Repository navigation
Stop failed sign-ins writing current_platform; fix resending orphaned invites - #149
Merged
Merged
Conversation
… invites devise_token_auth looks the shopkeeper up by email before checking the password, and SessionsController#create saved the `source` header whenever that lookup succeeded. Anyone who knew an email could set the shopkeeper's current_platform to any string, skipping validation; the record then failed its ios/android inclusion check, so that shopkeeper's profile updates returned 422. The platform is now written from render_create_success, which runs only after a successful sign-in, and only for "ios" or "android". Deleting an inviter nullifies accounts_invitations.invited_by_id, and resending such an invitation raised NoMethodError on nil.name in the mail job. The invitation mail now names the app (mobile_app.name) instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WyUzNEPWyhjjWrBcSaXSW4
Drop the Style/DoubleCopDisableDirective entry (RuboCop removed the cop) and rename .erb-lint.yml to .erb_lint.yml, the name erb_lint now expects. Both tools printed a warning on every run; the lint results are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WyUzNEPWyhjjWrBcSaXSW4
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WyUzNEPWyhjjWrBcSaXSW4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
current_platformeven when the password was wrong. devise_token_auth finds the shopkeeper by email before checking the password, andSessionsController#createsaved thesourceheader whenever that lookup succeeded, skipping validation. Anyone knowing an email could set any string; the record then failed its ios/android inclusion check, so the shopkeeper's profile updates returned 422. The platform is now written fromrender_create_success(successful sign-ins only) and only forios/android(Shopkeeper::CURRENT_PLATFORMS).NoMethodError: undefined method 'name' for nil).invited_byis nullified on shopkeeper deletion; the mail now names the app (mobile_app.name) instead.Style/DoubleCopDisableDirectivecop from.rubocop.yml, rename.erb-lint.ymlto.erb_lint.yml.Tests
Written first and seen failing before the fix:
failed sign-in does not change current_platformsuccessful sign-in with an unsupported source header preserves the existing current_platforminvited names the app when the inviter has been deletedbin/rubocop,bin/brakeman,erb_lint: clean.bin/rails test: 540 runs, 0 failures.Exercised on a running dev server: a wrong-password sign-in with
source: hackedleftcurrent_platformunchanged; successful sign-ins storedios/androidand ignoredhacked. Rendered the invitation mail for a dev invitation with no inviter: subject "NativeAppTemplate invited you to Test org".🤖 Generated with Claude Code
https://claude.ai/code/session_01WyUzNEPWyhjjWrBcSaXSW4