Class: QuoVadis::Controller::QuoVadisWrapper

Inherits:
Object
  • Object
show all
Defined in:
lib/quo_vadis/controller.rb

Instance Method Summary collapse

Constructor Details

#initialize(controller) ⇒ QuoVadisWrapper

Returns a new instance of QuoVadisWrapper.



116
117
118
 
# File 'lib/quo_vadis/controller.rb', line 116

def initialize(controller)
  @controller = controller
end

Instance Method Details

#clear_session_id ⇒ Object 



146
147
148
 
# File 'lib/quo_vadis/controller.rb', line 146

def clear_session_id
  cookies.delete QuoVadis.cookie_name
end

#lifetime_expires_at(browser_session) ⇒ Object 



205
206
207
208
209
210
211
 
# File 'lib/quo_vadis/controller.rb', line 205

def lifetime_expires_at(browser_session)
  return nil if browser_session
  return nil if QuoVadis.session_lifetime == :session

  t = ActiveSupport::Duration.build(QuoVadis.session_lifetime).from_now
  QuoVadis.session_lifetime_extend_to_end_of_day ? t.end_of_day : t
end

#log(account, action, metadata = {}) ⇒ Object 



224
225
226
 
# File 'lib/quo_vadis/controller.rb', line 224

def log(, action, metadata = {})
  Log.create account: , action: action, ip: request.remote_ip, metadata: metadata
end

#logout ⇒ Object 



213
214
215
216
217
218
 
# File 'lib/quo_vadis/controller.rb', line 213

def logout
  session&.destroy
  clear_session_id
  prevent_rails_session_fixation
  controller.instance_variable_set :@authenticated_model, nil
end

#logout_other_sessions ⇒ Object 



220
221
222
 
# File 'lib/quo_vadis/controller.rb', line 220

def logout_other_sessions
  session.logout_other_sessions
end

#path_after_authentication ⇒ Object

Raises:

  • (RuntimeError) 


228
229
230
231
232
233
234
235
236
 
# File 'lib/quo_vadis/controller.rb', line 228

def path_after_authentication
  if (bookmark = rails_session[:qv_bookmark])
    rails_session.delete :qv_bookmark
    return bookmark
  end
  return main_app. if main_app.respond_to?(:after_login_path)
  return main_app.root_path        if main_app.respond_to?(:root_path)
  raise RuntimeError, 'Missing routes: after_login_path, root_path; define at least one of them.'
end

#path_after_password_change ⇒ Object

Raises:

  • (RuntimeError) 


238
239
240
241
242
 
# File 'lib/quo_vadis/controller.rb', line 238

def path_after_password_change
  return main_app.after_password_change_path if main_app.respond_to?(:after_password_change_path)
  return main_app.root_path                  if main_app.respond_to?(:root_path)
  raise RuntimeError, 'Missing routes: after_password_change_path, root_path; define at least one of them.'
end

#prevent_rails_session_fixation ⇒ Object 



150
151
152
153
154
 
# File 'lib/quo_vadis/controller.rb', line 150

def prevent_rails_session_fixation
  old_session = rails_session.to_hash
  reset_session
  old_session.each { |k,v| rails_session[k] = v }
end

#replace_session ⇒ Object 



196
197
198
199
200
201
202
203
 
# File 'lib/quo_vadis/controller.rb', line 196

def replace_session
  prevent_rails_session_fixation

  sess = session.replace
  store_session_id sess.id, sess.lifetime_expires_at

  controller.instance_variable_set :@authenticated_model, sess..model
end

#request_confirmation(model) ⇒ Object 



166
167
168
169
170
171
172
173
174
175
176
177
 
# File 'lib/quo_vadis/controller.rb', line 166

def request_confirmation(model)
  rails_session[:account_pending_confirmation] = model..id

  expiration = QuoVadis..from_now.to_i
  rails_session[:account_confirmation_expires_at] = expiration

  otp = model..otp_for_confirmation(expiration)

  QuoVadis.deliver :account_confirmation, {email: model.email, otp: otp}

  controller.flash[:notice] = QuoVadis.translate 'flash.confirmation.sent'
end

#require_confirmation ⇒ Object 



156
157
158
159
160
161
162
163
164
 
# File 'lib/quo_vadis/controller.rb', line 156

def require_confirmation
  return if ! QuoVadis.accounts_require_confirmation
  return if ! controller.logged_in?
  return if controller.authenticated_model..confirmed?

  request_confirmation controller.authenticated_model
  rails_session[:qv_bookmark] = controller.request.original_fullpath
  controller.redirect_to controller.quo_vadis.confirm_path
end

#second_factor_authenticated? ⇒ Boolean

Returns:

  • (Boolean) 


184
185
186
 
# File 'lib/quo_vadis/controller.rb', line 184

def second_factor_authenticated?
  session.second_factor_authenticated?
end

#second_factor_required? ⇒ Boolean

Assumes user is logged in.

Returns:

  • (Boolean) 


180
181
182
 
# File 'lib/quo_vadis/controller.rb', line 180

def second_factor_required?
  QuoVadis.two_factor_authentication_mandatory || authenticated_model..has_two_factors?
end

#session ⇒ Object

Returns the current QuoVadis session or nil.



121
122
123
124
 
# File 'lib/quo_vadis/controller.rb', line 121

def session
  return nil unless session_id
  QuoVadis::Session.find_by id: session_id
end

#session_authenticated_with_second_factor ⇒ Object 



192
193
194
 
# File 'lib/quo_vadis/controller.rb', line 192

def session_authenticated_with_second_factor
  session.authenticated_with_second_factor
end

#session_id ⇒ Object 



126
127
128
 
# File 'lib/quo_vadis/controller.rb', line 126

def session_id
  cookies.encrypted[QuoVadis.cookie_name]
end

#store_session_id(id, expires_at) ⇒ Object

Store the session id in an encrypted cookie.

Given that the cookie is encrypted, it is safe to store the database primary key of the session rather than a random-value candidate key.

expires_at - the end of the QuoVadis session’s lifetime (regardless of the idle timeout)



136
137
138
139
140
141
142
143
144
 
# File 'lib/quo_vadis/controller.rb', line 136

def store_session_id(id, expires_at)
  cookies.encrypted[QuoVadis.cookie_name] = {
    value:     id,
    httponly:  true,
    secure:    Rails.env.production?,
    same_site: :lax,
    expires:   expires_at  # setting expires_at to nil has the same effect as not setting it
  }
end

#touch_session_last_seen_at ⇒ Object 



188
189
190
 
# File 'lib/quo_vadis/controller.rb', line 188

def touch_session_last_seen_at
  session&.touch :last_seen_at
end