From c64550785e23fbcfe57422a73e48645733cce590 Mon Sep 17 00:00:00 2001 From: Andrew Tomaka Date: Sun, 8 Sep 2024 21:07:51 -0400 Subject: [PATCH] Require authentication for most endpoints (#29) Reviewed-on: https://git.atomaka.com/atomaka/budget/pulls/29 --- app/controllers/application_controller.rb | 1 + app/controllers/concerns/authorizable.rb | 37 ++++++++++++++++++++ app/controllers/sessions_controller.rb | 10 ++++-- app/controllers/users_controller.rb | 9 +++++ app/models/guest_user.rb | 2 ++ app/models/user.rb | 2 ++ app/views/layouts/application.html.erb | 11 +++--- test/controllers/sessions_controller_test.rb | 3 +- test/controllers/users_controller_test.rb | 5 +++ test/system/credit_card_bills_test.rb | 1 + test/system/expenses_test.rb | 1 + test/system/incomes_test.rb | 1 + test/system/members_test.rb | 1 + test/system/users_test.rb | 7 ++-- test/test_helper.rb | 4 +++ 15 files changed, 84 insertions(+), 11 deletions(-) create mode 100644 app/controllers/concerns/authorizable.rb diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 1374ee0..c42fe74 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -1,3 +1,4 @@ class ApplicationController < ActionController::Base include Authenticatable + include Authorizable end diff --git a/app/controllers/concerns/authorizable.rb b/app/controllers/concerns/authorizable.rb new file mode 100644 index 0000000..7b81667 --- /dev/null +++ b/app/controllers/concerns/authorizable.rb @@ -0,0 +1,37 @@ +module Authorizable + extend ActiveSupport::Concern + + included do + before_action :require_registered_user + end + + class_methods do + def allow_unregistered_user(**args) + skip_before_action :require_registered_user, **args + end + + def require_unregistered_user(**args) + skip_before_action :require_registered_user, **args + before_action :require_unregistered_user, **args + end + end + + private + + def require_registered_user + Current.user.registered? || redirect_to_sign_in + end + + def require_unregistered_user + Current.user.unregistered? || redirect_to_dashboard + end + + def redirect_to_sign_in + session[:return_url] = request.url + redirect_to new_session_url, alert: "You must be logged in to continue." + end + + def redirect_to_dashboard + redirect_to root_url, alert: "You are already logged in." + end +end diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb index f6fd1fe..3bf7328 100644 --- a/app/controllers/sessions_controller.rb +++ b/app/controllers/sessions_controller.rb @@ -1,4 +1,5 @@ class SessionsController < ApplicationController + require_unregistered_user only: %i[new create] # GET /sessions/new def new @session = Session.new @@ -11,9 +12,8 @@ class SessionsController < ApplicationController respond_to do |format| if @session.save session[:current_user_id] = @session.user_id - Rails.logger.info("ID: #{@session.user_id}") - format.html { redirect_to root_url, notice: "Session was successfully created." } + format.html { redirect_to redirect_url, notice: "Session was successfully created." } format.json { render :show, status: :created, location: @session } else format.html { render :new, status: :unprocessable_entity, alert: @session.errors } @@ -27,12 +27,16 @@ class SessionsController < ApplicationController session[:current_user_id] = nil respond_to do |format| - format.html { redirect_to root_url, notice: "Session was successfully destroyed." } + format.html { redirect_to new_session_url, notice: "Session was successfully destroyed." } format.json { head :no_content } end end private + def redirect_url + session.delete(:return_url) || root_url + end + # Only allow a list of trusted parameters through. def session_params params.require(:session).permit(:email, :password) diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index 2f1084d..e8058a3 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -1,4 +1,6 @@ class UsersController < ApplicationController + require_unregistered_user only: %i[new create] + before_action :set_user, only: %i[ show edit update destroy ] # GET /users or /users.json @@ -25,6 +27,9 @@ class UsersController < ApplicationController respond_to do |format| if @user.save + @session = Session.new(session_params).save + session[:current_user_id] = @session.user_id + format.html { redirect_to user_url(@user), notice: "User was successfully created." } format.json { render :show, status: :created, location: @user } else @@ -67,4 +72,8 @@ class UsersController < ApplicationController def user_params params.require(:user).permit(:email, :password, :password_confirmation) end + + def session_params + user_params.slice(:email, :password) + end end diff --git a/app/models/guest_user.rb b/app/models/guest_user.rb index 9f6dbd1..1121af6 100644 --- a/app/models/guest_user.rb +++ b/app/models/guest_user.rb @@ -1,3 +1,5 @@ class GuestUser def registered? = false + + def unregistered? = true end diff --git a/app/models/user.rb b/app/models/user.rb index 1d74647..e8e6d64 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -2,4 +2,6 @@ class User < ApplicationRecord has_secure_password def registered? = true + + def unregistered? = false end diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb index a4b84df..0ba3739 100644 --- a/app/views/layouts/application.html.erb +++ b/app/views/layouts/application.html.erb @@ -14,14 +14,15 @@