Module: Sorcery::Controller::InstanceMethods

Defined in:
lib/sorcery/controller.rb

Overview

rubocop:disable Metrics/ModuleLength

Instance Method Summary collapse

Instance Method Details

#auto_login(user, _should_remember = false) ⇒ Object

login a user instance

Parameters:

  • user (<User-Model>) —

    the user instance.

Returns:

    • do not depend on the return value.



132
133
134
135
 
# File 'lib/sorcery/controller.rb', line 132

def (user, _should_remember = false)
  session[:user_id] = user.id.to_s
  @current_user = user
end

#current_user ⇒ Object

attempts to auto-login from the sources defined (session, basic_auth, cookie, etc.) returns the logged in user if found, nil if not



89
90
91
92
 
# File 'lib/sorcery/controller.rb', line 89

def current_user
  @current_user =  ||  || nil unless defined?(@current_user)
  @current_user
end

#current_user=(user) ⇒ Object 



94
95
96
 
# File 'lib/sorcery/controller.rb', line 94

def current_user=(user)
  @current_user = user
end

#handle_unverified_request ⇒ Object

Overwrite Rails’ handle unverified request



138
139
140
141
142
 
# File 'lib/sorcery/controller.rb', line 138

def handle_unverified_request
  cookies[:remember_me_token] = nil
  @current_user = nil
  super # call the default behaviour which resets the session
end

#logged_in? ⇒ Boolean

Returns:

  • (Boolean) 


83
84
85
 
# File 'lib/sorcery/controller.rb', line 83

def logged_in?
  !!current_user
end

#login(*credentials) ⇒ Object

Takes credentials and returns a user on successful authentication. Runs hooks after login or failed login.



32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
 
# File 'lib/sorcery/controller.rb', line 32

def (*credentials)
  @current_user = nil

  user_class.authenticate(*credentials) do |user, failure_reason|
    if failure_reason
      after_failed_login!(credentials)

      yield(user, failure_reason) if block_given?

      # FIXME: Does using `break` or `return nil` change functionality?
      # rubocop:disable Lint/NonLocalExitFromIterator
      return
      # rubocop:enable Lint/NonLocalExitFromIterator
    end

    old_session = session.dup.to_hash
    reset_sorcery_session
    old_session.each_pair do |k, v|
      session[k.to_sym] = v
    end

    (user, credentials[2])
    after_login!(user, credentials)

    block_given? ? yield(current_user, nil) : current_user
  end
end

#login! ⇒ Object

Raises:



60
61
62
63
64
65
66
 
# File 'lib/sorcery/controller.rb', line 60

def login!(...)
  user = (...)

  raise Sorcery::InvalidCredentials if user.nil?

  user
end

#logout ⇒ Object

Resets the session and runs hooks before and after.



73
74
75
76
77
78
79
80
81
 
# File 'lib/sorcery/controller.rb', line 73

def logout
  return unless logged_in?

  user = current_user
  before_logout!
  @current_user = nil
  reset_sorcery_session
  after_logout!(user)
end

#not_authenticated ⇒ Object

The default action for denying non-authenticated users. You can override this method in your controllers, or provide a different method in the configuration.



124
125
126
 
# File 'lib/sorcery/controller.rb', line 124

def not_authenticated
  redirect_to root_path
end

#redirect_back_or_to ⇒ Object

used when a user tries to access a page while logged out, is asked to login, and we want to return him back to the page he originally wanted.



100
101
102
103
104
105
106
107
108
109
110
111
 
# File 'lib/sorcery/controller.rb', line 100

def redirect_back_or_to(...)
  if Config.use_redirect_back_or_to_by_rails
    super
  else
    Sorcery.deprecator.warn(
      '`redirect_back_or_to` overrides the method of the same name defined in Rails 7. ' \
      'To avoid overriding, set `config.use_redirect_back_or_to_by_rails = true` and use `redirect_to_before_login_path`. ' \
      'In a future release, `config.use_redirect_back_or_to_by_rails = true` will become the default.'
    )
    (...)
  end
end

#redirect_to_before_login_path(url, **options) ⇒ Object 



113
114
115
116
117
118
119
 
# File 'lib/sorcery/controller.rb', line 113

def (url, **options)
  allow_other_host = options[:allow_other_host].nil? ? _allow_other_host : options[:allow_other_host]
  flash = options.except(:allow_other_host)

  redirect_to(session[:return_to_url] || url, flash:, allow_other_host:)
  session[:return_to_url] = nil
end

#require_login ⇒ Object

To be used as before_action. Will trigger auto-login attempts via the call to logged_in? If all attempts to auto-login fail, the failure callback will be called.



20
21
22
23
24
25
26
27
28
 
# File 'lib/sorcery/controller.rb', line 20

def 
  return if logged_in?

  if Config.save_return_to_url && request.get? && !request.xhr? && !request.format.json?
    session[:return_to_url] = request.url
  end

  send(Config.not_authenticated_action)
end

#reset_sorcery_session ⇒ Object 



68
69
70
 
# File 'lib/sorcery/controller.rb', line 68

def reset_sorcery_session
  reset_session # protect from session fixation attacks
end