quo_vadis 1.1.0 → 1.1.1

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 # CHANGELOG
 
+
+## 1.1.1 (18 October 2011)
+
+* Only change password when a non-blank value is given.
+* Add `authenticated?` helper method.
+
+
 ## 1.1.0 (7 October 2011)
 
 * Correctly handle blank username in password reset.

data/README.md

@@ -64,7 +64,7 @@ You have to write the view yourself because you'd inevitably want to change what
 
 Remember to serve your sign in form over HTTPS -- to avoid [the credentials being stolen](http://blog.jgc.org/2011/01/code-injected-to-steal-passwords-in.html).
 
-In your layout, use `current_user` to retrieve the signed-in user; and `sign_in_path`, `sign_out_path`, and `forgotten_sign_in_path` as appropriate.
+In your layout, use `current_user` to retrieve the signed-in user; and `sign_in_path`, `sign_out_path`, and `forgotten_sign_in_path` as appropriate.  You can also use `authenticated?`.
 
 
 ## Forgotten Password

data/app/controllers/controller_mixin.rb

@@ -1,6 +1,6 @@
 module ControllerMixin
   def self.included(base)
-    base.helper_method :"current_#{QuoVadis.model_instance_name}"
+    base.helper_method :"current_#{QuoVadis.model_instance_name}", :authenticated?
   end
 
   protected
@@ -13,6 +13,11 @@ module ControllerMixin
   private
 
   class_eval <<-END, __FILE__, __LINE__ + 1
+    # Returns `true` if we have an authenticated user, `false` otherwise.
+    def authenticated?
+      !!current_#{QuoVadis.model_instance_name}
+    end
+
     # Remembers the authenticated <tt>user</tt> (in this session and future sessions).
     #
     # If you want to sign in a <tt>user</tt> you have just created, call <tt>sign_in</tt>
@@ -30,7 +35,7 @@ module ControllerMixin
     # Does nothing if we already have an authenticated user.  If we don't have an
     # authenticated user, it stores the desired URL and redirects to the sign in URL.
     def authenticate
-      unless current_#{QuoVadis.model_instance_name}
+      unless authenticated?
         session[:quo_vadis_original_url] = request.fullpath
         flash[:notice] = t('quo_vadis.flash.sign_in.before') unless t('quo_vadis.flash.sign_in.before').blank?
         redirect_to sign_in_url

data/app/controllers/quo_vadis/sessions_controller.rb

@@ -66,11 +66,15 @@ class QuoVadis::SessionsController < ApplicationController
   # PUT change_password_path /sign-in/change-password/:token
   def update
     if (user = QuoVadis.model_class.valid_token(params[:token]).first)
-      user.password = params[:password]
-      if user.save
-        user.clear_token
-        flash_if_present :notice, 'quo_vadis.flash.forgotten.password_changed'
-        sign_in user
+      if params[:password].present?
+        user.password = params[:password]
+        if user.save
+          user.clear_token
+          flash_if_present :notice, 'quo_vadis.flash.forgotten.password_changed'
+          sign_in user
+        else
+          render 'sessions/edit'
+        end
       else
         render 'sessions/edit'
       end

data/app/models/model_mixin.rb

@@ -10,6 +10,9 @@ module ModelMixin
     # Adds methods to set and authenticate against a password stored encrypted by BCrypt.
     # Also adds methods to generate and clear a token, used to retrieve the record of a
     # user who has forgotten their password.
+    #
+    # Note that if a password isn't supplied when creating a user, the error will be on
+    # the `password_digest` attribute.
     def authenticates
       send :include, InstanceMethodsOnActivation
 
@@ -17,7 +20,6 @@ module ModelMixin
       attr_protected :password_digest
 
       validates :username,        :presence => true, :uniqueness => true, :if => :should_authenticate?
-      validates :password,        :presence => true, :if => Proc.new { |u| u.should_authenticate? && u.changed.include?('password_digest') }
       validates :password_digest, :presence => true, :if => :should_authenticate?
 
       scope :valid_token, lambda { |token| where("token = ? AND token_created_at > ?", token, 3.hours.ago) }
@@ -54,7 +56,9 @@ module ModelMixin
 
     def password=(plain_text_password) # :nodoc:
       @password = plain_text_password
-      self.password_digest = BCrypt::Password.create plain_text_password
+      unless @password.blank?
+        self.password_digest = BCrypt::Password.create plain_text_password
+      end
     end
 
     # Generates a unique, timestamped token which can be used in URLs, and

data/lib/quo_vadis/version.rb

@@ -1,3 +1,3 @@
 module QuoVadis
-  VERSION = '1.1.0'
+  VERSION = '1.1.1'
 end

data/test/dummy/app/views/layouts/application.html.erb

@@ -9,17 +9,16 @@
 <body>
 
   <div id='topnav'>
-    <% if defined?(current_user) && current_user %>
-      You are signed in as <%= current_user.name %>.
+    <% if authenticated? %>
+      You are signed in as
+      <% if defined?(current_user) %>
+        <%= current_user.name %>.
+      <% elsif defined?(current_person) %>
+        <%= current_person.name %>.
+      <% end %>
       <%= link_to 'Sign out', sign_out_path %>
-
-    <% elsif defined?(current_person) && current_person %>
-      You are signed in as <%= current_person.name %>.
-      <%= link_to 'Sign out', sign_out_path %>
-
     <% else %>
       <%= link_to 'Sign in', sign_in_path %>
-
     <% end %>
   </div>
 

data/test/integration/forgotten_test.rb

@@ -53,7 +53,7 @@ class ForgottenTest < ActiveSupport::IntegrationCase
   test 'user can follow emailed link while valid to change password' do
     user_factory 'Bob', 'bob', 'secret', 'bob@example.com'
     submit_forgotten_details 'bob'
-    
+
     link_in_email = ActionMailer::Base.deliveries.last.encoded[%r{http://.*}].strip
     visit link_in_email
     fill_in :password, :with => 'topsecret'
@@ -69,7 +69,7 @@ class ForgottenTest < ActiveSupport::IntegrationCase
   test 'user cannot change password to an invalid one' do
     user_factory 'Bob', 'bob', 'secret', 'bob@example.com'
     submit_forgotten_details 'bob'
-    
+
     link_in_email = ActionMailer::Base.deliveries.last.encoded[%r{http://.*}].strip
     visit link_in_email
     fill_in :password, :with => ''
@@ -81,7 +81,7 @@ class ForgottenTest < ActiveSupport::IntegrationCase
     user_factory 'Bob', 'bob', 'secret', 'bob@example.com'
     submit_forgotten_details 'bob'
     User.last.update_attributes :token_created_at => 1.day.ago
-    
+
     link_in_email = ActionMailer::Base.deliveries.last.encoded[%r{http://.*}].strip
     visit link_in_email
     assert_equal forgotten_sign_in_path, current_path

data/test/unit/user_test.rb

@@ -2,10 +2,15 @@ require 'test_helper'
 
 class UserTest < ActiveSupport::TestCase
 
+  test 'user must have a unique username' do
+    User.create :username => 'bob', :password => 'secret'
+    assert User.new(:username => 'bob', :password => 'secret').invalid?
+  end
+
   test 'user must have a valid password on create' do
-    assert !User.create(:username => 'bob', :password => nil).valid?
-    assert !User.create(:username => 'bob', :password => '').valid?
-    assert  User.create(:username => 'bob', :password => 'secret').valid?
+    assert User.create(:username => 'bob', :password => nil).invalid?
+    assert User.create(:username => 'bob', :password => '').invalid?
+    assert User.create(:username => 'bob', :password => 'secret').valid?
   end
 
   test 'user need not supply password when updating other attributes' do
@@ -13,13 +18,14 @@ class UserTest < ActiveSupport::TestCase
     user = User.last  # reload from database so password is nil
     assert_nil user.password
     assert user.update_attributes(:username => 'Robert')
+    assert user.update_attributes(:username => 'Robert', :password => nil)
+    assert user.update_attributes(:username => 'Robert', :password => '')
+    assert User.last.has_matching_password?('secret')
   end
 
   test 'user must have a valid password when updating password' do
     user = User.create :username => 'bob', :password => 'secret'
-    assert !user.update_attributes(:password => '')
-    assert !user.update_attributes(:password => nil)
-    assert  user.update_attributes(:password => 'topsecret')
+    assert user.update_attributes(:password => 'topsecret')
   end
 
   test 'has_matching_password?' do
@@ -36,7 +42,7 @@ class UserTest < ActiveSupport::TestCase
       end
     END
     user.username = 'bob'
-    assert !user.valid?
+    assert user.invalid?
 
     user.username = 'robert'
     assert user.valid?

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: quo_vadis
 version: !ruby/object:Gem::Version 
-  hash: 19
+  hash: 17
   prerelease: 
   segments: 
   - 1
   - 1
-  - 0
-  version: 1.1.0
+  - 1
+  version: 1.1.1
 platform: ruby
 authors: 
 - Andy Stewart
@@ -15,7 +15,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-10-07 00:00:00 +02:00
+date: 2011-10-18 00:00:00 +02:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency