module GovukPersonalisation::ControllerConcern

Constants

ACCOUNT_END_SESSION_HEADER_NAME
ACCOUNT_SESSION_HEADER_NAME
ACCOUNT_SESSION_INTERNAL_HEADER_NAME

Public Instance Methods

account_flash_add(message) click to toggle source

Add a message to the flash to return to the user. This does not change `account_flash`

@param message [String] the message to add

@return [true, false] whether the message is valid (and so has been added)

# File lib/govuk_personalisation/controller_concern.rb, line 114
def account_flash_add(message)
  return false unless GovukPersonalisation::Flash.valid_message? message

  @new_account_flash[message] = true
  set_account_session_header
  true
end
account_flash_keep() click to toggle source

Copy all messages from the `account_flash` into the flash to return to the user.

# File lib/govuk_personalisation/controller_concern.rb, line 124
def account_flash_keep
  @new_account_flash = @account_flash.merge(@new_account_flash)
  set_account_session_header
end
fetch_account_session_header() click to toggle source

Read the `GOVUK-Account-Session` request header and set the `@account_session_header` and `@account_flash` variables. Also sets a response header with an empty flash if there is a flash in the request.

This is called as a `before_action`

This should not be called after either of the `@govuk_account_session` or flash to return to the user have been changed, as those changes will be overwritten.

# File lib/govuk_personalisation/controller_concern.rb, line 31
def fetch_account_session_header
  session_with_flash =
    if request.headers[ACCOUNT_SESSION_INTERNAL_HEADER_NAME]
      request.headers[ACCOUNT_SESSION_INTERNAL_HEADER_NAME].presence
    elsif Rails.env.development?
      cookies[ACCOUNT_SESSION_DEV_COOKIE_NAME]
    end

  @account_session_header, flash = GovukPersonalisation::Flash.decode_session(session_with_flash)
  @account_flash = (flash || []).index_with { |_| true }
  @new_account_flash = {}

  set_account_session_header unless @account_flash.empty?
end
logged_in?() click to toggle source

Check if the user has a session.

This does not call account-api to verify that the session is valid, but an invalid session would not allow a user to access any personal data anyway.

@return [true, false] whether the user has a session

# File lib/govuk_personalisation/controller_concern.rb, line 65
def logged_in?
  account_session_header.present?
end
logout!() click to toggle source

Clear the `@account_session_header` and set the logout response header.

# File lib/govuk_personalisation/controller_concern.rb, line 96
def logout!
  response.headers[ACCOUNT_END_SESSION_HEADER_NAME] = "1"
  @account_session_header = nil
  if Rails.env.development?
    cookies[ACCOUNT_SESSION_DEV_COOKIE_NAME] = {
      value: "",
      domain: "dev.gov.uk",
      expires: 1.second.ago,
    }
  end
end
set_account_session_header(govuk_account_session = nil) click to toggle source

Set a new session header.

This should be called after any API call to account-api which returns a new session value. This is called automatically after updating the flash with `account_flash_add` or `account_flash_keep`

Calling this after calling `logout!` will not prevent the user from being logged out.

@param govuk_account_session [String, nil] the new session identifier

# File lib/govuk_personalisation/controller_concern.rb, line 80
def set_account_session_header(govuk_account_session = nil)
  @account_session_header = govuk_account_session if govuk_account_session

  session_with_flash = GovukPersonalisation::Flash.encode_session(@account_session_header, @new_account_flash.keys)

  response.headers[ACCOUNT_SESSION_HEADER_NAME] = session_with_flash
  if Rails.env.development?
    cookies[ACCOUNT_SESSION_DEV_COOKIE_NAME] = {
      value: session_with_flash,
      domain: "dev.gov.uk",
    }
  end
end
set_account_vary_header() click to toggle source

Set the `Vary: GOVUK-Account-Session` response header.

This is called as a `before_action`, to ensure that pages rendered using one user's session are not served to another by our CDN. You should only skip this action if you are certain that the response does not include any personalisation, or if you prevent caching in some other way (for example, with `Cache-Control: no-store`).

# File lib/govuk_personalisation/controller_concern.rb, line 54
def set_account_vary_header
  response.headers["Vary"] = [response.headers["Vary"], ACCOUNT_SESSION_HEADER_NAME].compact.join(", ")
end