0
@@ -21,10 +21,10 @@ class XmlRpcService < ActionWebService::Base
0
       # Coping with backwards incompatibility change in AWS releases post 0.6.2
0
       begin
0
         h = method.expects_to_hash(args)
0
-        raise "Invalid login" unless @user = User.authenticate(h[:username], h[:password])
0
+        raise "Invalid login" unless @user = User.authenticate_for(controller.site, h[:username], h[:password])
0
       rescue NoMethodError
0
         username, password = method[:expects].index(:username=>String), method[:expects].index(:password=>String)
0
-        raise "Invalid login" unless @user = User.authenticate(args[username], args[password])
0
+        raise "Invalid login" unless @user = User.authenticate_for(controller.site, args[username], args[password])
0
       end
0
     end
0
 end
0
\ No newline at end of file

0
@@ -9,7 +9,7 @@ class AccountController < ApplicationController
0
 
0
   def login
0
     return unless request.post?
0
-    self.current_user = User.authenticate(params[:login], params[:password])
0
+    self.current_user = User.authenticate_for(site, params[:login], params[:password])
0
     if logged_in?
0
       if params[:remember_me] == "1"
0
         self.current_user.remember_me

0
@@ -19,8 +19,9 @@ class UserAuth < ActiveRecord::Base
0
   # before_create :make_activation_code
0
 
0
   # Authenticates a user by their login name and unencrypted password.  Returns the user or nil.
0
-  def self.authenticate(login, password)
0
-    u = find_by_login(login) # need to get the salt
0
+  def self.authenticate_for(site, login, password)
0
+    u = find(:first, :select => 'users.*', :joins => 'left outer join memberships on users.id = memberships.user_id',
0
+      :conditions => ['users.login = ? and (memberships.site_id = ? or users.admin = ?)', login, site.id, true])
0
     u && u.authenticated?(password) ? u : nil
0
   end
0
 

0
@@ -19,7 +19,7 @@ module AuthenticatedSystem
0
     
0
     def login_required
0
       username, passwd = get_auth_data
0
-      self.current_user ||= User.authenticate(username, passwd) || :false if username && passwd
0
+      self.current_user ||= User.authenticate_for(site, username, passwd) || :false if username && passwd
0
       logged_in? && authorized? ? true : access_denied
0
     end
0
 
0
@@ -47,7 +47,7 @@ module AuthenticatedSystem
0
     end
0
     
0
     def basic_auth_required
0
-      unless session[:user] = User.authenticate(*get_auth_data) 
0
+      unless session[:user] = User.authenticate_for(*get_auth_data.unshift(site)) 
0
         access_denied_with_basic_auth
0
       end 
0
     end

0
@@ -5,7 +5,7 @@ require_dependency 'account_controller'
0
 class AccountController; def rescue_action(e) raise e end; end
0
 
0
 class AccountControllerTest < Test::Unit::TestCase
0
-  fixtures :users, :sites
0
+  fixtures :users, :sites, :memberships
0
 
0
   def setup
0
     @controller = AccountController.new

0
@@ -5,7 +5,7 @@ require 'admin/articles_controller'
0
 class Admin::ArticlesController; def rescue_action(e) raise e end; end
0
 
0
 class Admin::ArticlesControllerTest < Test::Unit::TestCase
0
-  fixtures :contents, :content_versions, :sections, :assigned_sections, :users, :sites, :tags, :taggings
0
+  fixtures :contents, :content_versions, :sections, :assigned_sections, :users, :sites, :tags, :taggings, :memberships
0
 
0
   def setup
0
     @controller = Admin::ArticlesController.new

0
@@ -5,7 +5,7 @@ require 'admin/assets_controller'
0
 class Admin::AssetsController; def rescue_action(e) raise e end; end
0
 
0
 class Admin::AssetsControllerTest < Test::Unit::TestCase
0
-  fixtures :sites, :assets, :users, :tags, :taggings, :contents
0
+  fixtures :sites, :assets, :users, :tags, :taggings, :contents, :memberships
0
 
0
   def setup
0
     @controller = Admin::AssetsController.new

0
@@ -5,7 +5,7 @@ require 'admin/design_controller'
0
 class Admin::DesignController; def rescue_action(e) raise e end; end
0
 
0
 class Admin::DesignControllerTest < Test::Unit::TestCase
0
-  fixtures :users, :sections, :sites
0
+  fixtures :users, :sections, :sites, :memberships
0
 
0
   def setup
0
     prepare_theme_fixtures

0
@@ -5,7 +5,7 @@ require 'admin/overview_controller'
0
 class Admin::OverviewController; def rescue_action(e) raise e end; end
0
 
0
 class Admin::OverviewControllerTest < Test::Unit::TestCase
0
-  fixtures :users, :contents, :events, :sites
0
+  fixtures :users, :contents, :events, :sites, :memberships
0
   def setup
0
     @controller = Admin::OverviewController.new
0
     @request    = ActionController::TestRequest.new

0
@@ -5,7 +5,7 @@ require 'admin/resources_controller'
0
 class Admin::ResourcesController; def rescue_action(e) raise e end; end
0
 
0
 class Admin::ResourcesControllerTest < Test::Unit::TestCase
0
-  fixtures :users, :sites
0
+  fixtures :users, :sites, :memberships
0
   def setup
0
     prepare_theme_fixtures
0
     @controller = Admin::ResourcesController.new

0
@@ -5,7 +5,7 @@ require 'admin/sections_controller'
0
 class Admin::SectionsController; def rescue_action(e) raise e end; end
0
 
0
 class Admin::SectionsControllerTest < Test::Unit::TestCase
0
-  fixtures :sections, :users, :contents, :assigned_sections, :sites
0
+  fixtures :sections, :users, :contents, :assigned_sections, :sites, :memberships
0
 
0
   def setup
0
     @controller = Admin::SectionsController.new

0
@@ -5,7 +5,7 @@ require 'admin/settings_controller'
0
 class Admin::SettingsController; def rescue_action(e) raise e end; end
0
 
0
 class Admin::SettingsControllerTest < Test::Unit::TestCase
0
-  fixtures :sites, :users
0
+  fixtures :sites, :users, :memberships
0
   def setup
0
     @controller = Admin::SettingsController.new
0
     @request    = ActionController::TestRequest.new

0
@@ -5,7 +5,7 @@ require 'admin/templates_controller'
0
 class Admin::TemplatesController; def rescue_action(e) raise e end; end
0
 
0
 class Admin::TemplatesControllerTest < Test::Unit::TestCase
0
-  fixtures :users, :sections, :sites
0
+  fixtures :users, :sections, :sites, :memberships
0
 
0
   def setup
0
     prepare_theme_fixtures

0
@@ -5,7 +5,7 @@ require 'admin/users_controller'
0
 class Admin::UsersController; def rescue_action(e) raise e end; end
0
 
0
 class Admin::UsersControllerTest < Test::Unit::TestCase
0
-  fixtures :users, :sites
0
+  fixtures :users, :sites, :memberships
0
   def setup
0
     @controller = Admin::UsersController.new
0
     @request    = ActionController::TestRequest.new
0
@@ -20,8 +20,8 @@ class Admin::UsersControllerTest < Test::Unit::TestCase
0
 
0
   def test_should_create_user
0
     assert_difference User, :count do
0
-      post :create, :user => { :login => 'bob', :email => 'foo', :password => 'testy', :password_confirmation => 'testy' }
0
-      assert_equal assigns(:user), User.authenticate('bob', 'testy')
0
+      post :create, :user => { :login => 'bob', :email => 'foo', :password => 'testy', :password_confirmation => 'testy', :admin => true }
0
+      assert_equal assigns(:user), User.authenticate_for(sites(:first), 'bob', 'testy')
0
       assert_redirected_to :action => 'index'
0
       assert flash[:notice]
0
     end
0
@@ -31,7 +31,7 @@ class Admin::UsersControllerTest < Test::Unit::TestCase
0
     post :update, :id => users(:quentin).id, :user => { :email => 'foo', :password => 'testy', :password_confirmation => 'testy' }
0
     users(:quentin).reload
0
     assert_equal 'foo', users(:quentin).email
0
-    assert_equal users(:quentin), User.authenticate('quentin', 'testy')
0
+    assert_equal users(:quentin), User.authenticate_for(sites(:first), 'quentin', 'testy')
0
     assert_response :success
0
   end
0
 
0
@@ -39,7 +39,7 @@ class Admin::UsersControllerTest < Test::Unit::TestCase
0
     post :update, :id => users(:quentin).id, :user => { :email => 'foo', :password => '', :password_confirmation => '' }
0
     users(:quentin).reload
0
     assert_equal 'foo', users(:quentin).email
0
-    assert_equal users(:quentin), User.authenticate('quentin', 'quentin')
0
+    assert_equal users(:quentin), User.authenticate_for(sites(:first), 'quentin', 'quentin')
0
     assert_response :success
0
   end
0
 
0
@@ -47,7 +47,7 @@ class Admin::UsersControllerTest < Test::Unit::TestCase
0
     post :update, :id => users(:quentin).id, :user => { :email => 'foo', :password => 'tea', :password_confirmation => '' }
0
     users(:quentin).reload
0
     assert_equal 'quentin@example.com', users(:quentin).email
0
-    assert_equal users(:quentin), User.authenticate('quentin', 'quentin')
0
+    assert_equal users(:quentin), User.authenticate_for(sites(:first), 'quentin', 'quentin')
0
     assert_response :success
0
   end
0
 

0
@@ -1,7 +1,7 @@
0
 require File.dirname(__FILE__) + '/../test_helper'
0
 
0
 class UserTest < Test::Unit::TestCase
0
-  fixtures :users
0
+  fixtures :users, :sites, :memberships
0
 
0
   def test_should_create_user
0
     assert create_user.valid?
0
@@ -29,16 +29,27 @@ class UserTest < Test::Unit::TestCase
0
 
0
   def test_should_reset_password
0
     users(:quentin).update_attributes(:password => 'new password', :password_confirmation => 'new password')
0
-    assert_equal users(:quentin), User.authenticate('quentin', 'new password')
0
+    assert_equal users(:quentin), User.authenticate_for(sites(:first), 'quentin', 'new password')
0
   end
0
 
0
   def test_should_not_rehash_password
0
     users(:quentin).update_attribute(:login, 'quentin2')
0
-    assert_equal users(:quentin), User.authenticate('quentin2', 'quentin')
0
+    assert_equal users(:quentin), User.authenticate_for(sites(:first), 'quentin2', 'quentin')
0
   end
0
 
0
-  def test_should_authenticate_user
0
-    assert_equal users(:quentin), User.authenticate('quentin', 'quentin')
0
+  def test_should_authenticate_user_admin
0
+    [:first, :hostess, :garden].each do |s|
0
+      assert_equal users(:quentin), User.authenticate_for(sites(s), 'quentin', 'quentin'), "Unable to login to site: #{s}"
0
+    end
0
+  end
0
+
0
+  def test_should_authenticate_member
0
+    assert_equal users(:arthur), User.authenticate_for(sites(:first), 'arthur', 'arthur')
0
+    assert_equal users(:arthur), User.authenticate_for(sites(:hostess), 'arthur', 'arthur')
0
+  end
0
+  
0
+  def test_should_not_authenticate_expired
0
+    assert_nil User.authenticate_for(sites(:first), 'aaron', 'aaron')
0
   end
0
 
0
   def test_should_allow_empty_filter