devise 1.0.11 → 1.1.0

data/lib/devise/controllers/internal_helpers.rb

@@ -4,28 +4,19 @@ module Devise
     # included in ApplicationController since they all depend on the url being
     # accessed.
     module InternalHelpers #:nodoc:
+      extend ActiveSupport::Concern
+      include Devise::Controllers::ScopedViews
 
-      def self.included(base)
-        base.class_eval do
-          extend ScopedViews
-          unloadable
+      included do
+        helper DeviseHelper
 
-          helper_method :resource, :scope_name, :resource_name, :resource_class, :devise_mapping, :devise_controller?
-          hide_action   :resource, :scope_name, :resource_name, :resource_class, :devise_mapping, :devise_controller?
+        helpers = %w(resource scope_name resource_name
+                     resource_class devise_mapping devise_controller?)
+        hide_action *helpers
+        helper_method *helpers
 
-          skip_before_filter *Devise.mappings.keys.map { |m| :"authenticate_#{m}!" }
-          prepend_before_filter :is_devise_resource?
-        end
-      end
-
-      module ScopedViews
-        def scoped_views
-          defined?(@scoped_views) ? @scoped_views : Devise.scoped_views
-        end
-
-        def scoped_views=(value)
-          @scoped_views = value
-        end
+        prepend_before_filter :is_devise_resource?
+        skip_before_filter *Devise.mappings.keys.map { |m| :"authenticate_#{m}!" }
       end
 
       # Gets the actual resource stored in the instance variable
@@ -46,11 +37,7 @@ module Devise
 
       # Attempt to find the mapped route for devise based on request path
       def devise_mapping
-        @devise_mapping ||= begin
-          mapping   = Devise::Mapping.find_by_path(request.path)
-          mapping ||= Devise.mappings[Devise.default_scope] if Devise.use_default_scope
-          mapping
-        end
+        @devise_mapping ||= request.env["devise.mapping"]
       end
 
       # Overwrites devise_controller? to return true
@@ -62,7 +49,7 @@ module Devise
 
       # Checks whether it's a devise mapped resource or not.
       def is_devise_resource? #:nodoc:
-        raise ActionController::UnknownAction unless devise_mapping && devise_mapping.allows?(controller_name)
+        raise ActionController::UnknownAction unless devise_mapping
       end
 
       # Sets the resource creating an instance variable
@@ -71,8 +58,9 @@ module Devise
       end
 
       # Build a devise resource.
-      def build_resource
-        self.resource ||= resource_class.new(params[resource_name] || {})
+      def build_resource(hash=nil)
+        hash ||= params[resource_name] || {}
+        self.resource = resource_class.new(hash)
       end
 
       # Helper for use in before_filters where no authentication is required.
@@ -97,33 +85,14 @@ module Devise
       #
       # Please refer to README or en.yml locale file to check what messages are
       # available.
-      def set_flash_message(key, kind, now=false)
-        flash_hash = now ? flash.now : flash
-        flash_hash[key] = I18n.t(:"#{resource_name}.#{kind}",
+      def set_flash_message(key, kind)
+        flash[key] = I18n.t(:"#{resource_name}.#{kind}", :resource_name => resource_name,
                             :scope => [:devise, controller_name.to_sym], :default => kind)
       end
 
-      # Shortcut to set flash.now message. Same rules applied from set_flash_message
-      def set_now_flash_message(key, kind)
-        set_flash_message(key, kind, true)
+      def clean_up_passwords(object)
+        object.clean_up_passwords if object.respond_to?(:clean_up_passwords)
       end
-
-      # Render a view for the specified scope. Turned off by default.
-      # Accepts just :controller as option.
-      def render_with_scope(action, options={})
-        controller_name = options.delete(:controller) || self.controller_name
-
-        if self.class.scoped_views
-          begin
-            render :template => "#{controller_name}/#{devise_mapping.as}/#{action}"
-          rescue ActionView::MissingTemplate
-            render action, :controller => controller_name
-          end
-        else
-          render action, :controller => controller_name
-        end
-      end
-
     end
   end
 end

data/lib/devise/controllers/scoped_views.rb

@@ -0,0 +1,35 @@
+module Devise
+  module Controllers
+    module ScopedViews
+      extend ActiveSupport::Concern
+
+      module ClassMethods
+        def scoped_views?
+          defined?(@scoped_views) ? @scoped_views : Devise.scoped_views
+        end
+
+        def scoped_views=(value)
+          @scoped_views = value
+        end
+      end
+
+    protected
+
+      # Render a view for the specified scope. Turned off by default.
+      # Accepts just :controller as option.
+      def render_with_scope(action, options={})
+        controller_name = options.delete(:controller) || self.controller_name
+
+        if self.class.scoped_views?
+          begin
+            render :template => "#{devise_mapping.plural}/#{controller_name}/#{action}"
+          rescue ActionView::MissingTemplate
+            render :template => "#{controller_path}/#{action}"
+          end
+        else
+          render :template => "#{controller_path}/#{action}"
+        end
+      end
+    end
+  end
+end

data/lib/devise/controllers/url_helpers.rb

@@ -19,7 +19,7 @@ module Devise
     # Those helpers are added to your ApplicationController.
     module UrlHelpers
 
-      Devise::ROUTES.each do |module_name|
+      Devise::ROUTES.values.uniq.each do |module_name|
         [:path, :url].each do |path_or_url|
           actions = [ nil, :new_ ]
           actions << :edit_    if [:password, :registration].include?(module_name)

data/lib/devise/encryptors/authlogic_sha512.rb

@@ -7,7 +7,6 @@ module Devise
     # Warning: it uses Devise's stretches configuration to port Authlogic's one. Should be set to 20 in the initializer to silumate
     #  the default behavior.
     class AuthlogicSha512 < Base
-      
       # Gererates a default password digest based on salt, pepper and the
       # incoming password.
       def self.digest(password, stretches, salt, pepper)
@@ -15,7 +14,6 @@ module Devise
         stretches.times { digest = Digest::SHA512.hexdigest(digest) }
         digest
       end
-
     end
   end
 end

data/lib/devise/encryptors/base.rb

@@ -12,7 +12,7 @@ module Devise
         raise NotImplemented
       end
 
-      def self.salt
+      def self.salt(stretches)
         Devise.friendly_token
       end
     end

data/lib/devise/encryptors/bcrypt.rb

@@ -5,17 +5,15 @@ module Devise
     # = BCrypt
     # Uses the BCrypt hash algorithm to encrypt passwords.
     class Bcrypt < Base
-
       # Gererates a default password digest based on stretches, salt, pepper and the
       # incoming password. We don't strech it ourselves since BCrypt does so internally.
       def self.digest(password, stretches, salt, pepper)
         ::BCrypt::Engine.hash_secret([password, pepper].join, salt, stretches)
       end
 
-      def self.salt
-        ::BCrypt::Engine.generate_salt
+      def self.salt(stretches)
+        ::BCrypt::Engine.generate_salt(stretches)
       end
-
     end
   end
 end

data/lib/devise/encryptors/clearance_sha1.rb

@@ -7,13 +7,11 @@ module Devise
     # Warning: it uses Devise's pepper to port the concept of REST_AUTH_SITE_KEY
     # Warning: it uses Devise's stretches configuration to port the concept of REST_AUTH_DIGEST_STRETCHES
     class ClearanceSha1 < Base
-      
       # Gererates a default password digest based on salt, pepper and the
       # incoming password.
       def self.digest(password, stretches, salt, pepper)
         Digest::SHA1.hexdigest("--#{salt}--#{password}--")
       end
-
     end
   end
 end

data/lib/devise/encryptors/sha1.rb

@@ -5,7 +5,6 @@ module Devise
     # = Sha1
     # Uses the Sha1 hash algorithm to encrypt passwords.
     class Sha1 < Base
-      
       # Gererates a default password digest based on stretches, salt, pepper and the
       # incoming password.
       def self.digest(password, stretches, salt, pepper)
@@ -14,14 +13,13 @@ module Devise
         digest
       end
 
-      private
+    private
 
-        # Generate a SHA1 digest joining args. Generated token is something like
-        #   --arg1--arg2--arg3--argN--
-        def self.secure_digest(*tokens)
-          ::Digest::SHA1.hexdigest('--' << tokens.flatten.join('--') << '--')
-        end        
-      
+      # Generate a SHA1 digest joining args. Generated token is something like
+      #   --arg1--arg2--arg3--argN--
+      def self.secure_digest(*tokens)
+        ::Digest::SHA1.hexdigest('--' << tokens.flatten.join('--') << '--')
+      end
     end
   end
 end

data/lib/devise/encryptors/sha512.rb

@@ -5,7 +5,6 @@ module Devise
     # = Sha512
     # Uses the Sha512 hash algorithm to encrypt passwords.
     class Sha512 < Base
-      
       # Gererates a default password digest based on salt, pepper and the
       # incoming password.
       def self.digest(password, stretches, salt, pepper)
@@ -14,14 +13,13 @@ module Devise
         digest
       end
 
-      private
+    private
 
-        # Generate a Sha512 digest joining args. Generated token is something like
-        #   --arg1--arg2--arg3--argN--
-        def self.secure_digest(*tokens)
-          ::Digest::SHA512.hexdigest('--' << tokens.flatten.join('--') << '--')
-        end        
-      
+      # Generate a Sha512 digest joining args. Generated token is something like
+      #   --arg1--arg2--arg3--argN--
+      def self.secure_digest(*tokens)
+        ::Digest::SHA512.hexdigest('--' << tokens.flatten.join('--') << '--')
+      end
     end
   end
 end

data/lib/devise/failure_app.rb

@@ -1,72 +1,107 @@
+require "action_controller/metal"
+
 module Devise
   # Failure application that will be called every time :warden is thrown from
   # any strategy or hook. Responsible for redirect the user to the sign in
   # page based on current scope and mapping. If no scope is given, redirect
   # to the default_url.
-  class FailureApp
-    attr_reader :env
-    include Warden::Mixins::Common
+  class FailureApp < ActionController::Metal
+    include ActionController::RackDelegation
+    include ActionController::UrlFor
+    include ActionController::Redirecting
+    include Rails.application.routes.url_helpers
 
-    cattr_accessor :default_url, :default_message, :instance_writer => false
-    @@default_message = :unauthenticated
+    delegate :flash, :to => :request
 
     def self.call(env)
-      new(env).respond!
+      action(:respond).call(env)
     end
 
-    def initialize(env)
-      @env = env
+    def self.default_url_options(*args)
+      ApplicationController.default_url_options(*args)
     end
 
-    def respond!
-      options = @env['warden.options']
-      scope   = options[:scope]
+    def respond
+      if http_auth?
+        http_auth
+      elsif warden_options[:recall]
+        recall
+      else
+        redirect
+      end
+    end
 
-      redirect_path = redirect_path_for(scope)
-      query_string  = query_string_for(options)
-      store_location!(scope)
+    def http_auth
+      self.status = 401
+      self.headers["WWW-Authenticate"] = %(Basic realm=#{Devise.http_authentication_realm.inspect})
+      self.content_type = request.format.to_s
+      self.response_body = http_auth_body
+    end
 
-      headers = {}
-      headers["Location"] = redirect_path
-      headers["Location"] << "?" << query_string unless query_string.empty?
-      headers["Content-Type"] = 'text/plain'
+    def recall
+      env["PATH_INFO"]  = attempted_path
+      flash.now[:alert] = i18n_message(:invalid)
+      self.response = recall_controller.action(warden_options[:recall]).call(env)
+    end
 
-      [302, headers, ["You are being redirected to #{redirect_path}"]]
+    def redirect
+      store_location!
+      flash[:alert] = i18n_message unless flash[:notice]
+      redirect_to redirect_url
     end
 
-    # Build the proper query string based on the given message.
-    def query_string_for(options)
-      message = @env['warden'].try(:message) || options[:message] || default_message
+  protected
 
-      params = case message
-        when Symbol
-          { message => true }
-        when String
-          { :message => message }
-        else
-          {}
+    def i18n_message(default = nil)
+      message = warden.message || warden_options[:message] || default || :unauthenticated
+
+      if message.is_a?(Symbol)
+        I18n.t(:"#{scope}.#{message}", :resource_name => scope,
+               :scope => "devise.failure", :default => [message, message.to_s])
+      else
+        message.to_s
       end
+    end
 
-      Rack::Utils.build_query(params)
+    def redirect_url
+      send(:"new_#{scope}_session_path")
     end
 
-    # Build the path based on current scope.
-    def redirect_path_for(scope)
-      if mapping = Devise.mappings[scope]
-        "#{mapping.parsed_path}/#{mapping.path_names[:sign_in]}"
-      else
-        "/#{default_url}"
-      end
+    def http_auth?
+      !Devise.navigational_formats.include?(request.format.to_sym) || (request.xhr? && Devise.http_authenticatable_on_xhr)
+    end
+
+    def http_auth_body
+      method = :"to_#{request.format.to_sym}"
+      {}.respond_to?(method) ? { :error => i18n_message }.send(method) : i18n_message
+    end
+
+    def recall_controller
+      "#{params[:controller].camelize}Controller".constantize
+    end
+
+    def warden
+      env['warden']
+    end
+
+    def warden_options
+      env['warden.options']
+    end
+
+    def scope
+      @scope ||= warden_options[:scope]
+    end
+
+    def attempted_path
+      warden_options[:attempted_path]
     end
 
     # Stores requested uri to redirect the user after signing in. We cannot use
     # scoped session provided by warden here, since the user is not authenticated
     # yet, but we still need to store the uri based on scope, so different scopes
     # would never use the same uri to redirect.
-    def store_location!(scope)
-      if request && request.get? && !request.xhr?
-        session[:"#{scope}.return_to"] = request.request_uri
-      end
+    def store_location!
+      session[:"#{scope}_return_to"] = attempted_path if request.get? && !http_auth?
     end
   end
 end

data/lib/devise/hooks/activatable.rb

@@ -1,15 +1,11 @@
-# Deny user access whenever his account is not active yet.
+# Deny user access whenever his account is not active yet. All strategies that inherits from
+# Devise::Strategies::Authenticatable and uses the validate already check if the user is active?
+# before actively signing him in. However, we need this as hook to validate the user activity
+# in each request and in case the user is using other strategies beside Devise ones.
 Warden::Manager.after_set_user do |record, warden, options|
   if record && record.respond_to?(:active?) && !record.active?
     scope = options[:scope]
     warden.logout(scope)
-
-    # If winning strategy was set, this is being called after authenticate and
-    # there is no need to force a redirect.
-    if warden.winning_strategy
-      warden.winning_strategy.fail!(record.inactive_message)
-    else
-      throw :warden, :scope => scope, :message => record.inactive_message
-    end
+    throw :warden, :scope => scope, :message => record.inactive_message
   end
-end
+end

data/lib/devise/hooks/forgetable.rb

@@ -0,0 +1,11 @@
+# Before logout hook to forget the user in the given scope, if it responds
+# to forget_me! Also clear remember token to ensure the user won't be
+# remembered again. Notice that we forget the user unless the record is frozen.
+# This avoids forgetting deleted users.
+Warden::Manager.before_logout do |record, warden, options|
+  if record.respond_to?(:forget_me!)
+    record.forget_me! unless record.frozen?
+    options = record.cookie_domain? ? { :domain => record.cookie_domain } : {}
+    warden.cookies.delete("remember_#{options[:scope]}_token", options)
+  end
+end

data/lib/devise/hooks/rememberable.rb

@@ -1,33 +1,43 @@
-# After authenticate hook to verify if the user in the given scope asked to be
-# remembered while he does not sign out. Generates a new remember token for
-# that specific user and adds a cookie with this user info to sign in this user
-# automatically without asking for credentials. Refer to rememberable strategy
-# for more info.
-Warden::Manager.prepend_after_authentication do |record, warden, options|
-  scope = options[:scope]
-  remember_me = warden.params[scope].try(:fetch, :remember_me, nil)
-
-  if Devise::TRUE_VALUES.include?(remember_me) &&
-     warden.authenticated?(scope) && record.respond_to?(:remember_me!)
-    record.remember_me!
-
-    warden.response.set_cookie "remember_#{scope}_token", {
-      :value => record.class.serialize_into_cookie(record),
-      :expires => record.remember_expires_at,
-      :path => "/"
-    }
+module Devise
+  module Hooks
+    # Overwrite success! in authentication strategies allowing users to be remembered.
+    # We choose to implement this as an strategy hook instead of a warden hook to allow a specific
+    # strategy (like token authenticatable or facebook authenticatable) to turn off remember_me?
+    # cookies.
+    module Rememberable #:nodoc:
+      def success!(resource)
+        super
+
+        if succeeded? && resource.respond_to?(:remember_me!) && remember_me?
+          resource.remember_me!(extend_remember_period?)
+
+          configuration = {
+            :value => resource.class.serialize_into_cookie(resource),
+            :expires => resource.remember_expires_at,
+            :path => "/"
+          }
+
+          configuration[:domain] = resource.cookie_domain if resource.cookie_domain?
+          cookies.signed["remember_#{scope}_token"] = configuration
+        end
+      end
+
+    protected
+
+      def succeeded?
+        @result == :success
+      end
+
+      def extend_remember_period?
+        false
+      end
+
+      def remember_me?
+        valid_params? && Devise::TRUE_VALUES.include?(params_auth_hash[:remember_me])
+      end
+    end
   end
 end
 
-# Before logout hook to forget the user in the given scope, only if rememberable
-# is activated for this scope. Also clear remember token to ensure the user
-# won't be remembered again.
-# Notice that we forget the user if the record is frozen. This usually means the
-# user was just deleted.
-Warden::Manager.before_logout do |record, warden, options|
-  scope = options[:scope]
-  if record.respond_to?(:forget_me!)
-    record.forget_me! unless record.frozen?
-    warden.response.delete_cookie "remember_#{scope}_token", :path => "/"
-  end
-end
+Devise::Strategies::Authenticatable.send :include, Devise::Hooks::Rememberable
+

data/lib/devise/hooks/timeoutable.rb

@@ -1,16 +1,20 @@
-# Each time a record is set we check whether it's session has already timed out
+# Each time a record is set we check whether its session has already timed out
 # or not, based on last request time. If so, the record is logged out and
 # redirected to the sign in page. Also, each time the request comes and the
 # record is set, we set the last request time inside it's scoped session to
 # verify timeout in the following request.
 Warden::Manager.after_set_user do |record, warden, options|
   scope = options[:scope]
+
   if record && record.respond_to?(:timedout?) && warden.authenticated?(scope)
     last_request_at = warden.session(scope)['last_request_at']
 
     if record.timedout?(last_request_at)
-      warden.logout(scope)
-      throw :warden, :scope => scope, :message => :timeout
+      path_checker = Devise::PathChecker.new(warden.env, scope)
+      unless path_checker.signing_out?
+        warden.logout(scope)
+        throw :warden, :scope => scope, :message => :timeout
+      end
     end
 
     warden.session(scope)['last_request_at'] = Time.now.utc

data/lib/devise/hooks/trackable.rb

@@ -1,18 +1,9 @@
 # After each sign in, update sign in time, sign in count and sign in IP.
+# This is only triggered when the user is explicitly set (with set_user)
+# and on authentication. Retrieving the user from session (:fetch) does
+# not trigger it.
 Warden::Manager.after_set_user :except => :fetch do |record, warden, options|
-  scope = options[:scope]
-  if Devise.mappings[scope].try(:trackable?) && warden.authenticated?(scope)
-    old_current, new_current  = record.current_sign_in_at, Time.now
-    record.last_sign_in_at    = old_current || new_current
-    record.current_sign_in_at = new_current
-
-    old_current, new_current  = record.current_sign_in_ip, warden.request.remote_ip
-    record.last_sign_in_ip    = old_current || new_current
-    record.current_sign_in_ip = new_current
-
-    record.sign_in_count ||= 0
-    record.sign_in_count += 1
-
-    record.save(false)
+  if record.respond_to?(:update_tracked_fields!) && warden.authenticated?(options[:scope])
+    record.update_tracked_fields!(warden.request)
   end
 end