devise_masquerade 0.6.5 → 1.3.1

data/lib/devise_masquerade.rb

@@ -1,22 +1,16 @@
 require 'devise'
-
-require 'action_controller'
-require 'action_controller/base'
 require 'devise_masquerade/version'
 require 'devise_masquerade/routes'
 require 'devise_masquerade/controllers/helpers'
 require 'devise_masquerade/controllers/url_helpers'
 require 'devise_masquerade/rails'
 
-module DeviseMasquerade
-end
-
 module Devise
   mattr_accessor :masquerade_param
   @@masquerade_param = 'masquerade'
 
   mattr_accessor :masquerade_expires_in
-  @@masquerade_expires_in = 10.seconds
+  @@masquerade_expires_in = 1.minute
 
   mattr_accessor :masquerade_key_size
   @@masquerade_key_size = 16
@@ -42,5 +36,5 @@ module Devise
   @@helpers << DeviseMasquerade::Controllers::Helpers
 end
 
-Devise.add_module :masqueradable, :controller => :masquerades,
-  :model => 'devise_masquerade/model', :route => :masquerade
+Devise.add_module :masqueradable, controller: :masquerades,
+  model: 'devise_masquerade/models', route: :masquerade

data/lib/devise_masquerade/controllers/helpers.rb

@@ -6,23 +6,44 @@ module DeviseMasquerade
         class_name = mapping.class_name
 
         class_eval <<-METHODS, __FILE__, __LINE__ + 1
+          def masquerade!
+            return if params["#{Devise.masquerade_param}"].blank?
+
+            klass = unless params[:masqueraded_resource_class].blank?
+              params[:masqueraded_resource_class].constantize
+            else
+              if Devise.masqueraded_resource_class
+                Devise.masqueraded_resource_class
+              elsif defined?(User)
+                User
+              end
+            end
+            return unless klass
+
+            resource = GlobalID::Locator.locate_signed params[Devise.masquerade_param], for: 'masquerade'
+
+            if resource
+              masquerade_sign_in(resource)
+            end
+          end
+
           def masquerade_#{name}!
             return if params["#{Devise.masquerade_param}"].blank?
 
-            #{name} = ::#{class_name}.find_by_masquerade_key(params["#{Devise.masquerade_param}"])
+            resource = GlobalID::Locator.locate_signed params[Devise.masquerade_param], for: 'masquerade'
 
-            if #{name}
-              masquerade_sign_in(#{name})
+            if resource
+              masquerade_sign_in(resource)
             end
           end
 
           def #{name}_masquerade?
-            session[:"devise_masquerade_#{name}"].present?
+            ::Rails.cache.exist?(:"devise_masquerade_#{name}").present?
           end
 
           def #{name}_masquerade_owner
             return nil unless send(:#{name}_masquerade?)
-            ::#{class_name}.to_adapter.find_first(:id => session[:"devise_masquerade_#{name}"])
+            GlobalID::Locator.locate_signed(Rails.cache.read(:"devise_masquerade_#{name}"), for: 'masquerade')
           end
 
           private
@@ -32,7 +53,7 @@ module DeviseMasquerade
               if respond_to?(:bypass_sign_in)
                 bypass_sign_in(resource)
               else
-                sign_in(resource, :bypass => true)
+                sign_in(resource, bypass: true)
               end
             else
               sign_in(resource)
@@ -50,5 +71,3 @@ module DeviseMasquerade
     end
   end
 end
-
-ActionController::Base.send(:include, DeviseMasquerade::Controllers::Helpers)

data/lib/devise_masquerade/controllers/url_helpers.rb

@@ -1,16 +1,30 @@
+require 'securerandom'
+
 module DeviseMasquerade
   module Controllers
+
     module UrlHelpers
       def masquerade_path(resource, *args)
         scope = Devise::Mapping.find_scope!(resource)
-        send("#{scope}_masquerade_path", resource, *args)
+
+        opts = args.shift || {}
+        opts.merge!(masqueraded_resource_class: resource.class.name)
+
+        opts.merge!(Devise.masquerade_param => resource.masquerade_key)
+
+        send("#{scope}_masquerade_index_path", opts, *args)
       end
 
       def back_masquerade_path(resource, *args)
         scope = Devise::Mapping.find_scope!(resource)
-        send("back_#{scope}_masquerade_index_path", *args)
+
+        opts = args.first || {}
+        opts.merge!(masqueraded_resource_class: resource.class.name)
+
+        send("back_#{scope}_masquerade_index_path", opts, *args)
       end
     end
+
   end
 end
 

data/lib/devise_masquerade/models.rb

@@ -0,0 +1,9 @@
+require 'devise_masquerade/models/masqueradable'
+
+module DeviseMasquerade
+  module Models
+
+  end
+end
+
+Devise::Models.send :include, DeviseMasquerade::Models

data/lib/devise_masquerade/models/masqueradable.rb

@@ -0,0 +1,13 @@
+module DeviseMasquerade
+  module Models
+    module Masqueradable
+      extend ActiveSupport::Concern
+
+      included do
+        def masquerade_key
+          to_sgid(expires_in: Devise.masquerade_expires_in, for: 'masquerade')
+        end
+      end
+    end
+  end
+end

data/lib/devise_masquerade/rails.rb

@@ -1,7 +1,17 @@
+# frozen_string_literal: true
+
 module DeviseMasquerade
-  class Engine < ::Rails::Engine
-    ActiveSupport.on_load(:action_controller) { include DeviseMasquerade::Controllers::UrlHelpers }
-    ActiveSupport.on_load(:action_view)       { include DeviseMasquerade::Controllers::UrlHelpers }
+  module Rails
+
+    class Engine < ::Rails::Engine
+      initializer "devise.url_helpers" do
+        Devise.include_helpers(DeviseMasquerade::Controllers)
+      end
+
+      ActiveSupport.on_load(:action_controller) do
+        include DeviseMasquerade::Controllers::Helpers
+      end
+    end
+
   end
 end
-

data/lib/devise_masquerade/routes.rb

@@ -1,17 +1,20 @@
-module ActionDispatch::Routing
-  class Mapper
-
-    protected
+module DeviseMasquerade
+  module Routes
 
     def devise_masquerade(mapping, controllers)
       resources :masquerade,
-        :only => :show,
-        :path => mapping.path_names[:masquerade],
-        :controller => controllers[:masquerades] do
+        path: mapping.path_names[:masquerade],
+        controller: controllers[:masquerades],
+        only: [] do
 
-        get :back, :on => :collection
+        collection do
+          get :show
+          get :back
+        end
       end
     end
+
   end
 end
 
+ActionDispatch::Routing::Mapper.send :include, DeviseMasquerade::Routes

data/lib/devise_masquerade/version.rb

@@ -1,3 +1,3 @@
 module DeviseMasquerade
-  VERSION = '0.6.5'.freeze
+  VERSION = '1.3.1'.freeze
 end

data/spec/controllers/admin/dashboard_controller_spec.rb

@@ -5,14 +5,13 @@ describe Admin::DashboardController, type: :controller do
     before { admin_logged_in }
 
     context 'and admin masquerade by user' do
-      let!(:user) { create(:admin_user) }
+      let!(:mask) { create(:admin_user) }
 
       before do
-        user.masquerade!
-        get :index, :masquerade => user.masquerade_key
+        get :index, params: { masquerade: mask.masquerade_key, masqueraded_resource_class: 'Admin::User' }
       end
 
-      it { expect(current_admin_user.reload).to eq(user) }
+      it { expect(current_admin_user.reload).to eq(mask) }
     end
   end
 end

data/spec/controllers/dashboard_controller_spec.rb

@@ -5,15 +5,13 @@ describe DashboardController, type: :controller do
     before { logged_in }
 
     context 'and admin masquerade by user' do
-      let!(:user) { create(:user) }
+      let!(:mask) { create(:user) }
 
       before do
-        user.masquerade!
-
-        get :index, :masquerade => user.masquerade_key
+        get :index, params: { masquerade: mask.masquerade_key }
       end
 
-      it { expect(current_user.reload).to eq(user) }
+      it { expect(current_user.reload).to eq(mask) }
     end
   end
 end

data/spec/controllers/devise/masquerades_controller_spec.rb

@@ -7,73 +7,97 @@ describe Devise::MasqueradesController, type: :controller do
     context 'when logged in' do
       before { logged_in }
 
+      context 'with masqueradable_class param' do
+        let(:mask) { create(:student) }
+
+        before do
+          get :show, params: { id: mask.to_param, masqueraded_resource_class: mask.class.name, masquerade: mask.masquerade_key }
+        end
+
+        it { expect(Rails.cache.read('devise_masquerade_student')).to be }
+
+        it 'should have warden keys defined' do
+          expect(session["warden.user.student.key"].first.first).to eq(mask.id)
+        end
+
+        it { should redirect_to('/') }
+      end
+
       describe '#masquerade user' do
         let(:mask) { create(:user) }
 
         before do
-          expect(SecureRandom).to receive(:urlsafe_base64) { "secure_key" }
-          get :show, :id => mask.to_param
+          get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key }
         end
 
-        it { expect(session.keys).to include('devise_masquerade_user') }
+        it { expect(Rails.cache.read('devise_masquerade_user')).to be }
         it { expect(session["warden.user.user.key"].first.first).to eq(mask.id) }
-        it { should redirect_to("/?masquerade=secure_key") }
+        it { should redirect_to('/') }
 
         context 'and back' do
           before { get :back }
 
           it { should redirect_to(masquerade_page) }
           it { expect(current_user.reload).to eq(@user) }
-          it { expect(session.keys).not_to include('devise_masquerade_user') }
+          it { expect(Rails.cache.read('devise_masquerade_user')).not_to be }
         end
+      end
 
-        # Configure masquerade_routes_back setting
-        describe 'config#masquerade_routes_back' do
-          before { Devise.setup {|c| c.masquerade_routes_back = true } }
+      # Configure masquerade_routes_back setting
+      describe 'config#masquerade_routes_back' do
+        let(:mask) { create(:user) }
 
-          context 'show' do
-            before { expect(SecureRandom).to receive(:urlsafe_base64) { "secure_key" } }
+        before { Devise.setup { |c| c.masquerade_routes_back = true } }
 
-            context '< Rails 5 version' do
-              before do
-                @request.env['HTTP_REFERER'] = 'previous_location'
-                get :show, id: mask.to_param
-              end # before
+        after { Devise.masquerade_routes_back = false }
 
-              it { should redirect_to('previous_location') }
-            end # context
+        context 'show' do
+          context 'with http referrer' do
+            before do
+              @request.env['HTTP_REFERER'] = 'previous_location'
+              get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key }
+            end # before
 
-            context '< Rails 5, fallback if http_referer not present' do
-              before do
-                allow_any_instance_of(described_class).to receive(:after_masquerade_path_for).and_return("/dashboard?color=red")
-              end
+            it { should redirect_to('previous_location') }
+          end # context
 
-              before { get :show, id: mask.to_param }
+          context 'no http referrer' do
+            before do
+              allow_any_instance_of(described_class).to(
+                receive(:after_masquerade_path_for).and_return("/dashboard?color=red"))
+            end
 
-              it { should redirect_to("/dashboard?color=red&masquerade=secure_key") }
-            end # context
+            before { get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key } }
+
+            it { should redirect_to("/dashboard?color=red") }
           end # context
+        end # context
 
-          context '< Rails 5, and back' do
-            before { get :back }
+        context 'and back' do
+          before do
+            get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key }
 
-            it { should redirect_to(masquerade_page) }
-          end # context
+            get :back
+          end
 
-          context '< Rails 5, and back fallback if http_referer not present' do
-            before do
-              @request.env['HTTP_REFERER'] = 'previous_location'
-              get :back
-            end
+          it { should redirect_to(masquerade_page) }
+        end # context
 
-            it { should redirect_to('previous_location') }
-          end # context
-        end # describe
-      end
+        context 'and back fallback if http_referer not present' do
+          before do
+            get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key }
+
+            @request.env['HTTP_REFERER'] = 'previous_location'
+            get :back
+          end
+
+          it { should redirect_to('previous_location') }
+        end # context
+      end # describe
     end
 
     context 'when not logged in' do
-      before { get :show, :id => 'any_id' }
+      before { get :show, params: { id: 'any_id' } }
 
       it { should redirect_to(new_user_session_path) }
     end

data/spec/controllers/masquerades_tests_controller_spec.rb

@@ -0,0 +1,41 @@
+require 'spec_helper'
+
+describe MasqueradesTestsController, type: :controller do
+  before { @request.env['devise.mapping'] = Devise.mappings[:user] }
+
+  context 'no access for masquerade' do
+    before do
+      session.clear
+      allow_any_instance_of(MasqueradesTestsController).to receive(:masquerade_authorized?) { false }
+    end
+
+    before { logged_in }
+
+    let(:mask) { create(:user) }
+
+    before { get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key } }
+
+    it { expect(response.status).to eq(403) }
+    it { expect(Rails.cache.read('devise_masquerade_user')).not_to be }
+    it { expect(session['warden.user.user.key'].first.first).not_to eq(mask.id) }
+  end
+
+  context 'access for masquerade' do
+    before do
+      session.clear
+      allow_any_instance_of(MasqueradesTestsController).to receive(:masquerade_authorized?) { true }
+    end
+
+    before { logged_in }
+
+    let(:mask) { create(:user) }
+
+    before do
+      get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key }
+    end
+
+    it { expect(response.status).to eq(302) }
+    it { expect(Rails.cache.read('devise_masquerade_user')).to be }
+    it { expect(session['warden.user.user.key'].first.first).to eq(mask.id) }
+  end
+end

data/spec/dummy/app/controllers/admin/dashboard_controller.rb

@@ -1,6 +1,5 @@
 class Admin::DashboardController < ApplicationController
-  before_filter :authenticate_admin_user!
-  before_filter :masquerade_admin_user!
+  before_action :authenticate_admin_user!
 
   def index
     @users = Admin::User.where("admin_users.id != ?", current_admin_user.id).all

data/spec/dummy/app/controllers/application_controller.rb

@@ -1,4 +1,6 @@
 class ApplicationController < ActionController::Base
+  before_action :masquerade!
+
   protect_from_forgery
 end