From b4e0e73692c5e12ed1213f2f4be0cbe58ee45502 Mon Sep 17 00:00:00 2001
From: Zachary Chai <zachary.chai@blindsidenetworks.com>
Date: Fri, 4 Nov 2016 14:28:40 -0400
Subject: [PATCH] oauth update

---
 .../javascripts/channels/meeting_updates.js   |  2 +-
 .../javascripts/channels/recording_update.js  |  2 +-
 app/assets/javascripts/landing.js             |  4 +--
 app/assets/javascripts/shared.js              |  2 +-
 app/assets/stylesheets/users.scss             | 13 --------
 app/channels/meeting_updates_channel.rb       |  2 +-
 app/channels/recording_updates_channel.rb     |  2 +-
 app/controllers/bbb_controller.rb             | 16 +++++-----
 app/controllers/landing_controller.rb         | 12 ++++---
 app/controllers/sessions_controller.rb        | 10 ++----
 app/controllers/users_controller.rb           | 32 -------------------
 app/models/user.rb                            | 28 ++++++++++------
 app/views/landing/rooms.html.erb              |  2 +-
 app/views/layouts/application.html.erb        |  8 ++---
 app/views/users/edit.html.erb                 | 29 -----------------
 config/initializers/omniauth.rb               |  2 +-
 config/routes.rb                              |  3 +-
 .../20161108224701_add_unique_id_to_users.rb  | 21 ++++++++++++
 db/schema.rb                                  | 13 ++++----
 test/controllers/users_controller_test.rb     | 18 -----------
 test/fixtures/users.yml                       |  2 ++
 21 files changed, 79 insertions(+), 144 deletions(-)
 delete mode 100644 app/assets/stylesheets/users.scss
 delete mode 100644 app/controllers/users_controller.rb
 delete mode 100644 app/views/users/edit.html.erb
 create mode 100644 db/migrate/20161108224701_add_unique_id_to_users.rb
 delete mode 100644 test/controllers/users_controller_test.rb

diff --git a/app/assets/javascripts/channels/meeting_updates.js b/app/assets/javascripts/channels/meeting_updates.js
index be34eaf4..f455fcc0 100644
--- a/app/assets/javascripts/channels/meeting_updates.js
+++ b/app/assets/javascripts/channels/meeting_updates.js
@@ -9,7 +9,7 @@
   var initRooms = function() {
     App.messages = App.cable.subscriptions.create({
       channel: 'MeetingUpdatesChannel',
-      username: getRoomName()
+      encrypted_id: getEncryptedId()
     },
     {
       received: function(data) {
diff --git a/app/assets/javascripts/channels/recording_update.js b/app/assets/javascripts/channels/recording_update.js
index 00314fb1..4d3c7730 100644
--- a/app/assets/javascripts/channels/recording_update.js
+++ b/app/assets/javascripts/channels/recording_update.js
@@ -3,7 +3,7 @@
   var initRooms = function() {
     App.messages = App.cable.subscriptions.create({
       channel: 'RecordingUpdatesChannel',
-      username: getRoomName()
+      encrypted_id: getEncryptedId()
     },
     {
       received: function(data) {
diff --git a/app/assets/javascripts/landing.js b/app/assets/javascripts/landing.js
index 11b47054..5b778a7e 100644
--- a/app/assets/javascripts/landing.js
+++ b/app/assets/javascripts/landing.js
@@ -152,7 +152,7 @@
           targets: -1,
           render: function(data, type, row) {
             if (type === 'display') {
-              var roomName = getRoomName();
+              var roomName = getEncryptedId();
               var published = row.published;
               var eye = getPublishClass(published);
               return '<button type="button" class="btn btn-default recording-update" data-published="'+published+'">' +
@@ -210,7 +210,7 @@
       return;
     }
     table = recordingsTable.api();
-    $.get("/rooms/"+getRoomName()+"/recordings", function(data) {
+    $.get("/rooms/"+getEncryptedId()+"/recordings", function(data) {
       if (!data.is_owner) {
         table.column(-1).visible( false );
       }
diff --git a/app/assets/javascripts/shared.js b/app/assets/javascripts/shared.js
index b1601f90..28aa8511 100644
--- a/app/assets/javascripts/shared.js
+++ b/app/assets/javascripts/shared.js
@@ -4,7 +4,7 @@ $.ajaxSetup({
   }
 });
 
-var getRoomName = function() {
+var getEncryptedId = function() {
   return $(".page-wrapper.rooms").data('room');
 }
 
diff --git a/app/assets/stylesheets/users.scss b/app/assets/stylesheets/users.scss
deleted file mode 100644
index 50e9fc13..00000000
--- a/app/assets/stylesheets/users.scss
+++ /dev/null
@@ -1,13 +0,0 @@
-.user {
-  .error {
-    p {
-      font-size: 14px;
-      color: red;
-    }
-  }
-  .description {
-    p {
-      font-size: 14px;
-    }
-  }
-}
diff --git a/app/channels/meeting_updates_channel.rb b/app/channels/meeting_updates_channel.rb
index 8e48fba0..3905e86e 100644
--- a/app/channels/meeting_updates_channel.rb
+++ b/app/channels/meeting_updates_channel.rb
@@ -1,5 +1,5 @@
 class MeetingUpdatesChannel < ApplicationCable::Channel
   def subscribed
-    stream_from "#{params[:username]}_meeting_updates_channel"
+    stream_from "#{params[:encrypted_id]}_meeting_updates_channel"
   end
 end
diff --git a/app/channels/recording_updates_channel.rb b/app/channels/recording_updates_channel.rb
index ff814506..859ed9bf 100644
--- a/app/channels/recording_updates_channel.rb
+++ b/app/channels/recording_updates_channel.rb
@@ -1,5 +1,5 @@
 class RecordingUpdatesChannel < ApplicationCable::Channel
   def subscribed
-    stream_from "#{params[:username]}_recording_updates_channel"
+    stream_from "#{params[:encrypted_id]}_recording_updates_channel"
   end
 end
diff --git a/app/controllers/bbb_controller.rb b/app/controllers/bbb_controller.rb
index bf45a720..37545d6e 100644
--- a/app/controllers/bbb_controller.rb
+++ b/app/controllers/bbb_controller.rb
@@ -9,7 +9,7 @@ class BbbController < ApplicationController
     if params[:name].blank?
       render_bbb_response("missing_parameter", "user name was not included", :unprocessable_entity)
     else
-      user = User.find_by username: params[:id]
+      user = User.find_by encrypted_id: params[:id]
 
       options = if user
         {
@@ -29,7 +29,7 @@ class BbbController < ApplicationController
       )
 
       if bbb_res[:returncode] && current_user && current_user == user
-        ActionCable.server.broadcast "#{user.username}_meeting_updates_channel",
+        ActionCable.server.broadcast "#{user.encrypted_id}_meeting_updates_channel",
           action: 'moderator_joined',
           moderator: 'joined'
       end
@@ -42,9 +42,9 @@ class BbbController < ApplicationController
   def end
     load_and_authorize_room_owner!
 
-    bbb_res = bbb_end_meeting @user.username
+    bbb_res = bbb_end_meeting @user.encrypted_id
     if bbb_res[:returncode]
-      EndMeetingJob.perform_later(@user.username)
+      EndMeetingJob.perform_later(@user.encrypted_id)
     end
     render_bbb_response bbb_res
   end
@@ -53,7 +53,7 @@ class BbbController < ApplicationController
   def recordings
     load_room!
 
-    bbb_res = bbb_get_recordings @user.username
+    bbb_res = bbb_get_recordings @user.encrypted_id
     render_bbb_response bbb_res, bbb_res[:recordings]
   end
 
@@ -61,7 +61,7 @@ class BbbController < ApplicationController
   def update_recordings
     bbb_res = bbb_update_recordings(params[:record_id], params[:published] == 'true')
     if bbb_res[:returncode]
-      RecordingUpdatesJob.perform_later(@user.username, params[:record_id], bbb_res[:published])
+      RecordingUpdatesJob.perform_later(@user.encrypted_id, params[:record_id], bbb_res[:published])
     end
     render_bbb_response bbb_res
   end
@@ -70,7 +70,7 @@ class BbbController < ApplicationController
   def delete_recordings
     bbb_res = bbb_delete_recordings(params[:record_id])
     if bbb_res[:returncode]
-      RecordingDeletesJob.perform_later(@user.username, params[:record_id])
+      RecordingDeletesJob.perform_later(@user.encrypted_id, params[:record_id])
     end
     render_bbb_response bbb_res
   end
@@ -78,7 +78,7 @@ class BbbController < ApplicationController
   private
 
   def load_room!
-    @user = User.find_by username: params[:id]
+    @user = User.find_by encrypted_id: params[:id]
     if !@user
       render head(:not_found) && return
     end
diff --git a/app/controllers/landing_controller.rb b/app/controllers/landing_controller.rb
index e52e29c3..ca336cdc 100644
--- a/app/controllers/landing_controller.rb
+++ b/app/controllers/landing_controller.rb
@@ -16,16 +16,20 @@ class LandingController < ApplicationController
   end
 
   def session_status_refresh
-    @user = User.find_by(username: params[:id])
+    @user = User.find_by(encrypted_id: params[:id])
     if @user.nil?
       render head(:not_found) && return
     end
 
-    @meeting_running = bbb_get_meeting_info(@user.username)[:returncode]
+    @meeting_running = bbb_get_meeting_info(@user.encrypted_id)[:returncode]
 
     render layout: false
   end
 
+  def auth_failure
+    redirect_to '/'
+  end
+
   def admin?
     @user && @user == current_user
   end
@@ -42,13 +46,13 @@ class LandingController < ApplicationController
   def render_room
     params[:action] = 'rooms'
 
-    @user = User.find_by(username: params[:id])
+    @user = User.find_by(encrypted_id: params[:id])
     if @user.nil?
       redirect_to root_path
       return
     end
 
-    @meeting_running = bbb_get_meeting_info(@user.username)[:returncode]
+    @meeting_running = bbb_get_meeting_info(@user.encrypted_id)[:returncode]
 
     render :action => 'rooms'
   end
diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index a5ebaaa7..54a0f3b5 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -1,14 +1,8 @@
 class SessionsController < ApplicationController
   def create
     @user = User.from_omniauth(request.env['omniauth.auth'])
-    if @user.persisted?
-      session[:user_id] = @user.id
-      redirect_to controller: 'landing', action: 'index', id: @user.username, resource: 'rooms'
-    else
-      @user.save!
-      session[:user_id] = @user.id
-      redirect_to controller: 'users', action: 'edit', id: @user.id
-    end
+    session[:user_id] = @user.id
+    redirect_to controller: 'landing', action: 'index', id: @user.encrypted_id, resource: 'rooms'
   rescue => e
     logger.error "Error authenticating via omniauth: #{e}"
     redirect_to root_path
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
deleted file mode 100644
index 0deef207..00000000
--- a/app/controllers/users_controller.rb
+++ /dev/null
@@ -1,32 +0,0 @@
-class UsersController < ApplicationController
-  before_action :set_user, only: [:edit, :update]
-
-  # GET /users/1/edit
-  def edit
-  end
-
-  # PATCH/PUT /users/1
-  # PATCH/PUT /users/1.json
-  def update
-    if @user.update(user_params)
-      redirect_to controller: 'landing', action: 'index', id: @user.username, resource: 'rooms'
-    else
-      @error = @user.errors.first[1] rescue nil
-      render :edit
-    end
-  end
-
-  private
-    # Use callbacks to share common setup or constraints between actions.
-    def set_user
-      @user = User.find(params[:id])
-      if @user.username
-        render 'errors/error'
-      end
-    end
-
-    # Never trust parameters from the scary internet, only allow the white list through.
-    def user_params
-      params.require(:user).permit(:username)
-    end
-end
diff --git a/app/models/user.rb b/app/models/user.rb
index 9cfb2add..873a2b6f 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -1,17 +1,17 @@
 class User < ApplicationRecord
 
-  validates :username,
-    uniqueness: { message: "this username is taken" },
-    format: { with: /\A^[0-9a-z-_]+\Z/,
-    message: "Only allows lowercase alphanumeric characters with dashes and underscores",
-    allow_blank: true }
+  # validates :username,
+  #   format: { with: /\A^[0-9a-z-_]+\Z/,
+  #   message: "Only allows lowercase alphanumeric characters with dashes and underscores",
+  #   allow_blank: true }
+
+  before_create :set_encrypted_id
 
   def self.from_omniauth(auth_hash)
     user = find_or_initialize_by(uid: auth_hash['uid'], provider: auth_hash['provider'])
-    unless user.persisted?
-      # user.username = self.send("#{auth_hash['provider']}_username", auth_hash) rescue nil
-      user.name = auth_hash['info']['name']
-    end
+    user.username = self.send("#{auth_hash['provider']}_username", auth_hash) rescue nil
+    user.name = auth_hash['info']['name']
+    user.save!
     user
   end
 
@@ -19,7 +19,15 @@ class User < ApplicationRecord
     auth_hash['info']['nickname']
   end
 
+  def self.google_username(auth_hash)
+    auth_hash['info']['email'].split('@').first
+  end
+
   def room_url
-    "/rooms/#{username}"
+    "/rooms/#{encrypted_id}"
+  end
+
+  def set_encrypted_id
+    self.encrypted_id = Digest::SHA1.hexdigest(uid+provider)
   end
 end
diff --git a/app/views/landing/rooms.html.erb b/app/views/landing/rooms.html.erb
index 40747bde..a6ba4f12 100644
--- a/app/views/landing/rooms.html.erb
+++ b/app/views/landing/rooms.html.erb
@@ -16,7 +16,7 @@
   </div>
 <% end %>
 
-<div class="page-wrapper rooms" data-room="<%= @user.username %>">
+<div class="page-wrapper rooms" data-room="<%= @user.encrypted_id %>">
   <div class="container-fluid">
 
     <%= render 'shared/title', title: page_title %>
diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
index 9fda7d81..74c71b91 100644
--- a/app/views/layouts/application.html.erb
+++ b/app/views/layouts/application.html.erb
@@ -13,7 +13,7 @@
     <!-- Messages -->
     <div id='alerts'>
     </div>
-    
+
     <!-- Header -->
     <div class='header'>
       <span class="logo-wrapper pull-left">
@@ -22,11 +22,7 @@
       <span class="signup pull-right">
         <% if current_user %>
           <%= current_user.name %> |
-          <% if current_user.username %>
-            <%= link_to t('my_room'), current_user.room_url %> |
-          <% else %>
-            <%= link_to t('my_room'), edit_user_path(current_user) %> |
-          <% end %>
+          <%= link_to t('my_room'), current_user.room_url %> |
           <%= link_to t('logout'), user_logout_url %>
         <% elsif @user %>
           <%= t('are_you', name: @user.username) %> |
diff --git a/app/views/users/edit.html.erb b/app/views/users/edit.html.erb
deleted file mode 100644
index 788898cd..00000000
--- a/app/views/users/edit.html.erb
+++ /dev/null
@@ -1,29 +0,0 @@
-<% content_for :title do %>
-  <div class="title">
-    Enter your Username below
-  </div>
-<% end %>
-
-<div class="page-wrapper user-edit">
-  <div class="container-fluid">
-
-    <%= render 'shared/title', title: 'Complete User Profile' %>
-
-    <%= render layout: 'shared/center_panel' do %>
-      <div class="center-block col-sm-8">
-        <%= form_for(@user) do |f| %>
-          <div class="input-group">
-            <%= f.text_field :username, placeholder: "Username", class: "form-control input" %>
-            <span class="input-group-btn">
-              <%= f.submit class: "btn btn-success", value: "Save" %>
-            </span>
-          </div>
-        <% end %>
-        <div class="error">
-          <p><%= @error %></p>
-        </div>
-      <% end %>
-    </div>
-
-  </div>
-</div>
diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb
index 29574fa5..41726b73 100644
--- a/config/initializers/omniauth.rb
+++ b/config/initializers/omniauth.rb
@@ -1,5 +1,5 @@
 Rails.application.config.middleware.use OmniAuth::Builder do
   provider :twitter, ENV['TWITTER_ID'], ENV['TWITTER_SECRET']
   provider :google_oauth2, ENV['GOOGLE_OAUTH2_ID'], ENV['GOOGLE_OAUTH2_SECRET'],
-    scope: ['profile'], access_type: 'online', name: 'google'
+    scope: ['profile', 'email'], access_type: 'online', name: 'google'
 end
diff --git a/config/routes.rb b/config/routes.rb
index 91ccb3b8..16bef9a8 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -5,7 +5,8 @@ Rails.application.routes.draw do
   resources :users, only: [:edit, :update]
   get '/users/logout', to: 'sessions#destroy', as: :user_logout
 
-  get '/auth/:provider/callback', to: 'sessions#create'
+  match '/auth/:provider/callback', to: 'sessions#create', via: [:get, :post]
+  get '/auth/failure', to: 'landing#auth_failure'
 
   # There are two resources [meetings|rooms]
   # meetings offer a landing page for NON authenticated users to create and join session in BigBlueButton
diff --git a/db/migrate/20161108224701_add_unique_id_to_users.rb b/db/migrate/20161108224701_add_unique_id_to_users.rb
new file mode 100644
index 00000000..1656fbcd
--- /dev/null
+++ b/db/migrate/20161108224701_add_unique_id_to_users.rb
@@ -0,0 +1,21 @@
+class AddUniqueIdToUsers < ActiveRecord::Migration[5.0]
+  def up
+    add_column :users, :encrypted_id, :string
+
+    User.all.each do |user|
+      user.set_encrypted_id
+      user.save!
+    end
+
+    change_column_null :users, :encrypted_id, false
+
+    add_index :users, :encrypted_id, unique: true
+    remove_index :users, :username
+  end
+
+  def down
+    add_index :users, :username, unique: true
+    remove_index :users, :encrypted_id
+    remove_column :users, :encrypted_id
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 9d2bd52c..c82f317c 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,19 +10,20 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20161017203809) do
+ActiveRecord::Schema.define(version: 20161108224701) do
 
   create_table "users", force: :cascade do |t|
-    t.string   "provider",   null: false
-    t.string   "uid",        null: false
+    t.string   "provider",     null: false
+    t.string   "uid",          null: false
     t.string   "name"
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
+    t.datetime "created_at",   null: false
+    t.datetime "updated_at",   null: false
     t.string   "username"
+    t.string   "encrypted_id", null: false
+    t.index ["encrypted_id"], name: "index_users_on_encrypted_id", unique: true
     t.index ["provider", "uid"], name: "index_users_on_provider_and_uid", unique: true
     t.index ["provider"], name: "index_users_on_provider"
     t.index ["uid"], name: "index_users_on_uid"
-    t.index ["username"], name: "index_users_on_username", unique: true
   end
 
 end
diff --git a/test/controllers/users_controller_test.rb b/test/controllers/users_controller_test.rb
deleted file mode 100644
index fa1218ea..00000000
--- a/test/controllers/users_controller_test.rb
+++ /dev/null
@@ -1,18 +0,0 @@
-require 'test_helper'
-
-class UsersControllerTest < ActionDispatch::IntegrationTest
-  setup do
-    @user = users(:one)
-  end
-
-  test "should get edit" do
-    get edit_user_url(@user)
-    assert_response :success
-  end
-
-  test "should update user" do
-    patch user_url(@user), params: { user: { username: @user.username } }
-    assert_redirected_to user_url(@user)
-  end
-
-end
diff --git a/test/fixtures/users.yml b/test/fixtures/users.yml
index 449a17c8..462ae2b1 100644
--- a/test/fixtures/users.yml
+++ b/test/fixtures/users.yml
@@ -3,11 +3,13 @@
 one:
   provider: twitter
   uid: <%= SecureRandom.hex(10) %>
+  encrypted_id: user1
   name: User 1
   username: user1
 
 two:
   provider: google
   uid: <%= SecureRandom.hex(10) %>
+  encrypted_id: user2
   name: User 2
   username: user2