devise 1.0.10 → 1.1.0

data/lib/devise/mapping.rb

@@ -18,21 +18,12 @@ module Devise
   #   mapping.to   #=> User
   #   # is the class to be loaded from routes, given in the route as :class_name.
   #
-  #   mapping.for  #=> [:authenticatable]
+  #   mapping.modules  #=> [:authenticatable]
   #   # is the modules included in the class
   #
   class Mapping #:nodoc:
-    attr_reader :name, :as, :path_names, :path_prefix, :route_options, :sign_out_via
-
-    # Loop through all mappings looking for a map that matches with the requested
-    # path (ie /users/sign_in). If a path prefix is given, it's taken into account.
-    def self.find_by_path(path)
-      Devise.mappings.each_value do |mapping|
-        route = path.split("/")[mapping.as_position]
-        return mapping if route && mapping.as == route.to_sym
-      end
-      nil
-    end
+    attr_reader :singular, :plural, :path, :controllers, :path_names, :class_name
+    alias :name :singular
 
     # Receives an object and find a scope for it. If a scope cannot be found,
     # raises an error. If a symbol is given, it's considered to be the scope.
@@ -49,82 +40,64 @@ module Devise
       raise "Could not find a valid mapping for #{duck}"
     end
 
-    # Default url options which can be used as prefix.
-    def self.default_url_options
-      {}
-    end
-
     def initialize(name, options) #:nodoc:
-      @as    = (options.delete(:as) || name).to_sym
-      @klass = (options.delete(:class_name) || name.to_s.classify).to_s
-      @name  = (options.delete(:scope) || name.to_s.singularize).to_sym
+      @plural   = (options[:as] ? "#{options[:as]}_#{name}" : name).to_sym
+      @singular = (options[:singular] || @plural.to_s.singularize).to_sym
 
-      @path_prefix   = "/#{options.delete(:path_prefix)}/".squeeze("/")
-      @route_options = options || {}
+      @class_name = (options[:class_name] || name.to_s.classify).to_s
+      @ref = ActiveSupport::Dependencies.ref(@class_name)
 
-      @path_names = Hash.new { |h,k| h[k] = k.to_s }
-      @path_names.merge!(options.delete(:path_names) || {})
+      @path = (options[:path] || name).to_s
+      @path_prefix = options[:path_prefix]
 
-      @sign_out_via = (options.delete(:sign_out_via) || :get)
+      mod = options[:module] || "devise"
+      @controllers = Hash.new { |h,k| h[k] = "#{mod}/#{k}" }
+      @controllers.merge!(options[:controllers] || {})
+
+      @path_names = Hash.new { |h,k| h[k] = k.to_s }
+      @path_names.merge!(:registration => "")
+      @path_names.merge!(options[:path_names] || {})
     end
 
     # Return modules for the mapping.
-    def for
-      @for ||= to.devise_modules
+    def modules
+      @modules ||= to.respond_to?(:devise_modules) ? to.devise_modules : []
     end
 
-    # Reload mapped class each time when cache_classes is false.
+    # Gives the class the mapping points to.
     def to
-      return @to if @to
-      klass = @klass.constantize
-      @to = klass if Rails.configuration.cache_classes
-      klass
+      @ref.get
     end
 
-    # Check if the respective controller has a module in the mapping class.
-    def allows?(controller)
-      (self.for & CONTROLLERS[controller.to_sym]).present?
+    def strategies
+      @strategies ||= STRATEGIES.values_at(*self.modules).compact.uniq.reverse
     end
 
-    # Return in which position in the path prefix devise should find the as mapping.
-    def as_position
-      self.path_prefix.count("/")
+    def routes
+      @routes ||= ROUTES.values_at(*self.modules).compact.uniq
     end
 
-    # Returns the raw path using path_prefix and as.
-    def raw_path
-      path_prefix + as.to_s
-    end
-
-    # Returns the parsed path taking into account the relative url root and raw path.
-    def parsed_path
-      (ActionController::Base.relative_url_root.to_s + raw_path).tap do |path|
-        self.class.default_url_options.each do |key, value|
-          path.gsub!(key.inspect, value.to_param)
-        end
-      end
+    def authenticatable?
+      @authenticatable ||= self.modules.any? { |m| m.to_s =~ /authenticatable/ }
     end
 
-    def authenticatable?
-      @authenticatable ||= self.for.any? { |m| m.to_s =~ /authenticatable/ }
+    def fullpath
+      "#{@path_prefix}/#{@path}".squeeze("/")
     end
 
     # Create magic predicates for verifying what module is activated by this map.
     # Example:
     #
     #   def confirmable?
-    #     self.for.include?(:confirmable)
+    #     self.modules.include?(:confirmable)
     #   end
     #
-    def self.register(*modules)
-      modules.each do |m|
-        class_eval <<-METHOD, __FILE__, __LINE__ + 1
-          def #{m}?
-            self.for.include?(:#{m})
-          end
-        METHOD
-      end
+    def self.add_module(m)
+      class_eval <<-METHOD, __FILE__, __LINE__ + 1
+        def #{m}?
+          self.modules.include?(:#{m})
+        end
+      METHOD
     end
-    Devise::Mapping.register *ALL
   end
 end

data/lib/devise/models/authenticatable.rb

@@ -0,0 +1,126 @@
+require 'devise/hooks/activatable'
+
+module Devise
+  module Models
+    # Authenticable module. Holds common settings for authentication.
+    #
+    # == Configuration:
+    #
+    # You can overwrite configuration values by setting in globally in Devise,
+    # using devise method or overwriting the respective instance method.
+    #
+    #   authentication_keys: parameters used for authentication. By default [:email].
+    #
+    #   http_authenticatable: if this model allows http authentication. By default true.
+    #   It also accepts an array specifying the strategies that should allow http.
+    #
+    #   params_authenticatable: if this model allows authentication through request params. By default true.
+    #   It also accepts an array specifying the strategies that should allow params authentication.
+    #
+    # == Active?
+    #
+    # Before authenticating an user and in each request, Devise checks if your model is active by
+    # calling model.active?. This method is overwriten by other devise modules. For instance,
+    # :confirmable overwrites .active? to only return true if your model was confirmed.
+    #
+    # You overwrite this method yourself, but if you do, don't forget to call super:
+    #
+    #   def active?
+    #     super && special_condition_is_valid?
+    #   end
+    #
+    # Whenever active? returns false, Devise asks the reason why your model is inactive using
+    # the inactive_message method. You can overwrite it as well:
+    #
+    #   def inactive_message
+    #     special_condition_is_valid? ? super : :special_condition_is_not_valid
+    #   end
+    #
+    module Authenticatable
+      extend ActiveSupport::Concern
+
+      included do
+        class_attribute :devise_modules, :instance_writer => false
+        self.devise_modules ||= []
+      end
+
+      # Check if the current object is valid for authentication. This method and
+      # find_for_authentication are the methods used in a Warden::Strategy to check
+      # if a model should be signed in or not.
+      #
+      # However, you should not overwrite this method, you should overwrite active? and
+      # inactive_message instead.
+      def valid_for_authentication?
+        if active?
+          block_given? ? yield : true
+        else
+          inactive_message
+        end
+      end
+
+      def active?
+        true
+      end
+
+      def inactive_message
+        :inactive
+      end
+
+      module ClassMethods
+        Devise::Models.config(self, :authentication_keys, :http_authenticatable, :params_authenticatable)
+
+        def params_authenticatable?(strategy)
+          params_authenticatable.is_a?(Array) ?
+            params_authenticatable.include?(strategy) : params_authenticatable
+        end
+
+        def http_authenticatable?(strategy)
+          http_authenticatable.is_a?(Array) ?
+            http_authenticatable.include?(strategy) : http_authenticatable
+        end
+
+        # Find first record based on conditions given (ie by the sign in form).
+        # Overwrite to add customized conditions, create a join, or maybe use a
+        # namedscope to filter records while authenticating.
+        # Example:
+        #
+        #   def self.find_for_authentication(conditions={})
+        #     conditions[:active] = true
+        #     super
+        #   end
+        #
+        def find_for_authentication(conditions)
+          find(:first, :conditions => conditions)
+        end
+
+        # Find an initialize a record setting an error if it can't be found.
+        def find_or_initialize_with_error_by(attribute, value, error=:invalid) #:nodoc:
+          if value.present?
+            conditions = { attribute => value }
+            record = find(:first, :conditions => conditions)
+          end
+
+          unless record
+            record = new
+            if value.present?
+              record.send(:"#{attribute}=", value)
+            else
+              error = :blank
+            end
+            record.errors.add(attribute, error)
+          end
+
+          record
+        end
+
+        # Generate a token by looping and ensuring does not already exist.
+        def generate_token(column)
+          loop do
+            token = Devise.friendly_token
+            break token unless find(:first, :conditions => { column => token })
+          end
+        end
+      end
+    end
+  end
+end

data/lib/devise/models/confirmable.rb

@@ -1,8 +1,5 @@
-require 'devise/models/activatable'
-
 module Devise
   module Models
-
     # Confirmable is responsible to verify if an account is already confirmed to
     # sign in, and to send emails with confirmation instructions.
     # Confirmation instructions are sent to the user email after creating a
@@ -29,15 +26,11 @@ module Devise
     #   User.find(1).send_confirmation_instructions # manually send instructions
     #   User.find(1).resend_confirmation! # generates a new token and resent it
     module Confirmable
-      include Devise::Models::Activatable
-
-      def self.included(base)
-        base.class_eval do
-          extend ClassMethods
+      extend ActiveSupport::Concern
 
-          before_create :generate_confirmation_token, :if => :confirmation_required?
-          after_create  :send_confirmation_instructions, :if => :confirmation_required?
-        end
+      included do
+        before_create :generate_confirmation_token, :if => :confirmation_required?
+        after_create  :send_confirmation_instructions, :if => :confirmation_required?
       end
 
       # Confirm a user by setting it's confirmed_at to actual time. If the user
@@ -46,19 +39,19 @@ module Devise
         unless_confirmed do
           self.confirmation_token = nil
           self.confirmed_at = Time.now
-          save(false)
+          save(:validate => false)
         end
       end
 
       # Verifies whether a user is confirmed or not
       def confirmed?
-        !new_record? && !confirmed_at.nil?
+        !!confirmed_at
       end
 
       # Send confirmation instructions by email
       def send_confirmation_instructions
         generate_confirmation_token! if self.confirmation_token.nil?
-        ::DeviseMailer.deliver_confirmation_instructions(self)
+        ::Devise.mailer.confirmation_instructions(self).deliver
       end
 
       # Resend confirmation token. This method does not need to generate a new token.
@@ -82,15 +75,14 @@ module Devise
       # If you don't want confirmation to be sent on create, neither a code
       # to be generated, call skip_confirmation!
       def skip_confirmation!
-        self.confirmed_at  = Time.now
-        @skip_confirmation = true
+        self.confirmed_at = Time.now
       end
 
       protected
 
         # Callback to overwrite if confirmation is required or not.
         def confirmation_required?
-          !@skip_confirmation
+          !confirmed?
         end
 
         # Checks if the confirmation for the user is within the limit time.
@@ -122,7 +114,7 @@ module Devise
           unless confirmed?
             yield
           else
-            self.class.add_error_on(self, :email, :already_confirmed)
+            self.errors.add(:email, :already_confirmed)
             false
           end
         end
@@ -131,12 +123,12 @@ module Devise
         # this token is being generated
         def generate_confirmation_token
           self.confirmed_at = nil
-          self.confirmation_token = Devise.friendly_token
+          self.confirmation_token = self.class.confirmation_token
           self.confirmation_sent_at = Time.now.utc
         end
 
         def generate_confirmation_token!
-          generate_confirmation_token && save(false)
+          generate_confirmation_token && save(:validate => false)
         end
 
       module ClassMethods
@@ -146,7 +138,7 @@ module Devise
         # Options must contain the user email
         def send_confirmation_instructions(attributes={})
           confirmable = find_or_initialize_with_error_by(:email, attributes[:email], :not_found)
-          confirmable.resend_confirmation_token unless confirmable.new_record?
+          confirmable.resend_confirmation_token if confirmable.persisted?
           confirmable
         end
 
@@ -156,10 +148,15 @@ module Devise
         # Options must have the confirmation_token
         def confirm_by_token(confirmation_token)
           confirmable = find_or_initialize_with_error_by(:confirmation_token, confirmation_token)
-          confirmable.confirm! unless confirmable.new_record?
+          confirmable.confirm! if confirmable.persisted?
           confirmable
         end
 
+        # Generate a token checking if one does not already exist in the database.
+        def confirmation_token
+          generate_token(:confirmation_token)
+        end
+
         Devise::Models.config(self, :confirm_within)
       end
     end

data/lib/devise/models/database_authenticatable.rb

@@ -19,27 +19,16 @@ module Devise
     #
     #   encryptor: the encryptor going to be used. By default :sha1.
     #
-    #   authentication_keys: parameters used for authentication. By default [:email]
-    #
     # Examples:
     #
-    #    User.authenticate('email@test.com', 'password123')  # returns authenticated user or nil
     #    User.find(1).valid_password?('password123')         # returns true/false
     #
     module DatabaseAuthenticatable
-      def self.included(base)
-        base.class_eval do
-          extend ClassMethods
-
-          attr_reader :password, :current_password
-          attr_accessor :password_confirmation
-        end
-      end
+      extend ActiveSupport::Concern
 
-      # TODO Remove me in next release
-      def old_password
-        ActiveSupport::Deprecation.warn "old_password is deprecated, please use current_password instead", caller
-        @old_password
+      included do
+        attr_reader :password, :current_password
+        attr_accessor :password_confirmation
       end
 
       # Regenerates password salt and encrypted password each time password is set,
@@ -48,19 +37,14 @@ module Devise
         @password = new_password
 
         if @password.present?
-          self.password_salt = self.class.encryptor_class.salt
+          self.password_salt = self.class.password_salt
           self.encrypted_password = password_digest(@password)
         end
       end
 
       # Verifies whether an incoming_password (ie from sign in) is the user password.
       def valid_password?(incoming_password)
-        Devise.secure_compare(password_digest(incoming_password), self.encrypted_password)
-      end
-
-      # Checks if a resource is valid upon authentication.
-      def valid_for_authentication?(attributes)
-        valid_password?(attributes[:password])
+        password_digest(incoming_password) == self.encrypted_password
       end
 
       # Set password and password confirmation to nil
@@ -82,61 +66,43 @@ module Devise
         result = if valid_password?(current_password)
           update_attributes(params)
         else
-          message = current_password.blank? ? :blank : :invalid
-          self.class.add_error_on(self, :current_password, message, false)
+          self.errors.add(:current_password, current_password.blank? ? :blank : :invalid)
           self.attributes = params
           false
         end
 
-        clean_up_passwords unless result
+        clean_up_passwords
         result
       end
 
-      protected
+      def after_database_authentication
+      end
 
-        # Checks whether a password is needed or not. For validations only.
-        # Passwords are always required if it's a new record, or if the password
-        # or confirmation are being set somewhere.
-        def password_required?
-          new_record? || !password.nil? || !password_confirmation.nil?
-        end
+    protected
 
-        # Digests the password using the configured encryptor.
-        def password_digest(password)
-          self.class.encryptor_class.digest(password, self.class.stretches, self.password_salt, self.class.pepper)
-        end
+      # Digests the password using the configured encryptor.
+      def password_digest(password)
+        self.class.encryptor_class.digest(password, self.class.stretches, self.password_salt, self.class.pepper)
+      end
 
       module ClassMethods
-        Devise::Models.config(self, :pepper, :stretches, :encryptor, :authentication_keys)
-
-        # Authenticate a user based on configured attribute keys. Returns the
-        # authenticated user if it's valid or nil.
-        def authenticate(attributes={})
-          return unless authentication_keys.all? { |k| attributes[k].present? }
-          conditions = attributes.slice(*authentication_keys)
-          resource = find_for_authentication(conditions)
-          resource if resource.try(:valid_for_authentication?, attributes)
-        end
+        Devise::Models.config(self, :pepper, :stretches, :encryptor)
 
         # Returns the class for the configured encryptor.
         def encryptor_class
           @encryptor_class ||= ::Devise::Encryptors.const_get(encryptor.to_s.classify)
         end
 
-      protected
-
-        # Find first record based on conditions given (ie by the sign in form).
-        # Overwrite to add customized conditions, create a join, or maybe use a
-        # namedscope to filter records while authenticating.
-        # Example:
-        #
-        #   def self.find_for_authentication(conditions={})
-        #     conditions[:active] = true
-        #     find(:first, :conditions => conditions)
-        #   end
-        #
-        def find_for_authentication(conditions)
-          find(:first, :conditions => conditions)
+        def password_salt
+          self.encryptor_class.salt(self.stretches)
+        end
+
+        # We assume this method already gets the sanitized values from the
+        # DatabaseAuthenticatable strategy. If you are using this method on
+        # your own, be sure to sanitize the conditions hash to only include
+        # the proper fields.
+        def find_for_database_authentication(conditions)
+          find_for_authentication(conditions)
         end
       end
     end

data/lib/devise/models/lockable.rb

@@ -1,8 +1,5 @@
-require 'devise/models/activatable'
-
 module Devise
   module Models
-
     # Handles blocking a user access after a certain number of attempts.
     # Lockable accepts two different strategies to unlock a user after it's
     # blocked: email and time. The former will send an email to the user when
@@ -13,39 +10,35 @@ module Devise
     # Configuration:
     #
     #   maximum_attempts: how many attempts should be accepted before blocking the user.
-    #   unlock_strategy: unlock the user account by :time, :email or :both.
+    #   lock_strategy: lock the user account by :failed_attempts or :none.
+    #   unlock_strategy: unlock the user account by :time, :email, :both or :none.
     #   unlock_in: the time you want to lock the user after to lock happens. Only
     #              available when unlock_strategy is :time or :both.
     #
     module Lockable
-      include Devise::Models::Activatable
+      extend  ActiveSupport::Concern
 
-      def self.included(base)
-        base.class_eval do
-          extend ClassMethods
-        end
-      end
+      delegate :lock_strategy_enabled?, :unlock_strategy_enabled?, :to => "self.class"
 
       # Lock an user setting it's locked_at to actual time.
       def lock_access!
-        return true if access_locked?
         self.locked_at = Time.now
 
-        if self.class.unlock_strategy_enabled?(:email)
+        if unlock_strategy_enabled?(:email)
           generate_unlock_token
           send_unlock_instructions
         end
 
-        save(false)
+        save(:validate => false)
       end
 
       # Unlock an user by cleaning locket_at and failed_attempts.
       def unlock_access!
         if_access_locked do
           self.locked_at = nil
-          self.failed_attempts = 0
-          self.unlock_token = nil
-          save(false)
+          self.failed_attempts = 0 if respond_to?(:failed_attempts=)
+          self.unlock_token = nil  if respond_to?(:unlock_token=)
+          save(:validate => false)
         end
       end
 
@@ -56,7 +49,7 @@ module Devise
 
       # Send unlock instructions by email
       def send_unlock_instructions
-        ::DeviseMailer.deliver_unlock_instructions(self)
+        ::Devise.mailer.unlock_instructions(self).deliver
       end
 
       # Resend the unlock instructions if the user is locked.
@@ -79,27 +72,40 @@ module Devise
       # Overwrites valid_for_authentication? from Devise::Models::Authenticatable
       # for verifying whether an user is allowed to sign in or not. If the user
       # is locked, it should never be allowed.
-      def valid_for_authentication?(attributes)
-        if result = super
+      def valid_for_authentication?
+        return super unless persisted? && lock_strategy_enabled?(:failed_attempts)
+
+        case (result = super)
+        when Symbol
+          return result
+        when TrueClass
           self.failed_attempts = 0
-        else
+        when FalseClass
           self.failed_attempts += 1
-          lock_access! if failed_attempts > self.class.maximum_attempts
+          if attempts_exceeded?
+            lock_access!
+            return :locked
+          end
         end
-        save(false) if changed?
+
+        save(:validate => false) if changed?
         result
       end
 
       protected
 
+        def attempts_exceeded?
+          self.failed_attempts > self.class.maximum_attempts
+        end
+
         # Generates unlock token
         def generate_unlock_token
-          self.unlock_token = Devise.friendly_token
+          self.unlock_token = self.class.unlock_token
         end
 
         # Tells if the lock is expired if :time unlock strategy is active
         def lock_expired?
-          if self.class.unlock_strategy_enabled?(:time)
+          if unlock_strategy_enabled?(:time)
             locked_at && locked_at < self.class.unlock_in.ago
           else
             false
@@ -112,7 +118,7 @@ module Devise
           if access_locked?
             yield
           else
-            self.class.add_error_on(self, :email, :not_locked)
+            self.errors.add(:email, :not_locked)
             false
           end
         end
@@ -124,7 +130,7 @@ module Devise
         # Options must contain the user email
         def send_unlock_instructions(attributes={})
          lockable = find_or_initialize_with_error_by(:email, attributes[:email], :not_found)
-         lockable.resend_unlock_token unless lockable.new_record?
+         lockable.resend_unlock_token if lockable.persisted?
          lockable
         end
 
@@ -134,7 +140,7 @@ module Devise
         # Options must have the unlock_token
         def unlock_access_by_token(unlock_token)
           lockable = find_or_initialize_with_error_by(:unlock_token, unlock_token)
-          lockable.unlock_access! unless lockable.new_record?
+          lockable.unlock_access! if lockable.persisted?
           lockable
         end
 
@@ -143,7 +149,16 @@ module Devise
           [:both, strategy].include?(self.unlock_strategy)
         end
 
-        Devise::Models.config(self, :maximum_attempts, :unlock_strategy, :unlock_in)
+        # Is the lock enabled for the given lock strategy?
+        def lock_strategy_enabled?(strategy)
+          self.lock_strategy == strategy
+        end
+
+        def unlock_token
+          Devise.friendly_token
+        end
+
+        Devise::Models.config(self, :maximum_attempts, :lock_strategy, :unlock_strategy, :unlock_in)
       end
     end
   end