Always get "login required" message

[jeff_wigal]

Hi--

I'm having a little problem with getting this up and running.

I'm using authlogic for authentication, and I believe that I have
everything set up correctly for providing a current_user object.

After I login to my application, I put a

permit "developers"

line at the top of my controller.

Regardless of whether the logged in user has that role or not, I
always get a redirect with the default message of "Login is required
to access the requested page."

I've tried being more explicit by saying

permit "developers", :user => @current_user

That doesn't seem to help either, same message.

I tried throwing in some logging to see if the current_user object is
set, and it indeed is set.

before_filter :log_user
permit "developers", :user => @current_user

def log_user
logger.info current_user.inspect
logger.info @current_user.inspect
end


I then tried explicitly setting some options;

permit "developers", {
:user => @current_user,
:permission_denied_redirection => '/teams',
:permission_denied_message => 'denied access',
:login_required_redirection => '/users',
:login_required_message => 'not logged in'}

The flash message displayed is 'not logged in'

What am I missing? Any ideas?

Thanks--

[Tim]

Which version of the plugin are you using?

Can you try adding a log message from within the has_permission?
method in the plugin to see whether it has the correct value for
current_user?

Something like this:

diff --git a/lib/authorization.rb b/lib/authorization.rb
index a31a565..90309a8 100644
--- a/lib/authorization.rb
+++ b/lib/authorization.rb
@@ -72,6 +72,7 @@ module Authorization

def has_permission?( authorization_expression )
@current_user = get_user
+ logger.info "Current user is #{@current_user.inspect}"
if not @options[:allow_guests]
# We aren't logged in, or an exception has already been
raised.
# Test for both nil and :false symbol as
restful_authentication plugin


-Tim

[jeff_wigal]

I ended up putting a similar expression through on the "get_user"
method. At the time that get_user method was called, current_user was
nil.

My guess it has something to do with "what gets executed first",
whether it be AuthLogic assigning the user to @current_user, or the
authorization expression, and it appears the authorization expression
for whatever reason is getting parsed first.

I'm inclined to ask the question over on the Authlogic forum.

-jeff

[Tim]

I thought something like that was happening...

IIRC, it's up to you to define the current_user and
current_user_session methods on ApplicationController for AuthLogic.
If you've done that, then it might help to log what they are returning
to see why they're returning nil when rails-authorization-plugin is
calling ApplicationController#current_user to get the logged in user.

Also, one thing I just noticed about the code that you posted earlier:

permit "developers", :user => @current_user

This will probably not work, as @current_user refers to the
"current_user" instance attribute on the controller class, instead of
on the particular instance of the controller. I think you're actually
passing :user => nil to the permit string.

HTH,
Tim