devise_masquerade 1.3.8 → 1.3.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3f3c384ee31658834131c95ec34bc376340a9f7d8b7d237ed97316f6e61eb5ee
-  data.tar.gz: 78f66fc23c43a3db4eef66c98e15447decfea5627b2900c2ee827785a3b0cdd2
+  metadata.gz: dd8da5271e7816c4823e6208ddb3d164065463a69d0be4d12bc6b6cdd6314102
+  data.tar.gz: 55e126ffbe80364b490ed85dd7235ad9de168614d0979d00e84ed0a9f7f31390
 SHA512:
-  metadata.gz: a6b318f8d335a53524a94d24b5c1bc78c41bc308200a0eed543fabdfb891e63a1d119efee269282f9f2e4e1d1a7dd27161076ed9465c3ac55b188f2127dce429
-  data.tar.gz: 0d39bbd0099a4d70496ece49d3db3e955eadbcb14bc20accfcc9fcc90c070b9e7aa5b697ce91367c7d20590a218d182fe99b7d0c37b220fd4bbb59ee1f6c5bde
+  metadata.gz: f575ef0026f95fc117daaee22797f2a8495e20a33c2e100c70f40df91eb7c05ad4eb84fe39fd01b0a9b1403c23c0a00a657f0b9475c02ff17e1c89b1c5ffc642
+  data.tar.gz: f42b17cc00ff950387b8a44f079a575a4875788e97743e8cb923cf09e73e41da3aa9bff7cc819250d96ed1347fed1258745f8ddeaaa8a0274af651ffcda0ae09

data/.travis.yml

@@ -1,12 +1,8 @@
 language: ruby
 rvm:
-  - 2.5.1
   - 2.6.0
-  - 2.7.2
-gemfile:
-  - Gemfile
+  - 2.7.3
 script: time ./script/travis.sh
-sudo: false
 addons:
   apt:
     packages:

data/Gemfile.lock

@@ -52,7 +52,7 @@ GIT
 PATH
   remote: .
   specs:
-    devise_masquerade (1.3.8)
+    devise_masquerade (1.3.9)
       devise (>= 4.7.0)
       globalid (>= 0.3.6)
       railties (>= 5.2.0)
@@ -93,7 +93,7 @@ GEM
       minitest (~> 5.1)
       tzinfo (~> 1.1)
       zeitwerk (~> 2.1, >= 2.1.8)
-    addressable (2.7.0)
+    addressable (2.8.0)
       public_suffix (>= 2.0.2, < 5.0)
     archive-zip (0.12.0)
       io-like (~> 0.3.0)
@@ -201,12 +201,12 @@ GEM
       mime-types-data (~> 3.2015)
     mime-types-data (3.2019.1009)
     mini_mime (1.0.2)
-    mini_portile2 (2.5.0)
+    mini_portile2 (2.5.1)
     minitest (5.12.2)
     multi_json (1.14.1)
     multi_test (0.1.2)
     nenv (0.3.0)
-    nokogiri (1.11.1)
+    nokogiri (1.11.5)
       mini_portile2 (~> 2.5.0)
       racc (~> 1.4)
     notiffany (0.1.3)
@@ -220,7 +220,7 @@ GEM
     pry-byebug (3.7.0)
       byebug (~> 11.0)
       pry (~> 0.10)
-    public_suffix (4.0.1)
+    public_suffix (4.0.6)
     racc (1.5.2)
     rack (2.2.3)
     rack-test (1.1.0)

data/README.md

@@ -1,15 +1,17 @@
 # Devise Masquerade
-[![Gitter](https://badges.gitter.im/Join Chat.svg)](https://gitter.im/oivoodoo/devise_masquerade?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
-[![FOSSA Status](https://app.fossa.io/api/projects/git%2Bgithub.com%2Foivoodoo%2Fdevise_masquerade.svg?type=shield)](https://app.fossa.io/projects/git%2Bgithub.com%2Foivoodoo%2Fdevise_masquerade?ref=badge_shield)
 
-[![Build Status](https://secure.travis-ci.org/oivoodoo/devise_masquerade.png?branch=master)](https://travis-ci.org/oivoodoo/devise_masquerade)
+ [![Gitter chat](https://badges.gitter.im/oivoodoo/devise_masquerade.svg)](https://gitter.im/oivoodoo/devise_masquerade?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+
+[![FOSSA Status](https://app.fossa.io/api/projects/git%2Bgithub.com%2Foivoodoo%2Fdevise_masquerade.svg?type=shield)](https://app.fossa.io/projects/git%2Bgithub.com%2Foivoodoo%2Fdevise_masquerade?ref=badge_shield)
 
-[![Code Climate](https://codeclimate.com/badge.png)](https://codeclimate.com/github/oivoodoo/devise_masquerade)
+[![Build Status](https://secure.travis-ci.org/oivoodoo/devise_masquerade.svg?branch=master)](https://travis-ci.org/oivoodoo/devise_masquerade)
 
-[![endorse](https://api.coderwall.com/oivoodoo/endorsecount.png)](https://coderwall.com/oivoodoo)
+[![Maintainability](https://api.codeclimate.com/v1/badges/cf63d775dc014a7ebc03/maintainability)](https://codeclimate.com/github/oivoodoo/devise_masquerade/maintainability)
 
 [![Analytics](https://ga-beacon.appspot.com/UA-46818771-1/devise_masquerade/README.md)](https://github.com/oivoodoo/devise_masquerade)
 
+[Consulting](https://bitscorp.co)
+
 It's a utility library for enabling functionallity like login as button for
 admin.
 
@@ -31,7 +33,9 @@ And then execute:
 
 In the view you can use url helper for defining link:
 
+```ruby
     = link_to "Login As", masquerade_path(user)
+```
 
 `masquerade_path` would create specific `/masquerade` path with query params `masquerade`(key) and `masqueraded_resource_class` to know
 which model to choose to search and sign in by masquerade key.
@@ -62,9 +66,11 @@ Instead of user you can use your resource name admin, student or another names.
 If you want to back to the owner of masquerade action user you could use
 helpers:
 
+```ruby
     user_masquerade? # current user was masqueraded by owner?
 
     = link_to "Reverse masquerade", back_masquerade_path(current_user)
+```
 
 ## Custom controller for adding cancan for authorization
 
@@ -162,12 +168,12 @@ in `routes.rb`:
     Devise.masquerade_key_size = 16 # size of the generate by SecureRandom.urlsafe_base64
     Devise.masquerade_bypass_warden_callback = false
     Devise.masquerade_routes_back = false # if true, route back to the page the user was on via redirect_back
-    Devise.masquerading_resource_class = User
+    Devise.masquerading_resource_class = AdminUser
     # optional, default: masquerading_resource_class.model_name.param_key
-    Devise.masquerading_resource_name = :user
-    Devise.masqueraded_resource_class = AdminUser
+    Devise.masquerading_resource_name = :admin_user
+    Devise.masqueraded_resource_class = User
     # optional, default: masqueraded_resource_class.model_name.param_key
-    Devise.masqueraded_resource_name = :admin_user
+    Devise.masqueraded_resource_name = :user
 ```
 
 ## Demo project
@@ -181,7 +187,7 @@ And check http://localhost:3000/, use for login user1@example.com and
 
 ## Troubleshooting
 
-Are you working in development mode and wondering why masquerade attempts result in a [Receiving "You are already signed in" flash[:error]](https://github.com/oivoodoo/devise_masquerade/issues/58) message? `Filter chain halted as :require_no_authentication rendered or redirected` showing up in your logfile? Chances are that you need to enable caching:
+Are you working in development mode and wondering why masquerade attempts result in a [Receiving "You are already signed in" flash[:error]](https://github.com/oivoodoo/devise_masquerade/issues/58) message? `Filter chain halted as :require_no_authentication rendered or redirected` showing up in your logfile? Do you find that your `user_masquerade?` method is always returning false? Chances are that you need to enable caching:
 
     rails dev:cache
 

data/app/controllers/devise/masquerades_controller.rb

@@ -1,3 +1,5 @@
+require 'securerandom'
+
 class Devise::MasqueradesController < DeviseController
   Devise.mappings.each do |name, _|
     class_eval <<-METHODS, __FILE__, __LINE__ + 1
@@ -11,7 +13,7 @@ class Devise::MasqueradesController < DeviseController
 
   def show
     if send("#{masqueraded_resource_name}_masquerade?")
-      resource = send("current_#{masquerading_resource_name}")
+      resource = masquerading_current_user
 
       go_back(resource, path: after_masquerade_full_path_for(resource))
     else
@@ -20,7 +22,7 @@ class Devise::MasqueradesController < DeviseController
       save_masquerade_owner_session(masqueradable_resource)
 
       resource = masqueradable_resource
-      sign_out(send("current_#{masquerading_resource_name}"))
+      sign_out(masquerading_current_user)
 
       unless resource
         flash[:error] = "#{masqueraded_resource_class} not found."
@@ -73,7 +75,7 @@ class Devise::MasqueradesController < DeviseController
   end
 
   def find_owner_resource(masqueradable_resource)
-    skey = session_key(masqueradable_resource)
+    skey = session_key(masqueradable_resource, masquerading_guid)
 
     GlobalID::Locator.locate_signed(Rails.cache.read(skey), for: 'masquerade')
   end
@@ -141,7 +143,9 @@ class Devise::MasqueradesController < DeviseController
   end
 
   def save_masquerade_owner_session(masqueradable_resource)
-    skey = session_key(masqueradable_resource)
+    guid = SecureRandom.uuid
+
+    skey = session_key(masqueradable_resource, guid)
 
     resource_gid = send("current_#{masquerading_resource_name}").to_sgid(for: 'masquerade')
 
@@ -150,19 +154,21 @@ class Devise::MasqueradesController < DeviseController
     session[skey] = true
     session[session_key_masquerading_resource_class] = masquerading_resource_class.name
     session[session_key_masqueraded_resource_class] = masqueraded_resource_class.name
+    session[session_key_masquerading_resource_guid] = guid
   end
 
   def cleanup_masquerade_owner_session(masqueradable_resource)
-    skey = session_key(masqueradable_resource)
+    skey = session_key(masqueradable_resource, masquerading_guid)
 
     Rails.cache.delete(skey)
     session.delete(skey)
     session.delete(session_key_masqueraded_resource_class)
     session.delete(session_key_masquerading_resource_class)
+    session.delete(session_key_masquerading_resource_guid)
   end
 
-  def session_key(masqueradable_resource)
-    "devise_masquerade_#{masqueraded_resource_name}_#{masqueradable_resource.to_param}".to_sym
+  def session_key(masqueradable_resource, guid)
+    "devise_masquerade_#{masqueraded_resource_name}_#{masqueradable_resource.to_param}_#{guid}".to_sym
   end
 
   def session_key_masqueraded_resource_class
@@ -170,6 +176,19 @@ class Devise::MasqueradesController < DeviseController
   end
 
   def session_key_masquerading_resource_class
-      "devise_masquerade_masquerading_resource_class"
+    "devise_masquerade_masquerading_resource_class"
+  end
+
+  def session_key_masquerading_resource_guid
+    "devise_masquerade_masquerading_resource_guid"
+  end
+
+  def masquerading_current_user
+    send("current_#{masquerading_resource_name}")
+  end
+
+  def masquerading_guid
+    session[session_key_masquerading_resource_guid]
   end
 end
+

data/lib/devise_masquerade/controllers/helpers.rb

@@ -39,23 +39,28 @@ module DeviseMasquerade
 
           def #{name}_masquerade?
             return false if current_#{name}.blank?
+            return false if session[#{name}_helper_session_key].blank?
 
-            key = "devise_masquerade_#{name}_" + current_#{name}.to_param
-            return false if session[key].blank?
-
-            ::Rails.cache.exist?(key.to_sym).present?
+            ::Rails.cache.exist?(#{name}_helper_session_key).present?
           end
 
           def #{name}_masquerade_owner
             return unless send(:#{name}_masquerade?)
 
-            key = "devise_masquerade_#{name}_" + current_#{name}.to_param
-            sgid = ::Rails.cache.read(key.to_sym)
+            sgid = ::Rails.cache.read(#{name}_helper_session_key)
             GlobalID::Locator.locate_signed(sgid, for: 'masquerade')
           end
 
           private
 
+          def #{name}_helper_session_key
+            ["devise_masquerade_#{name}", current_#{name}.to_param, #{name}_helper_masquerading_resource_guid].join("_")
+          end
+
+          def #{name}_helper_masquerading_resource_guid
+            session["devise_masquerade_masquerading_resource_guid"].to_s
+          end
+
           def masquerade_sign_in(resource)
             if Devise.masquerade_bypass_warden_callback
               if respond_to?(:bypass_sign_in)

data/lib/devise_masquerade/controllers/url_helpers.rb

@@ -8,9 +8,9 @@ module DeviseMasquerade
         scope = Devise::Mapping.find_scope!(resource)
 
         opts = args.shift || {}
-        opts.merge!(masqueraded_resource_class: resource.class.name)
+        opts[:masqueraded_resource_class] = resource.class.name
 
-        opts.merge!(Devise.masquerade_param => resource.masquerade_key)
+        opts[Devise.masquerade_param] = resource.masquerade_key
 
         send("#{scope}_masquerade_index_path", opts, *args)
       end
@@ -19,7 +19,7 @@ module DeviseMasquerade
         scope = Devise::Mapping.find_scope!(resource)
 
         opts = args.first || {}
-        opts.merge!(masqueraded_resource_class: resource.class.name)
+        opts[:masqueraded_resource_class] = resource.class.name
 
         send("back_#{scope}_masquerade_index_path", opts, *args)
       end

data/lib/devise_masquerade/version.rb

@@ -1,3 +1,3 @@
 module DeviseMasquerade
-  VERSION = '1.3.8'.freeze
+  VERSION = '1.3.9'.freeze
 end

data/spec/controllers/devise/masquerades_controller_spec.rb

@@ -14,7 +14,7 @@ describe Devise::MasqueradesController, type: :controller do
           get :show, params: { id: mask.to_param, masqueraded_resource_class: mask.class.name, masquerade: mask.masquerade_key }
         end
 
-        it { expect(Rails.cache.read("devise_masquerade_student_#{mask.to_param}")).to be }
+        it { expect(cache_read(mask)).to be }
 
         it 'should have warden keys defined' do
           expect(session["warden.user.student.key"].first.first).to eq(mask.id)
@@ -22,6 +22,9 @@ describe Devise::MasqueradesController, type: :controller do
 
         it { should redirect_to('/') }
       end
+    end
+    context 'when logged in' do
+      before { logged_in }
 
       describe '#masquerade user' do
         let(:mask) { create(:user) }
@@ -30,7 +33,7 @@ describe Devise::MasqueradesController, type: :controller do
           get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key }
         end
 
-        it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).to be }
+        it { expect(cache_read(mask)).to be }
         it { expect(session["warden.user.user.key"].first.first).to eq(mask.id) }
         it { should redirect_to('/') }
 
@@ -39,7 +42,7 @@ describe Devise::MasqueradesController, type: :controller do
 
           it { should redirect_to(masquerade_page) }
           it { expect(current_user.reload).to eq(@user) }
-          it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).not_to be }
+          it { expect(cache_read(mask)).not_to be }
         end
       end
 
@@ -107,4 +110,16 @@ describe Devise::MasqueradesController, type: :controller do
   def masquerade_page
     "/"
   end
+
+  def guid
+    session[:devise_masquerade_masquerading_resource_guid]
+  end
+
+  def cache_read(user)
+    Rails.cache.read(cache_key(user))
+  end
+
+  def cache_key(user)
+    "devise_masquerade_#{mask.class.name.downcase}_#{mask.to_param}_#{guid}"
+  end
 end

data/spec/controllers/masquerades_tests_controller_spec.rb

@@ -16,7 +16,7 @@ describe MasqueradesTestsController, type: :controller do
     before { get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key } }
 
     it { expect(response.status).to eq(403) }
-    it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).not_to be }
+    it { expect(cache_read(mask)).not_to be }
     it { expect(session['warden.user.user.key'].first.first).not_to eq(mask.id) }
   end
 
@@ -35,7 +35,20 @@ describe MasqueradesTestsController, type: :controller do
     end
 
     it { expect(response.status).to eq(302) }
-    it { expect(Rails.cache.read("devise_masquerade_user_#{mask.to_param}")).to be }
+    it { expect(cache_read(mask)).to be }
     it { expect(session['warden.user.user.key'].first.first).to eq(mask.id) }
   end
+
+
+  def guid
+    session[:devise_masquerade_masquerading_resource_guid]
+  end
+
+  def cache_read(user)
+    Rails.cache.read(cache_key(user))
+  end
+
+  def cache_key(user)
+    "devise_masquerade_#{mask.class.name.downcase}_#{mask.to_param}_#{guid}"
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise_masquerade
 version: !ruby/object:Gem::Version
-  version: 1.3.8
+  version: 1.3.9
 platform: ruby
 authors:
 - Alexandr Korsak
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-04-28 00:00:00.000000000 Z
+date: 2021-09-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler