class WarpEngine::ApplicationToken

A bearer credential (table application_tokens). Only the SHA-256 digest and the first eight characters (token_prefix) are stored; the plain token exists only on the instance that created it (plain_token).

scopes says what the token may do: update and upload for the CI’s /build endpoints, catalog for a signed-in client, and the Admin API scopes. The polymorphic owner must be of a class the host configured (application token, access token or Admin API owner class), and admin scopes need the Admin API owner class. An unrestricted token is exempt from software ownership checks. Revoking soft-deletes it (WarpEngine::SoftDeletable); the active scope holds the kept, unexpired tokens.

Constants

ADMIN_READ_SCOPE: Admin API read scope (WarpEngine::AdminApi::Scopes::READ).
ADMIN_SCOPES: Every Admin API scope (WarpEngine::AdminApi::Scopes::ALL).
ADMIN_TOKENS_SCOPE: Admin API token management scope (WarpEngine::AdminApi::Scopes::TOKENS).
ADMIN_WRITE_SCOPE: Admin API write scope (WarpEngine::AdminApi::Scopes::WRITE).
CATALOG_SCOPE: Scope of a client signed in through the device grant, read by the catalog API.
UPDATE_SCOPE: Scope for POST /build/publish and triggering CI pipelines.
UPLOAD_SCOPE: Scope for POST /build/upload.

Attributes

plain_token [R]

The plain token, set only on the instance that generated it on create; nil on records loaded from the database.

Public Class Methods

authenticate (token, required_scope: nil)

Source

# File app/models/warp_engine/application_token.rb, line 70
def self.authenticate(token, required_scope: nil)
  return nil if token.blank?

  record = active.find_by(token_digest: digest(token))
  return nil if record.nil?
  return nil if required_scope.present? && !Array(record.scopes).include?(required_scope)

  record
end

Finds the active token whose digest matches the plain token.

required_scope: a scope the token must carry, or nil for any

Returns the WarpEngine::ApplicationToken, or nil when token is blank, unknown, revoked, expired or lacks the scope.

digest (token)

Source

# File app/models/warp_engine/application_token.rb, line 60
def self.digest(token)
  Digest::SHA256.hexdigest(token)
end

Returns the SHA-256 hex digest of token, the form stored in token_digest.

ransackable_associations (auth_object = nil)

Source

# File app/models/warp_engine/application_token.rb, line 112
def self.ransackable_associations(auth_object = nil)
  []
end

Allows no association in Ransack searches.

Public Instance Methods

admin? ()

Source

# File app/models/warp_engine/application_token.rb, line 81
def admin?
  Array(scopes).intersect?(ADMIN_SCOPES)
end

Returns whether the token carries any Admin API scope.

expired? ()

Source

# File app/models/warp_engine/application_token.rb, line 86
def expired?
  expires_at.present? && expires_at <= Time.current
end

Returns whether expires_at is set and has passed.

revoke! ()

Source

# File app/models/warp_engine/application_token.rb, line 91
def revoke!
  soft_delete!
end

Revokes the token by soft-deleting it.

scopes_string ()

Source

# File app/models/warp_engine/application_token.rb, line 101
def scopes_string
  Array(scopes).join(", ")
end

Returns the scopes as a comma-separated string, for forms.

scopes_string= (value)

Source

# File app/models/warp_engine/application_token.rb, line 107
def scopes_string=(value)
  self.scopes = value.to_s.split(",").map(&:strip).reject(&:blank?).uniq
end

Sets scopes from a comma-separated string, stripped, without blanks and duplicates.

touch_last_used! ()

Source

# File app/models/warp_engine/application_token.rb, line 96
def touch_last_used!
  update_column(:last_used_at, Time.current)
end

Sets last_used_at to now, without validations or callbacks.