Github Auth Setup

Users can now login through Github. Users which are admins can create or edit pages
powellmichael · Sep 3, 2013 · 68e2adf · 68e2adf
1 parent 9d6cd2e
commit 68e2adf
Show file tree

Hide file tree

Showing 18 changed files with 257 additions and 8 deletions.
diff --git a/Gemfile b/Gemfile
@@ -27,4 +27,6 @@ gem 'coffee-rails', '~> 4.0.0'
 gem 'jquery-rails'
 gem 'turbolinks'
 
-gem "watu_table_builder", :require => "table_builder"
+gem "watu_table_builder", :require => "table_builder"
+
+gem 'faraday'
diff --git a/Gemfile.lock b/Gemfile.lock
@@ -39,6 +39,8 @@ GEM
     erubis (2.7.0)
     execjs (1.4.0)
       multi_json (~> 1.0)
+    faraday (0.8.7)
+      multipart-post (~> 1.1)
     hike (1.2.3)
     i18n (0.6.4)
     jquery-rails (3.0.4)
@@ -50,6 +52,7 @@ GEM
     mime-types (1.23)
     minitest (4.7.5)
     multi_json (1.7.7)
+    multipart-post (1.2.0)
     pg (0.16.0)
     polyglot (0.3.3)
     rack (1.5.2)
@@ -125,6 +128,7 @@ PLATFORMS
 
 DEPENDENCIES
   coffee-rails (~> 4.0.0)
+  faraday
   jquery-rails
   pg
   rails (= 4.0.0)

diff --git a/README.md b/README.md
@@ -7,4 +7,13 @@ bundle install
 rake db:migrate
 rake import
 rails s
-```
+```
+
+Setup an application with Github and setup some environment variables
+
+```
+ENV['GITHUB_CLIENT_ID']
+ENV['GITHUB_CLIENT_SECRET']
+```
+
+Only admin users are allowed create or edit existing outlines.
diff --git a/app/assets/stylesheets/styles.css.scss b/app/assets/stylesheets/styles.css.scss
@@ -1013,3 +1013,9 @@ input[type="submit"]:hover, .btn a:hover {
 
 #jsl-video {float:left;}
 
+
+#notifications {
+  color: #fc9b15;
+  padding-left: 30px;
+  font-size: 20px;
+}
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
@@ -2,4 +2,32 @@ class ApplicationController < ActionController::Base
   # Prevent CSRF attacks by raising an exception.
   # For APIs, you may want to use :null_session instead.
   protect_from_forgery with: :exception
+
+  helper_method :current_user
+
+  def require_login
+    if current_user.guest?
+      redirect_to please_login_path, error: "Please log in"
+    end
+  end
+
+  def login(user)
+    @current_user = nil
+    session[:user_id] = user.id
+  end
+
+  def logout
+    @current_user = nil
+    reset_session
+  end
+
+  def current_user
+    return @current_user if @current_user
+
+    if session[:user_id]
+      @current_user = User.find_by_id(session[:user_id])
+    end
+    @current_user ||= Guest.new
+  end
+
 end
diff --git a/app/controllers/outlines_controller.rb b/app/controllers/outlines_controller.rb
@@ -1,5 +1,7 @@
 class OutlinesController < ApplicationController
 
+  before_action :require_login, only: [ :new, :create, :edit, :update ]
+
   def index
     @outlines = Outline.all.group_by { |outline| outline.publish_date.year }
     @outlines.each do |year,outlines|

diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
@@ -0,0 +1,40 @@
+require './lib/github'
+
+class SessionsController < ApplicationController
+
+  def new
+    redirect_to Github.login_url
+  end
+
+  def show
+  end
+
+  def destroy
+    logout
+    flash[:notice] = "You have been logged out."
+    redirect_to root_path
+  end
+
+  def callback
+    unless params[:code]
+      flash[:error] = "We didn't receive any authentication code from GitHub."
+    end
+
+    begin
+      user = Authentication.perform(params[:code])
+      login(user)
+    rescue => e
+      flash[:error] = "We're having trouble with logins right now. Please come back later."
+    end
+
+    if current_user.guest?
+      flash[:error] = "We're having trouble with logins right now. Please come back later."
+    end
+
+    if current_user.admin?
+      redirect_to root_path
+    else
+      redirect_to root_path
+    end
+  end
+end
diff --git a/app/models/authentication.rb b/app/models/authentication.rb
@@ -0,0 +1,5 @@
+class Authentication
+  def self.perform(code)
+    User.from_github Github.authenticate(code)
+  end
+end
diff --git a/app/models/guest.rb b/app/models/guest.rb
@@ -0,0 +1,9 @@
+class Guest
+  def guest?
+    true
+  end
+
+  def admin?
+    false
+  end
+end
diff --git a/app/models/user.rb b/app/models/user.rb
@@ -0,0 +1,46 @@
+class User < ActiveRecord::Base
+  has_one :application, inverse_of: :user
+
+  def self.from_github(data)
+    user = User.where(github_id: data['id']).first
+    user_data = {
+      name: data['name'],
+      email: data['email'],
+      location: data['location'],
+      github_id: data['id'],
+      avatar_url: data['avatar_url'],
+      gravatar_id: data['gravatar_id']
+    }
+    user ||= User.new(user_data)
+    user.username = data['login'] # always update the GitHub username
+    user.save
+    user
+  end
+
+  def guest?
+    false
+  end
+
+  def admin?
+    is_admin
+  end
+
+  def applying?
+    application && application.completed?('bio')
+  end
+
+  def apply
+    build_application unless application
+    application
+  end
+
+  def apply!
+    create_application unless application
+    application
+  end
+
+  def admin!
+    self.is_admin = true
+    save
+  end
+end
diff --git a/app/views/layouts/_footer.html.erb b/app/views/layouts/_footer.html.erb
@@ -2,7 +2,17 @@
   <div class="wrapper">
     <ul class="footer-nav">
       <%= yield :footer %>
+
+      <li>
+        <% if current_user.guest? %>
+          <%= link_to "login", login_path %>
+        <% else %>
+          <%= link_to "logout", logout_path, method: :delete %>
+        <% end %>
+      </li>
+
     </ul>
+
     <p>Content © Casimir Creative, LLC except where licensed otherwise.</p>
   </div>
 </div>
diff --git a/app/views/layouts/_header.html.erb b/app/views/layouts/_header.html.erb
@@ -7,4 +7,9 @@
       <%= yield :navigation %>
     </ul>
   </div>
+  <div id="notifications">
+    <% flash.each do |message| %>
+      <%= message.last %>
+    <% end %>
+  </div>
 </div>
diff --git a/app/views/schedule/show.html.erb b/app/views/schedule/show.html.erb
@@ -56,11 +56,16 @@
 </script>
 
 <%= content_for :footer do %>
-  <li><%= link_to "new", new_outline_path(outline: { publish_date: @schedule.current.to_param }) %></li>
-  <% if @schedule.can_edit? %>
+
+  <% if current_user.admin? %>
+    <li><%= link_to "new", new_outline_path(outline: { publish_date: @schedule.current.to_param }) %></li>
+  <% end %>
+
+  <% if @schedule.can_edit? and current_user.admin? %>
     <li><%= link_to "edit", "", class: "toggle-content-edit" %></li>
   <% end %>
   <li>
     <%= link_to "calendar", outlines_path %>
   </li>
+
 <% end %>
diff --git a/app/views/sessions/show.html.erb b/app/views/sessions/show.html.erb
@@ -0,0 +1 @@
+<h1>Please Login</h1>
diff --git a/config/routes.rb b/config/routes.rb
@@ -1,9 +1,13 @@
 Today::Application.routes.draw do
 
-  resources :outlines
-
-  root to: "schedule#show"
+  get '/please-login' => 'sessions#show', as: :please_login
+  get '/login' => 'sessions#new', as: :login
+  get '/github/callback' => 'sessions#callback', as: :github_callback
+  delete '/logout' => 'sessions#destroy', as: :logout
 
   get "/:date_string", to: "schedule#show", as: "schedule"
 
+  root to: "schedule#show"
+  resources :outlines
+
 end
diff --git a/db/migrate/20130903213106_create_users.rb b/db/migrate/20130903213106_create_users.rb
@@ -0,0 +1,16 @@
+class CreateUsers < ActiveRecord::Migration
+  def change
+    create_table 'users' do |t|
+      t.string 'name'
+      t.string 'email'
+      t.string 'location'
+      t.string 'username'
+      t.string 'github_id'
+      t.string 'avatar_url'
+      t.string 'gravatar_id'
+      t.boolean 'is_admin', default: false
+
+      t.timestamps
+    end
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
@@ -11,7 +11,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20130730204022) do
+ActiveRecord::Schema.define(version: 20130903213106) do
 
   create_table "outlines", force: true do |t|
     t.string   "title"
@@ -21,4 +21,17 @@
     t.datetime "updated_at"
   end
 
+  create_table "users", force: true do |t|
+    t.string   "name"
+    t.string   "email"
+    t.string   "location"
+    t.string   "username"
+    t.string   "github_id"
+    t.string   "avatar_url"
+    t.string   "gravatar_id"
+    t.boolean  "is_admin",    default: false
+    t.datetime "created_at"
+    t.datetime "updated_at"
+  end
+
 end
diff --git a/lib/github.rb b/lib/github.rb
@@ -0,0 +1,44 @@
+class Github
+  def self.login_url
+    "https://github.com/login/oauth/authorize?client_id=#{ENV.fetch('GITHUB_CLIENT_ID')}"
+  end
+
+  def self.authenticate(code)
+    conn = Faraday.new(:url => 'https://github.com') do |c|
+      c.use Faraday::Response::Logger
+      c.use Faraday::Adapter::NetHttp
+    end
+
+    options = {
+      client_id: ENV.fetch('GITHUB_CLIENT_ID'),
+      client_secret: ENV.fetch('GITHUB_CLIENT_SECRET'),
+      code: code
+    }
+
+    options = options.map {|k,v| "#{k}=#{v}"}.join('&')
+
+    response = conn.post do |req|
+      req.url '/login/oauth/access_token'
+      req.headers['Accept'] = 'application/json'
+      req.headers['User-Agent'] = user_agent
+      req.body = options
+    end
+    access_token = JSON.parse(response.body)['access_token']
+
+    conn = Faraday.new(:url => 'https://api.github.com') do |c|
+      c.use Faraday::Response::Logger
+      c.use Faraday::Adapter::NetHttp
+    end
+
+    response = conn.get do |req|
+      req.url '/user'
+      req.headers['User-Agent'] = user_agent
+      req.params['access_token'] = access_token
+    end
+    JSON.parse(response.body)
+  end
+
+  def self.user_agent
+    'github.com:JumpstartLab/enrollist'
+  end
+end