module Hanami::Tachiban
Private Instance Methods
The authenticated? method returns true if the the following criteria are true:
-
a user exists
-
a user's hashed password from the database matches the input password
# File lib/tachiban.rb, line 28 def authenticated?(input_pass) @user && BCrypt::Password.new(@user.hashed_pass) == input_pass end
The check_for_logged_in_user
method can be used to check for each request whether the user is logged in. If the user is not logged in the logout method takes over.
# File lib/tachiban.rb, line 73 def check_for_logged_in_user logout unless session[:current_user] end
# File lib/tachiban.rb, line 129 def email_body(url, token, link_validity, time_unit) "Visit this url to reset your password: #{url}#{token}. \n The url will be valid for #{link_validity} #{time_unit}(s)." end
# File lib/tachiban.rb, line 125 def email_subject(app_name) "#{app_name} -- password reset request" end
If the session hasn't expired the restart_session_counter
method is called to reset the session start time.
# File lib/tachiban.rb, line 109 def handle_session if session_expired? @redirect_url ||= routes.root_path session[:current_user] = nil flash[:failed_notice] = 'Your session has expired.' redirect_to @redirect_url else restart_session_counter end end
The hashed_password
method generates a hashed version of the user's password. By default it includes a salt and the default cost factor of 10 provided by BCrypt. Hashed password should be stored in the database as a user's attribute so it can be retrieved during the login process.
# File lib/tachiban.rb, line 17 def hashed_password(password) BCrypt::Password.create(password) end
Example: login if authenticated?(input_pass)
# File lib/tachiban.rb, line 46 def login session[:current_user] = @user.id session[:session_start_time] = Time.now @flash_message ||= 'You have been successfully logged in.' flash[:success_notice] = @flash_message @login_redirect_url ||= routes.root_path redirect_to @login_redirect_url end
The logout method sets the current user in the session to nil and performs a redirect to the redirect_url which is set to /login, but can be overwritten as needed with a specific url by setting a new value for @logout_redirect_url.
# File lib/tachiban.rb, line 60 def logout session[:current_user] = nil session.clear @logout_redirect_url ||= '/login' redirect_to @logout_redirect_url end
State the link_validity in seconds.
# File lib/tachiban.rb, line 135 def password_reset_url_valid?(link_validity) Time.now < @user.password_reset_sent_at + link_validity end
The restart_session_counter
method resets the session start time to Time.now. It's used in the handle session method.
# File lib/tachiban.rb, line 96 def restart_session_counter session[:session_start_time] = Time.now end
The session_expired? method compares the session start time increased for the defined validity time (set to 10 minutes by default and can be overwritten) with the current time.
# File lib/tachiban.rb, line 86 def session_expired? if session[:current_user] @validity_time ||= 600 session[:session_start_time] + @validity_time.to_i < Time.now end end
Password reset ###
# File lib/tachiban.rb, line 121 def token SecureRandom.urlsafe_base64 end