blob: f10f7a1515aa9b14510f702a21775b100fecf246 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
|
module ActiveRecord
module SecureToken
extend ActiveSupport::Concern
module ClassMethods
# Example using #has_secure_token
#
# # Schema: User(token:string, auth_token:string)
# class User < ActiveRecord::Base
# has_secure_token
# has_secure_token :auth_token
# end
#
# user = User.new
# user.save
# user.token # => "pX27zsMN2ViQKta1bGfLmVJE"
# user.auth_token # => "77TMHrHJFvFDwodq8w7Ev2m7"
# user.regenerate_token # => true
# user.regenerate_auth_token # => true
#
# <tt>SecureRandom::base58</tt> is used to generate the 24-character unique token, so collisions are highly unlikely.
#
# A secure token can also be only created given a condition, for example if a user should only have an
# auto-generated invitation token if the user was invited:
#
# # Schema: User(token:string, invited:boolean)
# class User < ActiveRecord::Base
# has_secure_token if: :invited?
# end
#
# user = User.new(invited: true)
# user.save
# user.token # => "pX27zsMN2ViQKta1bGfLmVJE"
#
# user = User.new(invited: false)
# user.save
# user.token # => nil
#
# The secure token creation supports all the options a `before_create` does - like +:if+ and +:unless+.
#
# Note that it's still possible to generate a race condition in the database in the same way that
# {validates_uniqueness_of}[rdoc-ref:Validations::ClassMethods#validates_uniqueness_of] can.
# You're encouraged to add a unique index in the database to deal with this even more unlikely scenario.
def has_secure_token(attribute = :token, **before_create_options)
# Load securerandom only when has_secure_token is used.
require 'active_support/core_ext/securerandom'
define_method("regenerate_#{attribute}") { update! attribute => self.class.generate_unique_secure_token }
before_create(before_create_options) do
self.send("#{attribute}=", self.class.generate_unique_secure_token) unless self.send("#{attribute}?")
end
end
def generate_unique_secure_token
SecureRandom.base58(24)
end
end
end
end
|
