Skills Assignment SA6: Authentication

Required Demos-n-Deets demos:

• Authentication
• Resource Ownership

Optional demos (for now): Everything else in the “Authentication” section of the Demos-n-Deets.

Active Reading

Follow the general instructions for active reading for the above required demos.

What to submit:

• For the Authentication demo, 5 screenshots:
  • sa6-ar-01: Quizzes index page before someone has signed in.
  • sa6-ar-02: Quizzes index page after being signed in as alice@email.com (password: “password”).
  • sa6-ar-03: The result of the following: (1) sign out and then (2) try to open the page: http://localhost:3000/quizzes/1/edit. (Should display sign-in page with error notification.)
  • sa6-ar-04: Quizzes controller class, including the before_action declaration.
  • sa6-ar-05: Questions controller class, including the before_action declaration.
• For the Resource Ownership demo, 4 screenshots:
  • sa6-ar-06: Quizzes index page after signing in as alice@gmail.com and creating a new Quiz.
  • sa6-ar-07: app/views/quizzes/index.html.erb view template.
  • sa6-ar-08: Quizzes controller class.
  • sa6-ar-09: The result of the following: (1) sign in as alice@gmail.com and then (2) try to open the page: http://localhost:3000/quizzes/1/edit. (Should display index page with error notification.)

In the above screenshots, code which is too long to be captured in one screenshot may be split up into multiple screenshots.

Important! All screenshots must include your computer’s desktop in the background so that it is recognizable as your desktop. Also, all screenshots of web pages must display the entire URL of the page in the browser’s location bar. (Watch out, as some browsers like to hide parts of the URL unless you click on it.)

Practice Test

Before proceeding, be sure to read the general description and instructions for the practice tests.

Start with the base project on the freebay branch of this repo: https://github.com/memphis-cs/practice-apps-2022-08fall

The aim of this project is enable users to post listings for free stuff that they want to give away. The project already includes a Listing model class, as per this class diagram:

Along with this model class, the app includes the standard resource-CRUDing pages and UI features for Listing model objects. It also includes model validations and database seeds. (You can ignore the test fixtures and model tests for this assignment.) It is recommended that you initialize and run the base app at this point, so you can see firsthand what’s there.

Task to perform:

• Install and set up the Devise gem.
• Generate a Devise User model class.
• In the seeds script, uncomment the calls to User.create!, so the system can be seeded with some users.
• Replace the “TODO” link at the top of all pages with “Sign In” and “Sign Up” links that are displayed when the user is signed out and a “Sign Out” link that is displayed when the user is signed in.
• Require a user to be signed in order to access any ListingsController action, except for the index and show actions.
• Add a has-many/belongs-to associations between the User and Listing classes to establish ownership links between users and the listings they create, as per this class diagram:

• Don’t forget to update the create action of the ListingsController such that it adds the new Listing object to the collection of listings created by the current user.
• Update the seeds script to make the Listing objects belong to the appropriate User objects (as per the comments).
• Require a user to be the owner of a Listing object in order to access the following ListingsController actions for that object: new, create, edit, update, and destroy.
• Hide all links to actions that a user doesn’t have permission to access.
• On the Listing show page, display the email of the User who was the “Lister” along with the other Listing attribute values.

What to submit:

• While signed out, these screenshots:
  • Listings index page.
  • Listings show page for any listing.
  • The result of trying to open the page: http://localhost:3000/listings/1/edit. (Should display sign-in page with error notification.)
• While signed in as bob@email.com (see seeds for password), these screenshots:
  • Listings index page.
  • Listings show page for a listing owned by bob@email.com.
  • Listings show page for a listing not owned by bob@email.com.
  • The result of trying to open the page: http://localhost:3000/listings/1/edit. (Should redirect to the index page and display an error.)
• These code screenshots:
  • The ListingsController class file.
  • The app/views/layouts/application.html.erb file.
  • The app/views/listings/index.html.erb file.
  • The User model class.
  • The Listing model class.

In the above screenshots, code which is too long to be captured in one screenshot may be split up into multiple screenshots.

Important! All screenshots must include your computer’s desktop in the background so that it is recognizable as your desktop. Also, all screenshots of web pages must display the entire URL of the page in the browser’s location bar. (Watch out, as some browsers like to hide parts of the URL unless you click on it.)

Explanation Video

Before proceeding, be sure to read the general instructions for the explanation videos.

Important! For this explanation video, you must follow the task plan and reflection instructions.

Start with the base project on the blogr branch of this repo: https://github.com/memphis-cs/practice-apps-2022-08fall

This project contains the start of a blogging app. It already includes a BlogPost model class, as per this class diagram:

Along with this model class, the app includes the standard resource-CRUDing pages and UI features for BlogPost model objects. It also includes model validations and database seeds. (You can ignore the test fixtures and model tests for this assignment.) It is recommended that you initialize and run the base app at this point, so you can see firsthand what’s there.

The video can begin after you have cloned, initialized, and run the base app.

This time, you will actually be making two video, because the tasks are longer than usual. Although it may not be your first thought, making a mistake during a video that causes you to have to restart and redo tasks is actually great practice, and thus, is great for skills acquisition. That said, doing this piece as two videos could potentially save you from having to aaaaaall the way back to the beginning if you make a mistake near the end.

Video 1

Task to perform:

• Install and set up the Devise gem.
• Generate a Devise User model class.
• In the seeds script, add calls to User.create!, so the system can be seeded with the users mentioned (Homer, Bart, and Lisa).
• Replace the “TODO_LINK” link at the top of all pages with “Sign In” and “Sign Up” links that are displayed when the user is signed out and a “Sign Out” link that is displayed when the user is signed in.
• Require a user to be signed in order to access any BlogPostsController action, except for the index and show actions.

Video 2

Task to perform:

• Add a has-many/belongs-to associations between the User and BlogPost classes to establish ownership links between users and the blog posts they create, as per this class diagram:

• Don’t forget to update the create action of the BlogPostsController such that it adds the new BlogPost object to the collection of posts authored by the current user.
• Update the seeds script to make the BlogPost objects belong to the appropriate User objects (as per the comments).
• Require a user to be the owner of a BlogPost object in order to access the following BlogPostsController actions for that object: edit, update, and destroy.
• Hide all links to actions that a user doesn’t have permission to access.
• On the BlogPost index and show pages, replace the “TODO_AUTHOR” text with email of the User object whom the BlogPost belongs to.