Demo Stomplet that shows how to use a session token for auth

demo_stomplet.rb

require 'torquebox-stomp'

class DemoStomplet
  def initialize()
    super
    @subscribers = []

    # passthrough for local messages to skip auth
    @passthrough_code = "e32f53ac7569ae3a1f692177"
  end

  def configure(stomplet_config)
  end

  def on_message(stomp_message, session)
    Rails.logger.debug( "[DemoStomplet] Message - #{stomp_message.getContentAsString()} - #{stomp_message.headers.inspect} - #{session.getAttributeNames().map { |x| x.to_s}}")

    token = session[:authentication_token]||stomp_message.headers['authentication_token']

    if is_authenticated?( token )
      @subscribers.each do |subscriber|
        subscriber.send( stomp_message )
      end
    end
  end

  def on_subscribe(subscriber)
    session = subscriber.session
    if is_authenticated?(session[:authentication_token])
      Rails.logger.debug( "[DemoStomplet] Sub - #{subscriber.getId()} - #{session.getAttributeNames().map { |x| x.to_s}}}")
      @subscribers << subscriber
    end
  end
 
  def on_unsubscribe(subscriber)
    session = subscriber.session
    if is_authenticated?(session[:authentication_token])
      Rails.logger.debug( "[DemoStomplet] Unsub - #{subscriber.getId()} - #{session.getAttributeNames().map { |x| x.to_s}}}")
      @subscribers.delete( subscriber )
    end
  end

  # Checks to see if the token matchs the pass through
  # else checks to see if a User has the authentication token
  def is_authenticated?(token)
    allowed = false
    if @passthrough_code == token
      allowed = true
    else
      allowed = !User.where( authentication_token: token ).empty?
    end

    allowed
  end
end