CLC-3569: Popover - no message if no alerts, should be "no active alerts"
https://jira.ets.berkeley.edu/jira/browse/CLC-3569
Merge pull request #2351 from christianv/CLC-3569

CLC-3569: Popover - no message if no alerts, should be "no active alerts...
started trying to use the reauthorize method as a before filter for act_as.  Still testing
Successfully logging the correct omniauth url, but the
application freezes there and fails to continue.

1. log in as admin
2. go to settings page
3. tail the log files looking for errors:
  tail -f log/*log | egrep -i "omni|error"
4. Try acting as oski (61889)

5. Logs will show the expected cas_url

[ERROR] [CalCentral] cas_url: https://auth-test.berkeley.edu/cas/login?renew=true&service=http%3A%2F%2Flocalhost%3A3000%2Fauth%2Fcas%2Fcallback%3Frenew%3Dtrue%26url%3Dhttp%253A%252F%252Flocalhost%253A3000%252Fsettings

6. But the redirect is never made. The app freezes right there
See previous commit comment.

[ERROR] [CalCentral] cas_url: https://auth-test.berkeley.edu/cas/login?renew=true&service=http%3A%2F%2Flocalhost%3A3000%2Fauth%2Fcas%2Fcallback%3Frenew%3Dtrue%26url%3Dhttp%253A%252F%252Flocalhost%253A3000%252Fsettings

application freezes
added the reauthentication feature flag
removed overrides of the OmniAuth-Cas gem
added the reauthenticate param when acting as
added the check_reauthentication before filter and the need_act_as_reauthentication? method that goes along with it
added delete_all_cookies method and the encode_uri_component method.  use delete_all_cookies whenever reset session is called
Removed the reauthorize method and its before filter
Added the act_as= method to force an act_as when needed
Use delete_all_cookies method whenever reset_session is used
Changed continue_with_login_success to only reasssign the session[:uid] when a user is not already acting_as and reauthenticated
Changed the lookup method to force the act_as on the user when the renew=act_as_UID parameter is received on callback and set the :reauthenticated_act_as cookie to true, continuing login success with the act as uid.
added some to-do notes for this jira 3414
added some to-do note
app/3414.todo.txt

Changed ActAs method in the app/controllers/application_controller.rb
$scope.admin.actAs = function() {
  // chikoon: i'm not sure if i should delete this condition or not
  // I don't understand it's purpose
  //if (!$scope.admin.act_as || !$scope.admin.act_as.uid) {
  //  return;
  //}
  // act_as is now a get enpoint because cas returns a 302
  window.location = '/act_as?act_as=' + $scope.admin.act_as.uid + '&url=/settings'
};

Change method for /act_as route:
is now a get enpoint because cas returns a 302

In app/controllers/application_controller.rb, added some global helper methods.
Perhaps they should be stuck into a module

+  def current_user_uid: returns uid for current_user
+  def acting_as?: returns boolean if user is acting_as
+  def pseudo_user_uid: returns the uid of pseudo_user, if any
+  def delete_reauth_cookies: delete the reauthentication cookies any time we reset the session

Removed all code previously changed in the bootstrap_controller

In the sessions_controller:

Defined the act_as_uid method that is called from different places
+  def act_as_uid(uid=nil)
   1. returns pseudo_user_id when called with no parameters
   2. When called with a uid parameter
     - deletes the pseudo_user if currently acting as somebody else
     - does all the magic with the session[:uid] and session[:original_user_id]
     - makes sever warning logs for Darlene to see in production logs
     - returns bookean on success

Rewrote the SessionController#act_as method.
 1. It checks for the cookies[:reauthenticated_act_as] cookie
    - If it's there, it redirects to the smart success path.
    - If it's not there, it deletes our server-side cookies and redirects us to CAS
      with the act_as parameter.

Created the delete_pseudo_user method that can be called from different places.
  - It contains the same logic that was formerly hardcoded into the continue_login_success method

  +  def delete_pseudo_user
     return redirect_to root_path unless session[:user_id] && session[:original_user_id]
     pseudo_user = Calcentral::PSEUDO_USER_PREFIX + session[:user_id]
     [pseudo_user, session[:user_id]].each do |cache_key|
     ...
     Rails.logger.warn "ACT-AS: User #{session[:original_user_id]} acting as #{session[:user_id]} ends"
     session[:user_id] = session[:original_user_id]
     session[:original_user_id] = nil

Shortened the stop_act_as method, but calling the delete_pseudo_user method
  +  def stop_act_as
  +    delete_pseudo_user
       render :nothing => true, :status => 204
     end

Call delete_reauth_cookies anytime we reset the session
   + def destroy
   - SessionsController#destroy
   - SessionsController#failure

Use SessionsController#reauthorize_act_as_response? to detect when it's necessary to act as for the first time and set the :reauthenticated_act_as cookie

Modified SessionsController#continue_login_success? to act as and set the :reauthenticated_act_as cookie
- If the user has alread reauthenticated, it assigns the session[:uid] just as it did before
- Regular redirect has been verified and so has deep linking

Monkey-patched the omniauth-cas gem to receive a renew parameter with an act_as parameter as well
before doing its 302 redirect.

config/routes.rb
Changed the act_as method from post to get since it needs to do allow the UI to change the window.loction in a non-ajax fashion.  Receiving the resopnse from onmiauth-cas through XHR causes security error.

Added reuthentication feature flag so developers can turn off reauthentication in local development if they want

To-do: make some test and fix the 5 exising tests that fail in ./spec/features/act_as_user_spec.rb