登入流程設計

兩類用戶：一般消費者（瀏覽、購物）、管理員（商品/訂單/用戶管理）。登入成功後存入 session[:user_id]，後續請求透過 Filter 驗證。

模型層：User 類別與密碼雜湊

# user.rb
require "digest/sha1"

class User < ActiveRecord::Base
  attr_accessor :password
  attr_accessible :name, :password
  
  validates_uniqueness_of :name
  validates_presence_of :name, :password
  
  def before_create
    self.hashed_password = User.hash_password(self.password)
  end
  
  def after_create
    @password = nil  # 清除明文密碼
  end
  
  def self.login(name, password)
    hashed = hash_password(password || "")
    find(:first, :conditions => ["name = ? AND hashed_password = ?", name, hashed])
  end
  
  def try_to_login
    User.login(self.name, self.password)
  end
  
  private
  def self.hash_password(password)
    Digest::SHA1.hexdigest(password)
  end
end

關鍵點

• attr_accessor :password：虛擬屬性，不對應資料庫欄位，暫存明文密碼
• attr_accessible：大量指派白名單，防止惡意指派 hashed_password
• before_create：儲存前自動雜湊密碼
• after_create：清除記憶體中明文密碼
• 使用 SHA1 雜湊（現代建議用 bcrypt/scrypt/Argon2）

控制器層：LoginController

class LoginController < ApplicationController
  def login
    if request.get?
      session[:user_id] = nil
      @user = User.new
    else
      @user = User.new(params[:user])
      logged_in_user = @user.try_to_login
      if logged_in_user
        session[:user_id] = logged_in_user.id
        redirect_to :action => "index"
      else
        flash[:notice] = "Invalid user/password combination"
      end
    end
  end
  
  def index
    @total_orders = Order.count
    @pending_orders = Order.count_pending
  end
  
  def logout
    session[:user_id] = nil
    flash[:notice] = "Logged out"
    redirect_to :action => "login"
  end
  
  # add_user, delete_user, list_users ...
end

視圖層

登入表單

<%= form_tag %>

  
User name:
<%= text_field("user", "name") %>
  
Password:
<%= password_field("user", "password") %>
  


<%= end_form_tag %>

管理首頁

<% @page_title = "Administer your Store" -%>
Depot Store Status
Total orders in system: <%= @total_orders %>
Orders pending shipping: <%= @pending_orders %>

Order 模型擴充

# order.rb
def self.count_pending
  count("shipped_at is null")
end

測試驗證

1. 訪問 /login/login 顯示登入表單
2. 輸入錯誤憑證 → 顯示 "Invalid user/password combination"
3. 輸入正確憑證 (fred/abracadabra) → 導向管理首頁，顯示訂單統計
4. 點擊 "Log out" → 導回登入頁，顯示 "Logged out"