Class: Studio::LocalReviewsController

Inherits:
ApplicationController
  • Object
show all
Includes:
MagicLinkIssuing
Defined in:
app/controllers/studio/local_reviews_controller.rb

Overview

GET /_studio/local_review?email=&return_to= — the LOCAL half of the task board's WAITING APPROVAL button.

Why it must live here, on the local app. A magic link signs the recipient into the app that MINTED it: the token is a row (or a signed blob) in that app's own store, and Studio::LinkToken.sanitize_path keeps return_to a same-origin PATH. So a link minted by the production board can only ever land on production — no matter what host the path belongs to. The board therefore stops minting and REDIRECTS here, to the local server named by the task's local_url, which mints in its own database and lands the operator signed-in on the page under review.

It mints for whatever email it is handed, unauthenticated — so it is bound to the same floor as the local email inbox (Studio::LocalEmailsController): never in production, and only for a loopback request. That is the same exposure the inbox already carries, which hands every captured sign-in link to any local reader. It is a development desk convenience; it is not a sign-in path.

It also PROVISIONS the account before minting, at Studio.local_review_role (default "admin"). The email the board hands over is the operator's PRODUCTION address, and a fresh worktree database has never seen it — so without this the consume takes Studio::LinkConsumption#sign_up_new, creates him at the default role ("viewer"), and require_admin on the page under review redirects him to "/". The sign-in SUCCEEDS and he never sees the page, which is what made the failure so quiet: a seeded admin works, so only the operator's real address ever hit it.

Instance Method Summary collapse

Instance Method Details

#show ⇒ Object 



38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
 
# File 'app/controllers/studio/local_reviews_controller.rb', line 38

def show
  email = reviewer_email
  return redirect_to(, alert: MISSING_EMAIL) unless email.match?(URI::MailTo::EMAIL_REGEXP)

  # Provision BEFORE minting, so the consume finds an existing account and
  # takes sign_in_existing rather than sign_up_new-at-the-default-role.
  provision_reviewer(email)

  # return_to is passed through raw: the store sanitizes it to a same-origin
  # path on the way in (Studio::Link.create_magic_link calls
  # Studio::LinkToken.sanitize_path). Re-sanitizing here would be a second
  # spelling of a rule that already has one owner — and a mutation run
  # confirmed it guards nothing the store does not already guard.
  token = issue_magic_link(email, params[:return_to])
  redirect_to magic_link_url_for(token), allow_other_host: false
end