devise_masquerade 1.3.7 → 1.3.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5c612609f3eeb20d48b13ed9166d5a6e3631cf284bda1aceb67501686bb806ee
-  data.tar.gz: 7c1e2356ec14f72af05816534d037b2a1e344a5d482a28156f71053b4d1dab0e
+  metadata.gz: 765e1b2a1c4a2ae6f4708ad80b7f69745093be77070aaffb0415a71e870d3d3e
+  data.tar.gz: ccfd44dc5346385d69a5b0bd6ef69f7504cb36e4d092568744b3e3bbbda34a07
 SHA512:
-  metadata.gz: 7545f0259d8607d0f06738308704646fccfea3708f33b39408302afc9893ab1203d36a5f3cedebb12ab4fc9b150b198d7dbf6f984655bec3ff02aa4ab2e76c47
-  data.tar.gz: 5e0b106db2ce2d05b1bfcbd91c81730ce09560e248bea3b700c6ba9ad822bbad68adf19305763470817b76a0b18775a974ba431334a1c043c9e1abe5345aec96
+  metadata.gz: 02f79998f7f9364a32628b3fa246e1e82b0b7a6007bfa344861ee5cf6fb168166cb73350733e554017922bd889709dcf29d374a08cf39cb191d68ca4e2fea811
+  data.tar.gz: 0b814c4cef685103f3a846dbdc2ee62f4b070b9be2c20e913eb63605e518e125d8aae6933c1006437a3b7fdfc5e5677820b4640c50d204e66174c6c4b1687800

data/.travis.yml

@@ -1,12 +1,8 @@
 language: ruby
 rvm:
-  - 2.5.1
   - 2.6.0
-  - 2.7.2
-gemfile:
-  - Gemfile
+  - 2.7.3
 script: time ./script/travis.sh
-sudo: false
 addons:
   apt:
     packages:

data/Gemfile.lock

@@ -52,7 +52,7 @@ GIT
 PATH
   remote: .
   specs:
-    devise_masquerade (1.3.7)
+    devise_masquerade (1.3.10)
       devise (>= 4.7.0)
       globalid (>= 0.3.6)
       railties (>= 5.2.0)
@@ -93,12 +93,12 @@ GEM
       minitest (~> 5.1)
       tzinfo (~> 1.1)
       zeitwerk (~> 2.1, >= 2.1.8)
-    addressable (2.7.0)
+    addressable (2.8.0)
       public_suffix (>= 2.0.2, < 5.0)
     archive-zip (0.12.0)
       io-like (~> 0.3.0)
     backports (3.15.0)
-    bcrypt (3.1.16)
+    bcrypt (3.1.17)
     bson (1.12.5)
     bson_ext (1.12.5)
       bson (~> 1.12.5)
@@ -142,7 +142,7 @@ GEM
     cucumber-tag_expressions (1.1.1)
     cucumber-wire (0.0.1)
     database_cleaner (1.0.1)
-    devise (4.7.3)
+    devise (4.8.1)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
       railties (>= 4.1.0)
@@ -201,13 +201,13 @@ GEM
       mime-types-data (~> 3.2015)
     mime-types-data (3.2019.1009)
     mini_mime (1.0.2)
-    mini_portile2 (2.5.0)
+    mini_portile2 (2.8.0)
     minitest (5.12.2)
     multi_json (1.14.1)
     multi_test (0.1.2)
     nenv (0.3.0)
-    nokogiri (1.11.1)
-      mini_portile2 (~> 2.5.0)
+    nokogiri (1.13.3)
+      mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
     notiffany (0.1.3)
       nenv (~> 0.1)
@@ -220,8 +220,8 @@ GEM
     pry-byebug (3.7.0)
       byebug (~> 11.0)
       pry (~> 0.10)
-    public_suffix (4.0.1)
-    racc (1.5.2)
+    public_suffix (4.0.6)
+    racc (1.6.0)
     rack (2.2.3)
     rack-test (1.1.0)
       rack (>= 1.0, < 3)

data/README.md

@@ -1,14 +1,14 @@
 # Devise Masquerade
-[![Gitter](https://badges.gitter.im/Join Chat.svg)](https://gitter.im/oivoodoo/devise_masquerade?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
-[![FOSSA Status](https://app.fossa.io/api/projects/git%2Bgithub.com%2Foivoodoo%2Fdevise_masquerade.svg?type=shield)](https://app.fossa.io/projects/git%2Bgithub.com%2Foivoodoo%2Fdevise_masquerade?ref=badge_shield)
 
-[![Build Status](https://secure.travis-ci.org/oivoodoo/devise_masquerade.png?branch=master)](https://travis-ci.org/oivoodoo/devise_masquerade)
+ [![Gitter chat](https://badges.gitter.im/oivoodoo/devise_masquerade.svg)](https://gitter.im/oivoodoo/devise_masquerade?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+
+[![FOSSA Status](https://app.fossa.io/api/projects/git%2Bgithub.com%2Foivoodoo%2Fdevise_masquerade.svg?type=shield)](https://app.fossa.io/projects/git%2Bgithub.com%2Foivoodoo%2Fdevise_masquerade?ref=badge_shield)
 
-[![Code Climate](https://codeclimate.com/badge.png)](https://codeclimate.com/github/oivoodoo/devise_masquerade)
+[![Build Status](https://secure.travis-ci.org/oivoodoo/devise_masquerade.svg?branch=master)](https://travis-ci.org/oivoodoo/devise_masquerade)
 
-[![endorse](https://api.coderwall.com/oivoodoo/endorsecount.png)](https://coderwall.com/oivoodoo)
+[![Maintainability](https://api.codeclimate.com/v1/badges/cf63d775dc014a7ebc03/maintainability)](https://codeclimate.com/github/oivoodoo/devise_masquerade/maintainability)
 
-[![Analytics](https://ga-beacon.appspot.com/UA-46818771-1/devise_masquerade/README.md)](https://github.com/oivoodoo/devise_masquerade)
+[Consulting](https://bitscorp.co)
 
 It's a utility library for enabling functionallity like login as button for
 admin.
@@ -31,7 +31,9 @@ And then execute:
 
 In the view you can use url helper for defining link:
 
+```ruby
     = link_to "Login As", masquerade_path(user)
+```
 
 `masquerade_path` would create specific `/masquerade` path with query params `masquerade`(key) and `masqueraded_resource_class` to know
 which model to choose to search and sign in by masquerade key.
@@ -62,9 +64,11 @@ Instead of user you can use your resource name admin, student or another names.
 If you want to back to the owner of masquerade action user you could use
 helpers:
 
+```ruby
     user_masquerade? # current user was masqueraded by owner?
 
     = link_to "Reverse masquerade", back_masquerade_path(current_user)
+```
 
 ## Custom controller for adding cancan for authorization
 
@@ -162,12 +166,12 @@ in `routes.rb`:
     Devise.masquerade_key_size = 16 # size of the generate by SecureRandom.urlsafe_base64
     Devise.masquerade_bypass_warden_callback = false
     Devise.masquerade_routes_back = false # if true, route back to the page the user was on via redirect_back
-    Devise.masquerading_resource_class = User
+    Devise.masquerading_resource_class = AdminUser
     # optional, default: masquerading_resource_class.model_name.param_key
-    Devise.masquerading_resource_name = :user
-    Devise.masqueraded_resource_class = AdminUser
+    Devise.masquerading_resource_name = :admin_user
+    Devise.masqueraded_resource_class = User
     # optional, default: masqueraded_resource_class.model_name.param_key
-    Devise.masqueraded_resource_name = :admin_user
+    Devise.masqueraded_resource_name = :user
 ```
 
 ## Demo project
@@ -181,7 +185,7 @@ And check http://localhost:3000/, use for login user1@example.com and
 
 ## Troubleshooting
 
-Are you working in development mode and wondering why masquerade attempts result in a [Receiving "You are already signed in" flash[:error]](https://github.com/oivoodoo/devise_masquerade/issues/58) message? `Filter chain halted as :require_no_authentication rendered or redirected` showing up in your logfile? Chances are that you need to enable caching:
+Are you working in development mode and wondering why masquerade attempts result in a [Receiving "You are already signed in" flash[:error]](https://github.com/oivoodoo/devise_masquerade/issues/58) message? `Filter chain halted as :require_no_authentication rendered or redirected` showing up in your logfile? Do you find that your `user_masquerade?` method is always returning false? Chances are that you need to enable caching:
 
     rails dev:cache
 

data/app/controllers/devise/masquerades_controller.rb

@@ -1,3 +1,5 @@
+require 'securerandom'
+
 class Devise::MasqueradesController < DeviseController
   Devise.mappings.each do |name, _|
     class_eval <<-METHODS, __FILE__, __LINE__ + 1
@@ -10,41 +12,52 @@ class Devise::MasqueradesController < DeviseController
   prepend_before_action :masquerade_authorize!
 
   def show
-    masqueradable_resource = find_masqueradable_resource
+    if send("#{masqueraded_resource_name}_masquerade?")
+      resource = masquerading_current_user
 
-    save_masquerade_owner_session(masqueradable_resource)
+      go_back(resource, path: after_masquerade_full_path_for(resource))
+    else
+      masqueradable_resource = find_masqueradable_resource
 
-    self.resource = masqueradable_resource
-    sign_out(send("current_#{masquerading_resource_name}"))
+      save_masquerade_owner_session(masqueradable_resource)
 
-    unless resource
-      flash[:error] = "#{masqueraded_resource_class} not found."
-      redirect_to(new_user_session_path) and return
-    end
+      resource = masqueradable_resource
+      sign_out(masquerading_current_user)
+
+      unless resource
+        flash[:error] = "#{masqueraded_resource_class} not found."
+        redirect_to(send("new_#{masqueraded_resource_name}_session_path")) and return
+      end
 
-    request.env['devise.skip_trackable'] = '1'
+      request.env['devise.skip_trackable'] = '1'
 
-    masquerade_sign_in(resource)
+      masquerade_sign_in(resource)
 
-    go_back(resource, path: after_masquerade_full_path_for(resource))
+      go_back(resource, path: after_masquerade_full_path_for(resource))
+    end
   end
 
   def back
-    masqueradable_resource = send("current_#{masqueraded_resource_name}")
+    unless send("#{masqueraded_resource_name}_masquerade?")
+      resource = send("current_#{masqueraded_resource_name}")
+      go_back(resource, path: after_back_masquerade_path_for(resource))
+    else
+      masqueradable_resource = send("current_#{masqueraded_resource_name}")
 
-    unless send("#{masqueraded_resource_name}_signed_in?")
-      head(401) and return
-    end
+      unless send("#{masqueraded_resource_name}_signed_in?")
+        head(401) and return
+      end
 
-    self.resource = find_owner_resource(masqueradable_resource)
-    sign_out(send("current_#{masqueraded_resource_name}"))
+      resource = find_owner_resource(masqueradable_resource)
+      sign_out(send("current_#{masqueraded_resource_name}"))
 
-    masquerade_sign_in(resource)
-    request.env['devise.skip_trackable'] = nil
+      sign_in(resource)
+      request.env['devise.skip_trackable'] = nil
 
-    go_back(resource, path: after_back_masquerade_path_for(resource))
+      go_back(resource, path: after_back_masquerade_path_for(resource))
 
-    cleanup_masquerade_owner_session(masqueradable_resource)
+      cleanup_masquerade_owner_session(masqueradable_resource)
+    end
   end
 
   protected
@@ -62,7 +75,7 @@ class Devise::MasqueradesController < DeviseController
   end
 
   def find_owner_resource(masqueradable_resource)
-    skey = session_key(masqueradable_resource)
+    skey = session_key(masqueradable_resource, masquerading_guid)
 
     GlobalID::Locator.locate_signed(Rails.cache.read(skey), for: 'masquerade')
   end
@@ -130,7 +143,9 @@ class Devise::MasqueradesController < DeviseController
   end
 
   def save_masquerade_owner_session(masqueradable_resource)
-    skey = session_key(masqueradable_resource)
+    guid = SecureRandom.uuid
+
+    skey = session_key(masqueradable_resource, guid)
 
     resource_gid = send("current_#{masquerading_resource_name}").to_sgid(for: 'masquerade')
 
@@ -139,19 +154,21 @@ class Devise::MasqueradesController < DeviseController
     session[skey] = true
     session[session_key_masquerading_resource_class] = masquerading_resource_class.name
     session[session_key_masqueraded_resource_class] = masqueraded_resource_class.name
+    session[session_key_masquerading_resource_guid] = guid
   end
 
   def cleanup_masquerade_owner_session(masqueradable_resource)
-    skey = session_key(masqueradable_resource)
+    skey = session_key(masqueradable_resource, masquerading_guid)
 
     Rails.cache.delete(skey)
     session.delete(skey)
     session.delete(session_key_masqueraded_resource_class)
     session.delete(session_key_masquerading_resource_class)
+    session.delete(session_key_masquerading_resource_guid)
   end
 
-  def session_key(masqueradable_resource)
-    "devise_masquerade_#{masqueraded_resource_name}_#{masqueradable_resource.to_param}".to_sym
+  def session_key(masqueradable_resource, guid)
+    "devise_masquerade_#{masqueraded_resource_name}_#{masqueradable_resource.to_param}_#{guid}".to_sym
   end
 
   def session_key_masqueraded_resource_class
@@ -159,6 +176,19 @@ class Devise::MasqueradesController < DeviseController
   end
 
   def session_key_masquerading_resource_class
-      "devise_masquerade_masquerading_resource_class"
+    "devise_masquerade_masquerading_resource_class"
+  end
+
+  def session_key_masquerading_resource_guid
+    "devise_masquerade_masquerading_resource_guid"
+  end
+
+  def masquerading_current_user
+    send("current_#{masquerading_resource_name}")
+  end
+
+  def masquerading_guid
+    session[session_key_masquerading_resource_guid]
   end
 end
+

data/lib/devise_masquerade/controllers/helpers.rb

@@ -39,23 +39,28 @@ module DeviseMasquerade
 
           def #{name}_masquerade?
             return false if current_#{name}.blank?
+            return false if session[#{name}_helper_session_key].blank?
 
-            key = "devise_masquerade_#{name}_" + current_#{name}.to_param
-            return false if session[key].blank?
-
-            ::Rails.cache.exist?(key.to_sym).present?
+            ::Rails.cache.exist?(#{name}_helper_session_key).present?
           end
 
           def #{name}_masquerade_owner
             return unless send(:#{name}_masquerade?)
 
-            key = "devise_masquerade_#{name}_" + current_#{name}.to_param
-            sgid = ::Rails.cache.read(key.to_sym)
+            sgid = ::Rails.cache.read(#{name}_helper_session_key)
             GlobalID::Locator.locate_signed(sgid, for: 'masquerade')
           end
 
           private
 
+          def #{name}_helper_session_key
+            ["devise_masquerade_#{name}", current_#{name}.to_param, #{name}_helper_masquerading_resource_guid].join("_")
+          end
+
+          def #{name}_helper_masquerading_resource_guid
+            session["devise_masquerade_masquerading_resource_guid"].to_s
+          end
+
           def masquerade_sign_in(resource)
             if Devise.masquerade_bypass_warden_callback
               if respond_to?(:bypass_sign_in)

data/lib/devise_masquerade/controllers/url_helpers.rb

@@ -8,9 +8,9 @@ module DeviseMasquerade
         scope = Devise::Mapping.find_scope!(resource)
 
         opts = args.shift || {}
-        opts.merge!(masqueraded_resource_class: resource.class.name)
+        opts[:masqueraded_resource_class] = resource.class.name
 
-        opts.merge!(Devise.masquerade_param => resource.masquerade_key)
+        opts[Devise.masquerade_param] = resource.masquerade_key
 
         send("#{scope}_masquerade_index_path", opts, *args)
       end
@@ -19,7 +19,7 @@ module DeviseMasquerade
         scope = Devise::Mapping.find_scope!(resource)
 
         opts = args.first || {}
-        opts.merge!(masqueraded_resource_class: resource.class.name)
+        opts[:masqueraded_resource_class] = resource.class.name
 
         send("back_#{scope}_masquerade_index_path", opts, *args)
       end

data/lib/devise_masquerade/version.rb

@@ -1,3 +1,3 @@
 module DeviseMasquerade
-  VERSION = '1.3.7'.freeze
+  VERSION = '1.3.10'.freeze
 end

data/spec/controllers/devise/masquerades_controller_spec.rb

@@ -14,7 +14,7 @@ describe Devise::MasqueradesController, type: :controller do
           get :show, params: { id: mask.to_param, masqueraded_resource_class: mask.class.name, masquerade: mask.masquerade_key }
         end
 
-        it { expect(Rails.cache.read("devise_masquerade_student_#{mask.to_param}")).to be }
+        it { expect(cache_read(mask)).to be }
 
         it 'should have warden keys defined' do
           expect(session["warden.user.student.key"].first.first).to eq(mask.id)
@@ -22,6 +22,9 @@ describe Devise::MasqueradesController, type: :controller do
 
         it { should redirect_to('/') }
       end
+    end
+    context 'when logged in' do
+      before { logged_in }
 
       describe '#masquerade user' do
         let(:mask) { create(:user) }
@@ -30,7 +33,7 @@ describe Devise::MasqueradesController, type: :controller do
           get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key }
         end
 
-        it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).to be }
+        it { expect(cache_read(mask)).to be }
         it { expect(session["warden.user.user.key"].first.first).to eq(mask.id) }
         it { should redirect_to('/') }
 
@@ -39,7 +42,7 @@ describe Devise::MasqueradesController, type: :controller do
 
           it { should redirect_to(masquerade_page) }
           it { expect(current_user.reload).to eq(@user) }
-          it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).not_to be }
+          it { expect(cache_read(mask)).not_to be }
         end
       end
 
@@ -107,4 +110,16 @@ describe Devise::MasqueradesController, type: :controller do
   def masquerade_page
     "/"
   end
+
+  def guid
+    session[:devise_masquerade_masquerading_resource_guid]
+  end
+
+  def cache_read(user)
+    Rails.cache.read(cache_key(user))
+  end
+
+  def cache_key(user)
+    "devise_masquerade_#{mask.class.name.downcase}_#{mask.to_param}_#{guid}"
+  end
 end

data/spec/controllers/masquerades_tests_controller_spec.rb

@@ -16,7 +16,7 @@ describe MasqueradesTestsController, type: :controller do
     before { get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key } }
 
     it { expect(response.status).to eq(403) }
-    it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).not_to be }
+    it { expect(cache_read(mask)).not_to be }
     it { expect(session['warden.user.user.key'].first.first).not_to eq(mask.id) }
   end
 
@@ -35,7 +35,20 @@ describe MasqueradesTestsController, type: :controller do
     end
 
     it { expect(response.status).to eq(302) }
-    it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).to be }
+    it { expect(cache_read(mask)).to be }
     it { expect(session['warden.user.user.key'].first.first).to eq(mask.id) }
   end
+
+
+  def guid
+    session[:devise_masquerade_masquerading_resource_guid]
+  end
+
+  def cache_read(user)
+    Rails.cache.read(cache_key(user))
+  end
+
+  def cache_key(user)
+    "devise_masquerade_#{mask.class.name.downcase}_#{mask.to_param}_#{guid}"
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise_masquerade
 version: !ruby/object:Gem::Version
-  version: 1.3.7
+  version: 1.3.10
 platform: ruby
 authors:
 - Alexandr Korsak
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-04-28 00:00:00.000000000 Z
+date: 2022-03-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler