Logging in and out from other routes

[i-h8-github]

Hello,

Can I have a few pointers on how to implement login and logout from routes other than those defined in the plugin? As a test, I copied over the login and logout html from their respective routes into new views, but does rodauth expect login and logout submissions to come only from the defined routes?

I know with logout, I can call rodauth.logout, though I don't know how recommended this approach is. But as for logging in the user from somewhere other than the login route, what's the best approach?

Thank you.

[jeremyevans]

If you want to replace the views that Rodauth uses, you can do that by defining a view with the same name in your application and Rodauth will pick it up (one of the specs that uses this: https://github.com/jeremyevans/rodauth/blob/master/spec/login_spec.rb#L272). That's probably a better approach than trying to implement the login action yourself (logout is trivial if you aren't using features such as active_sessions or single_session).

Note that logout by default just clears the session, and login by default just sets a couple session values. You can set the same values manually if you know what you are doing. It is possible to call rodauth.login directly, but if you haven't prepared the rodauth object correctly to set the account, it won't work.

[i-h8-github]

Thank you for your reply.

I have already customized the login view, but was really hoping there was a way to reuse that view as a fragment inside other pages.

What I want to be able to do, at a minimum, is to have a landing page for a file download with a button prompt to log in for non-authenticated users, then bring them back to that same page after login to click the same button which will now bring them to the download.

Unfortunately, I cannot rely on login_return_to_requested_location? (at least according to my current knowledge) because there are multiple access tiers, and the login needs to redirect back to the download page so that it can tell logged-in users if they need to upgrade, &c.

To that end, I was thinking I could dynamically create a login view with an extra hidden parameter containing the current path, and use that to log in internally and then redirect back to the path param, or wherever is appropriate depending on the situation.

Have I misunderstood something?

In regards to setting the session values manually, I knew I had seen those methods (login &c.) before somewhere, but I cannot for the life of me locate them in the documentation, which I tried to do before I posted this question. I would appreciate it very much if you could point me to where I can read up on the specifics.

Thank you.

[janko]

Yeah, a custom logic for redirecting back to the desired page after login sounds right. But you can still use Rodauth's login endpoint for that, just override the appropriate configuration, e.g. before_login_route and login_redirect. I still don't understand what exactly do you need differently in your custom endpoint.

Some Rodauth public methods are documented here, but most that don't have configuration method aren't documented, you have to look at the source code (this is what I do). For example, if you look at the #login method and how it's used, it's pretty easy to understand what it does:

rodauth/lib/rodauth/features/login.rb

Lines 86 to 95 in 0ac442a

	def login(auth_type)
	@saved_login_redirect = remove_session_value(login_redirect_session_key)
	transaction do
	before_login
	login_session(auth_type)
	yield if block_given?
	after_login
	end
	require_response(:_login_response)
	end

[janko]

Assuming you have retrieved the account in your custom route, you can login as follows:

rodauth.account_from_login(account.email)
rodauth.login_session("password")

If you also want Rodauth's default redirects and flash message, use rodauth.login instead of rodauth.login_session.

[jeremyevans]

Both take the auth type, not the password. You should be validating the password before calling the methods.

[i-h8-github]

Do you think you could point me towards where this is implemented in Rodauth itself so I can learn best practices?

I would prefer to be able to use the built-in mechanisms because I trust the security (indeed, I am very wary of implementing anything of this sort myself, hence my using Rodauth in the first place), but unless I've misunderstood something about how things work, I don't see how it's possible whilst also having the UX I need. Thus, I would like to be able to make sure I am doing everything "the right way" with only the additional functionality I require.

[jeremyevans]

Again, for just changing the view, it's easy to do by defining a template with the same name in your Roda application (so if you are using the erb template engine by default, this would be login.erb in your Roda views directory). If you need hooks for your own code, before_login_route, before_login_attempt, before_login, after_login, after_login_failure can all be used. This would be "the right way" using the built-in mechanisms.

You haven't explained why you want to implement your own login route, but use Rodauth for the authentication part. In terms of Rodauth's handling of the login route, it is here: https://github.com/jeremyevans/rodauth/blob/master/lib/rodauth/features/login.rb#L35C6-L80

Until you have a fairly good understanding of Rodauth and how it works internally, I advise against trying to implement your own login route but calling into Rodauth for the authentication part.

[i-h8-github]

In reply to your top-level comment, I mentioned that I already customized the views at those locations, and also explained my use case and why I don't see how that UX can be achieved with Rodauth's defaults per my current understanding.

Thank you for the link. Looking at the code there, it seems fairly straightforward (so far as something like this can be uncomplicated, anyway). I don't see where the check against non-login routes is happening, though.

As of now, I have the following saved as both login.erb and sign-in.erb:

<form method="post" action="login" class="rodauth" role="form" id="login-form">

  <%== rodauth.csrf_tag %>
  <div class="form-group mb-3">
  <label for="login" class="form-label">Username or Email</label>
  <input  autocomplete="email"  required="required"   type="text" class="form-control" name="login" id="login" value=""/>
</div>

  <div class="form-group mb-3">
  <label for="password" class="form-label">Password</label>
  <input  autocomplete="current-password"  required="required"   type="password" class="form-control" name="password" id="password" value=""/>
</div>

  <div class="form-group mb-3">
  <input type="submit"  class="btn btn-primary" value="Log in"/>
</div>

</form>

Naturally, login.erb works, and sign-in.erb doesn't. My instinct told me it had something to do with rodauth.csrf_tag, but login.erb works regardless of its presence, and sign-in.erb fails regardless of its presence.

I know that I can change the rodauth login route to sign-in to be able to log in from that page, but what I really want is to be able to log in from both login and sign-in. If that were possible, I'm relatively certain I could accomplish the rest of what I want via rodauth's before and after hooks.

[janko]

Since Roda uses per-action CSRF tokens, you probably need to specify Rodauth's login route, because that's where you submitting the form to:

<form method="post" action="<%= rodauth.login_path %>" class="rodauth" role="form" id="login-form">
  <%== rodauth.csrf_tag(rodauth.login_path) %>
  ...
</form>

Note that in case of validation errors, Rodauth will re-render its default login page, so you might need to override login_view to be contextual. Maybe have a hidden field that you check:

<form ...>
  ...
  <input type="hidden" name="page" value="sign-in" />
</form>

# in your Rodauth configuration:
login_view do
  if param("page") == "sign-in"
    view("sign-in", "Sign In") # signature is `view(template, page_title)`
  else
    super()
  end
end

There could be a simpler solution I'm not seeing.