- Implement AccountActivationsController for activation logic
- Create UserMailer for sending activation emails
- Update SessionsController to handle unactivated users
- Modify UsersController to restrict access to activated users
- Add activation fields to User model and database migration
- Create views for account activation emails
- Add tests for account activation functionality
- Change the render method to include a status of
:unprocessable_entity when the email/password combination
is invalid.
- This change improves the API response for invalid login
attempts, allowing clients to better handle errors.
- Remove unnecessary turbo frame tag from the signup form
- Directly render the form within the column div
This change simplifies the user signup view by removing the
unneeded turbo frame, which was not contributing to the
functionality. The form is now rendered directly, making the
code cleaner and easier to understand.
- Updated single quotes to double quotes for consistency
- Adjusted spacing in array definitions for better readability
- Ensured consistent use of quotes in flash messages and method parameters
These changes enhance the overall code style without altering any functionality.
- Implement friendly forwarding for user login
- Add correct_user method to ensure users can only edit their own profiles
- Update sessions_controller to handle forwarding URL
- Enhance user controller tests to verify redirection for unauthorized access
These changes improve user experience by allowing users to be redirected
back to their intended page after logging in. Additionally, the new
correct_user method enhances security by preventing users from editing
other users' profiles, ensuring proper authorization checks are in place.
- Implement remember me checkbox in login form
- Update sessions controller to handle remember me logic
- Enhance session management to prevent session hijacking
- Add tests for remember me functionality
This commit introduces a "Remember me" feature that allows users to
stay logged in across sessions. It includes updates to the login
form, session handling in the controller, and additional tests to
ensure the functionality works as expected. The changes also
improve security by validating session tokens to prevent session
hijacking.
- Update `destroy` action in `SessionsController` to log out
only if the user is currently logged in.
- Add a check in the `authenticated?` method of the `User`
model to return false if `remember_digest` is nil.
- Enhance integration tests to simulate logout in another
browser session and verify that the logout link is not
present after logging out.
These changes improve the robustness of the session management
by preventing unnecessary logout attempts and ensuring that
authentication checks are more reliable.
- Implement remember method in User model to generate and store a remember token
- Update SessionsController to call remember on successful login
- Enhance current_user method to retrieve user from cookies if session is not present
- Add forget method to clear remember token on logout
- Create migration to add remember_digest column to users table
- Update session creation to use safe navigation operator
- Implement log_out method in SessionsHelper
- Add session reset and login on user creation
- Improve user login tests for better coverage
These changes improve the user session management by ensuring
that the session is handled more safely and efficiently. The
addition of the log_out method centralizes session termination,
while the updated tests ensure that both login and logout
functionality are thoroughly validated.
