possible regression introduced in currect_account method

[benkoshy]

I don't have a reproduction script handy but it should be self explanatory.

Consider this method:

rodauth-rails/lib/rodauth/rails/controller_methods.rb

Line 11 in d1d3dd4

def current_account(name = nil)

1. Assume that the current_account is nil - in other words, nobody is logged in.
2. rodauth(name).login_required would be hit, and this would precipitate the following:

https://rodauth.jeremyevans.net/rdoc/classes/Rodauth.html#method-i-login_required

def login_required
   set_redirect_error_status(login_required_error_status)
   set_error_reason :login_required
   set_redirect_error_flash require_login_error_flash
   redirect require_login_redirect
end

Any view / controller which checks for a current_account (when nobody is logged in) would trigger a redirect to the login page?

Is my understanding incorrect?

[janko]

Is this a regression in the sense that it worked in previous versions? To be clear, I plan to remove this login requring in the next version.

[benkoshy]

Is this a regression in the sense that it worked in previous versions?

I'm finding that all my pages, which should be publicly facing, are forcing a login.

<-- some publicly accessible view-->

<%  if current_account    %>

<-- immediate redirection to the login page  -->
<-- but the page should still be accessible to non-logged in users  -->

Would you be opposed to me posting a hotfix which entirely removes rodauth(name).login_required. Perhaps I may be missing something?

rodauth-rails/lib/rodauth/rails/controller_methods.rb

Lines 11 to 13 in d1d3dd4

	def current_account(name = nil)
	rodauth(name).rails_account || rodauth(name).login_required
	end

[janko]

What was different in the previous version, that's now changing the behaviour in your app? current_account method should have never worked as a way to check whether the user is logged in, it always should have been paired with rodauth.logged_in? or rodauth.authenticated?, otherwise it would redirect to the login page.

[benkoshy]

What was different in the previous version, that's now changing the behaviour in your app?

I am now using this paradigm throughout:

# some view:
if current_account
    <p> You're logged in! </p>
end

Or:

if get_policy(current_user, @post).update?
     <p> you can update! </p>
end

Whereas before I used the following paradigm:

if rodauth.logged_in? && current_user
  # etc.
end

I was not expecting current_user to force a redirect? my use of the API was wrong.

[janko]

OK, it seems you've used different code in addition to upgrading to the newest version. A regression is when you upgrade without changing your code, and which then stops working as expected.

The current_account method was never intended to be used for checking whether the user is logged in, that's what logged_in? and authenticated? methods are for. It was meant to be called once you've already checked logged in state.

I know Devise users are used to it, though. In your case, why do you want to check both? You should only need it if you're deleting logged in users from the database in production.

Considering that require_account has been made a public Rodauth method in recent versions, I would like to start recommending using it, and with that I'd probably remove requiring login.

[benkoshy]

agreed with incorrect use of 'regression'

Ok I"ll follow the approach suggested. (In fact alll publicly accessible views/controllers have the login requirement removed.)

I know Devise users are used to it, though. In your case, why do you want to check both? You should only need it if you're deleting logged in users from the database in production.

To check for permissions. Some publicly accessible pages should be seen by logged_in users who must also have permission to see those sections:

# some publicly accessible view view
if rodauth.logged_in? &&  check_permissions(current_user)   <-- checking permissions

I apologize for the time taken. my undersanding of the api was wrong.

Thanks for clarifying. as always much appreciate the library and open source work.