Passwords and More Security for a Rails Ecommerce Application

Passwords and More Security for a Rails Ecommerce Application - Using Observers
(Page 3 of 4 )

When we createdUserNotifierin the beginning of the Reset Password user story implementation, the generator also created a file calleduser_observer.rbinapp/models. Observers in Rails are classes that monitor the life cycle of ActiveRecord objects, somewhat similar to the filters for controllers. Observers support the following callback methods:

1. after_create
   
2. after_destroy 
    
3. after_save 
    
4. after_update 
    
5. after_validation 
    
6. after_validation_on_create 
    
7. after_validation_on_update 
    
8. before_create 
    
9. before_destroy 
    
10. before_save 
     
11. before_update 
     
12. before_validation 
     
13. before_validation_on_create 
     
14. before_validation_on_update

You can call these callbacks directly in an ActiveRecord model, too:  

class MyModel < ActiveRecord::Base
  after_save :say_foo

  def say_foo
    logger.info "Foo-oo!"
  end
end

However, if your callback code gets longer and/or you want to implement similar behavior for multiple models, it’s a good idea to extract the callbacks to an observer. Observers also give you more flexibility, since you can restrict the callbacks to happen only in certain controllers, as we will do in this section.

When thegenerate authenticated_mailer usercommand created theUserObserver observer, it created two callbacks for it:

class UserObserver < ActiveRecord::Observer
  def after_create(user)
    UserNotifier.deliver_signup_notification(user)
  end

  def after_save(user)
    UserNotifier.deliver_activation(user) if user.recently_activated?
  end
end

However, we don’t need either of these callbacks, since we aren’t implementing signup notification or user activation in this sprint. We can simplify the observer to look like this:

class UserObserver < ActiveRecord::Observer
  def after_save(user)
    UserNotifier.deliver_forgot_password(user) if user.password_forgotten
  end
end

You might have wondered what we’re going to do with the@password_forgottenvariable in theUserclass, and here’s the answer. Ourafter_savemethod inUserObserverkicks in when theUser object is saved and checks whether the variable istrue. If yes, it asks theUserNotifiermailer to deliver theforgot_passwordmail, passing the current user as an attribute. In normal cases, when@password_forgottenisnil, the observer does nothing.

blog comments powered by Disqus