users_controller.rb

classUsersController < ApplicationController
before_action:require_login,only: [:edit,:update,:unsubscribe_comment_emails]
skip_before_action:verify_authenticity_token,only: :show,
if: ->{request.format.json?}

defshow
scope=User.visible_to(current_user)
ifparams[:username].blank? && params[:id]
@user=scope.find(params[:id])
returnredirect_to(profile_path(username: @user.username))
elsifparams[:username] == 'random'
@user=scope.order("random()").first
elsifparams[:delete_account]
returnredirect_to(sign_in_url)unlesssigned_in?
@user=current_user
else
@user=scope.includes(:badges,:protips).find_by_username!(params[:username])
end
respond_todo |format|
format.htmldo
fresh_when(web_etag_key_for_user)
end
format.jsondo
ifstale?(api_etag_key_for_user)
render(json: @user,callback: params[:callback])
end
end
format.all{head(:not_found)}
end
end

defedit
@user=User.where(id: params[:id]).first || current_user
returnhead(:forbidden)if !current_user.can_edit?(@user)
end

defcreate
returnhead(:forbidden)ifsigned_in?
@user=User.new(new_user_params)
if !captcha_valid_user?(params["g-recaptcha-response"],remote_ip)
flash[:notice]="Let us know if you're human below :D"
renderaction: :new
return
end

if@user.save
sign_in(@user)
redirect_tofinish_signup_url
else
renderaction: :new
end
end

defindex
redirect_tosign_up_url
end

defupdate
@user=User.find(params[:id])
returnhead(:forbidden)if !current_user.can_edit?(@user)
@user.attributes=user_params
if@user.save
redirect_toprofile_url(username: @user.username)
else
renderaction: :edit
end
end

defimpersonate
ifRails.env.development? || current_user.admin?
@user=ifparams[:username]
User.find_by_username(params[:username])
else
User.order('random()').first
end
logger.info"signing in as #{@user.username}"
sign_in(@user)do |status|
ifstatus.success?
redirect_back_orClearance.configuration.redirect_url
else
flash.now.notice=status.failure_message
rendertemplate: "sessions/new",status: :unauthorized
end
end
end
end

defdestroy
@user=User.find(params[:id])
head(:forbidden)unlesscurrent_user.can_edit?(@user)
UserMailer.destroy_email(@user).deliver_now
@user.destroy
if@user == current_user
sign_out
flash[:notice]="You are no longer signed in to Coderwall. Your acccount, #{@user.username}, has been deleted."
else
flash[:notice]="#{@user.username}'s account deleted."
end
redirect_to_back_or_default
end

protected

defnew_user_params
params.require(:user).permit(:username,:password,:email)
end

defuser_params
safe_attributes=[
:twitter,
:github,
:color,
:email,
:avatar,
:title,
:company,
:location,
:editable_skills,
:about,
:receive_newsletter,
:receive_weekly_digest
]
safe_attributes << :usernameifadmin?
params.require(:user).permit(safe_attributes)
end

defweb_etag_key_for_user
{
etag:['v4',@user,current_user,params[:protips],params[:protips]],
last_modified: @user.updated_at.utc,
public: false
}
end

defapi_etag_key_for_user
{
etag:['v5',@user,params[:callback]],
last_modified: @user.updated_at.utc,
public: true
}
end

end