diff --git a/app/models/spree/auth/unauthorized_admin_access_handler.rb b/app/models/spree/auth/unauthorized_admin_access_handler.rb new file mode 100644 index 00000000..11ca58f1 --- /dev/null +++ b/app/models/spree/auth/unauthorized_admin_access_handler.rb @@ -0,0 +1,33 @@ +# frozen_string_literal: true + +module Spree + module Auth + # This service object is responsible for handling unauthorized redirects + class UnauthorizedAdminAccessHandler + # @param controller [ApplicationController] an instance of ApplicationController + # or its subclasses. + def initialize(controller) + @controller = controller + end + + # This method is responsible for handling unauthorized redirects + def call + if spree_current_user + flash[:error] = I18n.t('spree.authorization_failure') + + redirect_to(spree.admin_unauthorized_path) + else + store_location + + redirect_to(spree.admin_login_path) + end + end + + private + + attr_reader :controller + + delegate :flash, :redirect_to, :spree_current_user, :store_location, :spree, to: :controller + end + end +end diff --git a/app/models/spree/auth/unauthorized_customer_access_handler.rb b/app/models/spree/auth/unauthorized_customer_access_handler.rb new file mode 100644 index 00000000..dd510690 --- /dev/null +++ b/app/models/spree/auth/unauthorized_customer_access_handler.rb @@ -0,0 +1,33 @@ +# frozen_string_literal: true + +module Spree + module Auth + # This service object is responsible for handling unauthorized redirects + class UnauthorizedCustomerAccessHandler + # @param controller [ApplicationController] an instance of ApplicationController + # or its subclasses. + def initialize(controller) + @controller = controller + end + + # This method is responsible for handling unauthorized redirects + def call + if spree_current_user + flash[:error] = I18n.t('spree.authorization_failure') + + redirect_back(fallback_location: spree.unauthorized_path) + else + store_location + + redirect_back(fallback_location: spree.login_path) + end + end + + private + + attr_reader :controller + + delegate :flash, :redirect_back, :spree_current_user, :store_location, :spree, to: :controller + end + end +end diff --git a/lib/spree/auth/engine.rb b/lib/spree/auth/engine.rb index f0e98489..2573e30a 100644 --- a/lib/spree/auth/engine.rb +++ b/lib/spree/auth/engine.rb @@ -21,73 +21,31 @@ class Engine < Rails::Engine Spree::Auth::Config = Spree::AuthConfiguration.new end - config.to_prepare do - Spree::Auth::Engine.prepare_backend if SolidusSupport.backend_available? - Spree::Auth::Engine.prepare_frontend if SolidusSupport.frontend_available? - - ApplicationController.include Spree::AuthenticationHelpers + if Spree::Config.respond_to?(:unauthorized_redirect_handler_class) + Spree::Config.unauthorized_redirect_handler_class = "Spree::Auth::UnauthorizedCustomerAccessHandler" + if SolidusSupport.backend_available? + Spree::Backend::Config.unauthorized_redirect_handler_class = "Spree::Auth::UnauthorizedAdminAccessHandler" + end + else + config.to_prepare do + Spree::Auth::Engine.prepare_backend if SolidusSupport.backend_available? + Spree::Auth::Engine.prepare_frontend if SolidusSupport.frontend_available? + end end - def self.redirect_back_on_unauthorized? - return false unless Spree::Config.respond_to?(:redirect_back_on_unauthorized) - - if Spree::Config.redirect_back_on_unauthorized - true - else - Spree::Deprecation.warn <<-WARN.strip_heredoc, caller - Having Spree::Config.redirect_back_on_unauthorized set - to `false` is deprecated and will not be supported in Solidus 3.0. - Please change this configuration to `true` and be sure that your - application does not break trying to redirect back when there is - an unauthorized access. - WARN - - false - end + config.to_prepare do + ApplicationController.include Spree::AuthenticationHelpers end def self.prepare_backend Spree::Admin::BaseController.unauthorized_redirect = -> do - if spree_current_user - flash[:error] = I18n.t('spree.authorization_failure') - - if Spree::Auth::Engine.redirect_back_on_unauthorized? - redirect_back(fallback_location: spree.admin_unauthorized_path) - else - redirect_to spree.admin_unauthorized_path - end - else - store_location - - if Spree::Auth::Engine.redirect_back_on_unauthorized? - redirect_back(fallback_location: spree.admin_login_path) - else - redirect_to spree.admin_login_path - end - end + Spree::Auth::UnauthorizedAdminAccessHandler.new(self).call end end - def self.prepare_frontend Spree::BaseController.unauthorized_redirect = -> do - if spree_current_user - flash[:error] = I18n.t('spree.authorization_failure') - - if Spree::Auth::Engine.redirect_back_on_unauthorized? - redirect_back(fallback_location: spree.unauthorized_path) - else - redirect_to spree.unauthorized_path - end - else - store_location - - if Spree::Auth::Engine.redirect_back_on_unauthorized? - redirect_back(fallback_location: spree.login_path) - else - redirect_to spree.login_path - end - end + Spree::Auth::UnauthorizedCustomerAccessHandler.new(self).call end end end diff --git a/spec/controllers/spree/admin/base_controller_spec.rb b/spec/controllers/spree/admin/base_controller_spec.rb index 5b81942a..b9ea3159 100644 --- a/spec/controllers/spree/admin/base_controller_spec.rb +++ b/spec/controllers/spree/admin/base_controller_spec.rb @@ -8,10 +8,6 @@ def index; authorize!(:read, :something); end end - before do - stub_spree_preferences(Spree::Config, redirect_back_on_unauthorized: true) - end - context "when user is logged in" do before { sign_in(create(:user)) } @@ -21,15 +17,6 @@ def index; authorize!(:read, :something); end expect(response).to redirect_to(spree.admin_unauthorized_path) end end - - context "when http_referrer is present" do - before { request.env['HTTP_REFERER'] = '/redirect' } - - it "redirects back" do - get :index - expect(response).to redirect_to('/redirect') - end - end end context "when user is not logged in" do @@ -39,15 +26,6 @@ def index; authorize!(:read, :something); end expect(response).to redirect_to(spree.admin_login_path) end end - - context "when http_referrer is present" do - before { request.env['HTTP_REFERER'] = '/redirect' } - - it "redirects back" do - get :index - expect(response).to redirect_to('/redirect') - end - end end end end diff --git a/spec/controllers/spree/base_controller_spec.rb b/spec/controllers/spree/base_controller_spec.rb index 9dc565cd..3010ba36 100644 --- a/spec/controllers/spree/base_controller_spec.rb +++ b/spec/controllers/spree/base_controller_spec.rb @@ -8,10 +8,6 @@ def index; authorize!(:read, :something); end end - before do - stub_spree_preferences(Spree::Config, redirect_back_on_unauthorized: true) - end - context "when user is logged in" do before { sign_in(create(:user)) }