constraint-validation-example

Expand History Expand History
Collapse History Collapse History

Add Users and require Authentication for messaging

Users

In order to increase the variety of validations and form styles in this example application, introduce the concept of a User, and require that they be authenticated to create Messages.

When creating Message records through the MessagesController, associate the new messages with the Current user.

Fixtures are declared for existing User and Message records to both simplify writing the authentication tests and so that we can delay a sign up process until a later point in the process.

Authentications

To authenticate the User, rely on has_secure_password, the bcrypt gem, and ActionDispatch‘s session. The AuthenticationsController is responsible for creating, verifying, and destroying User sessions. Matching before_action declarations are declared in both AuthenticationsController and MessagesController to ensure that the proper authentications have occurred before certain actions.

Validations

In a very similar style to the Message record validations, declare Authentication validations for each individual field. Additionally, to demonstrate a more secure authentication process, when an invalid username & password pairing are submitted, don’t mark the fields themselves as invalid, but instead associate the error message to the record itself.

Note that we’re asserting that the username and password fields are described by the error message (which relies on aria-describedby), and not that they’re validation errors themselves (which rely on the browser-native Constraint Validation validity state).

Duplications

At this point in the process, we have two controllers and two forms. There are some emerging patterns, mostly related to rendering the correct ARIA attributes, and testing form elements’ Accessibility.