New user on CAS gets stuck during first login

[orenyk]

Discovered during #1272, we have some strong params issues to resolve due to our interdependence on CanCanCan. The details are in that thread, the most recent point is below:

okay, so I think the issue is that :username isn't being added to the permitted params because the default user can't manage reservations (line 232 of users_controller: permitted_attributes << :username if can? :manage, Reservation)

I also can't accept the TOS because the checkbox is disabled if you can't manage reservations.

Note that I'm making this high priority and sticking it in v5.3.1 - this is because all of our clients use CAS so we need to get a working version for them ASAP for user testing.

[orenyk]

Ok, now to address the comment - the issue here is only the :username strong params filtering. Users don't get to accept the Terms of Service during user creation, that only happens during the checkout of their first reservation.

I'm confused about the permissions issue since the default user should be a superuser and therefore should have full access according to CanCanCan (and therefore can? :manage, Reservation should return true). Is the user not logged in yet (so current_user returns nil)? I feel like we have two separate cases that need to be debugged here:

1. Can a newly-minted superuser log in for the first time using CAS?
2. Can a patron create a new account and log in using CAS?

The latter case will likely require you to use the Rails console to delete your user account in the database and manually try to re-create it; you can then modify your role in the Rails console if necessary as well. Let me know how that sounds!

[esoterik]

1. No -- you get stuck on the "New User" page, trying to enter information for a user that already exists as created by the seed script. (@user.save fails because the username is the same as the one that is entered in the seed script)
2. Yes. Tested by making the superuser netid not my netid.

[orenyk]

Ok, so it's not a strong params issue. It is, however, very weird, it shouldn't be redirecting you to the "New User" page since the user already exists. Can you see what the chain of redirects is when you log in?

[esoterik]

[orenyk]

We need a better idea of what's happening in that second redirect - wanna throw some binding.pry's in the CAS login code (it should mostly or all be in ApplicationController) and see what's going on?

[orenyk]

You might have to read some of my comments from #2 to trace the Devise login stuff...