samueljmurray

defmodule YayCorp.API.UserController do
  use YayCorp.Web, :controller
  use Guardian.Phoenix.Controller

  alias YayCorp.{User, UserAuth, Repo}

  def show(conn, %{"id" => id}, user_auth, _claims) do
    requested_user = Repo.get!(User, id)

    # users can only retrieve their own details

samueljmurray

defmodule YayCorp.GuardianSerializer do
  @behaviour Guardian.Serializer

  alias YayCorp.{Repo, UserAuth}

  def for_token(user_auth = %UserAuth{}), do: { :ok, "UserAuth:#{user_auth.id}" }
  def for_token(_), do: { :error, "Unknown resource type" }

  def from_token("UserAuth:" <> id), do: { :ok, Repo.get(UserAuth, id) }
  def from_token(_), do: { :error, "Unknown resource type" }

samueljmurray

config :guardian_db, GuardianDb,
  repo: YayCorp.Repo,
  sweep_interval: 60

samueljmurray

defmodule YayCorp.Router do
  use YayCorp.Web, :router
  
  pipeline :api do
    plug :accepts, ["json"]
  end

  pipeline :authenticated_api do
    plug Guardian.Plug.VerifyHeader, realm: "Bearer"
    plug Guardian.Plug.LoadResource

samueljmurray

defp authorized_employee(conn, user_auth) do
  conn = Guardian.Plug.api_sign_in(conn, user_auth, :access, perms: %{employee: [:full]})
  jwt = Guardian.Plug.current_token(conn)

  conn
  |> put_status(201)
  |> render(UserView, "show.json", user: user_auth.user, jwt: jwt)
end

samueljmurray

defp authorized_anon(conn, user_auth) do
  conn = Guardian.Plug.api_sign_in(conn, user_auth, :access)
  jwt = Guardian.Plug.current_token(conn)

  conn
  |> put_status(201)
  |> render(UserAuthView, "show.json", jwt: jwt)
end

samueljmurray

def anon?(%__MODULE__{user_id: nil}), do: true
def anon?(_), do: false

samueljmurray

schema "user_auths" do
  field :method, :string
  field :remote_id, :string
  field :auth0_id, :string

  belongs_to :user, User
  has_many :devices, Device

  timestamps
end

samueljmurray

schema "users" do
  field :phone_number, :string
  field :first_name, :string
  field :last_name, :string
  field :display_name, :string
  field :employee_id, :string
  field :disabled_at, Ecto.DateTime
  field :disabled, :boolean, virtual: true

  has_one :user_auth, UserAuth, on_replace: :delete

samueljmurray

defp login_with_auth0_token(conn, decoded_jwt) do
  case get_user_auth(decoded_jwt) do
    nil -> server_error(conn)
    user_auth ->
      cond do
        UserAuth.anon?(user_auth) ->
          authorized_anon(conn, user_auth)
        User.enabled?(user_auth.user) ->
          authorized_employee(conn, user_auth)
        true ->