devise 1.1.3 → 1.2.0

data/lib/devise/models/database_authenticatable.rb

@@ -1,25 +1,18 @@
 require 'devise/strategies/database_authenticatable'
+require 'bcrypt'
 
 module Devise
   module Models
-    # Authenticable Module, responsible for encrypting password and validating
+    # Authenticatable Module, responsible for encrypting password and validating
     # authenticity of a user while signing in.
     #
-    # Configuration:
+    # == Options
     #
-    # You can overwrite configuration values by setting in globally in Devise,
-    # using devise method or overwriting the respective instance method.
+    # DatabaseAuthenticable adds the following options to devise_for:
     #
-    #   pepper: encryption key used for creating encrypted password. Each time
-    #           password changes, it's gonna be encrypted again, and this key
-    #           is added to the password and salt to create a secure hash.
-    #           Always use `rake secret' to generate a new key.
+    #   * +stretches+: the cost given to bcrypt.
     #
-    #   stretches: defines how many times the password will be encrypted.
-    #
-    #   encryptor: the encryptor going to be used. By default :sha1.
-    #
-    # Examples:
+    # == Examples
     #
     #    User.find(1).valid_password?('password123')         # returns true/false
     #
@@ -29,22 +22,20 @@ module Devise
       included do
         attr_reader :password, :current_password
         attr_accessor :password_confirmation
+        before_save :downcase_keys
       end
 
-      # Regenerates password salt and encrypted password each time password is set,
-      # and then trigger any "after_changed_password"-callbacks.
+      # Generates password encryption based on the given value.
       def password=(new_password)
         @password = new_password
-
-        if @password.present?
-          self.password_salt = self.class.password_salt
-          self.encrypted_password = password_digest(@password)
-        end
+        self.encrypted_password = password_digest(@password) if @password.present?
       end
 
-      # Verifies whether an incoming_password (ie from sign in) is the user password.
-      def valid_password?(incoming_password)
-        password_digest(incoming_password) == self.encrypted_password
+      # Verifies whether an password (ie from sign in) is the user password.
+      def valid_password?(password)
+        bcrypt   = ::BCrypt::Password.new(self.encrypted_password)
+        password = ::BCrypt::Engine.hash_secret("#{password}#{self.class.pepper}", bcrypt.salt)
+        Devise.secure_compare(password, self.encrypted_password)
       end
 
       # Set password and password confirmation to nil
@@ -78,26 +69,25 @@ module Devise
       def after_database_authentication
       end
 
+      # A reliable way to expose the salt regardless of the implementation.
+      def authenticatable_salt
+        self.encrypted_password[0,29] if self.encrypted_password
+      end
+
     protected
 
-      # Digests the password using the configured encryptor.
+      # Downcase case-insensitive keys
+      def downcase_keys
+        (self.class.case_insensitive_keys || []).each { |k| self[k].try(:downcase!) }
+      end
+
+      # Digests the password using bcrypt.
       def password_digest(password)
-        if self.password_salt.present?
-          self.class.encryptor_class.digest(password, self.class.stretches, self.password_salt, self.class.pepper)
-        end
+        ::BCrypt::Password.create("#{password}#{self.class.pepper}", :cost => self.class.stretches).to_s
       end
 
       module ClassMethods
-        Devise::Models.config(self, :pepper, :stretches, :encryptor)
-
-        # Returns the class for the configured encryptor.
-        def encryptor_class
-          @encryptor_class ||= ::Devise::Encryptors.const_get(encryptor.to_s.classify)
-        end
-
-        def password_salt
-          self.encryptor_class.salt(self.stretches)
-        end
+        Devise::Models.config(self, :pepper, :stretches)
 
         # We assume this method already gets the sanitized values from the
         # DatabaseAuthenticatable strategy. If you are using this method on

data/lib/devise/models/encryptable.rb

@@ -0,0 +1,72 @@
+require 'devise/strategies/database_authenticatable'
+
+module Devise
+  module Models
+    # Encryptable Module adds support to several encryptors.
+    #
+    # == Options
+    #
+    # Encryptable adds the following options to devise_for:
+    #
+    #   * +pepper+: a random string used to provide a more secure hash.
+    #
+    #   * +encryptor+: the encryptor going to be used. By default is nil.
+    #
+    # == Examples
+    #
+    #    User.find(1).valid_password?('password123') # returns true/false
+    #
+    module Encryptable
+      extend ActiveSupport::Concern
+
+      included do
+        attr_reader :password, :current_password
+        attr_accessor :password_confirmation
+      end
+
+      # Generates password salt.
+      def password=(new_password)
+        self.password_salt = self.class.password_salt if new_password.present?
+        super
+      end
+
+      def authenticatable_salt
+        self.password_salt
+      end
+
+      # Verifies whether an incoming_password (ie from sign in) is the user password.
+      def valid_password?(incoming_password)
+        Devise.secure_compare(password_digest(incoming_password), self.encrypted_password)
+      end
+
+    protected
+
+      # Digests the password using the configured encryptor.
+      def password_digest(password)
+        if self.password_salt.present?
+          self.class.encryptor_class.digest(password, self.class.stretches, self.password_salt, self.class.pepper)
+        end
+      end
+
+      module ClassMethods
+        Devise::Models.config(self, :encryptor)
+
+        # Returns the class for the configured encryptor.
+        def encryptor_class
+          @encryptor_class ||= case encryptor
+            when :bcrypt
+              raise "In order to use bcrypt as encryptor, simply remove :encryptable from your devise model"
+            when nil
+              raise "You need to give an :encryptor as option in order to use :encryptable"
+            else
+              ::Devise::Encryptors.const_get(encryptor.to_s.classify)
+          end
+        end
+
+        def password_salt
+          self.encryptor_class.salt(self.stretches)
+        end
+      end
+    end
+  end
+end

data/lib/devise/models/lockable.rb

@@ -7,20 +7,22 @@ module Devise
     # will unlock the user automatically after some configured time (ie 2.hours).
     # It's also possible to setup lockable to use both email and time strategies.
     #
-    # Configuration:
+    # == Options
     #
-    #   maximum_attempts: how many attempts should be accepted before blocking the user.
-    #   lock_strategy: lock the user account by :failed_attempts or :none.
-    #   unlock_strategy: unlock the user account by :time, :email, :both or :none.
-    #   unlock_in: the time you want to lock the user after to lock happens. Only
-    #              available when unlock_strategy is :time or :both.
+    # Lockable adds the following options to devise_for:
+    #
+    #   * +maximum_attempts+: how many attempts should be accepted before blocking the user.
+    #   * +lock_strategy+: lock the user account by :failed_attempts or :none.
+    #   * +unlock_strategy+: unlock the user account by :time, :email, :both or :none.
+    #   * +unlock_in+: the time you want to lock the user after to lock happens. Only available when unlock_strategy is :time or :both.
+    #   * +unlock_keys+: the keys you want to use when locking and unlocking an account
     #
     module Lockable
       extend  ActiveSupport::Concern
 
       delegate :lock_strategy_enabled?, :unlock_strategy_enabled?, :to => "self.class"
 
-      # Lock an user setting it's locked_at to actual time.
+      # Lock a user setting it's locked_at to actual time.
       def lock_access!
         self.locked_at = Time.now
 
@@ -32,14 +34,12 @@ module Devise
         save(:validate => false)
       end
 
-      # Unlock an user by cleaning locket_at and failed_attempts.
+      # Unlock a user by cleaning locket_at and failed_attempts.
       def unlock_access!
-        if_access_locked do
-          self.locked_at = nil
-          self.failed_attempts = 0 if respond_to?(:failed_attempts=)
-          self.unlock_token = nil  if respond_to?(:unlock_token=)
-          save(:validate => false)
-        end
+        self.locked_at = nil
+        self.failed_attempts = 0 if respond_to?(:failed_attempts=)
+        self.unlock_token = nil  if respond_to?(:unlock_token=)
+        save(:validate => false)
       end
 
       # Verifies whether a user is locked or not.
@@ -57,9 +57,9 @@ module Devise
         if_access_locked { send_unlock_instructions }
       end
 
-      # Overwrites active? from Devise::Models::Activatable for locking purposes
-      # by verifying whether an user is active to sign in or not based on locked?
-      def active?
+      # Overwrites active_for_authentication? from Devise::Models::Activatable for locking purposes
+      # by verifying whether a user is active to sign in or not based on locked?
+      def active_for_authentication?
         super && !access_locked?
       end
 
@@ -70,16 +70,21 @@ module Devise
       end
 
       # Overwrites valid_for_authentication? from Devise::Models::Authenticatable
-      # for verifying whether an user is allowed to sign in or not. If the user
+      # for verifying whether a user is allowed to sign in or not. If the user
       # is locked, it should never be allowed.
       def valid_for_authentication?
         return super unless persisted? && lock_strategy_enabled?(:failed_attempts)
 
+        # Unlock the user if the lock is expired, no matter
+        # if the user can login or not (wrong password, etc)
+        unlock_access! if lock_expired?
+
         case (result = super)
         when Symbol
           return result
         when TrueClass
           self.failed_attempts = 0
+          save(:validate => false)
         when FalseClass
           # PostgreSQL uses nil as the default value for integer columns set to 0
           self.failed_attempts ||= 0
@@ -87,10 +92,11 @@ module Devise
           if attempts_exceeded?
             lock_access!
             return :locked
+          else
+            save(:validate => false)
           end
         end
 
-        save(:validate => false) if changed?
         result
       end
 
@@ -131,7 +137,7 @@ module Devise
         # with an email not found error.
         # Options must contain the user email
         def send_unlock_instructions(attributes={})
-         lockable = find_or_initialize_with_error_by(:email, attributes[:email], :not_found)
+         lockable = find_or_initialize_with_errors(unlock_keys, attributes, :not_found)
          lockable.resend_unlock_token if lockable.persisted?
          lockable
         end
@@ -160,7 +166,7 @@ module Devise
           Devise.friendly_token
         end
 
-        Devise::Models.config(self, :maximum_attempts, :lock_strategy, :unlock_strategy, :unlock_in)
+        Devise::Models.config(self, :maximum_attempts, :lock_strategy, :unlock_strategy, :unlock_in, :unlock_keys)
       end
     end
   end

data/lib/devise/models/omniauthable.rb

@@ -0,0 +1,23 @@
+require 'devise/omniauth'
+
+module Devise
+  module Models
+    # Adds OmniAuth support to your model.
+    #
+    # == Options
+    #
+    # Oauthable adds the following options to devise_for:
+    #
+    #   * +omniauth_providers+: Which providers are avaialble to this model. It expects an array:
+    #
+    #       devise_for :database_authenticatable, :omniauthable, :omniauth_providers => [:twitter]
+    #
+    module Omniauthable
+      extend ActiveSupport::Concern
+
+      module ClassMethods
+        Devise::Models.config(self, :omniauth_providers)
+      end
+    end
+  end
+end

data/lib/devise/models/recoverable.rb

@@ -1,8 +1,15 @@
 module Devise
   module Models
 
-    # Recoverable takes care of reseting the user password and send reset instructions
-    # Examples:
+    # Recoverable takes care of reseting the user password and send reset instructions.
+    #
+    # ==Options
+    #
+    # Recoverable adds the following options to devise_for:
+    #
+    #   * +reset_password_keys+: the keys you want to use when recovering the password for an account
+    #
+    # == Examples
     #
     #   # resets the user password and save the record, true if valid passwords are given, otherwise false
     #   User.find(1).reset_password!('password123', 'password123')
@@ -13,6 +20,7 @@ module Devise
     #
     #   # creates a new token and send it with instructions about how to reset the password
     #   User.find(1).send_reset_password_instructions
+    #
     module Recoverable
       extend ActiveSupport::Concern
 
@@ -55,7 +63,7 @@ module Devise
         # with an email not found error.
         # Attributes must contain the user email
         def send_reset_password_instructions(attributes={})
-          recoverable = find_or_initialize_with_error_by(:email, attributes[:email], :not_found)
+          recoverable = find_or_initialize_with_errors(reset_password_keys, attributes, :not_found)
           recoverable.send_reset_password_instructions if recoverable.persisted?
           recoverable
         end
@@ -75,6 +83,8 @@ module Devise
           recoverable.reset_password!(attributes[:password], attributes[:password_confirmation]) if recoverable.persisted?
           recoverable
         end
+
+        Devise::Models.config(self, :reset_password_keys)
       end
     end
   end

data/lib/devise/models/registerable.rb

@@ -3,6 +3,19 @@ module Devise
     # Registerable is responsible for everything related to registering a new
     # resource (ie user sign up).
     module Registerable
+      extend ActiveSupport::Concern
+
+      module ClassMethods
+        # A convenience method that receives both parameters and session to
+        # initialize a user. This can be used by OAuth, for example, to send
+        # in the user token and be stored on initialization.
+        #
+        # By default discards all information sent by the session by calling
+        # new with params.
+        def new_with_session(params, session)
+          new(params)
+        end
+      end
     end
   end
 end

data/lib/devise/models/rememberable.rb

@@ -11,24 +11,27 @@ module Devise
     # You probably wouldn't use rememberable methods directly, they are used
     # mostly internally for handling the remember token.
     #
-    # Configuration:
+    # == Options
     #
-    #   remember_for: the time you want the user will be remembered without
-    #                 asking for credentials. After this time the user will be
-    #                 blocked and will have to enter his credentials again.
-    #                 This configuration is also used to calculate the expires
-    #                 time for the cookie created to remember the user.
-    #                 2.weeks by default.
+    # Rememberable adds the following options in devise_for:
     #
-    #   remember_across_browsers: if true, a valid remember token can be
-    #                             re-used between multiple browsers.
-    #                             True by default.
+    #   * +remember_for+: the time you want the user will be remembered without
+    #     asking for credentials. After this time the user will be blocked and
+    #     will have to enter his credentials again. This configuration is also
+    #     used to calculate the expires time for the cookie created to remember
+    #     the user. By default remember_for is 2.weeks.
     #
-    #   extend_remember_period: if true, extends the user's remember period
-    #                           when remembered via cookie.
-    #                           False by default.
+    #   * +remember_across_browsers+: if a valid remember token can be re-used
+    #     between multiple browsers. By default remember_across_browsers is true
+    #     and cannot be turned off if you are using password salt instead of remember
+    #     token.
     #
-    # Examples:
+    #   * +extend_remember_period+: if true, extends the user's remember period
+    #     when remembered via cookie. False by default.
+    #
+    #   * +cookie_options+: configuration options passed to the created cookie.
+    #
+    # == Examples
     #
     #   User.find(1).remember_me!  # regenerating the token
     #   User.find(1).forget_me!    # clearing the token
@@ -41,15 +44,12 @@ module Devise
     module Rememberable
       extend ActiveSupport::Concern
 
-      included do
-        # Remember me option available in after_authentication hook.
-        attr_accessor :remember_me
-      end
+      attr_accessor :remember_me, :extend_remember_period
 
       # Generate a new remember token and save the record without validations
       # unless remember_across_browsers is true and the user already has a valid token.
       def remember_me!(extend_period=false)
-        self.remember_token = self.class.remember_token if generate_remember_token?
+        self.remember_token = self.class.remember_token if respond_to?(:remember_token) && generate_remember_token?
         self.remember_created_at = Time.now.utc if generate_remember_timestamp?(extend_period)
         save(:validate => false)
       end
@@ -57,16 +57,14 @@ module Devise
       # Removes the remember token only if it exists, and save the record
       # without validations.
       def forget_me!
-        if remember_token
-          self.remember_token = nil
-          self.remember_created_at = nil
-          save(:validate => false)
-        end
+        self.remember_token = nil if respond_to?(:remember_token=)
+        self.remember_created_at = nil
+        save(:validate => false)
       end
 
       # Remember token should be expired if expiration time not overpass now.
       def remember_expired?
-        remember_created_at && (remember_expires_at <= Time.now.utc)
+        remember_created_at.nil? || (remember_expires_at <= Time.now.utc)
       end
 
       # Remember token expires at created time + remember_for configuration
@@ -74,12 +72,20 @@ module Devise
         remember_created_at + self.class.remember_for
       end
 
-      def cookie_domain
-        self.class.cookie_domain
+      def rememberable_value
+        if respond_to?(:remember_token)
+          remember_token
+        elsif respond_to?(:authenticatable_salt) && (salt = authenticatable_salt)
+          salt
+        else
+          raise "The #{self.class.name} class does not respond to remember_token and " <<
+            "authenticatable_salt returns nil. In order to use rememberable, you must " <<
+            "add a remember_token field to your model or ensure a password is always set."
+        end
       end
 
-      def cookie_domain?
-        self.class.cookie_domain != false
+      def cookie_options
+        self.class.cookie_options
       end
 
     protected
@@ -99,14 +105,13 @@ module Devise
       module ClassMethods
         # Create the cookie key using the record id and remember_token
         def serialize_into_cookie(record)
-          [record.id, record.remember_token]
+          [record.to_key, record.rememberable_value]
         end
 
         # Recreate the user based on the stored cookie
         def serialize_from_cookie(id, remember_token)
-          conditions = { :id => id, :remember_token => remember_token }
-          record = find(:first, :conditions => conditions)
-          record if record && !record.remember_expired?
+          record = to_adapter.get(id)
+          record if record && record.rememberable_value == remember_token && !record.remember_expired?
         end
 
         # Generate a token checking if one does not already exist in the database.
@@ -115,7 +120,7 @@ module Devise
         end
 
         Devise::Models.config(self, :remember_for, :remember_across_browsers,
-          :extend_remember_period, :cookie_domain)
+          :extend_remember_period, :cookie_options)
       end
     end
   end

data/lib/devise/models/timeoutable.rb

@@ -7,17 +7,34 @@ module Devise
     # will be asked for credentials again, it means, he/she will be redirected
     # to the sign in page.
     #
-    # Configuration:
+    # == Options
+    #
+    # Timeoutable adds the following options to devise_for:
+    #
+    #   * +timeout_in+: the interval to timeout the user session without activity.
+    #
+    # == Examples
+    #
+    #   user.timedout?(30.minutes.ago)
     #
-    #   timeout_in: the time you want to timeout the user session without activity.
     module Timeoutable
       extend ActiveSupport::Concern
 
       # Checks whether the user session has expired based on configured time.
       def timedout?(last_access)
+        return false if remember_exists_and_not_expired?
+        
         last_access && last_access <= self.class.timeout_in.ago
       end
-
+      
+      private
+      
+      def remember_exists_and_not_expired?
+        return false unless respond_to?(:remember_expired?)
+        
+        remember_created_at && !remember_expired?
+      end
+      
       module ClassMethods
         Devise::Models.config(self, :timeout_in)
       end

data/lib/devise/models/token_authenticatable.rb

@@ -5,15 +5,27 @@ module Devise
     # The TokenAuthenticatable module is responsible for generating an authentication token and
     # validating the authenticity of the same while signing in.
     #
-    # This module only provides a few helpers to help you manage the token. Creating and resetting
-    # the token is your responsibility.
+    # This module only provides a few helpers to help you manage the token, but it is up to you
+    # to choose how to use it. For example, if you want to have a new token every time the user
+    # saves his account, you can do the following:
     #
-    # == Configuration:
+    #   before_save :reset_authentication_token
     #
-    # You can overwrite configuration values by setting in globally in Devise (+Devise.setup+),
-    # using devise method, or overwriting the respective instance method.
+    # On the other hand, if you want to generate token unless one exists, you should use instead:
     #
-    # +token_authentication_key+ - Defines name of the authentication token params key. E.g. /users/sign_in?some_key=...
+    #   before_save :ensure_authentication_token
+    #
+    # If you want to delete the token after it is used, you can do so in the
+    # after_token_authentication callback.
+    #
+    # == Options
+    #
+    # TokenAuthenticatable adds the following options to devise_for:
+    #
+    #   * +token_authentication_key+: Defines name of the authentication token params key. E.g. /users/sign_in?some_key=...
+    #
+    #   * +stateless_token+: By default, when you sign up with a token, Devise will store the user in session
+    #     as any other authentication strategy. You can set stateless_token to true to avoid this.
     #
     module TokenAuthenticatable
       extend ActiveSupport::Concern
@@ -26,17 +38,17 @@ module Devise
       # Generate new authentication token and save the record.
       def reset_authentication_token!
         reset_authentication_token
-        self.save(:validate => false)
+        save(:validate => false)
       end
 
       # Generate authentication token unless already exists.
       def ensure_authentication_token
-        self.reset_authentication_token if self.authentication_token.blank?
+        reset_authentication_token if authentication_token.blank?
       end
 
       # Generate authentication token unless already exists and save the record.
       def ensure_authentication_token!
-        self.reset_authentication_token! if self.authentication_token.blank?
+        reset_authentication_token! if authentication_token.blank?
       end
 
       # Hook called after token authentication.
@@ -53,7 +65,7 @@ module Devise
           generate_token(:authentication_token)
         end
 
-        ::Devise::Models.config(self, :token_authentication_key)
+        ::Devise::Models.config(self, :token_authentication_key, :stateless_token)
       end
     end
   end

data/lib/devise/models/validatable.rb

@@ -1,10 +1,17 @@
 module Devise
   module Models
-
     # Validatable creates all needed validations for a user email and password.
     # It's optional, given you may want to create the validations by yourself.
     # Automatically validate if the email is present, unique and it's format is
-    # valid. Also tests presence of password, confirmation and length
+    # valid. Also tests presence of password, confirmation and length.
+    #
+    # == Options
+    #
+    # Validatable adds the following options to devise_for:
+    #
+    #   * +email_regexp+: the regular expression used to validate e-mails;
+    #   * +password_length+: a range expressing password length. Defaults to 6..20.
+    #
     module Validatable
       # All validations used by this module.
       VALIDATIONS = [ :validates_presence_of, :validates_uniqueness_of, :validates_format_of,
@@ -15,8 +22,9 @@ module Devise
         assert_validations_api!(base)
 
         base.class_eval do
-          validates_presence_of   :email
-          validates_uniqueness_of :email, :scope => authentication_keys[1..-1], :case_sensitive => false, :allow_blank => true
+          validates_presence_of   :email, :if => :email_required?
+          validates_uniqueness_of :email, :scope => authentication_keys[1..-1],
+            :case_sensitive => (case_insensitive_keys != false), :allow_blank => true
           validates_format_of     :email, :with  => email_regexp, :allow_blank => true
 
           with_options :if => :password_required? do |v|
@@ -45,6 +53,10 @@ module Devise
         !persisted? || !password.nil? || !password_confirmation.nil?
       end
 
+      def email_required?
+        true
+      end
+
       module ClassMethods
         Devise::Models.config(self, :email_regexp, :password_length)
       end