card 1.18.6 → 1.19.0

data/mod/account/set/self/signin.rb

@@ -0,0 +1,158 @@
+
+format :html do
+  view :open do |args|
+    args[:optional_help] = :show
+    super args
+  end
+
+  def default_title_args args
+    args[:title] ||= I18n.t(:sign_in_title, # 'Sign In'
+                            scope: "mod.standard.set.self.signin")
+  end
+
+  view :open_content do |args|
+    # annoying step designed to avoid table of contents.  sigh
+    _render_core(args)
+  end
+
+  view :closed_content do |_args|
+    ""
+  end
+
+  def default_core_args args={}
+    # 'Sign in' '...or sign up!' 'RESET PASSWORD'
+    sign_in, or_sign_up, reset_password =
+      I18n.t([:sign_in, :or_sign_up, :reset_password],
+             scope: "mod.standard.set.self.signin")
+    # since i18n-tasks doesn't understand bulk lookups, tell it keys are used
+    # i18n-tasks-use t(:sign_in, scope: 'mod.standard.set.self.signin')
+    # i18n-tasks-use t(:or_sign_up, scope: 'mod.standard.set.self.signin')
+    # i18n-tasks-use t(:reset_password,
+    #                  scope: 'mod.standard.set.self.signin')
+    args[:buttons] = button_tag sign_in, situation: "primary"
+    if Card.new(type_id: Card::SignupID).ok? :create
+      args[:buttons] += link_to(or_sign_up, card_path("account/signup"))
+    end
+    args[:buttons] += raw(
+      "<div style='float:right'>" \
+      "#{view_link reset_password, :edit,
+                   path_opts: { slot: { hide: :toolbar } }}" \
+      "</div>"
+    ) # FIXME: hardcoded styling
+    args
+  end
+
+  view :core do |args|
+    form_args = {
+      hidden: { success: "REDIRECT: #{Env.interrupted_action || '*previous'}" },
+      recaptcha: :off
+    }
+    with_nest_mode :edit do
+      card_form :update, form_args do
+        [
+          _optional_render(:content_formgroup, args.merge(structure: true)),
+          _optional_render(:button_formgroup, args)
+        ].join
+      end
+    end
+  end
+
+  # FORGOT PASSWORD
+  view :edit do |args|
+    @forgot_password = true
+    args.merge!(
+      title: I18n.t(:forgot_password, # 'Forgot Password'
+                    scope: "mod.standard.set.self.signin"),
+      optional_help: :hide,
+      buttons: button_tag(I18n.t(:reset_my_password, # 'Reset my password'
+                                 scope: "mod.standard.set.self.signin"),
+                          situation: "primary"),
+      structure: true,
+      hidden: {
+        reset_password: true,
+        success: { view: :reset_password_success }
+      }
+    )
+    Auth.as_bot { super args }
+  end
+
+  view :raw do |_args|
+    if @forgot_password
+      "{{+#{Card[:email].name}|title:email;type:Phrase}}"
+    else
+      %(
+        {{+#{Card[:email].name}|titled;title:email}}
+        {{+#{Card[:password].name}|titled;title:password}}
+      )
+    end
+  end
+
+  view :reset_password_success do |_args|
+    # 'Check your email for a link to reset your password'
+    frame { I18n.t(:check_email, scope: "mod.standard.set.self.signin") }
+  end
+end
+
+event :signin, :validate, on: :update do
+  email = subfield :email
+  email &&= email.content
+  pword = subfield :password
+  pword &&= pword.content
+
+  unless email && pword
+    abort :failure, I18n.t(:abort_bad_signin_args, # 'bad signin args'
+                           scope: "mod.standard.set.self.signin")
+  end
+
+  if (account = Auth.authenticate(email, pword))
+    Auth.signin account.left_id
+  else
+    account = Auth.find_account_by_email email
+    error_msg =
+      case
+      when account.nil?     then
+        # 'Unrecognized email.'
+        I18n.t(:error_unknown_email, scope: "mod.standard.set.self.signin")
+      when !account.active? then
+        # 'Sorry, that account is not active.'
+        I18n.t(:error_not_active, scope: "mod.standard.set.self.signin")
+      else
+        # 'Wrong password'
+        I18n.t(:error_wrong_password, scope: "mod.standard.set.self.signin")
+      end
+    errors.add :signin, error_msg
+    abort :failure
+  end
+end
+
+event :signin_success, after: :signin do
+  abort :success
+end
+
+event :send_reset_password_token,
+      before: :signin, on: :update,
+      when: proc { Env.params[:reset_password] } do
+  email = subfield :email
+  email &&= email.content
+
+  account = Auth.find_account_by_email email
+  if account
+    if account.active?
+      account.send_reset_password_token
+      abort :success
+    else
+      errors.add :account, I18n.t(:error_not_active, # 'not active'
+                                  scope: "mod.standard.set.self.signin")
+      abort :failure
+    end
+  else
+    errors.add :email, I18n.t(:error_not_recognized, # 'not recognized'
+                              scope: "mod.standard.set.self.signin")
+    abort :failure
+  end
+end
+
+event :signout, :validate, on: :delete do
+  Auth.signin nil
+  abort :success
+end

data/mod/account/set/type/signup.rb

@@ -0,0 +1,168 @@
+format :html do
+  def default_new_args args
+    super args
+    args.merge!(
+      optional_help: :show, # , optional_menu: :never
+      buttons: submit_button,
+      account: card.fetch(trait: :account, new: {}),
+      title: "Sign up",
+      hidden: {
+        success: (card.rule(:thanks) || "_self"),
+        "card[type_id]" => card.type_id
+      }
+    )
+    return unless Auth.signed_in? && args[:account].confirm_ok?
+    invite_args args
+  end
+
+  def invite_args args
+    args[:title] = "Invite"
+    args[:buttons] = button_tag("Send Invitation", situation: "primary")
+    args[:hidden][:success] = "_self"
+  end
+
+  view :new do |args|
+    # FIXME: make more use of standard new view?
+
+    frame_and_form :create, args, "main-success" => "REDIRECT" do
+      [
+        _render_name_formgroup(help: "usually first and last name"),
+        _optional_render(:account_formgroups, args),
+        (card.structure ? edit_slot : ""),
+        _optional_render(:button_formgroup, args)
+      ]
+    end
+  end
+
+  view :account_formgroups do |args|
+    sub_args = { structure: true }
+    sub_args[:no_password] = true if Auth.signed_in?
+    Auth.as_bot do
+      subformat(args[:account])._render :content_formgroup, sub_args
+    end # YUCK!!!!
+  end
+
+  view :core do |_args|
+    return if card.new_card? # necessary?
+    headings = []
+    by_anon = card.creator_id == AnonymousID
+    headings << %(
+      <strong>#{card.name}</strong> #{'was' unless by_anon} signed up on
+      #{format_date card.created_at}
+    )
+    if (account = card.account)
+      headings += verification_info account
+    else
+      headings << "ERROR: signup card missing account"
+    end
+    <<-HTML
+      <div class="invite-links">
+        #{headings.map { |h| "<div>#{h}</div>" }.join "\n"}
+      </div>
+      #{process_content render_raw}
+    HTML
+  end
+
+  def verification_info account
+    headings = []
+    token_action = "Send"
+    if account.token.present?
+      headings << "A verification email has been sent " \
+                  "#{"to #{account.email}" if account.email_card.ok? :read}"
+      token_action = "Resend"
+    end
+    links = verification_links account, token_action
+    headings << links * "" if links.any?
+    headings
+  end
+
+  def verification_links account, token_action
+    links = []
+    if account.confirm_ok?
+      links << link_to(
+        "#{token_action} verification email",
+        card_path("update/~#{card.id}?approve_with_token=true")
+      )
+      links << link_to(
+        "Approve without verification",
+        card_path("update/~#{card.id}?approve_without_token=true")
+      )
+    end
+    if card.ok? :delete
+      links << link_to("Deny and delete", card_path("delete/~#{card.id}"))
+    end
+    links
+  end
+end
+
+event :activate_by_token, :validate, on: :update,
+                                     when: proc { |c| c.has_token? } do
+  abort :failure, "no field manipulation mid-activation" if subcards.present?
+  # necessary because this performs actions as Wagn Bot
+  abort :failure, "no account associated with #{name}" unless account
+
+  account.validate_token! @env_token
+
+  if account.errors.empty?
+    account.token_card.used!
+    activate_account
+    Auth.signin id
+    Auth.as_bot # use admin permissions for rest of action
+    success << ""
+  else
+    resend_activation_token
+    abort :success
+  end
+end
+
+def has_token?
+  @env_token = Env.params[:token]
+end
+
+event :activate_account do
+  # FIXME: -- sends email before account is fully activated
+  add_subfield :account
+  subfield(:account).add_subfield :status, content: "active"
+  self.type_id = Card.default_accounted_type_id
+  account.send_welcome_email
+end
+
+event :approve_with_token, :validate,
+      on: :update,
+      when: proc { Env.params[:approve_with_token] } do
+  abort :failure, "illegal approval" unless account.confirm_ok?
+  account.reset_token
+  account.send_account_verification_email
+end
+
+event :approve_without_token, :validate,
+      on: :update,
+      when: proc { Env.params[:approve_without_token] } do
+  abort :failure, "illegal approval" unless account.confirm_ok?
+  activate_account
+end
+
+event :resend_activation_token do
+  account.reset_token
+  account.send_account_verification_email
+  message = "Please check your email for a new password reset link."
+  if account.errors.any?
+    message = "Sorry, #{account.errors.first.last}. #{message}"
+  end
+  success << { id: "_self", view: "message", message: message }
+end
+
+def signed_in_as_me_without_password?
+  Auth.signed_in? && Auth.current_id == id && account.password.blank?
+end
+
+event :redirect_to_edit_password, :finalize,
+      on: :update,
+      when: proc { |c| c.signed_in_as_me_without_password? } do
+  Env.params[:success] = account.edit_password_success_args
+end
+
+event :act_as_current_for_integrate_stage, :integrate,
+      on: :create do
+  Auth.current_id = id
+end

data/mod/account/set/type/user.rb

@@ -0,0 +1,81 @@
+
+include Basic
+
+attr_accessor :email
+
+format :html do
+  view :setup, tags: :unknown_ok,
+               perms: ->(_r) { Auth.needs_setup? } do |args|
+    account = card.fetch trait: :account, new: {}
+    Auth.as_bot do
+      frame_and_form :create, args do
+        [
+          _render_name_formgroup(help: "usually first and last name"),
+          subformat(account)._render(:content_formgroup, structure: true),
+          _render_button_formgroup(args)
+        ]
+      end
+    end
+  end
+
+  def default_setup_args args
+    args.merge!(
+      title: "Welcome, Wagneer!",
+      optional_help: :show,
+      optional_menu: :never,
+      help_text: help_text,
+      buttons: setup_button,
+      hidden: {
+        success: "REDIRECT: #{Card.path_setting '/'}",
+        "card[type_id]" => Card.default_accounted_type_id,
+        "setup" => true
+      }
+    )
+  end
+
+  def help_text
+    text = "<h3>To get started, set up an account.</h3>"
+    if Card.config.action_mailer.perform_deliveries == false
+      text += <<-HTML
+        <br>WARNING: Email delivery is turned off.
+        Change settings in config/application.rb to send sign up notifications.'
+      HTML
+    end
+    text
+  end
+
+  def setup_button
+    submit_button text: "Set up", disable_with: "Setting up"
+  end
+end
+
+event :setup_as_bot, before: :check_permissions, on: :create,
+                     when: proc { Card::Env.params[:setup] } do
+  abort :failure unless Auth.needs_setup?
+  Auth.as_bot
+  # we need bot authority to set the initial administrator roles
+  # this is granted and inspected here as a separate event for
+  # flexibility and security when configuring initial setups
+end
+
+event :setup_first_user, :prepare_to_store,
+      on: :create, when: proc { Card::Env.params[:setup] } do
+  add_subcard "signup alert email+*to", content: name
+  add_subfield :roles, content: Card[:administrator].name
+end
+
+event :signin_after_setup, :integrate,
+      on: :create, when: proc { Card::Env.params[:setup] } do
+  Auth.signin id
+end
+
+def follow follow_name, option="*always"
+  return unless
+    (card = Card.fetch follow_name) &&
+    (set_card = card.default_follow_set_card) &&
+    (follow_rule_name = set_card.follow_rule_name(name)) &&
+    (follow_rule = Card.fetch follow_rule_name, new: {})
+  follow_rule.drop_item "*never"
+  follow_rule.add_item option
+  follow_rule.save!
+end

data/mod/account/spec/set/all/account_spec.rb

@@ -0,0 +1,138 @@
+# -*- encoding : utf-8 -*-
+
+describe Card::Set::All::Account do
+  describe "accountable?" do
+    it "should be false for cards with *accountable rule off" do
+      expect(Card["A"].accountable?).to eq(false)
+    end
+
+    it "should be true for cards with *accountable rule on" do
+      Card::Auth.as_bot do
+        Card.create name: "A+*self+*accountable", content: "1"
+        Card.create name: "*account+*right+*create",
+                    content: "[[Anyone Signed In]]"
+      end
+      expect(Card["A"].accountable?).to eq(true)
+    end
+  end
+
+  describe "parties" do
+    it "for Wagn Bot" do
+      Card::Auth.current_id = Card::WagnBotID
+      expect(Card::Auth.current.parties.sort).to eq(
+        [Card::WagnBotID, Card::AnyoneSignedInID, Card::AdministratorID]
+      )
+    end
+
+    it "for Anonymous" do
+      Card::Auth.current_id = Card::AnonymousID
+      expect(Card::Auth.current.parties.sort).to eq([Card::AnonymousID])
+    end
+
+    context "for Joe User" do
+      before do
+        @joe_user_card = Card::Auth.current
+        @parties = @joe_user_card.parties # note: must be called to test resets
+      end
+
+      it "should initially have only auth and self " do
+        expect(@parties).to eq([Card::AnyoneSignedInID, @joe_user_card.id])
+      end
+
+      it "should update when new roles are set" do
+        roles_card = @joe_user_card.fetch trait: :roles, new: {}
+        r1 = Card["r1"]
+
+        Card::Auth.as_bot { roles_card.items = [r1.id] }
+        expect(Card["Joe User"].parties).to eq(@parties)
+        # local cache still has old parties
+        # (permission does not change mid-request)
+
+        Card::Cache.restore
+        # simulate new request
+        # clears local cache, where, eg, @parties would still be cached on card
+
+        Card::Auth.current_id = Card::Auth.current_id
+        # simulate new request
+        # current_id assignment clears several class variables
+
+        new_parties = [Card::AnyoneSignedInID, r1.id, @joe_user_card.id]
+        expect(Card["Joe User"].parties).to eq(new_parties)
+        # @parties regenerated, now with correct values
+
+        expect(Card::Auth.current. parties).to eq(new_parties)
+        # @joe_user_card.refresh(force=true).parties.should == new_parties
+        # should work, but now superfluous?
+      end
+    end
+  end
+
+  describe "among?" do
+    it "should be true for self" do
+      expect(Card::Auth.current.among?([Card::Auth.current_id])).to be_truthy
+    end
+  end
+
+  describe "+*email" do
+    it "should create a card and account card" do
+      jadmin = Card["joe admin"]
+      Card::Auth.current_id = jadmin.id
+      # simulate login to get correct from address
+
+      Card::Env[:params] = { email: { subject: "Hey Joe!",
+                                      message: "Come on in." } }
+      Card.create! name: "Joe New",
+                   type_id: Card::UserID,
+                   "+*account" => { "+*email" => "joe@new.com" }
+
+      c = Card["Joe New"]
+      u = Card::Auth.find_account_by_email("joe@new.com")
+
+      expect(c.account).to eq(u)
+      expect(c.type_id).to eq(Card::UserID)
+    end
+  end
+
+  context "updates" do
+    before do
+      @card = Card["Joe User"]
+    end
+
+    it "should handle email updates" do
+      @card.update_attributes! "+*account" => { "+*email" => "joe@user.co.uk" }
+      expect(@card.account.email).to eq("joe@user.co.uk")
+    end
+
+    it "should let Wagn Bot block accounts" do
+      Card::Auth.as_bot do
+        @card.account.status_card.update_attributes! content: "blocked"
+        expect(@card.account.blocked?).to be_truthy
+      end
+    end
+
+    it "should not allow a user to block or unblock himself" do
+      expect do
+        @card.account.status_card.update_attributes! content: "blocked"
+      end.to raise_error
+      expect(@card.account.blocked?).to be_falsey
+    end
+  end
+
+  describe "#read_rules" do
+    before(:all) do
+      @read_rules = Card["joe_user"].read_rules
+    end
+
+    it "*all+*read should apply to Joe User" do
+      expect(@read_rules.member?(Card.fetch("*all+*read").id)).to be_truthy
+    end
+
+    it "13 more should apply to Joe Admin" do
+      # includes lots of account rules...
+      Card::Auth.as("joe_admin") do
+        ids = Card::Auth.as_card.read_rules
+        expect(ids.length).to eq(@read_rules.size + 14)
+      end
+    end
+  end
+end