class ApplicationController < ActionController::Base # Prevent CSRF attacks by raising an exception. # For APIs, you may want to use :null_session instead. protect_from_forgery with: :exception # Do not mention passwords in the log file # filter_parameter_logging :password before_action :get_current_users_screenshots, :debian_sso # TODO: Deprecation. What is the replacement for Rails.env.development? ? # Query for packages that were uploaded by the current user. # If the user is anonymous then find the uploads by the cookie token. # If the user is logged in then find the uploads by matching the user id. def get_current_users_screenshots if user_signed_in? @current_users_screenshots = current_user.screenshots end end # If the visitor presents a valid SSL client certificate from Debian SSO # then the frontend web server will send a certain request header. # Log the user in and welcome them. def debian_sso # Only run if the user is not yet logged in if not user_signed_in? if debian_sso_dn = request.env['HTTP_X_DEBIAN_SSO_DN'] # Turn # "/O=Debian SSO client certificate/CN=haas@debian.org" # into # haas@debian.org debian_email = debian_sso_dn.split('/').grep(/^CN/).first.split('=').last raise "No valid certificate CN found" unless debian_email.include? '@' @user = User.where(provider: 'debian-sso', email: debian_email).first_or_create do |user| user.provider = 'debian-sso' user.email = debian_email user.name = debian_email # Set a random password user.password = Devise.friendly_token[0,20] end if @user.persisted? flash[:notice] = 'You are logged in through the Debian SSO' sign_in_and_redirect @user, :event => :authentication else redirect_to root_path, alert: @user.errors.full_messages.join("\n") end end end end # Define where the user is redirected to after a successful login. def after_sign_in_path_for(resource) my_welcome_path end end