j1_template_mde 2018.4.25 → 2018.4.26

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 54a8be96ba8773e6f3f64ed9cb3626543ccaf9cb
-  data.tar.gz: a9245d5f4a67b81ca3d7106c639f175175bbc4db
+  metadata.gz: c9af654adc5781e70b236b5f49ee79aee1b69e26
+  data.tar.gz: 8a7501b1fb331f25849681cabca813f64c015c64
 SHA512:
-  metadata.gz: c9d2f4fdeef1096b759ad89181f7c424b789856724d10a61efa66123512f2bcb15b40af7ff522626c84dc1a0a4af4e3acea3023dea1d6a049ecf2acf56f8a6fd
-  data.tar.gz: 5aa89abf67debb3b9d2a1f14d08ef406426254e13a9e22221b18cc1e0aeca6c686f5a1af72c58fd7b8669cf6a713d8448c60cbd219e8bf76bd0e1659953a8d50
+  metadata.gz: 7a457a75fabc48f95e12af75aee06a8dd8ae4955a8c510ab605ca07d366e10771c212f7ba8e77a3f972b3c3c250f72c0e572bb36c7ec113703b6456151136623
+  data.tar.gz: aec61c1a051c847fc2f36158d8a0741141c3574c81ff6efa3a9203ce6ddeb5e48541c62084bf11de549ca5964b5bb802e10ce4ec6ce2895e659d7e7bd6eff40d

data/_includes/themes/j1/layouts/layout_shim_generator.html

@@ -22,6 +22,7 @@
 -------------------------------------------------------------------------------- {% endcomment %}
 {% assign j1_apps     = site.data.apps %}
 {% assign nedb_config = j1_apps.j1_nedb %}
+{% assign stickyfill  =  site.data.j1_polyfills.stickyfill.enabled %}
 
 {% comment %} Main
 -------------------------------------------------------------------------------- {% endcomment %}
@@ -31,6 +32,16 @@
 <script>
   // [INFO   ] [j1.layout.shim_loader.html         ] [create global ENVIRONMENT variable for Javascript access]
   var j1_environment = "{{ site.environment }}";
+  var sticky_elements = $('.sticky');
+
+  {% comment %} Polyfill initializations
+  ------------------------------------------------------------------------------ {% endcomment %}  
+  {% if stickyfill %}
+  <!-- [INFO   ] [j1.layout.shim_loader.html         ] [load and activate the polyfill stickyfill for elements using CSS style "sticky"] -->
+  $(document).ready(function() {    
+    Stickyfill.add(sticky_elements);
+  });
+  {% endif %}
 
   // [INFO   ] [j1.layout.shim_loader.html         ] [create global NeDB database object]
   // jadams, 2017-06-06: for the time being, NeDB is NOT a module */

data/lib/j1/version.rb

@@ -1,3 +1,3 @@
 module J1
-  VERSION = '2018.4.25'
+  VERSION = '2018.4.26'
 end

data/lib/j1_app.rb

@@ -22,7 +22,6 @@ require 'rest-client'
 require 'puma'
 
 require 'rack'
-require 'rack-livereload'
 require 'omniauth'
 require 'omniauth-oauth2'
 require 'sinatra'

data/lib/j1_app/j1_auth_manager/auth_manager.rb

@@ -1,4 +1,30 @@
-# frozen_string_literal: true
+# RuboCops - Documentation
+# ------------------------------------------------------------------------------
+# See: https://rubocop.readthedocs.io/en/latest/
+
+# RuboCops - Disabled Cops
+# ------------------------------------------------------------------------------
+# rubocop:disable Metrics/BlockLength
+# rubocop:disable Metrics/ClassLength
+# rubocop:disable Metrics/LineLength
+# rubocop:disable Style/StringLiterals
+# rubocop:disable Style/Documentation
+# rubocop:disable Metrics/BlockNesting
+# rubocop:disable Layout/ClosingParenthesisIndentation
+# rubocop:disable Layout/LeadingCommentSpace
+# rubocop:disable Layout/EmptyLines
+# rubocop:disable Layout/EmptyLinesAroundBlockBody
+# rubocop:disable Layout/FirstParameterIndentation
+# rubocop:disable Layout/CommentIndentation
+# rubocop:disable Layout/AlignParameters
+# rubocop:disable Layout/AlignHash
+# rubocop:disable Layout/TrailingWhitespace
+# rubocop:disable Layout/IndentHash
+# rubocop:disable Layout/SpaceAroundOperators
+# rubocop:disable Layout/ExtraSpacing
+# rubocop:disable Style/UnlessElse
+# rubocop:disable Style/HashSyntax
+
 
 # ------------------------------------------------------------------------------
 #  ~/lib/j1_auth_manager/auth_manager/.rb
@@ -17,6 +43,8 @@
 # NOTES
 #
 # ------------------------------------------------------------------------------
+# frozen_string_literal: true
+
 module J1App
   class AuthManager < Sinatra::Base
 
@@ -173,7 +201,7 @@ module J1App
     # Set the (internal) endpoint if a user is successfully authenticated
     # --------------------------------------------------------------------------
     use J1WardenOmniAuth do |config|
-      config.redirect_after_callback = '/redirect_after_callback'
+      config.redirect_after_callback = '/post_authentication'
     end
 
     # Add the internal logger from Rack to the middleware's of the stack
@@ -194,8 +222,7 @@ module J1App
     # Prepare root (index) page for app detection
     #
     before '/' do
-      log_info! "RootPage", "PrepareCookie", 'j1.web.session'
-      #logger.info "ROOT PAGE: Prepare J1 web session data"
+      log_info! "ROOT", "Prepare", 'Web Session'
 
       # read existing/current cookie 'j1.web.session' to update all data
       # of j1_web_session (hash) otherwise set initial data
@@ -214,10 +241,10 @@ module J1App
       # Create|Initialize the J1 web session cookie
       # ------------------------------------------------------------------------
       if warden.authenticated?
-        log_info! "RootPage", 'UpdateCookie', 'Set current user data'
+        log_info! "ROOT", 'Cookie', 'Update current user data'
 
         user = warden.user
-        log_info! "RootPage", 'AuthCheck', 'User detected as signed in', "#{user[:provider]}"
+        log_info! "ROOT", 'AuthCheck', 'User detected as signed in', "#{user[:provider]}"
         j1_web_session['authenticated']   = 'true'
         j1_web_session['requested_page']  = '/'
         j1_web_session['users_allowed']   = providers["#{user[:provider]}"]['users']
@@ -226,15 +253,15 @@ module J1App
         j1_web_session['provider']        = user[:provider]
         j1_web_session['provider_url']    = providers["#{user[:provider]}"]['home_url']
         j1_web_session['permissions']     = providers["#{user[:provider]}"]['permissions']
-        j1_web_session['payment_info']    = user[:info]['payment_info']['attributes'] unless user[:info]['payment_info'].nil?
+        j1_web_session['payment_status']  = user[:info][:payment_status]
       else
-        log_info! "RootPage", 'AuthCheck', 'User detected', 'signed out'
+        log_info! "ROOT", 'AuthCheck', 'User detected', 'signed out'
         j1_web_session['authenticated']   = 'false'
         j1_web_session['requested_page']  = '/'
         j1_web_session['users_allowed']   = 'all'
         j1_web_session['user_name']       = 'unknown'
         j1_web_session['user_id']         = 'unknown'
-        j1_web_session['payment_info']    = 'unknown'
+        j1_web_session['payment_status']  = 'unknown'
         j1_web_session['provider']        = 'unknown'
         j1_web_session['provider_url']    = 'unknown'
         j1_web_session['permissions']     = 'unknown'
@@ -242,7 +269,7 @@ module J1App
       j1_web_session['writer']            = 'middleware'
 
       session_json = j1_web_session.to_json
-      log_info! "RootPage", 'WriteCookie', 'j1.web.session' # "#{session_json}"
+      log_info! "ROOT", 'Cookie', 'Update web session data'                     # "#{session_json}"
 
       session_encoded = Base64.encode64(session_json)
       response.set_cookie(
@@ -253,10 +280,8 @@ module J1App
       )
     end
 
-    # Check auth status for content of type "private" or "premium"
+    # General page detection (page auth pre-flight)
     # --------------------------------------------------------------------------
-    #before '/*' do
-    #before /\/\w+\/(public|private|premium)/ do
     before '/(pages|posts)/*' do
 
       # read existing/current cookie 'j1.web.session'
@@ -268,7 +293,7 @@ module J1App
         session_decoded     = Base64.decode64(session_encoded)
         j1_web_session      = JSON.parse(session_decoded)
 
-        log_info! 'Authorisation', 'ReadCookie', 'j1.web.session' # "#{session_decoded}"
+        log_info! 'PreFlight', 'Cookie', 'Read web session data' # "#{session_decoded}"
       else
         requested_page      = env['REQUEST_URI']
         j1_web_session['requested_page'] = "#{env['REQUEST_URI']}"
@@ -276,9 +301,8 @@ module J1App
 
       # Create|Initialize the J1 web session cookie
       # ------------------------------------------------------------------------
+      log_info! 'PreFlight', 'AuthCheck', 'Check authentication status'
       if warden.authenticated?
-        log_info! 'Authorisation', 'UpdateCookie', 'Set current user data'
-
         user = warden.user
         j1_web_session['authenticated']   = 'true'
         j1_web_session['user_name']       = user[:info]['nickname']
@@ -287,11 +311,13 @@ module J1App
         j1_web_session['provider_url']    = providers["#{user[:provider]}"]['home_url']
         j1_web_session['users_allowed']   = providers["#{user[:provider]}"]['users']#
         j1_web_session['permissions']     = providers["#{user[:provider]}"]['permissions']
-        j1_web_session['payment_info']    = user[:info]['payment_info']['attributes'] unless user[:info]['payment_info'].nil?
+        j1_web_session['payment_status']  = user[:info][:payment_status]
         j1_web_session['writer']          = 'middleware'
 
+        log_info! 'PreFlight', 'AuthCheck', 'User authenticated', "#{user[:info]['nickname']}"
+
         session_json = j1_web_session.to_json
-        log_info! 'Authorisation', 'WriteCookie', 'j1.web.session' # "#{session_json}"
+        log_info! 'PreFlight', 'Cookie', 'Write web session data' # "#{session_json}"
 
         session_encoded = Base64.encode64(session_json)
         response.set_cookie(
@@ -304,27 +330,27 @@ module J1App
 
       # User state|content detection for implicit authentication
       # ------------------------------------------------------------------------
-      log_info! 'Authorisation', 'CheckConfig', 'Authentication enabled', "false" if authentication_enabled? == false
-      log_info! 'Authorisation', 'CheckConfig', 'Pass for all pages' if authentication_enabled? == false
+      log_info! 'PreFlight', 'CheckConfig', 'Authentication check detected', "false" if authentication_enabled? == false
+      log_info! 'PreFlight', 'AuthCheck', 'Pass for all pages' if authentication_enabled? == false
       pass if authentication_enabled? == false
-      log_info! 'Authorisation', 'CheckConfig', 'Authentication enabled', "true"
-      log_info! 'Authorisation', 'DetectContent', 'Check for public content' if public_content?
-      log_info! 'Authorisation', 'DetectContent', 'Pass all public content' if public_content?
+
+      log_info! 'PreFlight', 'CheckConfig', 'Authentication check detected', "true"
+      log_info! 'PreFlight', 'DetectContent', 'Public content detected' if public_content?
+      log_info! 'PreFlight', 'DetectContent', 'Pass all public content' if public_content?
       pass if public_content?
-      log_info! 'Authorisation', 'DetectContent', 'Check for protected content'
 
-      requested_page      = env['REQUEST_URI']
+      log_info! 'PreFlight', 'DetectContent', 'Check for protected content'
 
+      requested_page = env['REQUEST_URI']
       requested_page.scan(/(private|premium)/) do |match|
 
         category = match[0]
-        log_info! 'Authorisation', 'DetectContent', 'Content detected', "#{category}"
+        log_info! 'PreFlight', 'DetectContent', 'Content detected', "#{category}"
 
+        log_info! 'PreFlight', 'AuthCheck', 'Check authorisation status'
         if warden.authenticated?
-          log_info! 'Authorisation', 'UpdateCookie', 'Set current user data'
-
           user_name = user[:info]['nickname']
-          log_info! 'Authorisation', 'AuthCheck', 'User detected', "#{user_name}"
+          log_info! 'PreFlight', 'AuthCheck', 'User detected', "#{user_name}"
 
           current_provider  = warden.user[:provider]
 
@@ -338,49 +364,55 @@ module J1App
           j1_web_session['permissions']     = providers["#{user[:provider]}"]['permissions']
           j1_web_session['requested_page']  = requested_page
 
+          log_info! 'PreFlight', 'ContentCheck', 'Check permissions'
           if permissions[:"#{category}"].include? current_provider
-            log_info! 'Authorisation', 'ContentCheck', 'Provider detected', "#{current_provider}"
-            log_info! 'Authorisation', 'ContentCheck', 'Category supported', "yes - #{category}"
+            log_info! 'PreFlight', 'ContentCheck', 'Provider detected', "#{current_provider}"
+            log_info! 'PreFlight', 'ContentCheck', 'Category detected', "#{category}"
+            log_info! 'PreFlight', 'ContentCheck', 'Category supported', 'YES'
+
             # Check permissions
             #
-            log_info! 'Authorisation', 'ConditionCheck', 'Check permissions for provider', "#{current_provider}"
-            conditions = J1App.conditions current_provider
-            if conditions["#{category}"]
-              log_info! 'Authorisation', 'ConditionCheck', 'Conditions detected for', "#{category}"
-              conditions["#{category}"].each do |k, v|
-                case k
-                when 'enabled'
-                  log_info! 'Authorisation', 'ConditionCheck', "#{k}", "#{v}"
-                when 'users'
-                  log_info! 'Authorisation', 'ConditionCheck', 'users'
-                  v.each do |k, v|
-                    log_info! 'Authorisation', 'ConditionCheck', "users - #{k}", "#{v}"
-                  end
-                when 'payment'
-                  log_info! 'Authorisation', 'ConditionCheck', 'payment'
-                  v.each do |k, v|
-                    case k
-                    when 'tiers'
-                      log_info! 'Authorisation', 'ConditionCheck', "payment - #{k}", "#{v}"
-                    when 'tier'
-                      v.each do |k, v|
-                        log_info! 'Authorisation', 'ConditionCheck', 'payment - tiers - tier : ' "#{k}", "#{v}"
-                      end
-                    end
-                  end
-                end
-              end
-            end
+            #log_info! 'Authorisation', 'ConditionCheck', 'Check permissions for provider', "#{current_provider}"
+            #conditions = J1App.conditions current_provider
+            # if conditions["#{category}"]
+            #   log_info! 'Authorisation', 'ConditionCheck', 'Conditions detected', "#{category}"
+            #   conditions["#{category}"].each do |k, v|
+            #     case k
+            #     when 'enabled'
+            #       log_info! 'Authorisation', 'ConditionCheck', "#{k}", "#{v}"
+            #     when 'users'
+            #       log_info! 'Authorisation', 'ConditionCheck', 'users'
+            #       v.each do |k, v|
+            #         log_info! 'Authorisation', 'ConditionCheck', "users - #{k}", "#{v}"
+            #       end
+            #     when 'payment'
+            #       log_info! 'Authorisation', 'ConditionCheck', 'payment'
+            #       v.each do |k, v|
+            #         case k
+            #         when 'tiers'
+            #           log_info! 'Authorisation', 'ConditionCheck', "payment - #{k}", "#{v}"
+            #         when 'tier'
+            #           v.each do |k, v|
+            #             log_info! 'Authorisation', 'ConditionCheck', 'payment - tiers - tier : ' "#{k}", "#{v}"
+            #           end
+            #         end
+            #       end
+            #     end
+            #   end
+            # end
           else
             provider  = permissions[:"#{category}"][0]
-            log_info! 'Authorisation', 'ContentCheck', 'Provider detected', "#{current_provider}"
-            log_info! 'Authorisation', 'ContentCheck', 'Category supported', "no - #{category}"
-            log_info! 'Authorisation', 'SignIn', 'Provider', "#{provider}"
+            log_info! 'PreFlight', 'ContentCheck', 'Provider detected', "#{current_provider}"
+            log_info! 'PreFlight', 'ContentCheck', 'Category detected', "#{category}"
+            log_info! 'PreFlight', 'ContentCheck', 'Category supported', 'NO'
+            log_info! 'PreFlight', 'AuthCheck', 'Authorisation failed for user', "#{user_name}"
+
+            log_info! 'PreFlight', 'SignOut', 'Sign out user', "#{user_name}"
             warden.logout
             session.clear
 
             session_json = j1_web_session.to_json
-            log_info! 'Authorisation', 'WriteCookie', 'j1.web.session' # "#{session_json}"
+            log_info! 'PreFlight', 'Cookie', 'Write web session data' # "#{session_json}"
 
             session_encoded = Base64.encode64(session_json)
             response.set_cookie(
@@ -390,24 +422,22 @@ module J1App
                 path: '/'
             )
 
-            log_info! 'Authorisation', 'AuthManager', 'Request for authentication'
-
+            log_info! 'PreFlight', 'AuthCheck', 'Call for authentication'
             allowed_users = providers["#{provider}"]['users'].join(',')
             redirect "/access_protected_content?provider=#{provider}&category=#{category}&page=#{requested_page}&allowed_users=#{allowed_users}"
           end
-          log_info! 'Authorisation', 'AuthCheck', 'Pass to requested page', "#{requested_page}"
+          log_info! 'PreFlight', 'AuthCheck', 'Pass to requested page', "#{requested_page}"
           pass
         else
-          log_info! 'Authentication', 'AuthCheck', 'User detected', 'signed out'
+          log_info! 'PreFlight', 'AuthCheck', 'User detected', 'signed out'
           default_provider = permissions[:"#{category}"][0]
-          log_info! 'Authentication', 'ContentCheck', 'Set default provider', "#{default_provider}"
+          log_info! 'PreFlight', 'AuthCheck', 'Set default provider', "#{default_provider}"
 
-          # provider_strategy = strategies["#{default_provider}"]
           strategy          = providers["#{default_provider}"]['strategy']
           provider_strategy = :"#{strategy}"
 
-          log_info! 'Authentication', 'SignIn', 'Default provider detected', "#{default_provider}"
-          log_info! 'Authentication', 'SignIn', 'Set authentication strategy', "#{provider_strategy}"
+          log_info! 'PreFlight', 'AuthCheck', 'Start processing provider', "#{default_provider}"
+          log_info! 'PreFlight', 'AuthCheck', 'Set authentication strategy', "#{provider_strategy}"
 
           case provider_strategy
 
@@ -427,19 +457,17 @@ module J1App
             logger.info "Hi There, #{j1_web_session[:user_name]}! You have access to the #{params['id']} team"
 
           when :member
-            log_info! 'Authentication', 'SignIn', "Strategy detected", "member"
+            log_info! 'PreFlight', 'AuthCheck', 'Process Authentication Strategy', "member"
 
             if env['HTTP_COOKIE'].include? 'j1.web.session'
               session_encoded   = request.cookies['j1.web.session']
               session_decoded   = Base64.decode64(session_encoded)
-              log_info! 'Authentication', 'ReadCookie', 'j1.web.session' # "#{session_decoded}"
+              log_info! 'PreFlight', 'Cookie', 'Read web session data' # "#{session_decoded}"
               j1_web_session    = JSON.parse(session_decoded)
             end
 
             # Update cookie data
             # ----------------------------------------------------------------------
-            log_info! 'Authentication', 'UpdateCookie', 'Set current user data'
-
             j1_web_session['provider_url']    = providers["#{default_provider}"]['home_url']
             j1_web_session['users_allowed']   = providers["#{default_provider}"]['users']
             j1_web_session['permissions']     = providers["#{default_provider}"]['permissions']
@@ -450,7 +478,7 @@ module J1App
             #
             session_json = j1_web_session.to_json
             session_encoded = Base64.encode64(session_json)
-            log_info! 'Authentication', 'WriteCookie', 'j1.web.session' # "#{session_json}"
+            log_info! 'PreFlight', 'Cookie', 'Write web session data' # "#{session_json}"
 
             response.set_cookie(
                 'j1.web.session',
@@ -462,7 +490,7 @@ module J1App
             allowed_users   = providers["#{default_provider}"]['users'].join(',')
             requested_page  = env['REQUEST_URI']
 
-            log_info! 'Authorisation', 'AuthManager', 'Request for authentication'
+            log_info! 'PreFlight', 'Redirect', 'Call Request for Page Access Control'
             redirect "/access_protected_content?provider=#{default_provider}&category=#{category}&page=#{requested_page}&allowed_users=#{allowed_users}"
           else
             raise J1App::ConfigError
@@ -485,9 +513,11 @@ module J1App
       request                           =  params.fetch('request')
       provider                          =  params.fetch('provider')
 
+      # SignIn
+      # ------------------------------------------------------------------------
       if request === 'signin'
 
-        log_info! 'Authentication', 'RestApi', 'Called for SignIn'
+        log_info! 'Authentication', 'SignIn', 'Called for provider', "#{provider}"
 
         # collect (additional) GET parameter|s
         # ----------------------------------------------------------------------
@@ -499,7 +529,7 @@ module J1App
         # Write updated J1 session data to cookie
         # --------------------------------------------------------------------
         session_json = j1_web_session.to_json
-        log_info! 'Authentication', 'RestApi', 'Write J1 web session data to cookie' # #{session_json}"
+        log_info! 'Authentication', 'Cookie', 'Write web session data' # #{session_json}"
 
         session_encoded = Base64.encode64(session_json)
         response.set_cookie(
@@ -510,263 +540,357 @@ module J1App
         )
 
         if warden.authenticated?
-          log_info! 'Authentication', 'RestApi', 'Already signed in', "#{warden.user[:info]['nickname']} "
+          log_info! 'Authentication', 'SignIn', 'User already signed in', "#{warden.user[:info]['nickname']} "
         else
-          log_info! 'Authentication', 'RestApi', 'Go for authentication', "#{provider}"
+          log_info! 'Authentication', 'SignIn', 'Initiate OmniAuth request phase', "#{provider}"
+
           # Make (really) sure that old session is cleared before login
           # --------------------------------------------------------------------
           warden.logout
           session.clear
           warden.authenticate! :"omni_#{provider}"
         end
-        log_info! 'Authentication', 'RestApi', 'Requested page', "#{j1_web_session['requested_page']}"
-        redirect j1_web_session['requested_page']
+        # SignOut
+        # ------------------------------------------------------------------------
       elsif request === 'signout'
-
-        log_info! 'Authentication', 'RestApi', 'Called for sign out'
-
         # collect (additional) GET parameter|s
-        # ----------------------------------------------------------------------
         provider_signout = params.fetch('provider_signout')
+        log_info! 'Authentication', 'SignOut', 'Called for provider', #{provider}"
+
+                  if warden.authenticated?
+                    user         = warden.user[:info]['nickname']
+                    provider     = warden.user[:provider]
+                    provider_url = j1_web_session['provider_url']
+                    log_info! 'Authentication', 'SignOut', 'Sign out user', "#{user}"
+                    warden.logout
+                    session.clear
+
+                    # Read current J1 web session cookie
+                    # --------------------------------------------------------------------
+                    if env['HTTP_COOKIE'].include? 'j1.web.session'
+                      session_encoded = env['rack.request.cookie_hash']['j1.web.session']
+                      session_decoded = Base64.decode64(session_encoded)
+                      log_info! 'Authentication', 'Cookie', 'Read web session data' # #{session_decoded}"
+                      j1_web_session = JSON.parse(session_decoded)
+                    else
+                      j1_web_session['requested_page'] = env['REQUEST_URI']
+                    end
 
-        if warden.authenticated?
-          user         = warden.user[:info]['nickname']
-          provider     = warden.user[:provider]
-          provider_url = j1_web_session['provider_url']
-          warden.logout
-          session.clear
-
-          # Read current J1 web session cookie
-          # --------------------------------------------------------------------
-          if env['HTTP_COOKIE'].include? 'j1.web.session'
-            session_encoded = env['rack.request.cookie_hash']['j1.web.session']
-            session_decoded = Base64.decode64(session_encoded)
-            log_info! 'Authentication', 'RestApi', 'Read J1 web session data from cookie' # #{session_decoded}"
-            j1_web_session = JSON.parse(session_decoded)
-          else
-            j1_web_session['requested_page'] = env['REQUEST_URI']
-          end
-
-          # Update J1 web session data
-          # --------------------------------------------------------------------
-          j1_web_session['user_name']     = 'unknown'
-          j1_web_session['user_id']       = 'unknown'
-          j1_web_session['users_allowed'] = 'unknown'
-          j1_web_session['payment_info']  = 'unknown'
-          j1_web_session['provider']      = 'unknown'
-          j1_web_session['provider_url']  = 'unknown'
-          j1_web_session['permissions']   = 'unknown'
-          j1_web_session['authenticated'] = 'false'
-          j1_web_session['writer']        = 'middleware'
-
-          # Write updated J1 session data to cookie
-          # --------------------------------------------------------------------
-          session_json = j1_web_session.to_json
-          log_info! 'Authentication', 'RestApi', 'Write J1 web session data to cookie' # #{session_json}"
-
-          session_encoded = Base64.encode64(session_json)
-          response.set_cookie(
-              'j1.web.session',
-              domain: false,
-              value: session_encoded.to_s,
-              path: '/'
-          )
-
-          if provider_signout === 'true'
-            log_info! 'Authentication', 'RestApi', 'Sign out user', "#{user}"
-            log_info! 'Authentication', 'RestApi', 'Sign out provider', "#{provider}"
-            log_info! 'Authentication', 'RestApi', 'Sign out from', "#{provider}"
-            log_info! 'Authentication', 'RestApi', 'Redirect to provider', "#{provider_url}"
-            redirect "#{provider_url}"
-          else
-            log_info! 'Authentication', 'RestApi', 'Sign out user', "#{user}"
-            log_info! 'Authentication', 'RestApi', 'Sign out provider', "#{provider}"
-            log_info! 'Authentication', 'RestApi', 'Sign out from', "session"
-            log_info! 'Authentication', 'RestApi', 'Redirect to page', "#{j1_web_session['requested_page']}"
-
-            # If signed out, redirect ONLY for PUBLIC pages
-            # ------------------------------------------------------------------
-            if redirect_whitelisted?j1_web_session['requested_page']
-              log_info! 'Authentication', 'RestApi', 'Redirect detetced as', "whitelisted"
-              log_info! 'Authentication', 'RestApi', 'Requested page', "#{j1_web_session['requested_page']}"
-              redirect j1_web_session['requested_page']
-            else
-              log_info! 'Authentication', 'RestApi', 'Redirect detetced as', "NOT whitelisted"
-              log_info! 'Authentication', 'RestApi', 'Redirect to', "/"
-              redirect '/'
-            end
-          end
-        else
-          # THIS condition should NEVER REACHED because NO logout dialog
-          # (modal) is provided by the auth client if a user isn't signed in.
-          # Kept this alternative for cases something went wrong.
-          # --------------------------------------------------------------------
-          log_info! 'Authentication', 'RestApi', 'DEAD PATH: Called for sign out', 'NOT signed in'
-
-          # Read current J1 session cookie
-          # --------------------------------------------------------------------
-          if env['HTTP_COOKIE'].include? 'j1.web.session'
-            session_encoded   = env['rack.request.cookie_hash']['j1.web.session']
-            session_decoded   = Base64.decode64(session_encoded)
-            j1_web_session  = JSON.parse(session_decoded)
-
-            log_info! 'Authentication', 'RestApi', 'DEAD PATH: Read J1 web session data from cookie' # #{session_decoded}"
-          else
-            j1_web_session['requested_page'] = env['REQUEST_URI']
-          end
+                    # Update J1 web session data
+                    # --------------------------------------------------------------------
+                    j1_web_session['user_name']       = 'unknown'
+                    j1_web_session['user_id']         = 'unknown'
+                    j1_web_session['users_allowed']   = 'unknown'
+                    j1_web_session['payment_status']  = 'unknown'
+                    j1_web_session['provider']        = 'unknown'
+                    j1_web_session['provider_url']    = 'unknown'
+                    j1_web_session['permissions']     = 'unknown'
+                    j1_web_session['authenticated']   = 'false'
+                    j1_web_session['writer']          = 'middleware'
+
+                    # Write updated J1 session data to cookie
+                    # --------------------------------------------------------------------
+                    session_json = j1_web_session.to_json
+                    log_info! 'Authentication', 'Cookie', 'Write web session data' # #{session_json}"
+
+                    session_encoded = Base64.encode64(session_json)
+                    response.set_cookie(
+                        'j1.web.session',
+                        domain: false,
+                        value: session_encoded.to_s,
+                        path: '/'
+                    )
+
+                    if provider_signout === 'true'
+                      log_info! 'Authentication', 'SignOut', 'Sign out user', "#{user}"
+                      log_info! 'Authentication', 'SignOut', 'Sign out from', "#{provider}"
+                      log_info! 'Authentication', 'Redirect', 'Pass to provider', "#{provider_url}"
+                      redirect "#{provider_url}"
+                    else
+                      log_info! 'Authentication', 'SignOut', 'Sign out user', "#{user}"
+                      log_info! 'Authentication', 'SignOut', 'Sign out from', "session"
+
+                      # If signed out, redirect ONLY for PUBLIC pages
+                      # ------------------------------------------------------------------
+                      if redirect_whitelisted?j1_web_session['requested_page']
+                        log_info! 'Authentication', 'Redirect', 'Pass to page', "#{j1_web_session['requested_page']}"
+                        redirect j1_web_session['requested_page']
+                      else
+                        log_info! 'Authentication', 'Redirect', 'Redirect NOT whitelisted'
+                        log_info! 'Authentication', 'Redirect', 'Pass to page', "/"
+                        redirect '/'
+                      end
+                    end
+                  else
+                    # THIS condition should NEVER REACHED because NO logout dialog
+                    # (modal) is provided by the auth client if a user isn't signed in.
+                    # Kept this alternative for cases something went wrong.
+                    # --------------------------------------------------------------------
+                    log_info! 'Authentication', 'API', 'DEAD PATH: Called for sign out', 'NOT signed in'
+
+                    # Read current J1 session cookie
+                    # --------------------------------------------------------------------
+                    if env['HTTP_COOKIE'].include? 'j1.web.session'
+                      session_encoded   = env['rack.request.cookie_hash']['j1.web.session']
+                      session_decoded   = Base64.decode64(session_encoded)
+                      j1_web_session  = JSON.parse(session_decoded)
+
+                      log_info! 'Authentication', 'Cookie', 'DEAD PATH. Read web session data' # #{session_decoded}"
+                    else
+                      j1_web_session['requested_page'] = env['REQUEST_URI']
+                    end
 
-          # Update J1 web session data
-          # --------------------------------------------------------------------
-          j1_web_session['user_name']     = 'unknown'
-          j1_web_session['user_id']       = 'unknown'
-          j1_web_session['users_allowed'] = 'unknown'
-          j1_web_session['payment_info']  = 'unknown'
-          j1_web_session['provider']      = 'unknown'
-          j1_web_session['provider_url']  = 'unknown'
-          j1_web_session['permissions']   = 'unknown'
-          j1_web_session['authenticated'] = 'false'
-          j1_web_session['writer']        = 'middleware'
-
-          # Write updated J1 session data to cookie
-          # --------------------------------------------------------------------
-          session_json = j1_web_session.to_json
-          log_info! 'Authentication', 'RestApi', 'DEAD PATH: Write J1 web session data to cookie' # #{session_json}"
-
-          session_encoded = Base64.encode64(session_json)
-          response.set_cookie(
-              'j1.web.session',
-              domain: false,
-              value: session_encoded.to_s,
-              path: '/'
-          )
-
-          log_info! 'Authentication', 'RestApi', 'DEAD PATH: Redirect to requested page', "#{j1_web_session['requested_page']}"
-          redirect j1_web_session['requested_page']
-        end
+                    # Update J1 web session data
+                    # --------------------------------------------------------------------
+                    j1_web_session['user_name']       = 'unknown'
+                    j1_web_session['user_id']         = 'unknown'
+                    j1_web_session['users_allowed']   = 'unknown'
+                    j1_web_session['payment_status']  = 'unknown'
+                    j1_web_session['provider']        = 'unknown'
+                    j1_web_session['provider_url']    = 'unknown'
+                    j1_web_session['permissions']     = 'unknown'
+                    j1_web_session['authenticated']   = 'false'
+                    j1_web_session['writer']          = 'middleware'
+
+                    # Write updated J1 session data to cookie
+                    # --------------------------------------------------------------------
+                    session_json = j1_web_session.to_json
+                    log_info! 'Authentication', 'Cookie', 'DEAD PATH. Write web session data' # #{session_json}"
+
+                    session_encoded = Base64.encode64(session_json)
+                    response.set_cookie(
+                        'j1.web.session',
+                        domain: false,
+                        value: session_encoded.to_s,
+                        path: '/'
+                    )
+
+                    log_info! 'Post Authentication', 'Redirect', 'DEAD PATH: Pass to requested page', "#{j1_web_session['requested_page']}"
+                    redirect j1_web_session['requested_page']
+                  end
       else
         raise J1App::ConfigError
       end
     end
+    # END get '/authentication'
+    # --------------------------------------------------------------------------
 
     # Post-processing ENDPOINT called after a user is authenticated
     # --------------------------------------------------------------------------
-    get '/redirect_after_callback' do
-
+    get '/post_authentication' do
       reward = {
           :id       => 'unknown',
           :name     => 'unknown',
           :link     => '#'
       }
-
       campaign = {
           :id       => 'unknown',
           :link     => '#'
       }
 
+      log_info! 'API', 'Post Authentication', 'Verification request detected'
+
+      log_info! 'Post Authentication',  'Cookie', 'Read web session data'
       session_encoded   = request.cookies['j1.web.session']
       session_decoded   = Base64.decode64(session_encoded)
       j1_web_session    = JSON.parse(session_decoded)
 
-      log_info! 'Authentication', 'Callback', 'Update web session data' # "#{j1_web_session}"
+      log_info! 'Post Authentication', 'Identification', 'Update web session data'         # "#{j1_web_session}"
 
-      user              = warden.user
-      user_json         = user.to_json
+      user                              = warden.user
+      user_json                         = user.to_json
 
       if user[:provider] === 'disqus'
-        user[:info][:urls][:site]   = "https://disqus.com"
-        user[:info][:urls][:home]   = user[:info]['urls']['profileUrl']
-        user[:info][:urls][:blog]   = "https://disqus.com/by/juergen_adams/"
-        user[:info][:urls][:member] = user[:info]['urls']['profileUrl']
+        user[:info][:urls][:site]       = "https://disqus.com"
+        user[:info][:urls][:home]       = user[:info]['urls']['profileUrl']
+        user[:info][:urls][:blog]       = "https://disqus.com/by/juergen_adams/"
+        user[:info][:urls][:member]     = user[:info]['urls']['profileUrl']
       end
 
       if user[:provider] === 'github'
-        user[:info][:urls][:site]   = "https://github.com"
-        user[:info][:urls][:home]   = user[:info]['urls']['GitHub']
-        user[:info][:urls][:blog]   = "https://github.com/jekyll-one"
-        user[:info][:urls][:member] = user[:info]['urls']['Blog']
+        user[:info][:urls][:site]       = "https://github.com"
+        user[:info][:urls][:home]       = user[:info]['urls']['GitHub']
+        user[:info][:urls][:blog]       = "https://github.com/jekyll-one"
+        user[:info][:urls][:member]     = user[:info]['urls']['Blog']
       end
 
       if user[:provider] === 'patreon'
-        reward_url                  = user[:info]['payment_info']['relationships']['reward']['links']['related']
-        reward_json                 = RestClient.get "#{reward_url}", {:content_type => :json, :accept => :json}
-        reward_data                 = JSON.parse(reward_json)
-
-        user[:info][:urls][:site]   = "https://patreon.com"
-        user[:info][:urls][:home]   = "https://patreon.com/home"
-        user[:info][:urls][:blog]   = "https://patreon.com/jekyll_one"
-#       user[:info][:urls][:member] = reward_data['included'][0]['attributes']['url']
-        user[:info][:urls][:member] = "https://patreon.com" + reward_data['data']['attributes']['url']
-
-        reward[:id]                 = reward_data['data']['id']
-        reward[:name]               = reward_data['data']['attributes']['title']
-        reward[:link]               = "https://patreon.com" + reward_data['data']['attributes']['url']
-
-        campaign[:id]               = reward_data['data']['relationships']['campaign']['data']['id']
-        campaign[:link]             = reward_data['data']['relationships']['campaign']['links']['related']
+
+        user[:info][:urls][:site]       = "https://patreon.com"
+        user[:info][:urls][:home]       = "https://patreon.com/home"
+        user[:info][:urls][:blog]       = "https://patreon.com/jekyll_one"
+
+        unless user[:info]['payment_info'].empty?
+          reward_url                    = user[:info]['payment_info']['relationships']['reward']['links']['related']
+          reward_json                   = RestClient.get "#{reward_url}", {:content_type => :json, :accept => :json}
+          reward_data                   = JSON.parse(reward_json)
+          user[:info][:urls][:member]   = "https://patreon.com" + reward_data['data']['attributes']['url']
+          user[:info][:payment_status]  = user[:info]['payment_info']['attributes']['declined_since'].nil? ? 'true' : 'false'
+        else
+          reward_url                    = ""
+          reward_json                   = ""
+          reward_data                   = ""
+          user[:info][:payment_status]  = 'false'
+        end
+
+        unless reward_data.empty?
+          reward[:id]                   = reward_data['data']['id']
+          reward[:name]                 = reward_data['data']['attributes']['title']
+          reward[:link]                 = "https://patreon.com" + reward_data['data']['attributes']['url']
+          campaign[:id]                 = reward_data['data']['relationships']['campaign']['data']['id']
+          campaign[:link]               = reward_data['data']['relationships']['campaign']['links']['related']
+        else
+          reward[:id]                   = ""
+          reward[:name]                 = "no tiers"
+          reward[:link]                 = ""
+          campaign[:id]                 = ""
+          campaign[:link]               = ""
+        end
       end
 
-      user[:extra][:reward]         = reward
-      user[:extra][:campaign]       = campaign
+      user[:extra][:reward]             = reward
+      user[:extra][:campaign]           = campaign
 
       if user.nil?
         # Collection of session data failed (e.g cookie > 4K)
         #
-        log_info! 'Authentication', 'Callback', 'Internal error', 'User authentication failed'
-
+        log_info! 'Post Authentication', 'Identification', 'Internal error', 'User authentication failed'
         warden.logout
         session.clear
-        redirect "/access_denied?provider=unknown&user=unknown&category=unknown"
+        log_info! 'Post Authentication', 'Redirect', 'Pass to error page (access_denied)'
+        description_title = "Access Denied"
+        redirect "/access_denied?provider=unknown&user=unknown&category=unknown&title=#{description_title}"
       else
-        log_info! 'Authentication', 'Callback', 'Set current user data'
-
+        log_info! 'Post Authentication',  'Cookie', 'Update web session data'
         j1_web_session['user_name']       = user[:info]['nickname']
         j1_web_session['user_id']         = user[:uid]
         j1_web_session['provider']        = user[:provider]
         j1_web_session['permissions']     = providers["#{user[:provider]}"]['permissions']
         j1_web_session['authenticated']   = 'true'
-        j1_web_session['payment_info']    = user[:info]['payment_info']['attributes'] unless user[:info]['payment_info'].nil?
+        j1_web_session['payment_status']  = user[:info][:payment_status]
         j1_web_session['writer']          = 'middleware'
 
         current_user                      = user[:info]['nickname']  = user[:info]['nickname']
         current_provider                  = user[:provider]
 
         j1_web_session['requested_page'].scan(/(private|premium)/) do |match|
+
+          # Set category from requested page
+          #
           category = match[0]
+          log_info! 'Post Authentication', 'Identification', 'Process content type', "#{category}"
+
+          # Check if user is allowed to access protected content in GENERAL
+          #
+          log_info! 'Post Authentication', 'Identification', 'Check allowed users'
           unless j1_web_session['users_allowed'].include? 'all'
             unless j1_web_session['users_allowed'].include? "#{current_user}"
-              log_info! 'Authentication', 'Callback', 'User not allowed', "#{current_user}"
-              log_info! 'Authentication', 'Callback', 'Allowed users', "#{j1_web_session['users_allowed']}"
+              log_info! 'Post Authentication', 'Identification', 'User not allowed', "#{current_user}"
+              log_info! 'Post Authentication', 'Identification', 'Allowed users', "#{j1_web_session['users_allowed']}"
+              log_info! 'Post Authentication', 'Association', 'Logout user from current session', "#{current_user}"
               warden.logout
               session.clear
-              log_info! 'Authentication', 'Callback', 'User signed out', "#{current_user}"
-              redirect "/access_denied?provider=#{current_provider}&user=#{current_user}&category=#{category}"
+              log_info! 'Post Authentication', 'Redirect', 'Pass to error page (access_denied)'
+              description_title = "Access Denied"
+              redirect "/access_denied?provider=#{current_provider}&user=#{current_user}&category=#{category}&title=#{description_title}"
             end
           end
-        end
 
-      end
+          # Check conditions to access protected content (if any)
+          #
+          log_info! 'Post Authentication', 'Identification', 'Check conditions', "#{current_provider}"
+          check_conditions = providers["#{user[:provider]}"]['conditions'][category]['enabled']
+          if check_conditions
 
-      j1_web_session['provider']      = current_provider
-      j1_web_session['users_allowed'] = providers["#{current_provider}"]['users']
+            if providers["#{user[:provider]}"]['conditions'][category]['users']['whitelist'].nil?
+              category_whitelist = 'all'
+            else
+              category_whitelist = providers["#{user[:provider]}"]['conditions'][category]['users']['whitelist']
+            end
 
-      if j1_web_session['requested_page'] == '/'
-        category = 'any protected content'
-        unless j1_web_session['users_allowed'].include? 'all'
-          unless j1_web_session['users_allowed'].include? "#{current_user}"
-            log_info! 'Authentication', 'Callback', 'User not allowed', "#{current_user}"
-            log_info! 'Authentication', 'Callback', 'Allowed users', "#{j1_web_session['users_allowed']}"
-            warden.logout
-            session.clear
-            log_info! 'Authentication', 'Callback', 'User signed out', "#{current_user}"
-            redirect "/access_denied?provider=#{current_provider}&user=#{current_user}&category=#{category}"
+            # Check if user is BLACKLISTED
+            #
+            blacklist = providers["#{user[:provider]}"]['conditions'][category]['users']['blacklist']
+            if blacklist.include? "#{current_user}"
+              log_info! 'Post Authentication', 'Identification', 'Check blacklisting'
+              log_info! 'Post Authentication', 'Identification', 'User blacklisted', "#{current_user}"
+              user[:info][:blacklisted]   = 'true'
+              log_info! 'Post Authentication', 'Association', 'Logout user from current session', "#{current_user}"
+              warden.logout
+              session.clear
+              log_info! 'Post Authentication', 'Redirect', 'Pass to error page (access_denied)'
+              description_title = "Access Denied"
+              redirect "/access_denied?provider=#{current_provider}&user=#{current_user}&category=#{category}&title=#{description_title}"
+            end
+
+            log_info! 'Post Authentication', 'Identification', 'Check whitelisting'
+            if category_whitelisted? category_whitelist, current_user
+              user[:info][:whitelisted]   = 'true'
+              reward[:name]               = 'whitelisted'
+              log_info! 'Post Authentication', 'Identification', 'User whitelisted', "#{current_user}"
+              log_info! 'Post Authentication', 'Identification', 'Reward set to', 'Whitelisted'
+            else
+              log_info! 'Post Authentication', 'Identification', 'No whitelisting found', "#{current_user}"
+            end
+
+            log_info! 'Post Authentication', 'Identification', 'Check conditions'
+            unless category_whitelisted? category_whitelist, current_user
+              log_info! 'Post Authentication', 'Identification', 'Check rewards'
+              payment_tiers = providers["#{user[:provider]}"]['conditions'][category]['payment']['activated']
+              log_info! 'Post Authentication', 'Identification', 'Check rewards', "#{current_user}"
+              if payment_activated? payment_tiers
+                log_info! 'Post Authentication', 'Identification', 'Reward found', "#{reward[:name]}"
+
+                # Check if any payment exists for that user
+                #
+                log_info! 'Post Authentication', 'Identification', 'Check payment status'
+                if user[:info]['payment_info'].empty?
+                  log_info! 'Post Authentication', 'Identification', 'Payment status: NOT AVAILABLE', "#{current_user}"
+                  log_info! 'Post Authentication', 'Association', 'Logout user from current session', "#{current_user}"
+                  warden.logout
+                  session.clear
+                  log_info! 'Post Authentication', 'Redirect', 'Pass to error page (access_denied)'
+                  description_title = "Access Denied"
+                  redirect "/access_denied?provider=#{current_provider}&user=#{current_user}&category=#{category}&title=#{description_title}"
+                end
+
+                # Check for VALID payments (scope: pledge-to-me)
+                #
+                payment_status = user[:info]['payment_info']['attributes']['declined_since']
+                unless payment_valid? payment_status
+                  log_info! 'Post Authentication', 'Identification', 'Payment status INVALID', "#{current_user}"
+                  log_info! 'Post Authentication', 'Association', 'Logout user from current session', "#{current_user}"
+                  warden.logout
+                  session.clear
+                  log_info! 'Post Authentication', 'Redirect', 'Pass to error page (access_denied)'
+                  description_title = "Access Denied"
+                  redirect "/access_denied?provider=#{current_provider}&user=#{current_user}&category=#{category}&title=#{description_title}"
+                else
+                  log_info! 'Post Authentication', 'Identification', 'Payment status VALID', "#{current_user}"
+                end
+              end
+
+            end
+            # end category_whitelisted
           end
+          # end check conditions
+
         end
+        # end protected content
       end
+      # end user.nil?
+
+      # redirect authenticated|validated user to requested page
+      #
+      j1_web_session['provider']      = current_provider
+      j1_web_session['users_allowed'] = providers["#{current_provider}"]['users']
+
+      # TODO: Add membership|product specific data for the SideBar
 
       # write updated J1 session data to cookie
       #
       session_json = j1_web_session.to_json
-      log_info! 'Authentication', 'Callback', 'Write J1 web session data to cookie' # "#{session_json}"
+      log_info! 'Post Authentication', 'Cookie', 'Write web session data' # "#{session_json}"
 
       session_encoded = Base64.encode64(session_json)
       response.set_cookie(
@@ -776,27 +900,25 @@ module J1App
           path: '/'
       )
 
-      # redirect to requested page
-      #
-      log_info! 'Authentication', 'Callback', 'Signed in at provider', "#{user[:provider]}"
-      log_info! 'Authentication', 'Callback', 'Signed in as user', "#{user[:info]['nickname']}"
-      log_info! 'Authentication', 'Callback', 'Requested page', "#{j1_web_session['requested_page']}"
+      log_info! 'Post Authentication', 'Identification', 'Signed in at provider', "#{user[:provider]}"
+      log_info! 'Post Authentication', 'Identification', 'Signed in as user', "#{user[:info]['nickname']}"
+      log_info! 'Post Authentication', 'Redirect', 'Pass to requested page', "#{j1_web_session['requested_page']}"
       redirect j1_web_session['requested_page']
-    end
 
-    get '/redirect_requested_page' do
-      log_info! 'Authentication', 'RedirectPage', 'Requested page', "#{j1_web_session['requested_page']}"
-      redirect j1_web_session['requested_page']
     end
+    # end get /post_authentication
+    # --------------------------------------------------------------------------
+
 
     # Status|Info ENDPOINT called from the web to get current state on an user
     # --------------------------------------------------------------------------
     get '/status' do
-      log_info! 'Status', 'RestApi', 'Info request detected'
       session_encoded   = request.cookies['j1.web.session']
       session_decoded   = Base64.decode64(session_encoded)
       j1_web_session    = JSON.parse(session_decoded)
 
+      log_info! 'API', 'Status Request', 'Info request detected'
+
       # if request.warden.user.respond_to?(:info)
       #
       if warden.authenticated?
@@ -817,16 +939,16 @@ module J1App
           provider_member_url   = '#'
         end
 
-        log_info! 'Status', 'RestApi', 'User detected as signed in', "#{user_name}"
+        log_info! 'API', 'Status Request', 'User detected as signed in', "#{user_name}"
       else
         user_name = 'unknown'
-        log_info! 'Status', 'RestApi', 'User detected', 'signed out'
+        log_info! 'API', 'Status Request', 'User detected', 'signed out'
       end
 
       # if request.warden.authenticated?
       #
       if user_name != 'unknown'
-        log_info! 'Status', 'RestApi', 'Send data for', 'SIGNED_IN'
+        log_info! 'API', 'Status Request', 'Send data', 'SIGNED_IN'
         content_type 'application/json'
         {
             user_name:                user_name,
@@ -841,7 +963,7 @@ module J1App
             status:                   'signed in'
         }.to_json
       else
-        log_info! 'Status', 'RestApi', 'Send data for', 'SIGNED_OUT'
+        log_info! 'API', 'Status Request', 'Send data', 'SIGNED_OUT'
         content_type 'application/json'
         {
             user_name:                'unknown',
@@ -858,13 +980,15 @@ module J1App
       end
     end
 
-    # access_protected_content ENDPOINT called from the app (auth manager)
+    # Exception ENDPOINT called from the app (auth manager)
     # --------------------------------------------------------------------------
     get '/access_denied' do
+      provider          = params.fetch('provider')
+      category          = params.fetch('category')
+      user              = params.fetch('user')
+      description_title = params.fetch('title')
 
-      provider        =  params.fetch('provider')
-      category        =  params.fetch('category')
-      user            =  params.fetch('user')
+      log_info! 'API', 'Exception', 'Page Access Request denied'
 
       session_encoded = request.cookies['j1.web.session']
       session_decoded = Base64.decode64(session_encoded)
@@ -872,23 +996,82 @@ module J1App
 
       # Update J1 web session data
       # --------------------------------------------------------------------
-      j1_web_session['user_name']     = 'unknown'
-      j1_web_session['user_id']       = 'unknown'
-      j1_web_session['users_allowed'] = 'unknown'
-      j1_web_session['payment_info']  = 'unknown'
-      j1_web_session['provider']      = 'unknown'
-      j1_web_session['provider_url']  = 'unknown'
-      j1_web_session['permissions']   = 'unknown'
-      j1_web_session['authenticated'] = 'false'
-      j1_web_session['writer']        = 'middleware'
+      j1_web_session['user_name']       = 'unknown'
+      j1_web_session['user_id']         = 'unknown'
+      j1_web_session['users_allowed']   = 'unknown'
+      j1_web_session['payment_status']  = 'unknown'
+      j1_web_session['provider']        = 'unknown'
+      j1_web_session['provider_url']    = 'unknown'
+      j1_web_session['permissions']     = 'unknown'
+      j1_web_session['authenticated']   = 'false'
+      j1_web_session['writer']          = 'middleware'
 
       # write updated J1 session data to cookie
       #
+      log_info! 'API', 'Exception Handler', 'ERROR', 'Access Denied'
+      session_json = j1_web_session.to_json
+      log_info! 'Exception Handler', 'Cookie', 'Write web session data' # "#{session_json}"
+
+      session_encoded = Base64.encode64(session_json)
+      response.set_cookie(
+          'j1.web.session',
+          domain: false,
+          value: session_encoded.to_s,
+          path: '/'
+      )
 
-      log_info! "AccessControl", 'RestApi', 'Exception', 'Access Denied'
+      log_info! 'Exception Handler', 'Redirect', 'Pass to error page', "Access Denied"
 
+      # Capitalize first char
+      provider  =  provider.sub(/^./, &:upcase)
+      route     = '/'
+
+      @route                  = route
+      @provider               = provider
+      @modal                  = "centralModalInfo"
+      @info_type              = "danger"
+      @modal_icon             = "account-off"
+      @modal_ok_text          = "Ok, understood"
+      @modal_title            = "Authentication Manager"
+      @modal_description      = "<h4>#{description_title}</h4></br></br> User <b>#{user}</b> from provider <b>#{provider}</b> is not allowed to access <b>#{category}</b> pages."
+
+      erb :auth_manager_ui
+    end
+    # END get '/access_denied'
+    # --------------------------------------------------------------------------
+
+
+    # Exception ENDPOINT called from the app (auth manager)
+    # --------------------------------------------------------------------------
+    get '/invalid_funds' do
+      provider          = params.fetch('provider')
+      category          = params.fetch('category')
+      user              = params.fetch('user')
+      description_title = params.fetch('title')
+
+      log_info! 'API', 'Exception', 'Invalid Funds'
+
+      session_encoded = request.cookies['j1.web.session']
+      session_decoded = Base64.decode64(session_encoded)
+      j1_web_session  = JSON.parse(session_decoded)
+
+      # Update J1 web session data
+      # --------------------------------------------------------------------
+      j1_web_session['user_name']       = 'unknown'
+      j1_web_session['user_id']         = 'unknown'
+      j1_web_session['users_allowed']   = 'unknown'
+      j1_web_session['payment_status']  = 'unknown'
+      j1_web_session['provider']        = 'unknown'
+      j1_web_session['provider_url']    = 'unknown'
+      j1_web_session['permissions']     = 'unknown'
+      j1_web_session['authenticated']   = 'false'
+      j1_web_session['writer']          = 'middleware'
+
+      # write updated J1 session data to cookie
+      #
+      log_info! 'API', 'Exception Handler', 'ERROR', 'Invalid Funds'
       session_json = j1_web_session.to_json
-      log_info! "AccessControl", 'RestApi', 'Write J1 web session data to cookie' # "#{session_json}"
+      log_info! 'Exception Handler', 'Cookie', 'Write web session data' # "#{session_json}"
 
       session_encoded = Base64.encode64(session_json)
       response.set_cookie(
@@ -898,10 +1081,11 @@ module J1App
           path: '/'
       )
 
-      route = '/'
+      log_info! 'Exception Handler', 'Redirect', 'Pass to error page', 'Invalid Funds'
 
       # Capitalize first char
-      provider                =  provider.sub(/^./, &:upcase) 
+      provider  =  provider.sub(/^./, &:upcase)
+      route     = '/'
 
       @route                  = route
       @provider               = provider
@@ -910,29 +1094,40 @@ module J1App
       @modal_icon             = "account-off"
       @modal_ok_text          = "Ok, understood"
       @modal_title            = "Authentication Manager"
-      @modal_description      = "<h4>Access denied</h4></br></br> User <b>#{user}</b> from provider <b>#{provider}</b> is not allowed to access <b>#{category}</b> pages."
+      @modal_description      = "<h4>#{description_title}</h4></br></br> User <b>#{user}</b> from provider <b>#{provider}</b> is not allowed to access <b>#{category}</b> pages."
 
       erb :auth_manager_ui
     end
+    # END get /invalid_funds
+    # --------------------------------------------------------------------------
+
 
     # access_protected_content ENDPOINT called from the app (auth manager)
     # --------------------------------------------------------------------------
     get '/access_protected_content' do
-
-      provider        =  params.fetch('provider')    
+      provider        =  params.fetch('provider')
       allowed_users   =  params.fetch('allowed_users')
       page            =  params.fetch('page')
       category        =  params.fetch('category')
 
+      log_info! 'API', 'PageAccessControl', 'Page Access Request detected'
+
       # Capitalize first char
-      # provider        =  provider.sub(/^./, &:upcase) 
+      # provider        =  provider.sub(/^./, &:upcase)
 
+      log_info! 'PageAccessControl', 'AuthCheck', 'Check authentication for provider', "#{provider}"
+      # jadams, 2019-03-16: Hier ist das Problem
+      #
       if warden.authenticated?
+        log_info! 'PageAccessControl', 'AuthCheck', 'Grant access for provider', "#{provider}"
+        log_info! 'PageAccessControl', 'Redirect', 'Pass to page', "#{page}"
         route = page
       else
+        log_info! 'PageAccessControl', 'AuthCheck', 'Authentication failed for provider', "#{provider}"
         route = "/authentication?request=signin&provider=#{provider}&allowed_users=#{allowed_users}"
       end
 
+      log_info! 'PageAccessControl', 'Redirect', 'Pass to SignIn dialog for page', "#{page}"
       # Capitalize first char
       provider                =  provider.sub(/^./, &:upcase)
 
@@ -948,11 +1143,22 @@ module J1App
 
       erb :auth_manager_ui
     end
+    # END get '/access_protected_content'
+    # --------------------------------------------------------------------------
+
 
     get '/iframe' do
       @website_url = "https://jekyll-one.github.io/"
       erb :iframe
     end
 
+    # Workaround to rescue OmniAuth::Strategies::OAuth2::CallbackError?
+    # for chromium based browsers (e.g. google-chrome)
+    # ------------------------------------------------------------------------
+    get '/redirect_requested_page' do
+      log_info! 'Fallback', 'Redirect', 'Pass to requested page', "#{j1_web_session['requested_page']}"
+      redirect j1_web_session['requested_page']
+    end
+
   end
 end