raffle_v1 0.0.5 → 1.0.4

data/app/controllers/raffle_v1/admin/base_controller.rb

@@ -0,0 +1,11 @@
+module RaffleV1
+	class Admin::BaseController < ApplicationController
+	  before_filter :require_admin!
+	  
+	  def index
+	    @last_signups = User.last_signups(10)
+	    @last_signins = User.last_signins(10)
+	    @count = User.users_count 
+	  end
+	end
+end

data/app/controllers/raffle_v1/admin/users_controller.rb

@@ -0,0 +1,69 @@
+module RaffleV1  
+  class Admin::UsersController < Admin::BaseController
+    before_action :set_user, only: [
+      :show,
+      :edit,
+      :update,
+      :destroy
+    ]
+    
+
+    def index
+      @users = User.search_and_order(params[:search], params[:page])
+    end
+    
+    def show
+      redirect_to edit_admin_user_path(params[:id])
+    end
+    
+    def edit
+    end
+    
+    def update
+      old_username = @user.username
+      new_params = user_params.dup
+      new_params[:username] = new_params[:username].strip
+      new_params[:email] = new_params[:email].strip
+      
+      @user.username = new_params[:username]
+      @user.email = new_params[:email]
+      @user.password = new_params[:password] if new_params[:password].strip.length > 0
+      @user.password_confirmation = new_params[:password_confirmation] if new_params[:password_confirmation].strip.length > 0
+      
+      if current_user.id != @user.id
+        @user.admin = new_params[:admin]=="0" ? false : true
+        @user.locked = new_params[:locked]=="0" ? false : true
+      end
+      
+      if @user.valid?
+        @user.skip_reconfirmation!
+        @user.save
+        redirect_to admin_users_path, notice: "#{@user.username} updated."
+      else
+        flash[:alert] = "#{old_username} couldn't be updated."
+        render :edit
+      end
+    end
+    
+    
+    private 
+    
+    def set_user
+      @user = User.friendly.find(params[:id])
+    rescue
+      flash[:alert] = "The user with an id of #{params[:id]} doesn't exist."
+      redirect_to admin_users_path
+    end
+    
+    def user_params
+      params.require(:user).permit(
+      :username,
+      :email,
+      :password,
+      :password_confirmation,
+      :admin,
+      :locked
+      )
+    end
+  end
+end

data/app/controllers/raffle_v1/application_controller.rb

@@ -1,84 +1,57 @@
-  require "cancan"
-  require "ransack"
-
 module RaffleV1
   class ApplicationController < ActionController::Base
-    protect_from_forgery
-    before_filter :authenticate_any!, unless: :stylesheet_controller?
-    check_authorization :unless => :devise_controller?
-    helper :all
-
-    def authenticate_any!
-      if admin_signed_in?
-        true
-      else
-        authenticate_user!
-      end
-    end
-
-    rescue_from CanCan::AccessDenied do |exception|
-      if user_signed_in? && current_user.requires_action_before_login? && !authenticated_by_proxy?
-        redirect_to user_required_actions_index_path, :alert => exception.message
-      else
-        redirect_to root_url, :alert => exception.message
-      end
-    end
-
-    def t(key, options = {})
-      if (val = super) =~ /translation missing/
-        return key
-      end
-
-      val
-    end
-
-    def authenticate_by_proxy(authenticate = true)
-      session[:proxy_auth] = authenticate
-    end
-
-    def authenticated_by_proxy?
-      session[:proxy_auth] || false
-    end
-
-    private
-
-    def current_ability
-      @current_ability ||= case
-        when current_admin || current_user.class.name == "Admin"
-          AdminAbility.new(current_admin || current_user, @current_program)
-        when current_user
-          UserAbility.new(current_user, authenticated_by_proxy?)
-          # AdminAbility.new(current_user, @current_program)
-        else
-          GuestAbility.new
-        end
-    end
-
-    def user_for_paper_trail
-      if user_signed_in? || admin_signed_in?
-        user = admin_signed_in? ? current_admin.email : current_user.email
-      else
-        user = "Guest"
-      end
-    end
-
-    def ckeditor_filebrowser_scope(options = {})
-      if @current_program
-        super({ :program_id => @current_program.id}.merge(options))
-      end
-    end
-
-    def after_sign_out_path_for(resource_or_scope)
-      if admin_signed_in?
-        admin_session_path
-      else
-        user_session_path
-      end
+  	  # Prevent CSRF attacks by raising an exception.
+  # For APIs, you may want to use :null_session instead.
+  protect_from_forgery with: :exception
+  
+  before_filter :configure_permitted_parameters, if: :devise_controller?
+  before_filter :reject_locked!, if: :devise_controller?
+  
+
+  # Devise permitted params
+  def configure_permitted_parameters
+    devise_parameter_sanitizer.for(:sign_up) { |u| u.permit(
+      :username, 
+      :email, 
+      :password, 
+      :password_confirmation) 
+    }
+    devise_parameter_sanitizer.for(:account_update) { |u| u.permit(
+      :username, 
+      :email, 
+      :password, 
+      :password_confirmation,
+      :current_password
+      ) 
+    }
+  end
+  
+  # Redirects on successful sign in
+  def after_sign_in_path_for(resource)
+    inside_path
+  end
+  
+  # Auto-sign out locked users
+  def reject_locked!
+    if current_user && current_user.locked?
+      sign_out current_user
+      user_session = nil
+      current_user = nil
+      flash[:alert] = "Your account is locked."
+      flash[:notice] = nil
+      redirect_to root_url
     end
-
-    def stylesheet_controller?
-      is_a?(StylesheetsController)
+  end
+  helper_method :reject_locked!
+  
+  # Only permits admin users
+  def require_admin!
+    authenticate_user!
+    
+    if current_user && !current_user.admin?
+      redirect_to root_path
     end
-
+  end
+  helper_method :require_admin!
   end
 end

data/app/controllers/raffle_v1/pages_controller.rb

@@ -1,180 +1,13 @@
-require_dependency "raffle_v1/application_controller"
-
 module RaffleV1
-  class PagesController < ApplicationController
-    load_and_authorize_resource
-
-    def index
-      if !params[:page_filter].nil? && !params[:page_filter][:type].empty?
-        @pages = @current_program.pages.where("page_type = ?", params[:page_filter][:type])
-      else  
-        @pages = @current_program.pages.all
-      end
-
-      respond_to do |format|
-        format.html # index.html.erb
-        format.json { render json: @pages }
-      end
-    end
-
-    def show
-      @page = Page.find(params[:id])
-      
-      respond_to do |format|
-        format.html # show.html.erb
-        format.json { render json: @page }
-      end
-    end
-
-    def new
-      @page = Page.new
-
-      respond_to do |format|
-        format.html # new.html.erb
-        format.json { render json: @page }
-      end
-    end
-
-    def edit
-      @page = Page.find(params[:id])
-      @status = @page.item_status
-      @header = @page.header
-      @footer = @page.footer
-      @nav = @page.nav
-      @type = @page.page_type
-    end
-
-    def create
-      @page = Page.new(params[:page])
-      @page.program_id = @current_program.id
-
-      preDefined = @current_program.pages.where(page_type: "Pre-Defined").first
-      if params[:page][:page_type] == "Pre-Defined" && preDefined.present?
-        flash[:notice] = "Pre-Defined page already exist."
-        render :new
-        return
-      end
-
-      if params[:preview_button] || !@page.save
-        render :action => 'new'
-        return
-      end
-
-
-      if @page.item_status == 'archive'
-        @page.archived = true
-      end
-
-      params[:page][:translations_attributes].each do |t|
-        t = t[1]
-        doc = Nokogiri::HTML(t[:body])
-        doc.xpath("//text()").remove
-        t[:body] = doc.to_s
-      end
-
-      respond_to do |format|
-        if @page.save
-          save_reach @page
-          if params[:button] == 'save_and_continue'
-            format.html { redirect_to edit_page_path(@page), notice: "Page was successfully created." }
-          else
-            format.html { redirect_to @page, notice: 'Page was successfully created.' }
-          end
-
-          format.json { render json: @page, status: :created, location: @page }
-        else
-          format.html { render action: "new" }
-          format.json { render json: @page.errors, status: :unprocessable_entity }
-        end
-      end
-    end
-
-    def update
-      @page = Page.find(params[:id])
-
-      if params[:page][:item_status] == 'archived'
-        @page.archived = true
-      end
-
-      respond_to do |format|
-        if @page.update_attributes(params[:page])
-          save_reach @page
-          if params[:button] == 'save_and_continue'
-            format.html { redirect_to edit_page_path(@page), notice: "Page was successfully created." }
-          else
-            format.html { redirect_to @page, notice: 'Page was successfully created.' }
-          end
-          format.json { head :no_content }
-        else
-          format.html { render action: "edit" }
-          format.json { render json: @page.errors, status: :unprocessable_entity }
-        end
-      end
-    end
-
-    def destroy
-      @page = Page.find(params[:id])
-      @page.destroy
-
-      respond_to do |format|
-        format.html { redirect_to pages_url }
-        format.json { head :no_content }
-      end
-    end
-
-    def action
-      if params[:button] == 'archive' && params[:page_ids]
-        archive
-      elsif params[:button] == 'publish' && params[:page_ids]
-        publish
-      elsif params[:button] == 'draft' && params[:page_ids]
-        draft
-      elsif params[:button] == 'remove' && params[:page_ids]
-        remove
-      else
-        redirect_to pages_url#, flash: "Article must be selected."
-      end
-    end
-
-    def publish
-      @pages = Page.find(params[:page_ids])
-      @pages.each do |a|
-        a.update_attributes(publish_date: Date.today, archived: false, item_status: "active", expiration_date: Date.today + 5.days)
-      end
-      redirect_to pages_url#, flash: "pages published."
-    end
-
-    def archive
-      @pages = Page.find(params[:page_ids])
-      @pages.each do |a|
-        a.update_attributes(archived: true, item_status: 'archive')
-      end
-      redirect_to pages_url
-    end
-
-    def draft
-      @pages = Page.find(params[:page_ids])
-      @pages.each do |a|
-        a.update_attributes(item_status: 'draft')
-      end
-      redirect_to pages_url
-    end
-
-    def remove
-      @pages = Page.find(params[:page_ids])
-      @pages.each do |a|
-        a.destroy
-      end
-
-      respond_to do |format|
-        format.html { redirect_to pages_url }
-        format.json { head :no_content }
-      end
-    end
-
-    def find_page_info
-      page = Page.find(params[:page_id])
-      render json: { title: page.translation_for(I18n.locale).title, body: page.translation_for(I18n.locale).body }
-    end
-  end
+	class PagesController < ApplicationController
+	  before_action :authenticate_user!, only: [
+	    :inside
+	  ]
+
+	  def home
+	  end
+	  
+	  def inside
+	  end   
+	end
 end

data/app/helpers/raffle_v1/application_helper.rb

@@ -1,4 +1,9 @@
 module RaffleV1
   module ApplicationHelper
+	  def title(value)
+	    unless value.nil?
+	      @title = "#{value} | RaffleV1"      
+	    end
+	  end
   end
 end

data/app/models/raffle_v1/user.rb

@@ -1,108 +1,62 @@
-module RaffleV1
-  class User < ActiveRecord::Base
-
-    STATUSES = ["active", "terminated"]
-    # Include default devise modules. Others available are:
-    devise :database_authenticatable,
-      :recoverable, :rememberable, :trackable, 
-      :token_authenticatable, :lockable, :authentication_keys => [:username, :program_id],
-      :lock_strategy => :failed_attempts, :unlock_strategy => :time, 
-      :maximum_attempts => 1000, :unlock_in => 1000 # These are ignored and overridden by the attempts_exceeded? and lock_expired?
-
-    # Setup accessible (or protected) attributes for the user model
-    attr_accessible :email, :password, :password_confirmation, :remember_me, :first_name, :last_name, :middle_initial, :suffix, 
-                    :work_email, :employee_number, :employee_id, :work_address, :work_city, :work_state, :work_postal, :work_county, :home_address, :home_city,:home_state,
-                    :home_postal,:home_county, :work_phone,:home_phone, :department_code, :department_name, :cost_center_cost, :user_name, 
-                    :job_title, :date_of_hire, :date_of_rehire, :date_of_birth, :preferred_language, :user_type, :employment_type, :vip_flag, :time_offset, :date_of_terminate, :manager_id, 
-                    :hierarchy_node, :hierarchy_node_id
-
-    default_scope where(:deleted_at => nil)
-
-    belongs_to :program
-
-    has_many :belongs_to_user_relationships, class_name: "UserRelationship", foreign_key: "user_id"
-    has_many :has_many_user_relationships, class_name: "UserRelationship", foreign_key: "related_user_id"
-
-    before_validation :generate_password_for_new_user
-
-    validates :username, :employee_id,  :presence => true
-    validates_confirmation_of :password, unless: Proc.new{|u| u.is_temporary_password == true or u.deleted_at != nil}
-    validates :date_of_birth, date: { before: Date.today, message: "must be before #{Date.today}"}, if: Proc.new { self.date_of_birth.present? }
-    validates_presence_of :password, :if => :password_required?
-    validates_confirmation_of :password, :if => :password_required?
-    validates_length_of :password, :within => Devise.password_length, :allow_blank => true
-
-    validate :password, presence: true, unless: Proc.new {|u| u.is_temporary_password == true or u.deleted_at != nil}
-    validate :custom_password_strength, unless: Proc.new { |u| u.deleted_at != nil}
-    validate :unique_usernames, on: :create
-
-    def generate_password_for_new_user
-      if password.nil? and self.new_record?
-        self.password = SecureRadom.hex(8) + "!&4$"
-        self.password_created_at = Time.now
-        self.is_temporary_password = true
-      end
-    end
-
-    def reset_password_token_and_notify host = nil
-      self.password = User.reset_password_token
-      self.reset_password_sent_at = User.reset_password_token
-      self.reset_password_sent_at = Time.now
-      self.save
-      puts UserMailer.reset_password(self, host).deliver
-    end
-
-    def custom_password_strength
-      if self.password.present? && self.encrypted_password_changed?
-        program = Program.find(self.program.id)
-        strength = PasswordStrength.test(self.username, self.password)
-        unless strength.valid?(program.password_strength.to_sym)
-          is_valid = false
-          self.errors.add(:password, "is not secure. Password must be #{program.password_strength.to_sym}")
-        end
-      end
+require 'kaminari'
+require 'friendly_id'
 
-      is_valid
-    end
-
-    def self.generate_random_password
-      start_length = 10
-      token = ""
-
-      #loop over token generation untill we get something matching our desired length
-      #the reason we loop is so that we can confidently filter our barred characters
-      #while resorting the gaps with the new random characters
-      while token.length < start_length
-        token << Devise.friendly_token.first(start_length)
-        token.gsub!(/[iIlLoO10]/, "")
-      end
-      #slice incase the string became too long
-      token = token[0, start_length]
-
-      #need to add special chars into the string
-      random = Random.new
-
-      token.insert(random.rand(0..token.length), "@")
-      token.insert(random.rand(0..token.length), "!")
-
-      token
-    end
-
-    def fullname
-      "#{self.first_name} #{self.last_name}"
-    end
-
-    def full_home_phone_number
-      "(#{home_telephone_country_code}) #{home_telephone_area_code}-#{home_telephone_number}"
-    end
-
-    def full_home_address
-      "#{home_address}\n #{home_city}, #{home_state}"
-    end
-
-    def active?
-      self.date_of_termination.blank? || self.date_of_termination < Date.new
-    end
-
-  end
-end
+module RaffleV1
+	class User < ActiveRecord::Base
+	  # Use friendly_id on Users
+	  extend FriendlyId
+	  friendly_id :friendify, use: :slugged
+	  
+	  # necessary to override friendly_id reserved words
+	  def friendify
+	    if username.downcase == "admin"
+	      "user-#{username}"
+	    else
+	      "#{username}"
+	    end
+	  end
+	  
+	  # Include default devise modules. Others available are:
+	  # :confirmable, :lockable, :timeoutable and :omniauthable
+	  devise :database_authenticatable, :registerable,
+	         :recoverable, :rememberable, :trackable, :validatable, :confirmable
+	         
+	  # Pagination
+	  paginates_per 100
+	  
+	  # Validations
+	  # :username
+	  validates :username, uniqueness: { case_sensitive: false }
+	  validates_format_of :username, with: /\A[a-zA-Z0-9]*\z/, on: :create, message: "can only contain letters and digits"
+	  validates :username, length: { in: 4..10 }
+	  # :email
+	  validates_format_of :email, with: /\A([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})\Z/i
+	  
+	  def self.paged(page_number)
+	    order(admin: :desc, username: :asc).page page_number
+	  end
+	  
+	  def self.search_and_order(search, page_number)
+	    if search
+	      where("username LIKE ?", "%#{search.downcase}%").order(
+	      admin: :desc, username: :asc
+	      ).page page_number
+	    else
+	      order(admin: :desc, username: :asc).page page_number
+	    end
+	  end
+	  
+	  def self.last_signups(count)
+	    order(created_at: :desc).limit(count).select("id","username","slug","created_at")
+	  end
+	  
+	  def self.last_signins(count)
+	    order(last_sign_in_at: 
+	    :desc).limit(count).select("id","username","slug","last_sign_in_at")
+	  end
+	  
+	  def self.users_count
+	    where("admin = ? AND locked = ?",false,false).count
+	  end
+	end
+end