Regan's OAuth Media Ranker

.gitignore

@@ -15,3 +15,4 @@
 
 # Ignore Byebug command history file.
 .byebug_history
+.env

Gemfile

@@ -39,6 +39,9 @@ gem 'jbuilder', '~> 2.5'
 # Use the Foundation CSS framework
 gem 'foundation-rails'
 
+gem 'omniauth'
+gem 'omniauth-github'
+
 group :development, :test do
   # Call 'byebug' anywhere in the code to stop execution and get a debugger console
   gem 'byebug', platform: :mri
@@ -64,6 +67,7 @@ group :development do
   # Spring speeds up development by keeping your application running in the background. Read more: https://github.com/rails/spring
   gem 'spring'
   gem 'spring-watcher-listen', '~> 2.0.0'
+  gem 'dotenv-rails'
 end
 
 # Windows does not include zoneinfo files, so bundle the tzinfo-data gem

Gemfile.lock

@@ -60,15 +60,22 @@ GEM
       execjs
     coffee-script-source (1.12.2)
     concurrent-ruby (1.0.5)
+    dotenv (2.2.0)
+    dotenv-rails (2.2.0)
+      dotenv (= 2.2.0)
+      railties (>= 3.2, < 5.1)
     erubis (2.7.0)
     execjs (2.7.0)
+    faraday (0.11.0)
+      multipart-post (>= 1.2, < 3)
     ffi (1.9.18)
     foundation-rails (6.3.0.0)
       railties (>= 3.1.0)
       sass (>= 3.3.0, < 3.5)
       sprockets-es6 (>= 0.9.0)
     globalid (0.3.7)
       activesupport (>= 4.1.0)
+    hashie (3.5.5)
     i18n (0.8.1)
     jbuilder (2.6.3)
       activesupport (>= 3.0.0, < 5.2)
@@ -77,6 +84,7 @@ GEM
       rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
+    jwt (1.5.6)
     listen (3.0.8)
       rb-fsevent (~> 0.9, >= 0.9.4)
       rb-inotify (~> 0.9, >= 0.9.7)
@@ -104,9 +112,26 @@ GEM
       minitest (~> 5.0)
       rails (>= 4.1)
     multi_json (1.12.1)
+    multi_xml (0.6.0)
+    multipart-post (2.0.0)
     nio4r (2.0.0)
     nokogiri (1.7.1)
       mini_portile2 (~> 2.1.0)
+    oauth2 (1.3.1)
+      faraday (>= 0.8, < 0.12)
+      jwt (~> 1.0)
+      multi_json (~> 1.3)
+      multi_xml (~> 0.5)
+      rack (>= 1.2, < 3)
+    omniauth (1.6.1)
+      hashie (>= 3.4.6, < 3.6.0)
+      rack (>= 1.6.2, < 3)
+    omniauth-github (1.2.3)
+      omniauth (~> 1.5)
+      omniauth-oauth2 (>= 1.4.0, < 2.0)
+    omniauth-oauth2 (1.4.0)
+      oauth2 (~> 1.0)
+      omniauth (~> 1.2)
     pg (0.20.0)
     pry (0.10.4)
       coderay (~> 1.1.0)
@@ -196,6 +221,7 @@ DEPENDENCIES
   better_errors
   byebug
   coffee-rails (~> 4.2)
+  dotenv-rails
   foundation-rails
   jbuilder (~> 2.5)
   jquery-rails
@@ -204,6 +230,8 @@ DEPENDENCIES
   minitest-reporters
   minitest-skip
   minitest-spec-rails
+  omniauth
+  omniauth-github
   pg (~> 0.18)
   pry-rails
   puma (~> 3.0)
@@ -220,4 +248,4 @@ RUBY VERSION
    ruby 2.4.0p0
 
 BUNDLED WITH
-   1.14.4
+   1.14.6

app/controllers/application_controller.rb

@@ -2,6 +2,16 @@ class ApplicationController < ActionController::Base
   protect_from_forgery with: :exception
 
   before_action :find_user
+  before_action :require_login
+
+  def require_login
+    #if user is not logged in, show message and redirect to root path
+    if find_user.nil?
+      flash[:status] = :failure
+      flash[:result_text] = "You must be logged in to view that page."
+      redirect_to root_path
+    end
+  end
 
   def render_404
     # DPR: supposedly this will actually render a 404 page in production
@@ -11,7 +21,7 @@ def render_404
 private
   def find_user
     if session[:user_id]
-      @login_user = User.find_by(id: session[:user_id])
+      @login_user ||= User.find_by(id: session[:user_id])
     end
   end
 end

app/controllers/sessions_controller.rb

@@ -1,28 +1,32 @@
 class SessionsController < ApplicationController
-  def login_form
-  end
+  skip_before_action :require_login, only: [:create]
 
-  def login
-    username = params[:username]
-    if username and user = User.find_by(username: username)
-      session[:user_id] = user.id
-      flash[:status] = :success
-      flash[:result_text] = "Successfully logged in as existing user #{user.username}"
-    else
-      user = User.new(username: username)
-      if user.save
+
+  def create
+    auth_hash = request.env['omniauth.auth']
+
+    user = User.find_by(uid: auth_hash["uid"], provider: auth_hash["provider"])
+
+    if user.nil?
+      user = User.create_from_github(auth_hash)
+
+      if user.nil?
+        flash[:status] = :failure
+        flash[:result_text] = "Could not log in"
+      else
         session[:user_id] = user.id
         flash[:status] = :success
-        flash[:result_text] = "Successfully created new user #{user.username} with ID #{user.id}"
-      else
-        flash.now[:status] = :failure
-        flash.now[:result_text] = "Could not log in"
-        flash.now[:messages] = user.errors.messages
-        render "login_form", status: :bad_request
-        return
+        flash[:result_text] = "Created new user #{user.username} with ID #{user.id}"
       end
+    else
+      session[:user_id] = user.id
+      flash[:status] = :success
+      flash[:result_text] = "Logged in successfully!"
     end
+
     redirect_to root_path
+
+
   end
 
   def logout
@@ -31,4 +35,37 @@ def logout
     flash[:result_text] = "Successfully logged out"
     redirect_to root_path
   end
+
+
+
+
+
+
+  # def login_form
+  # end
+  #
+  # def login
+  #   username = params[:username]
+  #   if username and user = User.find_by(username: username)
+  #     session[:user_id] = user.id
+  #     flash[:status] = :success
+  #     flash[:result_text] = "Successfully logged in as existing user #{user.username}"
+  #   else
+  #     user = User.new(username: username)
+  #     if user.save
+  #       session[:user_id] = user.id
+  #       flash[:status] = :success
+  #       flash[:result_text] = "Successfully created new user #{user.username} with ID #{user.id}"
+  #     else
+  #       flash.now[:status] = :failure
+  #       flash.now[:result_text] = "Could not log in"
+  #       flash.now[:messages] = user.errors.messages
+  #       render "login_form", status: :bad_request
+  #       return
+  #     end
+  #   end
+  #   redirect_to root_path
+  # end
+  #
+
 end

app/controllers/users_controller.rb

@@ -7,4 +7,6 @@ def show
     @user = User.find_by(id: params[:id])
     render_404 unless @user
   end
+
+
 end

app/controllers/works_controller.rb

@@ -3,6 +3,9 @@ class WorksController < ApplicationController
   # of work we're dealing with
   before_action :category_from_url, only: [:index, :new, :create]
   before_action :category_from_work, except: [:root, :index, :new, :create]
+  skip_before_action :require_login, only: [:root, :index]
+  before_action :check_owner, only: [:edit, :destroy]
+
 
   def root
     @albums = Work.best_albums
@@ -91,16 +94,36 @@ def upvote
 
 private
   def media_params
-    params.require(:work).permit(:title, :category, :creator, :description, :publication_year)
+    params.require(:work).permit(:title, :category, :creator, :description, :publication_year, :user_id)
   end
 
   def category_from_url
     @media_category = params[:category].downcase.pluralize
   end
 
   def category_from_work
-    @work = Work.find_by(id: params[:id])
+    # @work = Work.find_by(id: params[:id])
+    @work = find_work
     render_404 unless @work
     @media_category = @work.category.downcase.pluralize
   end
+
+  def find_work
+    @work = Work.find_by(id: params[:id])
+  end
+
+  def check_owner
+    # when user tries to edit or delete a work, check for ownership
+    # find_user (returns current user)
+    user = find_user
+    # find_work (returns current work)
+    work = find_work
+    # compare work.user_id and user.id
+    if user.id != work.user_id
+        # error message and redirect if they do not match
+      flash[:status] = :failure
+      flash[:result_text] = "You may only edit works that you yourself added."
+      redirect_back fallback_location: root_path
+    end
+  end
 end

app/models/user.rb

@@ -1,6 +1,26 @@
 class User < ApplicationRecord
   has_many :votes
   has_many :ranked_works, through: :votes, source: :work
+  has_many :works
+
+  # validates :username, uniqueness: true, presence: true
+  validates :uid, presence: true
+  validates :provider, presence: true
+  validates :email, presence: true
+
+  def self.create_from_github(auth_hash)
+    user = User.new
+
+    if auth_hash["uid"] == nil || auth_hash["provider"] == nil || auth_hash["info"] == nil
+    return nil
+    end
+
+    user.uid = auth_hash["uid"]
+    user.provider = auth_hash["provider"]
+    user.email = auth_hash["info"]["email"]
+    user.save
+    user.username = auth_hash["info"]["name"] || "User#{user.id}"
+    user.save ? user : nil
+  end
 
-  validates :username, uniqueness: true, presence: true
 end

app/models/work.rb

@@ -1,6 +1,7 @@
 class Work < ApplicationRecord
   has_many :votes, dependent: :destroy
   has_many :ranking_users, through: :votes, source: :user
+  belongs_to :user
 
   validates :category,  presence: true,
                         inclusion: { in: %w(album book movie) }

app/views/layouts/application.html.erb

@@ -23,7 +23,7 @@
         <%= link_to "Log Out", logout_path, method: :post, class: "button float-right" %>
       <% else %>
         <p class="text-right">Not logged in</p>
-        <%= link_to "Log In", login_path, class: "button float-right" %>
+        <%= link_to "Log In", "/auth/github", class: "button float-right" %>
       <% end %>
     </div>
   </header>

app/views/works/_form.html.erb

@@ -1,6 +1,7 @@
 <section>
   <%= form_for @work do |f| %>
     <%= f.hidden_field :category, value: @work.category %>
+    <%= f.hidden_field :user_id, value: session[:user_id] %>
 
     <%= f.label :title %>
     <%= f.text_field :title %>

config/initializers/omniauth.rb

@@ -0,0 +1,3 @@
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider :github, ENV["GITHUB_CLIENT_ID"], ENV["GITHUB_CLIENT_SECRET"], scope: "user:email"
+end

config/routes.rb

@@ -1,10 +1,12 @@
 Rails.application.routes.draw do
   # For details on the DSL available within this file, see http://guides.rubyonrails.org/routing.html
   root 'works#root'
-  get '/login', to: 'sessions#login_form', as: 'login'
-  post '/login', to: 'sessions#login'
+  # get '/login', to: 'sessions#login_form', as: 'login'
+  # post '/login', to: 'sessions#login'
+  get 'auth/github/callback', to: "sessions#create"
   post '/logout', to: 'sessions#logout', as: 'logout'
 
+
   # Build the category routes for albums, books and movies
   category_constraints = { category: /(albums)|(books)|(movies)/}
   get '/:category', to: 'works#index', as: 'works', constraints: category_constraints

db/media_seeds.csv

@@ -1,5 +1,5 @@
-category,title,creator,publication_year,description
-album,Can't Buy a Thrill,Steely Dan,1972,
+category,title,creator,publication_year,description, user_id
+album,Can't Buy a Thrill,Steely Dan,1972
 album,Countdown to Ecstasy,Steely Dan,1973,
 album,Pretzel Logic,Steely Dan,1974,
 album,Katy Lied,Steely Dan,1975,
@@ -24,4 +24,4 @@ book,Hidden Figures,Margot Lee Shetterly,2016,Good book that came before the mov
 book,Practical Object-Oriented Design in Ruby,Sandi Metz,2012,Good programming book
 book,Kindred,Octavia E. Butler,1979,Good sci-fi book
 book,Parable of the Sower,Octavia E. Butler,1993,
-book,A Wizard of Earthsea,Ursula K. Leguin,1968,
+book,A Wizard of Earthsea,Ursula K. Leguin,1968,

db/migrate/20170417220610_add_o_auth_fieldsto_user.rb

@@ -0,0 +1,7 @@
+class AddOAuthFieldstoUser < ActiveRecord::Migration[5.0]
+  def change
+    add_column :users, :uid, :integer, null: false
+    add_column :users, :provider, :string, null: false
+    add_column :users, :email, :string, null: false
+  end
+end

db/migrate/20170418173922_work_to_user_relationship.rb

@@ -0,0 +1,5 @@
+class WorkToUserRelationship < ActiveRecord::Migration[5.0]
+  def change
+    add_reference :works, :user, foreign_key: true
+  end
+end