Contents

class UserTasks < Volt::Task
  # Login a user, takes a login and password.  Login can be either a username
  # or an e-mail based on Volt.config.public.auth.use_username
  def login(login, password)
    query = { User.login_field => login }

    # During login we need access to the user's info even though we aren't the user
    Volt.skip_permissions do
      store._users.where(query).fetch_first do |user|
        fail 'User could not be found' unless user

        match_pass = BCrypt::Password.new(user._hashed_password)
        fail 'Password did not match' unless  match_pass == password
        fail 'app_secret is not configured' unless Volt.config.app_secret

        # TODO: returning here should be possible, but causes some issues
        # Salt the user id with the app_secret so the end user can't
        # tamper with the cookie
        signature = Digest::SHA256.hexdigest(salty_user_id(user._id))

        # Return user_id:hash on user id
        next "#{user._id}:#{signature}"
      end
    end
  end

  private

  def salty_user_id(user_id)
    "#{Volt.config.app_secret}::#{user_id}"
  end
end

Version data entries

5 entries across 5 versions & 1 rubygems

Version	Path
volt-0.9.0.pre3	app/volt/tasks/user_tasks.rb
volt-0.9.0.pre2	app/volt/tasks/user_tasks.rb
volt-0.9.0.pre1	app/volt/tasks/user_tasks.rb
volt-0.8.27.beta9	app/volt/tasks/user_tasks.rb
volt-0.8.27.beta8	app/volt/tasks/user_tasks.rb