Merge pull request #66 from sul-dlss/sul-embed-591-iiif-token-creation

don't grant IIIF bearer tokens to anonymous users

app/controllers/application_controller.rb

@@ -62,7 +62,8 @@ def webauth_user
   end
 
   def anonymous_locatable_user
-    User.new(ip_address: request.remote_ip)
+    User.new(ip_address: request.remote_ip,
+             anonymous_locatable_user: true)
   end
 
   def rescue_can_can(exception)

app/controllers/iiif_token_controller.rb

@@ -1,7 +1,7 @@
 # API to create IIIF Authentication access tokens
 class IiifTokenController < ApplicationController
   def create
-    token = mint_bearer_token if current_user
+    token = mint_bearer_token unless current_user.anonymous_locatable_user?
 
     write_bearer_token_cookie(token) if token
 

app/models/user.rb

@@ -3,12 +3,16 @@
 class User
   include ActiveModel::Model
 
-  attr_accessor :id, :webauth_user, :app_user, :token_user, :ldap_groups, :ip_address
+  attr_accessor :id, :webauth_user, :anonymous_locatable_user, :app_user, :token_user, :ldap_groups, :ip_address
 
   def webauth_user?
     webauth_user
   end
 
+  def anonymous_locatable_user?
+    anonymous_locatable_user
+  end
+
   def stanford?
     ldap_groups.present? && (ldap_groups & Settings.user.stanford_groups).any?
   end

spec/controllers/application_controller_spec.rb

@@ -42,5 +42,11 @@
         expect(subject).to be_a_webauth_user
       end
     end
+
+    context 'with no other credentials' do
+      it 'is an anonymous locatable user' do
+        expect(subject).to be_an_anonymous_locatable_user
+      end
+    end
   end
 end

spec/controllers/iiif_token_controller_spec.rb

@@ -6,7 +6,7 @@
       get :create, format: :js
     end
 
-    let(:user) { nil }
+    let(:user) { User.new(anonymous_locatable_user: true) }
 
     before do
       allow(controller).to receive(:current_user).and_return(user)
@@ -35,7 +35,7 @@
       end
     end
 
-    context 'without a user' do
+    context 'with an anonymous user' do
       it 'returns the error response' do
         expect(subject.status).to eq 401