Okay, this ecommerce site has turned out to be quite a mess. Though I
believe it was written in 2008, it has home grown authorization with
unencrypted passwords in the db, among other things, lots of code
scattered all over. It is non-RESTful and has a huge set of routes. I
can't touch most of this, client has a tight budget. I did move to
cookie-based sessions.
But one thing seems wrong: the shopping cart model has a user_id
column. In application_controller.rb there are before_filters
get_user and get_cart:
def get_user
@user = User.find(session[:user_id]) if session[:user_id]
end
def get_cart
@cart = @user.cart unless @user.blank?
@cart = Cart.find_by_id(session[:cart_id]) if @cart.blank? &&
!session[:cart_id].blank?
end
While it is not required that one sign in to make a purchase, if I am
signed in, then get_cart first goes and looks for a cart of mine in
the database. This makes informal testing difficult because it means
I can't discard a cart by deleting the cookie, I can't start over!
A more serious problem with tying a cart to a user is that someone
could add items to a new cart, then log in and find themselves
looking at an old cart they had when last logged in, losing the newer
cart they were using. Maybe the developer wanted to make sure a
user's cart was never lost, but this is a bad side effect.
So am I right in thinking that a cart should not be tied to a user?
Or at least the logic in get_cart should be reversed: look first for
a cart pointed to by the session, then look for one belonging to the user?
Thanks,
Scott
--
SD Ruby mailing list
[email protected]
http://groups.google.com/group/sdruby
