Merge branch 'advanced-login' into 'master'

Implement advanced login

See merge request !11

app/assets/stylesheets/custom.scss

@@ -145,3 +145,16 @@ input {
   }
 }
 
+.checkbox {
+  margin-top: -10px;
+  margin-bottom: 10px;
+  span {
+    margin-left: 20px;
+    font-weight: normal;
+    }
+  }
+
+  #session_remember_me {
+    width: auto;
+    margin-left: 0;
+  }

app/controllers/sessions_controller.rb

@@ -8,6 +8,8 @@ class SessionsController < ApplicationController
     user = User.find_by(email: params[:session][:email].downcase)
     if user && user.authenticate(params[:session][:password])
       log_in user
+      params[:session][:remember_me] == '1' ? remember(user) : forget(user)
+      remember user
       redirect_to user
     else
       flash.now[:danger] = 'Invalid email/password combination'
@@ -16,7 +18,7 @@ class SessionsController < ApplicationController
   end
 
   def destroy
-    log_out
+    log_out if logged_in?
     redirect_to root_url
   end
 end

app/helpers/sessions_helper.rb

@@ -3,10 +3,23 @@ module SessionsHelper
     session[:user_id] = user.id
   end
 
+  # Remembers a user in a persistent session.
+  def remember(user)
+    user.remember
+    cookies.permanent.encrypted[:user_id] = user.id
+    cookies.permanent[:remember_token] = user.remember_token
+  end
+  
   # Returns the current logged-in user (if any).
   def current_user
-    if session[:user_id]
-      @current_user ||= User.find_by(id: session[:user_id])
+    if (user_id = session[:user_id])
+      @current_user ||= User.find_by(id: user_id)
+    elsif (user_id = cookies.encrypted[:user_id])
+      user = User.find_by(id: user_id)
+      if user && user.authenticated?(cookies[:remember_token])
+        log_in user
+        @current_user = user
+      end
     end
   end
 
@@ -19,4 +32,18 @@ module SessionsHelper
     session.delete(:user_id)
     @current_user = nil
   end
+
+  # Forgets a persistent session.
+  def forget(user)
+    user.forget
+    cookies.delete(:user_id)
+    cookies.delete(:remember_token)
+  end
+
+  # Logs out the current user.
+  def log_out
+    forget(current_user)
+    session.delete(:user_id)
+    @current_user = nil
+  end
 end

app/models/user.rb

 class User < ApplicationRecord
+  attr_accessor :remember_token
   before_save { email.downcase! }
   validates :name, presence: true, length: { maximum: 50 }
   VALID_EMAIL_REGEX = /\A[\w+\-.]+@[a-z\d\-.]+\.[a-z]+\z/i
@@ -14,4 +15,24 @@ class User < ApplicationRecord
                                                   BCrypt::Engine.cost
     BCrypt::Password.create(string, cost: cost)
   end
+
+  # Returns a random token.
+  def User.new_token
+    SecureRandom.urlsafe_base64
+  end
+
+  def remember
+    self.remember_token = User.new_token
+    update_attribute(:remember_digest, User.digest(remember_token))
+  end
+
+  def authenticated?(remember_token)
+    return false if remember_digest.nil?
+    BCrypt::Password.new(remember_digest).is_password?(remember_token)
+  end
+
+  # Forgets a user.
+  def forget
+    update_attribute(:remember_digest, nil)
+  end
 end

app/views/sessions/new.html.erb

@@ -3,12 +3,21 @@
 <div class="row">
   <div class="col-md-6 offset-md-3">
   <%= form_with(url: login_path, scope: :session, local: true) do |f| %>
+
     <%= f.label :email %>
     <%= f.email_field :email, class: 'form-control' %>
+
     <%= f.label :password %>
     <%= f.password_field :password, class: 'form-control' %>
+
+    <%= f.label :remember_me, class: "checkbox inline" do %>
+      <%= f.check_box :remember_me %>
+      <span>Remember me on this computer</span>
+    <% end %>
+
     <%= f.submit "Log in", class: "btn btn-primary" %>
   <% end %>
+  
   <p>New user? <%= link_to "Sign up now!", signup_path %></p>
   </div>
 </div>
\ No newline at end of file

db/migrate/20210617022511_add_remember_digest_to_users.rb

+class AddRememberDigestToUsers < ActiveRecord::Migration[6.1]
+  def change
+    add_column :users, :remember_digest, :string
+  end
+end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2021_06_09_152857) do
+ActiveRecord::Schema.define(version: 2021_06_17_022511) do
 
   create_table "users", force: :cascade do |t|
     t.string "name"
@@ -18,6 +18,7 @@ ActiveRecord::Schema.define(version: 2021_06_09_152857) do
     t.datetime "created_at", precision: 6, null: false
     t.datetime "updated_at", precision: 6, null: false
     t.string "password_digest"
+    t.string "remember_digest"
     t.index ["email"], name: "index_users_on_email", unique: true
   end
 

test/integration/users_login_test.rb

@@ -32,10 +32,25 @@ class UsersLoginTest < ActionDispatch::IntegrationTest
     delete logout_path
     assert_not is_logged_in?
     assert_redirected_to root_url
+    # Simulate a user clicking logout in a second window.
+    delete logout_path
     follow_redirect!
     assert_select "a[href=?]", login_path
     assert_select "a[href=?]", logout_path,
     count: 0
     assert_select "a[href=?]", user_path(@user), count: 0
   end
+
+  test "login with remembering" do
+    log_in_as(@user, remember_me: '1')
+    assert_not_empty cookies[:remember_token]
+  end
+  
+  test "login without remembering" do
+    # Log in to set the cookie.
+    log_in_as(@user, remember_me: '1')
+    # Log in again and verify that the cookie is deleted.
+    log_in_as(@user, remember_me: '0')
+    assert_empty cookies[:remember_token]
+  end
 end

test/models/user_test.rb

@@ -17,4 +17,7 @@ class UserTest < ActiveSupport::TestCase
     assert_not @user.valid?
   end
 
+  test "authenticated? should return false for a user with nil digest" do
+    assert_not @user.authenticated?('')
+  end
 end
\ No newline at end of file

test/test_helper.rb

@@ -10,7 +10,21 @@ parallelize(workers: :number_of_processors)
 fixtures :all
 # Add more helper methods to be used by all tests here...
 # Returns true if a test user is logged in.
-def is_logged_in?
-  !session[:user_id].nil?
+  def is_logged_in?
+    !session[:user_id].nil?
+  end
+  
+# Log in as a particular user.
+  def log_in_as(user)
+    session[:user_id] = user.id
+  end
 end
+
+class ActionDispatch::IntegrationTest
+# Log in as a particular user.
+  def log_in_as(user, password: 'password', remember_me: '1')
+    post login_path, params: { session: { email: user.email,
+                                          password: password,
+                                          remember_me: remember_me } }
+  end
 end
\ No newline at end of file