Merge pull request #2394 from FarmBot/staging

v15.4.14

app/controllers/api/tokens_controller.rb

@@ -20,7 +20,7 @@ def create
       # to log in with an unverified account (500 error).
       # Still not sure what changed or why, but this is a
       # temporary hotfix. Can be removed later if users
-      # are able to attempt logins on unverfied accounts.
+      # are able to attempt logins on unverified accounts.
       email = params.dig("user", "email")
       if needs_validation?(email)
         raise Errors::Forbidden, SessionToken::MUST_VERIFY
@@ -35,6 +35,16 @@ def create
       end
     end
 
+    def destroy
+      token = SessionToken.decode!(request.headers["Authorization"].split(" ").last)
+      claims = token.unencoded
+      device_id = claims["bot"].gsub("device_", "").to_i
+      TokenIssuance
+        .where("exp > ?", Time.now.to_i)
+        .find_by!(jti: claims["jti"], device_id: device_id)
+        .destroy!
+    end
+
     private
 
     def needs_validation?(email)

app/lib/session_token.rb

@@ -10,8 +10,6 @@ class SessionToken < AbstractJwtToken
   MQTT_WS = ENV["MQTT_WS"] || DEFAULT_MQTT_WS
   EXPIRY = 60.days
   VHOST = ENV.fetch("MQTT_VHOST") { "/" }
-  DEFAULT_OS = "https://api.github.com/repos/farmbot/farmbot_os/releases" +
-               "/latest"
 
   def self.issue_to(user,
                     iat: Time.now.to_i,

app/mutations/auth/from_jwt.rb

@@ -1,6 +1,4 @@
 module Auth
-  # The API supports a number of authentication strategies (Cookies, Bot token,
-  # JWT). This service helps determine which auth strategy to use.
   class FromJwt < Mutations::Command
     required { string :jwt }
 

app/mutations/auth/reload_token.rb

@@ -1,6 +1,4 @@
 module Auth
-  # The API supports a number of authentication strategies (Cookies, Bot token,
-  # JWT). This service helps determine which auth strategy to use.
   class ReloadToken < Mutations::Command
     attr_reader :user
     BAD_SUB = "Please log out and try again."

config/routes.rb

@@ -39,7 +39,7 @@
       fbos_config: [:destroy, :show, :update],
       firmware_config: [:destroy, :show, :update],
       public_key: [:show],
-      tokens: [:create, :show],
+      tokens: [:create, :destroy, :show],
       web_app_config: [:destroy, :show, :update],
     }.to_a.map { |(name, only)| resource name, only: only }
     get "/corpus" => "corpuses#show", as: :api_corpus

frontend/__tests__/logout_test.ts

@@ -0,0 +1,24 @@
+jest.mock("../session", () => ({ Session: { clear: jest.fn() } }));
+
+jest.mock("axios", () => ({ delete: jest.fn(() => Promise.resolve()) }));
+
+import axios from "axios";
+import { API } from "../api";
+import { logout } from "../logout";
+import { Session } from "../session";
+
+API.setBaseUrl("");
+
+describe("logout()", () => {
+  it("logs out", () => {
+    logout()();
+    expect(Session.clear).toHaveBeenCalled();
+    expect(axios.delete).toHaveBeenCalledWith("http://localhost/api/tokens/");
+  });
+
+  it("keeps token", () => {
+    logout(true)();
+    expect(Session.clear).toHaveBeenCalled();
+    expect(axios.delete).not.toHaveBeenCalled();
+  });
+});

frontend/css/sequences.scss

@@ -173,6 +173,7 @@
       .bp4-popover-wrapper {
         display: inline;
       }
+      .bp4-button-text,
       p {
         display: inline-block;
         width: max-content;
@@ -202,8 +203,18 @@
           font-size: 1rem !important;
         }
         .fa-caret-down {
+          right: 0;
+          line-height: 2.25rem;
           color: $white;
         }
+        .bp4-button {
+          padding-left: 0.5rem;
+        }
+        .bp4-button-text {
+          margin-left: 0;
+          padding-left: 0;
+          line-height: 1.5rem;
+        }
       }
       &.selected {
         border-bottom: 3px solid $dark_gray;

frontend/logout.ts

@@ -0,0 +1,9 @@
+import axios from "axios";
+import { noop } from "lodash";
+import { API } from "./api";
+import { Session } from "./session";
+
+export const logout = (keepToken = false) => () => {
+  !keepToken && axios.delete(API.current.tokensPath).then(noop, noop);
+  Session.clear();
+};

frontend/messages/__tests__/cards_test.tsx

@@ -39,6 +39,9 @@ import { push } from "../../history";
 import { buildResourceIndex } from "../../__test_support__/resource_index_builder";
 import { fakeWizardStepResult } from "../../__test_support__/fake_state/resources";
 import { Path } from "../../internal_urls";
+import { API } from "../../api";
+
+API.setBaseUrl("");
 
 describe("<AlertCard />", () => {
   const fakeProps = (): AlertCardProps => ({

frontend/messages/cards.tsx

@@ -24,14 +24,14 @@ import {
 import { updateConfig } from "../devices/actions";
 import { fetchBulletinContent, seedAccount } from "./actions";
 import { startCase } from "lodash";
-import { Session } from "../session";
 import { ExternalUrl } from "../external_urls";
 import { setupProgressString } from "../wizard/data";
 import { store } from "../redux/store";
 import { selectAllWizardStepResults } from "../resources/selectors_by_kind";
 import { push } from "../history";
 import moment from "moment";
 import { Path } from "../internal_urls";
+import { logout } from "../logout";
 
 export const AlertCard = (props: AlertCardProps) => {
   const { alert, timeSettings, findApiAlertById, dispatch } = props;
@@ -398,14 +398,14 @@ const DemoAccount = (props: CommonAlertCardProps) =>
     <p>
       {t(Content.MAKE_A_REAL_ACCOUNT)}&nbsp;
       <a href={ExternalUrl.myFarmBot} target="_blank" rel={"noreferrer"}
-        onClick={() => Session.clear()}
+        onClick={logout()}
         title={"my.farm.bot"}>
         {"my.farm.bot"}
       </a>.
     </p>
     <a className="link-button fb-button green"
       href={ExternalUrl.myFarmBot} target="_blank" rel={"noreferrer"}
-      onClick={() => Session.clear()}
+      onClick={logout()}
       title={t("Make a real account")}>
       {t("Make a real account")}
     </a>

frontend/nav/__tests__/additional_menu_test.tsx

@@ -1,40 +1,43 @@
 import React from "react";
 import { mount, shallow } from "enzyme";
 import { AdditionalMenu } from "../additional_menu";
+import { AccountMenuProps } from "../interfaces";
 
 describe("AdditionalMenu", () => {
+  const fakeProps = (): AccountMenuProps => ({
+    isStaff: false,
+    close: jest.fn(),
+  });
+
   it("renders the account menu", () => {
-    const wrapper = mount(<AdditionalMenu
-      logout={jest.fn()}
-      close={jest.fn()} />);
+    const wrapper = mount(<AdditionalMenu {...fakeProps()} />);
     const text = wrapper.text();
     expect(text).toContain("Account Settings");
     expect(text).toContain("Logout");
     expect(text).toContain("VERSION");
+    expect(text).not.toContain("destroy token");
+  });
+
+  it("renders the account menu as staff", () => {
+    const p = fakeProps();
+    p.isStaff = true;
+    const wrapper = mount(<AdditionalMenu {...p} />);
+    const text = wrapper.text();
+    expect(text).toContain("Account Settings");
+    expect(text).toContain("destroy token");
   });
 
   it("closes the account menu upon nav", () => {
     const close = jest.fn();
-    const wrapper = shallow(<AdditionalMenu
-      logout={jest.fn()}
-      close={(x) => () => close(x)} />);
+    const p = fakeProps();
+    p.close = x => () => close(x);
+    const wrapper = shallow(<AdditionalMenu {...p} />);
     wrapper.find("Link").first().simulate("click");
     expect(close).toHaveBeenCalledWith("accountMenuOpen");
   });
 
-  it("logs out", () => {
-    const logout = jest.fn();
-    const wrapper = shallow(<AdditionalMenu
-      logout={logout}
-      close={jest.fn()} />);
-    wrapper.find("a").at(0).simulate("click");
-    expect(logout).toHaveBeenCalled();
-  });
-
   it("navigates to help page", () => {
-    const wrapper = shallow(<AdditionalMenu
-      logout={jest.fn()}
-      close={jest.fn()} />);
+    const wrapper = shallow(<AdditionalMenu {...fakeProps()} />);
     wrapper.find("Link").at(3).simulate("click");
   });
 });

frontend/nav/__tests__/index_test.tsx

@@ -2,8 +2,6 @@ jest.mock("../../devices/timezones/guess_timezone", () => ({
   maybeSetTimezone: jest.fn()
 }));
 
-jest.mock("../../session", () => ({ Session: { clear: jest.fn() } }));
-
 jest.mock("../../api/crud", () => ({ refresh: jest.fn() }));
 
 import React from "react";
@@ -16,7 +14,6 @@ import { maybeSetTimezone } from "../../devices/timezones/guess_timezone";
 import { fakeTimeSettings } from "../../__test_support__/fake_time_settings";
 import { fakePings } from "../../__test_support__/fake_state/pings";
 import { Link } from "../../link";
-import { Session } from "../../session";
 import { refresh } from "../../api/crud";
 import { push } from "../../history";
 import { fakeHelpState } from "../../__test_support__/fake_designer_state";
@@ -75,12 +72,6 @@ describe("<NavBar />", () => {
     expect(wrapper.text().toLowerCase()).toContain("menu");
   });
 
-  it("logs out", () => {
-    const wrapper = mount<NavBar>(<NavBar {...fakeProps()} />);
-    wrapper.instance().logout();
-    expect(Session.clear).toHaveBeenCalled();
-  });
-
   it("toggles state value", () => {
     const wrapper = shallow<NavBar>(<NavBar {...fakeProps()} />);
     expect(wrapper.state().mobileMenuOpen).toEqual(false);

frontend/nav/additional_menu.tsx

@@ -5,6 +5,7 @@ import { shortRevision } from "../util";
 import { t } from "../i18next_wrapper";
 import { ExternalUrl } from "../external_urls";
 import { FilePath, Icon, Path } from "../internal_urls";
+import { logout } from "../logout";
 
 export const AdditionalMenu = (props: AccountMenuProps) => {
   return <div className="nav-additional-menu">
@@ -34,11 +35,17 @@ export const AdditionalMenu = (props: AccountMenuProps) => {
       </Link>
     </div>
     <div className={"logout-link"}>
-      <a onClick={props.logout} title={t("logout")}>
+      <a onClick={logout(props.isStaff)} title={t("logout")}>
         <img width={12} height={12} src={FilePath.icon(Icon.logout)} />
         {t("Logout")}
       </a>
     </div>
+    {props.isStaff && <div className={"logout-link"}>
+      <a onClick={logout()} title={t("logout")}>
+        <img width={12} height={12} src={FilePath.icon(Icon.logout)} />
+        {t("Logout and destroy token")}
+      </a>
+    </div>}
     <div className="app-version">
       <label>{t("APP VERSION")}</label>:&nbsp;
       <a href={ExternalUrl.webAppRepo} target="_blank" rel={"noreferrer"}>

frontend/nav/index.tsx

@@ -1,7 +1,6 @@
 import React from "react";
 import { NavBarProps, NavBarState } from "./interfaces";
 import { EStopButton } from "./e_stop_btn";
-import { Session } from "../session";
 import { Row, Col, Popover } from "../ui";
 import { push } from "../history";
 import { updatePageInfo } from "../util";
@@ -49,7 +48,7 @@ export class NavBar extends React.Component<NavBarProps, Partial<NavBarState>> {
     }
   };
 
-  logout = () => Session.clear();
+  get isStaff() { return this.props.authAud == "staff"; }
 
   toggle = (key: keyof NavBarState) => () =>
     this.setState({ [key]: !this.state[key] });
@@ -89,7 +88,7 @@ export class NavBar extends React.Component<NavBarProps, Partial<NavBarState>> {
           onClick={this.toggle("accountMenuOpen")}>
           {firstName}
         </div>}
-        content={<AdditionalMenu logout={this.logout} close={this.close} />} />
+        content={<AdditionalMenu close={this.close} isStaff={this.isStaff} />} />
     </div>;
   };
 
@@ -199,7 +198,7 @@ export class NavBar extends React.Component<NavBarProps, Partial<NavBarState>> {
     return <ErrorBoundary>
       <div className={[
         "nav-wrapper",
-        this.props.authAud == "staff" ? "red" : "",
+        this.isStaff ? "red" : "",
       ].join(" ")}>
         <nav role="navigation">
           <Row>

frontend/nav/interfaces.ts

@@ -61,8 +61,8 @@ export interface NavLinksProps {
 }
 
 export interface AccountMenuProps {
+  isStaff: boolean;
   close: (property: keyof NavBarState) => ToggleEventHandler;
-  logout: () => void;
 }
 
 export interface EStopButtonProps {

spec/controllers/api/tokens/tokens_controller_destroy_spec.rb

@@ -0,0 +1,29 @@
+require "spec_helper"
+
+describe Api::TokensController do
+  include Devise::Test::ControllerHelpers
+
+  describe "#destroy" do
+    let(:user) { FactoryBot.create(:user, password: "password") }
+    let(:device) { FactoryBot.create(:device) }
+    let(:auth_token) do
+      SessionToken.issue_to(user,
+                            fbos_version: Gem::Version.new("9.9.9"),
+                            iat: Time.now.to_i,
+                            exp: 40.days.from_now.to_i)
+    end
+
+    it "destroys a token" do
+      user.device = device
+      request.headers["Authorization"] = "bearer #{auth_token.encoded}"
+      delete :destroy
+      expect(response.status).to eq(204)
+    end
+
+    it "denies bad tokens" do
+      request.headers["Authorization"] = "bearer nope"
+      delete :destroy
+      expect(response.status).to eq(401)
+    end
+  end
+end