module Hanami::Tachiban

Private Instance Methods

authenticated?(input_pass) click to toggle source

The authenticated? method returns true if the the following criteria are true:

  • a user exists

  • a user's hashed password from the database matches the input password

# File lib/tachiban.rb, line 28
def authenticated?(input_pass)
  @user && BCrypt::Password.new(@user.hashed_pass) == input_pass
end
check_for_logged_in_user() click to toggle source

The check_for_logged_in_user method can be used to check for each request whether the user is logged in. If the user is not logged in the logout method takes over.

# File lib/tachiban.rb, line 73
def check_for_logged_in_user
  logout unless session[:current_user]
end
email_body(url, token, link_validity, time_unit) click to toggle source
# File lib/tachiban.rb, line 129
def email_body(url, token, link_validity, time_unit)
  "Visit this url to reset your password: #{url}#{token}. \n
  The url will be valid for #{link_validity} #{time_unit}(s)."
end
email_subject(app_name) click to toggle source
# File lib/tachiban.rb, line 125
def email_subject(app_name)
  "#{app_name} -- password reset request"
end
handle_session() click to toggle source

If the session hasn't expired the restart_session_counter method is called to reset the session start time.

# File lib/tachiban.rb, line 109
def handle_session
  if session_expired?
    @redirect_url ||= routes.root_path
    session[:current_user] = nil
    flash[:failed_notice] = 'Your session has expired.'
    redirect_to @redirect_url
  else
    restart_session_counter
  end
end
hashed_password(password) click to toggle source

The hashed_password method generates a hashed version of the user's password. By default it includes a salt and the default cost factor of 10 provided by BCrypt. Hashed password should be stored in the database as a user's attribute so it can be retrieved during the login process.

# File lib/tachiban.rb, line 17
def hashed_password(password)
  BCrypt::Password.create(password)
end
login() click to toggle source

Example: login if authenticated?(input_pass)

# File lib/tachiban.rb, line 46
def login
  session[:current_user] = @user.id
  session[:session_start_time] = Time.now
  @flash_message ||= 'You have been successfully logged in.'
  flash[:success_notice] = @flash_message
  @login_redirect_url ||= routes.root_path
  redirect_to @login_redirect_url
end
logout() click to toggle source

The logout method sets the current user in the session to nil and performs a redirect to the redirect_url which is set to /login, but can be overwritten as needed with a specific url by setting a new value for @logout_redirect_url.

# File lib/tachiban.rb, line 60
def logout
  session[:current_user] = nil
  session.clear
  @logout_redirect_url ||= '/login'
  redirect_to @logout_redirect_url
end
password_reset_url_valid?(link_validity) click to toggle source

State the link_validity in seconds.

# File lib/tachiban.rb, line 135
def password_reset_url_valid?(link_validity)
  Time.now < @user.password_reset_sent_at + link_validity
end
restart_session_counter() click to toggle source

The restart_session_counter method resets the session start time to Time.now. It's used in the handle session method.

# File lib/tachiban.rb, line 96
def restart_session_counter
  session[:session_start_time] = Time.now
end
session_expired?() click to toggle source

The session_expired? method compares the session start time increased for the defined validity time (set to 10 minutes by default and can be overwritten) with the current time.

# File lib/tachiban.rb, line 86
def session_expired?
  if session[:current_user]
    @validity_time ||= 600
    session[:session_start_time] + @validity_time.to_i < Time.now
  end
end
token() click to toggle source

Password reset ###

# File lib/tachiban.rb, line 121
def token
  SecureRandom.urlsafe_base64
end