diff --git a/app/controllers/api/v1/users_controller.rb b/app/controllers/api/v1/users_controller.rb
new file mode 100644
index 0000000..6866774
--- /dev/null
+++ b/app/controllers/api/v1/users_controller.rb
@@ -0,0 +1,57 @@
+class Api::V1::UsersController < ApplicationController
+
+ skip_before_filter :authenticated
+ before_filter :valid_api_token
+ before_filter :extrapolate_user
+
+ respond_to :json
+
+ def index
+ # We removed the .as_json code from the model, just seemed like extra work.
+ # dunno, maybe useful at a later time?
+ #respond_with @user.admin ? User.all.as_json : @user.as_json
+
+ respond_with @user.admin ? User.all : @user
+ end
+
+ def show
+ respond_with @user.as_json
+ end
+
+private
+
+ def valid_api_token
+ authenticate_or_request_with_http_token do |token, options|
+ # TODO :add some functionality to check if the HTTP Header is valid
+ identify_user(token)
+ end
+ end
+
+ def identify_user(token="")
+ # We've had issues with URL encoding, etc. causing issues so just to be safe
+ # we will go ahead and unescape the user's token
+ unescape_token(token)
+ @clean_token =~ /(.*?)-(.*)/
+ id = $1
+ hash = $2
+ (id && hash) ? true : false
+ check_hash(id, hash) ? true : false
+ end
+
+ def check_hash(id, hash)
+ digest = OpenSSL::Digest::SHA1.hexdigest("#{ACCESS_TOKEN_SALT}:#{id}")
+ hash == digest
+ end
+
+ # We had some issues with the token and url encoding...
+ # this is an attempt to normalize the data.
+ def unescape_token(token="")
+ @clean_token = CGI::unescape(token)
+ end
+
+ # Added a method to make it easy to figure out who the user is.
+ def extrapolate_user
+ @user = User.find_by_id(@clean_token.split("-").first)
+ end
+
+end
diff --git a/app/controllers/tutorials_controller.rb b/app/controllers/tutorials_controller.rb
index a8d151c..69df74f 100755
--- a/app/controllers/tutorials_controller.rb
+++ b/app/controllers/tutorials_controller.rb
@@ -83,7 +83,8 @@ class TutorialsController < ApplicationController
def guard
end
-
+ def logic_flaws
+ end
def mass_assignment
end
diff --git a/app/helpers/api/v1/users_helper.rb b/app/helpers/api/v1/users_helper.rb
new file mode 100644
index 0000000..4d5288c
--- /dev/null
+++ b/app/helpers/api/v1/users_helper.rb
@@ -0,0 +1,2 @@
+module Api::V1::UsersHelper
+end
diff --git a/app/models/user.rb b/app/models/user.rb
index df0f140..b2ccf52 100755
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -37,6 +37,13 @@ class User < ActiveRecord::Base
def full_name
"#{self.first_name} #{self.last_name}"
end
+
+=begin
+ # Instead of the entire user object being returned, we can use this to filter.
+ def as_json
+ super(only: [:user_id, :email, :first_name, :last_name])
+ end
+=end
private
diff --git a/app/views/layouts/tutorial/_sidebar.html.erb b/app/views/layouts/tutorial/_sidebar.html.erb
index b46902b..644b772 100755
--- a/app/views/layouts/tutorial/_sidebar.html.erb
+++ b/app/views/layouts/tutorial/_sidebar.html.erb
@@ -112,6 +112,9 @@
<%= link_to "Constantize", constantize_tutorials_path %>
+
+ <%= link_to "Logic Flaws", logic_flaws_tutorials_path %>
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/config/initializers/constants.rb b/config/initializers/constants.rb
new file mode 100644
index 0000000..7fdcd8f
--- /dev/null
+++ b/config/initializers/constants.rb
@@ -0,0 +1 @@
+ACCESS_TOKEN_SALT = "S4828341189aefiasd#ASDF"
\ No newline at end of file
diff --git a/config/routes.rb b/config/routes.rb
index 9c21e1a..6dfde00 100755
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -33,7 +33,7 @@ Railsgoat::Application.routes.draw do
resources :messages do
end
-
+
end
get "download" => "benefit_forms#download"
@@ -58,6 +58,7 @@ Railsgoat::Application.routes.draw do
get "mass_assignment"
get "constantize"
get "gauntlt"
+ get "logic_flaws"
end
end
@@ -81,6 +82,12 @@ Railsgoat::Application.routes.draw do
get "home"
end
end
+
+ namespace :api, defaults: {format: 'json'} do
+ namespace :v1 do
+ resources :users
+ end
+ end
root :to => "sessions#new"
diff --git a/spec/controllers/api/v1/users_controller_spec.rb b/spec/controllers/api/v1/users_controller_spec.rb
new file mode 100644
index 0000000..184b048
--- /dev/null
+++ b/spec/controllers/api/v1/users_controller_spec.rb
@@ -0,0 +1,5 @@
+require 'spec_helper'
+
+describe Api::V1::UsersController do
+
+end
diff --git a/spec/helpers/api/v1/users_helper_spec.rb b/spec/helpers/api/v1/users_helper_spec.rb
new file mode 100644
index 0000000..13a6067
--- /dev/null
+++ b/spec/helpers/api/v1/users_helper_spec.rb
@@ -0,0 +1,15 @@
+require 'spec_helper'
+
+# Specs in this file have access to a helper object that includes
+# the Api::V1::UsersHelper. For example:
+#
+# describe Api::V1::UsersHelper do
+# describe "string concat" do
+# it "concats two strings with spaces" do
+# expect(helper.concat_strings("this","that")).to eq("this that")
+# end
+# end
+# end
+describe Api::V1::UsersHelper do
+ pending "add some examples to (or delete) #{__FILE__}"
+end