devise 1.0.11 → 1.1.0

data/lib/devise/models/recoverable.rb

@@ -14,11 +14,7 @@ module Devise
     #   # creates a new token and send it with instructions about how to reset the password
     #   User.find(1).send_reset_password_instructions
     module Recoverable
-      def self.included(base)
-        base.class_eval do
-          extend ClassMethods
-        end
-      end
+      extend ActiveSupport::Concern
 
       # Update password saving the record and clearing token. Returns true if
       # the passwords are valid and the record was saved, false otherwise.
@@ -32,20 +28,20 @@ module Devise
       # Resets reset password token and send reset password instructions by email
       def send_reset_password_instructions
         generate_reset_password_token!
-        ::DeviseMailer.deliver_reset_password_instructions(self)
+        ::Devise.mailer.reset_password_instructions(self).deliver
       end
 
       protected
 
         # Generates a new random token for reset password
         def generate_reset_password_token
-          self.reset_password_token = Devise.friendly_token
+          self.reset_password_token = self.class.reset_password_token
         end
 
         # Resets the reset password token with and save the record without
         # validating
         def generate_reset_password_token!
-          generate_reset_password_token && save(false)
+          generate_reset_password_token && save(:validate => false)
         end
 
         # Removes reset_password token
@@ -60,10 +56,15 @@ module Devise
         # Attributes must contain the user email
         def send_reset_password_instructions(attributes={})
           recoverable = find_or_initialize_with_error_by(:email, attributes[:email], :not_found)
-          recoverable.send_reset_password_instructions unless recoverable.new_record?
+          recoverable.send_reset_password_instructions if recoverable.persisted?
           recoverable
         end
 
+        # Generate a token checking if one does not already exist in the database.
+        def reset_password_token
+          generate_token(:reset_password_token)
+        end
+
         # Attempt to find a user by it's reset_password_token to reset it's
         # password. If a user is found, reset it's password and automatically
         # try saving the record. If not user is found, returns a new user
@@ -71,7 +72,7 @@ module Devise
         # Attributes must contain reset_password_token, password and confirmation
         def reset_password_by_token(attributes={})
           recoverable = find_or_initialize_with_error_by(:reset_password_token, attributes[:reset_password_token])
-          recoverable.reset_password!(attributes[:password], attributes[:password_confirmation]) unless recoverable.new_record?
+          recoverable.reset_password!(attributes[:password], attributes[:password_confirmation]) if recoverable.persisted?
           recoverable
         end
       end

data/lib/devise/models/rememberable.rb

@@ -1,5 +1,6 @@
 require 'devise/strategies/rememberable'
 require 'devise/hooks/rememberable'
+require 'devise/hooks/forgetable'
 
 module Devise
   module Models
@@ -17,7 +18,15 @@ module Devise
     #                 blocked and will have to enter his credentials again.
     #                 This configuration is also used to calculate the expires
     #                 time for the cookie created to remember the user.
-    #                 By default remember_for is 2.weeks.
+    #                 2.weeks by default.
+    #
+    #   remember_across_browsers: if true, a valid remember token can be
+    #                             re-used between multiple browsers.
+    #                             True by default.
+    #
+    #   extend_remember_period: if true, extends the user's remember period
+    #                           when remembered via cookie.
+    #                           False by default.
     #
     # Examples:
     #
@@ -30,21 +39,19 @@ module Devise
     #   # lookup the user based on the incoming cookie information
     #   User.serialize_from_cookie(cookie_string)
     module Rememberable
+      extend ActiveSupport::Concern
 
-      def self.included(base)
-        base.class_eval do
-          extend ClassMethods
-
-          # Remember me option available in after_authentication hook.
-          attr_accessor :remember_me
-        end
+      included do
+        # Remember me option available in after_authentication hook.
+        attr_accessor :remember_me
       end
 
-      # Generate a new remember token and save the record without validations.
-      def remember_me!
-        self.remember_token = Devise.friendly_token
-        self.remember_created_at = Time.now.utc
-        save(false)
+      # Generate a new remember token and save the record without validations
+      # unless remember_across_browsers is true and the user already has a valid token.
+      def remember_me!(extend_period=false)
+        self.remember_token = self.class.remember_token if generate_remember_token?
+        self.remember_created_at = Time.now.utc if generate_remember_timestamp?(extend_period)
+        save(:validate => false)
       end
 
       # Removes the remember token only if it exists, and save the record
@@ -53,18 +60,13 @@ module Devise
         if remember_token
           self.remember_token = nil
           self.remember_created_at = nil
-          save(false)
+          save(:validate => false)
         end
       end
 
-      # Checks whether the incoming token matches or not with the record token.
-      def valid_remember_token?(token)
-        remember_token && !remember_expired? && remember_token == token
-      end
-
       # Remember token should be expired if expiration time not overpass now.
       def remember_expired?
-        remember_expires_at <= Time.now.utc
+        remember_created_at && (remember_expires_at <= Time.now.utc)
       end
 
       # Remember token expires at created time + remember_for configuration
@@ -72,20 +74,48 @@ module Devise
         remember_created_at + self.class.remember_for
       end
 
+      def cookie_domain
+        self.class.cookie_domain
+      end
+
+      def cookie_domain?
+        self.class.cookie_domain != false
+      end
+
+    protected
+
+      # Generate a token unless remember_across_browsers is true and there is
+      # an existing remember_token or the existing remember_token has expried.
+      def generate_remember_token? #:nodoc:
+        !(self.class.remember_across_browsers && remember_token) || remember_expired?
+      end
+
+      # Generate a timestamp if extend_remember_period is true, if no remember_token
+      # exists, or if an existing remember token has expired.
+      def generate_remember_timestamp?(extend_period) #:nodoc:
+        extend_period || remember_created_at.nil? || remember_expired?
+      end
+
       module ClassMethods
         # Create the cookie key using the record id and remember_token
         def serialize_into_cookie(record)
-          "#{record.id}::#{record.remember_token}"
+          [record.id, record.remember_token]
         end
 
         # Recreate the user based on the stored cookie
-        def serialize_from_cookie(cookie)
-          record_id, record_token = cookie.split('::')
-          record = find(:first, :conditions => { :id => record_id }) if record_id
-          record if record.try(:valid_remember_token?, record_token)
+        def serialize_from_cookie(id, remember_token)
+          conditions = { :id => id, :remember_token => remember_token }
+          record = find(:first, :conditions => conditions)
+          record if record && !record.remember_expired?
+        end
+
+        # Generate a token checking if one does not already exist in the database.
+        def remember_token
+          generate_token(:remember_token)
         end
 
-        Devise::Models.config(self, :remember_for)
+        Devise::Models.config(self, :remember_for, :remember_across_browsers,
+          :extend_remember_period, :cookie_domain)
       end
     end
   end

data/lib/devise/models/timeoutable.rb

@@ -11,9 +11,7 @@ module Devise
     #
     #   timeout_in: the time you want to timeout the user session without activity.
     module Timeoutable
-      def self.included(base)
-        base.extend ClassMethods
-      end
+      extend ActiveSupport::Concern
 
       # Checks whether the user session has expired based on configured time.
       def timedout?(last_access)

data/lib/devise/models/token_authenticatable.rb

@@ -2,8 +2,11 @@ require 'devise/strategies/token_authenticatable'
 
 module Devise
   module Models
-    # Token Authenticatable Module, responsible for generate authentication token and validating
-    # authenticity of a user while signing in using an authentication token (say follows an URL).
+    # The TokenAuthenticatable module is responsible for generating an authentication token and
+    # validating the authenticity of the same while signing in.
+    #
+    # This module only provides a few helpers to help you manage the token. Creating and resetting
+    # the token is your responsibility.
     #
     # == Configuration:
     #
@@ -12,18 +15,8 @@ module Devise
     #
     # +token_authentication_key+ - Defines name of the authentication token params key. E.g. /users/sign_in?some_key=...
     #
-    # == Examples:
-    #
-    #    User.authenticate_with_token(:auth_token => '123456789')           # returns authenticated user or nil
-    #    User.find(1).valid_authentication_token?('rI1t6PKQ8yP7VetgwdybB')  # returns true/false
-    #
     module TokenAuthenticatable
-      def self.included(base)
-        base.class_eval do
-          extend ClassMethods
-          before_save :ensure_authentication_token
-        end
-      end
+      extend ActiveSupport::Concern
 
       # Generate new authentication token (a.k.a. "single access token").
       def reset_authentication_token
@@ -33,7 +26,7 @@ module Devise
       # Generate new authentication token and save the record.
       def reset_authentication_token!
         reset_authentication_token
-        self.save
+        self.save(:validate => false)
       end
 
       # Generate authentication token unless already exists.
@@ -46,43 +39,21 @@ module Devise
         self.reset_authentication_token! if self.authentication_token.blank?
       end
 
-      # Verifies whether an +incoming_authentication_token+ (i.e. from single access URL)
-      # is the user authentication token.
-      def valid_authentication_token?(incoming_auth_token)
-        incoming_auth_token.present? && incoming_auth_token == self.authentication_token
+      # Hook called after token authentication.
+      def after_token_authentication
       end
 
       module ClassMethods
-        ::Devise::Models.config(self, :token_authentication_key)
-
-        # Authenticate a user based on authentication token.
-        def authenticate_with_token(attributes)
-          token = attributes[self.token_authentication_key]
-          resource = self.find_for_token_authentication(token)
-          resource if resource.try(:valid_authentication_token?, token)
+        def find_for_token_authentication(conditions)
+          find_for_authentication(:authentication_token => conditions[token_authentication_key])
         end
 
+        # Generate a token checking if one does not already exist in the database.
         def authentication_token
-          ::Devise.friendly_token
+          generate_token(:authentication_token)
         end
 
-        protected
-
-          # Find first record based on conditions given (ie by the sign in form).
-          # Overwrite to add customized conditions, create a join, or maybe use a
-          # namedscope to filter records while authenticating.
-          #
-          # == Example:
-          #
-          #   def self.find_for_token_authentication(token, conditions = {})
-          #     conditions = {:active => true}
-          #     self.find_by_authentication_token(token, :conditions => conditions)
-          #   end
-          #
-          def find_for_token_authentication(token)
-            self.find(:first, :conditions => { :authentication_token => token})
-          end
-
+        ::Devise::Models.config(self, :token_authentication_key)
       end
     end
   end

data/lib/devise/models/trackable.rb

@@ -11,6 +11,20 @@ module Devise
     # * last_sign_in_at    - Holds the remote ip of the previous sign in
     #
     module Trackable
+      def update_tracked_fields!(request)
+        old_current, new_current = self.current_sign_in_at, Time.now
+        self.last_sign_in_at     = old_current || new_current
+        self.current_sign_in_at  = new_current
+
+        old_current, new_current = self.current_sign_in_ip, request.remote_ip
+        self.last_sign_in_ip     = old_current || new_current
+        self.current_sign_in_ip  = new_current
+
+        self.sign_in_count ||= 0
+        self.sign_in_count += 1
+
+        save(:validate => false)
+      end
     end
   end
 end

data/lib/devise/models/validatable.rb

@@ -11,17 +11,18 @@ module Devise
                       :validates_confirmation_of, :validates_length_of ].freeze
 
       def self.included(base)
+        base.extend ClassMethods
         assert_validations_api!(base)
 
         base.class_eval do
           validates_presence_of   :email
           validates_uniqueness_of :email, :scope => authentication_keys[1..-1], :case_sensitive => false, :allow_blank => true
-          validates_format_of     :email, :with  => EMAIL_REGEX, :allow_blank => true
+          validates_format_of     :email, :with  => email_regexp, :allow_blank => true
 
           with_options :if => :password_required? do |v|
             v.validates_presence_of     :password
             v.validates_confirmation_of :password
-            v.validates_length_of       :password, :within => 6..20, :allow_blank => true
+            v.validates_length_of       :password, :within => password_length, :allow_blank => true
           end
         end
       end
@@ -34,6 +35,19 @@ module Devise
                 "to the following methods: #{unavailable_validations.to_sentence}."
         end
       end
+
+    protected
+
+      # Checks whether a password is needed or not. For validations only.
+      # Passwords are always required if it's a new record, or if the password
+      # or confirmation are being set somewhere.
+      def password_required?
+        !persisted? || !password.nil? || !password_confirmation.nil?
+      end
+
+      module ClassMethods
+        Devise::Models.config(self, :email_regexp, :password_length)
+      end
     end
   end
 end

data/lib/devise/models.rb

@@ -1,16 +1,5 @@
 module Devise
   module Models
-    autoload :Activatable, 'devise/models/activatable'
-    autoload :DatabaseAuthenticatable, 'devise/models/database_authenticatable'
-    autoload :Confirmable, 'devise/models/confirmable'
-    autoload :Lockable, 'devise/models/lockable'
-    autoload :Recoverable, 'devise/models/recoverable'
-    autoload :Rememberable, 'devise/models/rememberable'
-    autoload :Registerable, 'devise/models/registerable'
-    autoload :Timeoutable, 'devise/models/timeoutable'
-    autoload :Trackable, 'devise/models/trackable'
-    autoload :Validatable, 'devise/models/validatable'
-
     # Creates configuration values for Devise and for the given module.
     #
     #   Devise::Models.config(Devise::Authenticable, :stretches, 10)
@@ -49,14 +38,14 @@ module Devise
 
     # Include the chosen devise modules in your model:
     #
-    #   devise :authenticatable, :confirmable, :recoverable
+    #   devise :database_authenticatable, :confirmable, :recoverable
     #
     # You can also give any of the devise configuration values in form of a hash,
     # with specific values for this model. Please check your Devise initializer
     # for a complete description on those values.
     #
     def devise(*modules)
-      raise "You need to give at least one Devise module" if modules.empty?
+      include Devise::Models::Authenticatable
       options = modules.extract_options!
 
       if modules.delete(:authenticatable)
@@ -64,54 +53,28 @@ module Devise
         modules << :database_authenticatable
       end
 
-      @devise_modules = Devise::ALL & modules.map(&:to_sym).uniq
-
-      Devise.orm_class.included_modules_hook(self) do
-        devise_modules.each do |m|
-          include Devise::Models.const_get(m.to_s.classify)
-        end
-
-        options.each { |key, value| send(:"#{key}=", value) }
+      if modules.delete(:activatable)
+        ActiveSupport::Deprecation.warn ":activatable as module is deprecated. It's included in your model by default.", caller
       end
-    end
-
-    # Stores all modules included inside the model, so we are able to verify
-    # which routes are needed.
-    def devise_modules
-      @devise_modules ||= []
-    end
 
-    # Find an initialize a record setting an error if it can't be found.
-    def find_or_initialize_with_error_by(attribute, value, error=:invalid)
-      if value.present?
-        conditions = { attribute => value }
-        record = find(:first, :conditions => conditions)
+      if modules.delete(:http_authenticatable)
+        ActiveSupport::Deprecation.warn ":http_authenticatable as module is deprecated and is on by default. Revert by setting :http_authenticatable => false.", caller
       end
 
-      unless record
-        record = new
+      self.devise_modules += Devise::ALL & modules.map(&:to_sym).uniq
 
-        if value.present?
-          record.send(:"#{attribute}=", value)
-        else
-          error, skip_default = :blank, true
-        end
-
-        add_error_on(record, attribute, error, !skip_default)
+      devise_modules_hook! do
+        devise_modules.each { |m| include Devise::Models.const_get(m.to_s.classify) }
+        options.each { |key, value| send(:"#{key}=", value) }
       end
-
-      record
     end
 
-    # Wraps add error logic in a method that works for different frameworks.
-    def add_error_on(record, attribute, error, add_default=true)
-      options = add_default ? { :default => error.to_s.gsub("_", " ") } : {}
-
-      begin
-        record.errors.add(attribute, error, options)
-      rescue ArgumentError
-        record.errors.add(attribute, error.to_s.gsub("_", " "))
-      end
+    # The hook which is called inside devise. So your ORM can include devise
+    # compatibility stuff.
+    def devise_modules_hook!
+      yield
     end
   end
 end
+
+require 'devise/models/authenticatable'

data/lib/devise/modules.rb

@@ -0,0 +1,23 @@
+require 'active_support/core_ext/object/with_options'
+
+Devise.with_options :model => true do |d|
+  # Strategies first
+  d.with_options :strategy => true do |s|      
+    s.add_module :database_authenticatable, :controller => :sessions, :route => :session
+    s.add_module :token_authenticatable,    :controller => :sessions, :route => :session
+    s.add_module :rememberable
+  end
+
+  # Misc after   
+  d.add_module :recoverable,  :controller => :passwords,     :route => :password
+  d.add_module :registerable, :controller => :registrations, :route => :registration
+  d.add_module :validatable
+
+  # The ones which can sign out after
+  d.add_module :confirmable,  :controller => :confirmations, :route => :confirmation
+  d.add_module :lockable,     :controller => :unlocks,       :route => :unlock
+  d.add_module :timeoutable
+
+  # Stats for last, so we make sure the user is really signed in
+  d.add_module :trackable
+end

data/lib/devise/orm/active_record.rb

@@ -3,7 +3,7 @@ module Devise
     # This module contains some helpers and handle schema (migrations):
     #
     #   create_table :accounts do |t|
-    #     t.authenticatable
+    #     t.database_authenticatable
     #     t.confirmable
     #     t.recoverable
     #     t.rememberable
@@ -19,23 +19,18 @@ module Devise
     #   add_index "accounts", ["reset_password_token"], :name => "reset_password_token", :unique => true
     #
     module ActiveRecord
-      # Required ORM hook. Just yield the given block in ActiveRecord.
-      def self.included_modules_hook(klass)
-        yield
-      end
-
-      include Devise::Schema
+      module Schema
+        include Devise::Schema
 
-      # Tell how to apply schema methods.
-      def apply_schema(name, type, options={})
-        column name, type.to_s.downcase.to_sym, options
+        # Tell how to apply schema methods.
+        def apply_devise_schema(name, type, options={})
+          column name, type.to_s.downcase.to_sym, options
+        end
       end
     end
   end
 end
 
-if defined?(ActiveRecord)
-  ActiveRecord::Base.extend Devise::Models
-  ActiveRecord::ConnectionAdapters::Table.send :include, Devise::Orm::ActiveRecord
-  ActiveRecord::ConnectionAdapters::TableDefinition.send :include, Devise::Orm::ActiveRecord
-end
+ActiveRecord::Base.extend Devise::Models
+ActiveRecord::ConnectionAdapters::Table.send :include, Devise::Orm::ActiveRecord::Schema
+ActiveRecord::ConnectionAdapters::TableDefinition.send :include, Devise::Orm::ActiveRecord::Schema

data/lib/devise/orm/mongoid.rb

@@ -0,0 +1,29 @@
+module Devise
+  module Orm
+    module Mongoid
+      module Hook
+        def devise_modules_hook!
+          extend Schema
+          yield
+          return unless Devise.apply_schema
+          devise_modules.each { |m| send(m) if respond_to?(m, true) }
+        end
+      end
+
+      module Schema
+        include Devise::Schema
+
+        # Tell how to apply schema methods
+        def apply_devise_schema(name, type, options={})
+          type = Time if type == DateTime
+          field name, { :type => type }.merge(options)
+        end
+      end
+    end
+  end
+end
+
+Mongoid::Document::ClassMethods.class_eval do
+  include Devise::Models
+  include Devise::Orm::Mongoid::Hook
+end

data/lib/devise/path_checker.rb

@@ -0,0 +1,18 @@
+module Devise
+  class PathChecker
+    include Rails.application.routes.url_helpers
+
+    def self.default_url_options(*args)
+      ApplicationController.default_url_options(*args)
+    end
+
+    def initialize(env, scope)
+      @current_path = "/#{env["SCRIPT_NAME"]}/#{env["PATH_INFO"]}".squeeze("/")
+      @scope = scope
+    end
+
+    def signing_out?
+      @current_path == send("destroy_#{@scope}_session_path")
+    end
+  end
+end