Class: RivetCms::UsersController

Inherits:
ApplicationController show all
Defined in:
app/controllers/rivet_cms/users_controller.rb

Overview

User management for built-in authentication mode. Hidden and denied under host auth. CE has no roles, so this is add / edit / deactivate only; every user can do everything. Users are deactivated, never deleted, since audit events and content attribution reference them.

The authorize! :users gates below pass for everyone under CE's allow-all policy; they are the seam through which Pro restricts user management to its own roles.

Instance Method Summary collapse

Instance Method Details

#create ⇒ Object 



24
25
26
27
28
29
30
31
32
33
34
 
# File 'app/controllers/rivet_cms/users_controller.rb', line 24

def create
  user = users.new(user_params)

  if user.save
    audit "user.created", user
    flash[:invite_link] = invitation_url(user.generate_token_for(:password_setup))
    redirect_to users_path, notice: "#{user.name} was added. Share the sign-in link below; it is shown only once."
  else
    redirect_to users_path, inertia: { errors: user.errors }
  end
end

#deactivate ⇒ Object 



45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
 
# File 'app/controllers/rivet_cms/users_controller.rb', line 45

def deactivate
  if @user == Current.user
    return redirect_to users_path, alert: "You cannot deactivate your own account"
  end

  locked_out = User.transaction do
    # Lock every user who can actually sign in (active with a password) so
    # two concurrent deactivations serialize instead of both seeing "one
    # other can still sign in" and leaving nobody who can. Pending
    # invitees have no password and do not count. (No-op on SQLite,
    # honored on Postgres/MySQL.)
     = users.active.where.not(password_digest: nil).order(:id).lock.pluck(:id)
    next true if .include?(@user.id) && ( - [ @user.id ]).empty?

    @user.update!(active: false)
    false
  end

  if locked_out
    return redirect_to users_path, alert: "At least one active user must remain, or no one could sign in"
  end

  audit "user.deactivated", @user
  redirect_to users_path, notice: "#{@user.name} was deactivated and can no longer sign in"
end

#index ⇒ Object 



17
18
19
20
21
22
 
# File 'app/controllers/rivet_cms/users_controller.rb', line 17

def index
  render inertia: "Users/Index", props: {
    users: users.order(:created_at).map { |user| user_props(user) },
    invite_link: flash[:invite_link]
  }
end

#reactivate ⇒ Object 



71
72
73
74
75
 
# File 'app/controllers/rivet_cms/users_controller.rb', line 71

def reactivate
  @user.update!(active: true)
  audit "user.reactivated", @user
  redirect_to users_path, notice: "#{@user.name} was reactivated"
end

#reset_link ⇒ Object 



77
78
79
80
 
# File 'app/controllers/rivet_cms/users_controller.rb', line 77

def reset_link
  flash[:invite_link] = invitation_url(@user.generate_token_for(:password_setup))
  redirect_to users_path, notice: "New sign-in link for #{@user.name}; it is shown only once."
end

#update ⇒ Object 



36
37
38
39
40
41
42
43
 
# File 'app/controllers/rivet_cms/users_controller.rb', line 36

def update
  if @user.update(user_params)
    audit "user.updated", @user
    redirect_to users_path, notice: "#{@user.name} was updated"
  else
    redirect_to users_path, inertia: { errors: @user.errors }
  end
end