How to programmatucally check in a Rails controller whether the current Discourse user is authenticated?

dmitrii_fediuk · December 21, 2016, 12:03am

You can do it by comparing the current_user method result with nil.

An example

discourse/discourse/blob/v1.7.0.beta10/app/controllers/badges_controller.rb#L24-L26


if current_user
  user_badges = Set.new(current_user.user_badges.select('distinct badge_id').pluck(:badge_id))
end

The method’s implementation

github.com

discourse/discourse/blob/v1.7.0.beta10/lib/auth/default_current_user_provider.rb#L21-L104


# our current user, return nil if none is found
def current_user
  return @env[CURRENT_USER_KEY] if @env.key?(CURRENT_USER_KEY)


  # bypass if we have the shared session header
  if shared_key = @env['HTTP_X_SHARED_SESSION_KEY']
    uid = $redis.get("shared_session_key_#{shared_key}")
    user = nil
    if uid
      user = User.find_by(id: uid.to_i)
    end
    @env[CURRENT_USER_KEY] = user
    return user
  end


  request = @request


  auth_token = request.cookies[TOKEN_COOKIE]


  current_user = nil


  if auth_token && auth_token.length == 32
    limiter = RateLimiter.new(nil, "cookie_auth_#{request.ip}", COOKIE_ATTEMPTS_PER_MIN ,60)


    if limiter.can_perform?
      current_user = User.where(auth_token: auth_token)
                       .where('auth_token_updated_at IS NULL OR auth_token_updated_at > ?',
                                SiteSetting.maximum_session_age.hours.ago)
                       .first
    end


    unless current_user
      begin
        limiter.performed!
      rescue RateLimiter::LimitExceeded
        raise Discourse::InvalidAccess
      end
    end
  end


  if current_user && (current_user.suspended? || !current_user.active)
    current_user = nil
  end


  if current_user && should_update_last_seen?
    u = current_user
    Scheduler::Defer.later "Updating Last Seen" do
      u.update_last_seen!
      u.update_ip_address!(request.ip)
    end
  end


  # possible we have an api call, impersonate
  if api_key = request[API_KEY]
    current_user = lookup_api_user(api_key, request)
    raise Discourse::InvalidAccess unless current_user
    @env[API_KEY_ENV] = true
  end


  # user api key handling
  if api_key = @env[USER_API_KEY]


    limiter_min = RateLimiter.new(nil, "user_api_min_#{api_key}", SiteSetting.max_user_api_reqs_per_minute, 60)
    limiter_day = RateLimiter.new(nil, "user_api_day_#{api_key}", SiteSetting.max_user_api_reqs_per_day, 86400)


    unless limiter_day.can_perform?
      limiter_day.performed!
    end


    unless  limiter_min.can_perform?
      limiter_min.performed!
    end


    current_user = lookup_user_api_user_and_update_key(api_key, @env[USER_API_CLIENT_ID])
    raise Discourse::InvalidAccess unless current_user


    limiter_min.performed!
    limiter_day.performed!


    @env[API_KEY_ENV] = true
  end


  @env[CURRENT_USER_KEY] = current_user
end

dmitrii_fediuk · December 21, 2016, 12:03am