Ruby on Rails 3 - Installing Devise authentication on Heroku

A few days ago I decided to add authentication to my Rails 3 app. I came across a few alternatives but in the end opted for Devise as this seems to be the newest and from the documents I found apparently the easiest to implement.
I needed users to be able to register new users, sign in and out and to have special admin users who could access restricted areas of the site, Devise hit all these requirements.

So I found a couple of good tutorials including https://github.com/plataformatec/devise and associated wiki https://github.com/plataformatec/devise/wiki/_pages and found these really good at getting me up and going quickly.

I got everything working locally but then when I pushed my git repo to Heroku I got the error when using the register page: We're sorry, but something went wrong. We've been notified about this issue and we'll take a look at it shortly.


so to the command line 'Heroku logs' revealed this error:
2011-03-21T14:03:09-07:00 app[web.1]: NameError (uninitialized constant Devise::Encryptors::Bcrypt):

It took me a while but after searching around any trying all sorts of things i hit the answer. and as usual it was simple, if you are deploying to heroku you need to add bcrypt-ruby to your gemfile like so:

gem 'devise', '1.1.8'
gem 'bcrypt-ruby', '2.1.4'

Also remember to generate and commit your new gemfile.lock into git and send this to heroku as well as the new gemfile or you will get the following error, as i did:

You have modified your Gemfile in development but did not check
the resulting snapshot (Gemfile.lock) into version control
You have added to the Gemfile:
* bcrypt-ruby (= 2.1.4)
FAILED: http://docs.heroku.com/bundler
Heroku push rejected, failed to install gems via Bundler

My Devise Authentication Implementation
I've added the following to the top of all my admin controller classes to ensure that only administrators can access them

before_filter :authenticate_user!
before_filter :authorise_user!

The method :authenticate_user! is a helper method built into Devise
The method :authorise_user! is my own declared in ApplicationController as follows:

def authorise_user!
  if ! current_user.try(:admin?)
    flash[:alert] = "Unauthorised"
    redirect_to ''
  end
end

where admin is a boolean field on the devise created user table. (I used option 2 from this wiki page)

For controllers which none admin users have access to I want to restrict them so that they can only see resources that they created. So for example, bob created an order-x, you don't want James to be able to access that order-x it belongs to bob not James.

For this I've created methods similar to:

def authorise_as_owner!
  order = Order.find(params[:id])
  unless current_user.try(:admin?) || order.user_id == current_user.id
    flash[:alert]  = "Not your order!"
    redirect_to ''
  end
end

The DZone effect (how blog aggregation can affect traffic)

I recently used DZone for the first time to publicise my latest blog post to a wider audience. Oh my ... it worked rather well.

So im on blogspot which gives some nice google analytics for free which i look at now and then to try and see what is popular and being read by other people.

My blog is not all that widely read to be honest, it has a fair number of hits though, approximately 250 a month mainly coming from google searches, most traffic goes to a couple of my better/more interesting posts. But then i tried out submitting a post to dzone, mainly to see what happens.

The result was instant, i got over 600 views in 2 days, for me thats a big number, was it the nature of the post (it was a little provocative) and maybe the summary on dzone made people want to see what i was on about, either way i got a large increase in my traffic %300 :-)

Im not really hung up on loads of people seeing my posts, but its nice to know your are read :-) And dzone certainly seems to deliver.

Appharbor, scripting sql server table creation using ado.net

So ive got a simple appharbor installation running, but need a database.
I was half expecting a nice API I could use similar to herokus that would let me run my scripts against the hosted DB and thus deploy my DB at the command line, but not.

What you need to do is connect to your DB through SQL server management studio (if using sql server) and do your DB work through that. All good and easy, but at work our corporate firewalls prevent us from getting out, or from external sources getting in, makes sense, and i as a lowly developer will never be able to change that, not that i would want to, it would be quite dangerous.

So what to do?
well i decided to write a page in my MVC app that (given the right credentials) will run a script that has been checked in, Here are the basics:

• Create a DB on appharbor (use the web interface to create it, really simple)
• Copy the connection settings and paste them into your web.config, here are mine (details changed to protect the innocent)


<connectionstrings>
    <add connectionstring="Server=db002.appharbor.net;Database=db1234;User ID=db1234;Password=lotsofrandomcharacters" name="mydb"></add>
</connectionstrings>



• now we need a controller with an action

public ActionResult RunTheScript(string filename)
{
    try
    {
        string connStr = ConfigurationManager.ConnectionStrings["mydb"].ToString();
        using (var conn = new SqlConnection(connStr))
        {
            conn.Open();
            string filePath = Server.MapPath("\\databasescripts\\" + filename);
            FileInfo fileInfo = new FileInfo(filePath);

            string script = fileInfo.OpenText().ReadToEnd();

            SqlCommand cmd = new SqlCommand(script, conn);
            cmd.ExecuteNonQuery();
            conn.Close();
        }

        return View();
    }
    catch (Exception e)
    {
        return View("ExceptionView", e);
    }
}

• Dont forget your routes in global.asax, Add the following before the default route.


routes.MapRoute(
    "admin_runthescript",
    "admin/runthescript/{filename}",
    new { controller = "admin", action = "runthescript" } // Parameter defaults
);


And add a couple of views (your know how to do that), one for success and one for an exception.
Yes there are better ways of doing this but its a quick and dirty demo, i expect people to use properly designed code when doing this live (Please dont mix your DB logic into your controllers people...)

A note on the exception handling, you had better do this properly too as appharbor will not give you any logging out of the box, and will not spit back helpful errors to the user, not errors that can be used to debug anyway..

• Almost there, add a script, and save it in your databasescripts folder


CREATE TABLE [dbo].[locations](
    [id] [int] IDENTITY(1,1) NOT NULL,
    [name] [nvarchar](256) NOT NULL
) ON [PRIMARY]

INSERT INTO [dbo].[locations] ([name]) VALUES ('London')
INSERT INTO [dbo].[locations] ([name]) VALUES ('Manchester')
INSERT INTO [dbo].[locations] ([name]) VALUES ('Bristol')
INSERT INTO [dbo].[locations] ([name]) VALUES ('Bath')


• Now add all the files to your git repo
• commit
• git push appharbor master
• Run the migration through your web app using the url Controller/Action/Filename (scripts/runthescript/add_location_table.sql)

Thats pretty much it, its upto you to secure the page that can be used to create and destroy your db,dont blame me if someone gets in an messes with unsecured pages,

Maybe there is something in the pipeline at app harbor that will help us out when scripting databases, but one thing is for sure using the management studio for building your applications database is not the way forward in the long run.

The true cost of TFS, is it really "free"?

You say you've got MSDN premium, so TFS is free, good for you, it is developed and supported by Microsoft, should be a great product then??

Anyway in my personal opinion, it sucks, but try telling that to none technical people, its actually really hard, and they still insist you use it because its designed for enterprise use, isn't it?

So i thought id do a 'back of the napkin' calculation of how much it actually costs.

Our dev team is apparently worth ~40k a month, consisting of 4 devs, designer, tester, db admin, tester, ba,
10 people, for arguments sake ~4 grand each per month.
So if you take a dev pair thats 8 grand a month, or 2 grand a week.

Where is the waste (source control)?
Check-ins :- We check in 7 to 10 times a day, each time it should be instant, but mostly TFS cant quite manage it, it needs user interaction to resolve the easiest of changes, some times it cant even manage to insert new lines. So estimate 3 minutes extra per check-in thats 20 minutes a day extra, or 2 hours per week. (Caveat, if you are working in the same area of code as another pair be prepared for this to at least double, ive had some awful merges in the past even when the conflicts weren't really that hard)

Get latest :- Sometimes get latest doesn't even get the latest, leaving files out or just getting it wrong?? how?? so now and then we need to sort it out, usually after wondering what on earth is going on and trying to debug your code only to find out my source is not up to date (10 - 20 mins per day on average, 1 hr per week)

Get specific :- So, often you start using get specific instead of get latest, this is slow so we try not to do it all the time, only when we think there might be a problem, the code base is big so this takes a lot longer than a get latest 2-3 minutes extra per check in, but only done 2-3 times a day (7 minutes per day, 30 mins per week)

Merge to main (feature branching) :-
Depending on how often you merge to main, and how many other teams you have also checking into main that is going to hit you quite hard. if you are a lone team with out any teams changing your code base you have it easy and can discount this step. for me its at least a 4 hour job of doing the merge to main once every month)

Where is the waste (Build management)?
MSBuild and TFS :- This is complex, significantly more complex than the same projects built with nant and cruse control, Team city, Go, et al. it sucks a lot of our time when we need to change the builds, its hard to say how much worse it is, our code base is quite old and complex, lots of build dependencies, this needs fixing, lets be conservative and say it only takes 1 hour extra per week to maintain TFS over any of the others.

Total Waste
2 hrs + 1hr + .5 hrs + 1hr = 5.5 hours of waste a week, lets call it 5 for now, I like round numbers.

So a pair of devs is on 2 grand a week, 35 hours = £60 per hour
5 hours waste = £60 * 5 = £300 per week per pair
2 pairs in our team = £600 per week * 4 = £2,400 per month on a £40,000 dev team

Thats just a 2 pair team, if you have even a moderate size team of 4 pairs you are going to get even more pain, with developers effecting each others check ins.

Oh and what about that merge to main hell we discussed (if you are feature branching), add 4 hrs * £60 per month = £240 extra.

Summary :-
your "free" version control and build agent is not looking so "free" any more.
Its costing us at least 25 grand a year... that sounds wrong? can you please check my math...

How much is it costing you?

Disclaimer:-
In my opinion I've been quite lenient in my estimates, but when you say the numbers and add it all up it sounds awful, but it is.
Also the numbers above don't take into account other teams costs, if you have 3 dev teams (like ours) all working on the same source code, merging every month (feature branch style), all having the same pain, the figures quickly become a big drain on the business.

Problems :-
The main problem I have is how to quantify the waste, often its small things here and there, they just add up, not all the time, but especially if the team is doing TDD properly and going through refactor cycles frequently, which we are.
Any ideas on how to quantify the waste better would be appreciated.


Amendments (11-03-2011)
Thanks to my reviewers (kat, skain) for pointing out my grammatical and spelling errors (now corrected). But i did just knock out this article in the gaps i had whilst waiting for TFS, i guess its good for something. Joking apart though this does lead me to something i didnt mention and that is context switching inefficiencies. So every now and then you get 5 minutes to do other tasks, email, ect, but this is a big context switch for the pair, it takes a little time to get back into the flow again, this cost is not accounted for in the above monetary costs.

Heroku - Installing your app and sqlite3

So ive just installed a dummy rails app to Heroku to test it out, its very very similar to appharbor, unsupprising since appharbor was inspired by heroku.

all went well untll i added a scaffold for my first admin page, when i tried to deploy this i got he error:


Application Error
An error occurred in the application and your page could not be served. Please try again in a few moments.
If you are the application owner, check your logs for details.

so i did check the logs 'heroku logs' (you need the logging add-on instaled for your app) and this is what i saw:

2011-03-03T01:24:00-08:00 heroku[web.1]: State changed from crashed to created
2011-03-03T01:24:00-08:00 heroku[web.1]: State changed from created to starting
2011-03-03T01:24:01-08:00 heroku[web.1]: State changed from crashed to created
2011-03-03T01:24:01-08:00 heroku[web.1]: State changed from created to starting
2011-03-03T01:24:08-08:00 app[web.1]: /usr/ruby1.8.7/lib/ruby/gems/1.8/gems/bundler-1.0.7/lib/bundler/runtime.rb:64:in `require': no such file to load
-- sqlite3 (LoadError)
2011-03-03T01:24:08-08:00 app[web.1]: from /usr/ruby1.8.7/lib/ruby/gems/1.8/gems/bundler-1.0.7/lib/bundler/runtime.rb:64:in `require'
2011-03-03T01:24:08-08:00 app[web.1]: from /usr/ruby1.8.7/lib/ruby/gems/1.8/gems/bundler-1.0.7/lib/bundler/runtime.rb:62:in `each'
...
...
2011-03-03T01:24:08-08:00 app[web.1]: from /home/heroku_rack/heroku.ru:1:in `new'
2011-03-03T01:24:08-08:00 app[web.1]: from /home/heroku_rack/heroku.ru:1
2011-03-03T01:24:08-08:00 heroku[web.1]: State changed from starting to crashed

so what went wrong? well looked like it was a problem loading sqlite3
stackoverflow to the rescue :-)

just make sure the references to sqlite3 are wrapped up as per the following line of code in your gemfile

group :development do
   gem 'sqlite3-ruby', :require => 'sqlite3'
end


and that is it, just do a 'heroku rake db:migrate' to get your database on heroku and your should be good to go.

AppHarbor - free .net hosting with continuous integration, Getting started tutorial

Ive been test driving appharbor recently and im very impressed.

Its basically a host for your .net web apps, but with a difference.
First you deploy to appharbor via a git push, as soon as you do this your app is built, your tests are run, and if all goes well (build succeeded and tests passed) your code is deployed to the hosting environment there and then.

Thats all sounds pretty simple, and is very impressive, especially since its free for a single web instance and a 20MB database.

So how do you go about doing it, how do you get a ASP.MVC 3 web app on the interweb in 15 minutes (if that) for free.

1. Create a solution with a single MVC 3 web app in it, im using VS2010 (1 minute)
2. Add a controller and a view, just static content will do (1 minute)
3. Create a git repository in the folder that contains your solution. Just run "git init" (1 minute)
4. Add your web app to the local repository "git add ." but be careful not to include the bin, obj or _resharper folders then Commit changes locally "git commit" (1-2 minutes)
5. Log into appharbor and create a new application (1-2 minutes)
6. Get your remote repository URL from the appharbor administration interface (1 minute)
7. Add remote repository to your git repo: "git remote add appharbor https://UserName@appharbor.com/AppName.git" (1 minute)
8. Push your app to git: "git push appharbor master" (1 minute)
9. Log on to appharbor and navigate to your new app, see the successful build (1-2 minutes)
10. Navigate to the live url and see the site live on the interweb (1-2 minutes)

Superb
I said 15 minutes, you can actually do it in a lot less, but you get my drift.

So what can you do :-)

• Add test projects, your code will only be deployed if all the tests pass, brilliant.
• Roll back to last deployment, very easy to do, if your not happy with the release, just click deploy on a older build and that older build gets redeployed, perfect. 
• You can add your own host name
• Add worker processors (at a cost)
• Have multiple collaborators to the same project and use appharbor as the master repo (a bit like github) its really easy to get get the source on to a different machine, use "git clone https://UserName@appharbor.com/AppName.git"

What cant it do :-(

• Acceptance tests, i use BDD style tests a lot, webdriver, selinium etc. it cant run these, and think about it, it makes sense. If a failing test stops deployment how can you run tests after you have deployed? I guess they need to develop a staging environment similar to Azure which gets deployed to first. I think that is on the pipeline of improvements but not at a high priority.
• No file storage, only what is checked into your repo, you can save things to the file system, but they will get blown away with each deployment. i guess you could use amazon EC2, google or Azure to store your files using their REST APIs but that could be slow for the users, options exist though.
• If/when tests fail you dont get a very good message, only a stack trace, you dont get the expected and actual values, not sure why this is, but its not a show stopper by any means.
• Only one web app per solution is allowed, i guess this is because appharbor uses convention over configuration, and will automatically deploy the one web app there to the hosting environment.

Acceptance Tests, Fluent Interfaces and a DSL

Lately ive been doing quite a lot of acceptance testing. We did give some BDD frameworks a try especially SpecFlow, but were left with a feeling that it was too complex for the benifits that it gave, was too inflexable and in the long run could turn into a bit of a mess. well that was the evaluation of the team, im sure there are good ways of doing it that is valuble but we decided not to go with a framework.

So i came up with a DSL that gives the developer a simple 'Given When Then' syntax that im quite pleased with, it allows for the most readable / maintainable acceptance test ive seen to date.

A small acceptance test follows as an example:

using NUnit.Framework;
using OpenQA.Selenium;
using AcceptanceTests.Domain;

namespace AcceptanceTests.Fixtures
{
    [TestFixture]
    public class TagTests : BaseTestFixture
    {
        [Test]
        public void ThisAndThatShouldDoSomeThings()
        {
            var resultsPage = Page.SiteABC.ResultsPage;
            given.WeAreOnThePage(resultsPage);

            when.I.Click.TheElement(By.LinkText("civil-engineering"));

            then.TheUrlShouldBe(Page.SiteABC.Article("civil-engineering"))
                .And.TheTitleShouldBe("civil-engineering articles in ABC example page");
            then.TheElement(By.ClassName("tag-wrapper")).ContainsTheText("Articles with the Tag:\r\ncivil engineering");

            when.I.Type("london").Into(By.Id("txtLocation"))
                .And.I.Click.TheElement(By.LinkText("search"));

            then ..... (You get the idea)
        }
    }
}

The base class gives the test fixtures access to the Given When Then classes similar to this:

public class BaseTestFixture
{
    protected Given given;
    protected When when;
    protected Then then;

    [TestFixtureSetUp]
    public void SetUp()
    {
        given = new Given();
        when = new When();
        then = new Then();
    }
}

The actual Given When Then classes delegate the actions to webdriver in the following manner:

public class Given
{
    private readonly WebDriver webDriver;

    public Given()
    {
        webDriver = WebDriver.GetCurrent();
    }

    public Given And
    {
        get { return this; }
    }

    public Given WeAreOnThePage(Page page)
    {
        webDriver.Driver.Navigate().GoToUrl(page.Url);
        return this;
    }
}


public class When
{
    private readonly WebDriver webDriver;

    public When()
    {
        this.webDriver = WebDriver.GetCurrent();
    }

    public When And
    {
        get { return this; }
    }

    public When I
    {
        get {return this; }
    }

    public IAction Click
    {
        get { return new Click(this); }
    }

    public TypeText Type(string text)
    {
        return new TypeText(text);
    }
}

By writing the step classes like this we can write the tests in a fluent style, making for very readable. This is important as it enables none technical (business) people to read / understand the tests and have input on the creation of the tests, although i admit it still does not really enable them to write them, as you do need to know c# and visual studio, but in my experience they never write them anyway (especially on the contact im on), its technical people who write the automated acceptance tests.

All in all im quite pleased who the suite of tests is progressing and how the DSL has evolved.

LauncherPro has expired. 403 forbidden. Phone is locked out...

Ive been using LauncherPro for a couple of months now, its a nice homescreen replacement on the android phone, actually i really liked it.

But this morning when i turned my phone on i got the error :-

"This version of LauncherPro has expired. Please goto http://www.launcherpro.com/ to get the latest version."

Then my web browser automatically opened so i could get it but i had a problem, i had no internet connection, no wifi, and no mobile connection.... arg.. Basically my phone was now a brick, well i could receive calls, but there was no way to access anything else as every time i hit the home key it would redirect to the internet...

Then later on in the morning i went into london and got a connection on 3G but then i got a 403 forbidden page.... double arg, whats going on this is so shoddy, so i still cant use my phone.

Only after getting to a PC with a decent internet connection did i managed to find a couple of solutions, the first was to download an app installer onto the pc and do a remote install of the new version of launcherPro, i didnt like this, it sounded too complex and i wanted rid of it not the latest version.

Then i found the following solution
browse to - http://bubiloop.com/download/org.adw.launcher
this should open the market (app store)
then search for launcherPro and finally update or uninstall.

I recommend un-installing, seams like this is a rather shoddy product if it locks out your phone like this. even if the actual software does everything else well i dont think this sort of error is in any way acceptabe in any software ever, locking you out of your device, laptop, PC whatever it is, is just wrong, i appreciate the developers might want to force people to upgrade all the time, but this is just not on, i dont know i just cant warn you folks enough, i woudnt trust this app.

morel of the story, dont use apps from random developers on major bits of your device, the home screen is quite major, if that dont work your stuffed.

Edward Deming and his Red Bead Experiment, in practice.

We had an interesting brown bag lunch meeting the other day about Edward Demings red bead experiment. I've heard and read about it before but never got to participate, it was interesting, thought provoking and fun. Some good discussions afterwards as well.

Edward Deming was a management consultant and statistician. He had a massive impact on the management styles and philosophy of Japanese business in the 50's and 60's. He used the red bead experiment to illustrate the impact that a system, and traditional management approaches, can have on individuals who work within a system, and how traditional management approaches (slogans, the usefulness of targets, annual appraisals and financial rewards) are not always (if ever) that effective at improving quality.

Details on the red bead experiment and how it is performed can be found here http://www.redbead.com/. For our results in the actual experiment read on.

Results
The session was run by a thoughtworks colleague, in a really good way, we had the workers, the management, the QA staff, and lots of fun.

The workers were set targets of 5 defects max per person ( a total of 15 per iteration for the team)
The 3 workers, were split into 2 average and 1 good (what ever that means)

Iteration	1	2	3	4	Developer Totals
Dev1	6	8	5	7	26
Dev2	10	7	5	7	29
Dev3	7	8	10	11	36
Iteration Totals	23	23	20	25	91

After iteration 1 workers were told that their efforts were not good enough, and basically told off by management. This made no difference, and so, after iteration 2 the workers were given incentives and appraisals, if they upped their game they would be given hard cash. This worked and management were encouraged to do more of that, offering bigger rewards for better performance.
But iteration 4 was the worst yet and so managers assumed that the incentives had failed because no one actually achieved them last time.

So what does this actually tell us?
That in a fixed system where the workers have no ability to manage or better themselves or their work, the management effectively can not effect workers performance though traditional carrot and stick management.

How does this relate to Software?
I have found that as software developers we don't get to change the system as a whole very often. Often software is seen as the solution to business problems, when actually changing the system would be a better approach. Just by making the process electronic doesn't always work and often makes things worse or masks the underlying problem. This is just another reason why software projects fail.

The experiment also relates to the software development process. If software engineers work in a rigid system where QA and strict process is seen as putting the quality in. Where the engineers don't have the ability to change their environment (technology, process, physical environment, methodology) then no amount of incentives, slogans, rewards can make the software produced better (less defects, meeting business requirements more effectively, etc.). I have seen this at several clients, and can say that clients who have empowered workers have a big advantage, these companies have better motivated, more professional developers and in the end better software.

Summary
Systems Thinking is a really interesting field at the moment and if you want to read more do a google for Edward Deming, systems thinking and John Sedden.

So even if you are CMM level 5 (i.e your processes are robust and repeatable) you can still have quality issues, The red bead experiment highlights that it is not process that produces quality, nor rewards, targets or incentives, its the system within which workers work that matters and their ability and motivation to help change and adapt the system.

Selenium 2, webdriver for .net c#

Webdriver tests that are fast to write and fast to run are essential for BDD. I was really supprised at how fast your tests can actually run, even the setup is quick IE opens instantly, providing a very quick test code loop.

1. Download selenium 2 from http://code.google.com/p/selenium/downloads/list i got selenium-dotnet-2.0a6.zip for this exmple

2. Add project references to nunit.framework, webdriver.common and webdriver.IE or webdriver.firefox

3. Using NUnit (No tutorial for that here, google it) create a test class that uses webdriver

using System;

using NUnit.Framework;

using OpenQA.Selenium.IE;

namespace AcceptanceTests

{

    [TestFixture]

    public class Class1

    {

        private InternetExplorerDriver _driver;

        [TestFixtureSetUp]

        public void FixtureSetUp()

        {

            _driver = new InternetExplorerDriver();

            _driver.Manage().Timeouts().ImplicitlyWait(new TimeSpan(0, 0, 30));

        }

        [TestFixtureTearDown]

        public void FixtureTearDown()

        {

            if (_driver != null) _driver.Close();

        }

        [Test]

        public void GoogleShouldBeInTheTitleWhenNavigatingToGoogleHomePage()

        {

            //Given

            _driver.Navigate().GoToUrl("http://google.co.uk");

            //When

            //Then

            Assert.AreEqual("Google", _driver.Title);

        }

    }

}

4. Run your tests
5. Done