diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb new file mode 100644 index 0000000..244d878 --- /dev/null +++ b/app/controllers/users_controller.rb @@ -0,0 +1,38 @@ +class UsersController < ApplicationController + before_filter :authenticate_user! + after_action :verify_authorized + + def index + @users = User.all + authorize User + end + + def show + @user = User.find(params[:id]) + authorize @user + end + + def update + @user = User.find(params[:id]) + authorize @user + if @user.update_attributes(secure_params) + redirect_to users_path, :notice => "User updated." + else + redirect_to users_path, :alert => "Unable to update user." + end + end + + def destroy + user = User.find(params[:id]) + authorize user + user.destroy + redirect_to users_path, :notice => "User deleted." + end + + private + + def secure_params + params.require(:user).permit(:role) + end + +end diff --git a/app/controllers/visitors_controller.rb b/app/controllers/visitors_controller.rb new file mode 100644 index 0000000..ebe5fb6 --- /dev/null +++ b/app/controllers/visitors_controller.rb @@ -0,0 +1,2 @@ +class VisitorsController < ApplicationController +end diff --git a/app/policies/user_policy.rb b/app/policies/user_policy.rb new file mode 100644 index 0000000..2889a10 --- /dev/null +++ b/app/policies/user_policy.rb @@ -0,0 +1,26 @@ +class UserPolicy + attr_reader :current_user, :model + + def initialize(current_user, model) + @current_user = current_user + @user = model + end + + def index? + @current_user.admin? + end + + def show? + @current_user.admin? or @current_user == @user + end + + def update? + @current_user.admin? + end + + def destroy? + return false if @current_user == @user + @current_user.admin? + end + +end diff --git a/app/views/layouts/_navigation_links.html.erb b/app/views/layouts/_navigation_links.html.erb new file mode 100644 index 0000000..beccd98 --- /dev/null +++ b/app/views/layouts/_navigation_links.html.erb @@ -0,0 +1,11 @@ +<%# add navigation links to this file %> +<% if user_signed_in? %> +
  • <%= link_to 'Edit account', edit_user_registration_path %>
    • +
  • <%= link_to 'Sign out', destroy_user_session_path, :method=>'delete' %>
    • +<% else %> +
  • <%= link_to 'Sign in', new_user_session_path %>
    • +
  • <%= link_to 'Sign up', new_user_registration_path %>
    • +<% end %> +<% if user_signed_in? %> +
  • <%= link_to 'Users', users_path %>
    • +<% end %> diff --git a/app/views/pages/about.html.erb b/app/views/pages/about.html.erb new file mode 100644 index 0000000..996fa0c --- /dev/null +++ b/app/views/pages/about.html.erb @@ -0,0 +1,7 @@ +<% content_for :title do %>About<% end %> +

    About the Website

    +

    +This web application was created with +<%= link_to('Rails Composer', 'http://railsapps.github.io/rails-composer/') %> +from the <%= link_to('RailsApps project', 'http://railsapps.github.io/') %>. +

    diff --git a/app/views/users/_user.html.erb b/app/views/users/_user.html.erb new file mode 100644 index 0000000..f1a3d7c --- /dev/null +++ b/app/views/users/_user.html.erb @@ -0,0 +1,12 @@ + + <%= link_to user.email, user %> + + + <%= form_for(user) do |f| %> + <%= f.select(:role, User.roles.keys.map {|role| [role.titleize,role]}) %> + <%= f.submit 'Change Role', :class => 'button-xs' %> + <% end %> + + + <%= link_to("Delete user", user_path(user), :data => { :confirm => "Are you sure?" }, :method => :delete, :class => 'button-xs') unless user == current_user %> + diff --git a/app/views/users/index.html.erb b/app/views/users/index.html.erb new file mode 100644 index 0000000..1ed37ec --- /dev/null +++ b/app/views/users/index.html.erb @@ -0,0 +1,16 @@ +
    +
    +

    Users

    +
    + + + <% @users.each do |user| %> + + <%= render user %> + + <% end %> + +
    +
    +
    +
    diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb new file mode 100644 index 0000000..8d0767f --- /dev/null +++ b/app/views/users/show.html.erb @@ -0,0 +1,3 @@ +

    User

    +

    Name: <%= @user.name if @user.name %>

    +

    Email: <%= @user.email if @user.email %>

    diff --git a/app/views/visitors/index.html.erb b/app/views/visitors/index.html.erb new file mode 100644 index 0000000..5854d00 --- /dev/null +++ b/app/views/visitors/index.html.erb @@ -0,0 +1,2 @@ +

    Welcome

    +

    <%= link_to 'Users:', users_path %> <%= User.count %> registered

    diff --git a/config/initializers/devise_permitted_parameters.rb b/config/initializers/devise_permitted_parameters.rb new file mode 100644 index 0000000..3ab6ae3 --- /dev/null +++ b/config/initializers/devise_permitted_parameters.rb @@ -0,0 +1,17 @@ +module DevisePermittedParameters + extend ActiveSupport::Concern + + included do + before_filter :configure_permitted_parameters + end + + protected + + def configure_permitted_parameters + devise_parameter_sanitizer.for(:sign_up) << :name + devise_parameter_sanitizer.for(:account_update) << :name + end + +end + +DeviseController.send :include, DevisePermittedParameters diff --git a/config/initializers/pundit.rb b/config/initializers/pundit.rb new file mode 100644 index 0000000..f574e12 --- /dev/null +++ b/config/initializers/pundit.rb @@ -0,0 +1,22 @@ +# config/initializers/pundit.rb +# Extends the ApplicationController to add Pundit for authorization. +# Modify this file to change the behavior of a 'not authorized' error. +# Be sure to restart your server when you modify this file. +module PunditHelper + extend ActiveSupport::Concern + + included do + include Pundit + rescue_from Pundit::NotAuthorizedError, with: :user_not_authorized + end + + private + + def user_not_authorized + flash[:alert] = "Access denied." + redirect_to (request.referrer || root_path) + end + +end + +ApplicationController.send :include, PunditHelper diff --git a/config/initializers/upmin.rb b/config/initializers/upmin.rb new file mode 100644 index 0000000..1127594 --- /dev/null +++ b/config/initializers/upmin.rb @@ -0,0 +1,25 @@ +# config/initializers/upmin.rb +# Extends the Upmin ApplicationController to limit access to users with an admin role. +# Depends on Devise for authentication plus role-based authorization. +# Be sure to restart your server when you modify this file. +module AdminOnly + extend ActiveSupport::Concern + + included do + before_filter :authenticate_user! + before_filter :admin_only + end + + private + + def admin_only + unless current_user.admin? + redirect_to :back, :alert => "Access denied." + end + rescue ActionController::RedirectBackError + redirect_to '/', :alert => "Access denied." + end + +end + +Upmin::ApplicationController.send :include, AdminOnly diff --git a/config/routes.rb b/config/routes.rb index fc2791d..3859365 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -1,5 +1,8 @@ Rails.application.routes.draw do + mount Upmin::Engine => '/admin' + root to: 'visitors#index' devise_for :users + resources :users # The priority is based upon order of creation: first created -> highest priority. # See how all your routes lay out with "rake routes". diff --git a/spec/features/visitors/about_page_spec.rb b/spec/features/visitors/about_page_spec.rb new file mode 100644 index 0000000..d94b56d --- /dev/null +++ b/spec/features/visitors/about_page_spec.rb @@ -0,0 +1,16 @@ +# Feature: 'About' page +# As a visitor +# I want to visit an 'about' page +# So I can learn more about the website +feature 'About page' do + + # Scenario: Visit the 'about' page + # Given I am a visitor + # When I visit the 'about' page + # Then I see "About the Website" + scenario 'Visit the about page' do + visit 'pages/about' + expect(page).to have_content 'About the Website' + end + +end diff --git a/spec/features/visitors/home_page_spec.rb b/spec/features/visitors/home_page_spec.rb new file mode 100644 index 0000000..8afa365 --- /dev/null +++ b/spec/features/visitors/home_page_spec.rb @@ -0,0 +1,16 @@ +# Feature: Home page +# As a visitor +# I want to visit a home page +# So I can learn more about the website +feature 'Home page' do + + # Scenario: Visit the home page + # Given I am a visitor + # When I visit the home page + # Then I see "Welcome" + scenario 'visit the home page' do + visit root_path + expect(page).to have_content 'Welcome' + end + +end diff --git a/spec/features/visitors/navigation_spec.rb b/spec/features/visitors/navigation_spec.rb new file mode 100644 index 0000000..ecd8fc0 --- /dev/null +++ b/spec/features/visitors/navigation_spec.rb @@ -0,0 +1,18 @@ +# Feature: Navigation links +# As a visitor +# I want to see navigation links +# So I can find home, sign in, or sign up +feature 'Navigation links', :devise do + + # Scenario: View navigation links + # Given I am a visitor + # When I visit the home page + # Then I see "home," "sign in," and "sign up" + scenario 'view navigation links' do + visit root_path + expect(page).to have_content 'Home' + expect(page).to have_content 'Sign in' + expect(page).to have_content 'Sign up' + end + +end