devise_masquerade 0.6.5 → 2.1.0

data/lib/devise_masquerade/models/masqueradable.rb

@@ -0,0 +1,13 @@
+module DeviseMasquerade
+  module Models
+    module Masqueradable
+      extend ActiveSupport::Concern
+
+      included do
+        def masquerade_key
+          to_sgid(expires_in: Devise.masquerade_expires_in, for: 'masquerade')
+        end
+      end
+    end
+  end
+end

data/lib/devise_masquerade/models.rb

@@ -0,0 +1,9 @@
+require 'devise_masquerade/models/masqueradable'
+
+module DeviseMasquerade
+  module Models
+
+  end
+end
+
+Devise::Models.send :include, DeviseMasquerade::Models

data/lib/devise_masquerade/rails.rb

@@ -1,7 +1,17 @@
+# frozen_string_literal: true
+
 module DeviseMasquerade
-  class Engine < ::Rails::Engine
-    ActiveSupport.on_load(:action_controller) { include DeviseMasquerade::Controllers::UrlHelpers }
-    ActiveSupport.on_load(:action_view)       { include DeviseMasquerade::Controllers::UrlHelpers }
+  module Rails
+
+    class Engine < ::Rails::Engine
+      initializer "devise.url_helpers" do
+        Devise.include_helpers(DeviseMasquerade::Controllers)
+      end
+
+      ActiveSupport.on_load(:action_controller) do
+        include DeviseMasquerade::Controllers::Helpers
+      end
+    end
+
   end
 end
-

data/lib/devise_masquerade/routes.rb

@@ -1,17 +1,20 @@
-module ActionDispatch::Routing
-  class Mapper
-
-    protected
+module DeviseMasquerade
+  module Routes
 
     def devise_masquerade(mapping, controllers)
       resources :masquerade,
-        :only => :show,
-        :path => mapping.path_names[:masquerade],
-        :controller => controllers[:masquerades] do
+        path: mapping.path_names[:masquerade],
+        controller: controllers[:masquerades],
+        only: [] do
 
-        get :back, :on => :collection
+        collection do
+          get :show
+          get :back
+        end
       end
     end
+
   end
 end
 
+ActionDispatch::Routing::Mapper.send :include, DeviseMasquerade::Routes

data/lib/devise_masquerade/version.rb

@@ -1,3 +1,3 @@
 module DeviseMasquerade
-  VERSION = '0.6.5'.freeze
+  VERSION = '2.1.0'.freeze
 end

data/lib/devise_masquerade.rb

@@ -1,22 +1,16 @@
 require 'devise'
-
-require 'action_controller'
-require 'action_controller/base'
 require 'devise_masquerade/version'
 require 'devise_masquerade/routes'
 require 'devise_masquerade/controllers/helpers'
 require 'devise_masquerade/controllers/url_helpers'
 require 'devise_masquerade/rails'
 
-module DeviseMasquerade
-end
-
 module Devise
   mattr_accessor :masquerade_param
   @@masquerade_param = 'masquerade'
 
   mattr_accessor :masquerade_expires_in
-  @@masquerade_expires_in = 10.seconds
+  @@masquerade_expires_in = 1.minute
 
   mattr_accessor :masquerade_key_size
   @@masquerade_key_size = 16
@@ -30,17 +24,37 @@ module Devise
   # Example: Devise.masqueraded_resource_class = User
   mattr_accessor :masqueraded_resource_class
 
+  # Example: Devise.masqueraded_resource_class_name = 'User'
+  mattr_accessor :masqueraded_resource_class_name
+
   # Example: Devise.masqueraded_resource_name = :user
   mattr_accessor :masqueraded_resource_name
 
   # Example: Devise.masquerading_resource_class = AdminUser
   mattr_accessor :masquerading_resource_class
 
+  # Example: Devise.masquerading_resource_class_name = 'AdminUser'
+  mattr_accessor :masquerading_resource_class_name
+
   # Example: Devise.masquerading_resource_name = :admin_user
   mattr_accessor :masquerading_resource_name
 
+  # Example: Devise.masquerade_storage_method = :session
+  # - session
+  # - cache
+  mattr_accessor :masquerade_storage_method
+  @@masquerade_storage_method = :session
+
+  def self.masquerade_storage_method_session?
+    Devise.masquerade_storage_method == :session
+  end
+
+  def self.masquerade_storage_method_cache?
+    Devise.masquerade_storage_method == :cache
+  end
+
   @@helpers << DeviseMasquerade::Controllers::Helpers
 end
 
-Devise.add_module :masqueradable, :controller => :masquerades,
-  :model => 'devise_masquerade/model', :route => :masquerade
+Devise.add_module :masqueradable, controller: :masquerades,
+  model: 'devise_masquerade/models', route: :masquerade

data/spec/controllers/admin/dashboard_controller_spec.rb

@@ -5,14 +5,13 @@ describe Admin::DashboardController, type: :controller do
     before { admin_logged_in }
 
     context 'and admin masquerade by user' do
-      let!(:user) { create(:admin_user) }
+      let!(:mask) { create(:admin_user) }
 
       before do
-        user.masquerade!
-        get :index, :masquerade => user.masquerade_key
+        get :index, params: { masquerade: mask.masquerade_key, masqueraded_resource_class: 'Admin::User' }
       end
 
-      it { expect(current_admin_user.reload).to eq(user) }
+      it { expect(current_admin_user.reload).to eq(mask) }
     end
   end
 end

data/spec/controllers/dashboard_controller_spec.rb

@@ -5,15 +5,13 @@ describe DashboardController, type: :controller do
     before { logged_in }
 
     context 'and admin masquerade by user' do
-      let!(:user) { create(:user) }
+      let!(:mask) { create(:user) }
 
       before do
-        user.masquerade!
-
-        get :index, :masquerade => user.masquerade_key
+        get :index, params: { masquerade: mask.masquerade_key }
       end
 
-      it { expect(current_user.reload).to eq(user) }
+      it { expect(current_user.reload).to eq(mask) }
     end
   end
 end

data/spec/controllers/devise/masquerades_controller_spec.rb

@@ -1,9 +1,31 @@
 require 'spec_helper'
 
 describe Devise::MasqueradesController, type: :controller do
+  before { Devise.masquerade_storage_method = :cache }
+  after { Devise.masquerade_storage_method = :session }
+
   context 'with configured devise app' do
     before { @request.env['devise.mapping'] = Devise.mappings[:user] }
 
+    context 'when logged in' do
+      before { logged_in }
+
+      context 'with masqueradable_class param' do
+        let(:mask) { create(:student) }
+
+        before do
+          get :show, params: { id: mask.id, masqueraded_resource_class: mask.class.name, masquerade: mask.masquerade_key }
+        end
+
+        it { expect(cache_read(mask)).to be }
+
+        it 'should have warden keys defined' do
+          expect(session["warden.user.student.key"].first.first).to eq(mask.id)
+        end
+
+        it { should redirect_to('/') }
+      end
+    end
     context 'when logged in' do
       before { logged_in }
 
@@ -11,69 +33,77 @@ describe Devise::MasqueradesController, type: :controller do
         let(:mask) { create(:user) }
 
         before do
-          expect(SecureRandom).to receive(:urlsafe_base64) { "secure_key" }
-          get :show, :id => mask.to_param
+          get :show, params: { id: mask.id, masquerade: mask.masquerade_key }
         end
 
-        it { expect(session.keys).to include('devise_masquerade_user') }
+        it { expect(cache_read(mask)).to be }
         it { expect(session["warden.user.user.key"].first.first).to eq(mask.id) }
-        it { should redirect_to("/?masquerade=secure_key") }
+        it { should redirect_to('/') }
 
         context 'and back' do
           before { get :back }
 
           it { should redirect_to(masquerade_page) }
           it { expect(current_user.reload).to eq(@user) }
-          it { expect(session.keys).not_to include('devise_masquerade_user') }
+          it { expect(cache_read(mask)).not_to be }
         end
+      end
 
-        # Configure masquerade_routes_back setting
-        describe 'config#masquerade_routes_back' do
-          before { Devise.setup {|c| c.masquerade_routes_back = true } }
+      # Configure masquerade_routes_back setting
+      describe 'config#masquerade_routes_back' do
+        let(:mask) { create(:user) }
 
-          context 'show' do
-            before { expect(SecureRandom).to receive(:urlsafe_base64) { "secure_key" } }
+        before { Devise.setup { |c| c.masquerade_routes_back = true } }
 
-            context '< Rails 5 version' do
-              before do
-                @request.env['HTTP_REFERER'] = 'previous_location'
-                get :show, id: mask.to_param
-              end # before
+        after { Devise.masquerade_routes_back = false }
 
-              it { should redirect_to('previous_location') }
-            end # context
+        context 'show' do
+          context 'with http referrer' do
+            before do
+              @request.env['HTTP_REFERER'] = 'previous_location'
+              get :show, params: { id: mask.id, masquerade: mask.masquerade_key }
+            end # before
 
-            context '< Rails 5, fallback if http_referer not present' do
-              before do
-                allow_any_instance_of(described_class).to receive(:after_masquerade_path_for).and_return("/dashboard?color=red")
-              end
+            it { should redirect_to('previous_location') }
+          end # context
 
-              before { get :show, id: mask.to_param }
+          context 'no http referrer' do
+            before do
+              allow_any_instance_of(described_class).to(
+                receive(:after_masquerade_path_for).and_return("/dashboard?color=red"))
+            end
+
+            before { get :show, params: { id: mask.id, masquerade: mask.masquerade_key } }
 
-              it { should redirect_to("/dashboard?color=red&masquerade=secure_key") }
-            end # context
+            it { should redirect_to("/dashboard?color=red") }
           end # context
+        end # context
 
-          context '< Rails 5, and back' do
-            before { get :back }
+        context 'and back' do
+          before do
+            get :show, params: { id: mask.id, masquerade: mask.masquerade_key }
 
-            it { should redirect_to(masquerade_page) }
-          end # context
+            get :back
+          end
 
-          context '< Rails 5, and back fallback if http_referer not present' do
-            before do
-              @request.env['HTTP_REFERER'] = 'previous_location'
-              get :back
-            end
+          it { should redirect_to(masquerade_page) }
+        end # context
 
-            it { should redirect_to('previous_location') }
-          end # context
-        end # describe
-      end
+        context 'and back fallback if http_referer not present' do
+          before do
+            get :show, params: { id: mask.id, masquerade: mask.masquerade_key }
+
+            @request.env['HTTP_REFERER'] = 'previous_location'
+            get :back
+          end
+
+          it { should redirect_to('previous_location') }
+        end # context
+      end # describe
     end
 
     context 'when not logged in' do
-      before { get :show, :id => 'any_id' }
+      before { get :show, params: { id: 'any_id' } }
 
       it { should redirect_to(new_user_session_path) }
     end
@@ -83,4 +113,16 @@ describe Devise::MasqueradesController, type: :controller do
   def masquerade_page
     "/"
   end
+
+  def guid
+    session[:devise_masquerade_masquerading_resource_guid]
+  end
+
+  def cache_read(user)
+    Rails.cache.read(cache_key(user))
+  end
+
+  def cache_key(user)
+    "devise_masquerade_#{mask.class.name.downcase}_#{mask.id}_#{guid}"
+  end
 end

data/spec/controllers/masquerades_tests_controller_spec.rb

@@ -0,0 +1,57 @@
+require 'spec_helper'
+
+describe MasqueradesTestsController, type: :controller do
+  before { Devise.masquerade_storage_method = :cache }
+  after { Devise.masquerade_storage_method = :session }
+
+  before { @request.env['devise.mapping'] = Devise.mappings[:user] }
+
+  context 'no access for masquerade' do
+    before do
+      session.clear
+      allow_any_instance_of(MasqueradesTestsController).to receive(:masquerade_authorized?) { false }
+    end
+
+    before { logged_in }
+
+    let(:mask) { create(:user) }
+
+    before { get :show, params: { id: mask.id, masquerade: mask.masquerade_key } }
+
+    it { expect(response.status).to eq(403) }
+    it { expect(cache_read(mask)).not_to be }
+    it { expect(session['warden.user.user.key'].first.first).not_to eq(mask.id) }
+  end
+
+  context 'access for masquerade' do
+    before do
+      session.clear
+      allow_any_instance_of(MasqueradesTestsController).to receive(:masquerade_authorized?) { true }
+    end
+
+    before { logged_in }
+
+    let(:mask) { create(:user) }
+
+    before do
+      get :show, params: { id: mask.id, masquerade: mask.masquerade_key }
+    end
+
+    it { expect(response.status).to eq(302) }
+    it { expect(cache_read(mask)).to be }
+    it { expect(session['warden.user.user.key'].first.first).to eq(mask.id) }
+  end
+
+
+  def guid
+    session[:devise_masquerade_masquerading_resource_guid]
+  end
+
+  def cache_read(user)
+    Rails.cache.read(cache_key(user))
+  end
+
+  def cache_key(user)
+    "devise_masquerade_#{mask.class.name.downcase}_#{mask.id}_#{guid}"
+  end
+end

data/spec/dummy/app/controllers/admin/dashboard_controller.rb

@@ -1,6 +1,5 @@
 class Admin::DashboardController < ApplicationController
-  before_filter :authenticate_admin_user!
-  before_filter :masquerade_admin_user!
+  before_action :authenticate_admin_user!
 
   def index
     @users = Admin::User.where("admin_users.id != ?", current_admin_user.id).all

data/spec/dummy/app/controllers/application_controller.rb

@@ -1,4 +1,6 @@
 class ApplicationController < ActionController::Base
+  before_action :masquerade!
+
   protect_from_forgery
 end
 

data/spec/dummy/app/controllers/dashboard_controller.rb

@@ -1,9 +1,12 @@
 class DashboardController < ApplicationController
-  before_filter :authenticate_user!
-  before_filter :masquerade_user!
+  before_action :authenticate_user!
 
   def index
     @users = User.where("users.id != ?", current_user.id).all
   end
+
+  def extra_params
+    @users = User.where("users.id != ?", current_user.id).all
+  end
 end
 

data/spec/dummy/app/controllers/masquerades_tests_controller.rb

@@ -0,0 +1,7 @@
+class MasqueradesTestsController < Devise::MasqueradesController
+  before_action :authenticate_user!
+
+  def show
+    super
+  end
+end

data/spec/dummy/app/controllers/students_controller.rb

@@ -0,0 +1,8 @@
+class StudentsController < ApplicationController
+  before_action :authenticate_user!
+
+  def index
+    @students = Student.all
+  end
+end
+

data/spec/dummy/app/models/admin/user.rb

@@ -1,13 +1,6 @@
 class Admin::User < ActiveRecord::Base
-  # Include default devise modules. Others available are:
-  # :token_authenticatable, :confirmable,
-  # :lockable, :timeoutable and :omniauthable
   devise :database_authenticatable, :registerable,
          :recoverable, :rememberable, :trackable, :validatable,
          :masqueradable
-
-  # Setup accessible (or protected) attributes for your model
-  attr_accessible :email, :password, :password_confirmation, :remember_me
-  # attr_accessible :title, :body
 end
 

data/spec/dummy/app/models/student.rb

@@ -0,0 +1,3 @@
+class Student < ActiveRecord::Base
+  devise :database_authenticatable, :validatable, :masqueradable
+end

data/spec/dummy/app/models/user.rb

@@ -1,12 +1,3 @@
 class User < ActiveRecord::Base
-  # Include default devise modules. Others available are:
-  # :token_authenticatable, :confirmable,
-  # :lockable, :timeoutable and :omniauthable
-  devise :database_authenticatable, :registerable,
-         :recoverable, :rememberable, :trackable, :validatable,
-         :masqueradable
-
-  # Setup accessible (or protected) attributes for your model
-  attr_accessible :email, :password, :password_confirmation, :remember_me
-  # attr_accessible :title, :body
+  devise :database_authenticatable, :validatable, :masqueradable
 end

data/spec/dummy/app/views/admin/dashboard/index.html.erb

@@ -1,3 +1 @@
-<h1>Users</h1>
-
 <%= render @users %>

data/spec/dummy/app/views/dashboard/extra_params.html.erb

@@ -0,0 +1,7 @@
+<% @users.each do |user| %>
+  <p>
+    <%= user.email %>
+
+    <%= link_to "Login as", masquerade_path(user, key1: 'value1'), class: 'login_as' %>
+  </p>
+<% end %>

data/spec/dummy/app/views/dashboard/index.html.erb

@@ -1,3 +1 @@
-<h1>Users</h1>
-
 <%= render @users %>

data/spec/dummy/app/views/layouts/application.html.erb

@@ -8,10 +8,18 @@
   </head>
   <body>
     <% if signed_in? %>
-      <h1 class='current_user'><%= current_user.email %></h1>
+      <% if user_signed_in? %>
+        <h1 class='current_user'><%= current_user.email %></h1>
+      <% end %>
+
+      <% if student_signed_in? %>
+        <h1 class='current_student'><%= current_student.email %></h1>
+      <% end %>
 
       <% if user_masquerade? %>
-        <%= link_to "Back masquerade", back_masquerade_path(current_user) %>
+        <h1 class='owner_user'><%= user_masquerade_owner.email %></h1>
+
+        <%= link_to "Back masquerade", back_masquerade_path(User.new) %>
       <% end %>
     <% end %>
 

data/spec/dummy/app/views/students/_student.html.erb

@@ -0,0 +1,6 @@
+<p>
+  <%= student.email %>
+
+  <%= link_to "Login as", masquerade_path(student), class: 'login_as' %>
+</p>
+

data/spec/dummy/app/views/students/index.html.erb

@@ -0,0 +1 @@
+<%= render @students %>

data/spec/dummy/app/views/users/_user.html.erb

@@ -1,6 +1,6 @@
 <p>
   <%= user.email %>
 
-  <%= link_to "Login as", masquerade_path(user) %>
+  <%= link_to "Login as", masquerade_path(user), class: 'login_as' %>
 </p>
 

data/spec/dummy/config/application.rb

@@ -16,6 +16,8 @@ module Dummy
     config.encoding = "utf-8"
 
     config.filter_parameters += [:password]
+
+    config.eager_load = false
   end
 end
 

data/spec/dummy/config/environment.rb

@@ -2,4 +2,5 @@
 require File.expand_path('../application', __FILE__)
 
 # Initialize the rails application
+#
 Dummy::Application.initialize!

data/spec/dummy/config/routes.rb

@@ -1,12 +1,16 @@
 Dummy::Application.routes.draw do
-  devise_for :users, controllers: { masquerades: "users/masquerades" }
-  devise_for :admin_users, :class_name => 'Admin::User'
+  devise_for :users, controllers: { masquerades: 'users/masquerades' }
+  devise_for :admin_users, class_name: Admin::User.name
+  devise_for :students, class_name: Student.name
 
-  root :to => 'dashboard#index'
+  root to: 'dashboard#index'
 
-  resources :masquerades
+  get '/extra_params', to: 'dashboard#extra_params'
+
+  resources :masquerades_tests
+  resources :students, only: :index
 
   namespace :admin do
-    root :to => 'dashboard#index'
+    root to: 'dashboard#index'
   end
 end

data/spec/dummy/db/.gitignore

@@ -0,0 +1 @@
+test.sqlite3*

data/spec/dummy/db/migrate/20121119085620_devise_create_users.rb

@@ -1,4 +1,4 @@
-class DeviseCreateUsers < ActiveRecord::Migration
+class DeviseCreateUsers < ActiveRecord::Migration[5.2]
   def change
     create_table(:users) do |t|
       ## Database authenticatable

data/spec/dummy/db/migrate/20140418160449_create_admin_users.rb

@@ -1,4 +1,4 @@
-class CreateAdminUsers < ActiveRecord::Migration
+class CreateAdminUsers < ActiveRecord::Migration[5.2]
   def change
     create_table(:admin_users) do |t|
       ## Database authenticatable

data/spec/dummy/db/migrate/20191022100000_create_students.rb

@@ -0,0 +1,14 @@
+class CreateStudents < ActiveRecord::Migration[5.2]
+  def change
+    create_table(:students) do |t|
+      t.string :email,              null: false, default: ''
+      t.string :encrypted_password, null: false, default: ''
+
+      t.timestamps
+    end
+
+    add_index :students, :email,                unique: true
+    add_index :students, :reset_password_token, unique: true
+  end
+end
+