Class: Auth::CustomerSessionsController

Inherits:
Devise::SessionsController
  • Object
show all
Includes:
Controllers::DeviseReturnable, Controllers::TurboStreamFlashable, MyAccountHelper
Defined in:
app/controllers/auth/customer_sessions_controller.rb

Constant Summary

Constants included from Controllers::DeviseReturnable

Controllers::DeviseReturnable::ALLOWED_REDIRECT_HOSTS

Instance Method Summary collapse

Methods included from MyAccountHelper

#account_nav_active?, #can_list_contact_resources?, #is_current_user_or_customer_login_email?, #setup_contact, #setup_customer_account, #sorted_contact_points

Methods included from Controllers::DeviseReturnable

#check_for_devise_return_path, #devise_return_path_from_omniauth_hash, #safe_referer

Instance Method Details

#authenticate ⇒ Object 



200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
 
# File 'app/controllers/auth/customer_sessions_controller.rb', line 200

def authenticate
  respond_to do |format|
    @account = Account.where(login: params[:account][:login].to_s.downcase).first
    if @account
      authenticated = @account.valid_password?(params[:account][:password])
      if authenticated && !@account.disabled?
        (:account, @account)
        logger.debug 'CustomerSessionsController authenticate'
        flash[:info] = 'Awesome, you have successfully signed in.'
        redirect_path = 
        format.turbo_stream { render turbo_stream: turbo_stream.redirect(redirect_path) }
        format.html { redirect_to(redirect_path) }
      elsif @account.disabled?
        flash.now[:error] = @account.inactive_message
        format.turbo_stream { render turbo_stream: turbo_stream.update(turbo_stream_target, partial: 'auth/customer_sessions/authenticate') }
        format.html { render :new, status: :unprocessable_entity }
      else
        flash.now[:error] = 'Sorry, incorrect password. Please try again.'
        format.turbo_stream { render turbo_stream: turbo_stream.update(turbo_stream_target, partial: 'auth/customer_sessions/authenticate') }
        format.html { render :new, status: :unprocessable_entity }
      end
    else
      flash.now[:error] = 'Invalid login. Please try again'
      format.turbo_stream { render turbo_stream: turbo_stream.update(turbo_stream_target, partial: 'auth/customer_sessions/login_form') }
      format.html { render :new, status: :unprocessable_entity }
    end
  end
end

#destroy ⇒ Object 



22
23
24
25
 
# File 'app/controllers/auth/customer_sessions_controller.rb', line 22

def destroy
  clear_post_logout_session
  super
end

#fast_checkout ⇒ Object 



48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
 
# File 'app/controllers/auth/customer_sessions_controller.rb', line 48

def fast_checkout
  logger.debug "CustomerSessionsController#start! delocalized_path(request.referer): #{delocalized_path(request.referer)}" if request.referer.present?
  set_up_alerts_by_parameters
  @account = 
  if @account&.valid?
    flash[:info] = 'You are already signed in.'
    respond_to do |format|
      format.turbo_stream { render turbo_stream: turbo_stream.redirect(@devise_return_path || ) }
      format.html do
        flash[:error] = 'You are already signed in.'
        redirect_to(@devise_return_path || checkout_my_cart_path)
      end
    end
  else
    respond_to do |format|
      format.turbo_stream {}
      format.html { redirect_to(@devise_return_path || checkout_my_cart_path) }
    end
  end
end

#finish_fast_checkout ⇒ Object 



135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
 
# File 'app/controllers/auth/customer_sessions_controller.rb', line 135

def finish_fast_checkout
  set_up_alerts_by_parameters
   = params[:login].presence
  password = params[:password].presence
  respond_to do |format|
    if  && password
      @account_by_login = Account.where(login: ).first_or_initialize
      @account_by_email = Account.where(email: )

      ## First we check wether the login doesn't exist but there is an account with that email
      if @account_by_login.new_record? && @account_by_email.first.nil?
        @account = @account_by_login
      elsif @account_by_login.new_record? && @account_by_email.first.present?
        @account = @account_by_email.first if @account_by_email.size == 1
        @account = nil if @account_by_email.size > 1
      else
        @account = @account_by_login
      end

      # Now we check what to do with the account
      if @account.nil?
        @account_by_email.each do |ac|
          authenticated = ac.valid_password?(password)
          @account = ac if authenticated
        end
        # If the password is not correct for any account but we have many accounts with that email addres, we select the last used account
        # so then we force to go through the 'Forgot Password?' flow
        @account = @account_by_email.order(:last_sign_in_at).first if @account.nil?
      end

      if @account.new_record?
        flash[:error] = "We couldn't find any account with that login."
        format.turbo_stream { render action: :fast_checkout }
      else
        if @account.auth_token_required?
          flash[:info] =
            "#{@account.} is already linked to a guest account with no password or social login. You will need to use your 'WarmlyYours Shopping Cart Misses You' e-mail link to access your account (and add a password or social login), or use the #{view_context.link_to 'Forgot Your Password?',
} link to create your password.".html_safe
        end
        authenticated = @account.valid_password?(password)
        if authenticated && !@account.disabled?
          (:account, @account) # If this fails, check if the account is confirmed by calling @account.confirmed?
          # This is now removed, but kept in for reference, 2/28/18, - Ramie
          # logger.debug "CustomerSessionsController finish_fast_checkout, JWT Token is #{env['warden-jwt_auth.token']}"
          flash[:info] = 'Awesome, you have successfully signed in.'
          if @devise_return_path.present? && @devise_return_path.include?('smart_services')
            format.turbo_stream { render action: :smart_services_checkout }
          else
            format.turbo_stream { render turbo_stream: turbo_stream.redirect(@devise_return_path || checkout_my_cart_path) }
          end
        elsif @account.disabled?
          flash[:error] = @account.inactive_message
          format.turbo_stream { render action: :fast_checkout }
        else
          flash[:error] = "Sorry, incorrect password. Please try again. #{view_context.link_to 'Forgot your password?', }".html_safe
          format.turbo_stream { render action: :fast_checkout }
        end
      end
    else
      flash[:error] = "Please enter a valid email address and password. #{view_context.link_to 'Forgot your password?', }".html_safe
      format.turbo_stream { render action: :fast_checkout }
    end
  end
end

#new ⇒ Object 



13
14
15
16
17
18
19
20
 
# File 'app/controllers/auth/customer_sessions_controller.rb', line 13

def new
  logger.debug "CustomerSessionsController#new! @devise_return_path: #{@devise_return_path}, params[:login]: #{params[:login]}"
  @account = 
  return unless @account&.valid?

  flash[:error] = 'You are already signed in.'
  redirect_to(@devise_return_path || )
end

#omniauth_register ⇒ Object 



229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
 
# File 'app/controllers/auth/customer_sessions_controller.rb', line 229

def omniauth_register
  @account = 
  if @account&.valid?
    flash[:error] = 'You are already signed in.'
    redirect_to(@devise_return_path || )
  else
    @provider = nil
    provider = params[:provider] if Authentication::SUPPORTED_PROVIDERS.include?(params[:provider])
    @provider = provider.to_sym if provider
    if @provider
      redirect_post delocalized_path(omniauth_authorize_path(:account, provider, authenticity_token: form_authenticity_token, devise_return_path: @devise_return_path))
    else
      flash[:error] = 'Unh-unh, that is an unsupported provider.'
      redirect_to (devise_return_path: @devise_return_path)
    end
  end
end

#register ⇒ Object 



276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
 
# File 'app/controllers/auth/customer_sessions_controller.rb', line 276

def register
  respond_to do |format|
    if registration_would_clobber_existing_identity?
      log_clobber_attempt('register')
      format.turbo_stream do
        # Turbo Stream re-renders the login form in place, so flash.now is
        # the correct flavor (no second request to read flash from the
        # session).
        flash.now[:error] = clobber_attempt_user_message
        render turbo_stream: turbo_stream.update(turbo_stream_target, partial: 'auth/customer_sessions/login_form')
      end
      format.html do
        # Plain HTML redirects need the message to survive into the next
        # request, so we use flash (not flash.now) which is read on the
        # follow-up GET to the sign-in page.
        flash[:error] = clobber_attempt_user_message
        redirect_to (devise_return_path: @devise_return_path, login: params.dig(:account, :login).presence)
      end
      return
    end

    @account = @context_user.(params[:account])
    @account. ||= @account.email
    @password = params[:account][:password]
    @password_confirmation = params[:account][:password_confirmation]
    @account.require_password = true
    apply_registration_customer_attributes(params[:customer])
    @context_user.
    @context_user.leadify
    @omniauth = get_omniauth_session_from_session_or_params
    if @omniauth
      @account.apply_omniauth(@omniauth)
      @account.require_password = false
    end
    begin
      if @context_user.save
        track_event('Lead - Form Submitted', { leadType: 'Registration', source: 'customer_registration' })
        logger.debug 'CustomerSessionsController register'
        flash[:info] = 'Cool! You have successfully registered your WarmlyYours account.'
        session.delete(:guest_user_id)
        (:account, @account)
        redirect_path = 
        format.turbo_stream { render turbo_stream: turbo_stream.redirect(redirect_path) }
        format.html { redirect_to redirect_path }
      else
        @report_errors_for = [@context_user]
        flash.now[:error] = @context_user.errors.full_messages.to_sentence
        format.turbo_stream { render turbo_stream: turbo_stream.update(turbo_stream_target, partial: 'auth/customer_sessions/register') }
        format.html { render :registration }
      end
    rescue ActiveRecord::RecordNotUnique, PG::UniqueViolation => e
      # Gracefully handle race conditions hitting unique DB constraints (e.g. index_accounts_on_login)
      ErrorReporting.warning('Registration uniqueness violation', error: e.message, login: @account.)
      @account.errors.add(:login, 'has already been taken') if e.message.to_s.include?('index_accounts_on_login')
      @report_errors_for = [@account, @context_user]
      flash.now[:error] = 'That username is already taken. Please choose another.'
      format.turbo_stream { render turbo_stream: turbo_stream.update(turbo_stream_target, partial: 'auth/customer_sessions/register') }
      format.html { render :registration }
    end
  end
end

#registration ⇒ Object 



247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
 
# File 'app/controllers/auth/customer_sessions_controller.rb', line 247

def registration
  # Same defense-in-depth as #register POST: never render a registration
  # form scoped to a party that already has somebody else's account on it.
  if @context_user&.&.persisted? && .nil?
    log_clobber_attempt('registration')
    flash[:error] = clobber_attempt_user_message
    redirect_to((devise_return_path: @devise_return_path)) and return
  end

  @account =  || @context_user.
  @account.require_password = true
  @omniauth = get_omniauth_session_from_session_or_params

  if @omniauth
    @account.apply_omniauth(@omniauth)
    @account.require_password = false
    @context_user.email = @account.email
    @context_user.name = @account.name
  elsif params[:login].present?
    # Direct registration entry from "Continue with Email" after the email
    # check determined no account exists. Pre-fill login/email so the user
    # doesn't have to type it again.
     = params[:login].to_s.strip
    @account. = 
    @account.email =  if .include?('@')
    @account.set_default_marketing_preferences(I18n.locale)
  end
end

#set_email ⇒ Object 



69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
 
# File 'app/controllers/auth/customer_sessions_controller.rb', line 69

def set_email
  set_up_alerts_by_parameters
   = params[:login].presence
  respond_to do |format|
    if 
      @account_by_login = Account.where(login: ).first_or_initialize
      @account_by_email = Account.where(email: )

      ## First we check whether the login doesn't exist but there is an account with that email
      if @account_by_login.new_record? && @account_by_email.first.nil?
        @account = @account_by_login
      elsif @account_by_login.new_record? && @account_by_email.first.present?
        @account = @account_by_email.first if @account_by_email.size == 1
        @account = nil if @account_by_email.size > 1
      else
        @account = @account_by_login
      end

      # Now we check what to do with the account
      if @account.nil?
        flash.now[:error] = "We found multiple accounts with that email. Please use 'Forgot your password?' to proceed."
        format.turbo_stream { render turbo_stream: turbo_stream.update(turbo_stream_target, partial: 'auth/customer_sessions/choose_account') }
        format.html do
          flash[:error] = "We found multiple accounts with that email. Please use 'Forgot your password?' to proceed."
          redirect_to (devise_return_path: @devise_return_path, login: )
        end
      elsif @account.new_record?
        @account.
        @account.require_password = true
        @account.set_default_marketing_preferences(I18n.locale)
        flash.now[:info] = 'Create your account to continue.'
        format.turbo_stream { render turbo_stream: turbo_stream.update(turbo_stream_target, partial: 'auth/customer_sessions/register') }
        format.html do
          flash[:info] = 'Create your account to continue.'
          redirect_to (devise_return_path: @devise_return_path, login: )
        end
      elsif @account.disabled?
        flash.now[:error] = @account.inactive_message
        format.turbo_stream { render turbo_stream: turbo_stream.update(turbo_stream_target, partial: 'auth/customer_sessions/login_form') }
        format.html do
          flash[:error] = @account.inactive_message
          redirect_to (devise_return_path: @devise_return_path, login: )
        end
      else
        if @account.auth_token_required?
          flash.now[:info] =
            "#{@account.} is already linked to a guest account with no password or social login. You will need to use your 'WarmlyYours Shopping Cart Misses You' e-mail link to access your account (and add a password or social login), or use the #{view_context.link_to 'Forgot Your Password?',
} link to create your password.".html_safe
        end
        format.turbo_stream { render turbo_stream: turbo_stream.update(turbo_stream_target, partial: 'auth/customer_sessions/authenticate') }
        format.html do
          flash[:info] ||= 'Please enter your password to continue.'
          redirect_to (devise_return_path: @devise_return_path, login: )
        end
      end
    else
      flash.now[:error] = 'Please enter a valid email address.'
      format.turbo_stream { render turbo_stream: turbo_stream.update(turbo_stream_target, partial: 'auth/customer_sessions/login_form') }
      format.html do
        flash[:error] = 'Please enter a valid email address.'
        redirect_to (devise_return_path: @devise_return_path)
      end
    end
  end
end

#start ⇒ Object 



27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
 
# File 'app/controllers/auth/customer_sessions_controller.rb', line 27

def start
  logger.debug "CustomerSessionsController#start! @devise_return_path: #{@devise_return_path}"
  logger.debug "CustomerSessionsController#start! params[:login]: #{params[:login]}"
  logger.debug "CustomerSessionsController#start! delocalized_path(request.referer): #{delocalized_path(request.referer)}" if request.referer.present?
  set_up_alerts_by_parameters
  respond_to do |format|
    @account = 
    if @account&.valid?
      flash[:info] = 'You are already signed in.'
      format.turbo_stream { render turbo_stream: turbo_stream.redirect(@devise_return_path || ) }
      format.html do
        flash[:error] = 'You are already signed in.'
        redirect_to(@devise_return_path || )
      end
    else
      format.turbo_stream {}
      format.html { redirect_to (devise_return_path: @devise_return_path, login: params[:login]) }
    end
  end
end