Merge pull request #292 from AyuntamientoMadrid/mask_user_data

Mask user data

app/controllers/verification/email_controller.rb

@@ -1,6 +1,6 @@
 class Verification::EmailController < ApplicationController
   before_action :authenticate_user!
-  before_action :set_verified_user
+  before_action :set_verified_user, only: :create
   skip_authorization_check
 
   def show
@@ -26,6 +26,10 @@ class Verification::EmailController < ApplicationController
   private
 
     def set_verified_user
-      @verified_user = VerifiedUser.by_user(current_user).by_email(params[:recipient]).first
+      @verified_user = VerifiedUser.by_user(current_user).where(id: verified_user_params[:id]).first
+    end
+
+    def verified_user_params
+      params.require(:verified_user).permit(:id)
     end
 end

app/controllers/verification/sms_controller.rb

@@ -2,6 +2,7 @@ class Verification::SmsController < ApplicationController
   before_action :authenticate_user!
   before_action :verify_resident!
   before_action :verify_attemps_left!, only: [:new, :create]
+  before_action :set_phone, only: :create
 
   skip_authorization_check
 
@@ -10,7 +11,7 @@ class Verification::SmsController < ApplicationController
   end
 
   def create
-    @sms = Verification::Sms.new(sms_params.merge(user: current_user))
+    @sms = Verification::Sms.new(phone: @phone, user: current_user)
     if @sms.save
       redirect_to edit_sms_path, notice: t('verification.sms.create.flash.success')
     else
@@ -44,6 +45,19 @@ class Verification::SmsController < ApplicationController
       params.require(:sms).permit(:phone, :confirmation_code)
     end
 
+    def set_phone
+      if verified_user
+        @phone = @verified_user.phone
+      else
+        @phone = sms_params[:phone]
+      end
+    end
+
+    def verified_user
+      return false unless params[:verified_user]
+      @verified_user = VerifiedUser.by_user(current_user).where(id: params[:verified_user][:id]).first
+    end
+
     def redirect_to_next_path
       current_user.reload
       if current_user.level_three_verified?

app/helpers/verification_helper.rb

@@ -6,4 +6,19 @@ module VerificationHelper
      [t('verification.residence.new.document_type.residence_card'), 3]]
   end
 
+  def mask_phone(number)
+    match = number.match /\d{3}$/
+    "******#{match}"
+  end
+
+  def mask_email(string)
+    match = string.match /^(\w{1,3})(.*)@(.*)/
+
+    data_to_display = match[1]
+    data_to_mask    = match[2]
+    email_provider  = match[3]
+
+    data_to_display + "*"*data_to_mask.size + "@" + email_provider
+  end
+
 end

app/views/verification/email/_form.html.erb

@@ -1,4 +0,0 @@
-<%= form_for Verification::Email.new(verified_user), as: "email", url: email_path, method: :post do |f| %>
-  <%= hidden_field_tag :recipient, verified_user.email %>
-  <%= f.submit t('verification.email.form.submit_button') %>
-<% end %>

app/views/verification/sms/_form.html.erb

@@ -1,5 +0,0 @@
-<%= form_for sms, as: "sms", url: sms_path do |f| %>
-  <%= render 'shared/errors', resource: sms %>
-  <%= f.hidden_field :phone %>
-  <%= f.submit t('verification.sms.form.submit_button') %>
-<% end %>

app/views/verification/verified_user/_form.html.erb

@@ -0,0 +1,4 @@
+<%= form_for verified_user, url: url, method: :post do |f| %>
+  <%= f.hidden_field :id %>
+  <%= f.submit t('verification.verified_user.form.submit_button') %>
+<% end %>

app/views/verification/verified_user/show.html.erb

@@ -10,10 +10,10 @@
           <% if verified_user.email.present? %>
             <li id="<%= dom_id(verified_user) %>_email" style="float:left">
               <span style="float:left">
-                <%= verified_user.email %>
+                <%= mask_email(verified_user.email) %>
               </span>
               <span style="float:left;padding-left:30px">
-                <%= render '/verification/email/form', verified_user: verified_user %>
+                <%= render 'form', url: email_path, verified_user: verified_user %>
               </span>
             </li>
             <br/><br/><br/>
@@ -29,10 +29,10 @@
           <% if verified_user.phone.present? %>
             <li id="<%= dom_id(verified_user) %>_phone" style="float:left">
               <span style="float:left">
-                <%= verified_user.phone %>
+                <%= mask_phone(verified_user.phone) %>
               </span>
               <span style="float:left;padding-left:30px">
-                <%= render '/verification/sms/form', sms: Verification::Sms.new(phone: verified_user.phone) %>
+                <%= render 'form', url: sms_path, verified_user: verified_user %>
               </span>
             </li>
             <br/><br/><br/>

config/locales/verification.en.yml

@@ -36,8 +36,6 @@ en:
             success: 'Correct code. You are now a verified user'
           level_two:
             success: 'Correct code'
-      form:
-        submit_button: Send
       alert:
         verify_attemps_left: 'You have reached the maximum number of sms verification tries'
     email:
@@ -51,8 +49,6 @@ en:
           success: "We have send you a confirmation email to your email account: %{email}"
         alert:
           failure: "There was a problem sending you an email to your account"
-      form:
-        submit_button: Send
     letter:
       new:
         title: Final Verification
@@ -71,4 +67,5 @@ en:
         email_title: Emails
         phone_title: Phones
         use_another_phone: Use another phone
-
+      form:
+        submit_button: Send

config/locales/verification.es.yml

@@ -36,8 +36,6 @@ es:
             success: 'Código correcto. Ya eres un usuario verificado'
           level_two:
             success: 'Código incorrecto'
-      form:
-        submit_button: Enviar
       alert:
         verify_attemps_left: 'Has llegado al máximo número de intentos de verificar tu teléfono.'
     email:
@@ -51,8 +49,6 @@ es:
           success: "Te hemos enviado un email de confirmación a tu cuenta: %{email}"
         alert:
           failure: "Hubo un problema enviándote un email a tu cuenta"
-      form:
-        submit_button: Enviar
     letter:
       new:
         title: Final Verification
@@ -71,3 +67,5 @@ es:
         email_title: Emails
         phone_title: Teléfonos
         use_another_phone: Utilizar otro teléfono
+      form:
+        submit_button: Enviar

spec/features/verification/email_spec.rb

@@ -18,7 +18,7 @@ feature 'Verify email' do
     visit verified_user_path
 
     within("#verified_user_#{verified_user.id}_email") do
-      expect(page).to have_content 'rock@example.com'
+      expect(page).to have_content 'roc*@example.com'
       click_button "Send"
     end
 

spec/features/verification/verified_user_spec.rb

@@ -26,8 +26,8 @@ feature 'Verified users' do
     login_as(user)
     visit verified_user_path
 
-    expect(page).to have_content 'rock@example.com'
+    expect(page).to have_content 'roc*@example.com'
-    expect(page).to have_content 'roll@example.com'
+    expect(page).to have_content 'rol*@example.com'
   end
 
   scenario "Verified phones" do
@@ -44,18 +44,18 @@ feature 'Verified users' do
     create(:verified_user,
             document_number: '12345678Z',
             document_type:   '2',
-            email:           '622222222')
+            phone:           '622222222')
 
     create(:verified_user,
             document_number: '99999999R',
             document_type:   '2',
-            email:           '633333333')
+            phone:           '633333333')
 
     login_as(user)
     visit verified_user_path
 
-    expect(page).to have_content '611111111'
+    expect(page).to have_content '******111'
-    expect(page).to have_content '622222222'
+    expect(page).to have_content '******222'
   end
 
   scenario "Select a verified email" do

spec/helpers/verification_helper_spec.rb

@@ -0,0 +1,24 @@
+require 'rails_helper'
+
+describe VerificationHelper do
+
+  describe "#mask_phone" do
+    it "should mask a phone" do
+      expect(mask_phone "612345678").to eq("******678")
+    end
+  end
+
+  describe "#mask_email" do
+    it "should mask a long email address" do
+      expect(mask_email "isabel@example.com").to eq("isa***@example.com")
+      expect(mask_email "antonio.perez@example.com").to eq("ant**********@example.com")
+    end
+
+    it "should mask a short email address" do
+      expect(mask_email "an@example.com").to eq("an@example.com")
+      expect(mask_email "ana@example.com").to eq("ana@example.com")
+      expect(mask_email "aina@example.com").to eq("ain*@example.com")
+    end
+  end
+
+end