devise_masquerade 1.3.5 → 1.3.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 02e2f123857132cfdeaf49b1dbb8cef1dce29175448f862dba6387e72087ebe2
-  data.tar.gz: 451e8c53e1e84d565fd0fcb13439c0f3b75dd27a00fb112e0c2fd8976f67b00b
+  metadata.gz: dd8da5271e7816c4823e6208ddb3d164065463a69d0be4d12bc6b6cdd6314102
+  data.tar.gz: 55e126ffbe80364b490ed85dd7235ad9de168614d0979d00e84ed0a9f7f31390
 SHA512:
-  metadata.gz: 4f3ea1133abf1ae6126ce12e64fb118fa88e2627587f1e29833fb7805bd230cac706d7e4ab1f12848409cca824e670a131f8b4c3bb1e02e00a45337ab8071de0
-  data.tar.gz: a281f8c5bcab7bde06ca043830ed98982e38c7e061a77be364768486caf7a5f10f85b35e5788c6334806a3b98a6010e8f4e1ee170a0baba88d05723429036287
+  metadata.gz: f575ef0026f95fc117daaee22797f2a8495e20a33c2e100c70f40df91eb7c05ad4eb84fe39fd01b0a9b1403c23c0a00a657f0b9475c02ff17e1c89b1c5ffc642
+  data.tar.gz: f42b17cc00ff950387b8a44f079a575a4875788e97743e8cb923cf09e73e41da3aa9bff7cc819250d96ed1347fed1258745f8ddeaaa8a0274af651ffcda0ae09

data/.travis.yml

@@ -1,12 +1,8 @@
 language: ruby
 rvm:
-  - 2.5.1
   - 2.6.0
-  - 2.7.2
-gemfile:
-  - Gemfile
+  - 2.7.3
 script: time ./script/travis.sh
-sudo: false
 addons:
   apt:
     packages:

data/Gemfile.lock

@@ -52,7 +52,7 @@ GIT
 PATH
   remote: .
   specs:
-    devise_masquerade (1.3.5)
+    devise_masquerade (1.3.9)
       devise (>= 4.7.0)
       globalid (>= 0.3.6)
       railties (>= 5.2.0)
@@ -93,7 +93,7 @@ GEM
       minitest (~> 5.1)
       tzinfo (~> 1.1)
       zeitwerk (~> 2.1, >= 2.1.8)
-    addressable (2.7.0)
+    addressable (2.8.0)
       public_suffix (>= 2.0.2, < 5.0)
     archive-zip (0.12.0)
       io-like (~> 0.3.0)
@@ -201,12 +201,12 @@ GEM
       mime-types-data (~> 3.2015)
     mime-types-data (3.2019.1009)
     mini_mime (1.0.2)
-    mini_portile2 (2.5.0)
+    mini_portile2 (2.5.1)
     minitest (5.12.2)
     multi_json (1.14.1)
     multi_test (0.1.2)
     nenv (0.3.0)
-    nokogiri (1.11.1)
+    nokogiri (1.11.5)
       mini_portile2 (~> 2.5.0)
       racc (~> 1.4)
     notiffany (0.1.3)
@@ -220,7 +220,7 @@ GEM
     pry-byebug (3.7.0)
       byebug (~> 11.0)
       pry (~> 0.10)
-    public_suffix (4.0.1)
+    public_suffix (4.0.6)
     racc (1.5.2)
     rack (2.2.3)
     rack-test (1.1.0)

data/README.md

@@ -1,15 +1,17 @@
 # Devise Masquerade
-[![Gitter](https://badges.gitter.im/Join Chat.svg)](https://gitter.im/oivoodoo/devise_masquerade?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
-[![FOSSA Status](https://app.fossa.io/api/projects/git%2Bgithub.com%2Foivoodoo%2Fdevise_masquerade.svg?type=shield)](https://app.fossa.io/projects/git%2Bgithub.com%2Foivoodoo%2Fdevise_masquerade?ref=badge_shield)
 
-[![Build Status](https://secure.travis-ci.org/oivoodoo/devise_masquerade.png?branch=master)](https://travis-ci.org/oivoodoo/devise_masquerade)
+ [![Gitter chat](https://badges.gitter.im/oivoodoo/devise_masquerade.svg)](https://gitter.im/oivoodoo/devise_masquerade?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+
+[![FOSSA Status](https://app.fossa.io/api/projects/git%2Bgithub.com%2Foivoodoo%2Fdevise_masquerade.svg?type=shield)](https://app.fossa.io/projects/git%2Bgithub.com%2Foivoodoo%2Fdevise_masquerade?ref=badge_shield)
 
-[![Code Climate](https://codeclimate.com/badge.png)](https://codeclimate.com/github/oivoodoo/devise_masquerade)
+[![Build Status](https://secure.travis-ci.org/oivoodoo/devise_masquerade.svg?branch=master)](https://travis-ci.org/oivoodoo/devise_masquerade)
 
-[![endorse](https://api.coderwall.com/oivoodoo/endorsecount.png)](https://coderwall.com/oivoodoo)
+[![Maintainability](https://api.codeclimate.com/v1/badges/cf63d775dc014a7ebc03/maintainability)](https://codeclimate.com/github/oivoodoo/devise_masquerade/maintainability)
 
 [![Analytics](https://ga-beacon.appspot.com/UA-46818771-1/devise_masquerade/README.md)](https://github.com/oivoodoo/devise_masquerade)
 
+[Consulting](https://bitscorp.co)
+
 It's a utility library for enabling functionallity like login as button for
 admin.
 
@@ -31,7 +33,9 @@ And then execute:
 
 In the view you can use url helper for defining link:
 
+```ruby
     = link_to "Login As", masquerade_path(user)
+```
 
 `masquerade_path` would create specific `/masquerade` path with query params `masquerade`(key) and `masqueraded_resource_class` to know
 which model to choose to search and sign in by masquerade key.
@@ -62,9 +66,11 @@ Instead of user you can use your resource name admin, student or another names.
 If you want to back to the owner of masquerade action user you could use
 helpers:
 
+```ruby
     user_masquerade? # current user was masqueraded by owner?
 
     = link_to "Reverse masquerade", back_masquerade_path(current_user)
+```
 
 ## Custom controller for adding cancan for authorization
 
@@ -162,12 +168,12 @@ in `routes.rb`:
     Devise.masquerade_key_size = 16 # size of the generate by SecureRandom.urlsafe_base64
     Devise.masquerade_bypass_warden_callback = false
     Devise.masquerade_routes_back = false # if true, route back to the page the user was on via redirect_back
-    Devise.masquerading_resource_class = User
+    Devise.masquerading_resource_class = AdminUser
     # optional, default: masquerading_resource_class.model_name.param_key
-    Devise.masquerading_resource_name = :user
-    Devise.masqueraded_resource_class = AdminUser
+    Devise.masquerading_resource_name = :admin_user
+    Devise.masqueraded_resource_class = User
     # optional, default: masqueraded_resource_class.model_name.param_key
-    Devise.masqueraded_resource_name = :admin_user
+    Devise.masqueraded_resource_name = :user
 ```
 
 ## Demo project
@@ -181,7 +187,7 @@ And check http://localhost:3000/, use for login user1@example.com and
 
 ## Troubleshooting
 
-Are you working in development mode and wondering why masquerade attempts result in a [Receiving "You are already signed in" flash[:error]](https://github.com/oivoodoo/devise_masquerade/issues/58) message? `Filter chain halted as :require_no_authentication rendered or redirected` showing up in your logfile? Chances are that you need to enable caching:
+Are you working in development mode and wondering why masquerade attempts result in a [Receiving "You are already signed in" flash[:error]](https://github.com/oivoodoo/devise_masquerade/issues/58) message? `Filter chain halted as :require_no_authentication rendered or redirected` showing up in your logfile? Do you find that your `user_masquerade?` method is always returning false? Chances are that you need to enable caching:
 
     rails dev:cache
 

data/app/controllers/devise/masquerades_controller.rb

@@ -1,3 +1,5 @@
+require 'securerandom'
+
 class Devise::MasqueradesController < DeviseController
   Devise.mappings.each do |name, _|
     class_eval <<-METHODS, __FILE__, __LINE__ + 1
@@ -10,41 +12,52 @@ class Devise::MasqueradesController < DeviseController
   prepend_before_action :masquerade_authorize!
 
   def show
-    masqueradable_resource = find_masqueradable_resource
+    if send("#{masqueraded_resource_name}_masquerade?")
+      resource = masquerading_current_user
 
-    save_masquerade_owner_session(masqueradable_resource)
+      go_back(resource, path: after_masquerade_full_path_for(resource))
+    else
+      masqueradable_resource = find_masqueradable_resource
 
-    self.resource = masqueradable_resource
-    sign_out(send("current_#{masquerading_resource_name}"))
+      save_masquerade_owner_session(masqueradable_resource)
 
-    unless resource
-      flash[:error] = "#{masqueraded_resource_class} not found."
-      redirect_to(new_user_session_path) and return
-    end
+      resource = masqueradable_resource
+      sign_out(masquerading_current_user)
+
+      unless resource
+        flash[:error] = "#{masqueraded_resource_class} not found."
+        redirect_to(new_user_session_path) and return
+      end
 
-    request.env['devise.skip_trackable'] = '1'
+      request.env['devise.skip_trackable'] = '1'
 
-    masquerade_sign_in(resource)
+      masquerade_sign_in(resource)
 
-    go_back(resource, path: after_masquerade_full_path_for(resource))
+      go_back(resource, path: after_masquerade_full_path_for(resource))
+    end
   end
 
   def back
-    masqueradable_resource = send("current_#{masqueraded_resource_name}")
+    unless send("#{masqueraded_resource_name}_masquerade?")
+      resource = send("current_#{masqueraded_resource_name}")
+      go_back(resource, path: after_back_masquerade_path_for(resource))
+    else
+      masqueradable_resource = send("current_#{masqueraded_resource_name}")
 
-    unless send("#{masqueraded_resource_name}_signed_in?")
-      head(401) and return
-    end
+      unless send("#{masqueraded_resource_name}_signed_in?")
+        head(401) and return
+      end
 
-    self.resource = find_owner_resource(masqueradable_resource)
-    sign_out(send("current_#{masqueraded_resource_name}"))
+      resource = find_owner_resource(masqueradable_resource)
+      sign_out(send("current_#{masqueraded_resource_name}"))
 
-    masquerade_sign_in(resource)
-    request.env['devise.skip_trackable'] = nil
+      sign_in(resource)
+      request.env['devise.skip_trackable'] = nil
 
-    go_back(resource, path: after_back_masquerade_path_for(resource))
+      go_back(resource, path: after_back_masquerade_path_for(resource))
 
-    cleanup_masquerade_owner_session(masqueradable_resource)
+      cleanup_masquerade_owner_session(masqueradable_resource)
+    end
   end
 
   protected
@@ -62,7 +75,7 @@ class Devise::MasqueradesController < DeviseController
   end
 
   def find_owner_resource(masqueradable_resource)
-    skey = session_key(masqueradable_resource)
+    skey = session_key(masqueradable_resource, masquerading_guid)
 
     GlobalID::Locator.locate_signed(Rails.cache.read(skey), for: 'masquerade')
   end
@@ -130,29 +143,32 @@ class Devise::MasqueradesController < DeviseController
   end
 
   def save_masquerade_owner_session(masqueradable_resource)
-    skey = session_key(masqueradable_resource)
+    guid = SecureRandom.uuid
+
+    skey = session_key(masqueradable_resource, guid)
 
-    resource_gid = send("current_#{masquerading_resource_name}").to_sgid(
-      expires_in: Devise.masquerade_expires_in, for: 'masquerade')
+    resource_gid = send("current_#{masquerading_resource_name}").to_sgid(for: 'masquerade')
 
     # skip sharing owner id via session
-    Rails.cache.write(skey, resource_gid, expires_in: Devise.masquerade_expires_in)
+    Rails.cache.write(skey, resource_gid)
     session[skey] = true
     session[session_key_masquerading_resource_class] = masquerading_resource_class.name
     session[session_key_masqueraded_resource_class] = masqueraded_resource_class.name
+    session[session_key_masquerading_resource_guid] = guid
   end
 
   def cleanup_masquerade_owner_session(masqueradable_resource)
-    skey = session_key(masqueradable_resource)
+    skey = session_key(masqueradable_resource, masquerading_guid)
 
     Rails.cache.delete(skey)
     session.delete(skey)
     session.delete(session_key_masqueraded_resource_class)
     session.delete(session_key_masquerading_resource_class)
+    session.delete(session_key_masquerading_resource_guid)
   end
 
-  def session_key(masqueradable_resource)
-    "devise_masquerade_#{masqueraded_resource_name}_#{masqueradable_resource.to_param}".to_sym
+  def session_key(masqueradable_resource, guid)
+    "devise_masquerade_#{masqueraded_resource_name}_#{masqueradable_resource.to_param}_#{guid}".to_sym
   end
 
   def session_key_masqueraded_resource_class
@@ -160,6 +176,19 @@ class Devise::MasqueradesController < DeviseController
   end
 
   def session_key_masquerading_resource_class
-      "devise_masquerade_masquerading_resource_class"
+    "devise_masquerade_masquerading_resource_class"
+  end
+
+  def session_key_masquerading_resource_guid
+    "devise_masquerade_masquerading_resource_guid"
+  end
+
+  def masquerading_current_user
+    send("current_#{masquerading_resource_name}")
+  end
+
+  def masquerading_guid
+    session[session_key_masquerading_resource_guid]
   end
 end
+

data/features/expires_masquerade.feature

@@ -0,0 +1,18 @@
+Feature: Use back button for returning to the owner despite on expiration time.
+  In order to back to the owner user
+  As an masquerade user
+  I want to be able to press a simple button on the page
+
+  Scenario: Use back button
+    Given I logged in
+    And I have a user for masquerade
+
+    When I have devise masquerade expiration time in 1 second
+
+    When I am on the users page
+    And I login as one user
+      Then I should be login as this user
+      And I waited for 2 seconds
+
+    When I press back masquerade button
+      Then I should be login as owner user

data/features/step_definitions/expires_steps.rb

@@ -0,0 +1,9 @@
+When("I have devise masquerade expiration time in {int} second") do |seconds|
+  Devise.masquerade_expires_in = seconds.second
+end
+
+Then("I waited for {int} seconds") do |seconds|
+  sleep(seconds)
+
+  Devise.masquerade_expires_in = 5.minutes
+end

data/lib/devise_masquerade/controllers/helpers.rb

@@ -39,22 +39,28 @@ module DeviseMasquerade
 
           def #{name}_masquerade?
             return false if current_#{name}.blank?
+            return false if session[#{name}_helper_session_key].blank?
 
-            key = "devise_masquerade_#{name}_" + current_#{name}.to_param
-            return false if session[key].blank?
-
-            ::Rails.cache.exist?(key.to_sym).present?
+            ::Rails.cache.exist?(#{name}_helper_session_key).present?
           end
 
           def #{name}_masquerade_owner
             return unless send(:#{name}_masquerade?)
 
-            key = "devise_masquerade_#{name}_" + current_#{name}.to_param
-            GlobalID::Locator.locate_signed(::Rails.cache.read(key.to_sym, for: 'masquerade'))
+            sgid = ::Rails.cache.read(#{name}_helper_session_key)
+            GlobalID::Locator.locate_signed(sgid, for: 'masquerade')
           end
 
           private
 
+          def #{name}_helper_session_key
+            ["devise_masquerade_#{name}", current_#{name}.to_param, #{name}_helper_masquerading_resource_guid].join("_")
+          end
+
+          def #{name}_helper_masquerading_resource_guid
+            session["devise_masquerade_masquerading_resource_guid"].to_s
+          end
+
           def masquerade_sign_in(resource)
             if Devise.masquerade_bypass_warden_callback
               if respond_to?(:bypass_sign_in)

data/lib/devise_masquerade/controllers/url_helpers.rb

@@ -8,9 +8,9 @@ module DeviseMasquerade
         scope = Devise::Mapping.find_scope!(resource)
 
         opts = args.shift || {}
-        opts.merge!(masqueraded_resource_class: resource.class.name)
+        opts[:masqueraded_resource_class] = resource.class.name
 
-        opts.merge!(Devise.masquerade_param => resource.masquerade_key)
+        opts[Devise.masquerade_param] = resource.masquerade_key
 
         send("#{scope}_masquerade_index_path", opts, *args)
       end
@@ -19,7 +19,7 @@ module DeviseMasquerade
         scope = Devise::Mapping.find_scope!(resource)
 
         opts = args.first || {}
-        opts.merge!(masqueraded_resource_class: resource.class.name)
+        opts[:masqueraded_resource_class] = resource.class.name
 
         send("back_#{scope}_masquerade_index_path", opts, *args)
       end

data/lib/devise_masquerade/version.rb

@@ -1,3 +1,3 @@
 module DeviseMasquerade
-  VERSION = '1.3.5'.freeze
+  VERSION = '1.3.9'.freeze
 end

data/spec/controllers/devise/masquerades_controller_spec.rb

@@ -14,7 +14,7 @@ describe Devise::MasqueradesController, type: :controller do
           get :show, params: { id: mask.to_param, masqueraded_resource_class: mask.class.name, masquerade: mask.masquerade_key }
         end
 
-        it { expect(Rails.cache.read("devise_masquerade_student_#{mask.to_param}")).to be }
+        it { expect(cache_read(mask)).to be }
 
         it 'should have warden keys defined' do
           expect(session["warden.user.student.key"].first.first).to eq(mask.id)
@@ -22,6 +22,9 @@ describe Devise::MasqueradesController, type: :controller do
 
         it { should redirect_to('/') }
       end
+    end
+    context 'when logged in' do
+      before { logged_in }
 
       describe '#masquerade user' do
         let(:mask) { create(:user) }
@@ -30,7 +33,7 @@ describe Devise::MasqueradesController, type: :controller do
           get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key }
         end
 
-        it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).to be }
+        it { expect(cache_read(mask)).to be }
         it { expect(session["warden.user.user.key"].first.first).to eq(mask.id) }
         it { should redirect_to('/') }
 
@@ -39,7 +42,7 @@ describe Devise::MasqueradesController, type: :controller do
 
           it { should redirect_to(masquerade_page) }
           it { expect(current_user.reload).to eq(@user) }
-          it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).not_to be }
+          it { expect(cache_read(mask)).not_to be }
         end
       end
 
@@ -107,4 +110,16 @@ describe Devise::MasqueradesController, type: :controller do
   def masquerade_page
     "/"
   end
+
+  def guid
+    session[:devise_masquerade_masquerading_resource_guid]
+  end
+
+  def cache_read(user)
+    Rails.cache.read(cache_key(user))
+  end
+
+  def cache_key(user)
+    "devise_masquerade_#{mask.class.name.downcase}_#{mask.to_param}_#{guid}"
+  end
 end

data/spec/controllers/masquerades_tests_controller_spec.rb

@@ -16,7 +16,7 @@ describe MasqueradesTestsController, type: :controller do
     before { get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key } }
 
     it { expect(response.status).to eq(403) }
-    it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).not_to be }
+    it { expect(cache_read(mask)).not_to be }
     it { expect(session['warden.user.user.key'].first.first).not_to eq(mask.id) }
   end
 
@@ -35,7 +35,20 @@ describe MasqueradesTestsController, type: :controller do
     end
 
     it { expect(response.status).to eq(302) }
-    it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).to be }
+    it { expect(cache_read(mask)).to be }
     it { expect(session['warden.user.user.key'].first.first).to eq(mask.id) }
   end
+
+
+  def guid
+    session[:devise_masquerade_masquerading_resource_guid]
+  end
+
+  def cache_read(user)
+    Rails.cache.read(cache_key(user))
+  end
+
+  def cache_key(user)
+    "devise_masquerade_#{mask.class.name.downcase}_#{mask.to_param}_#{guid}"
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise_masquerade
 version: !ruby/object:Gem::Version
-  version: 1.3.5
+  version: 1.3.9
 platform: ruby
 authors:
 - Alexandr Korsak
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-02-23 00:00:00.000000000 Z
+date: 2021-09-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -92,9 +92,11 @@ files:
 - config/environment.rb
 - devise_masquerade.gemspec
 - features/back.feature
+- features/expires_masquerade.feature
 - features/multiple_masquerading_models.feature
 - features/step_definitions/auth_steps.rb
 - features/step_definitions/back_steps.rb
+- features/step_definitions/expires_steps.rb
 - features/step_definitions/url_helpers_steps.rb
 - features/support/env.rb
 - features/url_helpers.feature
@@ -185,9 +187,11 @@ specification_version: 4
 summary: use for login as functionallity on your admin users pages
 test_files:
 - features/back.feature
+- features/expires_masquerade.feature
 - features/multiple_masquerading_models.feature
 - features/step_definitions/auth_steps.rb
 - features/step_definitions/back_steps.rb
+- features/step_definitions/expires_steps.rb
 - features/step_definitions/url_helpers_steps.rb
 - features/support/env.rb
 - features/url_helpers.feature