feat: sign_in and sign_up generate jwt

Author: lmeireles

lib/api_ecommerce/auth.ex

@@ -4,9 +4,10 @@ defmodule ApiEcommerce.Auth do
   """
 
   import Ecto.Query, warn: false
-  alias ApiEcommerce.Repo
 
+  alias ApiEcommerce.Repo
   alias ApiEcommerce.Auth.User
+  alias ApiEcommerce.Guardian
 
   @doc """
   Returns the list of users.
@@ -107,6 +108,7 @@ defmodule ApiEcommerce.Auth do
     query
     |> Repo.one()
     |> verify_password(password)
+    |> gen_token()
   end
 
   defp verify_password(nil, _) do
@@ -116,9 +118,20 @@ defmodule ApiEcommerce.Auth do
 
   defp verify_password(user, password) do
     if Bcrypt.verify_pass(password, user.password_hash) do
-      {:ok, user}
+      user
     else
       {:error, "Wrong username or password"}
     end
   end
+
+  defp gen_token(%User{} = user) do
+    case Guardian.encode_and_sign(user) do
+      {:ok, token, _claims} -> {:ok, user, token}
+      _ -> {:error, :unauthorized}
+    end
+  end
+
+  defp gen_token(error) do
+    error
+  end
 end

lib/api_ecommerce_web/controllers/user_controller.ex

@@ -3,21 +3,22 @@ defmodule ApiEcommerceWeb.UserController do
 
   alias ApiEcommerce.Auth
   alias ApiEcommerce.Auth.User
+  alias ApiEcommerce.Guardian
 
   action_fallback ApiEcommerceWeb.FallbackController
 
   def index(conn, _params) do
     users = Auth.list_users()
-    user = get_session(conn, :current_user_id)
-    render(conn, "index.json", users: users, user: user)
+    render(conn, "index.json", users: users)
   end
 
   def create(conn, %{"user" => user_params}) do
-    with {:ok, %User{} = user} <- Auth.create_user(user_params) do
+    with {:ok, %User{} = user} <- Auth.create_user(user_params),
+         {:ok, token, _claims} <- Guardian.encode_and_sign(user) do
       conn
       |> put_status(:created)
       |> put_resp_header("location", Routes.user_path(conn, :show, user))
-      |> render("show.json", user: user)
+      |> render("sign_up.json", user: user, token: token)
     end
   end
 
@@ -44,11 +45,11 @@ defmodule ApiEcommerceWeb.UserController do
 
   def sign_in(conn, %{"email" => email, "password" => password}) do
     case ApiEcommerce.Auth.authenticate_user(email, password) do
-      {:ok, user} ->
+      {:ok, user, token} ->
         conn
         |> put_status(:ok)
         |> put_view(ApiEcommerceWeb.UserView)
-        |> render("sign_in.json", user: user)
+        |> render("sign_in.json", user: user, token: token)
 
       {:error, message} ->
         conn

lib/api_ecommerce_web/views/user_view.ex

@@ -2,19 +2,20 @@ defmodule ApiEcommerceWeb.UserView do
   use ApiEcommerceWeb, :view
   alias ApiEcommerceWeb.UserView
 
-  def render("index.json", %{users: users, user: user}) do
-    %{
-      data: render_many(users, UserView, "user.json"),
-      user: user
-    }
+  def render("index.json", %{users: users}) do
+    %{data: render_many(users, UserView, "user.json")}
   end
 
   def render("show.json", %{user: user}) do
     %{data: render_one(user, UserView, "user.json")}
   end
 
-  def render("sign_in.json", %{user: user}) do
-    %{data: render_one(user, UserView, "user.json")}
+  def render("sign_in.json", %{user: user, token: token}) do
+    %{data: Map.merge(render_one(user, UserView, "user.json"), %{token: token})}
+  end
+
+  def render("sign_up.json", %{user: user, token: token}) do
+    %{data: Map.merge(render_one(user, UserView, "user.json"), %{token: token})}
   end
 
   def render("user.json", %{user: user}) do

lib/guardian.ex

@@ -0,0 +1,22 @@
+defmodule ApiEcommerce.Guardian do
+  use Guardian, otp_app: :api_ecommerce
+
+  def subject_for_token(user, _claims) do
+    sub = to_string(user.id)
+    {:ok, sub}
+  end
+
+  def subject_for_token(_, _) do
+    {:error, :reason_for_error}
+  end
+
+  def resource_from_claims(claims) do
+    id = claims["sub"]
+    resource = MyApi.Accounts.get_user!(id)
+    {:ok,  resource}
+  end
+
+  def resource_from_claims(_claims) do
+    {:error, :reason_for_error}
+  end
+end

test/api_ecommerce/auth_test.exs

@@ -87,7 +87,7 @@ defmodule ApiEcommerce.AuthTest do
     test "authenticate_user/2 authenticates the user" do
       user = user_fixture()
       assert {:error, "Wrong username or password"} = Auth.authenticate_user("wrong email", "")
-      assert {:ok, authenticated_user} = Auth.authenticate_user(user.email, @valid_attrs.password)
+      assert {:ok, authenticated_user, token} = Auth.authenticate_user(user.email, @valid_attrs.password)
       assert %{user | password: nil, password_confirmation: nil} == authenticated_user
     end
   end

test/api_ecommerce_web/controllers/user_controller_test.exs

@@ -3,6 +3,7 @@ defmodule ApiEcommerceWeb.UserControllerTest do
 
   alias ApiEcommerce.Auth
   alias ApiEcommerce.Auth.User
+  alias ApiEcommerce.Guardian
 
   @create_attrs %{
     email: "some@email",
@@ -112,11 +113,11 @@ defmodule ApiEcommerceWeb.UserControllerTest do
       conn =
         post(conn, Routes.user_path(conn, :sign_in, %{ email: current_user.email, password: @current_user_attrs.password}))
 
-      assert json_response(conn, 200)["data"] == %{
-               "id" => current_user.id,
-               "email" => current_user.email,
-               "status" => current_user.status |> Atom.to_string(),
-               "role" => current_user.role |> Atom.to_string()}
+      assert json_response(conn, 200)["data"]["id"] == current_user.id
+      assert json_response(conn, 200)["data"]["email"] == current_user.email
+      assert json_response(conn, 200)["data"]["status"] == current_user.status |> Atom.to_string()
+      assert json_response(conn, 200)["data"]["role"] == current_user.role |> Atom.to_string()
+      assert {:ok, claims} = Guardian.decode_and_verify(json_response(conn, 200)["data"]["token"])
     end
 
     test "renders errors when user credentials are bad", %{conn: conn} do