devise 1.0.10 → 1.1.0

data/app/controllers/{registrations_controller.rb → devise/registrations_controller.rb}

@@ -1,15 +1,15 @@
-class RegistrationsController < ApplicationController
+class Devise::RegistrationsController < ApplicationController
   prepend_before_filter :require_no_authentication, :only => [ :new, :create ]
   prepend_before_filter :authenticate_scope!, :only => [:edit, :update, :destroy]
   include Devise::Controllers::InternalHelpers
 
   # GET /resource/sign_up
   def new
-    build_resource
+    build_resource({})
     render_with_scope :new
   end
 
-  # POST /resource
+  # POST /resource/sign_up
   def create
     build_resource
 
@@ -17,6 +17,7 @@ class RegistrationsController < ApplicationController
       set_flash_message :notice, :signed_up
       sign_in_and_redirect(resource_name, resource)
     else
+      clean_up_passwords(resource)
       render_with_scope :new
     end
   end
@@ -28,26 +29,29 @@ class RegistrationsController < ApplicationController
 
   # PUT /resource
   def update
-    if self.resource.update_with_password(params[resource_name])
+    if resource.update_with_password(params[resource_name])
       set_flash_message :notice, :updated
-      redirect_to after_sign_in_path_for(self.resource)
+      redirect_to after_update_path_for(resource)
     else
+      clean_up_passwords(resource)
       render_with_scope :edit
     end
   end
 
   # DELETE /resource
   def destroy
-    self.resource.destroy
+    resource.destroy
     set_flash_message :notice, :destroyed
     sign_out_and_redirect(self.resource)
   end
 
   protected
 
-    # Authenticates the current scope and dup the resource
+    # Authenticates the current scope and gets a copy of the current resource.
+    # We need to use a copy because we don't want actions like update changing
+    # the current user in place.
     def authenticate_scope!
       send(:"authenticate_#{resource_name}!")
-      self.resource = send(:"current_#{resource_name}").dup
+      self.resource = resource_class.find(send(:"current_#{resource_name}").id)
     end
 end

data/app/controllers/devise/sessions_controller.rb

@@ -0,0 +1,23 @@
+class Devise::SessionsController < ApplicationController
+  prepend_before_filter :require_no_authentication, :only => [ :new, :create ]
+  include Devise::Controllers::InternalHelpers
+
+  # GET /resource/sign_in
+  def new
+    clean_up_passwords(build_resource)
+    render_with_scope :new
+  end
+
+  # POST /resource/sign_in
+  def create
+    resource = warden.authenticate!(:scope => resource_name, :recall => "new")
+    set_flash_message :notice, :signed_in
+    sign_in_and_redirect(resource_name, resource)
+  end
+
+  # GET /resource/sign_out
+  def destroy
+    set_flash_message :notice, :signed_out if signed_in?(resource_name)
+    sign_out_and_redirect(resource_name)
+  end
+end

data/app/controllers/{unlocks_controller.rb → devise/unlocks_controller.rb}

@@ -1,5 +1,4 @@
-class UnlocksController < ApplicationController
-  prepend_before_filter :ensure_email_as_unlock_strategy
+class Devise::UnlocksController < ApplicationController
   prepend_before_filter :require_no_authentication
   include Devise::Controllers::InternalHelpers
 
@@ -32,10 +31,4 @@ class UnlocksController < ApplicationController
       render_with_scope :new
     end
   end
-
-  protected
-
-  def ensure_email_as_unlock_strategy
-    raise ActionController::UnknownAction unless resource_class.unlock_strategy_enabled?(:email)
-  end
 end

data/app/helpers/devise_helper.rb

@@ -0,0 +1,17 @@
+module DeviseHelper
+  def devise_error_messages!
+    return "" if resource.errors.empty?
+
+    messages = resource.errors.full_messages.map { |msg| content_tag(:li, msg) }.join
+    sentence = "#{pluralize(resource.errors.count, "error")} prohibited this #{resource_name} from being saved:"
+
+    html = <<-HTML
+    <div id="error_explanation">
+      <h2>#{sentence}</h2>
+      <ul>#{messages}</ul>
+    </div>
+    HTML
+
+    html.html_safe
+  end
+end

data/app/mailers/devise/mailer.rb

@@ -0,0 +1,71 @@
+class Devise::Mailer < ::ActionMailer::Base
+  include Devise::Controllers::ScopedViews
+  attr_reader :devise_mapping, :resource
+
+  def confirmation_instructions(record)
+    setup_mail(record, :confirmation_instructions)
+  end
+
+  def reset_password_instructions(record)
+    setup_mail(record, :reset_password_instructions)
+  end
+
+  def unlock_instructions(record)
+    setup_mail(record, :unlock_instructions)
+  end
+
+  private
+
+  # Configure default email options
+  def setup_mail(record, action)
+    @scope_name     = Devise::Mapping.find_scope!(record)
+    @devise_mapping = Devise.mappings[@scope_name]
+    @resource       = instance_variable_set("@#{@devise_mapping.name}", record)
+
+    headers = {
+      :subject => translate(@devise_mapping, action),
+      :from => mailer_sender(@devise_mapping),
+      :to => record.email,
+      :template_path => template_paths
+    }
+
+    headers.merge!(record.headers_for(action)) if record.respond_to?(:headers_for)
+    mail(headers)
+  end
+
+  def mailer_sender(mapping)
+    if Devise.mailer_sender.is_a?(Proc)
+      Devise.mailer_sender.call(mapping.name)
+    else
+      Devise.mailer_sender
+    end
+  end
+
+  def template_paths
+    template_path = [self.class.mailer_name]
+    template_path.unshift "#{@devise_mapping.plural}/mailer" if self.class.scoped_views?
+    template_path
+  end
+
+  # Setup a subject doing an I18n lookup. At first, it attemps to set a subject
+  # based on the current mapping:
+  #
+  #   en:
+  #     devise:
+  #       mailer:
+  #         confirmation_instructions:
+  #           user_subject: '...'
+  #
+  # If one does not exist, it fallbacks to ActionMailer default:
+  #
+  #   en:
+  #     devise:
+  #       mailer:
+  #         confirmation_instructions:
+  #           subject: '...'
+  #
+  def translate(mapping, key)
+    I18n.t(:"#{mapping.name}_subject", :scope => [:devise, :mailer, key],
+      :default => [:subject, key.to_s.humanize])
+  end
+end

data/app/views/devise/confirmations/new.html.erb

@@ -0,0 +1,12 @@
+<h2>Resend confirmation instructions</h2>
+
+<%= form_for(resource, :as => resource_name, :url => confirmation_path(resource_name), :html => { :method => :post }) do |f| %>
+  <%= devise_error_messages! %>
+
+  <p><%= f.label :email %><br />
+  <%= f.text_field :email %></p>
+
+  <p><%= f.submit "Resend confirmation instructions" %></p>
+<% end %>
+
+<%= render :partial => "devise/shared/links" %>

data/app/views/devise/passwords/edit.html.erb

@@ -0,0 +1,16 @@
+<h2>Change your password</h2>
+
+<%= form_for(resource, :as => resource_name, :url => password_path(resource_name), :html => { :method => :put }) do |f| %>
+  <%= devise_error_messages! %>
+  <%= f.hidden_field :reset_password_token %>
+
+  <p><%= f.label :password %><br />
+  <%= f.password_field :password %></p>
+
+  <p><%= f.label :password_confirmation %><br />
+  <%= f.password_field :password_confirmation %></p>
+
+  <p><%= f.submit "Change my password" %></p>
+<% end %>
+
+<%= render :partial => "devise/shared/links" %>

data/app/views/devise/passwords/new.html.erb

@@ -0,0 +1,12 @@
+<h2>Forgot your password?</h2>
+
+<%= form_for(resource, :as => resource_name, :url => password_path(resource_name), :html => { :method => :post }) do |f| %>
+  <%= devise_error_messages! %>
+
+  <p><%= f.label :email %><br />
+  <%= f.text_field :email %></p>
+
+  <p><%= f.submit "Send me reset password instructions" %></p>
+<% end %>
+
+<%= render :partial => "devise/shared/links" %>

data/app/views/devise/registrations/edit.html.erb

@@ -0,0 +1,25 @@
+<h2>Edit <%= resource_name.to_s.humanize %></h2>
+
+<%= form_for(resource, :as => resource_name, :url => registration_path(resource_name), :html => { :method => :put }) do |f| %>
+  <%= devise_error_messages! %>
+
+  <p><%= f.label :email %><br />
+  <%= f.text_field :email %></p>
+
+  <p><%= f.label :password %> <i>(leave blank if you don't want to change it)</i><br />
+  <%= f.password_field :password %></p>
+
+  <p><%= f.label :password_confirmation %><br />
+  <%= f.password_field :password_confirmation %></p>
+
+  <p><%= f.label :current_password %> <i>(we need your current password to confirm your changes)</i><br />
+  <%= f.password_field :current_password %></p>
+
+  <p><%= f.submit "Update" %></p>
+<% end %>
+
+<h3>Cancel my account</h3>
+
+<p>Unhappy? <%= link_to "Cancel my account", registration_path(resource_name), :confirm => "Are you sure?", :method => :delete %>.</p>
+
+<%= link_to "Back", :back %>

data/app/views/devise/registrations/new.html.erb

@@ -0,0 +1,18 @@
+<h2>Sign up</h2>
+
+<%= form_for(resource, :as => resource_name, :url => registration_path(resource_name)) do |f| %>
+  <%= devise_error_messages! %>
+
+  <p><%= f.label :email %><br />
+  <%= f.text_field :email %></p>
+
+  <p><%= f.label :password %><br />
+  <%= f.password_field :password %></p>
+
+  <p><%= f.label :password_confirmation %><br />
+  <%= f.password_field :password_confirmation %></p>
+
+  <p><%= f.submit "Sign up" %></p>
+<% end %>
+
+<%= render :partial => "devise/shared/links" %>

data/app/views/devise/sessions/new.html.erb

@@ -0,0 +1,17 @@
+<h2>Sign in</h2>
+
+<%= form_for(resource, :as => resource_name, :url => session_path(resource_name)) do |f| %>
+  <p><%= f.label :email %><br />
+  <%= f.text_field :email %></p>
+
+  <p><%= f.label :password %><br />
+  <%= f.password_field :password %></p>
+
+  <% if devise_mapping.rememberable? -%>
+    <p><%= f.check_box :remember_me %> <%= f.label :remember_me %></p>
+  <% end -%>
+
+  <p><%= f.submit "Sign in" %></p>
+<% end %>
+
+<%= render :partial => "devise/shared/links" %>

data/app/views/devise/shared/_links.erb

@@ -0,0 +1,19 @@
+<%- if controller_name != 'sessions' %>
+  <%= link_to "Sign in", new_session_path(resource_name) %><br />
+<% end -%>
+
+<%- if devise_mapping.registerable? && controller_name != 'registrations' %>
+  <%= link_to "Sign up", new_registration_path(resource_name) %><br />
+<% end -%>
+
+<%- if devise_mapping.recoverable? && controller_name != 'passwords' %>
+  <%= link_to "Forgot your password?", new_password_path(resource_name) %><br />
+<% end -%>
+
+<%- if devise_mapping.confirmable? && controller_name != 'confirmations' %>
+  <%= link_to "Didn't receive confirmation instructions?", new_confirmation_path(resource_name) %><br />
+<% end -%>
+
+<%- if devise_mapping.lockable? && resource_class.unlock_strategy_enabled?(:email) && controller_name != 'unlocks' %>
+  <%= link_to "Didn't receive unlock instructions?", new_unlock_path(resource_name) %><br />
+<% end -%>

data/app/views/devise/unlocks/new.html.erb

@@ -0,0 +1,12 @@
+<h2>Resend unlock instructions</h2>
+
+<%= form_for(resource, :as => resource_name, :url => unlock_path(resource_name), :html => { :method => :post }) do |f| %>
+  <%= devise_error_messages! %>
+
+  <p><%= f.label :email %><br />
+  <%= f.text_field :email %></p>
+
+  <p><%= f.submit "Resend unlock instructions" %></p>
+<% end %>
+
+<%= render :partial => "devise/shared/links" %>

data/{lib/devise → config}/locales/en.yml

@@ -1,9 +1,12 @@
 en:
+  errors:
+    messages:
+      not_found: "not found"
+      already_confirmed: "was already confirmed"
+      not_locked: "was not locked"
+
   devise:
-    sessions:
-      link: 'Sign in'
-      signed_in: 'Signed in successfully.'
-      signed_out: 'Signed out successfully.'
+    failure:
       unauthenticated: 'You need to sign in or sign up before continuing.'
       unconfirmed: 'You have to confirm your account before continuing.'
       locked: 'Your account is locked.'
@@ -11,25 +14,26 @@ en:
       invalid_token: 'Invalid authentication token.'
       timeout: 'Your session expired, please sign in again to continue.'
       inactive: 'Your account was not activated yet.'
+    sessions:
+      signed_in: 'Signed in successfully.'
+      signed_out: 'Signed out successfully.'
     passwords:
-      link: 'Forgot password?'
       send_instructions: 'You will receive an email with instructions about how to reset your password in a few minutes.'
       updated: 'Your password was changed successfully. You are now signed in.'
     confirmations:
-      link: "Didn't receive confirmation instructions?"
       send_instructions: 'You will receive an email with instructions about how to confirm your account in a few minutes.'
       confirmed: 'Your account was successfully confirmed. You are now signed in.'
     registrations:
-      link: 'Sign up'
       signed_up: 'You have signed up successfully. If enabled, a confirmation was sent to your e-mail.'
       updated: 'You updated your account successfully.'
       destroyed: 'Bye! Your account was successfully cancelled. We hope to see you again soon.'
     unlocks:
-      link: "Didn't receive unlock instructions?"
       send_instructions: 'You will receive an email with instructions about how to unlock your account in a few minutes.'
       unlocked: 'Your account was successfully unlocked. You are now signed in.'
     mailer:
-      confirmation_instructions: 'Confirmation instructions'
-      reset_password_instructions: 'Reset password instructions'
-      unlock_instructions: 'Unlock Instructions'
-
+      confirmation_instructions:
+        subject: 'Confirmation instructions'
+      reset_password_instructions:
+        subject: 'Reset password instructions'
+      unlock_instructions:
+        subject: 'Unlock Instructions'

data/lib/devise/controllers/helpers.rb

@@ -2,18 +2,11 @@ module Devise
   module Controllers
     # Those helpers are convenience methods added to ApplicationController.
     module Helpers
+      extend ActiveSupport::Concern
 
-      def self.included(base)
-        base.class_eval do
-          helper_method :warden, :signed_in?, :devise_controller?, :anybody_signed_in?,
-                        *Devise.mappings.keys.map { |m| [:"current_#{m}", :"#{m}_signed_in?", :"#{m}_session"] }.flatten
-
-          # Use devise default_url_options. We have to declare it here to overwrite
-          # default definitions.
-          def default_url_options(options=nil)
-            Devise::Mapping.default_url_options
-          end
-        end
+      included do
+        helper_method :warden, :signed_in?, :devise_controller?, :anybody_signed_in?,
+                      *Devise.mappings.keys.map { |m| [:"current_#{m}", :"#{m}_signed_in?", :"#{m}_session"] }.flatten
       end
 
       # The main accessor for the warden proxy instance
@@ -30,18 +23,6 @@ module Devise
         false
       end
 
-      # Attempts to authenticate the given scope by running authentication hooks,
-      # but does not redirect in case of failures.
-      def authenticate(scope)
-        warden.authenticate(:scope => scope)
-      end
-
-      # Attempts to authenticate the given scope by running authentication hooks,
-      # redirecting in case of failures.
-      def authenticate!(scope)
-        warden.authenticate!(:scope => scope)
-      end
-
       # Check if the given scope is signed in session, without running
       # authentication hooks.
       def signed_in?(scope)
@@ -66,7 +47,6 @@ module Devise
         scope      = Devise::Mapping.find_scope!(resource_or_scope)
         resource ||= resource_or_scope
         warden.set_user(resource, :scope => scope)
-        @_session = request.session # Recalculate session
       end
 
       # Sign out a given user or scope. This helper is useful for signing out an user
@@ -84,6 +64,16 @@ module Devise
         warden.logout(scope)
       end
 
+      # Sign out all active users or scopes. This helper is useful for signing out all roles
+      # in one click.
+      def sign_out_all_scopes
+        # Not "warden.logout" since we need to sign_out only devise-defined scopes.
+        scopes = Devise.mappings.keys
+        scopes.each { |scope| warden.user(scope) }
+        warden.raw_session.inspect
+        warden.logout(*scopes)
+      end
+
       # Returns and delete the url stored in the session for the given scope. Useful
       # for giving redirect backs after sign up:
       #
@@ -93,8 +83,7 @@ module Devise
       #
       def stored_location_for(resource_or_scope)
         scope = Devise::Mapping.find_scope!(resource_or_scope)
-        key = "#{scope}.return_to"
-        session.delete(key) || session.delete(key.to_sym)
+        session.delete(:"#{scope}_return_to")
       end
 
       # The default url to be used after signing in. This is used by all Devise
@@ -125,10 +114,40 @@ module Devise
       #
       def after_sign_in_path_for(resource_or_scope)
         scope = Devise::Mapping.find_scope!(resource_or_scope)
-        home_path = "#{scope}_root_path"
+        home_path = :"#{scope}_root_path"
         respond_to?(home_path, true) ? send(home_path) : root_path
       end
 
+      # The default url to be used after updating a resource. This is used by all Devise
+      # controllers and you can overwrite it in your ApplicationController to
+      # provide a custom hook for a custom resource.
+      #
+      # By default, it first tries to find a resource_root_path, otherwise it
+      # uses the root path. For a user scope, you can define the default url in
+      # the following way:
+      #
+      #   map.user_root '/users', :controller => 'users' # creates user_root_path
+      #
+      #   map.resources :users do |users|
+      #     users.root # creates user_root_path
+      #   end
+      #
+      #
+      # If none of these are defined, root_path is used. However, if this default
+      # is not enough, you can customize it, for example:
+      #
+      #   def after_update_path_for(resource)
+      #     if resource.is_a?(User) && resource.can_publish?
+      #       publisher_url
+      #     else
+      #       super
+      #     end
+      #   end
+      #
+      def after_update_path_for(resource_or_scope)
+        after_sign_in_path_for(resource_or_scope)
+      end
+
       # Method used by sessions controller to sign out an user. You can overwrite
       # it in your ApplicationController to provide a custom hook for a custom
       # scope. Notice that differently from +after_sign_in_path_for+ this method
@@ -144,14 +163,10 @@ module Devise
       #
       # If just a symbol is given, consider that the user was already signed in
       # through other means and just perform the redirection.
-      def sign_in_and_redirect(resource_or_scope, resource=nil, skip=false)
+      def sign_in_and_redirect(resource_or_scope, resource=nil)
         scope      = Devise::Mapping.find_scope!(resource_or_scope)
         resource ||= resource_or_scope
-        if skip
-          @_session = request.session # Recalculate session
-        else
-          sign_in(scope, resource)
-        end
+        sign_in(scope, resource) unless warden.user(scope) == resource
         redirect_to stored_location_for(scope) || after_sign_in_path_for(resource)
       end
 
@@ -159,33 +174,23 @@ module Devise
       # after_sign_out_path_for.
       def sign_out_and_redirect(resource_or_scope)
         scope = Devise::Mapping.find_scope!(resource_or_scope)
-        sign_out(scope)
+        if Devise.sign_out_all_scopes
+          sign_out_all_scopes
+        else
+          sign_out(scope)
+        end
         redirect_to after_sign_out_path_for(scope)
       end
 
-      # Sign out all active users or scopes. This helper is useful for signing out all roles
-      # in one click. This signs out ALL scopes in warden.
-      def sign_out_all_scopes
-        Devise.mappings.keys.each { |s| warden.user(s) }
-        warden.raw_session.inspect
-        warden.logout
-      end
-
-      # Override Rails' handle unverified request to sign out all scopes.
-      def handle_unverified_request
-        sign_out_all_scopes
-        super # call the default behaviour which resets the session
-      end
-
       # Define authentication filters and accessor helpers based on mappings.
       # These filters should be used inside the controllers as before_filters,
       # so you can control the scope of the user who should be signed in to
       # access that specific controller/action.
       # Example:
       #
-      #   Maps:
-      #     User => :authenticatable
-      #     Admin => :authenticatable
+      #   Roles:
+      #     User
+      #     Admin
       #
       #   Generated methods:
       #     authenticate_user!  # Signs user in or redirect
@@ -193,7 +198,7 @@ module Devise
       #     user_signed_in?     # Checks whether there is an user signed in or not
       #     admin_signed_in?    # Checks whether there is an admin signed in or not
       #     current_user        # Current signed in user
-      #     current_admin       # Current signed in admin
+      #     current_admin       # Currend signed in admin
       #     user_session        # Session data available only to the user scope
       #     admin_session       # Session data available only to the admin scope
       #