devise_masquerade 1.3.3 → 1.3.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 23f626ba1c590f1686660a00804eaa5c5139a210fae80e72168a9f0a322e4be8
-  data.tar.gz: ee1641f8fed338ac83be5935b5e374df60fc7eb003919c120b24052528462302
+  metadata.gz: 3f3c384ee31658834131c95ec34bc376340a9f7d8b7d237ed97316f6e61eb5ee
+  data.tar.gz: 78f66fc23c43a3db4eef66c98e15447decfea5627b2900c2ee827785a3b0cdd2
 SHA512:
-  metadata.gz: 49c892cf2302d56d3d3aafb106d4e2eeba92b6c2f256440aa27a428df620bd16f49e89d5666ef6c2083e44fb260c1cb0beef3e575234cf5c6e91bff8f621dc4d
-  data.tar.gz: 357d959e456fa0d10a748f2c15b4cd0f94f8c21e773c970d52715e752dfd29c4d39f1e5f06fb2cbe11c8b4517c9503203954af1674a4a02c89669ffacbacc5c0
+  metadata.gz: a6b318f8d335a53524a94d24b5c1bc78c41bc308200a0eed543fabdfb891e63a1d119efee269282f9f2e4e1d1a7dd27161076ed9465c3ac55b188f2127dce429
+  data.tar.gz: 0d39bbd0099a4d70496ece49d3db3e955eadbcb14bc20accfcc9fcc90c070b9e7aa5b697ce91367c7d20590a218d182fe99b7d0c37b220fd4bbb59ee1f6c5bde

data/Gemfile.lock

@@ -52,7 +52,7 @@ GIT
 PATH
   remote: .
   specs:
-    devise_masquerade (1.3.3)
+    devise_masquerade (1.3.8)
       devise (>= 4.7.0)
       globalid (>= 0.3.6)
       railties (>= 5.2.0)

data/app/controllers/devise/masquerades_controller.rb

@@ -9,44 +9,53 @@ class Devise::MasqueradesController < DeviseController
   prepend_before_action :authenticate_scope!, only: :show
   prepend_before_action :masquerade_authorize!
 
-  before_action :save_masquerade_owner_session, only: :show
+  def show
+    if send("#{masqueraded_resource_name}_masquerade?")
+      resource = send("current_#{masquerading_resource_name}")
 
-  after_action :cleanup_masquerade_owner_session, only: :back
+      go_back(resource, path: after_masquerade_full_path_for(resource))
+    else
+      masqueradable_resource = find_masqueradable_resource
 
-  def show
-    self.resource = find_resource
+      save_masquerade_owner_session(masqueradable_resource)
 
-    if resource.class != masquerading_resource_class
+      resource = masqueradable_resource
       sign_out(send("current_#{masquerading_resource_name}"))
-    end
 
-    unless resource
-      flash[:error] = "#{masqueraded_resource_class} not found."
-      redirect_to(new_user_session_path) and return
-    end
+      unless resource
+        flash[:error] = "#{masqueraded_resource_class} not found."
+        redirect_to(new_user_session_path) and return
+      end
 
-    request.env['devise.skip_trackable'] = '1'
+      request.env['devise.skip_trackable'] = '1'
 
-    masquerade_sign_in(resource)
+      masquerade_sign_in(resource)
 
-    go_back(resource, path: after_masquerade_full_path_for(resource))
+      go_back(resource, path: after_masquerade_full_path_for(resource))
+    end
   end
 
   def back
-    unless send("#{masqueraded_resource_name}_signed_in?")
-      head(401) and return
-    end
+    unless send("#{masqueraded_resource_name}_masquerade?")
+      resource = send("current_#{masqueraded_resource_name}")
+      go_back(resource, path: after_back_masquerade_path_for(resource))
+    else
+      masqueradable_resource = send("current_#{masqueraded_resource_name}")
 
-    self.resource = find_owner_resource
+      unless send("#{masqueraded_resource_name}_signed_in?")
+        head(401) and return
+      end
 
-    if resource.class != masqueraded_resource_class
+      resource = find_owner_resource(masqueradable_resource)
       sign_out(send("current_#{masqueraded_resource_name}"))
-    end
 
-    masquerade_sign_in(resource)
-    request.env['devise.skip_trackable'] = nil
+      sign_in(resource)
+      request.env['devise.skip_trackable'] = nil
+
+      go_back(resource, path: after_back_masquerade_path_for(resource))
 
-    go_back(resource, path: after_back_masquerade_path_for(resource))
+      cleanup_masquerade_owner_session(masqueradable_resource)
+    end
   end
 
   protected
@@ -59,12 +68,14 @@ class Devise::MasqueradesController < DeviseController
     true
   end
 
-  def find_resource
-    GlobalID::Locator.locate_signed params[Devise.masquerade_param], for: 'masquerade'
+  def find_masqueradable_resource
+    GlobalID::Locator.locate_signed(params[Devise.masquerade_param], for: 'masquerade')
   end
 
-  def find_owner_resource
-    GlobalID::Locator.locate_signed(Rails.cache.read(session_key), for: 'masquerade')
+  def find_owner_resource(masqueradable_resource)
+    skey = session_key(masqueradable_resource)
+
+    GlobalID::Locator.locate_signed(Rails.cache.read(skey), for: 'masquerade')
   end
 
   def go_back(user, path:)
@@ -129,27 +140,29 @@ class Devise::MasqueradesController < DeviseController
     '/'
   end
 
-  def save_masquerade_owner_session
-    resource_gid = send("current_#{masquerading_resource_name}").to_sgid(
-      expires_in: Devise.masquerade_expires_in, for: 'masquerade')
-    # skip sharing owner id via session
-    Rails.cache.write(session_key, resource_gid, expires_in: Devise.masquerade_expires_in)
+  def save_masquerade_owner_session(masqueradable_resource)
+    skey = session_key(masqueradable_resource)
 
-    unless session.key?(session_key)
-      session[session_key_masquerading_resource_class] = masquerading_resource_class.name
-      session[session_key_masqueraded_resource_class] = masqueraded_resource_class.name
-    end
+    resource_gid = send("current_#{masquerading_resource_name}").to_sgid(for: 'masquerade')
+
+    # skip sharing owner id via session
+    Rails.cache.write(skey, resource_gid)
+    session[skey] = true
+    session[session_key_masquerading_resource_class] = masquerading_resource_class.name
+    session[session_key_masqueraded_resource_class] = masqueraded_resource_class.name
   end
 
-  def cleanup_masquerade_owner_session
-    Rails.cache.delete(session_key)
+  def cleanup_masquerade_owner_session(masqueradable_resource)
+    skey = session_key(masqueradable_resource)
 
+    Rails.cache.delete(skey)
+    session.delete(skey)
     session.delete(session_key_masqueraded_resource_class)
     session.delete(session_key_masquerading_resource_class)
   end
 
-  def session_key
-    "devise_masquerade_#{masqueraded_resource_name}".to_sym
+  def session_key(masqueradable_resource)
+    "devise_masquerade_#{masqueraded_resource_name}_#{masqueradable_resource.to_param}".to_sym
   end
 
   def session_key_masqueraded_resource_class
@@ -157,6 +170,6 @@ class Devise::MasqueradesController < DeviseController
   end
 
   def session_key_masquerading_resource_class
-    "devise_masquerade_masquerading_resource_class"
+      "devise_masquerade_masquerading_resource_class"
   end
 end

data/features/expires_masquerade.feature

@@ -0,0 +1,18 @@
+Feature: Use back button for returning to the owner despite on expiration time.
+  In order to back to the owner user
+  As an masquerade user
+  I want to be able to press a simple button on the page
+
+  Scenario: Use back button
+    Given I logged in
+    And I have a user for masquerade
+
+    When I have devise masquerade expiration time in 1 second
+
+    When I am on the users page
+    And I login as one user
+      Then I should be login as this user
+      And I waited for 2 seconds
+
+    When I press back masquerade button
+      Then I should be login as owner user

data/features/step_definitions/expires_steps.rb

@@ -0,0 +1,9 @@
+When("I have devise masquerade expiration time in {int} second") do |seconds|
+  Devise.masquerade_expires_in = seconds.second
+end
+
+Then("I waited for {int} seconds") do |seconds|
+  sleep(seconds)
+
+  Devise.masquerade_expires_in = 5.minutes
+end

data/lib/devise_masquerade/controllers/helpers.rb

@@ -38,12 +38,20 @@ module DeviseMasquerade
           end
 
           def #{name}_masquerade?
-            ::Rails.cache.exist?(:"devise_masquerade_#{name}").present?
+            return false if current_#{name}.blank?
+
+            key = "devise_masquerade_#{name}_" + current_#{name}.to_param
+            return false if session[key].blank?
+
+            ::Rails.cache.exist?(key.to_sym).present?
           end
 
           def #{name}_masquerade_owner
-            return nil unless send(:#{name}_masquerade?)
-            GlobalID::Locator.locate_signed(::Rails.cache.read(:"devise_masquerade_#{name}"), for: 'masquerade')
+            return unless send(:#{name}_masquerade?)
+
+            key = "devise_masquerade_#{name}_" + current_#{name}.to_param
+            sgid = ::Rails.cache.read(key.to_sym)
+            GlobalID::Locator.locate_signed(sgid, for: 'masquerade')
           end
 
           private

data/lib/devise_masquerade/version.rb

@@ -1,3 +1,3 @@
 module DeviseMasquerade
-  VERSION = '1.3.3'.freeze
+  VERSION = '1.3.8'.freeze
 end

data/spec/controllers/devise/masquerades_controller_spec.rb

@@ -14,7 +14,7 @@ describe Devise::MasqueradesController, type: :controller do
           get :show, params: { id: mask.to_param, masqueraded_resource_class: mask.class.name, masquerade: mask.masquerade_key }
         end
 
-        it { expect(Rails.cache.read('devise_masquerade_student')).to be }
+        it { expect(Rails.cache.read("devise_masquerade_student_#{mask.to_param}")).to be }
 
         it 'should have warden keys defined' do
           expect(session["warden.user.student.key"].first.first).to eq(mask.id)
@@ -30,7 +30,7 @@ describe Devise::MasqueradesController, type: :controller do
           get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key }
         end
 
-        it { expect(Rails.cache.read('devise_masquerade_user')).to be }
+        it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).to be }
         it { expect(session["warden.user.user.key"].first.first).to eq(mask.id) }
         it { should redirect_to('/') }
 
@@ -39,7 +39,7 @@ describe Devise::MasqueradesController, type: :controller do
 
           it { should redirect_to(masquerade_page) }
           it { expect(current_user.reload).to eq(@user) }
-          it { expect(Rails.cache.read('devise_masquerade_user')).not_to be }
+          it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).not_to be }
         end
       end
 

data/spec/controllers/masquerades_tests_controller_spec.rb

@@ -16,7 +16,7 @@ describe MasqueradesTestsController, type: :controller do
     before { get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key } }
 
     it { expect(response.status).to eq(403) }
-    it { expect(Rails.cache.read('devise_masquerade_user')).not_to be }
+    it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).not_to be }
     it { expect(session['warden.user.user.key'].first.first).not_to eq(mask.id) }
   end
 
@@ -35,7 +35,7 @@ describe MasqueradesTestsController, type: :controller do
     end
 
     it { expect(response.status).to eq(302) }
-    it { expect(Rails.cache.read('devise_masquerade_user')).to be }
+    it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).to be }
     it { expect(session['warden.user.user.key'].first.first).to eq(mask.id) }
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise_masquerade
 version: !ruby/object:Gem::Version
-  version: 1.3.3
+  version: 1.3.8
 platform: ruby
 authors:
 - Alexandr Korsak
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-02-16 00:00:00.000000000 Z
+date: 2021-04-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -92,9 +92,11 @@ files:
 - config/environment.rb
 - devise_masquerade.gemspec
 - features/back.feature
+- features/expires_masquerade.feature
 - features/multiple_masquerading_models.feature
 - features/step_definitions/auth_steps.rb
 - features/step_definitions/back_steps.rb
+- features/step_definitions/expires_steps.rb
 - features/step_definitions/url_helpers_steps.rb
 - features/support/env.rb
 - features/url_helpers.feature
@@ -185,9 +187,11 @@ specification_version: 4
 summary: use for login as functionallity on your admin users pages
 test_files:
 - features/back.feature
+- features/expires_masquerade.feature
 - features/multiple_masquerading_models.feature
 - features/step_definitions/auth_steps.rb
 - features/step_definitions/back_steps.rb
+- features/step_definitions/expires_steps.rb
 - features/step_definitions/url_helpers_steps.rb
 - features/support/env.rb
 - features/url_helpers.feature