+
+
+
+ Howdy, admin 👋
+
+
+
+
+ <%= form_for(resource, as: resource_name, url: '/super_admin/sign_in', html: { class: 'login-box column align-self-top'}) do |f| %>
+
+ <% end %>
+
+ © Chatwoot
+
+
+
+
+
+
diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb
index ce0010637..80eb40433 100644
--- a/config/initializers/devise.rb
+++ b/config/initializers/devise.rb
@@ -6,7 +6,7 @@ Devise.setup do |config|
# confirmation, reset password and unlock tokens in the database.
# Devise will use the `secret_key_base` as its `secret_key`
# by default. You can change it below and use your own secret key.
- # config.secret_key = 'dff4665a082305d28b485d1d763d0d3e52e2577220eaa551836862a3dbca1aade309fe7ceed35180ac494cbc27bd2f5f84d45e4d19530598d1bd899dcbb115e1'
+ # config.secret_key = 'dff4665a082305d28b485d1d763d0d3e52e2577220eaa551836862a3dbca1aade309fe7ceed35180ac494cbc27bd2f5f84d45e1'
# ==> Mailer Configuration
# Configure the e-mail address which will be shown in Devise::Mailer,
@@ -220,15 +220,15 @@ Devise.setup do |config|
# Turn scoped views on. Before rendering "sessions/new", it will first check for
# "users/sessions/new". It's turned off by default because it's slower if you
# are using only default views.
- # config.scoped_views = false
+ config.scoped_views = true
# Configure the default scope given to Warden. By default it's the first
# devise role declared in your routes (usually :user).
- # config.default_scope = :user
+ config.default_scope = :user
# Set this configuration to false if you want /users/sign_out to sign out
# only the current scope. By default, Devise signs out all scopes.
- # config.sign_out_all_scopes = true
+ config.sign_out_all_scopes = true
# ==> Navigation configuration
# Lists the formats that should be treated as navigational. Formats like
diff --git a/config/routes.rb b/config/routes.rb
index 50331d25a..35f162e0d 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -168,20 +168,20 @@ Rails.application.routes.draw do
# Internal Monitoring Routes
require 'sidekiq/web'
- scope :monitoring do
- # Sidekiq should use basic auth in production environment
- if Rails.env.production?
- Sidekiq::Web.use Rack::Auth::Basic do |username, password|
- ENV['SIDEKIQ_AUTH_USERNAME'] &&
- ENV['SIDEKIQ_AUTH_PASSWORD'] &&
- ActiveSupport::SecurityUtils.secure_compare(::Digest::SHA256.hexdigest(username),
- ::Digest::SHA256.hexdigest(ENV['SIDEKIQ_AUTH_USERNAME'])) &&
- ActiveSupport::SecurityUtils.secure_compare(::Digest::SHA256.hexdigest(password),
- ::Digest::SHA256.hexdigest(ENV['SIDEKIQ_AUTH_PASSWORD']))
- end
- end
+ devise_for :super_admins, path: 'super_admin', controllers: { sessions: 'super_admin/devise/sessions' }
+ devise_scope :super_admin do
+ get 'super_admin/logout', to: 'super_admin/devise/sessions#destroy'
+ namespace :super_admin do
+ resources :users
+ resources :accounts
+ resources :super_admins
+ resources :access_tokens
- mount Sidekiq::Web, at: '/sidekiq'
+ root to: 'users#index'
+ end
+ authenticated :super_admin do
+ mount Sidekiq::Web => '/monitoring/sidekiq'
+ end
end
# ---------------------------------------------------------------------
diff --git a/db/migrate/20200410145519_devise_create_super_admins.rb b/db/migrate/20200410145519_devise_create_super_admins.rb
new file mode 100644
index 000000000..4a74847dc
--- /dev/null
+++ b/db/migrate/20200410145519_devise_create_super_admins.rb
@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+class DeviseCreateSuperAdmins < ActiveRecord::Migration[6.0]
+ def change
+ return if ActiveRecord::Base.connection.table_exists? 'super_admins'
+
+ create_table :super_admins do |t|
+ ## Database authenticatable
+ t.string :email, null: false, default: ''
+ t.string :encrypted_password, null: false, default: ''
+
+ ## Recoverable
+ # t.string :reset_password_token
+ # t.datetime :reset_password_sent_at
+
+ ## Rememberable
+ t.datetime :remember_created_at
+
+ ## Trackable
+ t.integer :sign_in_count, default: 0, null: false
+ t.datetime :current_sign_in_at
+ t.datetime :last_sign_in_at
+ t.inet :current_sign_in_ip
+ t.inet :last_sign_in_ip
+
+ ## Confirmable
+ # t.string :confirmation_token
+ # t.datetime :confirmed_at
+ # t.datetime :confirmation_sent_at
+ # t.string :unconfirmed_email # Only if using reconfirmable
+
+ ## Lockable
+ # t.integer :failed_attempts, default: 0, null: false # Only if lock strategy is :failed_attempts
+ # t.string :unlock_token # Only if unlock strategy is :email or :both
+ # t.datetime :locked_at
+
+ t.timestamps null: false
+ end
+
+ add_index :super_admins, :email, unique: true
+ # add_index :super_admins, :reset_password_token, unique: true
+ # add_index :super_admins, :confirmation_token, unique: true
+ # add_index :super_admins, :unlock_token, unique: true
+ end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 7fab7d066..6965c2d03 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -327,6 +327,20 @@ ActiveRecord::Schema.define(version: 2020_05_10_112339) do
t.boolean "payment_source_added", default: false
end
+ create_table "super_admins", force: :cascade do |t|
+ t.string "email", default: "", null: false
+ t.string "encrypted_password", default: "", null: false
+ t.datetime "remember_created_at"
+ t.integer "sign_in_count", default: 0, null: false
+ t.datetime "current_sign_in_at"
+ t.datetime "last_sign_in_at"
+ t.inet "current_sign_in_ip"
+ t.inet "last_sign_in_ip"
+ t.datetime "created_at", precision: 6, null: false
+ t.datetime "updated_at", precision: 6, null: false
+ t.index ["email"], name: "index_super_admins_on_email", unique: true
+ end
+
create_table "taggings", id: :serial, force: :cascade do |t|
t.integer "tag_id"
t.string "taggable_type"
diff --git a/spec/controllers/api/v1/accounts/accounts_controller_spec.rb b/spec/controllers/api/v1/accounts/accounts_controller_spec.rb
index 70b6953a3..955cf1e72 100644
--- a/spec/controllers/api/v1/accounts/accounts_controller_spec.rb
+++ b/spec/controllers/api/v1/accounts/accounts_controller_spec.rb
@@ -2,9 +2,10 @@ require 'rails_helper'
RSpec.describe 'Accounts API', type: :request do
describe 'POST /api/v1/accounts' do
+ let(:email) { Faker::Internet.email }
+
context 'when posting to accounts with correct parameters' do
let(:account_builder) { double }
- let(:email) { Faker::Internet.email }
let(:account) { create(:account) }
let(:user) { create(:user, email: email, account: account) }
@@ -22,7 +23,7 @@ RSpec.describe 'Accounts API', type: :request do
params: params,
as: :json
- expect(AccountBuilder).to have_received(:new).with(params)
+ expect(AccountBuilder).to have_received(:new).with(params.merge(confirmed: false))
expect(account_builder).to have_received(:perform)
expect(response.headers.keys).to include('access-token', 'token-type', 'client', 'expiry', 'uid')
end
@@ -36,16 +37,45 @@ RSpec.describe 'Accounts API', type: :request do
params: params,
as: :json
- expect(AccountBuilder).to have_received(:new).with(params)
+ expect(AccountBuilder).to have_received(:new).with(params.merge(confirmed: false))
+ expect(account_builder).to have_received(:perform)
+ expect(response).to have_http_status(:forbidden)
+ expect(response.body).to eq({ message: I18n.t('errors.signup.failed') }.to_json)
+ end
+
+ it 'ignores confirmed param when called with out super admin token' do
+ allow(account_builder).to receive(:perform).and_return(nil)
+
+ params = { account_name: 'test', email: email, confirmed: true }
+
+ post api_v1_accounts_url,
+ params: params,
+ as: :json
+
+ expect(AccountBuilder).to have_received(:new).with(params.merge(confirmed: false))
expect(account_builder).to have_received(:perform)
expect(response).to have_http_status(:forbidden)
expect(response.body).to eq({ message: I18n.t('errors.signup.failed') }.to_json)
end
end
- context 'when ENABLE_ACCOUNT_SIGNUP env variable is set to false' do
- let(:email) { Faker::Internet.email }
+ context 'when called with super admin token' do
+ let(:super_admin) { create(:super_admin) }
+ it 'calls account builder with confirmed true when confirmed param is passed' do
+ params = { account_name: 'test', email: email, confirmed: true }
+
+ post api_v1_accounts_url,
+ params: params,
+ headers: { api_access_token: super_admin.access_token.token },
+ as: :json
+
+ expect(User.find_by(email: email).confirmed?).to eq(true)
+ expect(response.headers.keys).to include('access-token', 'token-type', 'client', 'expiry', 'uid')
+ end
+ end
+
+ context 'when ENABLE_ACCOUNT_SIGNUP env variable is set to false' do
it 'responds 404 on requests' do
params = { account_name: 'test', email: email }
ENV['ENABLE_ACCOUNT_SIGNUP'] = 'false'
@@ -60,8 +90,6 @@ RSpec.describe 'Accounts API', type: :request do
end
context 'when ENABLE_ACCOUNT_SIGNUP env variable is set to api_only' do
- let(:email) { Faker::Internet.email }
-
it 'does not respond 404 on requests' do
params = { account_name: 'test', email: email }
ENV['ENABLE_ACCOUNT_SIGNUP'] = 'api_only'
diff --git a/spec/controllers/super_admin/access_tokens_controller_spec.rb b/spec/controllers/super_admin/access_tokens_controller_spec.rb
new file mode 100644
index 000000000..c1f38ea23
--- /dev/null
+++ b/spec/controllers/super_admin/access_tokens_controller_spec.rb
@@ -0,0 +1,24 @@
+require 'rails_helper'
+
+RSpec.describe 'Super Admin access tokens API', type: :request do
+ let(:super_admin) { create(:super_admin) }
+
+ describe 'GET /super_admin/access_tokens' do
+ context 'when it is an unauthenticated super admin' do
+ it 'returns unauthorized' do
+ get '/super_admin/'
+ expect(response).to have_http_status(:redirect)
+ end
+ end
+
+ context 'when it is an authenticated super admin' do
+ it 'shows the list of access tokens' do
+ sign_in super_admin
+ get '/super_admin/access_tokens'
+ expect(response).to have_http_status(:success)
+ expect(response.body).to include('New access token')
+ expect(response.body).to include(super_admin.access_token.token)
+ end
+ end
+ end
+end
diff --git a/spec/controllers/super_admin/accounts_controller_spec.rb b/spec/controllers/super_admin/accounts_controller_spec.rb
new file mode 100644
index 000000000..f4da5ad3d
--- /dev/null
+++ b/spec/controllers/super_admin/accounts_controller_spec.rb
@@ -0,0 +1,26 @@
+require 'rails_helper'
+
+RSpec.describe 'Super Admin accounts API', type: :request do
+ let(:super_admin) { create(:super_admin) }
+
+ describe 'GET /super_admin/accounts' do
+ context 'when it is an unauthenticated user' do
+ it 'returns unauthorized' do
+ get '/super_admin/accounts'
+ expect(response).to have_http_status(:redirect)
+ end
+ end
+
+ context 'when it is an authenticated user' do
+ let!(:account) { create(:account) }
+
+ it 'shows the list of accounts' do
+ sign_in super_admin
+ get '/super_admin/accounts'
+ expect(response).to have_http_status(:success)
+ expect(response.body).to include('New account')
+ expect(response.body).to include(account.name)
+ end
+ end
+ end
+end
diff --git a/spec/controllers/super_admin/super_admins_controller_spec.rb b/spec/controllers/super_admin/super_admins_controller_spec.rb
new file mode 100644
index 000000000..0255b520c
--- /dev/null
+++ b/spec/controllers/super_admin/super_admins_controller_spec.rb
@@ -0,0 +1,24 @@
+require 'rails_helper'
+
+RSpec.describe 'Super Admin super admins API', type: :request do
+ let(:super_admin) { create(:super_admin) }
+
+ describe 'GET /super_admin/users' do
+ context 'when it is an unauthenticated super admin' do
+ it 'returns unauthorized' do
+ get '/super_admin/super_admins'
+ expect(response).to have_http_status(:redirect)
+ end
+ end
+
+ context 'when it is an authenticated super admin' do
+ it 'shows the list of super admins' do
+ sign_in super_admin
+ get '/super_admin/super_admins'
+ expect(response).to have_http_status(:success)
+ expect(response.body).to include('New super admin')
+ expect(response.body).to include(super_admin.email)
+ end
+ end
+ end
+end
diff --git a/spec/controllers/super_admin/users_controller_spec.rb b/spec/controllers/super_admin/users_controller_spec.rb
new file mode 100644
index 000000000..7a1385213
--- /dev/null
+++ b/spec/controllers/super_admin/users_controller_spec.rb
@@ -0,0 +1,26 @@
+require 'rails_helper'
+
+RSpec.describe 'Super Admin Users API', type: :request do
+ let(:super_admin) { create(:super_admin) }
+
+ describe 'GET /super_admin/users' do
+ context 'when it is an unauthenticated super admin' do
+ it 'returns unauthorized' do
+ get '/super_admin/'
+ expect(response).to have_http_status(:redirect)
+ end
+ end
+
+ context 'when it is an authenticated super admin' do
+ let!(:user) { create(:user) }
+
+ it 'shows the list of users' do
+ sign_in super_admin
+ get '/super_admin'
+ expect(response).to have_http_status(:success)
+ expect(response.body).to include('New user')
+ expect(response.body).to include(user.name)
+ end
+ end
+ end
+end
diff --git a/spec/controllers/super_admin_controller_spec.rb b/spec/controllers/super_admin_controller_spec.rb
new file mode 100644
index 000000000..ea0697dd9
--- /dev/null
+++ b/spec/controllers/super_admin_controller_spec.rb
@@ -0,0 +1,46 @@
+require 'rails_helper'
+
+RSpec.describe 'Super Admin', type: :request do
+ let(:super_admin) { create(:super_admin) }
+
+ describe 'request to /super_admin' do
+ context 'when the super admin is unauthenticated' do
+ it 'redirects to signin page' do
+ get '/super_admin/'
+ expect(response).to have_http_status(:redirect)
+ expect(response.body).to include('sign_in')
+ end
+
+ it 'signs super admin in and out' do
+ sign_in super_admin
+ get '/super_admin'
+ expect(response).to have_http_status(:success)
+ expect(response.body).to include('New user')
+
+ sign_out super_admin
+ get '/super_admin'
+ expect(response).to have_http_status(:redirect)
+ end
+ end
+ end
+
+ describe 'request to /super_admin/sidekiq' do
+ context 'when the super admin is unauthenticated' do
+ it 'redirects to signin page' do
+ get '/monitoring/sidekiq'
+ expect(response).to have_http_status(:not_found)
+ expect(response.body).to include('sign_in')
+ end
+
+ it 'signs super admin in and out' do
+ sign_in super_admin
+ get '/monitoring/sidekiq'
+ expect(response).to have_http_status(:success)
+
+ sign_out super_admin
+ get '/monitoring/sidekiq'
+ expect(response).to have_http_status(:not_found)
+ end
+ end
+ end
+end
diff --git a/spec/factories/super_admins.rb b/spec/factories/super_admins.rb
new file mode 100644
index 000000000..88e488f68
--- /dev/null
+++ b/spec/factories/super_admins.rb
@@ -0,0 +1,6 @@
+FactoryBot.define do
+ factory :super_admin do
+ email { "admin@#{SecureRandom.uuid}.com" }
+ password { 'password' }
+ end
+end
diff --git a/spec/models/super_admin_spec.rb b/spec/models/super_admin_spec.rb
new file mode 100644
index 000000000..e9a03b361
--- /dev/null
+++ b/spec/models/super_admin_spec.rb
@@ -0,0 +1,5 @@
+require 'rails_helper'
+
+RSpec.describe SuperAdmin, type: :model do
+ pending "add some examples to (or delete) #{__FILE__}"
+end
diff --git a/spec/rails_helper.rb b/spec/rails_helper.rb
index 0c0d89421..ef39ac0ef 100644
--- a/spec/rails_helper.rb
+++ b/spec/rails_helper.rb
@@ -61,6 +61,8 @@ RSpec.configure do |config|
config.filter_rails_from_backtrace!
# arbitrary gems may also be filtered via:
# config.filter_gems_from_backtrace("gem name")
+
+ config.include Devise::Test::IntegrationHelpers, type: :request
end
Shoulda::Matchers.configure do |config|