card 1.98.0 → 1.99.1

data/mod/account/set/type/signup/views.rb

@@ -0,0 +1,93 @@
+format :html do
+  def invitation?
+    Auth.signed_in? && card.can_approve?
+  end
+
+  view :new do
+    voo.title = invitation? ? tr(:invite) : tr(:sign_up)
+    super()
+  end
+
+  view :content_formgroups do
+    [account_formgroups, (card.structure ? edit_slot : "")].join
+  end
+
+  view :new_buttons do
+    button_formgroup do
+      [standard_create_button, invite_button].compact
+    end
+  end
+
+  def invite_button
+    return unless invitation?
+    button_tag "Send Invitation", situation: "primary"
+  end
+
+  view :core, template: :haml do
+    @lines = [signup_line] + account_lines
+    @body = process_content _render_raw
+  end
+
+  def signup_line
+    ["<strong>#{safe_name}</strong>",
+     ("was" if invited?),
+     "signed up on #{format_date card.created_at}"].compact.join " "
+  end
+
+  def invited?
+    !self_signup?
+  end
+
+  def self_signup?
+    card.creator_id == AnonymousID
+  end
+
+  def account_lines
+    if card.account
+      verification_lines
+    else
+      [tr(:missing_account)]
+    end
+  end
+
+  def verification_lines
+    [verification_sent_line, verification_link_line].compact
+  end
+
+  def verification_sent_line
+    account = card.account
+    return unless account.email_card.ok?(:read)
+    "A verification email has been sent to #{account.email}"
+  end
+
+  def verification_link_line
+    links = verification_links
+    return if links.empty?
+    links.join " "
+  end
+
+  def verification_links
+    [approve_with_token_link, approve_without_token_link, deny_link].compact
+  end
+
+  def approve_with_token_link
+    action = card.account.status == "unverified" ? "Resend" : "Send"
+    approval_link "#{action} verification email", :with
+  end
+
+  def approve_without_token_link
+    approval_link "Approve without verification", :without
+  end
+
+  def approval_link text, with_or_without
+    return unless card.can_approve?
+    link_to_card card, text,
+                 path: { action: :update,
+                         card: { trigger: "approve_#{with_or_without}_verification" } }
+  end
+
+  def deny_link
+    return unless card.ok? :delete
+    link_to_card card, "Deny and delete", path: { action: :delete }
+  end
+end

data/mod/account/set/type/user.rb

@@ -1,14 +1,15 @@
-
 include Basic
+include_set Abstract::Accounted
 
 attr_accessor :email
 
 format :html do
   view :setup, unknown: true, perms: ->(_fmt) { Auth.needs_setup? } do
     with_nest_mode :edit do
-      voo.title = "Welcome, Shark!" # LOCALIZE
+      voo.title = "Your deck is ready to go!" # LOCALIZE
       voo.show! :help
       voo.hide! :menu
+      voo.help = haml :setup_help
       Auth.as_bot { setup_form }
     end
   end
@@ -17,8 +18,8 @@ format :html do
     frame_and_form :create do
       [
         setup_hidden_fields,
-        _render_name_formgroup(help: "usually first and last name"),
-        account_formgroup,
+        _render_name_formgroup,
+        account_formgroups,
         setup_form_buttons
       ]
     end
@@ -28,11 +29,6 @@ format :html do
     button_formgroup { setup_button }
   end
 
-  def account_formgroup
-    account = card.fetch trait: :account, new: {}
-    subformat(account)._render :content_formgroup, structure: true
-  end
-
   def setup_button
     submit_button text: "Set up", disable_with: "Setting up"
   end
@@ -44,21 +40,13 @@ format :html do
       "card[type_id]" => Card.default_accounted_type_id
     )
   end
+end
 
-  def help_text
-    text = "<h3>To get started, set up an account.</h3>"
-    if Card.config.action_mailer.perform_deliveries == false
-      text += <<-HTML
-        <br>WARNING: Email delivery is turned off.
-        Change settings in config/application.rb to send sign up notifications.
-      HTML
-    end
-    text
-  end
+def setup?
+  Card::Env.params[:setup]
 end
 
-event :setup_as_bot, before: :check_permissions, on: :create,
-                     when: proc { Card::Env.params[:setup] } do
+event :setup_as_bot, before: :check_permissions, on: :create, when: :setup? do
   abort :failure unless Auth.needs_setup?
   Auth.as_bot
   # we need bot authority to set the initial administrator roles
@@ -66,14 +54,15 @@ event :setup_as_bot, before: :check_permissions, on: :create,
   # flexibility and security when configuring initial setups
 end
 
-event :setup_first_user, :prepare_to_store,
-      on: :create, when: proc { Card::Env.params[:setup] } do
+event :setup_first_user, :prepare_to_store, on: :create, when: :setup? do
   add_subcard "signup alert email+*to", content: name
-  add_subfield :roles,
-               content: %i[help_desk shark administrator].map(&:cardname)
+  add_subfield :roles, content: roles_for_first_user
+end
+
+def roles_for_first_user
+  %i[help_desk shark administrator].map(&:cardname)
 end
 
-event :signin_after_setup, :integrate,
-      on: :create, when: proc { Card::Env.params[:setup] } do
+event :signin_after_setup, :integrate, on: :create, when: :setup? do
   Auth.signin id
 end

data/mod/account/set/type/user/setup_help.haml

@@ -0,0 +1,10 @@
+%h3 First, set up an account.
+.pb-2
+  As the first account holder for this deck, you will automatically have several
+  permissioned roles. You can configure these roles at any time.
+
+
+- if Card.config.action_mailer.perform_deliveries == false
+  .bg-warning.p-3
+    WARNING: Email delivery is turned off.
+    Change settings in config/application.rb to send sign up notifications.

data/mod/account/spec/set/all/account_spec.rb

@@ -1,127 +1,113 @@
 RSpec.describe Card::Set::All::Account do
-  describe "accountable?" do
-    it "is false for cards with *accountable rule off" do
-      expect(Card["A"].accountable?).to eq(false)
+  describe "parties" do
+    it "for Wagn Bot", with_user: Card::WagnBotID do
+      expect(Card::Auth.current.parties.sort)
+        .to eq([Card::WagnBotID, Card::AnyoneSignedInID, Card::AdministratorID])
     end
 
-    it "is true for cards with *accountable rule on", as_bot: true do
-      Card.create name: "A+*self+*accountable", content: "1"
-      Card.create name: "*account+*right+*create",
-                  content: "[[Anyone Signed In]]"
-      expect(Card["A"].accountable?).to eq(true)
+    it "for Anonymous", with_user: Card::AnonymousID do
+      expect(Card::Auth.current.parties.sort).to eq([Card::AnonymousID])
     end
 
-    describe "parties" do
-      it "for Wagn Bot", with_user: Card::WagnBotID do
-        expect(Card::Auth.current.parties.sort).to eq(
-                                                     [Card::WagnBotID, Card::AnyoneSignedInID, Card::AdministratorID]
-                                                   )
+    context "for Joe User" do
+      before do
+        @joe_user_card = Card::Auth.current
+        @parties = @joe_user_card.parties # note: must be called to test resets
       end
 
-      it "for Anonymous", with_user: Card::AnonymousID do
-        expect(Card::Auth.current.parties.sort).to eq([Card::AnonymousID])
+      it "initially has only auth and self " do
+        expect(@parties)
+          .to eq([Card::AnyoneSignedInID, Card::SharkID, @joe_user_card.id])
       end
 
-      context "for Joe User" do
-        before do
-          @joe_user_card = Card::Auth.current
-          @parties = @joe_user_card.parties # note: must be called to test resets
-        end
-
-        it "initially has only auth and self " do
-          expect(@parties)
-            .to eq([Card::AnyoneSignedInID, Card::SharkID, @joe_user_card.id])
-        end
-
-        it "updates when new roles are set" do
-          roles_card = @joe_user_card.fetch trait: :roles, new: {}
-          r1 = Card["r1"]
-
-          Card::Auth.as_bot { roles_card.items = [r1.id] }
-          Card::Cache.restore
-          # simulate new request
-          # clears local cache, where, eg, @parties would still be cached on card
-
-          Card::Auth.current_id = Card::Auth.current_id
-          # simulate new request
-          # current_id assignment clears several class variables
-
-          new_parties = [Card::AnyoneSignedInID, r1.id, @joe_user_card.id]
-          expect(Card["Joe User"].parties).to eq(new_parties)
-          # @parties regenerated, now with correct values
-
-          expect(Card::Auth.current.parties).to eq(new_parties)
-          # @joe_user_card.refresh(force=true).parties.should == new_parties
-          # should work, but now superfluous?
-        end
+      it "updates when new roles are set" do
+        roles_card = @joe_user_card.fetch trait: :roles, new: {}
+        r1 = Card["r1"]
+
+        Card::Auth.as_bot { roles_card.items = [r1.id] }
+        Card::Cache.restore
+        # simulate new request
+        # clears local cache, where, eg, @parties would still be cached on card
+
+        Card::Auth.current_id = Card::Auth.current_id
+        # simulate new request
+        # current_id assignment clears several class variables
+
+        new_parties = [Card::AnyoneSignedInID, r1.id, @joe_user_card.id]
+        expect(Card["Joe User"].parties).to eq(new_parties)
+        # @parties regenerated, now with correct values
+
+        expect(Card::Auth.current.parties).to eq(new_parties)
+        # @joe_user_card.refresh(force=true).parties.should == new_parties
+        # should work, but now superfluous?
       end
     end
+  end
 
-    describe "among?" do
-      it "is true for self" do
-        expect(Card::Auth.current.among?([Card::Auth.current_id])).to be_truthy
-      end
+  describe "among?" do
+    it "is true for self" do
+      expect(Card::Auth.current.among?([Card::Auth.current_id])).to be_truthy
     end
+  end
 
-    describe "+*email" do
-      it "creates a card and account card" do
-        jadmin = Card["joe admin"]
-        Card::Auth.current_id = jadmin.id
-        # simulate login to get correct from address
+  describe "+*email" do
+    it "creates a card and account card" do
+      jadmin = Card["joe admin"]
+      Card::Auth.current_id = jadmin.id
+      # simulate login to get correct from address
 
-        Card::Env[:params] = { email: { subject: "Hey Joe!",
-                                        message: "Come on in." } }
-        Card.create! name: "Joe New",
-                     type_id: Card::UserID,
-                     "+*account" => { "+*email" => "joe@new.com" }
+      Card::Env[:params] = { email: { subject: "Hey Joe!",
+                                      message: "Come on in." } }
+      Card.create! name: "Joe New",
+                   type_id: Card::UserID,
+                   "+*account" => { "+*email" => "joe@new.com" }
 
-        c = Card["Joe New"]
-        u = Card::Auth.find_account_by_email("joe@new.com")
+      c = Card["Joe New"]
+      u = Card::Auth.find_account_by_email("joe@new.com")
 
-        expect(c.account).to eq(u)
-        expect(c.type_id).to eq(Card::UserID)
-      end
+      expect(c.account).to eq(u)
+      expect(c.type_id).to eq(Card::UserID)
     end
+  end
 
-    context "updates" do
-      let(:card) {Card["Joe User"]}
-      let(:account) {card.account}
+  context "updates" do
+    let(:card) {Card["Joe User"]}
+    let(:account) {card.account}
 
-      it "handles email updates" do
-        card.update! "+*account" => { "+*email" => "joe@user.co.uk" }
-        expect(account.email).to eq("joe@user.co.uk")
-      end
+    it "handles email updates" do
+      card.update! "+*account" => { "+*email" => "joe@user.co.uk" }
+      expect(account.email).to eq("joe@user.co.uk")
+    end
 
-      it "lets Wagn Bot block accounts", as_bot: true do
-        card.account.status_card.update! content: "blocked"
-        expect(account.blocked?).to be_truthy
-      end
+    it "lets Wagn Bot block accounts", as_bot: true do
+      card.account.status_card.update! content: "blocked"
+      expect(account.blocked?).to be_truthy
+    end
 
-      it "does not allow a user to block or unblock himself" do
-        expect do
-          account.status_card.update! content: "blocked"
-        end.to raise_error(ActiveRecord::RecordInvalid,
-                           "Validation failed: Permission denied You don't have "\
-                         "permission to change the status of your own account")
-        expect(account.blocked?).to be_falsey
-      end
+    it "does not allow a user to block or unblock himself" do
+      expect do
+        account.status_card.update! content: "blocked"
+      end.to raise_error(ActiveRecord::RecordInvalid,
+                         "Validation failed: Permission denied You don't have "\
+                       "permission to change the status of your own account")
+      expect(account.blocked?).to be_falsey
     end
+  end
 
-    describe "#read_rules" do
-      before(:all) do
-        @read_rules = Card["joe_user"].read_rules
-      end
+  describe "#read_rules" do
+    before(:all) do
+      @read_rules = Card["joe_user"].read_rules
+    end
 
-      it "*all+*read should apply to Joe User" do
-        expect(@read_rules.member?(Card.fetch("*all+*read").id)).to be_truthy
-      end
+    it "*all+*read should apply to Joe User" do
+      expect(@read_rules.member?(Card.fetch("*all+*read").id)).to be_truthy
+    end
 
-      it "11 more should apply to Joe Admin" do
-        # includes lots of account rules...
-        Card::Auth.as("joe_admin") do
-          ids = Card::Auth.as_card.read_rules
-          expect(ids.length).to eq(@read_rules.size + 17)
-        end
+    it "11 more should apply to Joe Admin" do
+      # includes lots of account rules...
+      Card::Auth.as("joe_admin") do
+        ids = Card::Auth.as_card.read_rules
+        expect(ids.length).to eq(@read_rules.size + 17)
       end
     end
   end

data/mod/account/spec/set/right/account_spec.rb

@@ -27,18 +27,17 @@ RSpec.describe Card::Set::Right::Account do
     end
 
     it "checks accountability of 'accounted' card" do
-      unaccountable = Card.create(dummy_account_args)
-      expect(unaccountable.errors["+*account"].first).to eq("not allowed on this card")
+      expect(Card.create(dummy_account_args).errors["+*account"].first)
+        .to match(/You don\'t have permission to create/)
     end
 
-    it "works for any accountable card -- not just User type" do
+    it "works for any card with +*account permissions -- not just User type" do
       Card::Auth.as_bot do
-        rule_name = Card::Name[%i[basic type accountable]]
-        Card.create! name: rule_name, content: "1"
+        Card.create! name: Card::Name[%i[basic account type_plus_right create]],
+                     content: "Anyone Signed In"
       end
 
-      accountable = Card.create(dummy_account_args)
-      expect(accountable.errors).to be_empty
+      expect(Card.create(dummy_account_args).errors).to be_empty
     end
 
     it "requires email" do
@@ -51,12 +50,12 @@ RSpec.describe Card::Set::Right::Account do
     end
   end
 
-  describe "#send_account_verification_email" do
+  describe "#send_verification_email" do
     before do
       @email = "joe@user.com"
       @account = Card::Auth.find_account_by_email(@email)
       Mail::TestMailer.deliveries.clear
-      @account.send_account_verification_email
+      @account.send_verification_email
       @mail = Mail::TestMailer.deliveries.last
     end
 
@@ -71,8 +70,9 @@ RSpec.describe Card::Set::Right::Account do
 
     it "contains link to verify account" do
       raw_source = @mail.parts[0].body.raw_source
-      ["/update/#{@account.left.name.url_key}",
-       "token=#{@account.token}"].each do |url_part|
+      ["/update/#{@account.name.url_key}",
+       "card%5Btrigger%5D=verify_and_activate",
+       "token="].each do |url_part|
         expect(raw_source).to include(url_part)
       end
     end
@@ -83,12 +83,29 @@ RSpec.describe Card::Set::Right::Account do
     end
   end
 
-  describe "#send_reset_password_token" do
+  describe "#verify_and_activate" do
+    it "activates account" do
+      user = Card.create!(
+        name: "TmpUser",
+        type_id: Card::UserID,
+        "+*account" => { "+*password" => "tmp_pass",
+                         "+*email" => "tmp@decko.org",
+                         "+*status" => "unverified" }
+      )
+
+      Card::Env.params[:token] = Card::Auth::Token.encode user.id, anonymous: true
+      user.account.update! trigger: :verify_and_activate
+
+      expect(user.account).to be_active
+    end
+  end
+
+  describe "#send_password_reset_email" do
     before do
       @email = "joe@user.com"
       @account = Card::Auth.find_account_by_email(@email)
       Mail::TestMailer.deliveries = []
-      @account.send_reset_password_token
+      @account.send_password_reset_email
       @mail = Mail::TestMailer.deliveries.last
     end
 
@@ -99,10 +116,8 @@ RSpec.describe Card::Set::Right::Account do
 
     it "contains password reset link" do
       raw_source = @mail.parts[0].body.raw_source
-      token = @account.token_card.refresh(true).content
       ["/update/#{@account.left.name.url_key}",
-       "token=#{token}",
-       "live_token=true",
+       "token=",
        "card%5Btrigger%5D=reset_password"].each do |url_part|
         expect(raw_source).to include(url_part)
       end
@@ -136,40 +151,31 @@ RSpec.describe Card::Set::Right::Account do
     before do
       @email = "joe@user.com"
       @account = Card::Auth.find_account_by_email(@email)
-      @account.send_reset_password_token
-      @token = @account.token
-      Card::Env.params[:token] = @token
       Card::Auth.current_id = Card::AnonymousID
     end
 
     let(:trigger_reset) { @account.update! trigger: :reset_password }
 
+    def auth_token extra_payload={}
+      Card::Env.params[:token] = Card::Auth::Token.encode @account.left_id, extra_payload
+    end
+
     it "authenticates with correct token" do
+      auth_token
       expect(Card::Auth.current_id).to eq(Card::AnonymousID)
       trigger_reset
       expect(Card::Auth.current_id).to eq(@account.left_id)
-      @account = @account.refresh true
-      # expect(@account.fetch(trait: :token)).to be_nil
     end
 
     it "does not work if token is expired" do
-      @account.token_card.update_column :updated_at,
-                                        3.days.ago.strftime("%F %T")
-      @account.token_card.expire
-
-      trigger_reset
-
-      expect(@account.token).not_to eq(@token)
-      # token gets updated
-
-      expect(@account.success.message).to match(/expired/)
+      auth_token exp: 1.days.ago.to_i
+      expect { trigger_reset }.to raise_error(/Signature has expired/)
       # user notified of expired token
     end
 
     it "does not work if token is wrong" do
-      Card::Env.params[:token] = @token + "xxx"
-      trigger_reset
-      expect(@account.errors[:incorrect_token].first).to match(/mismatch/)
+      Card::Env.params[:token] = auth_token + "xxx"
+      expect { trigger_reset }.to raise_error(/Signature verification raised/)
     end
   end
 end