Refactor JWT-generation methods out of ReportingAPI controller and into the model

app/controllers/api/reporting/one_time_tokens_controller.rb

@@ -9,7 +9,7 @@ class API::Reporting::OneTimeTokensController < API::Reporting::BaseController
   def authorize
     @token = ReportingAPI::OneTimeToken.find_by!(token: params[:code])
     @token.delete # <- Tokens are one-time use
-    json_data = { jwt: jwt(@token) }
+    json_data = { jwt: @token.to_jwt }
     render json: json_data
   rescue ActiveRecord::RecordNotFound
     render json: { errors: "invalid_grant" }, status: :forbidden
@@ -23,26 +23,4 @@ def verify_grant_type!
         return
     end
   end
-
-  def jwt_payload(token)
-    {
-      "iat" => Time.current.utc.to_i,
-      "data" => {
-        "user" => token.user.as_json,
-        "cis2_info" => token.cis2_info
-      }
-    }
-  end
-
-  def jwt(token)
-    JWT.encode(
-      jwt_payload(token),
-      Settings.reporting_api.client_app.secret,
-      "HS512"
-    )
-  end
-
-  def ensure_reporting_api_feature_enabled
-    render status: :forbidden and return unless Flipper.enabled?(:reporting_api)
-  end
 end

app/controllers/concerns/reporting_api/token_authentication_concern.rb

@@ -64,7 +64,7 @@ def decode_jwt!(jwt)
         jwt,
         Settings.reporting_api.client_app.secret,
         true,
-        { algorithm: "HS512" }
+        { algorithm: ReportingAPI::OneTimeToken::JWT_SIGNING_ALGORITHM }
       )
     end
   end

app/models/reporting_api/one_time_token.rb

@@ -26,6 +26,8 @@ class ReportingAPI::OneTimeToken < ApplicationRecord
   validates :user_id, uniqueness: true, presence: true
   validates :token, uniqueness: true, presence: true
 
+  JWT_SIGNING_ALGORITHM = "HS512"
+
   def self.generate!(user_id:, cis2_info: {})
     create!(user_id: user_id, token: SecureRandom.hex(32), cis2_info: cis2_info)
   end
@@ -46,4 +48,22 @@ def self.find_or_generate_for!(user:, cis2_info: {})
   def expired?
     created_at < self.class.expire_before
   end
+
+  def jwt_payload
+    {
+      "iat" => Time.current.utc.to_i,
+      "data" => {
+        "user" => user.as_json,
+        "cis2_info" => cis2_info
+      }
+    }
+  end
+
+  def to_jwt
+    JWT.encode(
+      jwt_payload,
+      Settings.reporting_api.client_app.secret,
+      JWT_SIGNING_ALGORITHM
+    )
+  end
 end

spec/controllers/api/reporting/one_time_tokens_controller_spec.rb

@@ -95,7 +95,10 @@
                     response_json["jwt"],
                     Settings.reporting_api.client_app.secret,
                     true,
-                    { algorithm: "HS512" }
+                    {
+                      algorithm:
+                        ReportingAPI::OneTimeToken::JWT_SIGNING_ALGORITHM
+                    }
                   )
                 }.not_to raise_error
               end
@@ -106,7 +109,10 @@
                     response_json["jwt"],
                     Settings.reporting_api.client_app.secret,
                     true,
-                    { algorithm: "HS512" }
+                    {
+                      algorithm:
+                        ReportingAPI::OneTimeToken::JWT_SIGNING_ALGORITHM
+                    }
                   )
                 end
                 let(:jwt_data) { decoded_payload.first["data"] }

spec/controllers/api/reporting/totals_controller_spec.rb

@@ -33,7 +33,7 @@
             JWT.encode(
               valid_payload,
               Settings.reporting_api.client_app.secret,
-              "HS512"
+              ReportingAPI::OneTimeToken::JWT_SIGNING_ALGORITHM
             )
           end
 
@@ -58,7 +58,7 @@
             JWT.encode(
               valid_payload,
               Settings.reporting_api.client_app.secret,
-              "HS512"
+              ReportingAPI::OneTimeToken::JWT_SIGNING_ALGORITHM
             )
           end
 
@@ -73,7 +73,7 @@
             JWT.encode(
               invalid_payload,
               Settings.reporting_api.client_app.secret,
-              "HS512"
+              ReportingAPI::OneTimeToken::JWT_SIGNING_ALGORITHM
             )
           end
 

spec/controllers/concerns/reporting_api/token_authentication_concern_spec.rb

@@ -273,7 +273,7 @@ def current_user
           jwt,
           Settings.reporting_api.client_app.secret,
           true,
-          { algorithm: "HS512" }
+          { algorithm: ReportingAPI::OneTimeToken::JWT_SIGNING_ALGORITHM }
         ) #.and_return(decoded_jwt)
         an_object_which_includes_the_concern.send(:decode_jwt!, jwt)
       end
@@ -284,7 +284,7 @@ def current_user
             jwt,
             Settings.reporting_api.client_app.secret,
             true,
-            { algorithm: "HS512" }
+            { algorithm: ReportingAPI::OneTimeToken::JWT_SIGNING_ALGORITHM }
           ).and_return(decoded_jwt)
         end
 

spec/models/reporting_api/one_time_token_spec.rb

@@ -22,7 +22,9 @@
 #
 
 describe ReportingAPI::OneTimeToken do
-  subject { described_class.new(user_id: user.id, token: SecureRandom.hex(32)) }
+  subject(:token) do
+    described_class.new(user_id: user.id, token: SecureRandom.hex(32))
+  end
 
   let(:user) { create(:user) }
 
@@ -168,4 +170,55 @@
       end
     end
   end
+
+  describe "#jwt_payload" do
+    let(:result) { token.jwt_payload }
+
+    it "has iat set to the current time as an integer" do
+      expect(result["iat"]).to be_within(1000).of(Time.current.utc.to_i)
+    end
+
+    it "has a data hash" do
+      expect(result["data"]).to be_a(Hash)
+    end
+
+    describe "the data hash" do
+      let(:data) { result["data"] }
+
+      it "has the user as json" do
+        expect(data["user"]).to eq(token.user.as_json)
+      end
+
+      it "has the cis2_info as json" do
+        expect(data["cis2_info"]).to eq(token.cis2_info.as_json)
+      end
+    end
+  end
+
+  describe "#to_jwt" do
+    let(:result) { token.to_jwt }
+    let(:decoded_payload) do
+      JWT.decode(
+        result,
+        Settings.reporting_api.client_app.secret,
+        true,
+        { algorithm: ReportingAPI::OneTimeToken::JWT_SIGNING_ALGORITHM }
+      ).first
+    end
+
+    it "returns a JWT signed with the Mavis reporting app secret" do
+      expect {
+        JWT.decode(
+          result,
+          Settings.reporting_api.client_app.secret,
+          true,
+          { algorithm: ReportingAPI::OneTimeToken::JWT_SIGNING_ALGORITHM }
+        )
+      }.not_to raise_error
+    end
+
+    it "has the jwt_payload" do
+      expect(decoded_payload).to eq(token.jwt_payload)
+    end
+  end
 end