur.renew_api_token }
it { expect(previous_token).not_to eq(administrateur.renew_api_token) } it { expect(new_token).not_to eq(token) }
end end
end end

View file

@ -1,8 +1,7 @@
require 'spec_helper' require 'spec_helper'
describe 'admin/gestionnaires/index.html.haml', type: :view do describe 'admin/gestionnaires/index.html.haml', type: :view do
let(:token) { 'super_token' } let(:admin) { create(:administrateur) }
let(:admin) { create(:administrateur, api_token: token) }
before do before do
assign(:gestionnaires, (smart_listing_create :gestionnaires, assign(:gestionnaires, (smart_listing_create :gestionnaires,