current_account - when nobody logged in, error is raised?

[benkoshy]

Hi there

<-- some view  -->

<% if current_account %>
<-- raises exception -->
<-- invalid account id passed to account_ds -->

• In a view where nobody has logged in, I was expect current_account to return nil rather than raising an exception: is this the intended behaviour?

• Do you need a fix for this?

My current solution adds another conditional.

<% if rodauth.logged_in? && current_account %>

[janko]

What kind of exception is raised? I intentionally wanted #current_account to require login when it's used, because people should use rodauth.logged_in?. But I understand they might be used to how Devise behaves, and it's probably more convenient. TBH, the internal require_login call was mostly left for backwards compatibility, it might be worth removing it, I will give this some thought.

[benkoshy]

How to reproduce?

In an existing rodauth-rails app, employ current_account in any publicly accessible view, ensuring nobody is logged in. The exception should be raised. I didn't worry about a reproduction script because i thought it was the intended behaviour (?) that could readily be seen without one. please let me know if one is necessary and i will oblige.

What kind of exception is raised?

The exception raised was invalid account id passed to account_ds.

Looks like sequel might be searching for it but the account id might be nil:

Here is the culprit: https://github.com/jeremyevans/rodauth/blob/1b79c1ea3664f7b58e9101a36daa20937e295add/lib/rodauth/features/base.rb#L693

Which originally stems from here:

rodauth-rails/lib/rodauth/rails/controller_methods.rb

Line 12 in 0312bf2

rodauth(name).rails_account || rodauth(name).login_required

Stack Trace here:

rodauth (2.25.0) lib/rodauth/features/base.rb:694:in `account_ds'
rodauth (2.25.0) lib/rodauth/features/base.rb:664:in `_account_from_session'
rodauth (2.25.0) lib/rodauth/features/base.rb:355:in `account_from_session'
rodauth-rails (1.5.4) lib/rodauth/rails/feature/base.rb:12:in `rails_account'
rodauth-rails (1.5.4) lib/rodauth/rails/controller_methods.rb:12:in `current_account'
rodauth-rails (1.5.4) lib/rodauth/rails/controller_methods.rb:8:in `current_account' 

My Use Case

# publicly accessible view

# some parts of the view should only be seen by those logged in.
<% if current_user %>
   <-- secret content -->

[janko]

Thanks for the details. This is definitely a bug, the rails_account method was meant to return nil if the account is not logged in. If you have time to work on a fix, I would gladly merge it 🙂