Authenticate devise user from email

0
votes

I'm using rails 3 and devise. I would like to do build in the following work flow.

  1. Article is submitted on site that requires admin approval.
  2. Site sends the admin of the site an email with a link to the page where the admin can review edit and approve the article

I've got this implemented, however, if the admin is not currently logged into the site the admin is bounced back to the root path for not being authenticated.

Is there away that the link that that is sent in the email can act as an authentication for the specific admin?

3
ruby-on-railsemaildevise
Does it mean that anyone who follows that link is authenticated as Admin?! - Christian
Yes, but the link is only being sent to authorized people and the link would presumably expire after some set time... I know it's not the most secure method, but this is a blog were talking about, not something highly sensitive. - Intentss

3 Answers

0
votes

You could implement this as a custom controller action.

You can turn off devise authentication for a given action in a controller by adding an :except => :custom_action key to your :before_filter call.

You could include a query string in the link with the article_id and the admin_id. Then in the custom controller action, you would check that this article has not already been moderated, via an extra field in the articles table. If it had, you could bail. If it hadn't then you could allow the moderator to approve or disapprove of it, set the moderated flag to true and thank the moderator for her work.

If you wanted to get really tricky, you could make the URL include an MD5-hashed id which you could use as the key rather than an article id. You could store this in an extra field in the article model. That would make it much less likely to get spoofed during the brief window when it is moderate-able.

ian.

0
votes

You want to look into token authentication for devise. This allows you to use a one time key to authorize user access through a URL parameter.

See more information here. http://zyphmartin.com/blog/simple-auth-token-example-with-devise

Also you could simply create a authentication token per resource and store the authentication value in the database. When you go to the approve URL for the resource pass in the resource id and the authentication token. This would be more secure than logging the user in as administrator.

If you need more help let me know.

0
votes

You could add an action to the controller (which is where your URL would point to), and then exclude it from authentication by adding this to your controller:

before_filter :authenticate_user!, :except => [:review_article]

You could include some sort of a key in the URL (e.g. MD5 of the article as Ian suggested), and check that in review_article.