module Locomotive::Steam
module Middlewares
# Hide a site behind a password to prevent public access.
# If page with the "lock_screen" handle exists, then it
# will be used to display the login form. Otherwise, a very basic
# form will be displayed.
#
class PrivateAccess < ThreadSafe
include Concerns::Helpers
def _call
return if env['steam.private_access_disabled']
if site.private_access
log "Site with private access"
if access_granted?
store_password
else
render_lock_screen
end
end
end
private
def render_lock_screen
if page = services.page_finder.by_handle('lock_screen', false)
log "Found custom lock screen: #{page.title}"
env['steam.page'] = page
else
render_response(lock_screen_html, 403)
end
end
def access_granted?
!submitted_password.blank? && submitted_password == site.password
end
def submitted_password
params[:private_access_password] || request.session[:private_access_password]
end
def store_password
request.session[:private_access_password] = params[:private_access_password] if params[:private_access_password].present?
end
def lock_screen_html
<<-HTML
#{site.name} - Password protected
HTML
end
end
end
end