GRN-56: Correctly implemented the account verification flow (#367)
* Correctly implemented the account verification flow * Fixed issues with redirect locationsv2
farhatahmad
4 years ago
committed by
Jesus Federico
parent
5521402ee7
commit
c60e25f71c
@ -0,0 +1,76 @@ |
||||
# frozen_string_literal: true |
||||
|
||||
# BigBlueButton open source conferencing system - http://www.bigbluebutton.org/. |
||||
# |
||||
# Copyright (c) 2018 BigBlueButton Inc. and by respective authors (see below). |
||||
# |
||||
# This program is free software; you can redistribute it and/or modify it under the |
||||
# terms of the GNU Lesser General Public License as published by the Free Software |
||||
# Foundation; either version 3.0 of the License, or (at your option) any later |
||||
# version. |
||||
# |
||||
# BigBlueButton is distributed in the hope that it will be useful, but WITHOUT ANY |
||||
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A |
||||
# PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. |
||||
# |
||||
# You should have received a copy of the GNU Lesser General Public License along |
||||
# with BigBlueButton; if not, see <http://www.gnu.org/licenses/>. |
||||
|
||||
class AccountActivationsController < ApplicationController |
||||
before_action :ensure_unauthenticated |
||||
before_action :find_user |
||||
|
||||
# GET /account_activations |
||||
def show |
||||
render :verify |
||||
end |
||||
|
||||
# GET /account_activations/edit |
||||
def edit |
||||
if @user && !@user.email_verified? && @user.authenticated?(:activation, params[:token]) |
||||
@user.activate |
||||
|
||||
flash[:success] = I18n.t("verify.activated") + " " + I18n.t("verify.signin") |
||||
else |
||||
flash[:alert] = I18n.t("verify.invalid") |
||||
end |
||||
|
||||
redirect_to root_url |
||||
end |
||||
|
||||
# GET /account_activations/resend |
||||
def resend |
||||
if @user.email_verified |
||||
flash[:alert] = I18n.t("verify.already_verified") |
||||
else |
||||
begin |
||||
@user.send_activation_email(verification_link) |
||||
rescue => e |
||||
logger.error "Error in email delivery: #{e}" |
||||
flash[:alert] = I18n.t(params[:message], default: I18n.t("delivery_error")) |
||||
else |
||||
flash[:success] = I18n.t("email_sent") |
||||
end |
||||
end |
||||
|
||||
redirect_to(root_path) |
||||
end |
||||
|
||||
private |
||||
|
||||
def verification_link |
||||
request.base_url + edit_account_activation_path(token: @user.activation_token, email: @user.email) |
||||
end |
||||
|
||||
def ensure_unauthenticated |
||||
redirect_to current_user.main_room if current_user |
||||
end |
||||
|
||||
def email_params |
||||
params.require(:email).permit(:token) |
||||
end |
||||
|
||||
def find_user |
||||
@user = User.find_by!(email: params[:email], provider: "greenlight") |
||||
end |
||||
end |
||||
@ -0,0 +1,20 @@ |
||||
# frozen_string_literal: true |
||||
|
||||
# BigBlueButton open source conferencing system - http://www.bigbluebutton.org/. |
||||
# |
||||
# Copyright (c) 2018 BigBlueButton Inc. and by respective authors (see below). |
||||
# |
||||
# This program is free software; you can redistribute it and/or modify it under the |
||||
# terms of the GNU Lesser General Public License as published by the Free Software |
||||
# Foundation; either version 3.0 of the License, or (at your option) any later |
||||
# version. |
||||
# |
||||
# BigBlueButton is distributed in the hope that it will be useful, but WITHOUT ANY |
||||
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A |
||||
# PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. |
||||
# |
||||
# You should have received a copy of the GNU Lesser General Public License along |
||||
# with BigBlueButton; if not, see <http://www.gnu.org/licenses/>. |
||||
|
||||
module AccountActivationsHelper |
||||
end |
||||
@ -0,0 +1,8 @@ |
||||
# frozen_string_literal: true |
||||
|
||||
class AddActivationToUsers < ActiveRecord::Migration[5.0] |
||||
def change |
||||
add_column :users, :activation_digest, :string |
||||
add_column :users, :activated_at, :datetime |
||||
end |
||||
end |
||||
@ -0,0 +1,95 @@ |
||||
# frozen_string_literal: true |
||||
|
||||
# BigBlueButton open source conferencing system - http://www.bigbluebutton.org/. |
||||
# |
||||
# Copyright (c) 2018 BigBlueButton Inc. and by respective authors (see below). |
||||
# |
||||
# This program is free software; you can redistribute it and/or modify it under the |
||||
# terms of the GNU Lesser General Public License as published by the Free Software |
||||
# Foundation; either version 3.0 of the License, or (at your option) any later |
||||
# version. |
||||
# |
||||
# BigBlueButton is distributed in the hope that it will be useful, but WITHOUT ANY |
||||
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A |
||||
# PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. |
||||
# |
||||
# You should have received a copy of the GNU Lesser General Public License along |
||||
# with BigBlueButton; if not, see <http://www.gnu.org/licenses/>. |
||||
|
||||
require "rails_helper" |
||||
|
||||
describe AccountActivationsController, type: :controller do |
||||
before { allow(Rails.configuration).to receive(:allow_user_signup).and_return(true) } |
||||
before { allow(Rails.configuration).to receive(:enable_email_verification).and_return(true) } |
||||
|
||||
describe "GET #show" do |
||||
it "redirects to main room if signed in" do |
||||
user = create(:user, provider: "greenlight") |
||||
@request.session[:user_id] = user.id |
||||
|
||||
get :show, params: { email: user.email } |
||||
|
||||
expect(response).to redirect_to(user.main_room) |
||||
end |
||||
|
||||
it "renders the verify view if the user is not signed in and is not verified" do |
||||
user = create(:user, email_verified: false, provider: "greenlight") |
||||
|
||||
get :show, params: { email: user.email } |
||||
|
||||
expect(response).to render_template(:verify) |
||||
end |
||||
end |
||||
|
||||
describe "GET #edit" do |
||||
it "activates a user if they have the correct activation token" do |
||||
@user = create(:user, email_verified: false, provider: "greenlight") |
||||
|
||||
get :edit, params: { email: @user.email, token: @user.activation_token } |
||||
@user.reload |
||||
|
||||
expect(@user.email_verified).to eq(true) |
||||
expect(flash[:success]).to be_present |
||||
expect(response).to redirect_to(root_path) |
||||
end |
||||
|
||||
it "does not activate a user if they have the correct activation token" do |
||||
@user = create(:user, email_verified: false, provider: "greenlight") |
||||
|
||||
get :edit, params: { email: @user.email, token: "fake_token" } |
||||
@user.reload |
||||
|
||||
expect(@user.email_verified).to eq(false) |
||||
expect(flash[:alert]).to be_present |
||||
expect(response).to redirect_to(root_path) |
||||
end |
||||
|
||||
it "does not allow the user to click the verify link again" do |
||||
@user = create(:user, provider: "greenlight") |
||||
|
||||
get :edit, params: { email: @user.email, token: @user.activation_token } |
||||
|
||||
expect(flash[:alert]).to be_present |
||||
expect(response).to redirect_to(root_path) |
||||
end |
||||
end |
||||
|
||||
describe "GET #resend" do |
||||
it "resends the email to the current user if the resend button is clicked" do |
||||
user = create(:user, email_verified: false, provider: "greenlight") |
||||
|
||||
expect { get :resend, params: { email: user.email } }.to change { ActionMailer::Base.deliveries.count }.by(1) |
||||
expect(flash[:success]).to be_present |
||||
expect(response).to redirect_to(root_path) |
||||
end |
||||
|
||||
it "redirects a verified user to the root path" do |
||||
user = create(:user, provider: "greenlight") |
||||
|
||||
get :resend, params: { email: user.email } |
||||
|
||||
expect(flash[:alert]).to be_present |
||||
expect(response).to redirect_to(root_path) |
||||
end |
||||
end |
||||
end |
||||
Reference in new issue