-
Notifications
You must be signed in to change notification settings - Fork 36
/
Copy pathupdating-showing-and-deleting-users.html
2386 lines (1617 loc) · 241 KB
/
updating-showing-and-deleting-users.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html>
<head>
<title>updating-showing-and-deleting-users</title>
<link rel="stylesheet" href="pygments.css" type="text/css" />
<link rel="stylesheet" href="polytexnic.css" type="text/css" />
</head>
<body>
<div id="book">
<h1 class="title">Ruby on Rails Tutorial </h1>
<h1 class="subtitle"> Learn Web Development with Rails</h1>
<h2 class="author">Michael Hartl</h2>
<h2 class="contents">Contents</h2>
<div id="table_of_contents"><ol><li class="chapter"><a href="beginning.html#top"><span class="number">Chapter 1</span> From zero to deploy</a></li><li><ol><li class="section"><a href="beginning.html#sec-introduction"><span class="number">1.1</span> Introduction</a></li><li><ol><li class="subsection"><a href="beginning.html#sec-comments_for_various_readers"><span class="number">1.1.1</span> Comments for various readers</a></li><li class="subsection"><a href="beginning.html#sec-1_1_2"><span class="number">1.1.2</span> “Scaling” Rails</a></li><li class="subsection"><a href="beginning.html#sec-conventions"><span class="number">1.1.3</span> Conventions in this book</a></li></ol></li><li class="section"><a href="beginning.html#sec-up_and_running"><span class="number">1.2</span> Up and running</a></li><li><ol><li class="subsection"><a href="beginning.html#sec-development_tools"><span class="number">1.2.1</span> Development environments</a></li><li><ol><li class="subsubsection"><a href="beginning.html#sec-1_2_1_1">IDEs</a></li><li class="subsubsection"><a href="beginning.html#sec-1_2_1_2">Text editors and command lines</a></li><li class="subsubsection"><a href="beginning.html#sec-1_2_1_3">Browsers</a></li><li class="subsubsection"><a href="beginning.html#sec-1_2_1_4">A note about tools</a></li></ol></li><li class="subsection"><a href="beginning.html#sec-rubygems"><span class="number">1.2.2</span> Ruby, RubyGems, Rails, and Git</a></li><li><ol><li class="subsubsection"><a href="beginning.html#sec-rails_installer_windows">Rails Installer (Windows)</a></li><li class="subsubsection"><a href="beginning.html#sec-install_git">Install Git</a></li><li class="subsubsection"><a href="beginning.html#sec-install_ruby">Install Ruby</a></li><li class="subsubsection"><a href="beginning.html#sec-install_rubygems">Install RubyGems</a></li><li class="subsubsection"><a href="beginning.html#sec-install_rails">Install Rails</a></li></ol></li><li class="subsection"><a href="beginning.html#sec-the_first_application"><span class="number">1.2.3</span> The first application</a></li><li class="subsection"><a href="beginning.html#sec-bundler"><span class="number">1.2.4</span> Bundler</a></li><li class="subsection"><a href="beginning.html#sec-rails_server"><span class="number">1.2.5</span> <tt>rails server</tt></a></li><li class="subsection"><a href="beginning.html#sec-mvc"><span class="number">1.2.6</span> Model-view-controller (MVC)</a></li></ol></li><li class="section"><a href="beginning.html#sec-version_control"><span class="number">1.3</span> Version control with Git</a></li><li><ol><li class="subsection"><a href="beginning.html#sec-git_setup"><span class="number">1.3.1</span> Installation and setup</a></li><li><ol><li class="subsubsection"><a href="beginning.html#sec-1_3_1_1">First-time system setup</a></li><li class="subsubsection"><a href="beginning.html#sec-1_3_1_2">First-time repository setup</a></li></ol></li><li class="subsection"><a href="beginning.html#sec-adding_and_committing"><span class="number">1.3.2</span> Adding and committing</a></li><li class="subsection"><a href="beginning.html#sec-1_3_3"><span class="number">1.3.3</span> What good does Git do you?</a></li><li class="subsection"><a href="beginning.html#sec-github"><span class="number">1.3.4</span> GitHub</a></li><li class="subsection"><a href="beginning.html#sec-git_commands"><span class="number">1.3.5</span> Branch, edit, commit, merge</a></li><li><ol><li class="subsubsection"><a href="beginning.html#sec-git_branch">Branch</a></li><li class="subsubsection"><a href="beginning.html#sec-git_edit">Edit</a></li><li class="subsubsection"><a href="beginning.html#sec-git_commit">Commit</a></li><li class="subsubsection"><a href="beginning.html#sec-git_merge">Merge</a></li><li class="subsubsection"><a href="beginning.html#sec-git_push">Push</a></li></ol></li></ol></li><li class="section"><a href="beginning.html#sec-deploying"><span class="number">1.4</span> Deploying</a></li><li><ol><li class="subsection"><a href="beginning.html#sec-heroku_setup"><span class="number">1.4.1</span> Heroku setup</a></li><li class="subsection"><a href="beginning.html#sec-heroku_step_one"><span class="number">1.4.2</span> Heroku deployment, step one</a></li><li class="subsection"><a href="beginning.html#sec-1_4_3"><span class="number">1.4.3</span> Heroku deployment, step two</a></li><li class="subsection"><a href="beginning.html#sec-heroku_commands"><span class="number">1.4.4</span> Heroku commands</a></li></ol></li><li class="section"><a href="beginning.html#sec-beginning_conclusion"><span class="number">1.5</span> Conclusion</a></li></ol></li><li class="chapter"><a href="a-demo-app.html#top"><span class="number">Chapter 2</span> A demo app</a></li><li><ol><li class="section"><a href="a-demo-app.html#sec-planning_the_application"><span class="number">2.1</span> Planning the application</a></li><li><ol><li class="subsection"><a href="a-demo-app.html#sec-modeling_demo_users"><span class="number">2.1.1</span> Modeling demo users</a></li><li class="subsection"><a href="a-demo-app.html#sec-modeling_demo_microposts"><span class="number">2.1.2</span> Modeling demo microposts</a></li></ol></li><li class="section"><a href="a-demo-app.html#sec-demo_users_resource"><span class="number">2.2</span> The Users resource</a></li><li><ol><li class="subsection"><a href="a-demo-app.html#sec-a_user_tour"><span class="number">2.2.1</span> A user tour</a></li><li class="subsection"><a href="a-demo-app.html#sec-mvc_in_action"><span class="number">2.2.2</span> MVC in action</a></li><li class="subsection"><a href="a-demo-app.html#sec-weaknesses_of_this_users_resource"><span class="number">2.2.3</span> Weaknesses of this Users resource</a></li></ol></li><li class="section"><a href="a-demo-app.html#sec-microposts_resource"><span class="number">2.3</span> The Microposts resource</a></li><li><ol><li class="subsection"><a href="a-demo-app.html#sec-a_micropost_microtour"><span class="number">2.3.1</span> A micropost microtour</a></li><li class="subsection"><a href="a-demo-app.html#sec-putting_the_micro_in_microposts"><span class="number">2.3.2</span> Putting the <em>micro</em> in microposts</a></li><li class="subsection"><a href="a-demo-app.html#sec-demo_user_has_many_microposts"><span class="number">2.3.3</span> A user <tt>has_many</tt> microposts</a></li><li class="subsection"><a href="a-demo-app.html#sec-inheritance_hierarchies"><span class="number">2.3.4</span> Inheritance hierarchies</a></li><li class="subsection"><a href="a-demo-app.html#sec-deploying_the_demo_app"><span class="number">2.3.5</span> Deploying the demo app</a></li></ol></li><li class="section"><a href="a-demo-app.html#sec-2_4"><span class="number">2.4</span> Conclusion</a></li></ol></li><li class="chapter"><a href="static-pages.html#top"><span class="number">Chapter 3</span> Mostly static pages</a></li><li><ol><li class="section"><a href="static-pages.html#sec-static_pages"><span class="number">3.1</span> Static pages</a></li><li><ol><li class="subsection"><a href="static-pages.html#sec-truly_static_pages"><span class="number">3.1.1</span> Truly static pages</a></li><li class="subsection"><a href="static-pages.html#sec-static_pages_with_rails"><span class="number">3.1.2</span> Static pages with Rails</a></li></ol></li><li class="section"><a href="static-pages.html#sec-first_tests"><span class="number">3.2</span> Our first tests</a></li><li><ol><li class="subsection"><a href="static-pages.html#sec-TDD"><span class="number">3.2.1</span> Test-driven development</a></li><li class="subsection"><a href="static-pages.html#sec-adding_a_page"><span class="number">3.2.2</span> Adding a page</a></li><li><ol><li class="subsubsection"><a href="static-pages.html#sec-red">Red</a></li><li class="subsubsection"><a href="static-pages.html#sec-green">Green</a></li><li class="subsubsection"><a href="static-pages.html#sec-refactor">Refactor</a></li></ol></li></ol></li><li class="section"><a href="static-pages.html#sec-slightly_dynamic_pages"><span class="number">3.3</span> Slightly dynamic pages</a></li><li><ol><li class="subsection"><a href="static-pages.html#sec-testing_a_title_change"><span class="number">3.3.1</span> Testing a title change</a></li><li class="subsection"><a href="static-pages.html#sec-passing_title_tests"><span class="number">3.3.2</span> Passing title tests</a></li><li class="subsection"><a href="static-pages.html#sec-embedded_ruby"><span class="number">3.3.3</span> Embedded Ruby</a></li><li class="subsection"><a href="static-pages.html#sec-layouts"><span class="number">3.3.4</span> Eliminating duplication with layouts</a></li></ol></li><li class="section"><a href="static-pages.html#sec-static_pages_conclusion"><span class="number">3.4</span> Conclusion</a></li><li class="section"><a href="static-pages.html#sec-static_pages_exercises"><span class="number">3.5</span> Exercises</a></li><li class="section"><a href="static-pages.html#sec-advanced_setup"><span class="number">3.6</span> Advanced setup</a></li><li><ol><li class="subsection"><a href="static-pages.html#sec-eliminating_bundle_exec"><span class="number">3.6.1</span> Eliminating <tt>bundle exec</tt></a></li><li><ol><li class="subsubsection"><a href="static-pages.html#sec-rvm_bundler_integration">RVM Bundler integration</a></li><li class="subsubsection"><a href="static-pages.html#sec-binstubs">binstubs</a></li></ol></li><li class="subsection"><a href="static-pages.html#sec-guard"><span class="number">3.6.2</span> Automated tests with Guard</a></li><li class="subsection"><a href="static-pages.html#sec-spork"><span class="number">3.6.3</span> Speeding up tests with Spork</a></li><li><ol><li class="subsubsection"><a href="static-pages.html#sec-spork_and_guard">Guard with Spork</a></li></ol></li><li class="subsection"><a href="static-pages.html#sec-tests_inside_sublime_text"><span class="number">3.6.4</span> Tests inside Sublime Text</a></li></ol></li></ol></li><li class="chapter"><a href="rails-flavored-ruby.html#top"><span class="number">Chapter 4</span> Rails-flavored Ruby</a></li><li><ol><li class="section"><a href="rails-flavored-ruby.html#sec-motivation"><span class="number">4.1</span> Motivation</a></li><li class="section"><a href="rails-flavored-ruby.html#sec-strings_and_methods"><span class="number">4.2</span> Strings and methods</a></li><li><ol><li class="subsection"><a href="rails-flavored-ruby.html#sec-comments"><span class="number">4.2.1</span> Comments</a></li><li class="subsection"><a href="rails-flavored-ruby.html#sec-strings"><span class="number">4.2.2</span> Strings</a></li><li><ol><li class="subsubsection"><a href="rails-flavored-ruby.html#sec-printing">Printing</a></li><li class="subsubsection"><a href="rails-flavored-ruby.html#sec-single_quoted_strings">Single-quoted strings</a></li></ol></li><li class="subsection"><a href="rails-flavored-ruby.html#sec-objects_and_message_passing"><span class="number">4.2.3</span> Objects and message passing</a></li><li class="subsection"><a href="rails-flavored-ruby.html#sec-method_definitions"><span class="number">4.2.4</span> Method definitions</a></li><li class="subsection"><a href="rails-flavored-ruby.html#sec-back_to_the_title_helper"><span class="number">4.2.5</span> Back to the title helper</a></li></ol></li><li class="section"><a href="rails-flavored-ruby.html#sec-other_data_structures"><span class="number">4.3</span> Other data structures</a></li><li><ol><li class="subsection"><a href="rails-flavored-ruby.html#sec-arrays_and_ranges"><span class="number">4.3.1</span> Arrays and ranges</a></li><li class="subsection"><a href="rails-flavored-ruby.html#sec-blocks"><span class="number">4.3.2</span> Blocks</a></li><li class="subsection"><a href="rails-flavored-ruby.html#sec-hashes_and_symbols"><span class="number">4.3.3</span> Hashes and symbols</a></li><li class="subsection"><a href="rails-flavored-ruby.html#sec-css_revisited"><span class="number">4.3.4</span> CSS revisited</a></li></ol></li><li class="section"><a href="rails-flavored-ruby.html#sec-ruby_classes"><span class="number">4.4</span> Ruby classes</a></li><li><ol><li class="subsection"><a href="rails-flavored-ruby.html#sec-constructors"><span class="number">4.4.1</span> Constructors</a></li><li class="subsection"><a href="rails-flavored-ruby.html#sec-a_class_of_our_own"><span class="number">4.4.2</span> Class inheritance</a></li><li class="subsection"><a href="rails-flavored-ruby.html#sec-modifying_built_in_classes"><span class="number">4.4.3</span> Modifying built-in classes</a></li><li class="subsection"><a href="rails-flavored-ruby.html#sec-a_controller_class"><span class="number">4.4.4</span> A controller class</a></li><li class="subsection"><a href="rails-flavored-ruby.html#sec-a_user_class"><span class="number">4.4.5</span> A user class</a></li></ol></li><li class="section"><a href="rails-flavored-ruby.html#sec-conclusion"><span class="number">4.5</span> Conclusion</a></li><li class="section"><a href="rails-flavored-ruby.html#sec-exercises"><span class="number">4.6</span> Exercises</a></li></ol></li><li class="chapter"><a href="filling-in-the-layout.html#top"><span class="number">Chapter 5</span> Filling in the layout</a></li><li><ol><li class="section"><a href="filling-in-the-layout.html#sec-structure"><span class="number">5.1</span> Adding some structure</a></li><li><ol><li class="subsection"><a href="filling-in-the-layout.html#sec-adding_to_the_layout"><span class="number">5.1.1</span> Site navigation</a></li><li class="subsection"><a href="filling-in-the-layout.html#sec-custom_css"><span class="number">5.1.2</span> Bootstrap and custom CSS</a></li><li class="subsection"><a href="filling-in-the-layout.html#sec-partials"><span class="number">5.1.3</span> Partials</a></li></ol></li><li class="section"><a href="filling-in-the-layout.html#sec-sass_and_the_asset_pipeline"><span class="number">5.2</span> Sass and the asset pipeline</a></li><li><ol><li class="subsection"><a href="filling-in-the-layout.html#sec-the_asset_pipeline"><span class="number">5.2.1</span> The asset pipeline</a></li><li><ol><li class="subsubsection"><a href="filling-in-the-layout.html#sec-5_2_1_1">Asset directories</a></li><li class="subsubsection"><a href="filling-in-the-layout.html#sec-5_2_1_2">Manifest files</a></li><li class="subsubsection"><a href="filling-in-the-layout.html#sec-5_2_1_3">Preprocessor engines</a></li><li class="subsubsection"><a href="filling-in-the-layout.html#sec-5_2_1_4">Efficiency in production</a></li></ol></li><li class="subsection"><a href="filling-in-the-layout.html#sec-sass"><span class="number">5.2.2</span> Syntactically awesome stylesheets</a></li><li><ol><li class="subsubsection"><a href="filling-in-the-layout.html#sec-5_2_2_1">Nesting</a></li><li class="subsubsection"><a href="filling-in-the-layout.html#sec-5_2_2_2">Variables</a></li></ol></li></ol></li><li class="section"><a href="filling-in-the-layout.html#sec-layout_links"><span class="number">5.3</span> Layout links</a></li><li><ol><li class="subsection"><a href="filling-in-the-layout.html#sec-route_tests"><span class="number">5.3.1</span> Route tests</a></li><li class="subsection"><a href="filling-in-the-layout.html#sec-rails_routes"><span class="number">5.3.2</span> Rails routes</a></li><li class="subsection"><a href="filling-in-the-layout.html#sec-named_routes"><span class="number">5.3.3</span> Named routes</a></li><li class="subsection"><a href="filling-in-the-layout.html#sec-pretty_rspec"><span class="number">5.3.4</span> Pretty RSpec</a></li></ol></li><li class="section"><a href="filling-in-the-layout.html#sec-user_signup"><span class="number">5.4</span> User signup: A first step</a></li><li><ol><li class="subsection"><a href="filling-in-the-layout.html#sec-users_controller"><span class="number">5.4.1</span> Users controller</a></li><li class="subsection"><a href="filling-in-the-layout.html#sec-signup_url"><span class="number">5.4.2</span> Signup URI</a></li></ol></li><li class="section"><a href="filling-in-the-layout.html#sec-layout_conclusion"><span class="number">5.5</span> Conclusion</a></li><li class="section"><a href="filling-in-the-layout.html#sec-layout_exercises"><span class="number">5.6</span> Exercises</a></li></ol></li><li class="chapter"><a href="modeling-users.html#top"><span class="number">Chapter 6</span> Modeling users</a></li><li><ol><li class="section"><a href="modeling-users.html#sec-user_model"><span class="number">6.1</span> User model</a></li><li><ol><li class="subsection"><a href="modeling-users.html#sec-database_migrations"><span class="number">6.1.1</span> Database migrations</a></li><li class="subsection"><a href="modeling-users.html#sec-the_model_file"><span class="number">6.1.2</span> The model file</a></li><li><ol><li class="subsubsection"><a href="modeling-users.html#sec-model_annotation">Model annotation</a></li><li class="subsubsection"><a href="modeling-users.html#sec-accessible_attributes">Accessible attributes</a></li></ol></li><li class="subsection"><a href="modeling-users.html#sec-creating_user_objects"><span class="number">6.1.3</span> Creating user objects</a></li><li class="subsection"><a href="modeling-users.html#sec-finding_user_objects"><span class="number">6.1.4</span> Finding user objects</a></li><li class="subsection"><a href="modeling-users.html#sec-updating_user_objects"><span class="number">6.1.5</span> Updating user objects</a></li></ol></li><li class="section"><a href="modeling-users.html#sec-user_validations"><span class="number">6.2</span> User validations</a></li><li><ol><li class="subsection"><a href="modeling-users.html#sec-initial_user_tests"><span class="number">6.2.1</span> Initial user tests</a></li><li class="subsection"><a href="modeling-users.html#sec-presence_validation"><span class="number">6.2.2</span> Validating presence</a></li><li class="subsection"><a href="modeling-users.html#sec-length_validation"><span class="number">6.2.3</span> Length validation</a></li><li class="subsection"><a href="modeling-users.html#sec-format_validation"><span class="number">6.2.4</span> Format validation</a></li><li class="subsection"><a href="modeling-users.html#sec-uniqueness_validation"><span class="number">6.2.5</span> Uniqueness validation</a></li><li><ol><li class="subsubsection"><a href="modeling-users.html#sec-the_caveat">The uniqueness caveat</a></li></ol></li></ol></li><li class="section"><a href="modeling-users.html#sec-adding_a_secure_password"><span class="number">6.3</span> Adding a secure password</a></li><li><ol><li class="subsection"><a href="modeling-users.html#sec-an_encrypted_password"><span class="number">6.3.1</span> An encrypted password</a></li><li class="subsection"><a href="modeling-users.html#sec-password_and_confirmation"><span class="number">6.3.2</span> Password and confirmation</a></li><li class="subsection"><a href="modeling-users.html#sec-user_authentication"><span class="number">6.3.3</span> User authentication</a></li><li class="subsection"><a href="modeling-users.html#sec-has_secure_password"><span class="number">6.3.4</span> User has secure password</a></li><li class="subsection"><a href="modeling-users.html#sec-creating_a_user"><span class="number">6.3.5</span> Creating a user</a></li></ol></li><li class="section"><a href="modeling-users.html#sec-6_4"><span class="number">6.4</span> Conclusion</a></li><li class="section"><a href="modeling-users.html#sec-6_5"><span class="number">6.5</span> Exercises</a></li></ol></li><li class="chapter"><a href="sign-up.html#top"><span class="number">Chapter 7</span> Sign up</a></li><li><ol><li class="section"><a href="sign-up.html#sec-showing_users"><span class="number">7.1</span> Showing users</a></li><li><ol><li class="subsection"><a href="sign-up.html#sec-rails_environments"><span class="number">7.1.1</span> Debug and Rails environments</a></li><li class="subsection"><a href="sign-up.html#sec-a_users_resource"><span class="number">7.1.2</span> A Users resource</a></li><li class="subsection"><a href="sign-up.html#sec-tests_with_factories"><span class="number">7.1.3</span> Testing the user show page (with factories)</a></li><li class="subsection"><a href="sign-up.html#sec-a_gravatar_image"><span class="number">7.1.4</span> A Gravatar image and a sidebar</a></li></ol></li><li class="section"><a href="sign-up.html#sec-signup_form"><span class="number">7.2</span> Signup form</a></li><li><ol><li class="subsection"><a href="sign-up.html#sec-tests_for_user_signup"><span class="number">7.2.1</span> Tests for user signup</a></li><li class="subsection"><a href="sign-up.html#sec-using_form_for"><span class="number">7.2.2</span> Using <tt>form_for</tt></a></li><li class="subsection"><a href="sign-up.html#sec-the_form_html"><span class="number">7.2.3</span> The form HTML</a></li></ol></li><li class="section"><a href="sign-up.html#sec-signup_failure"><span class="number">7.3</span> Signup failure</a></li><li><ol><li class="subsection"><a href="sign-up.html#sec-a_working_form"><span class="number">7.3.1</span> A working form</a></li><li class="subsection"><a href="sign-up.html#sec-signup_error_messages"><span class="number">7.3.2</span> Signup error messages</a></li></ol></li><li class="section"><a href="sign-up.html#sec-signup_success"><span class="number">7.4</span> Signup success</a></li><li><ol><li class="subsection"><a href="sign-up.html#sec-the_finished_signup_form"><span class="number">7.4.1</span> The finished signup form</a></li><li class="subsection"><a href="sign-up.html#sec-the_flash"><span class="number">7.4.2</span> The flash</a></li><li class="subsection"><a href="sign-up.html#sec-the_first_signup"><span class="number">7.4.3</span> The first signup</a></li><li class="subsection"><a href="sign-up.html#sec-deploying_to_production_with_ssl"><span class="number">7.4.4</span> Deploying to production with SSL</a></li></ol></li><li class="section"><a href="sign-up.html#sec-7_5"><span class="number">7.5</span> Conclusion</a></li><li class="section"><a href="sign-up.html#sec-signup_exercises"><span class="number">7.6</span> Exercises</a></li></ol></li><li class="chapter"><a href="sign-in-sign-out.html#top"><span class="number">Chapter 8</span> Sign in, sign out</a></li><li><ol><li class="section"><a href="sign-in-sign-out.html#sec-signin_failure"><span class="number">8.1</span> Sessions and signin failure</a></li><li><ol><li class="subsection"><a href="sign-in-sign-out.html#sec-sessions_controller"><span class="number">8.1.1</span> Sessions controller</a></li><li class="subsection"><a href="sign-in-sign-out.html#sec-signin_tests"><span class="number">8.1.2</span> Signin tests</a></li><li class="subsection"><a href="sign-in-sign-out.html#sec-signin_form"><span class="number">8.1.3</span> Signin form</a></li><li class="subsection"><a href="sign-in-sign-out.html#sec-reviewing_form_submission"><span class="number">8.1.4</span> Reviewing form submission</a></li><li class="subsection"><a href="sign-in-sign-out.html#sec-rendering_with_a_flash_message"><span class="number">8.1.5</span> Rendering with a flash message</a></li></ol></li><li class="section"><a href="sign-in-sign-out.html#sec-signin_success"><span class="number">8.2</span> Signin success</a></li><li><ol><li class="subsection"><a href="sign-in-sign-out.html#sec-remember_me"><span class="number">8.2.1</span> Remember me</a></li><li class="subsection"><a href="sign-in-sign-out.html#sec-a_working_sign_in_method"><span class="number">8.2.2</span> A working <tt>sign_in</tt> method</a></li><li class="subsection"><a href="sign-in-sign-out.html#sec-current_user"><span class="number">8.2.3</span> Current user</a></li><li class="subsection"><a href="sign-in-sign-out.html#sec-changing_the_layout_links"><span class="number">8.2.4</span> Changing the layout links</a></li><li class="subsection"><a href="sign-in-sign-out.html#sec-signin_upon_signup"><span class="number">8.2.5</span> Signin upon signup</a></li><li class="subsection"><a href="sign-in-sign-out.html#sec-signing_out"><span class="number">8.2.6</span> Signing out</a></li></ol></li><li class="section"><a href="sign-in-sign-out.html#sec-cucumber"><span class="number">8.3</span> Introduction to Cucumber (optional)</a></li><li><ol><li class="subsection"><a href="sign-in-sign-out.html#sec-installation_and_setup"><span class="number">8.3.1</span> Installation and setup</a></li><li class="subsection"><a href="sign-in-sign-out.html#sec-features_and_steps"><span class="number">8.3.2</span> Features and steps</a></li><li class="subsection"><a href="sign-in-sign-out.html#sec-rspec_custom_matchers"><span class="number">8.3.3</span> Counterpoint: RSpec custom matchers</a></li></ol></li><li class="section"><a href="sign-in-sign-out.html#sec-8_4"><span class="number">8.4</span> Conclusion</a></li><li class="section"><a href="sign-in-sign-out.html#sec-sign_in_out_exercises"><span class="number">8.5</span> Exercises</a></li></ol></li><li class="chapter"><a href="updating-showing-and-deleting-users.html#top"><span class="number">Chapter 9</span> Updating, showing, and deleting users</a></li><li><ol><li class="section"><a href="updating-showing-and-deleting-users.html#sec-updating_users"><span class="number">9.1</span> Updating users</a></li><li><ol><li class="subsection"><a href="updating-showing-and-deleting-users.html#sec-edit_form"><span class="number">9.1.1</span> Edit form</a></li><li class="subsection"><a href="updating-showing-and-deleting-users.html#sec-unsuccessful_edits"><span class="number">9.1.2</span> Unsuccessful edits</a></li><li class="subsection"><a href="updating-showing-and-deleting-users.html#sec-successful_edits"><span class="number">9.1.3</span> Successful edits</a></li></ol></li><li class="section"><a href="updating-showing-and-deleting-users.html#sec-authorization"><span class="number">9.2</span> Authorization</a></li><li><ol><li class="subsection"><a href="updating-showing-and-deleting-users.html#sec-requiring_signed_in_users"><span class="number">9.2.1</span> Requiring signed-in users</a></li><li class="subsection"><a href="updating-showing-and-deleting-users.html#sec-requiring_the_right_user"><span class="number">9.2.2</span> Requiring the right user</a></li><li class="subsection"><a href="updating-showing-and-deleting-users.html#sec-friendly_forwarding"><span class="number">9.2.3</span> Friendly forwarding</a></li></ol></li><li class="section"><a href="updating-showing-and-deleting-users.html#sec-showing_all_users"><span class="number">9.3</span> Showing all users</a></li><li><ol><li class="subsection"><a href="updating-showing-and-deleting-users.html#sec-user_index"><span class="number">9.3.1</span> User index</a></li><li class="subsection"><a href="updating-showing-and-deleting-users.html#sec-sample_users"><span class="number">9.3.2</span> Sample users</a></li><li class="subsection"><a href="updating-showing-and-deleting-users.html#sec-pagination"><span class="number">9.3.3</span> Pagination</a></li><li class="subsection"><a href="updating-showing-and-deleting-users.html#sec-partial_refactoring"><span class="number">9.3.4</span> Partial refactoring</a></li></ol></li><li class="section"><a href="updating-showing-and-deleting-users.html#sec-destroying_users"><span class="number">9.4</span> Deleting users</a></li><li><ol><li class="subsection"><a href="updating-showing-and-deleting-users.html#sec-administrative_users"><span class="number">9.4.1</span> Administrative users</a></li><li><ol><li class="subsubsection"><a href="updating-showing-and-deleting-users.html#sec-revisiting_attr_accessible">Revisiting <tt>attr_accessible</tt></a></li></ol></li><li class="subsection"><a href="updating-showing-and-deleting-users.html#sec-the_destroy_action"><span class="number">9.4.2</span> The <tt>destroy</tt> action</a></li></ol></li><li class="section"><a href="updating-showing-and-deleting-users.html#sec-updating_and_deleting_users_conclusion"><span class="number">9.5</span> Conclusion</a></li><li class="section"><a href="updating-showing-and-deleting-users.html#sec-updating_deleting_exercises"><span class="number">9.6</span> Exercises</a></li></ol></li><li class="chapter"><a href="user-microposts.html#top"><span class="number">Chapter 10</span> User microposts</a></li><li><ol><li class="section"><a href="user-microposts.html#sec-a_micropost_model"><span class="number">10.1</span> A Micropost model</a></li><li><ol><li class="subsection"><a href="user-microposts.html#sec-the_basic_model"><span class="number">10.1.1</span> The basic model</a></li><li class="subsection"><a href="user-microposts.html#sec-accessible_attribute"><span class="number">10.1.2</span> Accessible attributes and the first validation</a></li><li class="subsection"><a href="user-microposts.html#sec-user_micropost_associations"><span class="number">10.1.3</span> User/Micropost associations</a></li><li class="subsection"><a href="user-microposts.html#sec-ordering_and_dependency"><span class="number">10.1.4</span> Micropost refinements</a></li><li><ol><li class="subsubsection"><a href="user-microposts.html#sec-default_scope">Default scope</a></li><li class="subsubsection"><a href="user-microposts.html#sec-dependent_destroy">Dependent: destroy</a></li></ol></li><li class="subsection"><a href="user-microposts.html#sec-micropost_validations"><span class="number">10.1.5</span> Content validations</a></li></ol></li><li class="section"><a href="user-microposts.html#sec-showing_microposts"><span class="number">10.2</span> Showing microposts</a></li><li><ol><li class="subsection"><a href="user-microposts.html#sec-augmenting_the_user_show_page"><span class="number">10.2.1</span> Augmenting the user show page</a></li><li class="subsection"><a href="user-microposts.html#sec-sample_microposts"><span class="number">10.2.2</span> Sample microposts</a></li></ol></li><li class="section"><a href="user-microposts.html#sec-manipulating_microposts"><span class="number">10.3</span> Manipulating microposts</a></li><li><ol><li class="subsection"><a href="user-microposts.html#sec-access_control"><span class="number">10.3.1</span> Access control</a></li><li class="subsection"><a href="user-microposts.html#sec-creating_microposts"><span class="number">10.3.2</span> Creating microposts</a></li><li class="subsection"><a href="user-microposts.html#sec-a_proto_feed"><span class="number">10.3.3</span> A proto-feed</a></li><li class="subsection"><a href="user-microposts.html#sec-destroying_microposts"><span class="number">10.3.4</span> Destroying microposts</a></li></ol></li><li class="section"><a href="user-microposts.html#sec-10_4"><span class="number">10.4</span> Conclusion</a></li><li class="section"><a href="user-microposts.html#sec-micropost_exercises"><span class="number">10.5</span> Exercises</a></li></ol></li><li class="chapter"><a href="following-users.html#top"><span class="number">Chapter 11</span> Following users</a></li><li><ol><li class="section"><a href="following-users.html#sec-the_relationship_model"><span class="number">11.1</span> The Relationship model</a></li><li><ol><li class="subsection"><a href="following-users.html#sec-a_problem_with_the_data_model"><span class="number">11.1.1</span> A problem with the data model (and a solution)</a></li><li class="subsection"><a href="following-users.html#sec-relationship_user_associations"><span class="number">11.1.2</span> User/relationship associations</a></li><li class="subsection"><a href="following-users.html#sec-relationship_validations"><span class="number">11.1.3</span> Validations</a></li><li class="subsection"><a href="following-users.html#sec-following"><span class="number">11.1.4</span> Followed users</a></li><li class="subsection"><a href="following-users.html#sec-followers"><span class="number">11.1.5</span> Followers</a></li></ol></li><li class="section"><a href="following-users.html#sec-a_web_interface_for_following_and_followers"><span class="number">11.2</span> A web interface for following users</a></li><li><ol><li class="subsection"><a href="following-users.html#sec-sample_following_data"><span class="number">11.2.1</span> Sample following data</a></li><li class="subsection"><a href="following-users.html#sec-stats_and_a_follow_form"><span class="number">11.2.2</span> Stats and a follow form</a></li><li class="subsection"><a href="following-users.html#sec-following_and_followers_pages"><span class="number">11.2.3</span> Following and followers pages</a></li><li class="subsection"><a href="following-users.html#sec-a_working_follow_button_the_standard_way"><span class="number">11.2.4</span> A working follow button the standard way</a></li><li class="subsection"><a href="following-users.html#sec-a_working_follow_button_with_ajax"><span class="number">11.2.5</span> A working follow button with Ajax</a></li></ol></li><li class="section"><a href="following-users.html#sec-the_status_feed"><span class="number">11.3</span> The status feed</a></li><li><ol><li class="subsection"><a href="following-users.html#sec-motivation_and_strategy"><span class="number">11.3.1</span> Motivation and strategy</a></li><li class="subsection"><a href="following-users.html#sec-a_first_feed_implementation"><span class="number">11.3.2</span> A first feed implementation</a></li><li class="subsection"><a href="following-users.html#sec-scopes_subselects_and_a_lambda"><span class="number">11.3.3</span> Subselects</a></li><li class="subsection"><a href="following-users.html#sec-the_new_status_feed"><span class="number">11.3.4</span> The new status feed</a></li></ol></li><li class="section"><a href="following-users.html#sec-following_conclusion"><span class="number">11.4</span> Conclusion</a></li><li><ol><li class="subsection"><a href="following-users.html#sec-extensions_to_the_sample_application"><span class="number">11.4.1</span> Extensions to the sample application</a></li><li><ol><li class="subsubsection"><a href="following-users.html#sec-replies">Replies</a></li><li class="subsubsection"><a href="following-users.html#sec-messaging">Messaging</a></li><li class="subsubsection"><a href="following-users.html#sec-follower_notifications">Follower notifications</a></li><li class="subsubsection"><a href="following-users.html#sec-password_reminders">Password reminders</a></li><li class="subsubsection"><a href="following-users.html#sec-signup_confirmation">Signup confirmation</a></li><li class="subsubsection"><a href="following-users.html#sec-rss_feed">RSS feed</a></li><li class="subsubsection"><a href="following-users.html#sec-rest_api">REST API</a></li><li class="subsubsection"><a href="following-users.html#sec-search">Search</a></li></ol></li><li class="subsection"><a href="following-users.html#sec-guide_to_further_resources"><span class="number">11.4.2</span> Guide to further resources</a></li></ol></li><li class="section"><a href="following-users.html#sec-following_exercises"><span class="number">11.5</span> Exercises</a></li></ol></li><li class="chapter"><a href="supplement.html#top"><span class="number">Chapter 12</span> Rails 4.0 supplement</a></li><li><ol><li class="section"><a href="supplement.html#sec-upgrading_from_rails_3_2_to_4_0"><span class="number">12.1</span> Upgrading from Rails 3.2 to 4.0</a></li><li><ol><li class="subsection"><a href="supplement.html#sec-rails_4_0_setup"><span class="number">12.1.1</span> Rails 4.0 setup</a></li><li class="subsection"><a href="supplement.html#sec-getting_to_green"><span class="number">12.1.2</span> Getting to green</a></li><li class="subsection"><a href="supplement.html#sec-some_specific_issues"><span class="number">12.1.3</span> Some specific issues</a></li><li><ol><li class="subsubsection"><a href="supplement.html#sec-models">Models</a></li><li class="subsubsection"><a href="supplement.html#sec-controllers_and_views">Controllers and views</a></li></ol></li><li class="subsection"><a href="supplement.html#sec-finishing_up"><span class="number">12.1.4</span> Finishing up</a></li><li class="subsection"><a href="supplement.html#sec-additional_resources"><span class="number">12.1.5</span> Additional resources</a></li></ol></li><li class="section"><a href="supplement.html#sec-strong_parameters"><span class="number">12.2</span> Strong parameters</a></li><li class="section"><a href="supplement.html#sec-security_updates"><span class="number">12.3</span> Security updates</a></li><li><ol><li class="subsection"><a href="supplement.html#sec-secret_key"><span class="number">12.3.1</span> Secret key</a></li><li class="subsection"><a href="supplement.html#sec-encrypted_remember_tokens"><span class="number">12.3.2</span> Hashed remember tokens</a></li></ol></li></ol></li></ol></div>
<div id="main_content"></div>
<p> <span class="preamble">
<span id="foreword">
<strong> Foreword</strong> <br />
</span>
</span></p>
<p>My former company (CD Baby) was one of the first to loudly switch to Ruby on Rails, and then even more loudly switch back to PHP (Google me to read about the drama). This book by Michael Hartl came so highly recommended that I had to try it, and the <em>Ruby on Rails Tutorial</em> is what I used to switch back to Rails again.</p>
<p>Though I’ve worked my way through many Rails books, this is the one that finally made me “get” it. Everything is done very much “the Rails way”—a way that felt very unnatural to me before, but now after doing this book finally feels natural. This is also the only Rails book that does test-driven development the entire time, an approach highly recommended by the experts but which has never been so clearly demonstrated before. Finally, by including Git, GitHub, and Heroku in the demo examples, the author really gives you a feel for what it’s like to do a real-world project. The tutorial’s code examples are not in isolation.</p>
<p>The linear narrative is such a great format. Personally, I powered through the <em>Rails Tutorial</em> in three long days, doing all the examples and challenges at the end of each chapter. Do it from start to finish, without jumping around, and you’ll get the ultimate benefit.</p>
<p>Enjoy!</p>
<p><a href="http://sivers.org/">Derek Sivers</a> (<a href="http://sivers.org/">sivers.org</a>) <br />
<em>Founder, CD Baby</em> <br /></p>
<p> <span class="preamble">
<strong> Acknowledgments</strong> <br />
</span></p>
<p>The <em>Ruby on Rails Tutorial</em> owes a lot to my previous Rails book, <em>RailsSpace</em>, and hence to my coauthor <a href="http://aure.com/">Aurelius Prochazka</a>. I’d like to thank Aure both for the work he did on that book and for his support of this one. I’d also like to thank Debra Williams Cauley, my editor on both <em>RailsSpace</em> and the <em>Ruby on Rails Tutorial</em>; as long as she keeps taking me to baseball games, I’ll keep writing books for her.</p>
<p>I’d like to acknowledge a long list of Rubyists who have taught and inspired me over the years: David Heinemeier Hansson, Yehuda Katz, Carl Lerche, Jeremy Kemper, Xavier Noria, Ryan Bates, Geoffrey Grosenbach, Peter Cooper, Matt Aimonetti, Gregg Pollack, Wayne E. Seguin, Amy Hoy, Dave Chelimsky, Pat Maddox, Tom Preston-Werner, Chris Wanstrath, Chad Fowler, Josh Susser, Obie Fernandez, Ian McFarland, Steven Bristol, Pratik Naik, Sarah Mei, Sarah Allen, Wolfram Arnold, Alex Chaffee, Giles Bowkett, Evan Dorn, Long Nguyen, James Lindenbaum, Adam Wiggins, Tikhon Bernstam, Ron Evans, Wyatt Greene, Miles Forrest, the good people at Pivotal Labs, the Heroku gang, the thoughtbot guys, and the GitHub crew. Finally, many, many readers—far too many to list—have contributed a huge number of bug reports and suggestions during the writing of this book, and I gratefully acknowledge their help in making it as good as it can be. <br /></p>
<p> <span class="preamble">
<span id="author">
<strong> About the author</strong> <br />
</span>
</span></p>
<p><a href="http://michaelhartl.com/">Michael Hartl</a> is the author of the <a href="http://ruby.railstutorial.org/"><em>Ruby on Rails Tutorial</em></a>, the leading introduction to web development with <a href="http://rubyonrails.org/">Ruby on Rails</a>. His prior experience includes writing and developing <em>RailsSpace</em>, an extremely obsolete Rails tutorial book, and developing Insoshi, a once-popular and now-obsolete social networking platform in Ruby on Rails. In 2011, Michael received a <a href="http://rubyheroes.com/heroes">Ruby Hero Award</a> for his contributions to the Ruby community. He is a graduate of <a href="http://college.harvard.edu/">Harvard College</a>, has a <a href="http://resolver.caltech.edu/CaltechETD:etd-05222003-161626">Ph.D. in Physics</a> from <a href="http://www.caltech.edu/">Caltech</a>, and is an alumnus of the <a href="http://ycombinator.com/">Y Combinator</a> entrepreneur program. <br /></p>
<p> <span id="license" class="preamble">
<strong> Copyright and license</strong> <br />
</span></p>
<p><em>Ruby on Rails Tutorial: Learn Web Development with Rails</em>. Copyright © 2012 by Michael Hartl. All source code in the <em>Ruby on Rails Tutorial</em> is available jointly under the <a href="http://www.opensource.org/licenses/mit-license.php">MIT License</a> and the <a href="http://people.freebsd.org/~phk/">Beerware License</a>.</p>
<div class="code"><div class="highlight"><pre>The MIT License
Copyright (c) 2012 Michael Hartl
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
</pre></div>
</div>
<div class="code"><div class="highlight"><pre>/*
* ----------------------------------------------------------------------------
* "THE BEER-WARE LICENSE" (Revision 42):
* Michael Hartl wrote this code. As long as you retain this notice you
* can do whatever you want with this stuff. If we meet some day, and you think
* this stuff is worth it, you can buy me a beer in return.
* ----------------------------------------------------------------------------
*/
</pre></div>
</div>
<div id="top"></div>
<h1 class="chapter"><a id="sec-9" href="updating-showing-and-deleting-users.html#top" class="heading"><span class="number">Chapter 9</span> Updating, showing, and deleting users</a></h1>
<p>In this chapter, we will complete the REST actions for the Users resource (<a class="ref" href="sign-up.html#table-RESTful_users">Table 7.1</a>) by adding <code>edit</code>, <code>update</code>, <code>index</code>, and <code>destroy</code> actions. We’ll start by giving users the ability to update their profiles, which will also provide a natural opportunity to enforce a security model (made possible by the authorization code in <a class="ref" href="sign-in-sign-out.html#top">Chapter 8</a>). Then we’ll make a listing of all users (also requiring authorization), which will motivate the introduction of sample data and pagination. Finally, we’ll add the ability to destroy users, wiping them clear from the database. Since we can’t allow just any user to have such dangerous powers, we’ll take care to create a privileged class of administrative users (admins) authorized to delete other users.</p>
<p>To get started, let’s start work on an <code>updating-users</code> topic branch:</p>
<div class="code"><div class="highlight"><pre><span class="gp">$</span> git checkout -b updating-users
</pre></div>
</div>
<div class="label" id="sec-updating_users"></div>
<h2><a id="sec-9_1" href="updating-showing-and-deleting-users.html#sec-updating_users" class="heading"><span class="number">9.1</span> Updating users</a></h2>
<p>The pattern for editing user information closely parallels that for creating new users (<a class="ref" href="sign-up.html#top">Chapter 7</a>). Instead of a <code>new</code> action rendering a view for new users, we have an <code>edit</code> action rendering a view to edit users; instead of <code>create</code> responding to a <tt>POST</tt> request, we have an <code>update</code> action responding to a <tt>PUT</tt> request (<a class="ref" href="static-pages.html#sidebar-get_etc">Box 3.2</a>). The biggest difference is that, while anyone can sign up, only the current user should be able to update his information. This means that we need to enforce access control so that only authorized users can edit and update; the authentication machinery from <a class="ref" href="sign-in-sign-out.html#top">Chapter 8</a> will allow us to use a <em>before filter</em> to ensure that this is the case.</p>
<div class="label" id="sec-edit_form"></div>
<h3><a id="sec-9_1_1" href="updating-showing-and-deleting-users.html#sec-edit_form" class="heading"><span class="number">9.1.1</span> Edit form</a></h3>
<p>We start with the edit form, whose mockup appears in <a class="ref" href="updating-showing-and-deleting-users.html#fig-edit_user_mockup">Figure 9.1</a>.<sup class="footnote" id="fnref-9_1"><a href="#fn-9_1">1</a></sup> As usual, we’ll begin with some tests. First, note the link to change the Gravatar image; if you poke around the Gravatar site, you’ll see that the page to add or edit images is located at <a href="http://gravatar.com/emails">http://gravatar.com/emails</a>, so we test the <code>edit</code> page for a link with that URI.<sup class="footnote" id="fnref-9_2"><a href="#fn-9_2">2</a></sup></p>
<div class="label" id="fig-edit_user_mockup"></div>
<div class="figure"><div class="center"><span class="graphic"><img src="images/figures/edit_user_mockup_bootstrap.png" alt="edit_user_mockup_bootstrap" /></span></div><div class="caption"><span class="header">Figure 9.1: </span><span class="description">A mockup of the user edit page. <a href="http://railstutorial.org/images/figures/edit_user_mockup_bootstrap-full.png">(full size)</a></span></div></div>
<p>The tests for the edit user form are analogous to the test for the new user form in <a class="ref" href="sign-up.html#code-error_messages_test">Listing 7.30</a> from the <a class="ref" href="sign-up.html#top">Chapter 7</a> exercises, which added a test for the error message on invalid submission. The result appears in <a class="ref" href="updating-showing-and-deleting-users.html#code-user_edit_specs">Listing 9.1</a>.</p>
<div class="label" id="code-user_edit_specs"></div>
<div class="codelisting">
<div class="listing"><span class="header">Listing 9.1.</span> <span class="description">Tests for the user edit page. <br /> <code>spec/requests/user_pages_spec.rb</code></span> </div>
<div class="code"><div class="highlight"><pre><span class="nb">require</span> <span class="s1">'spec_helper'</span>
<span class="n">describe</span> <span class="s2">"User pages"</span> <span class="k">do</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="n">describe</span> <span class="s2">"edit"</span> <span class="k">do</span>
<span class="n">let</span><span class="p">(</span><span class="ss">:user</span><span class="p">)</span> <span class="p">{</span> <span class="no">FactoryGirl</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="ss">:user</span><span class="p">)</span> <span class="p">}</span>
<span class="n">before</span> <span class="p">{</span> <span class="n">visit</span> <span class="n">edit_user_path</span><span class="p">(</span><span class="n">user</span><span class="p">)</span> <span class="p">}</span>
<span class="n">describe</span> <span class="s2">"page"</span> <span class="k">do</span>
<span class="n">it</span> <span class="p">{</span> <span class="n">should</span> <span class="n">have_selector</span><span class="p">(</span><span class="s1">'h1'</span><span class="p">,</span> <span class="ss">text:</span> <span class="s2">"Update your profile"</span><span class="p">)</span> <span class="p">}</span>
<span class="n">it</span> <span class="p">{</span> <span class="n">should</span> <span class="n">have_selector</span><span class="p">(</span><span class="s1">'title'</span><span class="p">,</span> <span class="ss">text:</span> <span class="s2">"Edit user"</span><span class="p">)</span> <span class="p">}</span>
<span class="n">it</span> <span class="p">{</span> <span class="n">should</span> <span class="n">have_link</span><span class="p">(</span><span class="s1">'change'</span><span class="p">,</span> <span class="ss">href:</span> <span class="s1">'http://gravatar.com/emails'</span><span class="p">)</span> <span class="p">}</span>
<span class="k">end</span>
<span class="n">describe</span> <span class="s2">"with invalid information"</span> <span class="k">do</span>
<span class="n">before</span> <span class="p">{</span> <span class="n">click_button</span> <span class="s2">"Save changes"</span> <span class="p">}</span>
<span class="n">it</span> <span class="p">{</span> <span class="n">should</span> <span class="n">have_content</span><span class="p">(</span><span class="s1">'error'</span><span class="p">)</span> <span class="p">}</span>
<span class="k">end</span>
<span class="k">end</span>
<span class="k">end</span>
</pre></div>
</div></div>
<p>To write the application code, we need to fill in the <code>edit</code> action in the Users controller. Note from <a class="ref" href="sign-up.html#table-RESTful_users">Table 7.1</a> that the proper URI for a user’s edit page is /users/1/edit (assuming the user’s id is <tt>1</tt>). Recall that the id of the user is available in the <code>params[:id]</code> variable, which means that we can find the user with the code in <a class="ref" href="updating-showing-and-deleting-users.html#code-initial_edit_action">Listing 9.2</a>.</p>
<div class="label" id="code-initial_edit_action"></div>
<div class="codelisting">
<div class="listing"><span class="header">Listing 9.2.</span> <span class="description">The user <code>edit</code> action. <br /> <code>app/controllers/users_controller.rb</code></span> </div>
<div class="code"><div class="highlight"><pre><span class="k">class</span> <span class="nc">UsersController</span> <span class="o"><</span> <span class="no">ApplicationController</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="k">def</span> <span class="nf">edit</span>
<span class="vi">@user</span> <span class="o">=</span> <span class="no">User</span><span class="o">.</span><span class="n">find</span><span class="p">(</span><span class="n">params</span><span class="o">[</span><span class="ss">:id</span><span class="o">]</span><span class="p">)</span>
<span class="k">end</span>
<span class="k">end</span>
</pre></div>
</div></div>
<p>Getting the tests to pass requires making the actual edit view, shown in <a class="ref" href="updating-showing-and-deleting-users.html#code-user_edit_view">Listing 9.3</a>. Note how closely this resembles the new user view from <a class="ref" href="sign-up.html#code-signup_form">Listing 7.17</a>; the large overlap suggests factoring the repeated code into a partial, which is left as an exercise (<a class="ref" href="updating-showing-and-deleting-users.html#sec-updating_deleting_exercises">Section 9.6</a>).</p>
<div class="label" id="code-user_edit_view"></div>
<div class="codelisting">
<div class="listing"><span class="header">Listing 9.3.</span> <span class="description">The user edit view. <br /> <code>app/views/users/edit.html.erb</code></span> </div>
<div class="code"><div class="highlight"><pre><span class="cp"><%</span> <span class="n">provide</span><span class="p">(</span><span class="ss">:title</span><span class="p">,</span> <span class="s2">"Edit user"</span><span class="p">)</span> <span class="cp">%></span>
<span class="nt"><h1></span>Update your profile<span class="nt"></h1></span>
<span class="nt"><div</span> <span class="na">class=</span><span class="s">"row"</span><span class="nt">></span>
<span class="nt"><div</span> <span class="na">class=</span><span class="s">"span6 offset3"</span><span class="nt">></span>
<span class="cp"><%=</span> <span class="n">form_for</span><span class="p">(</span><span class="vi">@user</span><span class="p">)</span> <span class="k">do</span> <span class="o">|</span><span class="n">f</span><span class="o">|</span> <span class="cp">%></span>
<span class="cp"><%=</span> <span class="n">render</span> <span class="s1">'shared/error_messages'</span> <span class="cp">%></span>
<span class="cp"><%=</span> <span class="n">f</span><span class="o">.</span><span class="n">label</span> <span class="ss">:name</span> <span class="cp">%></span>
<span class="cp"><%=</span> <span class="n">f</span><span class="o">.</span><span class="n">text_field</span> <span class="ss">:name</span> <span class="cp">%></span>
<span class="cp"><%=</span> <span class="n">f</span><span class="o">.</span><span class="n">label</span> <span class="ss">:email</span> <span class="cp">%></span>
<span class="cp"><%=</span> <span class="n">f</span><span class="o">.</span><span class="n">text_field</span> <span class="ss">:email</span> <span class="cp">%></span>
<span class="cp"><%=</span> <span class="n">f</span><span class="o">.</span><span class="n">label</span> <span class="ss">:password</span> <span class="cp">%></span>
<span class="cp"><%=</span> <span class="n">f</span><span class="o">.</span><span class="n">password_field</span> <span class="ss">:password</span> <span class="cp">%></span>
<span class="cp"><%=</span> <span class="n">f</span><span class="o">.</span><span class="n">label</span> <span class="ss">:password_confirmation</span><span class="p">,</span> <span class="s2">"Confirm Password"</span> <span class="cp">%></span>
<span class="cp"><%=</span> <span class="n">f</span><span class="o">.</span><span class="n">password_field</span> <span class="ss">:password_confirmation</span> <span class="cp">%></span>
<span class="cp"><%=</span> <span class="n">f</span><span class="o">.</span><span class="n">submit</span> <span class="s2">"Save changes"</span><span class="p">,</span> <span class="ss">class:</span> <span class="s2">"btn btn-large btn-primary"</span> <span class="cp">%></span>
<span class="cp"><%</span> <span class="k">end</span> <span class="cp">%></span>
<span class="cp"><%=</span> <span class="n">gravatar_for</span> <span class="vi">@user</span> <span class="cp">%></span>
<span class="nt"><a</span> <span class="na">href=</span><span class="s">"http://gravatar.com/emails"</span><span class="nt">></span>change<span class="nt"></a></span>
<span class="nt"></div></span>
<span class="nt"></div></span>
</pre></div>
</div></div>
<p>Here we have reused the shared <code>error_messages</code> partial introduced in <a class="ref" href="sign-up.html#sec-signup_error_messages">Section 7.3.2</a>.</p>
<p>With the <code>@user</code> instance variable from <a class="ref" href="updating-showing-and-deleting-users.html#code-initial_edit_action">Listing 9.2</a>, the edit page tests from <a class="ref" href="updating-showing-and-deleting-users.html#code-user_edit_specs">Listing 9.1</a> should pass:</p>
<div class="code"><div class="highlight"><pre><span class="gp">$</span> bundle <span class="nb">exec </span>rspec spec/requests/user_pages_spec.rb -e <span class="s2">"edit page"</span>
</pre></div>
</div>
<p>The corresponding page appears in <a class="ref" href="updating-showing-and-deleting-users.html#fig-edit_page">Figure 9.2</a>, which shows how Rails automatically pre-fills the Name and Email fields using the attributes of the <code>@user</code> variable.</p>
<div class="label" id="fig-edit_page"></div>
<div class="figure"><div class="center"><span class="graphic"><img src="images/figures/edit_page_bootstrap.png" alt="edit_page_bootstrap" /></span></div><div class="caption"><span class="header">Figure 9.2: </span><span class="description">The initial user edit page with pre-filled name & email. <a href="http://railstutorial.org/images/figures/edit_page_bootstrap-full.png">(full size)</a></span></div></div>
<p>Looking at the HTML source for <a class="ref" href="updating-showing-and-deleting-users.html#fig-edit_page">Figure 9.2</a>, we see a form tag as expected (<a class="ref" href="updating-showing-and-deleting-users.html#code-edit_form_html">Listing 9.4</a>).</p>
<div class="label" id="code-edit_form_html"></div>
<div class="codelisting">
<div class="listing"><span class="header">Listing 9.4.</span> <span class="description">HTML for the edit form defined in <a class="ref" href="updating-showing-and-deleting-users.html#code-user_edit_view">Listing 9.3</a> and shown in <a class="ref" href="updating-showing-and-deleting-users.html#fig-edit_page">Figure 9.2</a>.</span> </div>
<div class="code"><div class="highlight"><pre><span class="nt"><form</span> <span class="na">action=</span><span class="s">"/users/1"</span> <span class="na">class=</span><span class="s">"edit_user"</span> <span class="na">id=</span><span class="s">"edit_user_1"</span> <span class="na">method=</span><span class="s">"post"</span><span class="nt">></span>
<span class="nt"><input</span> <span class="na">name=</span><span class="s">"_method"</span> <span class="na">type=</span><span class="s">"hidden"</span> <span class="na">value=</span><span class="s">"put"</span> <span class="nt">/></span>
.
.
.
<span class="nt"></form></span>
</pre></div>
</div></div>
<p>Note here the hidden input field</p>
<div class="code"><div class="highlight"><pre><span class="nt"><input</span> <span class="na">name=</span><span class="s">"_method"</span> <span class="na">type=</span><span class="s">"hidden"</span> <span class="na">value=</span><span class="s">"put"</span> <span class="nt">/></span>
</pre></div>
</div>
<p>Since web browsers can’t natively send <tt>PUT</tt> requests (as required by the REST conventions from <a class="ref" href="sign-up.html#table-RESTful_users">Table 7.1</a>), Rails fakes it with a <tt>POST</tt> request and a hidden <code>input</code> field.<sup class="footnote" id="fnref-9_3"><a href="#fn-9_3">3</a></sup></p>
<p>There’s another subtlety to address here: the code <code>form_for(@user)</code> in <a class="ref" href="updating-showing-and-deleting-users.html#code-user_edit_view">Listing 9.3</a> is <em>exactly</em> the same as the code in <a class="ref" href="sign-up.html#code-signup_form">Listing 7.17</a>—so how does Rails know to use a <tt>POST</tt> request for new users and a <tt>PUT</tt> for editing users? The answer is that it is possible to tell whether a user is new or already exists in the database via Active Record’s <code>new_record?</code> boolean method:</p>
<div class="code"><div class="highlight"><pre><span class="go">$ rails console</span>
<span class="gp">>> </span><span class="no">User</span><span class="o">.</span><span class="n">new</span><span class="o">.</span><span class="n">new_record?</span>
<span class="go">=> true</span>
<span class="gp">>> </span><span class="no">User</span><span class="o">.</span><span class="n">first</span><span class="o">.</span><span class="n">new_record?</span>
<span class="go">=> false</span>
</pre></div>
</div>
<p>When constructing a form using <code>form_for(@user)</code>, Rails uses <tt>POST</tt> if <code>@user.new_record?</code> is <code>true</code> and <tt>PUT</tt> if it is <code>false</code>.</p>
<p>As a final touch, we’ll add a URI to the user settings link to the site navigation. Since it depends on the signin status of the user, the test for the “Settings” link belongs with the other authentication tests, as shown in <a class="ref" href="updating-showing-and-deleting-users.html#code-settings_link_test">Listing 9.5</a>. (It would be nice to have additional tests verifying that such links <em>don’t</em> appear for users who aren’t signed in; writing these tests is left as an exercise (<a class="ref" href="updating-showing-and-deleting-users.html#sec-updating_deleting_exercises">Section 9.6</a>).)</p>
<div class="label" id="code-settings_link_test"></div>
<div class="codelisting">
<div class="listing"><span class="header">Listing 9.5.</span> <span class="description">Adding a test for the “Settings” link. <br /> <code>spec/requests/authentication_pages_spec.rb</code></span> </div>
<div class="code"><div class="highlight"><pre><span class="nb">require</span> <span class="s1">'spec_helper'</span>
<span class="n">describe</span> <span class="s2">"Authentication"</span> <span class="k">do</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="n">describe</span> <span class="s2">"with valid information"</span> <span class="k">do</span>
<span class="n">let</span><span class="p">(</span><span class="ss">:user</span><span class="p">)</span> <span class="p">{</span> <span class="no">FactoryGirl</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="ss">:user</span><span class="p">)</span> <span class="p">}</span>
<span class="n">before</span> <span class="p">{</span> <span class="n">sign_in</span> <span class="n">user</span> <span class="p">}</span>
<span class="n">it</span> <span class="p">{</span> <span class="n">should</span> <span class="n">have_selector</span><span class="p">(</span><span class="s1">'title'</span><span class="p">,</span> <span class="ss">text:</span> <span class="n">user</span><span class="o">.</span><span class="n">name</span><span class="p">)</span> <span class="p">}</span>
<span class="n">it</span> <span class="p">{</span> <span class="n">should</span> <span class="n">have_link</span><span class="p">(</span><span class="s1">'Profile'</span><span class="p">,</span> <span class="ss">href:</span> <span class="n">user_path</span><span class="p">(</span><span class="n">user</span><span class="p">))</span> <span class="p">}</span>
<span class="n">it</span> <span class="p">{</span> <span class="n">should</span> <span class="n">have_link</span><span class="p">(</span><span class="s1">'Settings'</span><span class="p">,</span> <span class="ss">href:</span> <span class="n">edit_user_path</span><span class="p">(</span><span class="n">user</span><span class="p">))</span> <span class="p">}</span>
<span class="n">it</span> <span class="p">{</span> <span class="n">should</span> <span class="n">have_link</span><span class="p">(</span><span class="s1">'Sign out'</span><span class="p">,</span> <span class="ss">href:</span> <span class="n">signout_path</span><span class="p">)</span> <span class="p">}</span>
<span class="n">it</span> <span class="p">{</span> <span class="n">should_not</span> <span class="n">have_link</span><span class="p">(</span><span class="s1">'Sign in'</span><span class="p">,</span> <span class="ss">href:</span> <span class="n">signin_path</span><span class="p">)</span> <span class="p">}</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="k">end</span>
<span class="k">end</span>
<span class="k">end</span>
</pre></div>
</div></div>
<p>For convenience, the code in <a class="ref" href="updating-showing-and-deleting-users.html#code-settings_link_test">Listing 9.5</a> uses a helper to sign in a user inside the tests. The method is to visit the signin page and submit valid information, as shown in <a class="ref" href="updating-showing-and-deleting-users.html#code-sign_in_helper">Listing 9.6</a>.</p>
<div class="label" id="code-sign_in_helper"></div>
<div class="codelisting">
<div class="listing"><span class="header">Listing 9.6.</span> <span class="description">A test helper to sign users in. <br /> <code>spec/support/utilities.rb</code></span> </div>
<div class="code"><div class="highlight"><pre><span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="k">def</span> <span class="nf">sign_in</span><span class="p">(</span><span class="n">user</span><span class="p">)</span>
<span class="n">visit</span> <span class="n">signin_path</span>
<span class="n">fill_in</span> <span class="s2">"Email"</span><span class="p">,</span> <span class="ss">with:</span> <span class="n">user</span><span class="o">.</span><span class="n">email</span>
<span class="n">fill_in</span> <span class="s2">"Password"</span><span class="p">,</span> <span class="ss">with:</span> <span class="n">user</span><span class="o">.</span><span class="n">password</span>
<span class="n">click_button</span> <span class="s2">"Sign in"</span>
<span class="c1"># Sign in when not using Capybara as well.</span>
<span class="n">cookies</span><span class="o">[</span><span class="ss">:remember_token</span><span class="o">]</span> <span class="o">=</span> <span class="n">user</span><span class="o">.</span><span class="n">remember_token</span>
<span class="k">end</span>
</pre></div>
</div></div>
<p>As noted in the comment line, filling in the form doesn’t work when not using Capybara, so to cover this case we also add the user’s remember token to the cookies:</p>
<div class="code"><div class="highlight"><pre><span class="c1"># Sign in when not using Capybara as well.</span>
<span class="n">cookies</span><span class="o">[</span><span class="ss">:remember_token</span><span class="o">]</span> <span class="o">=</span> <span class="n">user</span><span class="o">.</span><span class="n">remember_token</span>
</pre></div>
</div>
<p>This is necessary when using one of the HTTP request methods directly (<code>get</code>, <code>post</code>, <code>put</code>, or <code>delete</code>), as we’ll see in <a class="ref" href="updating-showing-and-deleting-users.html#code-delete_destroy_test">Listing 9.46</a>. (Note that the test <code>cookies</code> object isn’t a perfect simulation of the real cookies object; in particular, the <code>cookies.permanent</code> method seen in <a class="ref" href="sign-in-sign-out.html#code-sign_in_function">Listing 8.19</a> doesn’t work inside tests.) As you might suspect, the <code>sign_in</code> method will prove useful in future tests, and in fact it can already be used to eliminate some duplication (<a class="ref" href="updating-showing-and-deleting-users.html#sec-updating_deleting_exercises">Section 9.6</a>).</p>
<p>The application code to add the URI for the “Settings” link is simple: we just use the named route <code>edit_user_path</code> from <a class="ref" href="sign-up.html#table-RESTful_users">Table 7.1</a>, together with the handy <code>current_user</code> helper method defined in <a class="ref" href="sign-in-sign-out.html#code-current_user_working">Listing 8.22</a>:</p>
<div class="code"><div class="highlight"><pre><span class="cp"><%=</span> <span class="n">link_to</span> <span class="s2">"Settings"</span><span class="p">,</span> <span class="n">edit_user_path</span><span class="p">(</span><span class="n">current_user</span><span class="p">)</span> <span class="cp">%></span>
</pre></div>
</div>
<p>The full application code appears in <a class="ref" href="updating-showing-and-deleting-users.html#code-settings_link">Listing 9.7</a>).</p>
<div class="label" id="code-settings_link"></div>
<div class="codelisting">
<div class="listing"><span class="header">Listing 9.7.</span> <span class="description">Adding a “Settings” link. <br /> <code>app/views/layouts/_header.html.erb</code></span> </div>
<div class="code"><div class="highlight"><pre><span class="nt"><header</span> <span class="na">class=</span><span class="s">"navbar navbar-fixed-top navbar-inverse"</span><span class="nt">></span>
<span class="nt"><div</span> <span class="na">class=</span><span class="s">"navbar-inner"</span><span class="nt">></span>
<span class="nt"><div</span> <span class="na">class=</span><span class="s">"container"</span><span class="nt">></span>
<span class="cp"><%=</span> <span class="n">link_to</span> <span class="s2">"sample app"</span><span class="p">,</span> <span class="n">root_path</span><span class="p">,</span> <span class="nb">id</span><span class="p">:</span> <span class="s2">"logo"</span> <span class="cp">%></span>
<span class="nt"><nav></span>
<span class="nt"><ul</span> <span class="na">class=</span><span class="s">"nav pull-right"</span><span class="nt">></span>
<span class="nt"><li></span><span class="cp"><%=</span> <span class="n">link_to</span> <span class="s2">"Home"</span><span class="p">,</span> <span class="n">root_path</span> <span class="cp">%></span><span class="nt"></li></span>
<span class="nt"><li></span><span class="cp"><%=</span> <span class="n">link_to</span> <span class="s2">"Help"</span><span class="p">,</span> <span class="n">help_path</span> <span class="cp">%></span><span class="nt"></li></span>
<span class="cp"><%</span> <span class="k">if</span> <span class="n">signed_in?</span> <span class="cp">%></span>
<span class="nt"><li></span><span class="cp"><%=</span> <span class="n">link_to</span> <span class="s2">"Users"</span><span class="p">,</span> <span class="s1">'#'</span> <span class="cp">%></span><span class="nt"></li></span>
<span class="nt"><li</span> <span class="na">id=</span><span class="s">"fat-menu"</span> <span class="na">class=</span><span class="s">"dropdown"</span><span class="nt">></span>
<span class="nt"><a</span> <span class="na">href=</span><span class="s">"#"</span> <span class="na">class=</span><span class="s">"dropdown-toggle"</span> <span class="na">data-toggle=</span><span class="s">"dropdown"</span><span class="nt">></span>
Account <span class="nt"><b</span> <span class="na">class=</span><span class="s">"caret"</span><span class="nt">></b></span>
<span class="nt"></a></span>
<span class="nt"><ul</span> <span class="na">class=</span><span class="s">"dropdown-menu"</span><span class="nt">></span>
<span class="nt"><li></span><span class="cp"><%=</span> <span class="n">link_to</span> <span class="s2">"Profile"</span><span class="p">,</span> <span class="n">current_user</span> <span class="cp">%></span><span class="nt"></li></span>
<span class="nt"><li></span><span class="cp"><%=</span> <span class="n">link_to</span> <span class="s2">"Settings"</span><span class="p">,</span> <span class="n">edit_user_path</span><span class="p">(</span><span class="n">current_user</span><span class="p">)</span> <span class="cp">%></span><span class="nt"></li></span>
<span class="nt"><li</span> <span class="na">class=</span><span class="s">"divider"</span><span class="nt">></li></span>
<span class="nt"><li></span>
<span class="cp"><%=</span> <span class="n">link_to</span> <span class="s2">"Sign out"</span><span class="p">,</span> <span class="n">signout_path</span><span class="p">,</span> <span class="nb">method</span><span class="p">:</span> <span class="s2">"delete"</span> <span class="cp">%></span>
<span class="nt"></li></span>
<span class="nt"></ul></span>
<span class="nt"></li></span>
<span class="cp"><%</span> <span class="k">else</span> <span class="cp">%></span>
<span class="nt"><li></span><span class="cp"><%=</span> <span class="n">link_to</span> <span class="s2">"Sign in"</span><span class="p">,</span> <span class="n">signin_path</span> <span class="cp">%></span><span class="nt"></li></span>
<span class="cp"><%</span> <span class="k">end</span> <span class="cp">%></span>
<span class="nt"></ul></span>
<span class="nt"></nav></span>
<span class="nt"></div></span>
<span class="nt"></div></span>
<span class="nt"></header></span>
</pre></div>
</div></div>
<div class="label" id="sec-unsuccessful_edits"></div>
<h3><a id="sec-9_1_2" href="updating-showing-and-deleting-users.html#sec-unsuccessful_edits" class="heading"><span class="number">9.1.2</span> Unsuccessful edits</a></h3>
<p>In this section we’ll handle unsuccessful edits and get the error messages test in <a class="ref" href="updating-showing-and-deleting-users.html#code-user_edit_specs">Listing 9.1</a> to pass. The application code creates an <code>update</code> action that uses <code>update_attributes</code> (<a class="ref" href="modeling-users.html#sec-updating_user_objects">Section 6.1.5</a>) to update the user based on the submitted <code>params</code> hash, as shown in <a class="ref" href="updating-showing-and-deleting-users.html#code-user_update_action_unsuccessful">Listing 9.8</a>. With invalid information, the update attempt returns <code>false</code>, so the <code>else</code> branch re-renders the edit page. We’ve seen this pattern before; the structure closely parallels the first version of the <code>create</code> action (<a class="ref" href="sign-up.html#code-first_create_action">Listing 7.21</a>).</p>
<div class="label" id="code-user_update_action_unsuccessful"></div>
<div class="codelisting">
<div class="listing"><span class="header">Listing 9.8.</span> <span class="description">The initial user <code>update</code> action. <br /> <code>app/controllers/users_controller.rb</code></span> </div>
<div class="code"><div class="highlight"><pre><span class="k">class</span> <span class="nc">UsersController</span> <span class="o"><</span> <span class="no">ApplicationController</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="k">def</span> <span class="nf">edit</span>
<span class="vi">@user</span> <span class="o">=</span> <span class="no">User</span><span class="o">.</span><span class="n">find</span><span class="p">(</span><span class="n">params</span><span class="o">[</span><span class="ss">:id</span><span class="o">]</span><span class="p">)</span>
<span class="k">end</span>
<span class="k">def</span> <span class="nf">update</span>
<span class="vi">@user</span> <span class="o">=</span> <span class="no">User</span><span class="o">.</span><span class="n">find</span><span class="p">(</span><span class="n">params</span><span class="o">[</span><span class="ss">:id</span><span class="o">]</span><span class="p">)</span>
<span class="k">if</span> <span class="vi">@user</span><span class="o">.</span><span class="n">update_attributes</span><span class="p">(</span><span class="n">params</span><span class="o">[</span><span class="ss">:user</span><span class="o">]</span><span class="p">)</span>
<span class="c1"># Handle a successful update.</span>
<span class="k">else</span>
<span class="n">render</span> <span class="s1">'edit'</span>
<span class="k">end</span>
<span class="k">end</span>
<span class="k">end</span>
</pre></div>
</div></div>
<p>The resulting error message (<a class="ref" href="updating-showing-and-deleting-users.html#fig-edit_with_invalid_information">Figure 9.3</a>) is the one needed to get the error message test to pass, as you should verify by running the test suite:</p>
<div class="code"><div class="highlight"><pre><span class="gp">$</span> bundle <span class="nb">exec </span>rspec spec/
</pre></div>
</div>
<div class="label" id="fig-edit_with_invalid_information"></div>
<div class="figure"><div class="center"><span class="graphic"><img src="images/figures/edit_with_invalid_information_bootstrap.png" alt="edit_with_invalid_information_bootstrap" /></span></div><div class="caption"><span class="header">Figure 9.3: </span><span class="description">Error message from submitting the update form. <a href="http://railstutorial.org/images/figures/edit_with_invalid_information_bootstrap-full.png">(full size)</a></span></div></div>
<div class="label" id="sec-successful_edits"></div>
<h3><a id="sec-9_1_3" href="updating-showing-and-deleting-users.html#sec-successful_edits" class="heading"><span class="number">9.1.3</span> Successful edits</a></h3>
<p>Now it’s time to get the edit form to work. Editing the profile images is already functional since we’ve outsourced image upload to Gravatar; we can edit gravatars by clicking on the “change” link from <a class="ref" href="updating-showing-and-deleting-users.html#fig-edit_page">Figure 9.2</a>, as shown in <a class="ref" href="updating-showing-and-deleting-users.html#fig-gravatar_cropper">Figure 9.4</a>. Let’s get the rest of the user edit functionality working as well.</p>
<div class="label" id="fig-gravatar_cropper"></div>
<div class="figure"><div class="center"><span class="graphic"><img src="images/figures/gravatar_cropper.png" alt="gravatar_cropper" /></span></div><div class="caption"><span class="header">Figure 9.4: </span><span class="description">The <a href="http://gravatar.com/">Gravatar</a> image-cropping interface, with a picture of <a href="http://michaelhartl.com/">some dude</a>.</span></div></div>
<p>The tests for the <code>update</code> action are similar to those for <code>create</code>. <a class="ref" href="updating-showing-and-deleting-users.html#code-user_update_specs">Listing 9.9</a> shows how to use Capybara to fill in the form fields with valid information and then test that the resulting behavior is correct. This is a lot of code; see if you can work through it by referring back to the tests in <a class="ref" href="sign-up.html#top">Chapter 7</a>.</p>
<div class="label" id="code-user_update_specs"></div>
<div class="codelisting">
<div class="listing"><span class="header">Listing 9.9.</span> <span class="description">Tests for the user <code>update</code> action. <br /> <code>spec/requests/user_pages_spec.rb</code></span> </div>
<div class="code"><div class="highlight"><pre><span class="nb">require</span> <span class="s1">'spec_helper'</span>
<span class="n">describe</span> <span class="s2">"User pages"</span> <span class="k">do</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="n">describe</span> <span class="s2">"edit"</span> <span class="k">do</span>
<span class="n">let</span><span class="p">(</span><span class="ss">:user</span><span class="p">)</span> <span class="p">{</span> <span class="no">FactoryGirl</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="ss">:user</span><span class="p">)</span> <span class="p">}</span>
<span class="n">before</span> <span class="k">do</span>
<span class="n">sign_in</span> <span class="n">user</span>
<span class="n">visit</span> <span class="n">edit_user_path</span><span class="p">(</span><span class="n">user</span><span class="p">)</span>
<span class="k">end</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="n">describe</span> <span class="s2">"with valid information"</span> <span class="k">do</span>
<span class="n">let</span><span class="p">(</span><span class="ss">:new_name</span><span class="p">)</span> <span class="p">{</span> <span class="s2">"New Name"</span> <span class="p">}</span>
<span class="n">let</span><span class="p">(</span><span class="ss">:new_email</span><span class="p">)</span> <span class="p">{</span> <span class="s2">"[email protected]"</span> <span class="p">}</span>
<span class="n">before</span> <span class="k">do</span>
<span class="n">fill_in</span> <span class="s2">"Name"</span><span class="p">,</span> <span class="ss">with:</span> <span class="n">new_name</span>
<span class="n">fill_in</span> <span class="s2">"Email"</span><span class="p">,</span> <span class="ss">with:</span> <span class="n">new_email</span>
<span class="n">fill_in</span> <span class="s2">"Password"</span><span class="p">,</span> <span class="ss">with:</span> <span class="n">user</span><span class="o">.</span><span class="n">password</span>
<span class="n">fill_in</span> <span class="s2">"Confirm Password"</span><span class="p">,</span> <span class="ss">with:</span> <span class="n">user</span><span class="o">.</span><span class="n">password</span>
<span class="n">click_button</span> <span class="s2">"Save changes"</span>
<span class="k">end</span>
<span class="n">it</span> <span class="p">{</span> <span class="n">should</span> <span class="n">have_selector</span><span class="p">(</span><span class="s1">'title'</span><span class="p">,</span> <span class="ss">text:</span> <span class="n">new_name</span><span class="p">)</span> <span class="p">}</span>
<span class="n">it</span> <span class="p">{</span> <span class="n">should</span> <span class="n">have_selector</span><span class="p">(</span><span class="s1">'div.alert.alert-success'</span><span class="p">)</span> <span class="p">}</span>
<span class="n">it</span> <span class="p">{</span> <span class="n">should</span> <span class="n">have_link</span><span class="p">(</span><span class="s1">'Sign out'</span><span class="p">,</span> <span class="ss">href:</span> <span class="n">signout_path</span><span class="p">)</span> <span class="p">}</span>
<span class="n">specify</span> <span class="p">{</span> <span class="n">user</span><span class="o">.</span><span class="n">reload</span><span class="o">.</span><span class="n">name</span><span class="o">.</span><span class="n">should</span> <span class="o">==</span> <span class="n">new_name</span> <span class="p">}</span>
<span class="n">specify</span> <span class="p">{</span> <span class="n">user</span><span class="o">.</span><span class="n">reload</span><span class="o">.</span><span class="n">email</span><span class="o">.</span><span class="n">should</span> <span class="o">==</span> <span class="n">new_email</span> <span class="p">}</span>
<span class="k">end</span>
<span class="k">end</span>
<span class="k">end</span>
</pre></div>
</div></div>
<p>Note that <a class="ref" href="updating-showing-and-deleting-users.html#code-user_update_specs">Listing 9.9</a> adds the <code>sign_in</code> method from <a class="ref" href="updating-showing-and-deleting-users.html#code-sign_in_helper">Listing 9.6</a> to the <code>before</code> block, which is required for the “Sign out” link test to pass, and also anticipates protecting the <code>edit</code> action from non-signed-in users (<a class="ref" href="updating-showing-and-deleting-users.html#sec-requiring_signed_in_users">Section 9.2.1</a>).</p>
<p>The only real novelty in <a class="ref" href="updating-showing-and-deleting-users.html#code-user_update_specs">Listing 9.9</a> is the <code>reload</code> method, which appears in the test for changing the user’s attributes:</p>
<div class="code"><div class="highlight"><pre><span class="n">specify</span> <span class="p">{</span> <span class="n">user</span><span class="o">.</span><span class="n">reload</span><span class="o">.</span><span class="n">name</span><span class="o">.</span><span class="n">should</span> <span class="o">==</span> <span class="n">new_name</span> <span class="p">}</span>
<span class="n">specify</span> <span class="p">{</span> <span class="n">user</span><span class="o">.</span><span class="n">reload</span><span class="o">.</span><span class="n">email</span><span class="o">.</span><span class="n">should</span> <span class="o">==</span> <span class="n">new_email</span> <span class="p">}</span>
</pre></div>
</div>
<p>This reloads the <code>user</code> variable from the test database using <code>user.reload</code>, and then verifies that the user’s new name and email match the new values.</p>
<p>The <code>update</code> action needed to get the tests in <a class="ref" href="updating-showing-and-deleting-users.html#code-user_update_specs">Listing 9.9</a> to pass is similar to the final form of the <code>create</code> action (<a class="ref" href="sign-in-sign-out.html#code-signin_upon_signup">Listing 8.27</a>), as seen in <a class="ref" href="updating-showing-and-deleting-users.html#code-user_update_action">Listing 9.10</a>. All this does is add</p>
<div class="code"><div class="highlight"><pre><span class="n">flash</span><span class="o">[</span><span class="ss">:success</span><span class="o">]</span> <span class="o">=</span> <span class="s2">"Profile updated"</span>
<span class="n">sign_in</span> <span class="vi">@user</span>
<span class="n">redirect_to</span> <span class="vi">@user</span>
</pre></div>
</div>
<p>to the code in <a class="ref" href="updating-showing-and-deleting-users.html#code-user_update_action_unsuccessful">Listing 9.8</a>. Note that we sign in the user as part of a successful profile update; this is because the remember token gets reset when the user is saved (<a class="ref" href="sign-in-sign-out.html#code-before_save_create_remember_token">Listing 8.18</a>), which invalidates the user’s session (<a class="ref" href="sign-in-sign-out.html#code-current_user_working">Listing 8.22</a>). This is a nice security feature, as it means that any hijacked sessions will automatically expire when the user information is changed.</p>
<div class="label" id="code-user_update_action"></div>
<div class="codelisting">
<div class="listing"><span class="header">Listing 9.10.</span> <span class="description">The user <code>update</code> action. <br /> <code>app/controllers/users_controller.rb</code></span> </div>
<div class="code"><div class="highlight"><pre><span class="k">class</span> <span class="nc">UsersController</span> <span class="o"><</span> <span class="no">ApplicationController</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="k">def</span> <span class="nf">update</span>
<span class="vi">@user</span> <span class="o">=</span> <span class="no">User</span><span class="o">.</span><span class="n">find</span><span class="p">(</span><span class="n">params</span><span class="o">[</span><span class="ss">:id</span><span class="o">]</span><span class="p">)</span>
<span class="k">if</span> <span class="vi">@user</span><span class="o">.</span><span class="n">update_attributes</span><span class="p">(</span><span class="n">params</span><span class="o">[</span><span class="ss">:user</span><span class="o">]</span><span class="p">)</span>
<span class="n">flash</span><span class="o">[</span><span class="ss">:success</span><span class="o">]</span> <span class="o">=</span> <span class="s2">"Profile updated"</span>
<span class="n">sign_in</span> <span class="vi">@user</span>
<span class="n">redirect_to</span> <span class="vi">@user</span>
<span class="k">else</span>
<span class="n">render</span> <span class="s1">'edit'</span>
<span class="k">end</span>
<span class="k">end</span>
<span class="k">end</span>
</pre></div>
</div></div>
<p>Note that, as currently constructed, every edit requires the user to reconfirm the password (as implied by the empty confirmation text box in <a class="ref" href="updating-showing-and-deleting-users.html#fig-edit_page">Figure 9.2</a>), which is a minor annoyance but makes updates much more secure.</p>
<p>With the code in this section, the user edit page should be working, as you can double-check by re-running the test suite, which should now be green:</p>
<div class="code"><div class="highlight"><pre><span class="gp">$</span> bundle <span class="nb">exec </span>rspec spec/
</pre></div>
</div>
<div class="label" id="sec-authorization"></div>
<h2><a id="sec-9_2" href="updating-showing-and-deleting-users.html#sec-authorization" class="heading"><span class="number">9.2</span> Authorization</a></h2>
<p>One nice effect of building the authentication machinery in <a class="ref" href="sign-in-sign-out.html#top">Chapter 8</a> is that we are now in a position to implement authorization as well: <em>authentication</em> allows us to identify users of our site, and <em>authorization</em> lets us control what they can do.</p>
<p>Although the edit and update actions from <a class="ref" href="updating-showing-and-deleting-users.html#sec-updating_users">Section 9.1</a> are functionally complete, they suffer from a ridiculous security flaw: they allow anyone (even non-signed-in users) to access either action, and any signed-in user can update the information for any other user. In this section, we’ll implement a security model that requires users to be signed in and prevents them from updating any information other than their own. Users who aren’t signed in and who try to access protected pages will be forwarded to the signin page with a helpful message, as mocked up in <a class="ref" href="updating-showing-and-deleting-users.html#fig-signin_page_protected_mockup">Figure 9.5</a>.</p>
<div class="label" id="fig-signin_page_protected_mockup"></div>
<div class="figure"><div class="center"><span class="graphic"><img src="images/figures/signin_page_protected_mockup_bootstrap.png" alt="signin_page_protected_mockup_bootstrap" /></span></div><div class="caption"><span class="header">Figure 9.5: </span><span class="description">A mockup of the result of visiting a protected page <a href="http://railstutorial.org/images/figures/signin_page_protected_mockup_bootstrap-full.png">(full size)</a></span></div></div>
<div class="label" id="sec-requiring_signed_in_users"></div>
<h3><a id="sec-9_2_1" href="updating-showing-and-deleting-users.html#sec-requiring_signed_in_users" class="heading"><span class="number">9.2.1</span> Requiring signed-in users</a></h3>
<p>Since the security restrictions for the <code>edit</code> and <code>update</code> actions are identical, we’ll handle them in a single RSpec <code>describe</code> block. Starting with the sign-in requirement, our initial tests verify that non-signed-in users attempting to access either action are simply sent to the signin page, as seen in <a class="ref" href="updating-showing-and-deleting-users.html#code-protected_edit_update_tests">Listing 9.11</a>.</p>
<div class="label" id="code-protected_edit_update_tests"></div>
<div class="codelisting">
<div class="listing"><span class="header">Listing 9.11.</span> <span class="description">Testing that the <code>edit</code> and <code>update</code> actions are protected. <br /> <code>spec/requests/authentication_pages_spec.rb</code></span> </div>
<div class="code"><div class="highlight"><pre><span class="nb">require</span> <span class="s1">'spec_helper'</span>
<span class="n">describe</span> <span class="s2">"Authentication"</span> <span class="k">do</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="n">describe</span> <span class="s2">"authorization"</span> <span class="k">do</span>
<span class="n">describe</span> <span class="s2">"for non-signed-in users"</span> <span class="k">do</span>
<span class="n">let</span><span class="p">(</span><span class="ss">:user</span><span class="p">)</span> <span class="p">{</span> <span class="no">FactoryGirl</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="ss">:user</span><span class="p">)</span> <span class="p">}</span>
<span class="n">describe</span> <span class="s2">"in the Users controller"</span> <span class="k">do</span>
<span class="n">describe</span> <span class="s2">"visiting the edit page"</span> <span class="k">do</span>
<span class="n">before</span> <span class="p">{</span> <span class="n">visit</span> <span class="n">edit_user_path</span><span class="p">(</span><span class="n">user</span><span class="p">)</span> <span class="p">}</span>
<span class="n">it</span> <span class="p">{</span> <span class="n">should</span> <span class="n">have_selector</span><span class="p">(</span><span class="s1">'title'</span><span class="p">,</span> <span class="ss">text:</span> <span class="s1">'Sign in'</span><span class="p">)</span> <span class="p">}</span>
<span class="k">end</span>
<span class="n">describe</span> <span class="s2">"submitting to the update action"</span> <span class="k">do</span>
<span class="n">before</span> <span class="p">{</span> <span class="n">put</span> <span class="n">user_path</span><span class="p">(</span><span class="n">user</span><span class="p">)</span> <span class="p">}</span>
<span class="n">specify</span> <span class="p">{</span> <span class="n">response</span><span class="o">.</span><span class="n">should</span> <span class="n">redirect_to</span><span class="p">(</span><span class="n">signin_path</span><span class="p">)</span> <span class="p">}</span>
<span class="k">end</span>
<span class="k">end</span>
<span class="k">end</span>
<span class="k">end</span>
<span class="k">end</span>
</pre></div>
</div></div>
<p>The code in <a class="ref" href="updating-showing-and-deleting-users.html#code-protected_edit_update_tests">Listing 9.11</a> introduces a second way, apart from Capybara’s <code>visit</code> method, to access a controller action: by issuing the appropriate HTTP request directly, in this case using the <code>put</code> method to issue a <tt>PUT</tt> request:</p>
<div class="code"><div class="highlight"><pre><span class="n">describe</span> <span class="s2">"submitting to the update action"</span> <span class="k">do</span>
<span class="n">before</span> <span class="p">{</span> <span class="n">put</span> <span class="n">user_path</span><span class="p">(</span><span class="n">user</span><span class="p">)</span> <span class="p">}</span>
<span class="n">specify</span> <span class="p">{</span> <span class="n">response</span><span class="o">.</span><span class="n">should</span> <span class="n">redirect_to</span><span class="p">(</span><span class="n">signin_path</span><span class="p">)</span> <span class="p">}</span>
<span class="k">end</span>
</pre></div>
</div>
<p>This issues a <tt>PUT</tt> request directly to <code>/users/1</code>, which gets routed to the <code>update</code> action of the Users controller (<a class="ref" href="sign-up.html#table-RESTful_users">Table 7.1</a>). This is necessary because there is no way for a browser to visit the <code>update</code> action directly—it can only get there indirectly by submitting the edit form—so Capybara can’t do it either. But visiting the edit page only tests the authorization for the <code>edit</code> action, not for <code>update</code>. As a result, the only way to test the proper authorization for the <code>update</code> action itself is to issue a direct request. (As you might guess, in addition to <code>put</code> Rails tests support <code>get</code>, <code>post</code>, and <code>delete</code> as well.)</p>
<p>When using one of the methods to issue HTTP requests directly, we get access to the low-level <code>response</code> object. Unlike the Capybara <code>page</code> object, <code>response</code> lets us test for the server response itself, in this case verifying that the <code>update</code> action responds by redirecting to the signin page:</p>
<div class="code"><div class="highlight"><pre><span class="n">specify</span> <span class="p">{</span> <span class="n">response</span><span class="o">.</span><span class="n">should</span> <span class="n">redirect_to</span><span class="p">(</span><span class="n">signin_path</span><span class="p">)</span> <span class="p">}</span>
</pre></div>
</div>
<p>The authorization application code uses a <em>before filter</em>, which arranges for a particular method to be called before the given actions. To require users to be signed in, we define a <code>signed_in_user</code> method and invoke it using <code>before_filter :signed_in_user</code>, as shown in <a class="ref" href="updating-showing-and-deleting-users.html#code-authorize_before_filter">Listing 9.12</a>.</p>
<div class="label" id="code-authorize_before_filter"></div>
<div class="codelisting">
<div class="listing"><span class="header">Listing 9.12.</span> <span class="description">Adding a <code>signed_in_user</code> before filter. <br /> <code>app/controllers/users_controller.rb</code></span> </div>
<div class="code"><div class="highlight"><pre><span class="k">class</span> <span class="nc">UsersController</span> <span class="o"><</span> <span class="no">ApplicationController</span>
<span class="n">before_filter</span> <span class="ss">:signed_in_user</span><span class="p">,</span> <span class="ss">only:</span> <span class="o">[</span><span class="ss">:edit</span><span class="p">,</span> <span class="ss">:update</span><span class="o">]</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="kp">private</span>
<span class="k">def</span> <span class="nf">signed_in_user</span>
<span class="n">redirect_to</span> <span class="n">signin_url</span><span class="p">,</span> <span class="ss">notice:</span> <span class="s2">"Please sign in."</span> <span class="k">unless</span> <span class="n">signed_in?</span>
<span class="k">end</span>
<span class="k">end</span>
</pre></div>
</div></div>
<p>By default, before filters apply to <em>every</em> action in a controller, so here we restrict the filter to act only on the <code>:edit</code> and <code>:update</code> actions by passing the appropriate <code>:only</code> options hash.</p>
<p>Note that <a class="ref" href="updating-showing-and-deleting-users.html#code-authorize_before_filter">Listing 9.12</a> uses a shortcut for setting <code>flash[:notice]</code> by passing an options hash to the <code>redirect_to</code> function. The code in <a class="ref" href="updating-showing-and-deleting-users.html#code-authorize_before_filter">Listing 9.12</a> is equivalent to the more verbose</p>
<div class="code"><div class="highlight"><pre><span class="k">unless</span> <span class="n">signed_in?</span>
<span class="n">flash</span><span class="o">[</span><span class="ss">:notice</span><span class="o">]</span> <span class="o">=</span> <span class="s2">"Please sign in."</span>
<span class="n">redirect_to</span> <span class="n">signin_url</span>
<span class="k">end</span>
</pre></div>
</div>
<p>(The same construction works for the <code>:error</code> key, but not for <code>:success</code>.)</p>
<p>Together with <code>:success</code> and <code>:error</code>, the <code>:notice</code> key completes our triumvirate of <code>flash</code> styles, all of which are supported natively by Bootstrap CSS. By signing out and attempting to access the user edit page <a href="http://localhost:3000/users/1/edit">/users/1/edit</a>, we can see the resulting yellow “notice” box, as seen in <a class="ref" href="updating-showing-and-deleting-users.html#fig-protected_sign_in">Figure 9.6</a>.</p>
<div class="label" id="fig-protected_sign_in"></div>
<div class="figure"><div class="center"><span class="graphic"><img src="images/figures/protected_sign_in_bootstrap.png" alt="protected_sign_in_bootstrap" /></span></div><div class="caption"><span class="header">Figure 9.6: </span><span class="description">The signin form after trying to access a protected page. <a href="http://railstutorial.org/images/figures/protected_sign_in_bootstrap-full.png">(full size)</a></span></div></div>
<p>At this point, our test suite should be green:</p>
<div class="code"><div class="highlight"><pre><span class="gp">$</span> bundle <span class="nb">exec </span>rspec spec/
</pre></div>
</div>
<div class="label" id="sec-requiring_the_right_user"></div>
<h3><a id="sec-9_2_2" href="updating-showing-and-deleting-users.html#sec-requiring_the_right_user" class="heading"><span class="number">9.2.2</span> Requiring the right user</a></h3>
<p>Of course, requiring users to sign in isn’t quite enough; users should only be allowed to edit their <em>own</em> information. We can test for this by first signing in as an incorrect user and then hitting the <code>edit</code> and <code>update</code> actions (<a class="ref" href="updating-showing-and-deleting-users.html#code-edit_update_wrong_user_tests">Listing 9.13</a>). Note that, since users should never even <em>try</em> to edit another user’s profile, we redirect not to the signin page but to the root URL.</p>
<div class="label" id="code-edit_update_wrong_user_tests"></div>
<div class="codelisting">
<div class="listing"><span class="header">Listing 9.13.</span> <span class="description">Testing that the <code>edit</code> and <code>update</code> actions require the right user. <br /> <code>spec/requests/authentication_pages_spec.rb</code></span> </div>
<div class="code"><div class="highlight"><pre><span class="nb">require</span> <span class="s1">'spec_helper'</span>
<span class="n">describe</span> <span class="s2">"Authentication"</span> <span class="k">do</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="n">describe</span> <span class="s2">"authorization"</span> <span class="k">do</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="n">describe</span> <span class="s2">"as wrong user"</span> <span class="k">do</span>
<span class="n">let</span><span class="p">(</span><span class="ss">:user</span><span class="p">)</span> <span class="p">{</span> <span class="no">FactoryGirl</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="ss">:user</span><span class="p">)</span> <span class="p">}</span>
<span class="n">let</span><span class="p">(</span><span class="ss">:wrong_user</span><span class="p">)</span> <span class="p">{</span> <span class="no">FactoryGirl</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="ss">:user</span><span class="p">,</span> <span class="ss">email:</span> <span class="s2">"[email protected]"</span><span class="p">)</span> <span class="p">}</span>
<span class="n">before</span> <span class="p">{</span> <span class="n">sign_in</span> <span class="n">user</span> <span class="p">}</span>
<span class="n">describe</span> <span class="s2">"visiting Users#edit page"</span> <span class="k">do</span>
<span class="n">before</span> <span class="p">{</span> <span class="n">visit</span> <span class="n">edit_user_path</span><span class="p">(</span><span class="n">wrong_user</span><span class="p">)</span> <span class="p">}</span>
<span class="n">it</span> <span class="p">{</span> <span class="n">should_not</span> <span class="n">have_selector</span><span class="p">(</span><span class="s1">'title'</span><span class="p">,</span> <span class="ss">text:</span> <span class="n">full_title</span><span class="p">(</span><span class="s1">'Edit user'</span><span class="p">))</span> <span class="p">}</span>
<span class="k">end</span>
<span class="n">describe</span> <span class="s2">"submitting a PUT request to the Users#update action"</span> <span class="k">do</span>
<span class="n">before</span> <span class="p">{</span> <span class="n">put</span> <span class="n">user_path</span><span class="p">(</span><span class="n">wrong_user</span><span class="p">)</span> <span class="p">}</span>
<span class="n">specify</span> <span class="p">{</span> <span class="n">response</span><span class="o">.</span><span class="n">should</span> <span class="n">redirect_to</span><span class="p">(</span><span class="n">root_url</span><span class="p">)</span> <span class="p">}</span>
<span class="k">end</span>
<span class="k">end</span>
<span class="k">end</span>
<span class="k">end</span>
</pre></div>
</div></div>
<p>Note here that a factory can take an option:</p>
<div class="code"><div class="highlight"><pre><span class="no">FactoryGirl</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="ss">:user</span><span class="p">,</span> <span class="ss">email:</span> <span class="s2">"[email protected]"</span><span class="p">)</span>
</pre></div>
</div>
<p>This creates a user with a different email address from the default. The tests specify that the original user should not have access to the wrong user’s <code>edit</code> or <code>update</code> actions.</p>
<p>The application code adds a second before filter to call the <code>correct_user</code> method, as shown in <a class="ref" href="updating-showing-and-deleting-users.html#code-correct_user_before_filter">Listing 9.14</a>.</p>
<div class="label" id="code-correct_user_before_filter"></div>
<div class="codelisting">
<div class="listing"><span class="header">Listing 9.14.</span> <span class="description">A <code>correct_user</code> before filter to protect the edit/update pages. <br /> <code>app/controllers/users_controller.rb</code></span> </div>
<div class="code"><div class="highlight"><pre><span class="k">class</span> <span class="nc">UsersController</span> <span class="o"><</span> <span class="no">ApplicationController</span>
<span class="n">before_filter</span> <span class="ss">:signed_in_user</span><span class="p">,</span> <span class="ss">only:</span> <span class="o">[</span><span class="ss">:edit</span><span class="p">,</span> <span class="ss">:update</span><span class="o">]</span>
<span class="n">before_filter</span> <span class="ss">:correct_user</span><span class="p">,</span> <span class="ss">only:</span> <span class="o">[</span><span class="ss">:edit</span><span class="p">,</span> <span class="ss">:update</span><span class="o">]</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="k">def</span> <span class="nf">edit</span>
<span class="k">end</span>
<span class="k">def</span> <span class="nf">update</span>
<span class="k">if</span> <span class="vi">@user</span><span class="o">.</span><span class="n">update_attributes</span><span class="p">(</span><span class="n">params</span><span class="o">[</span><span class="ss">:user</span><span class="o">]</span><span class="p">)</span>
<span class="n">flash</span><span class="o">[</span><span class="ss">:success</span><span class="o">]</span> <span class="o">=</span> <span class="s2">"Profile updated"</span>
<span class="n">sign_in</span> <span class="vi">@user</span>
<span class="n">redirect_to</span> <span class="vi">@user</span>
<span class="k">else</span>
<span class="n">render</span> <span class="s1">'edit'</span>
<span class="k">end</span>
<span class="k">end</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="kp">private</span>
<span class="k">def</span> <span class="nf">signed_in_user</span>
<span class="n">redirect_to</span> <span class="n">signin_url</span><span class="p">,</span> <span class="ss">notice:</span> <span class="s2">"Please sign in."</span> <span class="k">unless</span> <span class="n">signed_in?</span>
<span class="k">end</span>
<span class="k">def</span> <span class="nf">correct_user</span>
<span class="vi">@user</span> <span class="o">=</span> <span class="no">User</span><span class="o">.</span><span class="n">find</span><span class="p">(</span><span class="n">params</span><span class="o">[</span><span class="ss">:id</span><span class="o">]</span><span class="p">)</span>
<span class="n">redirect_to</span><span class="p">(</span><span class="n">root_url</span><span class="p">)</span> <span class="k">unless</span> <span class="n">current_user?</span><span class="p">(</span><span class="vi">@user</span><span class="p">)</span>
<span class="k">end</span>
<span class="k">end</span>
</pre></div>
</div></div>
<p>The <code>correct_user</code> filter uses the <code>current_user?</code> boolean method, which we define in the Sessions helper (<a class="ref" href="updating-showing-and-deleting-users.html#code-current_user_p">Listing 9.15</a>).</p>
<div class="label" id="code-current_user_p"></div>
<div class="codelisting">
<div class="listing"><span class="header">Listing 9.15.</span> <span class="description">The <code>current_user?</code> method. <br /> <code>app/helpers/sessions_helper.rb</code></span> </div>
<div class="code"><div class="highlight"><pre><span class="k">module</span> <span class="nn">SessionsHelper</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="k">def</span> <span class="nf">current_user</span>
<span class="vi">@current_user</span> <span class="o">||=</span> <span class="no">User</span><span class="o">.</span><span class="n">find_by_remember_token</span><span class="p">(</span><span class="n">cookies</span><span class="o">[</span><span class="ss">:remember_token</span><span class="o">]</span><span class="p">)</span>
<span class="k">end</span>
<span class="k">def</span> <span class="nf">current_user?</span><span class="p">(</span><span class="n">user</span><span class="p">)</span>
<span class="n">user</span> <span class="o">==</span> <span class="n">current_user</span>
<span class="k">end</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="k">end</span>
</pre></div>
</div></div>
<p><a class="ref" href="updating-showing-and-deleting-users.html#code-correct_user_before_filter">Listing 9.14</a> also shows the updated <code>edit</code> and <code>update</code> actions. Before, in <a class="ref" href="updating-showing-and-deleting-users.html#code-initial_edit_action">Listing 9.2</a>, we had</p>
<div class="code"><div class="highlight"><pre><span class="k">def</span> <span class="nf">edit</span>
<span class="vi">@user</span> <span class="o">=</span> <span class="no">User</span><span class="o">.</span><span class="n">find</span><span class="p">(</span><span class="n">params</span><span class="o">[</span><span class="ss">:id</span><span class="o">]</span><span class="p">)</span>
<span class="k">end</span>
</pre></div>
</div>
<p>and similarly for <code>update</code>. Now that the <code>correct_user</code> before filter defines <code>@user</code>, we can omit it from both actions.</p>
<p>Before moving on, you should verify that the test suite passes:</p>
<div class="code"><div class="highlight"><pre><span class="gp">$</span> bundle <span class="nb">exec </span>rspec spec/
</pre></div>
</div>
<div class="label" id="sec-friendly_forwarding"></div>
<h3><a id="sec-9_2_3" href="updating-showing-and-deleting-users.html#sec-friendly_forwarding" class="heading"><span class="number">9.2.3</span> Friendly forwarding</a></h3>
<p>Our site authorization is complete as written, but there is one minor blemish: when users try to access a protected page, they are currently redirected to their profile pages regardless of where they were trying to go. In other words, if a non-logged-in user tries to visit the edit page, after signing in the user will be redirected to /users/1 instead of /users/1/edit. It would be much friendlier to redirect them to their intended destination instead.</p>
<p>To test for such “friendly forwarding”, we first visit the user edit page, which redirects to the signin page. We then enter valid signin information and click the “Sign in” button. The resulting page, which by default is the user’s profile, should in this case be the “Edit user” page. The test for this sequence appears in <a class="ref" href="updating-showing-and-deleting-users.html#code-friendly_forwarding_test">Listing 9.16</a>.</p>
<div class="label" id="code-friendly_forwarding_test"></div>
<div class="codelisting">
<div class="listing"><span class="header">Listing 9.16.</span> <span class="description">A test for friendly forwarding. <br /> <code>spec/requests/authentication_pages_spec.rb</code></span> </div>
<div class="code"><div class="highlight"><pre><span class="nb">require</span> <span class="s1">'spec_helper'</span>
<span class="n">describe</span> <span class="s2">"Authentication"</span> <span class="k">do</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="n">describe</span> <span class="s2">"authorization"</span> <span class="k">do</span>
<span class="n">describe</span> <span class="s2">"for non-signed-in users"</span> <span class="k">do</span>
<span class="n">let</span><span class="p">(</span><span class="ss">:user</span><span class="p">)</span> <span class="p">{</span> <span class="no">FactoryGirl</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="ss">:user</span><span class="p">)</span> <span class="p">}</span>
<span class="n">describe</span> <span class="s2">"when attempting to visit a protected page"</span> <span class="k">do</span>
<span class="n">before</span> <span class="k">do</span>
<span class="n">visit</span> <span class="n">edit_user_path</span><span class="p">(</span><span class="n">user</span><span class="p">)</span>
<span class="n">fill_in</span> <span class="s2">"Email"</span><span class="p">,</span> <span class="ss">with:</span> <span class="n">user</span><span class="o">.</span><span class="n">email</span>
<span class="n">fill_in</span> <span class="s2">"Password"</span><span class="p">,</span> <span class="ss">with:</span> <span class="n">user</span><span class="o">.</span><span class="n">password</span>
<span class="n">click_button</span> <span class="s2">"Sign in"</span>
<span class="k">end</span>
<span class="n">describe</span> <span class="s2">"after signing in"</span> <span class="k">do</span>
<span class="n">it</span> <span class="s2">"should render the desired protected page"</span> <span class="k">do</span>
<span class="n">page</span><span class="o">.</span><span class="n">should</span> <span class="n">have_selector</span><span class="p">(</span><span class="s1">'title'</span><span class="p">,</span> <span class="ss">text:</span> <span class="s1">'Edit user'</span><span class="p">)</span>
<span class="k">end</span>
<span class="k">end</span>
<span class="k">end</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="k">end</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="k">end</span>
<span class="k">end</span>
</pre></div>
</div></div>
<p>Now for the implementation.<sup class="footnote" id="fnref-9_4"><a href="#fn-9_4">4</a></sup> In order to forward users to their intended destination, we need to store the location of the requested page somewhere, and then redirect to that location instead. We accomplish this with a pair of methods, <code>store_location</code> and <code>redirect_back_or</code>, both defined in the Sessions helper (<a class="ref" href="updating-showing-and-deleting-users.html#code-friendly_forwarding_code">Listing 9.17</a>).</p>
<div class="label" id="code-friendly_forwarding_code"></div>
<div class="codelisting">
<div class="listing"><span class="header">Listing 9.17.</span> <span class="description">Code to implement friendly forwarding. <br /> <code>app/helpers/sessions_helper.rb</code></span> </div>
<div class="code"><div class="highlight"><pre><span class="k">module</span> <span class="nn">SessionsHelper</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="k">def</span> <span class="nf">redirect_back_or</span><span class="p">(</span><span class="n">default</span><span class="p">)</span>
<span class="n">redirect_to</span><span class="p">(</span><span class="n">session</span><span class="o">[</span><span class="ss">:return_to</span><span class="o">]</span> <span class="o">||</span> <span class="n">default</span><span class="p">)</span>
<span class="n">session</span><span class="o">.</span><span class="n">delete</span><span class="p">(</span><span class="ss">:return_to</span><span class="p">)</span>
<span class="k">end</span>
<span class="k">def</span> <span class="nf">store_location</span>
<span class="n">session</span><span class="o">[</span><span class="ss">:return_to</span><span class="o">]</span> <span class="o">=</span> <span class="n">request</span><span class="o">.</span><span class="n">url</span>
<span class="k">end</span>
<span class="k">end</span>
</pre></div>
</div></div>
<p>The storage mechanism is the <code>session</code> facility provided by Rails, which you can think of as being like an instance of the <code>cookies</code> variable from <a class="ref" href="sign-in-sign-out.html#sec-remember_me">Section 8.2.1</a> that automatically expires upon browser close. We also use the <code>request</code> object to get the <code>url</code>, i.e., the URI/URL of the requested page. The <code>store_location</code> method puts the requested URI in the <code>session</code> variable under the key <code>:return_to</code>.</p>
<p>To make use of <code>store_location</code>, we need to add it to the <code>signed_in_user</code> before filter, as shown in <a class="ref" href="updating-showing-and-deleting-users.html#code-add_store_location">Listing 9.18</a>.</p>
<div class="label" id="code-add_store_location"></div>
<div class="codelisting">
<div class="listing"><span class="header">Listing 9.18.</span> <span class="description">Adding <code>store_location</code> to the signed-in user before filter. <br /> <code>app/controllers/users_controller.rb</code></span> </div>
<div class="code"><div class="highlight"><pre><span class="k">class</span> <span class="nc">UsersController</span> <span class="o"><</span> <span class="no">ApplicationController</span>
<span class="n">before_filter</span> <span class="ss">:signed_in_user</span><span class="p">,</span> <span class="ss">only:</span> <span class="o">[</span><span class="ss">:edit</span><span class="p">,</span> <span class="ss">:update</span><span class="o">]</span>
<span class="n">before_filter</span> <span class="ss">:correct_user</span><span class="p">,</span> <span class="ss">only:</span> <span class="o">[</span><span class="ss">:edit</span><span class="p">,</span> <span class="ss">:update</span><span class="o">]</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="k">def</span> <span class="nf">edit</span>
<span class="k">end</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="kp">private</span>
<span class="k">def</span> <span class="nf">signed_in_user</span>
<span class="k">unless</span> <span class="n">signed_in?</span>
<span class="n">store_location</span>
<span class="n">redirect_to</span> <span class="n">signin_url</span><span class="p">,</span> <span class="ss">notice:</span> <span class="s2">"Please sign in."</span>
<span class="k">end</span>
<span class="k">end</span>
<span class="k">def</span> <span class="nf">correct_user</span>
<span class="vi">@user</span> <span class="o">=</span> <span class="no">User</span><span class="o">.</span><span class="n">find</span><span class="p">(</span><span class="n">params</span><span class="o">[</span><span class="ss">:id</span><span class="o">]</span><span class="p">)</span>
<span class="n">redirect_to</span><span class="p">(</span><span class="n">root_url</span><span class="p">)</span> <span class="k">unless</span> <span class="n">current_user?</span><span class="p">(</span><span class="vi">@user</span><span class="p">)</span>
<span class="k">end</span>
<span class="k">end</span>
</pre></div>
</div></div>
<p>To implement the forwarding itself, we use the <code>redirect_back_or</code> method to redirect to the requested URI if it exists, or some default URI otherwise, which we add to the Sessions controller <code>create</code> action to redirect after successful signin (<a class="ref" href="updating-showing-and-deleting-users.html#code-friendly_session_create">Listing 9.19</a>). The <code>redirect_back_or</code> method uses the or operator <code>||</code> through</p>
<div class="code"><div class="highlight"><pre><span class="n">session</span><span class="o">[</span><span class="ss">:return_to</span><span class="o">]</span> <span class="o">||</span> <span class="n">default</span>
</pre></div>
</div>
<p>This evaluates to <code>session[:return_to]</code> unless it’s <code>nil</code>, in which case it evaluates to the given default URI. Note that <a class="ref" href="updating-showing-and-deleting-users.html#code-friendly_forwarding_code">Listing 9.17</a> is careful to remove the forwarding URI; otherwise, subsequent signin attempts would forward to the protected page until the user closed his browser. (Testing for this is left as an exercise (<a class="ref" href="updating-showing-and-deleting-users.html#sec-updating_deleting_exercises">Section 9.6</a>.)</p>
<div class="label" id="code-friendly_session_create"></div>
<div class="codelisting">
<div class="listing"><span class="header">Listing 9.19.</span> <span class="description">The Sessions <code>create</code> action with friendly forwarding. <br /> <code>app/controllers/sessions_controller.rb</code></span> </div>
<div class="code"><div class="highlight"><pre><span class="k">class</span> <span class="nc">SessionsController</span> <span class="o"><</span> <span class="no">ApplicationController</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="k">def</span> <span class="nf">create</span>
<span class="n">user</span> <span class="o">=</span> <span class="no">User</span><span class="o">.</span><span class="n">find_by_email</span><span class="p">(</span><span class="n">params</span><span class="o">[</span><span class="ss">:session</span><span class="o">][</span><span class="ss">:email</span><span class="o">].</span><span class="n">downcase</span><span class="p">)</span>
<span class="k">if</span> <span class="n">user</span> <span class="o">&&</span> <span class="n">user</span><span class="o">.</span><span class="n">authenticate</span><span class="p">(</span><span class="n">params</span><span class="o">[</span><span class="ss">:session</span><span class="o">][</span><span class="ss">:password</span><span class="o">]</span><span class="p">)</span>
<span class="n">sign_in</span> <span class="n">user</span>
<span class="n">redirect_back_or</span> <span class="n">user</span>
<span class="k">else</span>
<span class="n">flash</span><span class="o">.</span><span class="n">now</span><span class="o">[</span><span class="ss">:error</span><span class="o">]</span> <span class="o">=</span> <span class="s1">'Invalid email/password combination'</span>
<span class="n">render</span> <span class="s1">'new'</span>
<span class="k">end</span>
<span class="k">end</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="o">.</span>
<span class="k">end</span>
</pre></div>
</div></div>
<p>(If you completed the first exercise in <a class="ref" href="sign-in-sign-out.html#top">Chapter 8</a>, be sure to use the proper <code>params</code> hash in <a class="ref" href="updating-showing-and-deleting-users.html#code-friendly_session_create">Listing 9.19</a>.)</p>