devise-passwordless 0.3.0 → 0.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 15837103c0aa116898d6b9847813c8ddf11d5e9e42fb3592322521b1107a96b0
-  data.tar.gz: e4d86d9d88ed12151a91490d9360440d9bbf68570f9fc7fc9a49ecadffa17d00
+  metadata.gz: 31848f572c8380345caeadef53ae0ee19ef029f3e7db96b2a30d2d4a3252c1b2
+  data.tar.gz: 30221de571208310dd56224c9abb88a0d3b19c5c00203e93116936648ac4098d
 SHA512:
-  metadata.gz: a834c844bdc0e1cc638140ae5081f7714d24637837c7b5f84b6c14f32819c5e41316b1a29b57ac65f2d8e76781a8ce20a55b51dbb8f30489bdb4af94f131a25b
-  data.tar.gz: 9b5703b2c793916342f9f044ea81ec1a626b0450cab2c0d91f4c56bc811ed7ccfee736db88715bae4d920729b3b56bbafaac781062dbf44b9cb016d73c15e7ce
+  metadata.gz: fdd553ce8ec4ddb9829585548ea28905b3355f1bc31808e7d60827fe7543c04e9287dfd9742fe123f75e2335e67a2421e96fe3aaefc53559b730b1954b358dab
+  data.tar.gz: 92256ff69b1bddcb7c17a0aff804da2a4c0740683d8d392960b9054a6dd51997e04268f1368b49b02b61f80bd12c28a0c437d98958a609ad6a2a619186ee1e01

data/.gitignore

@@ -5,6 +5,7 @@
 /doc/
 /pkg/
 /spec/reports/
+/spec/tmp
 /tmp/
 Gemfile.lock
 

data/Gemfile

@@ -4,3 +4,10 @@ git_source(:github) {|repo_name| "https://github.com/#{repo_name}" }
 
 # Specify your gem's dependencies in devise-passwordless.gemspec
 gemspec
+
+gem "rake", "~> 10.0"
+
+group :test do
+  gem "rspec", "~> 3.0"
+  gem "generator_spec"
+end

data/README.md

@@ -4,8 +4,9 @@ A passwordless a.k.a. "magic link" login strategy for [Devise][]
 
 ## Features
 
-* No database migrations / state needed - links are stateless encrypted tokens thanks to Rails's MessageEncryptor
+* No special database migrations needed - magic links are stateless encrypted tokens
 * Magic links are sent from your app - not a mounted Rails engine - so path and URL helpers work as expected
+* [Supports multiple user (resource) types](#multiple-user-resource-types)
 * All the goodness of Devise!
 
 ## Installation
@@ -36,33 +37,26 @@ See the [customization section](#customization) for details on what gets install
 
 This gem adds a `:magic_link_authenticatable` strategy that can be used in your Devise models for passwordless authentication. This strategy plays well with most other Devise strategies (see [*notes on other Devise strategies*](#notes-on-other-devise-strategies)).
 
-For example, for a User model, you can now do this (other strategies listed are optional and not exhaustive):
+For example, if your Devise model is User, enable the strategy like this:
 
 ```ruby
 # app/models/user.rb
 class User < ApplicationRecord
-  devise :magic_link_authenticatable,
-         :registerable,
-         :rememberable,
-         :validatable,
-         :confirmable
+  devise :magic_link_authenticatable #, :registerable, :rememberable, ...
 end
 ```
 
-Then, you'll need to generate two controllers to modify Devise's default session create logic and to handle processing magic links:
-
-```
-$ rails g devise:passwordless:controller User
-```
-
-Then, set up your Devise routes like so to use these controllers:
+Then, you'll need to set up your Devise routes like so to use the passwordless controllers to modify Devise's default session create logic and to handle processing magic links:
 
 ```ruby
 # config/routes.rb
 Rails.application.routes.draw do
-  devise_for :users, controllers: { sessions: "users/sessions" }
+  devise_for :users,
+    controllers: { sessions: "devise/passwordless/sessions" }
   devise_scope :user do
-    get "/users/magic_links" => "users/magic_links#show"
+    get "/users/magic_link",
+      to: "devise/passwordless/magic_links#show",
+      as: "users_magic_link"
   end
 end
 ```
@@ -86,6 +80,15 @@ And these should be edited to remove password references:
 * `app/views/devise/sessions/new.html.erb`
   * Delete field `:password`
 
+#### Manually sending magic links
+
+You can very easily send a magic link at any point like so:
+
+```ruby
+remember_me = true
+User.send_magic_link(remember_me)
+```
+
 ## Customization
 
 Configuration options are stored in Devise's initializer at `config/initializers/devise.rb`:
@@ -94,7 +97,8 @@ Configuration options are stored in Devise's initializer at `config/initializers
 # ==> Configuration for :magic_link_authenticatable
 
 # Need to use a custom Devise mailer in order to send magic links
-config.mailer = "PasswordlessMailer"
+require "devise/passwordless/mailer"
+config.mailer = "Devise::Passwordless::Mailer"
 
 # Time period after a magic login link is sent out that it will be valid for.
 # config.passwordless_login_within = 20.minutes
@@ -128,6 +132,89 @@ en:
 
 To customize the magic link email body, edit `app/views/devise/mailer/magic_link.html.erb`
 
+### Multiple user (resource) types
+
+Devise supports multiple resource types, so we do too.
+
+For example, if you have a User and Admin model, enable the `:magic_link_authenticatable` strategy for each:
+
+```ruby
+# app/models/user.rb
+class User < ApplicationRecord
+  devise :magic_link_authenticatable # , :registerable, :rememberable, ...
+end
+
+# app/models/admin.rb
+class Admin < ApplicationRecord
+  devise :magic_link_authenticatable # , :registerable, :rememberable, ...
+end
+```
+
+Then just set up your routes like this:
+
+```ruby
+# config/routes.rb
+Rails.application.routes.draw do
+  devise_for :users,
+    controllers: { sessions: "devise/passwordless/sessions" }
+  devise_scope :user do
+    get "/users/magic_link",
+      to: "devise/passwordless/magic_links#show",
+      as: "users_magic_link"
+  end
+  devise_for :admins,
+    controllers: { sessions: "devise/passwordless/sessions" }
+  devise_scope :admin do
+    get "/admins/magic_link",
+      to: "devise/passwordless/magic_links#show",
+      as: "admins_magic_link"
+  end
+end
+```
+
+And that's it!
+
+Messaging can be customized per-resource using [Devise's usual I18n support][devise-i18n]:
+
+```yaml
+en:
+  devise:
+    passwordless:
+      user:
+        not_found_in_database: "Could not find a USER for that email address"
+        magic_link_sent: "A USER login link has been sent to your email address. Please follow the link to log in to your account."
+      admin:
+        not_found_in_database: "Could not find an ADMIN for that email address"
+        magic_link_sent: "An ADMIN login link has been sent to your email address. Please follow the link to log in to your account."
+    failure:
+      user:
+        magic_link_invalid: "Invalid or expired USER login link."
+      admin:
+        magic_link_invalid: "Invalid or expired ADMIN login link."
+    mailer:
+      magic_link:
+        user_subject: "Here's your USER magic login link ✨"
+        admin_subject: "Here's your ADMIN magic login link ✨"
+```
+
+#### Scoped views
+
+If you have multiple Devise models, some that are passwordless and some that aren't, you will probably want to enable [Devise's `scoped_views` setting](https://henrytabima.github.io/rails-setup/docs/devise/configuring-views) so that the models have different signup and login pages (since some models will need password fields and others won't).
+
+If you need to generate fresh Devise views for your models, you can do so like so:
+
+```
+$ rails generate devise:views users
+$ rails generate devise:views admins
+```
+
+Which will generate the whole set of Devise views under these paths:
+
+```
+app/views/users/
+app/views/admins/
+```
+
 ### Notes on other Devise strategies
 
 If using the `:rememberable` strategy for "remember me" functionality, you'll need to add a `remember_token` column to your resource, as by default that strategy assumes you're using a password auth strategy and relies on comparing the password's salt to validate cookies:
@@ -140,8 +227,16 @@ end
 
 If using the `:confirmable` strategy, you may want to override the default Devise behavior of requiring a fresh login after email confirmation (e.g. [this](https://stackoverflow.com/a/39010334/215168) or [this](https://stackoverflow.com/a/25865526/215168) approach). Otherwise, users will have to get a fresh login link after confirming their email, which makes little sense if they just confirmed they own the email address.
 
+## Alternatives
+
+Other Ruby libraries that offer passwordless authentication:
+
+* [passwordless](https://github.com/mikker/passwordless)
+* [magic-link](https://github.com/dvanderbeek/magic-link)
+
 ## License
 
 The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
 
 [Devise]: https://github.com/heartcombo/devise
+[devise-i18n]: https://github.com/heartcombo/devise#i18n

data/devise-passwordless.gemspec

@@ -38,8 +38,4 @@ Gem::Specification.new do |spec|
   spec.required_ruby_version = ">= 2.1.0"
 
   spec.add_dependency "devise"
-
-  spec.add_development_dependency "bundler", "~> 1.17"
-  spec.add_development_dependency "rake", "~> 10.0"
-  spec.add_development_dependency "rspec", "~> 3.0"
 end

data/lib/devise/passwordless/mailer.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Devise::Passwordless
+  class Mailer < Devise::Mailer
+    def magic_link(record, token, remember_me, opts = {})
+      @token = token
+      @remember_me = remember_me
+      devise_mail(record, :magic_link, opts)
+    end
+  end
+end

data/lib/devise/passwordless/version.rb

@@ -1,5 +1,5 @@
 module Devise
   module Passwordless
-    VERSION = "0.3.0"
+    VERSION = "0.6.1"
   end
 end

data/lib/devise/strategies/magic_link_authenticatable.rb

@@ -21,7 +21,7 @@ module Devise
 
       def authenticate!
         begin
-          data = Devise::Passwordless::LoginToken.decode(self.token)
+          data = decode_passwordless_token
         rescue Devise::Passwordless::LoginToken::InvalidOrExpiredTokenError
           fail!(:magic_link_invalid)
           return
@@ -50,6 +50,10 @@ module Devise
 
       private
 
+      def decode_passwordless_token
+        Devise::Passwordless::LoginToken.decode(self.token)
+      end
+
       # Sets the authentication hash and the token from params_auth_hash or http_auth_hash.
       def with_authentication_hash(auth_type, auth_values)
         self.authentication_hash, self.authentication_type = {}, auth_type

data/lib/generators/devise/passwordless/install_generator.rb

@@ -5,7 +5,19 @@ require "yaml"
 module Devise::Passwordless
   module Generators # :nodoc:
     class InstallGenerator < ::Rails::Generators::Base # :nodoc:
-      desc "Creates default install and config files for the Devise passwordless auth strategy"
+      desc "Creates default install and config files for the Devise :magic_link_authenticatable strategy"
+
+      def self.default_generator_root
+        File.dirname(__FILE__)
+      end
+
+      def create_sessions_controller
+        template "sessions_controller.rb.erb", "app/controllers/devise/passwordless/sessions_controller.rb"
+      end
+
+      def create_magic_links_controller
+        template "magic_links_controller.rb.erb", "app/controllers/devise/passwordless/magic_links_controller.rb"
+      end
 
       def update_devise_initializer
         inject_into_file 'config/initializers/devise.rb', before: /^end$/ do <<~'CONFIG'.indent(2)
@@ -13,7 +25,8 @@ module Devise::Passwordless
           # ==> Configuration for :magic_link_authenticatable
 
           # Need to use a custom Devise mailer in order to send magic links
-          config.mailer = "PasswordlessMailer"
+          require "devise/passwordless/mailer"
+          config.mailer = "Devise::Passwordless::Mailer"
 
           # Time period after a magic login link is sent out that it will be valid for.
           # config.passwordless_login_within = 20.minutes
@@ -32,26 +45,13 @@ module Devise::Passwordless
         end
       end
 
-      def add_custom_devise_mailer
-        create_file "app/mailers/passwordless_mailer.rb" do <<~'FILE'
-        class PasswordlessMailer < Devise::Mailer
-          def magic_link(record, token, remember_me, opts = {})
-            @token = token
-            @remember_me = remember_me
-            devise_mail(record, :magic_link, opts)
-          end
-        end
-        FILE
-        end
-      end
-
       def add_mailer_view
         create_file "app/views/devise/mailer/magic_link.html.erb" do <<~'FILE'
           <p>Hello <%= @resource.email %>!</p>
 
           <p>You can login using the link below:</p>
           
-          <p><%= link_to "Log in to my account", send("#{@scope_name.to_s.pluralize}_magic_links_url", Hash[@scope_name, {email: @resource.email, token: @token, remember_me: @remember_me}]) %></p>
+          <p><%= link_to "Log in to my account", send("#{@scope_name.to_s.pluralize}_magic_link_url", Hash[@scope_name, {email: @resource.email, token: @token, remember_me: @remember_me}]) %></p>
           
           <p>Note that the link will expire in <%= Devise.passwordless_login_within.inspect %>.</p>          
         FILE
@@ -60,10 +60,13 @@ module Devise::Passwordless
 
       def update_devise_yaml
         devise_yaml = "config/locales/devise.en.yml"
+        existing_config = {}
         begin
-          config = YAML.load_file(devise_yaml)
+          in_root do
+            existing_config = YAML.load_file(devise_yaml)
+          end
         rescue Errno::ENOENT
-          STDERR.puts "Couldn't find #{devise_yaml} - skipping patch"
+          say_status :skip, devise_yaml, :yellow
           return
         end
         default_config = {
@@ -84,9 +87,16 @@ module Devise::Passwordless
             }
           }
         }
-        merged_config = config.deep_merge(default_config.deep_stringify_keys)
-        File.open(devise_yaml, "w") do |f|
-          f.write(force_double_quote_yaml(merged_config.to_yaml))
+        merged_config = existing_config.deep_merge(default_config.deep_stringify_keys)
+        if existing_config.to_yaml == merged_config.to_yaml
+          say_status :identical, devise_yaml, :blue
+        else
+          in_root do
+            File.open(devise_yaml, "w") do |f|
+              f.write(force_double_quote_yaml(merged_config.to_yaml))
+            end
+          end
+          say_status :insert, devise_yaml, :green
         end
       end
 

data/lib/generators/devise/passwordless/templates/magic_links_controller.rb.erb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 <% module_namespacing do -%>
-class <%= class_name.pluralize %>::MagicLinksController < DeviseController
+class Devise::Passwordless::MagicLinksController < DeviseController
   prepend_before_action :require_no_authentication, only: :show
   prepend_before_action :allow_params_authentication!, only: :show
   prepend_before_action(only: [:show]) { request.env["devise.skip_timeout"] = true }
@@ -17,7 +17,8 @@ class <%= class_name.pluralize %>::MagicLinksController < DeviseController
   protected
 
   def auth_options
-    { scope: resource_name, recall: "#{resource_name.to_s.pluralize}/sessions#new" }
+    mapping = Devise.mappings[resource_name]
+    { scope: resource_name, recall: "#{mapping.controllers[:sessions]}#new" }
   end
 
   def translation_scope

data/lib/generators/devise/passwordless/templates/sessions_controller.rb.erb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 <% module_namespacing do -%>
-class <%= class_name.pluralize %>::SessionsController < Devise::SessionsController
+class Devise::Passwordless::SessionsController < Devise::SessionsController
   def create
     self.resource = resource_class.find_by(email: create_params[:email])
     if self.resource

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise-passwordless
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.6.1
 platform: ruby
 authors:
 - Abe Voelker
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-11-12 00:00:00.000000000 Z
+date: 2021-08-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: devise
@@ -24,48 +24,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: bundler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.17'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.17'
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '10.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '10.0'
-- !ruby/object:Gem::Dependency
-  name: rspec
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.0'
 description: 
 email:
 - _@abevoelker.com
@@ -86,9 +44,9 @@ files:
 - lib/devise/models/magic_link_authenticatable.rb
 - lib/devise/passwordless.rb
 - lib/devise/passwordless/login_token.rb
+- lib/devise/passwordless/mailer.rb
 - lib/devise/passwordless/version.rb
 - lib/devise/strategies/magic_link_authenticatable.rb
-- lib/generators/devise/passwordless/controller_generator.rb
 - lib/generators/devise/passwordless/install_generator.rb
 - lib/generators/devise/passwordless/templates/magic_links_controller.rb.erb
 - lib/generators/devise/passwordless/templates/sessions_controller.rb.erb
@@ -113,7 +71,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
 summary: Passwordless (email-only) login strategy for Devise

data/lib/generators/devise/passwordless/controller_generator.rb

@@ -1,21 +0,0 @@
-require "rails/generators/named_base"
-
-module Devise::Passwordless
-  module Generators # :nodoc:
-    class ControllerGenerator < ::Rails::Generators::NamedBase # :nodoc:
-      desc "Creates the session and magic link controllers needed for a Devise resource to use passwordless auth"
-
-      def self.default_generator_root
-        File.dirname(__FILE__)
-      end
-
-      def create_sessions_controller
-        template "sessions_controller.rb.erb", File.join("app/controllers", class_path, plural_name, "sessions_controller.rb")
-      end
-
-      def create_magic_links_controller
-        template "magic_links_controller.rb.erb", File.join("app/controllers", class_path, plural_name, "magic_links_controller.rb")
-      end
-    end
-  end
-end