Question

I am trying to refactor the railstutorial authorization mechanism.

My version of rails is 3.2.0 and I am using ruby 1.9.3-p0 and postrgresql 9.1.

So far, my tests are passing when it comes to a failed attempt to sigin but the successfull sign in fails.(The reason is that I have to refactor the old signin mechanism)

Here is my session helpers sign_in function:

def sign_in(employee)
  cookies.permanent.signed[:remember_token] = [employee.id, employee.salt]
  self.current_employee = employee
end.

One problem I see immediately with the sign_in function is that has_secure_password already takes care of the encryption and salt etc … my thinking was that maybe I should use password_digest instead of employee.salt, but that failed as well.

I would like to have my cookies expire after two hours. I found this option at api.rubyonrails.org under cookies.

 cookies[:key] = {
                  value => "employee.id, employee.salt",
                  expires => 2.hours.from.now
                  }

Another question I have has to do with the fact that has_secure_password already has an authenticate method so that means that I do not have to use the authenticate definition defined in the employee model,(user model) in the rails tutorial, but when I comment it out I get a flag reading:

NoMethodError: undefined method 'authenticate'

Here is my session controllers create action:

def create
  employee = Employee.authenticate(params[:session][:email],
                                   params[:session][:password])
  if employee.nil?
    flash.now[:error] = "Invalid email/password combination."
    @title = "Sign in"
    render 'new'
   else
    sign_in employee
    redirect_back_or employee
   end
 end

It seems the Employee.authenticate is a problem.

So I essentially have three question and they are as follows:

In the rails tutorial we go through a fairly lengthly process of encrypting and applying salt etc to the employees password. Since has_secure_password has this already taken care of, what variable would I pass to my functions or arguments that would capture the encrypted password?

The next question has to do with the expiration of the cookie, and how I would use that in the sign_in function?

Lastly, how do I use the authenticate method so that rails recognizes it as a genuine method?

Just for the record, I have searched through railsguide, api.rubyonrails.org and other questions asked on SO that are similar to this one. Of course this merely points up my lack of understanding of the principles, but I am learning and do take direction well.

Thanks for any thoughts, suggestions and or resources you might share with me.

Update
I re-read the api on has_secure_password and authenticate takes only one argument, namely an unencrypted password … so I have something to work with.

I still need any help or thoughts or suggestions that you might offer … thanks.

update
I found this article that deals with session timeouts:
http://madkingsmusings.blogspot.com/2011/05/session-timeouts-on-rails.html
I am still working to see if I can get it to work for me, but it is tailored for the railstutorial.
As for the other questions, Michael Hartl is busy pushing out the second edition of Ruby on Rails tutorial and in that edition he will be dealing with has_secure_password.

Answer 1

The new version of the railstutorial is available.

For the first and last question question… You’ll find the authentication extremely simple.
In the User model:

has_secure_password

In the SessionController:

  def create
    user = User.find_by_email(params[:session][:email])
    if user && user.authenticate(params[:session][:password])
      sign_in user
      redirect_back_or user
    else
      flash.now[:error] = 'Invalid email/password combination'
      render 'new'
    end
  end

In the SessionsHelper:

def sign_in(user)
  cookies[:remember_token] = user.remember_token
  current_user = user
end

It should have been obvious but I didn’t even think about looking for the code on github. Maybe someone else will appreciate the link.
Here is Hartl’s 2nd edition Sample_App source on github