From 0c79df9874c59fbaa5c845e07d8fa1b4bbc23b9c Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Thu, 11 Oct 2012 17:11:32 +0200
Subject: use ruby-srp 0.1.3 which returns the user on authenticate call

Also removed a few hooks to User.current. Will replace with current_user
---
 users/app/controllers/sessions_controller.rb | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/sessions_controller.rb b/users/app/controllers/sessions_controller.rb
index 284c0e2..4a1107d 100644
--- a/users/app/controllers/sessions_controller.rb
+++ b/users/app/controllers/sessions_controller.rb
@@ -8,19 +8,15 @@ class SessionsController < ApplicationController
   def create
     @user = User.find_by_param(params[:login])
     session[:handshake] = @user.initialize_auth(params['A'].hex)
-    User.current = @user #?
     render :json => session[:handshake]
   rescue RECORD_NOT_FOUND
     render :json => {:errors => {:login => ["unknown user"]}}
   end
 
   def update
-    # TODO: validate the id belongs to the session
-    @user = User.find_by_param(params[:id])
     @srp_session = session.delete(:handshake)
-    @srp_session.authenticate!(params[:client_auth].hex)
+    @user = @srp_session.authenticate!(params[:client_auth].hex)
     session[:user_id] = @user.id
-    User.current = @user #?
     render :json => @srp_session
   rescue WRONG_PASSWORD
     session[:handshake] = nil
@@ -29,7 +25,6 @@ class SessionsController < ApplicationController
 
   def destroy
     session[:user_id] = nil
-    User.current = nil #?
     redirect_to root_path
   end
 end
-- 
cgit v1.2.3


From 28b51dc38ad71b8a7468aa91d8ce8d3059d9bb69 Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Thu, 11 Oct 2012 17:41:00 +0200
Subject: current_user and authenticate methods

---
 users/app/controllers/application_controller.rb | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 create mode 100644 users/app/controllers/application_controller.rb

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/application_controller.rb b/users/app/controllers/application_controller.rb
new file mode 100644
index 0000000..64e1a55
--- /dev/null
+++ b/users/app/controllers/application_controller.rb
@@ -0,0 +1,14 @@
+class ApplicationController < ActionController::Base
+  protect_from_forgery
+
+  private
+
+  def current_user
+    @current_user ||= User.find(session[:user_id]) if session[:user_id]
+  end
+  helper_method :current_user
+
+  def authorize
+    redirect_to login_url, alert: "Not authorized" if current_user.nil?
+  end
+end
-- 
cgit v1.2.3


From 194e924cb7c36eafa01b68c74774505e170e47ac Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Tue, 30 Oct 2012 12:32:10 +0100
Subject: adding in warden with a basic strategy

currently failing because we are not setting the content-type header.
---
 users/app/controllers/application_controller.rb |  2 +-
 users/app/controllers/sessions_controller.rb    | 16 ++++------------
 2 files changed, 5 insertions(+), 13 deletions(-)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/application_controller.rb b/users/app/controllers/application_controller.rb
index 64e1a55..8388dda 100644
--- a/users/app/controllers/application_controller.rb
+++ b/users/app/controllers/application_controller.rb
@@ -4,7 +4,7 @@ class ApplicationController < ActionController::Base
   private
 
   def current_user
-    @current_user ||= User.find(session[:user_id]) if session[:user_id]
+    @current_user ||= env['warden'].user
   end
   helper_method :current_user
 
diff --git a/users/app/controllers/sessions_controller.rb b/users/app/controllers/sessions_controller.rb
index 4a1107d..3872866 100644
--- a/users/app/controllers/sessions_controller.rb
+++ b/users/app/controllers/sessions_controller.rb
@@ -6,21 +6,13 @@ class SessionsController < ApplicationController
   end
 
   def create
-    @user = User.find_by_param(params[:login])
-    session[:handshake] = @user.initialize_auth(params['A'].hex)
-    render :json => session[:handshake]
-  rescue RECORD_NOT_FOUND
-    render :json => {:errors => {:login => ["unknown user"]}}
+    debugger
+    env['warden'].authenticate!
   end
 
   def update
-    @srp_session = session.delete(:handshake)
-    @user = @srp_session.authenticate!(params[:client_auth].hex)
-    session[:user_id] = @user.id
-    render :json => @srp_session
-  rescue WRONG_PASSWORD
-    session[:handshake] = nil
-    render :json => {:errors => {"password" => ["wrong password"]}}
+    debugger
+    env['warden'].authenticate!
   end
 
   def destroy
-- 
cgit v1.2.3


From bcc0f11caeef1b09712b9b62e1607237885d1af5 Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Tue, 30 Oct 2012 14:42:04 +0100
Subject: using rails_warden bit of refactoring

without rails_warden the failure app action was not getting set properly.
---
 users/app/controllers/sessions_controller.rb | 2 --
 1 file changed, 2 deletions(-)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/sessions_controller.rb b/users/app/controllers/sessions_controller.rb
index 3872866..7b7799c 100644
--- a/users/app/controllers/sessions_controller.rb
+++ b/users/app/controllers/sessions_controller.rb
@@ -6,12 +6,10 @@ class SessionsController < ApplicationController
   end
 
   def create
-    debugger
     env['warden'].authenticate!
   end
 
   def update
-    debugger
     env['warden'].authenticate!
   end
 
-- 
cgit v1.2.3


From f2825d10e6447ea766fee085841e2b92b0477976 Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Tue, 30 Oct 2012 15:36:16 +0100
Subject: sending proper error messages from warden.

still need to translate these
---
 users/app/controllers/sessions_controller.rb | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/sessions_controller.rb b/users/app/controllers/sessions_controller.rb
index 7b7799c..06d55eb 100644
--- a/users/app/controllers/sessions_controller.rb
+++ b/users/app/controllers/sessions_controller.rb
@@ -3,14 +3,17 @@ class SessionsController < ApplicationController
   skip_before_filter :verify_authenticity_token
 
   def new
+    if warden.winning_strategy
+      @errors = warden.winning_strategy.message
+    end
   end
 
   def create
-    env['warden'].authenticate!
+    authenticate!
   end
 
   def update
-    env['warden'].authenticate!
+    authenticate!
   end
 
   def destroy
-- 
cgit v1.2.3


From 4b7333eec8eaf0c01227ade9d77a21f7a879ff0b Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Wed, 31 Oct 2012 17:39:06 +0100
Subject: using controller extensions for application controller by hand

---
 users/app/controllers/application_controller.rb         | 14 --------------
 .../controllers/controller_extension/authentication.rb  | 17 +++++++++++++++++
 2 files changed, 17 insertions(+), 14 deletions(-)
 delete mode 100644 users/app/controllers/application_controller.rb
 create mode 100644 users/app/controllers/controller_extension/authentication.rb

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/application_controller.rb b/users/app/controllers/application_controller.rb
deleted file mode 100644
index 64e1a55..0000000
--- a/users/app/controllers/application_controller.rb
+++ /dev/null
@@ -1,14 +0,0 @@
-class ApplicationController < ActionController::Base
-  protect_from_forgery
-
-  private
-
-  def current_user
-    @current_user ||= User.find(session[:user_id]) if session[:user_id]
-  end
-  helper_method :current_user
-
-  def authorize
-    redirect_to login_url, alert: "Not authorized" if current_user.nil?
-  end
-end
diff --git a/users/app/controllers/controller_extension/authentication.rb b/users/app/controllers/controller_extension/authentication.rb
new file mode 100644
index 0000000..507b62f
--- /dev/null
+++ b/users/app/controllers/controller_extension/authentication.rb
@@ -0,0 +1,17 @@
+module ControllerExtension::Authentication
+  extend ActiveSupport::Concern
+
+  private
+
+  included do
+    helper_method :current_user
+  end
+
+  def current_user
+    @current_user ||= User.find(session[:user_id]) if session[:user_id]
+  end
+
+  def authorize
+    redirect_to login_url, :alert => "Not authorized" if current_user.nil?
+  end
+end
-- 
cgit v1.2.3


From 6c60b179a09030da985462d15dbdf076367b5ea4 Mon Sep 17 00:00:00 2001
From: jessib <jessib@riseup.net>
Date: Wed, 31 Oct 2012 12:10:07 -0700
Subject: Code to check administration (and ugly test display.) This includes
 example config file.

---
 .../controller_extension/authentication.rb          | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/controller_extension/authentication.rb b/users/app/controllers/controller_extension/authentication.rb
index 507b62f..c3342f3 100644
--- a/users/app/controllers/controller_extension/authentication.rb
+++ b/users/app/controllers/controller_extension/authentication.rb
@@ -4,14 +4,31 @@ module ControllerExtension::Authentication
   private
 
   included do
-    helper_method :current_user
+    helper_method :current_user, :logged_in?, :admin?
   end
 
   def current_user
     @current_user ||= User.find(session[:user_id]) if session[:user_id]
   end
 
+  def logged_in?
+    !!current_user
+  end
+
   def authorize
-    redirect_to login_url, :alert => "Not authorized" if current_user.nil?
+    access_denied unless logged_in?
   end
+
+  def access_denied
+    redirect_to login_url, :alert => "Not authorized"
+  end
+
+  def admin?
+    current_user && current_user.is_admin?
+  end
+
+  def authorize_admin
+    access_denied unless admin?
+  end
+
 end
-- 
cgit v1.2.3


From e1fc3f4850ee73e0591bd67a92b104db4f63e4cb Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Sun, 4 Nov 2012 21:01:27 +0100
Subject: stubbing current_user the warden way

---
 users/app/controllers/controller_extension/authentication.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/controller_extension/authentication.rb b/users/app/controllers/controller_extension/authentication.rb
index 50cf0d1..0408b77 100644
--- a/users/app/controllers/controller_extension/authentication.rb
+++ b/users/app/controllers/controller_extension/authentication.rb
@@ -8,7 +8,7 @@ module ControllerExtension::Authentication
   end
 
   def current_user
-    @current_user ||= env['warden'].user
+    @current_user ||= request.env['warden'].user
   end
 
   def logged_in?
-- 
cgit v1.2.3


From ef90c45998b33ba8606c3786875e21496ace4686 Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Sun, 4 Nov 2012 22:14:13 +0100
Subject: fixed functional tests

---
 users/app/controllers/controller_extension/authentication.rb | 4 ++--
 users/app/controllers/sessions_controller.rb                 | 6 ++----
 2 files changed, 4 insertions(+), 6 deletions(-)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/controller_extension/authentication.rb b/users/app/controllers/controller_extension/authentication.rb
index 0408b77..87f7921 100644
--- a/users/app/controllers/controller_extension/authentication.rb
+++ b/users/app/controllers/controller_extension/authentication.rb
@@ -7,8 +7,8 @@ module ControllerExtension::Authentication
     helper_method :current_user, :logged_in?, :admin?
   end
 
-  def current_user
-    @current_user ||= request.env['warden'].user
+  def authentication_error
+    warden.winning_strategy.try(:message)
   end
 
   def logged_in?
diff --git a/users/app/controllers/sessions_controller.rb b/users/app/controllers/sessions_controller.rb
index 06d55eb..722265a 100644
--- a/users/app/controllers/sessions_controller.rb
+++ b/users/app/controllers/sessions_controller.rb
@@ -3,9 +3,7 @@ class SessionsController < ApplicationController
   skip_before_filter :verify_authenticity_token
 
   def new
-    if warden.winning_strategy
-      @errors = warden.winning_strategy.message
-    end
+    @errors = authentication_error
   end
 
   def create
@@ -17,7 +15,7 @@ class SessionsController < ApplicationController
   end
 
   def destroy
-    session[:user_id] = nil
+    logout
     redirect_to root_path
   end
 end
-- 
cgit v1.2.3


From da2804c8f8a800851fa1863f579e2b8e9a57b4cc Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Tue, 6 Nov 2012 11:51:10 +0100
Subject: first steps towards warden srp testing

---
 users/app/controllers/sessions_controller.rb | 1 +
 1 file changed, 1 insertion(+)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/sessions_controller.rb b/users/app/controllers/sessions_controller.rb
index 722265a..72e2892 100644
--- a/users/app/controllers/sessions_controller.rb
+++ b/users/app/controllers/sessions_controller.rb
@@ -11,6 +11,7 @@ class SessionsController < ApplicationController
   end
 
   def update
+    debugger
     authenticate!
   end
 
-- 
cgit v1.2.3


From 63c5b2cafdefbd9b13297faa57ee2f18a5c07bf5 Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Fri, 9 Nov 2012 16:05:22 +0100
Subject: got integration test and login flow to work

---
 users/app/controllers/sessions_controller.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/sessions_controller.rb b/users/app/controllers/sessions_controller.rb
index 72e2892..486f67e 100644
--- a/users/app/controllers/sessions_controller.rb
+++ b/users/app/controllers/sessions_controller.rb
@@ -11,8 +11,8 @@ class SessionsController < ApplicationController
   end
 
   def update
-    debugger
     authenticate!
+    render :json => session.delete(:handshake)
   end
 
   def destroy
-- 
cgit v1.2.3


From 7e5db2a28ba872154e5f5002bb84d149a512e36e Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Thu, 22 Nov 2012 10:33:21 +0100
Subject: using the new srp.js api

---
 users/app/controllers/sessions_controller.rb | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/sessions_controller.rb b/users/app/controllers/sessions_controller.rb
index 486f67e..66c1c4f 100644
--- a/users/app/controllers/sessions_controller.rb
+++ b/users/app/controllers/sessions_controller.rb
@@ -3,7 +3,9 @@ class SessionsController < ApplicationController
   skip_before_filter :verify_authenticity_token
 
   def new
-    @errors = authentication_error
+    if @errors = authentication_error
+      render :status => 422
+    end
   end
 
   def create
-- 
cgit v1.2.3


From cec9ad7c514f2f3c767bd12bfc3df28db4d1a98b Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Thu, 22 Nov 2012 11:36:25 +0100
Subject: using client side validations for login

---
 users/app/controllers/sessions_controller.rb | 1 +
 1 file changed, 1 insertion(+)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/sessions_controller.rb b/users/app/controllers/sessions_controller.rb
index 66c1c4f..32d1ddc 100644
--- a/users/app/controllers/sessions_controller.rb
+++ b/users/app/controllers/sessions_controller.rb
@@ -3,6 +3,7 @@ class SessionsController < ApplicationController
   skip_before_filter :verify_authenticity_token
 
   def new
+    @session = Session.new
     if @errors = authentication_error
       render :status => 422
     end
-- 
cgit v1.2.3


From 6d5f8d0f993093b51d1f11bb528c535dcf88a969 Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Thu, 22 Nov 2012 13:05:32 +0100
Subject: beautify login workflow

* translating error messages
* not caching login and password in js anymore
* catching non responses
---
 users/app/controllers/controller_extension/authentication.rb | 8 ++++++--
 users/app/controllers/sessions_controller.rb                 | 3 ++-
 2 files changed, 8 insertions(+), 3 deletions(-)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/controller_extension/authentication.rb b/users/app/controllers/controller_extension/authentication.rb
index 87f7921..6ac7a5b 100644
--- a/users/app/controllers/controller_extension/authentication.rb
+++ b/users/app/controllers/controller_extension/authentication.rb
@@ -7,8 +7,12 @@ module ControllerExtension::Authentication
     helper_method :current_user, :logged_in?, :admin?
   end
 
-  def authentication_error
-    warden.winning_strategy.try(:message)
+  def authentication_errors
+    return unless errors = warden.winning_strategy.try(:message)
+    errors.inject({}) do |translated,err|
+      translated[err.first] = I18n.t(err.last)
+      translated
+    end
   end
 
   def logged_in?
diff --git a/users/app/controllers/sessions_controller.rb b/users/app/controllers/sessions_controller.rb
index 32d1ddc..bc910b5 100644
--- a/users/app/controllers/sessions_controller.rb
+++ b/users/app/controllers/sessions_controller.rb
@@ -4,7 +4,8 @@ class SessionsController < ApplicationController
 
   def new
     @session = Session.new
-    if @errors = authentication_error
+    if authentication_errors
+      @errors = authentication_errors
       render :status => 422
     end
   end
-- 
cgit v1.2.3


From 33c124aa67788d5c64906f7b3e21ad383577b2a8 Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Thu, 22 Nov 2012 17:31:18 +0100
Subject: basic user edit form and actions

---
 users/app/controllers/users_controller.rb | 10 ++++++++++
 1 file changed, 10 insertions(+)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/users_controller.rb b/users/app/controllers/users_controller.rb
index 82d2eac..46ecc32 100644
--- a/users/app/controllers/users_controller.rb
+++ b/users/app/controllers/users_controller.rb
@@ -15,4 +15,14 @@ class UsersController < ApplicationController
     @user = e.document
     respond_with(@user, :location => new_user_path)
   end
+
+  def edit
+    @user = current_user
+  end
+
+  def update
+    @user = current_user
+    @user.update!(params[:user])
+    respond_with(@user, :location => edit_user_path(@user))
+  end
 end
-- 
cgit v1.2.3


From 3ce5a25afef3b938c2bbbe8ce481f2af9e0c24dc Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Fri, 23 Nov 2012 10:24:46 +0100
Subject: test editing user settings

---
 users/app/controllers/users_controller.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/users_controller.rb b/users/app/controllers/users_controller.rb
index 46ecc32..ecab53b 100644
--- a/users/app/controllers/users_controller.rb
+++ b/users/app/controllers/users_controller.rb
@@ -22,7 +22,7 @@ class UsersController < ApplicationController
 
   def update
     @user = current_user
-    @user.update!(params[:user])
+    @user.update(params[:user])
     respond_with(@user, :location => edit_user_path(@user))
   end
 end
-- 
cgit v1.2.3


From ee3c9146e4bbe93ec1f00ee45386a82ec4363c4d Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Fri, 23 Nov 2012 12:11:11 +0100
Subject: identify user by id so rerendering the form does not use new invalid
 login

---
 users/app/controllers/users_controller.rb | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/users_controller.rb b/users/app/controllers/users_controller.rb
index ecab53b..3913d0d 100644
--- a/users/app/controllers/users_controller.rb
+++ b/users/app/controllers/users_controller.rb
@@ -1,6 +1,8 @@
 class UsersController < ApplicationController
 
-  skip_before_filter :verify_authenticity_token
+  skip_before_filter :verify_authenticity_token, :only => [:create]
+
+  before_filter :fetch_user, :only => [:edit, :update]
 
   respond_to :json, :html
 
@@ -17,12 +19,17 @@ class UsersController < ApplicationController
   end
 
   def edit
-    @user = current_user
   end
 
   def update
-    @user = current_user
-    @user.update(params[:user])
+    @user.update_attributes(params[:user])
     respond_with(@user, :location => edit_user_path(@user))
   end
+
+  protected
+
+  def fetch_user
+    @user = User.find_by_param(params[:id])
+    access_denied unless @user == current_user
+  end
 end
-- 
cgit v1.2.3


From 595518684b9c4364f96c97a84cc481b5ae0da981 Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Mon, 26 Nov 2012 11:54:11 +0100
Subject: simplified controller and adjusted tests

Also added #assert_json_error to tests.
---
 users/app/controllers/users_controller.rb | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/users_controller.rb b/users/app/controllers/users_controller.rb
index 3913d0d..5be1fa9 100644
--- a/users/app/controllers/users_controller.rb
+++ b/users/app/controllers/users_controller.rb
@@ -11,11 +11,8 @@ class UsersController < ApplicationController
   end
 
   def create
-    @user = User.create!(params[:user])
-    respond_with(@user, :location => root_url, :notice => "Signed up!")
-  rescue VALIDATION_FAILED => e
-    @user = e.document
-    respond_with(@user, :location => new_user_path)
+    @user = User.create(params[:user])
+    respond_with @user
   end
 
   def edit
@@ -23,7 +20,7 @@ class UsersController < ApplicationController
 
   def update
     @user.update_attributes(params[:user])
-    respond_with(@user, :location => edit_user_path(@user))
+    respond_with @user
   end
 
   protected
-- 
cgit v1.2.3


From bf74255d1530fe5852dc6e6c27ef975ce9aa8d3c Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Mon, 26 Nov 2012 14:32:50 +0100
Subject: added admin menu and user index action

---
 users/app/controllers/users_controller.rb | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/users_controller.rb b/users/app/controllers/users_controller.rb
index 5be1fa9..4912ac8 100644
--- a/users/app/controllers/users_controller.rb
+++ b/users/app/controllers/users_controller.rb
@@ -3,9 +3,14 @@ class UsersController < ApplicationController
   skip_before_filter :verify_authenticity_token, :only => [:create]
 
   before_filter :fetch_user, :only => [:edit, :update]
+  before_filter :authorize_admin, :only => [:index]
 
   respond_to :json, :html
 
+  def index
+    @users = User.all
+  end
+
   def new
     @user = User.new
   end
-- 
cgit v1.2.3


From 51ba799f98113b7112f2968fc80e4d291924b3bf Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Mon, 26 Nov 2012 16:34:46 +0100
Subject: basic users index with typeahead search

---
 users/app/controllers/users_controller.rb | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/users_controller.rb b/users/app/controllers/users_controller.rb
index 4912ac8..09199f0 100644
--- a/users/app/controllers/users_controller.rb
+++ b/users/app/controllers/users_controller.rb
@@ -8,7 +8,13 @@ class UsersController < ApplicationController
   respond_to :json, :html
 
   def index
-    @users = User.all
+    if params[:query]
+      @users = User.by_login.startkey(params[:query]).endkey(params[:query].succ)
+    else
+      @users = User.by_created_at.descending
+    end
+    @users = @users.limit(5)
+    respond_with @users.map(&:login).sort
   end
 
   def new
-- 
cgit v1.2.3


From a941c89293bcbb067c6152b63765ead38a484b81 Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Mon, 26 Nov 2012 18:06:21 +0100
Subject: basic typeahead and user querying working

---
 users/app/controllers/users_controller.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/users_controller.rb b/users/app/controllers/users_controller.rb
index 09199f0..925b584 100644
--- a/users/app/controllers/users_controller.rb
+++ b/users/app/controllers/users_controller.rb
@@ -13,7 +13,7 @@ class UsersController < ApplicationController
     else
       @users = User.by_created_at.descending
     end
-    @users = @users.limit(5)
+    @users = @users.limit(10)
     respond_with @users.map(&:login).sort
   end
 
-- 
cgit v1.2.3


From 277b9f98bfbe2ef0217dfd17c8d9d6597369b903 Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Wed, 28 Nov 2012 15:13:47 +0100
Subject: admins can destroy users

I changed the permissions a little to be more consistent.

Now:
* admins can edit users
* users can destroy themselves.

There's no ui for either of them but theoretically they could. Not sure this is what we want though.
---
 users/app/controllers/users_controller.rb | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/users_controller.rb b/users/app/controllers/users_controller.rb
index 925b584..3407191 100644
--- a/users/app/controllers/users_controller.rb
+++ b/users/app/controllers/users_controller.rb
@@ -2,7 +2,7 @@ class UsersController < ApplicationController
 
   skip_before_filter :verify_authenticity_token, :only => [:create]
 
-  before_filter :fetch_user, :only => [:edit, :update]
+  before_filter :fetch_user, :only => [:edit, :update, :destroy]
   before_filter :authorize_admin, :only => [:index]
 
   respond_to :json, :html
@@ -34,10 +34,15 @@ class UsersController < ApplicationController
     respond_with @user
   end
 
+  def destroy
+    @user.destroy
+    redirect_to users_path
+  end
+
   protected
 
   def fetch_user
     @user = User.find_by_param(params[:id])
-    access_denied unless @user == current_user
+    access_denied unless admin? or (@user == current_user)
   end
 end
-- 
cgit v1.2.3


From 2a928455f9dcefa465b80b79768ba1d1a423e6e9 Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Mon, 3 Dec 2012 10:52:01 +0100
Subject: enable users to cancel their account

---
 users/app/controllers/users_controller.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'users/app/controllers')

diff --git a/users/app/controllers/users_controller.rb b/users/app/controllers/users_controller.rb
index 3407191..cffc8c6 100644
--- a/users/app/controllers/users_controller.rb
+++ b/users/app/controllers/users_controller.rb
@@ -36,7 +36,7 @@ class UsersController < ApplicationController
 
   def destroy
     @user.destroy
-    redirect_to users_path
+    redirect_to admin? ? users_path : login_path
   end
 
   protected
-- 
cgit v1.2.3