summaryrefslogtreecommitdiff
path: root/users
AgeCommit message (Collapse)Author
2013-10-18test logging in through the API using python with umlautsAzul
2013-10-18Merge pull request #98 from jessib/feature/billing-past-due-subscriptionsazul
Feature/billing past due subscriptions
2013-10-17Merge pull request #102 from azul/feature/3602-email-blacklistjessib
blacklist system logins for aliases and logins
2013-10-17blacklist system logins for aliases and loginsAzul
We blacklist based on three things: * blacklist in APP_CONFIG[:handle_blacklist] * emails in RFC 2142 * usernames in /etc/passwd The latter two can be allowed by explicitly whitelisting them in APP_CONFIG[:handle_whitelist]. We stick to blocking names that have been configured as both blacklisted and whitelisted - better be save than sorry.
2013-10-17use latest version of srp_js to fix #4002Azul
We were not encoding the srp password properly before. So umlauts in the password would cause the login procedure to fail.
2013-10-01Allow admins to view past-due subscriptions.jessib
2013-09-26Since local part of email is case sensitive, want to allow remote email ↵jessib
addresses with uppercase letters in local part.
2013-09-25visual feedback when submitting forms (#3164)Azul
This also helps with the failing integration test. We needed a way to tell the ajax request was back. Observing the button state now works for that.
2013-09-24use token auth when accessing the api from webappAzul
One failing integration test still needs to be fixed
2013-09-23This ensures that email addresses contain only lowercase letters, and that ↵jessib
an identity's destination is a valid Email.
2013-09-23Merge branch 'develop' into feature/only_lower_case_aliasesjessib
2013-09-23security fix: clear srp data from db asap (#3686)Azul
This is a quick fix for iSEC issue #13.
2013-09-19Merge branch 'develop' into feature/only_lower_case_aliasesjessib
2013-09-19Merge pull request #82 from azul/feature/sessions-expirejessib
Feature/sessions expire
2013-09-18user.account shortcut to Account.new(user)Azul
2013-09-17integration tests for session expiryAzul
2013-09-09Merge branch 'develop' into feature/only_lower_case_aliasesjessib
2013-09-05For moment, have identity's address handle aliased from login so we can use ↵jessib
LoginFormatValidation. However, this is not how we will want it eventually. One issue is that the errors messages are set on login, rather than the appropriate field.
2013-09-05Ensure that address in identity really is a LocalEmail.jessib
2013-09-05Test of failing to add non-local email address as an identity's address.jessib
2013-09-05Move handle method to Email model and have it work for local and non-local ↵jessib
emails.
2013-09-04use /login instead of /sessions/new and test successful loginAzul
2013-09-04fix login form - use api session urlAzul
There's no non api sessions resource anymore.
2013-09-03Merge pull request #73 from azul/bugfix/3623-teardown-test-data-properlyjessib
Bugfix/3623 teardown test data properly
2013-09-03Merge pull request #75 from azul/feature/token-expiryjessib
Token expiry
2013-09-03Merge pull request #76 from azul/feature/3600-visual-feedback-on-failed-signupjessib
Ensure json requests get json error response on failure
2013-09-03clearify usage of V1::UsersController#index for autocompleteAzul
[skip ci]
2013-09-03use the login logout named route instead of sessions resourceAzul
The main part of the sessions resource now lives in the API. the two named routes are just fine for what is left.
2013-09-03remove email aliases controller - we don't use it anymoreAzul
2013-09-03Cleanup sessions controller - webapp logs in through the api.Azul
So the #create and #update actions were not needed anymore. Also removed the tests
2013-09-03Account: Composition to handle User and its identitiesAzul
We have a lot of things that act upon a user record and one or more of it's identities at the same time: * Sing up: Create a user and it's initial identity * Rename: Change the username and create a new identity, turn old into an alias * Cancel Account: Remove user and all their identities. In order to keep the User and Identity behaviour isolated but still have a this logic represented in a sinle place the Account model deals with all these things. We could have overwritten the User#create, User#update and User#destroy methods instead. But then we would always create identities, even if we only need a user (for example in tests).
2013-09-03cleanup records after running user integration testsAzul
2013-09-03simplify users_controller_testAzul
2013-09-03don't leave id records behind when unit testingAzul
2013-09-03expire token according to config setting auth:token_expires_afterAzul
2013-09-03use Token#authenticate for authenticationAzul
This will return the user. But we can add timestamp validations and updates here.
2013-09-03integration test for displaying internal server error during signupAzul
2013-09-02Remove references to email_settings controller, which has been removed. An ↵jessib
identities controller will replace it.
2013-08-30there's no need for User#find_by_param. clean it upAzul
2013-08-27Not ideal way to do it, but was proving complicated to have a config file ↵jessib
specify which gems for which environments. Here, we have the billing gem included for the development and test environments only, hardcoded in the Gemfile. Then we show the links to billing based on a config file setting. The setting itself could be used to specify different types of billing, but isn't yet.
2013-08-27Merge branch 'master' into billing_with_testsjessib
2013-08-27refactor: Changing the py test to use less globals and session only locally.Azul
2013-08-27use token to update user passwordAzul
2013-08-27separate different tests for showing non existant userAzul
This way the failed stubbing errors were more telling
2013-08-27token.user will get you the right userAzul
This way we can stub the token to return the user directly. Stubbing User.find_by_param is not a good idea as it will make all calls to User#find_by_param with a different id fail.
2013-08-27do not redirect if no token presentAzul
So far we allow two mechanisms of authentication: * session based * token based If token fails session will be atempted in most cases. So we can't just redirect here or we get a double render error.
2013-08-27make sure find_record still works with real recordsAzul
2013-08-27clear token on logout with testAzul
2013-08-27basic testing for token based auth in testsAzul
2013-08-27first steps towards enabling token based authAzul