refinerycms-authentication 2.0.4 → 2.0.5

data/app/models/refinery/user.rb

@@ -13,7 +13,8 @@ module Refinery
     # Include default devise modules. Others available are:
     # :token_authenticatable, :confirmable, :lockable and :timeoutable
     if self.respond_to?(:devise)
-      devise :database_authenticatable, :registerable, :recoverable, :rememberable, :trackable, :validatable, :authentication_keys => [:login]
+      devise :database_authenticatable, :registerable, :recoverable, :rememberable,
+             :trackable, :validatable, :authentication_keys => [:login]
     end
 
     # Setup accessible (or protected) attributes for your model
@@ -23,6 +24,7 @@ module Refinery
     attr_accessible :email, :password, :password_confirmation, :remember_me, :username, :plugins, :login
 
     validates :username, :presence => true, :uniqueness => true
+    before_validation :downcase_username
 
     class << self
       # Find user by email or username.
@@ -77,7 +79,7 @@ module Refinery
         save
         # add refinery role
         add_role(:refinery)
-        # add superuser role
+        # add superuser role if there are no other users
         add_role(:superuser) if ::Refinery::Role[:refinery].users.count == 1
         # add plugins
         self.plugins = Refinery::Plugins.registered.in_menu.names
@@ -95,5 +97,13 @@ module Refinery
       to_s.parameterize
     end
 
+    private
+    # To ensure uniqueness without case sensitivity we first downcase the username.
+    # We do this here and not in SQL is that it will otherwise bypass indexes using LOWER:
+    # SELECT 1 FROM "refinery_users" WHERE LOWER("refinery_users"."username") = LOWER('UsErNAME') LIMIT 1
+    def downcase_username
+      self.username = self.username.downcase if self.username?
+    end
+
   end
 end

data/lib/refinery/authenticated_system.rb

@@ -7,19 +7,48 @@ module Refinery
       session[:return_to] = request.fullpath.sub("//", "/")
     end
 
+    # Clear and return the stored location
+    def pop_stored_location
+      session.delete(:return_to)
+    end
+
     # Redirect to the URI stored by the most recent store_location call or
     # to the passed default.
     def redirect_back_or_default(default)
-      redirect_to(session[:return_to] || default)
-      session[:return_to] = nil
+      redirect_to(pop_stored_location || default)
+    end
+
+    # This defines the devise method for refinery routes
+    def signed_in_root_path(resource_or_scope)
+      scope = Devise::Mapping.find_scope!(resource_or_scope)
+      home_path = "#{scope}_root_path"
+      if respond_to?(home_path, true)
+        refinery.send(home_path)
+      elsif respond_to?(:admin_root_path)
+        refinery.admin_root_path
+      else
+        "/"
+      end
+    end
+
+    # Pops the stored url, trims the sneaky "//" from it, and returns it.
+    #
+    # Making sure bad urls aren't stored in the first place should probably be
+    # a part of the Devise::FailureApp
+    def sanitized_stored_location_for(resource_or_scope)
+      # `stored_location_for` is the devise method that pops the
+      # scoped `return_to` key
+      location = stored_location_for(resource_or_scope)
+      location.sub!("//", "/") if location.respond_to?(:sub!)
+      location
     end
 
     # This just defines the devise method for after sign in to support
     # extension namespace isolation...
     def after_sign_in_path_for(resource_or_scope)
-      scope = Devise::Mapping.find_scope!(resource_or_scope)
-      home_path = "#{scope}_root_path"
-      respond_to?(home_path, true) ? refinery.send(home_path) : refinery.admin_root_path
+      pop_stored_location ||
+      sanitized_stored_location_for(resource_or_scope) ||
+      signed_in_root_path(resource_or_scope)
     end
 
     def after_sign_out_path_for(resource_or_scope)
@@ -30,7 +59,8 @@ module Refinery
       refinery_user_signed_in? && current_refinery_user.has_role?(:refinery)
     end
 
-    protected :store_location, :redirect_back_or_default, :refinery_user?
+    protected :store_location, :pop_stored_location, :redirect_back_or_default,
+              :sanitized_stored_location_for, :refinery_user?
 
     def self.included(base)
       if base.respond_to? :helper_method

data/spec/models/refinery/user_spec.rb

@@ -68,6 +68,11 @@ module Refinery
         User.create!(attr)
         User.new(attr.merge(:email => "another@email.com")).should_not be_valid
       end
+
+      it "rejects duplicate usernames regardless of case" do
+        User.create!(attr)
+        User.new(attr.merge(:username => attr[:username].upcase, :email => "another@email.com")).should_not be_valid
+      end
     end
 
     describe ".find_for_database_authentication" do

data/spec/requests/refinery/sessions_spec.rb

@@ -2,11 +2,15 @@ require "spec_helper"
 
 module Refinery
   describe "sign in" do
+    let(:login_path) { refinery.new_refinery_user_session_path }
+    let(:login_retry_path) { refinery.refinery_user_session_path }
+    let(:admin_path) { refinery.admin_root_path }
+
     before(:each) do
       FactoryGirl.create(:refinery_user, :username => "ugisozols",
                               :password => "123456",
                               :password_confirmation => "123456")
-      visit refinery.new_refinery_user_session_path
+      visit login_path
     end
 
     it "shows login form" do
@@ -21,6 +25,7 @@ module Refinery
         fill_in "Password", :with => "123456"
         click_button "Sign in"
         page.should have_content("Signed in successfully.")
+        current_path.should == admin_path
       end
     end
 
@@ -30,6 +35,7 @@ module Refinery
         fill_in "Password", :with => "Hmmm"
         click_button "Sign in"
         page.should have_content("Sorry, your login or password was incorrect.")
+        current_path.should == login_retry_path
       end
     end
   end
@@ -59,4 +65,39 @@ module Refinery
       end
     end
   end
+
+  describe 'redirects' do
+    let(:protected_path) { refinery.new_admin_user_path }
+    let(:login_path) { refinery.new_refinery_user_session_path }
+
+    before(:each) do
+      FactoryGirl.create(:refinery_user,
+        :username => "ugisozols",
+        :password => "123456",
+        :password_confirmation => "123456"
+      )
+    end
+
+    context "when visiting a protected path" do
+      before(:each) { visit protected_path }
+
+      it "redirects to the login" do
+        current_path.should == login_path
+      end
+
+      it "shows login form" do
+        page.should have_content("Hello! Please sign in.")
+        page.should have_content("I forgot my password")
+        page.should have_selector("a[href*='/refinery/users/password/new']")
+      end
+
+      it "redirects to the protected path on login" do
+        fill_in "Login", :with => "ugisozols"
+        fill_in "Password", :with => "123456"
+        page.click_button "Sign in"
+        current_path.should == protected_path
+      end
+    end
+
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: refinerycms-authentication
 version: !ruby/object:Gem::Version
-  version: 2.0.4
+  version: 2.0.5
   prerelease: 
 platform: ruby
 authors:
@@ -13,7 +13,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-05-14 00:00:00.000000000 Z
+date: 2012-06-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: refinerycms-core
@@ -22,7 +22,7 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.0.4
+        version: 2.0.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -30,7 +30,7 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.0.4
+        version: 2.0.5
 - !ruby/object:Gem::Dependency
   name: devise
   requirement: !ruby/object:Gem::Requirement
@@ -157,7 +157,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 1393669055922669137
+      hash: -3083907870298684741
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements:
@@ -166,7 +166,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 1393669055922669137
+      hash: -3083907870298684741
 requirements: []
 rubyforge_project: refinerycms
 rubygems_version: 1.8.22