eminuxandCursor
cc96c0396a
Aggiunge filtri/colonne (società, orari) e dettaglio leggibile; evita 422 CSRF su logout e non cancella le cover slate custom in sync prod. Co-authored-by: Cursor <cursoragent@cursor.com>
37 lines
1.2 KiB
Ruby
37 lines
1.2 KiB
Ruby
module Public
|
|
class SessionsController < WebBaseController
|
|
# Logout must succeed even with a stale CSRF token (old tab after deploy /
|
|
# session rotate). SameSite=Lax already blocks cross-site cookie POSTs.
|
|
skip_before_action :verify_authenticity_token, only: :destroy
|
|
|
|
def new
|
|
if logged_in? && current_user.primary_club
|
|
redirect_to public_club_path(current_user.primary_club)
|
|
end
|
|
end
|
|
|
|
def create
|
|
user = User.find_by(email: params[:email]&.downcase)
|
|
if user&.authenticate(params[:password])
|
|
session[:user_id] = user.id
|
|
dest = if user.primary_club
|
|
public_club_path(user.primary_club)
|
|
elsif user.manageable_teams.first
|
|
public_team_details_path(user.manageable_teams.first)
|
|
else
|
|
public_new_club_path
|
|
end
|
|
redirect_to dest, notice: t("flash.sessions.welcome_back")
|
|
else
|
|
flash.now[:alert] = t("flash.sessions.invalid_credentials")
|
|
render :new, status: :unauthorized
|
|
end
|
|
end
|
|
|
|
def destroy
|
|
reset_session
|
|
redirect_to public_pricing_path, notice: t("flash.sessions.logged_out")
|
|
end
|
|
end
|
|
end
|