Edges Chantelle MediaRanker_Revisited

.gitignore

@@ -15,3 +15,6 @@
 
 # Ignore Byebug command history file.
 .byebug_history
+
+#Storing Credentials
+.env

Gemfile

@@ -62,7 +62,13 @@ group :development do
   # Spring speeds up development by keeping your application running in the background. Read more: https://github.com/rails/spring
   gem 'spring'
   gem 'spring-watcher-listen', '~> 2.0.0'
+  #add .env to dev group
+  gem 'dotenv-rails'
 end
 
 # Windows does not include zoneinfo files, so bundle the tzinfo-data gem
 gem 'tzinfo-data', platforms: [:mingw, :mswin, :x64_mingw, :jruby]
+
+#Installing OmniAuth
+gem "omniauth"
+gem "omniauth-github"

Gemfile.lock

@@ -70,11 +70,18 @@ GEM
     concurrent-ruby (1.0.5)
     crass (1.0.4)
     debug_inspector (0.0.3)
+    dotenv (2.5.0)
+    dotenv-rails (2.5.0)
+      dotenv (= 2.5.0)
+      railties (>= 3.2, < 6.0)
     erubi (1.7.1)
     execjs (2.7.0)
+    faraday (0.15.3)
+      multipart-post (>= 1.2, < 3)
     ffi (1.9.25)
     globalid (0.4.1)
       activesupport (>= 4.2.0)
+    hashie (3.5.7)
     i18n (1.1.0)
       concurrent-ruby (~> 1.0)
     jbuilder (2.7.0)
@@ -84,6 +91,7 @@ GEM
       rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
+    jwt (2.1.0)
     listen (3.0.8)
       rb-fsevent (~> 0.9, >= 0.9.4)
       rb-inotify (~> 0.9, >= 0.9.7)
@@ -113,9 +121,26 @@ GEM
       minitest (~> 5.0)
       rails (>= 4.1)
     multi_json (1.13.1)
+    multi_xml (0.6.0)
+    multipart-post (2.0.0)
     nio4r (2.3.1)
     nokogiri (1.8.4)
       mini_portile2 (~> 2.3.0)
+    oauth2 (1.4.1)
+      faraday (>= 0.8, < 0.16.0)
+      jwt (>= 1.0, < 3.0)
+      multi_json (~> 1.3)
+      multi_xml (~> 0.5)
+      rack (>= 1.2, < 3)
+    omniauth (1.8.1)
+      hashie (>= 3.4.6, < 3.6.0)
+      rack (>= 1.6.2, < 3)
+    omniauth-github (1.3.0)
+      omniauth (~> 1.5)
+      omniauth-oauth2 (>= 1.4.0, < 2.0)
+    omniauth-oauth2 (1.5.0)
+      oauth2 (~> 1.1)
+      omniauth (~> 1.2)
     pg (0.21.0)
     popper_js (1.14.3)
     pry (0.11.3)
@@ -207,13 +232,16 @@ DEPENDENCIES
   bootstrap (~> 4.1.3)
   byebug
   coffee-rails (~> 4.2)
+  dotenv-rails
   jbuilder (~> 2.5)
   jquery-rails
   listen (~> 3.0.5)
   minitest-rails
   minitest-reporters
   minitest-skip
   minitest-spec-rails
+  omniauth
+  omniauth-github
   pg (~> 0.18)
   pry-rails
   puma (~> 3.0)

README.md

@@ -42,7 +42,7 @@ Take some time to understand what each controller is doing. Add tests to the exi
 - Tests custom controller logic and custom routes when appropriate
   - Tests positive, negative, nominal and edge cases
 
-<!-- ## Wave 2: Authentication via OAuth
+## Wave 2: Authentication via OAuth
 
 Following the steps in the Textbook curriculum, add OAuth to your Media Ranker Application and enable a user to log in.
 
@@ -53,33 +53,33 @@ Following the steps in the Textbook curriculum, add OAuth to your Media Ranker A
 - All other requirements from in-class notes apply:
   - Managed via `session`
   - `SessionsController`
-  - `User` model -->
+  - `User` model
 
 
-<!-- ## Wave 3: Basic Authorization (Page Access)
+  ## Wave 3: Basic Authorization (Page Access)
 
-In this wave we will create authorization logic to enforce rules that govern what pages on the site users and guests (unauthenticated browsers) can view. The rule we'll use is that guests can only access the main page, and all logged-in users can access the show and index pages for all categories of work.
+  In this wave we will create authorization logic to enforce rules that govern what pages on the site users and guests (unauthenticated browsers) can view. The rule we'll use is that guests can only access the main page, and all logged-in users can access the show and index pages for all categories of work.
 
-### Requirements
--  Ensure that users who are not logged in can see *only* the main page with the spotlight and top 10 items. No other pages should be viewable by the guest user.
--  Ensure that users who are logged in can see the rest of the pages.
-- Full unit testing around authentication using mocks
+  ### Requirements
+  -  Ensure that users who are not logged in can see *only* the main page with the spotlight and top 10 items. No other pages should be viewable by the guest user.
+  -  Ensure that users who are logged in can see the rest of the pages.
+  - Full unit testing around authentication using mocks
 
 
-## Optional Wave 4: Advanced Authorization (Ownership)
+  ## Optional Wave 4: Advanced Authorization (Ownership)
 
-Create advanced authorization logic to enforce rules that govern what _changes_ users can make to the site's data. The rules here are more complex than for accessing pages:
-- Guests cannot change any data on the site
-- All logged-in users can add new works to the site
+  Create advanced authorization logic to enforce rules that govern what _changes_ users can make to the site's data. The rules here are more complex than for accessing pages:
+  - Guests cannot change any data on the site
+  - All logged-in users can add new works to the site
   - Those works are owned by the user that created them
-- The user who owns a given work can:
+  - The user who owns a given work can:
   - Edit that work
   - Delete that work
 
-### Tasks
-- Modify the edit and delete functionality to ensure that users can only change works they are associated with.
+  ### Tasks
+  - Modify the edit and delete functionality to ensure that users can only change works they are associated with.
   - Consider how this could be implemented at the model layer.
-- Do some research into how to use Google or another OAuth provider for authentication and use that provider. -->
+  - Do some research into how to use Google or another OAuth provider for authentication and use that provider.
 
 ## Due Date
 This project is due before class Monday October 29 via PR against Ada-C10/MediaRanker-Revisited.

app/controllers/application_controller.rb

@@ -8,7 +8,8 @@ def render_404
     raise ActionController::RoutingError.new('Not Found')
   end
 
-private
+  private
+
   def find_user
     if session[:user_id]
       @login_user = User.find_by(id: session[:user_id])

app/controllers/sessions_controller.rb

@@ -2,33 +2,49 @@ class SessionsController < ApplicationController
   def login_form
   end
 
-  def login
-    username = params[:username]
-    if username and user = User.find_by(username: username)
-      session[:user_id] = user.id
-      flash[:status] = :success
-      flash[:result_text] = "Successfully logged in as existing user #{user.username}"
-    else
-      user = User.new(username: username)
-      if user.save
-        session[:user_id] = user.id
-        flash[:status] = :success
-        flash[:result_text] = "Successfully created new user #{user.username} with ID #{user.id}"
-      else
-        flash.now[:status] = :failure
-        flash.now[:result_text] = "Could not log in"
-        flash.now[:messages] = user.errors.messages
-        render "login_form", status: :bad_request
-        return
-      end
-    end
-    redirect_to root_path
-  end
+  def create
+   auth_hash = request.env['omniauth.auth']
 
-  def logout
-    session[:user_id] = nil
-    flash[:status] = :success
-    flash[:result_text] = "Successfully logged out"
-    redirect_to root_path
-  end
+
+   #UID specific to user for this provider
+   user = User.find_by(uid: auth_hash[:uid], provider: auth_hash[:provider])
+   if user
+     # User was found in the database
+     session[:user_id] = user.id
+     flash[:status] = :success
+     flash[:result_text] = "Logged in as returning user #{user.name}"
+   else
+     # User doesn't match anything in the DB
+     # Attempt to create a new user
+
+     user = User.build_from_github(auth_hash)
+
+     if user.save
+       flash[:status] = :success
+       flash[:result_text] = "Logged in as new user #{user.name}"
+     else
+       # Couldn't save the user for some reason. If we hit this it probably means there's a bug with the
+       # way we've configured GitHub. Our strategy will
+       # be to display error messages to make future
+       # debugging easier.
+       flash.now[:status] = :failure
+       flash[:result_text] = "Could not create new user account: "
+       flash[:messages] = user.errors.messages
+
+       redirect_to root_path
+     end
+   end
+
+   # If we get here, we have a valid user instance
+   session[:user_id] = user.id
+   redirect_to root_path
+ end
+
+ def destroy
+   session[:user_id] = nil
+   flash[:status] = :success
+   flash[:result_text] = "Successfully logged out!"
+
+   redirect_to root_path
+ end
 end

app/controllers/users_controller.rb

@@ -1,4 +1,6 @@
 class UsersController < ApplicationController
+  before_action :require_login
+
   def index
     @users = User.all
   end
@@ -8,3 +10,12 @@ def show
     render_404 unless @user
   end
 end
+
+private
+
+def require_login
+  unless session[:user_id]
+    flash[:error] = "You must be logged in to do that."
+    redirect_to root_path
+  end
+end

app/controllers/works_controller.rb

@@ -2,6 +2,7 @@ class WorksController < ApplicationController
   # We should always be able to tell what category
   # of work we're dealing with
   before_action :category_from_work, except: [:root, :index, :new, :create]
+  before_action :require_login, except: [:root, :show, :upvote]
 
   def root
     @albums = Work.best_albums
@@ -21,6 +22,7 @@ def new
   def create
     @work = Work.new(media_params)
     @media_category = @work.category
+
     if @work.save
       flash[:status] = :success
       flash[:result_text] = "Successfully created #{@media_category.singularize} #{@work.id}"
@@ -38,6 +40,11 @@ def show
   end
 
   def edit
+    if session[:user_id] != @work.user_id
+      redirect_back fallback_location: root_path
+      flash[:status] = :error
+      flash[:result_text] = "Sorry, can't edit a work that you don't own."
+    end
   end
 
   def update
@@ -50,11 +57,16 @@ def update
       flash.now[:status] = :failure
       flash.now[:result_text] = "Could not update #{@media_category.singularize}"
       flash.now[:messages] = @work.errors.messages
-      render :edit, status: :not_found
+      render :edit, status: :bad_request
     end
   end
 
   def destroy
+    if session[:user_id] != @work.user_id
+      redirect_back fallback_location: root_path
+      flash[:status] = :error
+      flash[:result_text] = "Sorry, can't edit a work that you don't own."
+    end
     @work.destroy
     flash[:status] = :success
     flash[:result_text] = "Successfully destroyed #{@media_category.singularize} #{@work.id}"
@@ -81,7 +93,7 @@ def upvote
     redirect_back fallback_location: work_path(@work)
   end
 
-private
+  private
   def media_params
     params.require(:work).permit(:title, :category, :creator, :description, :publication_year)
   end
@@ -91,4 +103,12 @@ def category_from_work
     render_404 unless @work
     @media_category = @work.category.downcase.pluralize
   end
+
+  def require_login
+    unless session[:user_id]
+
+      flash[:error] = "You must be logged in to do that."
+      redirect_to root_path
+    end
+  end
 end

app/models/user.rb

@@ -3,4 +3,15 @@ class User < ApplicationRecord
   has_many :ranked_works, through: :votes, source: :work
 
   validates :username, uniqueness: true, presence: true
+
+  def self.build_from_github(auth_hash)
+    user = User.new(provider: auth_hash['provider'], uid: auth_hash['uid'], username: auth_hash['info']['nickname'], name: auth_hash['info']['name'], email: auth_hash['info']['email'], image_url: auth_hash['info']['image'])
+    if auth_hash['info']['nickname'] == nil
+      #temp solution for resolving if username does not exist
+      user.username = auth_hash['email']
+    # elsif user.username = auth_hash['email'] == nil
+      #method to generate random username
+    end
+    return user
+  end
 end

app/models/work.rb

@@ -1,5 +1,6 @@
 class Work < ApplicationRecord
   CATEGORIES = %w(album book movie)
+  belongs_to :user
   has_many :votes, dependent: :destroy
   has_many :ranking_users, through: :votes, source: :user
 

app/views/layouts/application.html.erb

@@ -33,22 +33,15 @@
         </li>
       </ul>
       <ul class="nav app-header__user-nav-container">
-        <% if @login_user %>
-
-        <li class="nav-item app-header__nav_item">
-          <%= link_to "Logged in as #{@login_user.username}", user_path(@login_user), class: "btn btn-primary" %>
-        </li>
-        <li class="nav-item app-header__nav_item">
-          <%= link_to "Log Out", logout_path, method: :post, class: "btn btn-primary" %>
-        </li>
 
+        <% if @login_user %>
+        <p>Currently logged in as user
+          <%= @login_user.username %>
+        <%= link_to "Log out", logout_path, method: "delete"   %>
         <% else %>
-
-        <li class="nav-item app-header__nav_item">
-          <%= link_to "Log In", login_path, class: "btn btn-primary" %>
-        </li>
+        <%= link_to "Login with Github", "/auth/github" %>
         <% end %>
-
+        </p>
       </ul>
     </nav>
   </header>

config/initializers/omniauth.rb

@@ -0,0 +1,4 @@
+# config/initializers/omniauth.rb
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider :github, ENV["GITHUB_CLIENT_ID"], ENV["GITHUB_CLIENT_SECRET"], scope: "user:email"
+end