is this bypassing authentication?

[apopescu]

Hi everyone,

I installed this fantastic gem and used it successfully. But i noticed something that a would like to understand better.
The helper method render_report makes an Ajax call to ReportsKit::ReportsController#index. However this does not check if the user that made the request is logged in.
Infact i can make the request to
/reports_kit/reports.json?report_params[key]=my_key_here&properties={"format":"table","ui_filters":{}}
with or without authentication. With context_params we can send also an arbitrary user ID but again, if we provide the right ID we would see that user's data without actually logging in.

How can we check if user is logged in when this Ajax call happens? thanks.

[apopescu]

I came out with this solution:
I create an initializer file reports.rb and put inside it

ReportsKit::BaseController.class_eval do
  # this is a module where i have all methods that checks for authentication
  include AuthenticatedSystem

  # now i can use my login_required method
  before_action :login_required
end

Let me know if there could be a better solution