mno-enterprise-core 2.0.0

data/lib/mandrill_client.rb

@@ -0,0 +1,58 @@
+# An interface to the Mandrill API
+# Example usage:
+# MandrillClient.send_template(template_name(string), template_content(array), message(hash))
+module MandrillClient
+  class << self
+    
+    # Store the list of mandrill emails that are pending
+    # to be sent
+    # Only used for testing
+    # E.g: expect { some_action }.to change(MandrillClient.base_deliveries,:count).by(1)
+    def base_deliveries
+      @base_deliveries ||= []
+    end
+    
+    # Check whether mailers are in test mode or not
+    # Emails should not be sent in test mode
+    def test?
+      (Rails.configuration.action_mailer.delivery_method || '').to_sym == :test
+    end
+    
+    # Return a mandrill client configured with the right API key
+    def client
+      @client ||= Mandrill::API.new(MnoEnterprise.mandrill_key)
+    end
+    
+    # Send the provided template with options
+    # MandrillClient.send_template(template_name(string), template_content(array), message(hash))
+    def send_template(*args)
+      if self.test?
+        self.base_deliveries.push(args)
+      else
+        self.client.messages.send_template(*args)
+      end
+    end
+    
+    # A simpler version of send_template
+    #
+    # Take in argument:
+    #   template: name of a mandrill template
+    #   from: hash describing the sender. E.g.: { name: "John", email: "john.doe@maestrano.com" }
+    #   to: Array or hash describing the recipient. E.g.: { name: "Jack", email: "jack.doe@maestrano.com" }
+    #   vars: Mandrill email variables. E.g.: { link: "https://mywebsite.com/confirm_account" }
+    #   opts: additional parameters to pass to mandrill. See: https://mandrillapp.com/api/docs/messages.ruby.html
+    #
+    def deliver(template,from,to,vars = {},opts = {})
+      # Prepare message from args
+      message = { from_name: from[:name], from_email: from[:email]}
+      message[:to] = [to].flatten.map { |t| {name: t[:name], email: t[:email], type: (t[:type] || :to) } }
+      message[:global_merge_vars] = vars.map { |k,v| {name: k.to_s, content: v} }
+      
+      # Merge additional mandrill options
+      message.merge!(opts)
+      
+      self.send_template(template,[],message)
+    end
+  end
+  
+end

data/lib/mno-enterprise-core.rb

@@ -0,0 +1 @@
+require 'mno_enterprise/core'

data/lib/mno_enterprise/concerns.rb

@@ -0,0 +1,4 @@
+module MnoEnterprise
+  module Concerns
+  end
+end

data/lib/mno_enterprise/concerns/controllers.rb

@@ -0,0 +1,6 @@
+module MnoEnterprise
+  module Concerns
+    module Controllers
+    end
+  end
+end

data/lib/mno_enterprise/concerns/controllers/angular_csrf.rb

@@ -0,0 +1,59 @@
+# This module allow Angular to works well with Rails CSRF protection
+# It's intended for AngularJS app served outside of the Rails asset pipeline.
+# See
+#   - https://technpol.wordpress.com/2014/04/17/rails4-angularjs-csrf-and-devise/
+#   - https://technpol.wordpress.com/2014/08/22/10-adding-devise-integration-logon-and-security/
+# for more details
+module MnoEnterprise::Concerns::Controllers::AngularCSRF
+  extend ActiveSupport::Concern
+
+  #==================================================================
+  # Included methods
+  #==================================================================
+  # 'included do' causes the included code to be evaluated in the
+  # context where it is included rather than being executed in the module's context
+  included do
+    # Prevent CSRF attacks by raising an exception.
+    protect_from_forgery with: :exception
+
+    after_filter :set_csrf_cookie_for_ng
+
+    # Clean up cookies on InvalidAuthenticityRequest
+    rescue_from ActionController::InvalidAuthenticityToken do |exception|
+      cookies['XSRF-TOKEN'] = form_authenticity_token if protect_against_forgery?
+      message = 'CSRF token error, please try again'
+      render_with_protection(message.to_json, {status: :unprocessable_entity})
+    end
+
+    protected
+    def set_csrf_cookie_for_ng
+      cookies['XSRF-TOKEN'] = form_authenticity_token if protect_against_forgery?
+    end
+
+    def verified_request?
+      super || valid_authenticity_token?(session, request.headers['X-XSRF-TOKEN'])
+    end
+
+    # JSON / JSONP XSS protection
+    def render_with_protection(object, parameters = {})
+      render parameters.merge(content_type: 'application/json', text: ")]}',\n" + object.to_json)
+    end
+  end
+
+  #==================================================================
+  # Class methods
+  #==================================================================
+  module ClassMethods
+    # def some_class_method
+    #   'some text'
+    # end
+  end
+
+  #==================================================================
+  # Instance methods
+  #==================================================================
+  # GET /resource/password/new
+  # def new
+  #   super
+  # end
+end

data/lib/mno_enterprise/concerns/controllers/auth.rb

@@ -0,0 +1,9 @@
+module MnoEnterprise
+  module Concerns
+    module Controllers
+      module Auth
+      end
+    end
+  end
+end
+

data/lib/mno_enterprise/concerns/controllers/auth/confirmations_controller.rb

@@ -0,0 +1,187 @@
+module MnoEnterprise::Concerns::Controllers::Auth::ConfirmationsController
+  extend ActiveSupport::Concern
+  
+  #==================================================================
+  # Included methods
+  #==================================================================
+  # 'included do' causes the included code to be evaluated in the
+  # context where it is included rather than being executed in the module's context
+  included do
+    before_filter :signed_in_and_unconfirmed, only: [:lounge,:update]
+    
+    private
+      # Redirects unless user is signed in and not confirmed yet
+      def signed_in_and_unconfirmed
+        resource = resource_class.to_adapter.get((send(:"current_#{resource_name}") || MnoEnterprise::User.new).to_key)
+        return true if resource && !resource.confirmed?
+    
+        redirect_to mno_enterprise.myspace_path
+        return false
+      end
+  end
+  
+  #==================================================================
+  # Class methods
+  #==================================================================
+  module ClassMethods
+    # def some_class_method
+    #   'some text'
+    # end
+  end
+  
+  #==================================================================
+  # Instance methods
+  #==================================================================
+  # GET /resource/confirmation/new
+  # def new
+  #   super
+  # end
+
+  # POST /resource/confirmation
+  # def create
+  #   super
+  # end
+
+  # GET /resource/confirmation?confirmation_token=abcdef
+  # Override to display a form for the user to fill the final registration details
+  def show
+    @confirmation_token = params[:confirmation_token]
+    self.resource = resource_class.find_for_confirmation(@confirmation_token)
+    
+    # Exit if no resources
+    unless resource.errors.empty?
+      yield(:error, resource) if block_given?
+      respond_with_navigational(resource.errors, status: :unprocessable_entity){ render :new }
+      return
+    end
+    
+    # Case 1: user is confirmed but trying to confirm a new email address (change of email)
+    # Case 2: user is a new user - in this case a form is displayed with final details to fill
+    # Case 3: user is confirmed and clicking again on the link
+    if resource.confirmed?
+      resource.perform_confirmation(@confirmation_token)
+
+      if resource.errors.empty?
+        sign_in(resource)
+        set_flash_message(:notice, :confirmed) if is_flashing_format?
+        yield(:reconfirmation_success, resource) if block_given?
+        respond_with_navigational(resource){ redirect_to after_confirmation_path_for(resource_name, resource) }
+      else
+        respond_with_navigational(resource.errors, status: :unprocessable_entity){ render :new }
+      end
+      return
+    end
+    
+    # Check if phone number should be required
+    # Bypassed for invited users
+    @phone_required = resource.organizations.map(&:users).flatten.count == 1
+    yield(:success, resource) if block_given?
+  end
+  
+  # POST /resource/confirmation/finalize
+  # Confirm a new user and update 
+  def finalize
+    @confirmation_token = params[:user].delete(:confirmation_token)
+    self.resource = resource_class.find_for_confirmation(@confirmation_token)
+    
+    # Exit action and redirect if user is already confirmed
+    if resource && resource.confirmed?
+      yield(:already_confirmed, resource) if block_given?
+      redirect_to after_confirmation_path_for(resource_name, resource)
+      return
+    end
+    
+    if resource.errors.empty?
+      resource.assign_attributes(params[:user]) unless resource.confirmed?
+      resource.perform_confirmation(@confirmation_token)
+      resource.save
+      sign_in resource, bypass: true
+      set_flash_message(:notice, :confirmed) if is_flashing_format?
+      yield(:success,resource) if block_given?
+      MnoEnterprise::EventLogger.info('user_confirm', resource.id, 'User confirmed', nil, resource)
+      respond_with_navigational(resource){ redirect_to after_confirmation_path_for(resource_name, resource, new_user: true) }
+    else
+      yield(:error,resource) if block_given?
+      respond_with_navigational(resource.errors, status: :unprocessable_entity){ render :new }
+    end
+  end
+
+  # TODO: specs
+  # GET /resource/confirmation/lounge
+  def lounge
+    self.resource = @resource = resource_class.to_adapter.get!(send(:"current_#{resource_name}").to_key)
+    yield(:success,resource) if block_given?
+  end
+
+  # TODO: specs
+  # PUT /resource/confirmation
+  def update
+    self.resource = @resource = resource_class.to_adapter.get!(send(:"current_#{resource_name}").to_key)
+
+    # Redirect straight away if no changes
+    if @resource.email == params[:user][:email] 
+      @resource.resend_confirmation_instructions
+      redirect_to mno_enterprise.user_confirmation_lounge_path, notice: "The confirmation email has been resent."
+      return
+    end
+  
+    # Update email
+    previous_email = @resource.email
+    @resource.email = params[:user][:email]
+    @resource.skip_reconfirmation!
+  
+    if @resource.save
+      @resource.resend_confirmation_instructions
+      yield(:success,resource) if block_given?
+      redirect_to mno_enterprise.user_confirmation_lounge_path, notice: "'Email updated! A confirmation email has been resent."
+    else
+      # Rollback
+      #@resource.restore_email!
+      yield(resource,:error) if block_given?
+      render 'lounge'
+    end
+  end
+
+  protected
+    # The path used after resending confirmation instructions.
+    # def after_resending_confirmation_instructions_path_for(resource_name)
+    #   super(resource_name)
+    # end
+
+    # The path used after confirmation.
+    # Confirm any outstanding organization invite
+    # TODO: invite acceptance logic should be moved to the 'show' action
+    def after_confirmation_path_for(resource_name, resource, opts = {})
+      return new_user_session_path unless resource
+    
+      # 3 days is the duration of an invite.
+      if resource.created_at > 3.days.ago
+        # First auto confirm the orga invite if user has pending
+        # invites
+        # Get invites from previous_url (user was accepting invite but didn't have an account)
+        org_invites = []
+        if !session[:previous_url].blank? && (r = session[:previous_url].match(/\/org_invites\/(\d+)\?token=(\w+)/))
+          invite_params = { id: r.captures[0].to_i, token: r.captures[1] }
+          org_invites << MnoEnterprise::OrgInvite.where(invite_params).first
+        end
+
+        # Get remaining invites via email address
+        org_invites << MnoEnterprise::OrgInvite.where(user_email: resource.email).to_a
+        org_invites.flatten!
+        org_invites.uniq!
+
+        # Accept the invites
+        org_invites.each do |org_invite|
+          org_invite.accept!(resource) unless org_invite.expired?
+        end
+      end
+      
+      if MnoEnterprise.style.workflow.signup_onboarding && opts[:new_user]
+        mno_enterprise.user_setup_index_path
+      elsif opts[:new_user]
+        after_sign_in_path_for(resource)
+      else
+        signed_in_root_path(resource)
+      end
+    end
+end

data/lib/mno_enterprise/concerns/controllers/auth/passwords_controller.rb

@@ -0,0 +1,54 @@
+module MnoEnterprise::Concerns::Controllers::Auth::PasswordsController
+  extend ActiveSupport::Concern
+  
+  #==================================================================
+  # Included methods
+  #==================================================================
+  # 'included do' causes the included code to be evaluated in the
+  # context where it is included rather than being executed in the module's context
+  included do
+  end
+  
+  #==================================================================
+  # Class methods
+  #==================================================================
+  module ClassMethods
+    # def some_class_method
+    #   'some text'
+    # end
+  end
+  
+  #==================================================================
+  # Instance methods
+  #==================================================================
+  # GET /resource/password/new
+  # def new
+  #   super
+  # end
+
+  # POST /resource/password
+  # def create
+  #   super
+  # end
+
+  # GET /resource/password/edit?reset_password_token=abcdef
+  # def edit
+  #   super
+  # end
+
+  # PUT /resource/password
+  # def update
+  #   super
+  # end
+
+  # protected
+
+  # def after_resetting_password_path_for(resource)
+  #   super(resource)
+  # end
+
+  # The path used after sending reset password instructions
+  # def after_sending_reset_password_instructions_path_for(resource_name)
+  #   super(resource_name)
+  # end
+end

data/lib/mno_enterprise/concerns/controllers/auth/registrations_controller.rb

@@ -0,0 +1,136 @@
+module MnoEnterprise::Concerns::Controllers::Auth::RegistrationsController
+  extend ActiveSupport::Concern
+  
+  #==================================================================
+  # Included methods
+  #==================================================================
+  # 'included do' causes the included code to be evaluated in the
+  # context where it is included rather than being executed in the module's context
+  included do
+    before_filter :configure_sign_up_params, only: [:create]
+    # before_filter :configure_account_update_params, only: [:update]
+    
+    protected
+      def configure_sign_up_params
+        devise_parameter_sanitizer.for(:sign_up) { |u| u.permit(
+          :email, 
+          :password, 
+          :password_confirmation, 
+          :name, 
+          :surname,
+          :company,
+          :phone,
+          :phone_country_code
+        )} 
+      end
+  end
+  
+  #==================================================================
+  # Class methods
+  #==================================================================
+  module ClassMethods
+    # def some_class_method
+    #   'some text'
+    # end
+  end
+  
+  #==================================================================
+  # Instance methods
+  #==================================================================
+  # GET /resource/sign_up
+  # def new
+  #   super
+  # end
+
+  # POST /resource
+  def create
+    build_resource(sign_up_params)
+    resource.password ||= Devise.friendly_token
+    
+    resource_saved = resource.save
+    
+    if resource_saved
+      if resource.active_for_authentication?
+        set_flash_message :notice, :signed_up if is_flashing_format?
+        sign_up(resource_name, resource)
+        yield(:success,resource) if block_given?
+        respond_with resource, location: after_sign_up_path_for(resource)
+      else
+        set_flash_message :notice, :"signed_up_but_#{resource.inactive_message}" if is_flashing_format?
+        expire_data_after_sign_in!
+        yield(:success_but_inactive,resource) if block_given?
+        respond_with resource, location: after_inactive_sign_up_path_for(resource)
+      end
+    else
+      clean_up_passwords resource
+      @validatable = devise_mapping.validatable?
+      if @validatable
+        @minimum_password_length = resource_class.password_length.min
+      end
+      yield(:error,resource) if block_given?
+      respond_with resource
+    end
+  end
+
+  # GET /resource/edit
+  # def edit
+  #   super
+  # end
+
+  # PUT /resource
+  # def update
+  #   super
+  # end
+
+  # DELETE /resource
+  # def destroy
+  #   super
+  # end
+
+  # GET /resource/cancel
+  # Forces the session data which is usually expired after sign
+  # in to be expired now. This is useful if the user wants to
+  # cancel oauth signing in/up in the middle of the process,
+  # removing all OAuth session data.
+  # def cancel
+  #   super
+  # end
+
+  protected
+  
+    # You can put the params you want to permit in the empty array.
+    # def configure_account_update_params
+    #   devise_parameter_sanitizer.for(:account_update) << :attribute
+    # end
+
+    # The path used after sign up.
+    def after_sign_up_path_for(resource)
+      mno_enterprise.user_confirmation_lounge_path
+    end
+
+    # The path used after sign up for inactive accounts.
+    # def after_inactive_sign_up_path_for(resource)
+    #   super(resource)
+    # end
+  
+    def sign_up_params
+      attrs = super
+      attrs.merge(orga_on_create: create_orga_on_user_creation(attrs))
+    end
+  
+    # Check whether we should create an organization for the user
+    def create_orga_on_user_creation(user_attrs)
+      return false unless user_attrs['email']
+
+      # First check previous url to see if the user
+      # was trying to accept an orga
+      orga_invites = []
+      if !session[:previous_url].blank? && (r = session[:previous_url].match(/\/orga_invites\/(\d+)\?token=(\w+)/))
+        invite_params = { id: r.captures[0].to_i, token: r.captures[1] }
+        return false if MnoEnterprise::OrgInvite.where(invite_params).any?
+      end
+
+      # Get remaining invites via email address
+      return MnoEnterprise::OrgInvite.where(user_email: user_attrs['email']).empty?
+    end
+end