devise_masquerade 1.3.0 → 1.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9b0f25fa4c2e5b41336a6b39bb4eab9dc8cc9a90544de0dffec1cd95d2b8b7f6
-  data.tar.gz: 96073dd0fb8c13658d7f9b6e156aeb9a9fd90d0aa3e5360fe8416e698b00ceb6
+  metadata.gz: 02e2f123857132cfdeaf49b1dbb8cef1dce29175448f862dba6387e72087ebe2
+  data.tar.gz: 451e8c53e1e84d565fd0fcb13439c0f3b75dd27a00fb112e0c2fd8976f67b00b
 SHA512:
-  metadata.gz: 243f3b4580c80bbf3c281df44bb7fba95d18ac67e0a547e925eb50d784bf05d7364c64ad439c45486473d38481f22b45aa44a9d152eddd67759e6792cf956bb4
-  data.tar.gz: 3f48a1f7d0a79f2b220380e6aa357ae3a9d937d817b00040b106b7e539d2ed651c61aec2da24626d8a58c9626a30ee958cb752dc779ed3195e09cf1b91177cdd
+  metadata.gz: 4f3ea1133abf1ae6126ce12e64fb118fa88e2627587f1e29833fb7805bd230cac706d7e4ab1f12848409cca824e670a131f8b4c3bb1e02e00a45337ab8071de0
+  data.tar.gz: a281f8c5bcab7bde06ca043830ed98982e38c7e061a77be364768486caf7a5f10f85b35e5788c6334806a3b98a6010e8f4e1ee170a0baba88d05723429036287

data/.travis.yml

@@ -2,6 +2,7 @@ language: ruby
 rvm:
   - 2.5.1
   - 2.6.0
+  - 2.7.2
 gemfile:
   - Gemfile
 script: time ./script/travis.sh

data/Gemfile.lock

@@ -52,7 +52,7 @@ GIT
 PATH
   remote: .
   specs:
-    devise_masquerade (1.3.0)
+    devise_masquerade (1.3.5)
       devise (>= 4.7.0)
       globalid (>= 0.3.6)
       railties (>= 5.2.0)
@@ -201,13 +201,14 @@ GEM
       mime-types-data (~> 3.2015)
     mime-types-data (3.2019.1009)
     mini_mime (1.0.2)
-    mini_portile2 (2.4.0)
+    mini_portile2 (2.5.0)
     minitest (5.12.2)
     multi_json (1.14.1)
     multi_test (0.1.2)
     nenv (0.3.0)
-    nokogiri (1.10.8)
-      mini_portile2 (~> 2.4.0)
+    nokogiri (1.11.1)
+      mini_portile2 (~> 2.5.0)
+      racc (~> 1.4)
     notiffany (0.1.3)
       nenv (~> 0.1)
       shellany (~> 0.0)
@@ -220,6 +221,7 @@ GEM
       byebug (~> 11.0)
       pry (~> 0.10)
     public_suffix (4.0.1)
+    racc (1.5.2)
     rack (2.2.3)
     rack-test (1.1.0)
       rack (>= 1.0, < 3)

data/app/controllers/devise/masquerades_controller.rb

@@ -6,14 +6,16 @@ class Devise::MasqueradesController < DeviseController
   end
   skip_before_action :masquerade!, raise: false
 
-  prepend_before_action :authenticate_scope!, :masquerade_authorize!
+  prepend_before_action :authenticate_scope!, only: :show
+  prepend_before_action :masquerade_authorize!
 
-  before_action :save_masquerade_owner_session, only: :show
+  def show
+    masqueradable_resource = find_masqueradable_resource
 
-  after_action :cleanup_masquerade_owner_session, only: :back
+    save_masquerade_owner_session(masqueradable_resource)
 
-  def show
-    self.resource = find_resource
+    self.resource = masqueradable_resource
+    sign_out(send("current_#{masquerading_resource_name}"))
 
     unless resource
       flash[:error] = "#{masqueraded_resource_class} not found."
@@ -28,16 +30,21 @@ class Devise::MasqueradesController < DeviseController
   end
 
   def back
-    self.resource = find_owner_resource
+    masqueradable_resource = send("current_#{masqueraded_resource_name}")
 
-    if resource.class != masqueraded_resource_class
-      sign_out(send("current_#{masqueraded_resource_name}"))
+    unless send("#{masqueraded_resource_name}_signed_in?")
+      head(401) and return
     end
 
+    self.resource = find_owner_resource(masqueradable_resource)
+    sign_out(send("current_#{masqueraded_resource_name}"))
+
     masquerade_sign_in(resource)
     request.env['devise.skip_trackable'] = nil
 
     go_back(resource, path: after_back_masquerade_path_for(resource))
+
+    cleanup_masquerade_owner_session(masqueradable_resource)
   end
 
   protected
@@ -50,12 +57,14 @@ class Devise::MasqueradesController < DeviseController
     true
   end
 
-  def find_resource
-    GlobalID::Locator.locate_signed params[Devise.masquerade_param], for: 'masquerade'
+  def find_masqueradable_resource
+    GlobalID::Locator.locate_signed(params[Devise.masquerade_param], for: 'masquerade')
   end
 
-  def find_owner_resource
-    GlobalID::Locator.locate_signed(Rails.cache.read(session_key), for: 'masquerade')
+  def find_owner_resource(masqueradable_resource)
+    skey = session_key(masqueradable_resource)
+
+    GlobalID::Locator.locate_signed(Rails.cache.read(skey), for: 'masquerade')
   end
 
   def go_back(user, path:)
@@ -120,27 +129,30 @@ class Devise::MasqueradesController < DeviseController
     '/'
   end
 
-  def save_masquerade_owner_session
+  def save_masquerade_owner_session(masqueradable_resource)
+    skey = session_key(masqueradable_resource)
+
     resource_gid = send("current_#{masquerading_resource_name}").to_sgid(
       expires_in: Devise.masquerade_expires_in, for: 'masquerade')
-    # skip sharing owner id via session
-    Rails.cache.write(session_key, resource_gid, expires_in: Devise.masquerade_expires_in)
 
-    unless session.key?(session_key)
-      session[session_key_masquerading_resource_class] = masquerading_resource_class.name
-      session[session_key_masqueraded_resource_class] = masqueraded_resource_class.name
-    end
+    # skip sharing owner id via session
+    Rails.cache.write(skey, resource_gid, expires_in: Devise.masquerade_expires_in)
+    session[skey] = true
+    session[session_key_masquerading_resource_class] = masquerading_resource_class.name
+    session[session_key_masqueraded_resource_class] = masqueraded_resource_class.name
   end
 
-  def cleanup_masquerade_owner_session
-    Rails.cache.delete(session_key)
+  def cleanup_masquerade_owner_session(masqueradable_resource)
+    skey = session_key(masqueradable_resource)
 
+    Rails.cache.delete(skey)
+    session.delete(skey)
     session.delete(session_key_masqueraded_resource_class)
     session.delete(session_key_masquerading_resource_class)
   end
 
-  def session_key
-    "devise_masquerade_#{masqueraded_resource_name}".to_sym
+  def session_key(masqueradable_resource)
+    "devise_masquerade_#{masqueraded_resource_name}_#{masqueradable_resource.to_param}".to_sym
   end
 
   def session_key_masqueraded_resource_class
@@ -148,6 +160,6 @@ class Devise::MasqueradesController < DeviseController
   end
 
   def session_key_masquerading_resource_class
-    "devise_masquerade_masquerading_resource_class"
+      "devise_masquerade_masquerading_resource_class"
   end
 end

data/features/step_definitions/url_helpers_steps.rb

@@ -0,0 +1,11 @@
+Then("I should see maquerade url") do
+  page.html.should include('href="/users/masquerade?masquerade=')
+end
+
+When("I am on the users page with extra params") do
+  visit '/extra_params'
+end
+
+Then("I should see maquerade url with extra params") do
+  page.html.should include('href="/users/masquerade?key1=value1&masquerade=')
+end

data/features/url_helpers.feature

@@ -0,0 +1,14 @@
+Feature: Use masquerade path to generate routes on page
+  In order to have the way to render masquerade path
+  As an user
+  I want to be able to see the url and use it
+
+  Scenario: Use masquerade path helper
+    Given I logged in
+    And I have a user for masquerade
+
+    When I am on the users page
+      Then I should see maquerade url
+
+    When I am on the users page with extra params
+      Then I should see maquerade url with extra params

data/lib/devise_masquerade/controllers/helpers.rb

@@ -38,12 +38,19 @@ module DeviseMasquerade
           end
 
           def #{name}_masquerade?
-            ::Rails.cache.exist?(:"devise_masquerade_#{name}").present?
+            return false if current_#{name}.blank?
+
+            key = "devise_masquerade_#{name}_" + current_#{name}.to_param
+            return false if session[key].blank?
+
+            ::Rails.cache.exist?(key.to_sym).present?
           end
 
           def #{name}_masquerade_owner
-            return nil unless send(:#{name}_masquerade?)
-            GlobalID::Locator.locate_signed(Rails.cache.read(:"devise_masquerade_#{name}"), for: 'masquerade')
+            return unless send(:#{name}_masquerade?)
+
+            key = "devise_masquerade_#{name}_" + current_#{name}.to_param
+            GlobalID::Locator.locate_signed(::Rails.cache.read(key.to_sym, for: 'masquerade'))
           end
 
           private

data/lib/devise_masquerade/controllers/url_helpers.rb

@@ -7,12 +7,12 @@ module DeviseMasquerade
       def masquerade_path(resource, *args)
         scope = Devise::Mapping.find_scope!(resource)
 
-        opts = args.first || {}
+        opts = args.shift || {}
         opts.merge!(masqueraded_resource_class: resource.class.name)
 
         opts.merge!(Devise.masquerade_param => resource.masquerade_key)
 
-        send("#{scope}_masquerade_path", resource, opts, *args)
+        send("#{scope}_masquerade_index_path", opts, *args)
       end
 
       def back_masquerade_path(resource, *args)

data/lib/devise_masquerade/routes.rb

@@ -3,11 +3,12 @@ module DeviseMasquerade
 
     def devise_masquerade(mapping, controllers)
       resources :masquerade,
-        only: :show,
         path: mapping.path_names[:masquerade],
-        controller: controllers[:masquerades] do
+        controller: controllers[:masquerades],
+        only: [] do
 
         collection do
+          get :show
           get :back
         end
       end

data/lib/devise_masquerade/version.rb

@@ -1,3 +1,3 @@
 module DeviseMasquerade
-  VERSION = '1.3.0'.freeze
+  VERSION = '1.3.5'.freeze
 end

data/spec/controllers/devise/masquerades_controller_spec.rb

@@ -14,7 +14,7 @@ describe Devise::MasqueradesController, type: :controller do
           get :show, params: { id: mask.to_param, masqueraded_resource_class: mask.class.name, masquerade: mask.masquerade_key }
         end
 
-        it { expect(Rails.cache.read('devise_masquerade_student')).to be }
+        it { expect(Rails.cache.read("devise_masquerade_student_#{mask.to_param}")).to be }
 
         it 'should have warden keys defined' do
           expect(session["warden.user.student.key"].first.first).to eq(mask.id)
@@ -30,7 +30,7 @@ describe Devise::MasqueradesController, type: :controller do
           get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key }
         end
 
-        it { expect(Rails.cache.read('devise_masquerade_user')).to be }
+        it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).to be }
         it { expect(session["warden.user.user.key"].first.first).to eq(mask.id) }
         it { should redirect_to('/') }
 
@@ -39,7 +39,7 @@ describe Devise::MasqueradesController, type: :controller do
 
           it { should redirect_to(masquerade_page) }
           it { expect(current_user.reload).to eq(@user) }
-          it { expect(Rails.cache.read('devise_masquerade_user')).not_to be }
+          it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).not_to be }
         end
       end
 

data/spec/controllers/masquerades_tests_controller_spec.rb

@@ -16,7 +16,7 @@ describe MasqueradesTestsController, type: :controller do
     before { get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key } }
 
     it { expect(response.status).to eq(403) }
-    it { expect(Rails.cache.read('devise_masquerade_user')).not_to be }
+    it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).not_to be }
     it { expect(session['warden.user.user.key'].first.first).not_to eq(mask.id) }
   end
 
@@ -35,7 +35,7 @@ describe MasqueradesTestsController, type: :controller do
     end
 
     it { expect(response.status).to eq(302) }
-    it { expect(Rails.cache.read('devise_masquerade_user')).to be }
+    it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).to be }
     it { expect(session['warden.user.user.key'].first.first).to eq(mask.id) }
   end
 end

data/spec/dummy/app/controllers/dashboard_controller.rb

@@ -4,5 +4,9 @@ class DashboardController < ApplicationController
   def index
     @users = User.where("users.id != ?", current_user.id).all
   end
+
+  def extra_params
+    @users = User.where("users.id != ?", current_user.id).all
+  end
 end
 

data/spec/dummy/app/views/dashboard/extra_params.html.erb

@@ -0,0 +1,7 @@
+<% @users.each do |user| %>
+  <p>
+    <%= user.email %>
+
+    <%= link_to "Login as", masquerade_path(user, key1: 'value1'), class: 'login_as' %>
+  </p>
+<% end %>

data/spec/dummy/app/views/layouts/application.html.erb

@@ -17,7 +17,7 @@
       <% end %>
 
       <% if user_masquerade? %>
-        <%= link_to "Back masquerade", back_masquerade_path(current_user) %>
+        <%= link_to "Back masquerade", back_masquerade_path(User.new) %>
       <% end %>
     <% end %>
 

data/spec/dummy/config/routes.rb

@@ -1,10 +1,12 @@
 Dummy::Application.routes.draw do
-  devise_for :users, controllers: { masquerades: "users/masquerades" }
+  devise_for :users, controllers: { masquerades: 'users/masquerades' }
   devise_for :admin_users, class_name: Admin::User.name
   devise_for :students, class_name: Student.name
 
   root to: 'dashboard#index'
 
+  get '/extra_params', to: 'dashboard#extra_params'
+
   resources :masquerades_tests
   resources :students, only: :index
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise_masquerade
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.3.5
 platform: ruby
 authors:
 - Alexandr Korsak
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-02-03 00:00:00.000000000 Z
+date: 2021-02-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -95,7 +95,9 @@ files:
 - features/multiple_masquerading_models.feature
 - features/step_definitions/auth_steps.rb
 - features/step_definitions/back_steps.rb
+- features/step_definitions/url_helpers_steps.rb
 - features/support/env.rb
+- features/url_helpers.feature
 - lib/devise_masquerade.rb
 - lib/devise_masquerade/controllers/helpers.rb
 - lib/devise_masquerade/controllers/url_helpers.rb
@@ -122,6 +124,7 @@ files:
 - spec/dummy/app/models/student.rb
 - spec/dummy/app/models/user.rb
 - spec/dummy/app/views/admin/dashboard/index.html.erb
+- spec/dummy/app/views/dashboard/extra_params.html.erb
 - spec/dummy/app/views/dashboard/index.html.erb
 - spec/dummy/app/views/layouts/application.html.erb
 - spec/dummy/app/views/students/_student.html.erb
@@ -185,7 +188,9 @@ test_files:
 - features/multiple_masquerading_models.feature
 - features/step_definitions/auth_steps.rb
 - features/step_definitions/back_steps.rb
+- features/step_definitions/url_helpers_steps.rb
 - features/support/env.rb
+- features/url_helpers.feature
 - spec/controllers/admin/dashboard_controller_spec.rb
 - spec/controllers/dashboard_controller_spec.rb
 - spec/controllers/devise/masquerades_controller_spec.rb
@@ -203,6 +208,7 @@ test_files:
 - spec/dummy/app/models/student.rb
 - spec/dummy/app/models/user.rb
 - spec/dummy/app/views/admin/dashboard/index.html.erb
+- spec/dummy/app/views/dashboard/extra_params.html.erb
 - spec/dummy/app/views/dashboard/index.html.erb
 - spec/dummy/app/views/layouts/application.html.erb
 - spec/dummy/app/views/students/_student.html.erb