devise 1.0.10 → 1.1.0

data/lib/devise.rb

@@ -1,12 +1,16 @@
+require 'active_support/core_ext/numeric/time'
+require 'active_support/dependencies'
+
 module Devise
   autoload :FailureApp, 'devise/failure_app'
-  autoload :Models, 'devise/models'
+  autoload :PathChecker, 'devise/path_checker'
   autoload :Schema, 'devise/schema'
   autoload :TestHelpers, 'devise/test_helpers'
 
   module Controllers
     autoload :Helpers, 'devise/controllers/helpers'
     autoload :InternalHelpers, 'devise/controllers/internal_helpers'
+    autoload :ScopedViews, 'devise/controllers/scoped_views'
     autoload :UrlHelpers, 'devise/controllers/url_helpers'
   end
 
@@ -20,45 +24,21 @@ module Devise
     autoload :Sha1, 'devise/encryptors/sha1'
   end
 
-  module Orm
-    autoload :ActiveRecord, 'devise/orm/active_record'
-    autoload :DataMapper, 'devise/orm/data_mapper'
-    autoload :MongoMapper, 'devise/orm/mongo_mapper'
+  module Strategies
+    autoload :Base, 'devise/strategies/base'
+    autoload :Authenticatable, 'devise/strategies/authenticatable'
   end
 
-  ALL = []
-
-  # Authentication ones first
-  ALL.push :database_authenticatable, :http_authenticatable, :token_authenticatable, :rememberable
-
-  # Misc after
-  ALL.push :recoverable, :registerable, :validatable
-
-  # The ones which can sign out after
-  ALL.push :activatable, :confirmable, :lockable, :timeoutable
-
-  # Stats for last, so we make sure the user is really signed in
-  ALL.push :trackable
-
-  # Maps controller names to devise modules.
-  CONTROLLERS = {
-    :sessions => [:database_authenticatable, :token_authenticatable],
-    :passwords => [:recoverable],
-    :confirmations => [:confirmable],
-    :registrations => [:registerable],
-    :unlocks => [:lockable]
-  }
-
-  # Routes for generating url helpers.
-  ROUTES = [:session, :password, :confirmation, :registration, :unlock]
-
-  STRATEGIES  = [:rememberable, :http_authenticatable, :token_authenticatable, :database_authenticatable]
+  # Constants which holds devise configuration for extensions. Those should
+  # not be modified by the "end user".
+  ALL         = []
+  CONTROLLERS = ActiveSupport::OrderedHash.new
+  ROUTES      = ActiveSupport::OrderedHash.new
+  STRATEGIES  = ActiveSupport::OrderedHash.new
 
+  # True values used to check params
   TRUE_VALUES = [true, 1, '1', 't', 'T', 'true', 'TRUE']
 
-  # Maps the messages types that are used in flash message.
-  FLASH_MESSAGES = [:unauthenticated, :unconfirmed, :invalid, :invalid_token, :timeout, :inactive, :locked]
-
   # Declare encryptors length which are used in migrations.
   ENCRYPTORS_LENGTH = {
     :sha1   => 40,
@@ -69,8 +49,9 @@ module Devise
     :bcrypt => 60
   }
 
-  # Email regex used to validate email formats. Adapted from authlogic.
-  EMAIL_REGEX = /^([\w\.%\+\-]+)@([\w\-]+\.)+([\w]{2,})$/i
+  # Custom domain for cookies. Not set by default
+  mattr_accessor :cookie_domain
+  @@cookie_domain = false
 
   # Used to encrypt password. Please generate one with rake secret.
   mattr_accessor :pepper
@@ -84,10 +65,42 @@ module Devise
   mattr_accessor :authentication_keys
   @@authentication_keys = [ :email ]
 
-  # Time interval where the remember me token is valid.
+  # If http authentication is enabled by default.
+  mattr_accessor :http_authenticatable
+  @@http_authenticatable = true
+
+  # If http authentication is used for ajax requests.  True by default.
+  mattr_accessor :http_authenticatable_on_xhr
+  @@http_authenticatable_on_xhr = true
+
+  # If params authenticatable is enabled by default.
+  mattr_accessor :params_authenticatable
+  @@params_authenticatable = true
+
+  # The realm used in Http Basic Authentication.
+  mattr_accessor :http_authentication_realm
+  @@http_authentication_realm = "Application"
+
+  # Email regex used to validate email formats. Adapted from authlogic.
+  mattr_accessor :email_regexp
+  @@email_regexp = /^([\w\.%\+\-]+)@([\w\-]+\.)+([\w]{2,})$/i
+
+  # Range validation for password length
+  mattr_accessor :password_length
+  @@password_length = 6..20
+
+  # The time the user will be remembered without asking for credentials again.
   mattr_accessor :remember_for
   @@remember_for = 2.weeks
 
+  # If true, a valid remember token can be re-used between multiple browsers.
+  mattr_accessor :remember_across_browsers
+  @@remember_across_browsers = true
+
+  # If true, extends the user's remember period when remembered via cookie.
+  mattr_accessor :extend_remember_period
+  @@extend_remember_period = false
+
   # Time interval you can access your account before confirming your account.
   mattr_accessor :confirm_within
   @@confirm_within = 0.days
@@ -98,22 +111,14 @@ module Devise
 
   # Used to define the password encryption algorithm.
   mattr_accessor :encryptor
-  @@encryptor = :sha1
+  @@encryptor = nil
 
   # Store scopes mappings.
   mattr_accessor :mappings
   @@mappings = ActiveSupport::OrderedHash.new
 
-  # Stores the chosen ORM.
-  mattr_accessor :orm
-  @@orm = :active_record
-
-  # TODO Remove
-  mattr_accessor :all
-  @@all = []
-
   # Tells if devise should apply the schema in ORMs where devise declaration
-  # and schema belongs to the same class (as Datamapper and MongoMapper).
+  # and schema belongs to the same class (as Datamapper and Mongoid).
   mattr_accessor :apply_schema
   @@apply_schema = true
 
@@ -122,23 +127,24 @@ module Devise
   mattr_accessor :scoped_views
   @@scoped_views = false
 
-  # Number of authentication tries before locking an account
-  mattr_accessor :maximum_attempts
-  @@maximum_attempts = 20
+  # Defines which strategy can be used to lock an account.
+  # Values: :failed_attempts, :none
+  mattr_accessor :lock_strategy
+  @@lock_strategy = :failed_attempts
 
   # Defines which strategy can be used to unlock an account.
   # Values: :email, :time, :both
   mattr_accessor :unlock_strategy
   @@unlock_strategy = :both
 
+  # Number of authentication tries before locking an account
+  mattr_accessor :maximum_attempts
+  @@maximum_attempts = 20
+
   # Time interval to unlock the account if :time is defined as unlock_strategy.
   mattr_accessor :unlock_in
   @@unlock_in = 1.hour
 
-  # Tell when to use the default scope, if one cannot be found from routes.
-  mattr_accessor :use_default_scope
-  @@use_default_scope = false
-
   # The default scope which is used by warden.
   mattr_accessor :default_scope
   @@default_scope = nil
@@ -147,131 +153,142 @@ module Devise
   mattr_accessor :mailer_sender
   @@mailer_sender = nil
 
-  # Content Type of Devise e-mails.
-  mattr_accessor :mailer_content_type
-  @@mailer_content_type = 'text/html'
-
   # Authentication token params key name of choice. E.g. /users/sign_in?some_key=...
   mattr_accessor :token_authentication_key
   @@token_authentication_key = :auth_token
 
-  # The realm used in Http Basic Authentication
-  mattr_accessor :http_authentication_realm
-  @@http_authentication_realm = "Application"
+  # Which formats should be treated as navigational.
+  mattr_accessor :navigational_formats
+  @@navigational_formats = [:html]
 
-  class << self
-    # Default way to setup Devise. Run script/generate devise_install to create
-    # a fresh initializer with all configuration values.
-    def setup
-      yield self
-    end
+  # Private methods to interface with Warden.
+  mattr_accessor :warden_config
+  @@warden_config = nil
+  @@warden_config_block = nil
 
-    # Sets warden configuration using a block that will be invoked on warden
-    # initialization.
-    #
-    #  Devise.initialize do |config|
-    #    config.confirm_within = 2.days
-    #
-    #    config.warden do |manager|
-    #      # Configure warden to use other strategies, like oauth.
-    #      manager.oauth(:twitter)
-    #    end
-    #  end
-    def warden(&block)
-      @warden_config = block
-    end
+  # When set to true, signing out an user signs out all other scopes.
+  mattr_accessor :sign_out_all_scopes
+  @@sign_out_all_scopes = false
 
-    # Configure default url options to be used within Devise and ActionController.
-    def default_url_options(&block)
-      who = Devise::Mapping.respond_to?(:singleton_class) ?
-        Devise::Mapping.singleton_class : Devise::Mapping.metaclass
-      who.send :define_method, :default_url_options, &block
-    end
+  def self.use_default_scope=(*)
+    ActiveSupport::Deprecation.warn "config.use_default_scope is deprecated and removed from Devise. " <<
+      "If you are using non conventional routes in Devise, all you need to do is to pass the devise " <<
+      "scope in the router DSL:\n\n  as :user do\n    get \"sign_in\", :to => \"devise/sessions\"\n  end\n\n" <<
+      "The method :as is also aliased to :devise_scope. Choose the one you prefer.", caller
+  end
 
-    # A method used internally to setup warden manager from the Rails initialize
-    # block.
-    def configure_warden(config) #:nodoc:
-      config.default_strategies *Devise::STRATEGIES
-      config.failure_app = Devise::FailureApp
-      config.silence_missing_strategies!
-      config.default_scope = Devise.default_scope
+  # Default way to setup Devise. Run rails generate devise_install to create
+  # a fresh initializer with all configuration values.
+  def self.setup
+    yield self
+  end
 
-      # If the user provided a warden hook, call it now.
-      @warden_config.try :call, config
-    end
+  # Get the mailer class from the mailer reference object.
+  def self.mailer
+    @@mailer_ref.get
+  end
 
-    # The class of the configured ORM
-    def orm_class
-      Devise::Orm.const_get(@@orm.to_s.camelize.to_sym)
-    end
+  # Set the mailer reference object to access the mailer.
+  def self.mailer=(class_name)
+    @@mailer_ref = ActiveSupport::Dependencies.ref(class_name)
+  end
+  self.mailer = "Devise::Mailer"
+
+  # Small method that adds a mapping to Devise.
+  def self.add_mapping(resource, options)
+    mapping = Devise::Mapping.new(resource, options)
+    self.mappings[mapping.name] = mapping
+    self.default_scope ||= mapping.name
+    mapping
+  end
 
-    # Generate a friendly string randomically to be used as token.
-    def friendly_token
-      ActiveSupport::SecureRandom.base64(15).tr('+/=', '-_ ').strip.delete("\n")
+  # Make Devise aware of an 3rd party Devise-module. For convenience.
+  #
+  # == Options:
+  #
+  #   +model+      - String representing the load path to a custom *model* for this module (to autoload.)
+  #   +controller+ - Symbol representing the name of an exisiting or custom *controller* for this module.
+  #   +route+      - Symbol representing the named *route* helper for this module.
+  #   +flash+      - Symbol representing the *flash messages* used by this helper.
+  #   +strategy+   - Symbol representing if this module got a custom *strategy*.
+  #
+  # All values, except :model, accept also a boolean and will have the same name as the given module
+  # name.
+  #
+  # == Examples:
+  #
+  #   Devise.add_module(:party_module)
+  #   Devise.add_module(:party_module, :strategy => true, :controller => :sessions)
+  #   Devise.add_module(:party_module, :model => 'party_module/model')
+  #
+  def self.add_module(module_name, options = {})
+    ALL << module_name
+    options.assert_valid_keys(:strategy, :model, :controller, :route)
+
+    config = {
+      :strategy => STRATEGIES,
+      :route => ROUTES,
+      :controller => CONTROLLERS
+    }
+
+    config.each do |key, value|
+      next unless options[key]
+      name = (options[key] == true ? module_name : options[key])
+
+      if value.is_a?(Hash)
+        value[module_name] = name
+      else
+        value << name unless value.include?(name)
+      end
     end
 
-    # constant-time comparison algorithm to prevent timing attacks
-    def secure_compare(a, b)
-      return false unless a.present? && b.present?
-      return false unless a.bytesize == b.bytesize
-      l = a.unpack "C#{a.bytesize}"
-
-      res = 0
-      b.each_byte { |byte| res |= byte ^ l.shift }
-      res == 0
+    if options[:model]
+      model_path = (options[:model] == true ? "devise/models/#{module_name}" : options[:model])
+      Devise::Models.send(:autoload, module_name.to_s.camelize.to_sym, model_path)
     end
 
-    # Make Devise aware of an 3rd party Devise-module. For convenience.
-    #
-    # == Options:
-    #
-    #   +strategy+    - Boolean value representing if this module got a custom *strategy*.
-    #                   Default is +false+. Note: Devise will auto-detect this in such case if this is true.
-    #   +model+       - String representing a load path to a custom *model* for this module (to autoload).
-    #                   Default is +nil+ (i.e. +false+).
-    #   +controller+  - Symbol representing a name of an exisiting or custom *controller* for this module.
-    #                   Default is +nil+ (i.e. +false+).
-    #   +route+       - Symbol representing the name of a *route* related to this module which a set of
-    #                   route view helpers should be created for.
-    #                   Default is +nil+ (i.e. +false+).
-    #
-    # == Examples:
-    #
-    #   Devise.add_module(:party_module)
-    #   Devise.add_module(:party_module, :strategy => true, :controller => :sessions)
-    #   Devise.add_module(:party_module, :model => 'party_module/model')
-    #
-    def add_module(module_name, options = {})
-      Devise::ALL << module_name        unless Devise::ALL.include?(module_name)
-      Devise::STRATEGIES.unshift module_name if options[:strategy] && !Devise::STRATEGIES.include?(module_name)
-
-      if options[:controller]
-        controller = options[:controller].to_sym
-        Devise::CONTROLLERS[controller] ||= []
-        Devise::CONTROLLERS[controller].unshift module_name unless Devise::CONTROLLERS[controller].include?(module_name)
-      end
+    Devise::Mapping.add_module module_name
+  end
 
-      if options[:route]
-        Devise::ROUTES.unshift options[:route] unless Devise::ROUTES.include?(options[:route])
-      end
+  # Sets warden configuration using a block that will be invoked on warden
+  # initialization.
+  #
+  #  Devise.initialize do |config|
+  #    config.confirm_within = 2.days
+  #
+  #    config.warden do |manager|
+  #      # Configure warden to use other strategies, like oauth.
+  #      manager.oauth(:twitter)
+  #    end
+  #  end
+  def self.warden(&block)
+    @@warden_config_block = block
+  end
 
-      if options[:model]
-        Devise::Models.module_eval do
-          autoload :"#{module_name.to_s.classify}", options[:model]
-        end
+  # A method used internally to setup warden manager from the Rails initialize
+  # block.
+  def self.configure_warden! #:nodoc:
+    @@warden_configured ||= begin
+      warden_config.failure_app   = Devise::FailureApp
+      warden_config.default_scope = Devise.default_scope
+
+      Devise.mappings.each_value do |mapping|
+        warden_config.scope_defaults mapping.name, :strategies => mapping.strategies
       end
 
-      Devise::Mapping.register module_name
+      @@warden_config_block.try :call, Devise.warden_config
+      true
     end
   end
-end
 
-begin
-  require 'warden'
-rescue
-  gem 'warden'
-  require 'warden'
+  # Generate a friendly string randomically to be used as token.
+  def self.friendly_token
+    ActiveSupport::SecureRandom.base64(15).tr('+/=', '-_ ').strip.delete("\n")
+  end
 end
 
+require 'warden'
 require 'devise/mapping'
+require 'devise/models'
+require 'devise/modules'
 require 'devise/rails'

data/lib/generators/active_record/devise_generator.rb

@@ -0,0 +1,28 @@
+require 'rails/generators/active_record'
+require 'generators/devise/orm_helpers'
+
+module ActiveRecord
+  module Generators
+    class DeviseGenerator < ActiveRecord::Generators::Base
+      argument :attributes, :type => :array, :default => [], :banner => "field:type field:type"
+
+      include Devise::Generators::OrmHelpers
+      source_root File.expand_path("../templates", __FILE__)
+
+      def generate_model
+        invoke "active_record:model", [name], :migration => false unless model_exists?
+      end
+
+      def copy_devise_migration
+        migration_template "migration.rb", "db/migrate/devise_create_#{table_name}"
+      end
+
+      def inject_devise_content
+        inject_into_class model_path, class_name, model_contents + <<-CONTENT
+  # Setup accessible (or protected) attributes for your model
+  attr_accessible :email, :password, :password_confirmation, :remember_me
+CONTENT
+      end
+    end
+  end
+end

data/{generators/devise → lib/generators/active_record}/templates/migration.rb

@@ -2,18 +2,24 @@ class DeviseCreate<%= table_name.camelize %> < ActiveRecord::Migration
   def self.up
     create_table(:<%= table_name %>) do |t|
       t.database_authenticatable :null => false
-      t.confirmable
       t.recoverable
       t.rememberable
       t.trackable
-      # t.lockable
+
+      # t.confirmable
+      # t.lockable :lock_strategy => :<%= Devise.lock_strategy %>, :unlock_strategy => :<%= Devise.unlock_strategy %>
+      # t.token_authenticatable
+
+<% for attribute in attributes -%>
+      t.<%= attribute.type %> :<%= attribute.name %>
+<% end -%>
 
       t.timestamps
     end
 
     add_index :<%= table_name %>, :email,                :unique => true
-    add_index :<%= table_name %>, :confirmation_token,   :unique => true
     add_index :<%= table_name %>, :reset_password_token, :unique => true
+    # add_index :<%= table_name %>, :confirmation_token,   :unique => true
     # add_index :<%= table_name %>, :unlock_token,         :unique => true
   end
 

data/lib/generators/devise/devise_generator.rb

@@ -0,0 +1,17 @@
+module Devise
+  module Generators
+    class DeviseGenerator < Rails::Generators::NamedBase
+      namespace "devise"
+      source_root File.expand_path("../templates", __FILE__)
+
+      desc "Generates a model with the given NAME (if one does not exist) with devise " <<
+           "configuration plus a migration file and devise routes."
+
+      hook_for :orm
+
+      def add_devise_routes
+        route "devise_for :#{table_name}"
+      end
+    end
+  end
+end

data/lib/generators/devise/install_generator.rb

@@ -0,0 +1,24 @@
+require 'active_support/secure_random'
+
+module Devise
+  module Generators
+    class InstallGenerator < Rails::Generators::Base
+      source_root File.expand_path("../templates", __FILE__)
+
+      desc "Creates a Devise initializer and copy locale files to your application."
+      class_option :orm
+
+      def copy_initializer
+        template "devise.rb", "config/initializers/devise.rb"
+      end
+
+      def copy_locale
+        copy_file "../../../../config/locales/en.yml", "config/locales/devise.en.yml"
+      end
+
+      def show_readme
+        readme "README"
+      end
+    end
+  end
+end

data/lib/generators/devise/orm_helpers.rb

@@ -0,0 +1,23 @@
+module Devise
+  module Generators
+    module OrmHelpers
+      def model_contents
+<<-CONTENT
+  # Include default devise modules. Others available are:
+  # :token_authenticatable, :confirmable, :lockable and :timeoutable
+  devise :database_authenticatable, :registerable,
+         :recoverable, :rememberable, :trackable, :validatable
+
+CONTENT
+      end
+
+      def model_exists?
+        File.exists?(File.join(destination_root, model_path))
+      end
+
+      def model_path
+        @model_path ||= File.join("app", "models", "#{file_path}.rb")
+      end
+    end
+  end
+end

data/{generators/devise_install → lib/generators/devise}/templates/README

@@ -1,3 +1,4 @@
+
 ===============================================================================
 
 Some setup you must do manually if you haven't yet:
@@ -7,17 +8,18 @@ Some setup you must do manually if you haven't yet:
 
        config.action_mailer.default_url_options = { :host => 'localhost:3000' }
 
-     This is a required Rails configuration. In production is must be the
+     This is a required Rails configuration. In production it must be the
      actual host of your application
 
-  2. Ensure you have defined root_url to *something* in your config/routes.rb:
+  2. Ensure you have defined root_url to *something* in your config/routes.rb.
+     For example:
 
-       map.root :controller => 'home'
+       root :to => "home#index"
 
- 3. Ensure you have a default layout in app/views/layouts and it shows
-     flash messages. For example:
+  3. Ensure you have flash messages in app/views/layouts/application.html.erb.
+     For example:
 
-       <p class="notice"><%= flash[:notice] %></p>
-       <p class="alert"><%= flash[:alert] %></p>
+       <p class="notice"><%= notice %></p>
+       <p class="alert"><%= alert %></p>
 
 ===============================================================================