devise 1.1.3 → 1.2.0

data/lib/devise/models.rb

@@ -2,7 +2,7 @@ module Devise
   module Models
     # Creates configuration values for Devise and for the given module.
     #
-    #   Devise::Models.config(Devise::Authenticable, :stretches, 10)
+    #   Devise::Models.config(Devise::Authenticatable, :stretches, 10)
     #
     # The line above creates:
     #
@@ -47,21 +47,9 @@ module Devise
     def devise(*modules)
       include Devise::Models::Authenticatable
       options = modules.extract_options!
-
-      if modules.delete(:authenticatable)
-        ActiveSupport::Deprecation.warn ":authenticatable as module is deprecated. Please give :database_authenticatable instead.", caller
-        modules << :database_authenticatable
-      end
-
-      if modules.delete(:activatable)
-        ActiveSupport::Deprecation.warn ":activatable as module is deprecated. It's included in your model by default.", caller
-      end
-
-      if modules.delete(:http_authenticatable)
-        ActiveSupport::Deprecation.warn ":http_authenticatable as module is deprecated and is on by default. Revert by setting :http_authenticatable => false.", caller
-      end
-
-      self.devise_modules += Devise::ALL & modules.map(&:to_sym).uniq
+      self.devise_modules += modules.map(&:to_sym).uniq.sort_by { |s|
+        Devise::ALL.index(s) || -1  # follow Devise::ALL order
+      }
 
       devise_modules_hook! do
         devise_modules.each { |m| include Devise::Models.const_get(m.to_s.classify) }

data/lib/devise/modules.rb

@@ -2,20 +2,27 @@ require 'active_support/core_ext/object/with_options'
 
 Devise.with_options :model => true do |d|
   # Strategies first
-  d.with_options :strategy => true do |s|      
-    s.add_module :database_authenticatable, :controller => :sessions, :route => :session
-    s.add_module :token_authenticatable,    :controller => :sessions, :route => :session
+  d.with_options :strategy => true do |s|
+    routes = [nil, :new, :destroy]
+    s.add_module :database_authenticatable, :controller => :sessions, :route => { :session => routes }
+    s.add_module :token_authenticatable,    :controller => :sessions, :route => { :session => routes }
     s.add_module :rememberable
   end
 
-  # Misc after   
-  d.add_module :recoverable,  :controller => :passwords,     :route => :password
-  d.add_module :registerable, :controller => :registrations, :route => :registration
+  # Other authentications
+  d.add_module :encryptable
+  d.add_module :omniauthable, :controller => :omniauth_callbacks,  :route => :omniauth_callback
+
+  # Misc after
+  routes = [nil, :new, :edit]
+  d.add_module :recoverable,  :controller => :passwords,     :route => { :password => routes }
+  d.add_module :registerable, :controller => :registrations, :route => { :registration => (routes << :cancel) }
   d.add_module :validatable
 
   # The ones which can sign out after
-  d.add_module :confirmable,  :controller => :confirmations, :route => :confirmation
-  d.add_module :lockable,     :controller => :unlocks,       :route => :unlock
+  routes = [nil, :new]
+  d.add_module :confirmable,  :controller => :confirmations, :route => { :confirmation => routes }
+  d.add_module :lockable,     :controller => :unlocks,       :route => { :unlock => routes }
   d.add_module :timeoutable
 
   # Stats for last, so we make sure the user is really signed in

data/lib/devise/omniauth/config.rb

@@ -0,0 +1,18 @@
+module Devise
+  module OmniAuth
+    class Config
+      attr_accessor :strategy
+      attr_reader :args
+
+      def initialize(provider, args)
+        @provider = provider
+        @args     = args
+        @strategy = nil
+      end
+
+      def strategy_class
+        ::OmniAuth::Strategies.const_get("#{::OmniAuth::Utils.camelize(@provider.to_s)}")
+      end
+    end
+  end
+end     

data/lib/devise/omniauth/url_helpers.rb

@@ -0,0 +1,33 @@
+module Devise
+  module OmniAuth
+    module UrlHelpers
+      def self.define_helpers(mapping)
+        return unless mapping.omniauthable?
+
+        class_eval <<-URL_HELPERS, __FILE__, __LINE__ + 1
+          def #{mapping.name}_omniauth_authorize_path(provider, params = {})
+            if Devise.omniauth_configs[provider.to_sym]
+              script_name = request.env["SCRIPT_NAME"]
+
+              path = "\#{script_name}/#{mapping.path}/auth/\#{provider}\".squeeze("/")
+              path << '?' + params.to_param if params.present?
+              path
+            else
+              raise ArgumentError, "Could not find omniauth provider \#{provider.inspect}"
+            end
+          end
+        URL_HELPERS
+      end
+
+      def omniauth_authorize_path(resource_or_scope, *args)
+        scope = Devise::Mapping.find_scope!(resource_or_scope)
+        send("#{scope}_omniauth_authorize_path", *args)
+      end
+
+      def omniauth_callback_path(resource_or_scope, *args)
+        scope = Devise::Mapping.find_scope!(resource_or_scope)
+        send("#{scope}_omniauth_callback_path", *args)
+      end
+    end
+  end
+end

data/lib/devise/omniauth.rb

@@ -0,0 +1,32 @@
+begin
+  require "omniauth/core"
+rescue LoadError => e
+  warn "Could not load 'omniauth/core'. Please ensure you have the oa-core gem installed and listed in your Gemfile."
+  raise
+end
+
+unless OmniAuth.config.respond_to? :test_mode
+  raise "You are using an old OmniAuth version, please ensure you have 0.2.0.beta version or later installed."
+end
+
+# Clean up the default path_prefix. It will be automatically set by Devise.
+OmniAuth.config.path_prefix = nil
+
+OmniAuth.config.on_failure = Proc.new do |env|
+  env['devise.mapping'] = Devise::Mapping.find_by_path!(env['PATH_INFO'], :path)
+  controller_klass = "#{env['devise.mapping'].controllers[:omniauth_callbacks].camelize}Controller"
+  controller_klass.constantize.action(:failure).call(env)
+end
+
+module Devise
+  module OmniAuth
+    autoload :Config,      "devise/omniauth/config"
+    autoload :UrlHelpers,  "devise/omniauth/url_helpers"
+    autoload :TestHelpers, "devise/omniauth/test_helpers"
+
+    class << self
+      delegate :short_circuit_authorizers!, :unshort_circuit_authorizers!,
+        :test_mode!, :stub!, :reset_stubs!, :to => "Devise::OmniAuth::TestHelpers"
+    end
+  end
+end

data/lib/devise/orm/active_record.rb

@@ -1,3 +1,5 @@
+require 'orm_adapter/adapters/active_record'
+
 module Devise
   module Orm
     # This module contains some helpers and handle schema (migrations):

data/lib/devise/orm/mongoid.rb

@@ -1,3 +1,5 @@
+require 'orm_adapter/adapters/mongoid'
+
 module Devise
   module Orm
     module Mongoid
@@ -16,7 +18,7 @@ module Devise
         # Tell how to apply schema methods
         def apply_devise_schema(name, type, options={})
           type = Time if type == DateTime
-          field name, { :type => type }.merge(options)
+          field name, { :type => type }.merge!(options)
         end
       end
     end
@@ -26,4 +28,4 @@ end
 Mongoid::Document::ClassMethods.class_eval do
   include Devise::Models
   include Devise::Orm::Mongoid::Hook
-end
+end

data/lib/devise/rails/routes.rb

@@ -5,7 +5,6 @@ module ActionDispatch::Routing
     def finalize_with_devise!
       finalize_without_devise!
       Devise.configure_warden!
-      ActionController::Base.send :include, Devise::Controllers::Helpers
     end
     alias_method_chain :finalize!, :devise
   end
@@ -70,6 +69,13 @@ module ActionDispatch::Routing
     #
     #      devise_for :users, :controllers => { :sessions => "users/sessions" }
     #
+    #  * :sign_out_via => the HTTP method(s) accepted for the :sign_out action (default: :get),
+    #    if you wish to restrict this to accept only :post or :delete requests you should do:
+    #
+    #      devise_for :users, :sign_out_via => [ :post, :delete ]
+    #
+    #    You need to make sure that your sign_out controls trigger a request with a matching HTTP method.
+    #
     #  * :module => the namespace to find controlers. By default, devise will access devise/sessions,
     #    devise/registrations and so on. If you want to namespace all at once, use module:
     #
@@ -85,6 +91,10 @@ module ActionDispatch::Routing
     #    Will use publisher/sessions controller instead of devise/sessions controller. You can revert
     #    this by providing the :module option to devise_for.
     #
+    #    Also pay attention that when you use a namespace it will affect all the helpers and methods for controllers
+    #    and views. For example, using the above setup you'll end with following methods:
+    #    current_publisher_account, authenticate_publisher_account!, pusblisher_account_signed_in, etc.
+    #
     #  * :skip => tell which controller you want to skip routes from being created:
     #
     #      devise_for :users, :skip => :sessions
@@ -113,19 +123,33 @@ module ActionDispatch::Routing
     #     end
     #   end
     #
+    # ==== Adding custom actions to override controllers
+    # 
+    # You can pass a block to devise_for that will add any routes defined in the block to Devise's 
+    # list of known actions.  This is important if you add a custom action to a controller that 
+    # overrides an out of the box Devise controller.
+    # For example:
+    #
+    #    class RegistrationsController < Devise::RegistrationsController
+    #      def update
+    #         # do something different here
+    #      end
+    #
+    #      def deactivate
+    #        # not a standard action
+    #        # deactivate code here
+    #      end
+    #    end
+    #
+    # In order to get Devise to recognize the deactivate action, your devise_for entry should look like this,
+    #
+    #     devise_for :owners, :controllers => { :registrations => "registrations" } do
+    #       post "deactivate", :to => "registrations#deactivate", :as => "deactivate_registration"
+    #     end
+    #
     def devise_for(*resources)
       options = resources.extract_options!
 
-      if as = options.delete(:as)
-        ActiveSupport::Deprecation.warn ":as is deprecated, please use :path instead."
-        options[:path] ||= as
-      end
-
-      if scope = options.delete(:scope)
-        ActiveSupport::Deprecation.warn ":scope is deprecated, please use :singular instead."
-        options[:singular] ||= scope
-      end
-
       options[:as]          ||= @scope[:as]     if @scope[:as].present?
       options[:module]      ||= @scope[:module] if @scope[:module].present?
       options[:path_prefix] ||= @scope[:path]   if @scope[:path].present?
@@ -154,7 +178,7 @@ module ActionDispatch::Routing
         devise_scope mapping.name do
           yield if block_given?
           with_devise_exclusive_scope mapping.fullpath, mapping.name do
-            routes.each { |mod| send(:"devise_#{mod}", mapping, mapping.controllers) }
+            routes.each { |mod| send("devise_#{mod}", mapping, mapping.controllers) }
           end
         end
       end
@@ -203,22 +227,22 @@ module ActionDispatch::Routing
 
       def devise_session(mapping, controllers) #:nodoc:
         resource :session, :only => [], :controller => controllers[:sessions], :path => "" do
-          get  :new,     :path => mapping.path_names[:sign_in],  :as => "new"
-          post :create,  :path => mapping.path_names[:sign_in]
-          get  :destroy, :path => mapping.path_names[:sign_out], :as => "destroy"
+          get   :new,     :path => mapping.path_names[:sign_in],  :as => "new"
+          post  :create,  :path => mapping.path_names[:sign_in]
+          match :destroy, :path => mapping.path_names[:sign_out], :as => "destroy", :via => mapping.sign_out_via
         end
       end
- 
+
       def devise_password(mapping, controllers) #:nodoc:
         resource :password, :only => [:new, :create, :edit, :update],
           :path => mapping.path_names[:password], :controller => controllers[:passwords]
       end
- 
+
       def devise_confirmation(mapping, controllers) #:nodoc:
         resource :confirmation, :only => [:new, :create, :show],
           :path => mapping.path_names[:confirmation], :controller => controllers[:confirmations]
       end
- 
+
       def devise_unlock(mapping, controllers) #:nodoc:
         if mapping.to.unlock_strategy_enabled?(:email)
           resource :unlock, :only => [:new, :create, :show],
@@ -227,8 +251,31 @@ module ActionDispatch::Routing
       end
 
       def devise_registration(mapping, controllers) #:nodoc:
-        resource :registration, :only => [:new, :create, :edit, :update, :destroy], :path => mapping.path_names[:registration],
-                 :path_names => { :new => mapping.path_names[:sign_up] }, :controller => controllers[:registrations]
+        path_names = {
+          :new => mapping.path_names[:sign_up],
+          :cancel => mapping.path_names[:cancel]
+        }
+
+        resource :registration, :except => :show, :path => mapping.path_names[:registration],
+                 :path_names => path_names, :controller => controllers[:registrations] do
+          get :cancel
+        end
+      end
+
+      def devise_omniauth_callback(mapping, controllers) #:nodoc:
+        path, @scope[:path] = @scope[:path], nil
+        path_prefix = "/#{mapping.path}/auth".squeeze("/")
+
+        if ::OmniAuth.config.path_prefix && ::OmniAuth.config.path_prefix != path_prefix
+          warn "[DEVISE] You can only add :omniauthable behavior to one model."
+        else
+          ::OmniAuth.config.path_prefix = path_prefix
+        end
+
+        match "#{path_prefix}/:action/callback", :action => Regexp.union(mapping.to.omniauth_providers.map(&:to_s)),
+          :to => controllers[:omniauth_callbacks], :as => :omniauth_callback
+      ensure
+        @scope[:path] = path
       end
 
       def with_devise_exclusive_scope(new_path, new_as) #:nodoc:

data/lib/devise/rails/warden_compat.rb

@@ -3,9 +3,9 @@ module Warden::Mixins::Common
     @request ||= ActionDispatch::Request.new(env)
   end
 
+  # This is called internally by Warden on logout
   def reset_session!
-    raw_session.inspect # why do I have to inspect it to get it to clear?
-    raw_session.clear
+    request.reset_session
   end
 
   def cookies
@@ -15,25 +15,111 @@ end
 
 class Warden::SessionSerializer
   def serialize(record)
-    [record.class.name, record.id]
+    [record.class.name, record.to_key, record.authenticatable_salt]
   end
 
   def deserialize(keys)
-    klass, id = keys
-
-    if klass.is_a?(Class)
+    if keys.size == 2
       raise "Devise changed how it stores objects in session. If you are seeing this message, " <<
-        "you can fix it by changing one character in your cookie secret, forcing all previous " <<
-        "cookies to expire, or cleaning up your database sessions if you are using a db store."
+        "you can fix it by changing one character in your cookie secret or cleaning up your " <<
+        "database sessions if you are using a db store."
+    end
+
+    klass, id, salt = keys
+
+    begin
+      record = klass.constantize.to_adapter.get(id)
+      record if record && record.authenticatable_salt == salt
+    rescue NameError => e
+      if e.message =~ /uninitialized constant/
+        Rails.logger.debug "[Devise] Trying to deserialize invalid class #{klass}"
+        nil
+      else
+        raise
+      end
+    end
+  end
+end
+
+unless Devise.rack_session?
+  # We cannot use Rails Indifferent Hash because it messes up the flash object.
+  class Devise::IndifferentHash < Hash
+    alias_method :regular_writer, :[]= unless method_defined?(:regular_writer)
+    alias_method :regular_update, :update unless method_defined?(:regular_update)
+
+    def [](key)
+      super(convert_key(key))
+    end
+
+    def []=(key, value)
+      regular_writer(convert_key(key), value)
+    end
+
+    alias_method :store, :[]=
+
+    def update(other_hash)
+      other_hash.each_pair { |key, value| regular_writer(convert_key(key), value) }
+      self
+    end
+
+    alias_method :merge!, :update
+
+    def key?(key)
+      super(convert_key(key))
+    end
+
+    alias_method :include?, :key?
+    alias_method :has_key?, :key?
+    alias_method :member?, :key?
+
+    def fetch(key, *extras)
+      super(convert_key(key), *extras)
+    end
+
+    def values_at(*indices)
+      indices.collect {|key| self[convert_key(key)]}
+    end
+
+    def merge(hash)
+      self.dup.update(hash)
+    end
+
+    def delete(key)
+      super(convert_key(key))
+    end
+
+    def stringify_keys!; self end
+    def stringify_keys; dup end
+
+    undef :symbolize_keys!
+    def symbolize_keys; to_hash.symbolize_keys end
+
+    def to_options!; self end
+    def to_hash; Hash.new.update(self) end
+
+    protected
+
+    def convert_key(key)
+      key.kind_of?(Symbol) ? key.to_s : key
     end
+  end
+
+  class ActionDispatch::Request
+    def reset_session
+      session.destroy if session && session.respond_to?(:destroy)
+      self.session = {}
+      @env['action_dispatch.request.flash_hash'] = nil
+    end
+  end
 
-    klass.constantize.find(:first, :conditions => { :id => id })
-  rescue NameError => e
-    if e.message =~ /uninitialized constant/
-      Rails.logger.debug "Trying to deserialize invalid class #{klass}"
-      nil
-    else
-      raise
+  Warden::Manager.after_set_user :event => [:set_user, :authentication] do |record, warden, options|
+    if options[:scope] && warden.authenticated?(options[:scope])
+      request, flash = warden.request, warden.env['action_dispatch.request.flash_hash']
+      backup = request.session.to_hash
+      backup.delete("session_id")
+      request.reset_session
+      warden.env['action_dispatch.request.flash_hash'] = flash
+      request.session = Devise::IndifferentHash.new.update(backup)
     end
   end
 end

data/lib/devise/rails.rb

@@ -1,14 +1,11 @@
 require 'devise/rails/routes'
 require 'devise/rails/warden_compat'
 
-# Include UrlHelpers in ActionController and ActionView as soon as they are loaded.
-ActiveSupport.on_load(:action_controller) { include Devise::Controllers::UrlHelpers }
-ActiveSupport.on_load(:action_view) { include Devise::Controllers::UrlHelpers }
-
 module Devise
   class Engine < ::Rails::Engine
     config.devise = Devise
 
+    # Initialize Warden and copy its configurations.
     config.app_middleware.use Warden::Manager do |config|
       Devise.warden_config = config
     end
@@ -16,54 +13,46 @@ module Devise
     # Force routes to be loaded if we are doing any eager load.
     config.before_eager_load { |app| app.reload_routes! }
 
-    config.after_initialize do
-      Devise.encryptor ||= begin
-        warn "[WARNING] config.encryptor is not set in your config/initializers/devise.rb. " \
-          "Devise will then set it to :bcrypt. If you were using the previous default " \
-          "encryptor, please add config.encryptor = :sha1 to your configuration file." if Devise.mailer_sender
-        :bcrypt
-      end
+    initializer "devise.url_helpers" do
+      Devise.include_helpers(Devise::Controllers)
     end
 
-    initializer "devise.add_filters" do |app|
-      app.config.filter_parameters += [:password, :password_confirmation]
-      app.config.filter_parameters.uniq
+    initializer "devise.navigationals" do
+      formats = Devise.navigational_formats
+      if formats.include?(:"*/*") && formats.exclude?("*/*")
+        puts "[DEVISE] We see the symbol :\"*/*\" in the navigational formats in your initializer " \
+          "but not the string \"*/*\". Due to changes in latest Rails, please include the latter."
+      end
     end
 
-    unless Rails.env.production?
-      config.after_initialize do
-        actions = [:confirmation_instructions, :reset_password_instructions, :unlock_instructions]
-
-        translations = begin
-          I18n.t("devise.mailer", :raise => true).map { |k, v| k if v.is_a?(String) }.compact
-        rescue Exception => e # Do not care if something fails
-          []
-        end
-
-        keys = actions & translations
-
-        keys.each do |key|
-          ActiveSupport::Deprecation.warn "The I18n message 'devise.mailer.#{key}' is deprecated. " \
-            "Please use 'devise.mailer.#{key}.subject' instead."
+    initializer "devise.omniauth" do |app|
+      Devise.omniauth_configs.each do |provider, config|
+        app.middleware.use config.strategy_class, *config.args do |strategy|
+          config.strategy = strategy
         end
       end
 
-      config.after_initialize do
-        flash = [:unauthenticated, :unconfirmed, :invalid, :invalid_token, :timeout, :inactive, :locked]
-
-        translations = begin
-          I18n.t("devise.sessions", :raise => true).keys
-        rescue Exception => e # Do not care if something fails
-          []
-        end
-
-        keys = flash & translations
+      if Devise.omniauth_configs.any?
+        Devise.include_helpers(Devise::OmniAuth)
+      end
+    end
 
-        if keys.any?
-          ActiveSupport::Deprecation.warn "The following I18n messages in 'devise.sessions' " \
-            "are deprecated: #{keys.to_sentence}. Please move them to 'devise.failure' instead."
-        end
+    initializer "devise.encryptor_check" do
+      case Devise.encryptor
+      when :bcrypt
+        puts "[DEVISE] From version 1.2, there is no need to set your encryptor to bcrypt " \
+          "since encryptors are only enabled if you include :encryptable in your models. " \
+          "With this change, we can integrate better with bcrypt and get rid of the " \
+          "password_salt column (since bcrypt stores the salt with password). " \
+          "Please comment config.encryptor in your initializer to get rid of this warning."
+      when nil
+        # Nothing to say
+      else
+        puts "[DEVISE] You are using #{Devise.encryptor} as encryptor. From version 1.2, " \
+          "you need to explicitly add `devise :encryptable, :encryptor => :#{Devise.encryptor}` " \
+          "to your models and comment the current value in the config/initializers/devise.rb. " \
+          "You must also add t.encryptable to your existing migrations."
       end
     end
   end
-end
+end

data/lib/devise/schema.rb

@@ -3,12 +3,7 @@ module Devise
   # and overwrite the apply_schema method.
   module Schema
 
-    def authenticatable(*args)
-      ActiveSupport::Deprecation.warn "t.authenticatable in migrations is deprecated. Please use t.database_authenticatable instead.", caller
-      database_authenticatable(*args)
-    end
-
-    # Creates email, encrypted_password and password_salt.
+    # Creates email when enabled (on by default), encrypted_password and password_salt.
     #
     # == Options
     # * :null - When true, allow columns to be null.
@@ -20,18 +15,19 @@ module Devise
     def database_authenticatable(options={})
       null    = options[:null] || false
       default = options.key?(:default) ? options[:default] : ("" if null == false)
+      include_email =  !self.respond_to?(:authentication_keys) || self.authentication_keys.include?(:email)
 
-      if options.delete(:encryptor)
-        ActiveSupport::Deprecation.warn ":encryptor as option is deprecated, simply remove it."
-      end
-
-      apply_devise_schema :email,              String, :null => null, :default => default
+      apply_devise_schema :email,              String, :null => null, :default => default if include_email
       apply_devise_schema :encrypted_password, String, :null => null, :default => default, :limit => 128
-      apply_devise_schema :password_salt,      String, :null => null, :default => default
-    end      
+    end
+
+    # Creates password salt for encryption support.
+    def encryptable
+      apply_devise_schema :password_salt, String
+    end
 
     # Creates authentication_token.
-    def token_authenticatable(options={})
+    def token_authenticatable
       apply_devise_schema :authentication_token, String
     end
 
@@ -48,8 +44,12 @@ module Devise
     end
 
     # Creates remember_token and remember_created_at.
-    def rememberable
-      apply_devise_schema :remember_token,      String
+    #
+    # == Options
+    # * :use_salt - When true, does not create a remember_token and use password_salt instead.
+    def rememberable(options={})
+      use_salt = options.fetch(:use_salt, Devise.use_salt_as_remember_token)
+      apply_devise_schema :remember_token,      String unless use_salt
       apply_devise_schema :remember_created_at, DateTime
     end