devise 1.1.3 → 1.2.0

data/lib/devise/controllers/scoped_views.rb

@@ -17,17 +17,15 @@ module Devise
 
       # Render a view for the specified scope. Turned off by default.
       # Accepts just :controller as option.
-      def render_with_scope(action, options={})
-        controller_name = options.delete(:controller) || self.controller_name
-
+      def render_with_scope(action, path=self.controller_path)
         if self.class.scoped_views?
           begin
-            render :template => "#{devise_mapping.plural}/#{controller_name}/#{action}"
+            render :template => "#{devise_mapping.scoped_path}/#{path.split("/").last}/#{action}"
           rescue ActionView::MissingTemplate
-            render :template => "#{controller_path}/#{action}"
+            render :template => "#{path}/#{action}"
           end
         else
-          render :template => "#{controller_path}/#{action}"
+          render :template => "#{path}/#{action}"
         end
       end
     end

data/lib/devise/controllers/url_helpers.rb

@@ -19,13 +19,11 @@ module Devise
     # Those helpers are added to your ApplicationController.
     module UrlHelpers
 
-      Devise::ROUTES.values.uniq.each do |module_name|
+      Devise::URL_HELPERS.each do |module_name, actions|
         [:path, :url].each do |path_or_url|
-          actions = [ nil, :new_ ]
-          actions << :edit_    if [:password, :registration].include?(module_name)
-          actions << :destroy_ if [:session].include?(module_name)
-
           actions.each do |action|
+            action = action ? "#{action}_" : ""
+
             class_eval <<-URL_HELPERS, __FILE__, __LINE__ + 1
               def #{action}#{module_name}_#{path_or_url}(resource_or_scope, *args)
                 scope = Devise::Mapping.find_scope!(resource_or_scope)

data/lib/devise/encryptors/authlogic_sha512.rb

@@ -4,7 +4,7 @@ module Devise
   module Encryptors
     # = AuthlogicSha512
     # Simulates Authlogic's default encryption mechanism.
-    # Warning: it uses Devise's stretches configuration to port Authlogic's one. Should be set to 20 in the initializer to silumate
+    # Warning: it uses Devise's stretches configuration to port Authlogic's one. Should be set to 20 in the initializer to simulate
     #  the default behavior.
     class AuthlogicSha512 < Base
       # Gererates a default password digest based on salt, pepper and the

data/lib/devise/encryptors/base.rb

@@ -13,7 +13,7 @@ module Devise
       end
 
       def self.salt(stretches)
-        Devise.friendly_token
+        Devise.friendly_token[0,20]
       end
     end
   end

data/lib/devise/encryptors/restful_authentication_sha1.rb

@@ -5,10 +5,10 @@ module Devise
     # = RestfulAuthenticationSha1
     # Simulates Restful Authentication's default encryption mechanism.
     # Warning: it uses Devise's pepper to port the concept of REST_AUTH_SITE_KEY
-    # Warning: it uses Devise's stretches configuration to port the concept of REST_AUTH_DIGEST_STRETCHES. Should be set to 10 in 
-    # the initializer to silumate the default behavior.
+    # Warning: it uses Devise's stretches configuration to port the concept of REST_AUTH_DIGEST_STRETCHES. Should be set to 10 in
+    # the initializer to simulate the default behavior.
     class RestfulAuthenticationSha1 < Base
-      
+
       # Gererates a default password digest based on salt, pepper and the
       # incoming password.
       def self.digest(password, stretches, salt, pepper)
@@ -19,4 +19,4 @@ module Devise
 
     end
   end
-end
+end

data/lib/devise/failure_app.rb

@@ -33,7 +33,7 @@ module Devise
 
     def http_auth
       self.status = 401
-      self.headers["WWW-Authenticate"] = %(Basic realm=#{Devise.http_authentication_realm.inspect})
+      self.headers["WWW-Authenticate"] = %(Basic realm=#{Devise.http_authentication_realm.inspect}) if http_auth_header?
       self.content_type = request.format.to_s
       self.response_body = http_auth_body
     end
@@ -41,12 +41,12 @@ module Devise
     def recall
       env["PATH_INFO"]  = attempted_path
       flash.now[:alert] = i18n_message(:invalid)
-      self.response = recall_controller.action(warden_options[:recall]).call(env)
+      self.response = recall_app(warden_options[:recall]).call(env)
     end
 
     def redirect
       store_location!
-      flash[:alert] = i18n_message unless flash[:notice]
+      flash[:alert] = i18n_message
       redirect_to redirect_url
     end
 
@@ -64,20 +64,44 @@ module Devise
     end
 
     def redirect_url
-      send(:"new_#{scope}_session_path")
+      if request_format == :html
+        send(:"new_#{scope}_session_path")
+      else
+        send(:"new_#{scope}_session_path", :format => request_format)
+      end
     end
 
+    # Choose whether we should respond in a http authentication fashion,
+    # including 401 and optional headers.
+    #
+    # This method allows the user to explicitly disable http authentication
+    # on ajax requests in case they want to redirect on failures instead of
+    # handling the errors on their own. This is useful in case your ajax API
+    # is the same as your public API and uses a format like JSON (so you
+    # cannot mark JSON as a navigational format).
     def http_auth?
-      !Devise.navigational_formats.include?(request.format.to_sym) || (request.xhr? && Devise.http_authenticatable_on_xhr)
+      if request.xhr?
+        Devise.http_authenticatable_on_xhr
+      else
+        !(request_format && Devise.navigational_formats.include?(request_format))
+      end
+    end
+
+    # It does not make sense to send authenticate headers in ajax requests
+    # or if the user disabled them.
+    def http_auth_header?
+      Devise.mappings[scope].to.http_authenticatable && !request.xhr?
     end
 
     def http_auth_body
-      method = :"to_#{request.format.to_sym}"
+      return i18n_message unless request_format
+      method = "to_#{request_format}"
       {}.respond_to?(method) ? { :error => i18n_message }.send(method) : i18n_message
     end
 
-    def recall_controller
-      "#{params[:controller].camelize}Controller".constantize
+    def recall_app(app)
+      controller, action = app.split("#")
+      "#{controller.camelize}Controller".constantize.action(action)
     end
 
     def warden
@@ -89,7 +113,7 @@ module Devise
     end
 
     def scope
-      @scope ||= warden_options[:scope]
+      @scope ||= warden_options[:scope] || Devise.default_scope
     end
 
     def attempted_path
@@ -101,7 +125,19 @@ module Devise
     # yet, but we still need to store the uri based on scope, so different scopes
     # would never use the same uri to redirect.
     def store_location!
-      session[:"#{scope}_return_to"] = attempted_path if request.get? && !http_auth?
+      session["#{scope}_return_to"] = attempted_path if request.get? && !http_auth?
+    end
+
+    MIME_REFERENCES = Mime::HTML.respond_to?(:ref)
+
+    def request_format
+      @request_format ||= if request.format.respond_to?(:ref)
+        request.format.ref
+      elsif MIME_REFERENCES
+        request.format
+      else # Rails < 3.0.4
+        request.format.to_sym
+      end
     end
   end
 end

data/lib/devise/hooks/activatable.rb

@@ -1,9 +1,9 @@
 # Deny user access whenever his account is not active yet. All strategies that inherits from
-# Devise::Strategies::Authenticatable and uses the validate already check if the user is active?
+# Devise::Strategies::Authenticatable and uses the validate already check if the user is active_for_authentication?
 # before actively signing him in. However, we need this as hook to validate the user activity
 # in each request and in case the user is using other strategies beside Devise ones.
 Warden::Manager.after_set_user do |record, warden, options|
-  if record && record.respond_to?(:active?) && !record.active?
+  if record && record.respond_to?(:active_for_authentication?) && !record.active_for_authentication?
     scope = options[:scope]
     warden.logout(scope)
     throw :warden, :scope => scope, :message => record.inactive_message

data/lib/devise/hooks/forgetable.rb

@@ -4,8 +4,6 @@
 # This avoids forgetting deleted users.
 Warden::Manager.before_logout do |record, warden, options|
   if record.respond_to?(:forget_me!)
-    record.forget_me! unless record.frozen?
-    cookie_options = record.cookie_domain? ? { :domain => record.cookie_domain } : {}
-    warden.cookies.delete("remember_#{options[:scope]}_token", cookie_options)
+    Devise::Controllers::Rememberable::Proxy.new(warden).forget_me(record)
   end
 end

data/lib/devise/hooks/rememberable.rb

@@ -1,43 +1,6 @@
-module Devise
-  module Hooks
-    # Overwrite success! in authentication strategies allowing users to be remembered.
-    # We choose to implement this as an strategy hook instead of a warden hook to allow a specific
-    # strategy (like token authenticatable or facebook authenticatable) to turn off remember_me?
-    # cookies.
-    module Rememberable #:nodoc:
-      def success!(resource)
-        super
-
-        if succeeded? && resource.respond_to?(:remember_me!) && remember_me?
-          resource.remember_me!(extend_remember_period?)
-
-          configuration = {
-            :value => resource.class.serialize_into_cookie(resource),
-            :expires => resource.remember_expires_at,
-            :path => "/"
-          }
-
-          configuration[:domain] = resource.cookie_domain if resource.cookie_domain?
-          cookies.signed["remember_#{scope}_token"] = configuration
-        end
-      end
-
-    protected
-
-      def succeeded?
-        @result == :success
-      end
-
-      def extend_remember_period?
-        false
-      end
-
-      def remember_me?
-        valid_params? && Devise::TRUE_VALUES.include?(params_auth_hash[:remember_me])
-      end
-    end
+Warden::Manager.after_set_user :except => :fetch do |record, warden, options|
+  scope = options[:scope]
+  if record.respond_to?(:remember_me) && record.remember_me && warden.authenticated?(scope)
+    Devise::Controllers::Rememberable::Proxy.new(warden).remember_me(record)
   end
-end
-
-Devise::Strategies::Authenticatable.send :include, Devise::Hooks::Rememberable
-
+end

data/lib/devise/hooks/timeoutable.rb

@@ -6,7 +6,7 @@
 Warden::Manager.after_set_user do |record, warden, options|
   scope = options[:scope]
 
-  if record && record.respond_to?(:timedout?) && warden.authenticated?(scope)
+  if record && record.respond_to?(:timedout?) && warden.authenticated?(scope) && options[:store] != false
     last_request_at = warden.session(scope)['last_request_at']
 
     if record.timedout?(last_request_at)

data/lib/devise/mapping.rb

@@ -22,7 +22,7 @@ module Devise
   #   # is the modules included in the class
   #
   class Mapping #:nodoc:
-    attr_reader :singular, :plural, :path, :controllers, :path_names, :class_name
+    attr_reader :singular, :scoped_path, :path, :controllers, :path_names, :class_name, :sign_out_via
     alias :name :singular
 
     # Receives an object and find a scope for it. If a scope cannot be found,
@@ -37,15 +37,20 @@ module Devise
         Devise.mappings.each_value { |m| return m.name if duck.is_a?(m.to) }
       end
 
-      raise "Could not find a valid mapping for #{duck}"
+      raise "Could not find a valid mapping for #{duck.inspect}"
+    end
+
+    def self.find_by_path!(path, path_type=:fullpath)
+      Devise.mappings.each_value { |m| return m if path.include?(m.send(path_type)) }
+      raise "Could not find a valid mapping for path #{path.inspect}"
     end
 
     def initialize(name, options) #:nodoc:
-      @plural   = (options[:as] ? "#{options[:as]}_#{name}" : name).to_sym
-      @singular = (options[:singular] || @plural.to_s.singularize).to_sym
+      @scoped_path = options[:as] ? "#{options[:as]}/#{name}" : name.to_s
+      @singular = (options[:singular] || @scoped_path.tr('/', '_').singularize).to_sym
 
       @class_name = (options[:class_name] || name.to_s.classify).to_s
-      @ref = ActiveSupport::Dependencies.ref(@class_name)
+      @ref = Devise.ref(@class_name)
 
       @path = (options[:path] || name).to_s
       @path_prefix = options[:path_prefix]
@@ -57,6 +62,8 @@ module Devise
       @path_names = Hash.new { |h,k| h[k] = k.to_s }
       @path_names.merge!(:registration => "")
       @path_names.merge!(options[:path_names] || {})
+
+      @sign_out_via = options[:sign_out_via] || Devise.sign_out_via
     end
 
     # Return modules for the mapping.
@@ -66,7 +73,11 @@ module Devise
 
     # Gives the class the mapping points to.
     def to
-      @ref.get
+      if defined?(ActiveSupport::Dependencies::ClassCache)
+        @ref.get @class_name
+      else
+        @ref.get
+      end
     end
 
     def strategies
@@ -82,7 +93,7 @@ module Devise
     end
 
     def fullpath
-      "#{@path_prefix}/#{@path}".squeeze("/")
+      "/#{@path_prefix}/#{@path}".squeeze("/")
     end
 
     # Create magic predicates for verifying what module is activated by this map.

data/lib/devise/models/authenticatable.rb

@@ -2,34 +2,41 @@ require 'devise/hooks/activatable'
 
 module Devise
   module Models
-    # Authenticable module. Holds common settings for authentication.
+    # Authenticatable module. Holds common settings for authentication.
     #
-    # == Configuration:
+    # == Options
     #
-    # You can overwrite configuration values by setting in globally in Devise,
-    # using devise method or overwriting the respective instance method.
+    # Authenticatable adds the following options to devise_for:
     #
-    #   authentication_keys: parameters used for authentication. By default [:email].
+    #   * +authentication_keys+: parameters used for authentication. By default [:email].
     #
-    #   http_authenticatable: if this model allows http authentication. By default true.
-    #   It also accepts an array specifying the strategies that should allow http.
+    #   * +request_keys+: parameters from the request object used for authentication.
+    #     By specifying a symbol (which should be a request method), it will automatically be
+    #     passed to find_for_authentication method and considered in your model lookup.
     #
-    #   params_authenticatable: if this model allows authentication through request params. By default true.
-    #   It also accepts an array specifying the strategies that should allow params authentication.
+    #     For instance, if you set :request_keys to [:subdomain], :subdomain will be considered
+    #     as key on authentication. This can also be a hash where the value is a boolean expliciting
+    #     if the value is required or not.
     #
-    # == Active?
+    #   * +http_authenticatable+: if this model allows http authentication. By default true.
+    #     It also accepts an array specifying the strategies that should allow http.
     #
-    # Before authenticating an user and in each request, Devise checks if your model is active by
-    # calling model.active?. This method is overwriten by other devise modules. For instance,
-    # :confirmable overwrites .active? to only return true if your model was confirmed.
+    #   * +params_authenticatable+: if this model allows authentication through request params. By default true.
+    #     It also accepts an array specifying the strategies that should allow params authentication.
+    #
+    # == active_for_authentication?
+    #
+    # Before authenticating a user and in each request, Devise checks if your model is active by
+    # calling model.active_for_authentication?. This method is overwriten by other devise modules. For instance,
+    # :confirmable overwrites .active_for_authentication? to only return true if your model was confirmed.
     #
     # You overwrite this method yourself, but if you do, don't forget to call super:
     #
-    #   def active?
+    #   def active_for_authentication?
     #     super && special_condition_is_valid?
     #   end
     #
-    # Whenever active? returns false, Devise asks the reason why your model is inactive using
+    # Whenever active_for_authentication? returns false, Devise asks the reason why your model is inactive using
     # the inactive_message method. You can overwrite it as well:
     #
     #   def inactive_message
@@ -48,10 +55,10 @@ module Devise
       # find_for_authentication are the methods used in a Warden::Strategy to check
       # if a model should be signed in or not.
       #
-      # However, you should not overwrite this method, you should overwrite active? and
-      # inactive_message instead.
+      # However, you should not overwrite this method, you should overwrite active_for_authentication?
+      # and inactive_message instead.
       def valid_for_authentication?
-        if active?
+        if active_for_authentication?
           block_given? ? yield : true
         else
           inactive_message
@@ -59,15 +66,30 @@ module Devise
       end
 
       def active?
-        true
+        ActiveSupport::Deprecation.warn "[DEVISE] active? is deprecated, please use active_for_authentication? instead.", caller
+        active_for_authentication?
+      end
+
+      def active_for_authentication?
+        my_methods = self.class.instance_methods(false)
+        if my_methods.include?("active?") || my_methods.include?(:active?)
+          ActiveSupport::Deprecation.warn "[DEVISE] Overriding active? is deprecated to avoid conflicts. " \
+            "Please use active_for_authentication? instead.", caller
+          active?
+        else
+          true
+        end
       end
 
       def inactive_message
         :inactive
       end
 
+      def authenticatable_salt
+      end
+
       module ClassMethods
-        Devise::Models.config(self, :authentication_keys, :http_authenticatable, :params_authenticatable)
+        Devise::Models.config(self, :authentication_keys, :request_keys, :case_insensitive_keys, :http_authenticatable, :params_authenticatable)
 
         def params_authenticatable?(strategy)
           params_authenticatable.is_a?(Array) ?
@@ -90,34 +112,54 @@ module Devise
         #   end
         #
         def find_for_authentication(conditions)
-          find(:first, :conditions => conditions)
+          filter_auth_params(conditions)
+          (case_insensitive_keys || []).each { |k| conditions[k].try(:downcase!) }
+          to_adapter.find_first(conditions)
         end
 
         # Find an initialize a record setting an error if it can't be found.
         def find_or_initialize_with_error_by(attribute, value, error=:invalid) #:nodoc:
-          if value.present?
-            conditions = { attribute => value }
-            record = find(:first, :conditions => conditions)
-          end
+          find_or_initialize_with_errors([attribute], { attribute => value }, error)
+        end
 
+        # Find an initialize a group of attributes based on a list of required attributes.
+        def find_or_initialize_with_errors(required_attributes, attributes, error=:invalid) #:nodoc:
+          (case_insensitive_keys || []).each { |k| attributes[k].try(:downcase!) }
+          
+          attributes = attributes.slice(*required_attributes)
+          attributes.delete_if { |key, value| value.blank? }
+
+          if attributes.size == required_attributes.size
+            record = to_adapter.find_first(filter_auth_params(attributes))
+          end
+          
           unless record
             record = new
-            if value.present?
-              record.send(:"#{attribute}=", value)
-            else
-              error = :blank
+
+            required_attributes.each do |key|
+              value = attributes[key]
+              record.send("#{key}=", value)
+              record.errors.add(key, value.present? ? error : :blank)
             end
-            record.errors.add(attribute, error)
           end
 
           record
         end
 
+        protected
+
+        # Force keys to be string to avoid injection on mongoid related database.
+        def filter_auth_params(conditions)
+          conditions.each do |k, v|
+            conditions[k] = v.to_s
+          end if conditions.is_a?(Hash)
+        end
+
         # Generate a token by looping and ensuring does not already exist.
         def generate_token(column)
           loop do
             token = Devise.friendly_token
-            break token unless find(:first, :conditions => { column => token })
+            break token unless to_adapter.find_first({ column => token })
           end
         end
       end

data/lib/devise/models/confirmable.rb

@@ -3,28 +3,24 @@ module Devise
     # Confirmable is responsible to verify if an account is already confirmed to
     # sign in, and to send emails with confirmation instructions.
     # Confirmation instructions are sent to the user email after creating a
-    # record, after updating it's email and also when manually requested by
-    # a new confirmation instruction request.
-    # Whenever the user update it's email, his account is automatically unconfirmed,
-    # it means it won't be able to sign in again without confirming the account
-    # again through the email that was sent.
+    # record and when manually requested by a new confirmation instruction request.
     #
-    # Configuration:
+    # == Options
     #
-    #   confirm_within: the time you want the user will have to confirm it's account
-    #                   without blocking his access. When confirm_within is zero, the
-    #                   user won't be able to sign in without confirming. You can
-    #                   use this to let your user access some features of your
-    #                   application without confirming the account, but blocking it
-    #                   after a certain period (ie 7 days). By default confirm_within is
-    #                   zero, it means users always have to confirm to sign in.
+    # Confirmable adds the following options to devise_for:
     #
-    # Examples:
+    #   * +confirm_within+: the time you want to allow the user to access his account
+    #     before confirming it. After this period, the user access is denied. You can
+    #     use this to let your user access some features of your application without
+    #     confirming the account, but blocking it after a certain period (ie 7 days).
+    #     By default confirm_within is zero, it means users always have to confirm to sign in.
+    #
+    # == Examples
     #
     #   User.find(1).confirm!      # returns true unless it's already confirmed
     #   User.find(1).confirmed?    # true/false
     #   User.find(1).send_confirmation_instructions # manually send instructions
-    #   User.find(1).resend_confirmation! # generates a new token and resent it
+    #
     module Confirmable
       extend ActiveSupport::Concern
 
@@ -59,11 +55,11 @@ module Devise
         unless_confirmed { send_confirmation_instructions }
       end
 
-      # Overwrites active? from Devise::Models::Activatable for confirmation
-      # by verifying whether an user is active to sign in or not. If the user
+      # Overwrites active_for_authentication? for confirmation
+      # by verifying whether a user is active to sign in or not. If the user
       # is already confirmed, it should never be blocked. Otherwise we need to
       # calculate if the confirm time has not expired for this user.
-      def active?
+      def active_for_authentication?
         super && (!confirmation_required? || confirmed? || confirmation_period_valid?)
       end
 
@@ -137,7 +133,7 @@ module Devise
         # with an email not found error.
         # Options must contain the user email
         def send_confirmation_instructions(attributes={})
-          confirmable = find_or_initialize_with_error_by(:email, attributes[:email], :not_found)
+          confirmable = find_or_initialize_with_errors(confirmation_keys, attributes, :not_found)
           confirmable.resend_confirmation_token if confirmable.persisted?
           confirmable
         end
@@ -157,7 +153,7 @@ module Devise
           generate_token(:confirmation_token)
         end
 
-        Devise::Models.config(self, :confirm_within)
+        Devise::Models.config(self, :confirm_within, :confirmation_keys)
       end
     end
   end