devise 1.1.3 → 1.2.0

data/lib/devise/strategies/authenticatable.rb

@@ -9,7 +9,7 @@ module Devise
       attr_accessor :authentication_hash, :password
 
       def valid?
-        valid_for_http_auth? || valid_for_params_auth?
+        valid_for_params_auth? || valid_for_http_auth?
       end
 
     private
@@ -19,13 +19,27 @@ module Devise
         result = resource && resource.valid_for_authentication?(&block)
 
         case result
-        when Symbol, String
+        when String, Symbol
           fail!(result)
+          false
+        when TrueClass
+          decorate(resource)
+          true
         else
           result
         end
       end
 
+      # Get values from params and set in the resource.
+      def decorate(resource)
+        resource.remember_me = remember_me? if resource.respond_to?(:remember_me=)
+      end
+
+      # Should this resource be marked to be remembered?
+      def remember_me?
+        valid_params? && Devise::TRUE_VALUES.include?(params_auth_hash[:remember_me])
+      end
+
       # Check if this is strategy is valid for http authentication by:
       #
       #   * Validating if the model allows params authentication;
@@ -96,15 +110,17 @@ module Devise
 
       # Helper to decode credentials from HTTP.
       def decode_credentials
-        return [] unless request.authorization && request.authorization =~ /^Basic (.*)/
+        return [] unless request.authorization && request.authorization =~ /^Basic (.*)/m
         ActiveSupport::Base64.decode64($1).split(/:/, 2)
       end
 
       # Sets the authentication hash and the password from params_auth_hash or http_auth_hash.
-      def with_authentication_hash(hash)
-        self.authentication_hash = hash.slice(*authentication_keys)
-        self.password = hash[:password]
-        authentication_keys.all?{ |k| authentication_hash[k].present? }
+      def with_authentication_hash(auth_values)
+        self.authentication_hash = {}
+        self.password = auth_values[:password]
+
+        parse_authentication_key_values(auth_values, authentication_keys) &&
+        parse_authentication_key_values(request_values, request_keys)
       end
 
       # Holds the authentication keys.
@@ -112,6 +128,31 @@ module Devise
         @authentication_keys ||= mapping.to.authentication_keys
       end
 
+      # Holds request keys.
+      def request_keys
+        @request_keys ||= mapping.to.request_keys
+      end
+
+      # Returns values from the request object.
+      def request_values
+        keys = request_keys.respond_to?(:keys) ? request_keys.keys : request_keys
+        values = keys.map { |k| self.request.send(k) }
+        Hash[keys.zip(values)]
+      end
+
+      # Parse authentication keys considering if they should be enforced or not.
+      def parse_authentication_key_values(hash, keys)
+        keys.each do |key, enforce|
+          value = hash[key].presence
+          if value
+            self.authentication_hash[key] = value
+          else
+            return false unless enforce == false
+          end
+        end
+        true
+      end
+
       # Holds the authenticatable name for this class. Devise::Strategies::DatabaseAuthenticatable
       # becomes simply :database.
       def authenticatable_name

data/lib/devise/strategies/database_authenticatable.rb

@@ -10,7 +10,7 @@ module Devise
         if validate(resource){ resource.valid_password?(password) }
           resource.after_database_authentication
           success!(resource)
-        else
+        elsif !halted?
           fail(:invalid)
         end
       end

data/lib/devise/strategies/rememberable.rb

@@ -20,7 +20,7 @@ module Devise
 
         if validate(resource)
           success!(resource)
-        else
+        elsif !halted?
           cookies.delete(remember_key)
           pass
         end
@@ -28,6 +28,11 @@ module Devise
 
     private
 
+      def decorate(resource)
+        super
+        resource.extend_remember_period = mapping.to.extend_remember_period if resource.respond_to?(:extend_remember_period=)
+      end
+
       def remember_me?
         true
       end
@@ -36,10 +41,6 @@ module Devise
         "remember_#{scope}_token"
       end
 
-      def extend_remember_period?
-        mapping.to.extend_remember_period
-      end
-
       # Accessor for remember cookie
       def remember_cookie
         @remember_cookie ||= cookies.signed[remember_key]

data/lib/devise/strategies/token_authenticatable.rb

@@ -10,13 +10,17 @@ module Devise
     # For HTTP, you can pass the token as username and blank password. Since some clients may require
     # a password, you can pass "X" as password and it will simply be ignored.
     class TokenAuthenticatable < Authenticatable
+      def store?
+        !mapping.to.stateless_token
+      end
+
       def authenticate!
         resource = mapping.to.find_for_token_authentication(authentication_hash)
 
         if validate(resource)
           resource.after_token_authentication
           success!(resource)
-        else
+        elsif !halted?
           fail(:invalid_token)
         end
       end
@@ -28,7 +32,7 @@ module Devise
         true
       end
 
-      # Do not use remember_me behavir with token.
+      # Do not use remember_me behavior with token.
       def remember_me?
         false
       end

data/lib/devise/test_helpers.rb

@@ -1,4 +1,11 @@
 module Devise
+  # Devise::TestHelpers provides a facility to test controllers in isolation
+  # when using ActionController::TestCase allowing you to quickly sign_in or
+  # sign_out a user. Do not use Devise::TestHelpers in integration tests.
+  #
+  # Notice you should not test Warden specific behavior (like Warden callbacks)
+  # using Devise::TestHelpers since it is a stub of the actual behavior. Such
+  # callbacks should be tested in your integration suite instead.
   module TestHelpers
     def self.included(base)
       base.class_eval do
@@ -37,9 +44,9 @@ module Devise
           env = @controller.request.env
           env["PATH_INFO"] = "/#{result[:action]}"
           env["warden.options"] = result
-          Warden::Manager._before_failure.each{ |hook| hook.call(env, result) }
+          Warden::Manager._run_callbacks(:before_failure, env, result)
 
-          status, headers, body = Devise::FailureApp.call(env).to_a
+          status, headers, body = Devise.warden_config[:failure_app].call(env).to_a
           @controller.send :render, :status => status, :text => body,
             :content_type => headers["Content-Type"], :location => headers["Location"]
 
@@ -61,6 +68,7 @@ module Devise
     end
 
     # sign_in a given resource by storing its keys in the session.
+    # This method bypass any warden authentication callback.
     #
     # Examples:
     #
@@ -74,6 +82,7 @@ module Devise
     end
 
     # Sign out a given resource or scope by calling logout on Warden.
+    # This method bypass any warden logout callback.
     #
     # Examples:
     #
@@ -83,7 +92,8 @@ module Devise
     def sign_out(resource_or_scope)
       scope = Devise::Mapping.find_scope!(resource_or_scope)
       @controller.instance_variable_set(:"@current_#{scope}", nil)
-      warden.logout(scope)
+      user = warden.instance_variable_get(:@users).delete(scope)
+      warden.session_serializer.delete(scope, user)
     end
 
   end

data/lib/devise/version.rb

@@ -1,3 +1,3 @@
 module Devise
-  VERSION = "1.1.3".freeze
+  VERSION = "1.2.0".freeze
 end

data/lib/devise.rb

@@ -1,8 +1,12 @@
+require 'rails'
 require 'active_support/core_ext/numeric/time'
 require 'active_support/dependencies'
+require 'orm_adapter'
+require 'set'
 
 module Devise
   autoload :FailureApp, 'devise/failure_app'
+  autoload :OmniAuth, 'devise/omniauth'
   autoload :PathChecker, 'devise/path_checker'
   autoload :Schema, 'devise/schema'
   autoload :TestHelpers, 'devise/test_helpers'
@@ -10,13 +14,13 @@ module Devise
   module Controllers
     autoload :Helpers, 'devise/controllers/helpers'
     autoload :InternalHelpers, 'devise/controllers/internal_helpers'
+    autoload :Rememberable, 'devise/controllers/rememberable'
     autoload :ScopedViews, 'devise/controllers/scoped_views'
     autoload :UrlHelpers, 'devise/controllers/url_helpers'
   end
 
   module Encryptors
     autoload :Base, 'devise/encryptors/base'
-    autoload :Bcrypt, 'devise/encryptors/bcrypt'
     autoload :AuthlogicSha512, 'devise/encryptors/authlogic_sha512'
     autoload :ClearanceSha1, 'devise/encryptors/clearance_sha1'
     autoload :RestfulAuthenticationSha1, 'devise/encryptors/restful_authentication_sha1'
@@ -30,11 +34,12 @@ module Devise
   end
 
   # Constants which holds devise configuration for extensions. Those should
-  # not be modified by the "end user".
+  # not be modified by the "end user" (this is why they are constants).
   ALL         = []
   CONTROLLERS = ActiveSupport::OrderedHash.new
   ROUTES      = ActiveSupport::OrderedHash.new
   STRATEGIES  = ActiveSupport::OrderedHash.new
+  URL_HELPERS = ActiveSupport::OrderedHash.new
 
   # True values used to check params
   TRUE_VALUES = [true, 1, '1', 't', 'T', 'true', 'TRUE']
@@ -45,31 +50,35 @@ module Devise
     :sha512 => 128,
     :clearance_sha1 => 40,
     :restful_authentication_sha1 => 40,
-    :authlogic_sha512 => 128,
-    :bcrypt => 60
+    :authlogic_sha512 => 128
   }
 
   # Custom domain for cookies. Not set by default
-  mattr_accessor :cookie_domain
-  @@cookie_domain = false
-
-  # Used to encrypt password. Please generate one with rake secret.
-  mattr_accessor :pepper
-  @@pepper = nil
+  mattr_accessor :cookie_options
+  @@cookie_options = {}
 
   # The number of times to encrypt password.
   mattr_accessor :stretches
   @@stretches = 10
 
-  # Keys used when authenticating an user.
+  # Keys used when authenticating a user.
   mattr_accessor :authentication_keys
   @@authentication_keys = [ :email ]
 
+  # Request keys used when authenticating a user.
+  mattr_accessor :request_keys
+  @@request_keys = []
+
+  # Keys that should be case-insensitive.
+  # False by default for backwards compatibility.
+  mattr_accessor :case_insensitive_keys
+  @@case_insensitive_keys = false
+
   # If http authentication is enabled by default.
   mattr_accessor :http_authenticatable
-  @@http_authenticatable = true
+  @@http_authenticatable = false
 
-  # If http authentication is used for ajax requests.  True by default.
+  # If http headers should be returned for ajax requests. True by default.
   mattr_accessor :http_authenticatable_on_xhr
   @@http_authenticatable_on_xhr = true
 
@@ -83,7 +92,7 @@ module Devise
 
   # Email regex used to validate email formats. Adapted from authlogic.
   mattr_accessor :email_regexp
-  @@email_regexp = /^([\w\.%\+\-]+)@([\w\-]+\.)+([\w]{2,})$/i
+  @@email_regexp = /\A([\w\.%\+\-]+)@([\w\-]+\.)+([\w]{2,})\z/i
 
   # Range validation for password length
   mattr_accessor :password_length
@@ -101,22 +110,31 @@ module Devise
   mattr_accessor :extend_remember_period
   @@extend_remember_period = false
 
+  # If true, uses salt as remember token and does not create it in the database.
+  # By default is false for backwards compatibility.
+  mattr_accessor :use_salt_as_remember_token
+  @@use_salt_as_remember_token = false
+
   # Time interval you can access your account before confirming your account.
   mattr_accessor :confirm_within
   @@confirm_within = 0.days
 
+  # Defines which key will be used when confirming an account
+  mattr_accessor :confirmation_keys
+  @@confirmation_keys = [ :email ]
+
   # Time interval to timeout the user session without activity.
   mattr_accessor :timeout_in
   @@timeout_in = 30.minutes
 
+  # Used to encrypt password. Please generate one with rake secret.
+  mattr_accessor :pepper
+  @@pepper = nil
+
   # Used to define the password encryption algorithm.
   mattr_accessor :encryptor
   @@encryptor = nil
 
-  # Store scopes mappings.
-  mattr_accessor :mappings
-  @@mappings = ActiveSupport::OrderedHash.new
-
   # Tells if devise should apply the schema in ORMs where devise declaration
   # and schema belongs to the same class (as Datamapper and Mongoid).
   mattr_accessor :apply_schema
@@ -132,6 +150,10 @@ module Devise
   mattr_accessor :lock_strategy
   @@lock_strategy = :failed_attempts
 
+  # Defines which key will be used when locking and unlocking an account
+  mattr_accessor :unlock_keys
+  @@unlock_keys = [ :email ]
+
   # Defines which strategy can be used to unlock an account.
   # Values: :email, :time, :both
   mattr_accessor :unlock_strategy
@@ -145,6 +167,10 @@ module Devise
   mattr_accessor :unlock_in
   @@unlock_in = 1.hour
 
+  # Defines which key will be used when recovering the password for an account
+  mattr_accessor :reset_password_keys
+  @@reset_password_keys = [ :email ]
+
   # The default scope which is used by warden.
   mattr_accessor :default_scope
   @@default_scope = nil
@@ -157,59 +183,98 @@ module Devise
   mattr_accessor :token_authentication_key
   @@token_authentication_key = :auth_token
 
+  # If true, authentication through token does not store user in session
+  mattr_accessor :stateless_token
+  @@stateless_token = false
+
   # Which formats should be treated as navigational.
+  # We need both :"*/*" and "*/*" to work on different Rails versions.
   mattr_accessor :navigational_formats
-  @@navigational_formats = [:html]
+  @@navigational_formats = [:"*/*", "*/*", :html]
+
+  # When set to true, signing out a user signs out all other scopes.
+  mattr_accessor :sign_out_all_scopes
+  @@sign_out_all_scopes = true
+
+  # The default method used while signing out
+  mattr_accessor :sign_out_via
+  @@sign_out_via = :get
+
+  # PRIVATE CONFIGURATION
+
+  # Store scopes mappings.
+  mattr_reader :mappings
+  @@mappings = ActiveSupport::OrderedHash.new
+
+  # Omniauth configurations.
+  mattr_reader :omniauth_configs
+  @@omniauth_configs = ActiveSupport::OrderedHash.new
+
+  # Define a set of modules that are called when a mapping is added.
+  mattr_reader :helpers
+  @@helpers = Set.new
+  @@helpers << Devise::Controllers::Helpers
 
   # Private methods to interface with Warden.
   mattr_accessor :warden_config
   @@warden_config = nil
   @@warden_config_block = nil
 
-  # When set to true, signing out an user signs out all other scopes.
-  mattr_accessor :sign_out_all_scopes
-  @@sign_out_all_scopes = false
-
-  def self.use_default_scope=(*)
-    ActiveSupport::Deprecation.warn "config.use_default_scope is deprecated and removed from Devise. " <<
-      "If you are using non conventional routes in Devise, all you need to do is to pass the devise " <<
-      "scope in the router DSL:\n\n  as :user do\n    get \"sign_in\", :to => \"devise/sessions\"\n  end\n\n" <<
-      "The method :as is also aliased to :devise_scope. Choose the one you prefer.", caller
-  end
-
   # Default way to setup Devise. Run rails generate devise_install to create
   # a fresh initializer with all configuration values.
   def self.setup
     yield self
   end
 
+  def self.ref(arg)
+    if defined?(ActiveSupport::Dependencies::ClassCache)
+      ActiveSupport::Dependencies::Reference.store(arg)
+    else
+      ActiveSupport::Dependencies.ref(arg)
+    end
+  end
+
+  def self.omniauth_providers
+    omniauth_configs.keys
+  end
+
+  def self.cookie_domain=(value)
+    ActiveSupport::Deprecation.warn "Devise.cookie_domain=(value) is deprecated. "
+      "Please use Devise.cookie_options = { :domain => value } instead."
+    self.cookie_options[:domain] = value
+  end
+
   # Get the mailer class from the mailer reference object.
   def self.mailer
-    @@mailer_ref.get
+    if defined?(ActiveSupport::Dependencies::ClassCache)
+      @@mailer_ref.get "Devise::Mailer"
+    else
+      @@mailer_ref.get
+    end
   end
 
   # Set the mailer reference object to access the mailer.
   def self.mailer=(class_name)
-    @@mailer_ref = ActiveSupport::Dependencies.ref(class_name)
+    @@mailer_ref = ref(class_name)
   end
   self.mailer = "Devise::Mailer"
 
   # Small method that adds a mapping to Devise.
   def self.add_mapping(resource, options)
     mapping = Devise::Mapping.new(resource, options)
-    self.mappings[mapping.name] = mapping
-    self.default_scope ||= mapping.name
+    @@mappings[mapping.name] = mapping
+    @@default_scope ||= mapping.name
+    @@helpers.each { |h| h.define_helpers(mapping) }
     mapping
   end
 
-  # Make Devise aware of an 3rd party Devise-module. For convenience.
+  # Make Devise aware of an 3rd party Devise-module (like invitable). For convenience.
   #
   # == Options:
   #
   #   +model+      - String representing the load path to a custom *model* for this module (to autoload.)
   #   +controller+ - Symbol representing the name of an exisiting or custom *controller* for this module.
   #   +route+      - Symbol representing the named *route* helper for this module.
-  #   +flash+      - Symbol representing the *flash messages* used by this helper.
   #   +strategy+   - Symbol representing if this module got a custom *strategy*.
   #
   # All values, except :model, accept also a boolean and will have the same name as the given module
@@ -225,26 +290,36 @@ module Devise
     ALL << module_name
     options.assert_valid_keys(:strategy, :model, :controller, :route)
 
-    config = {
-      :strategy => STRATEGIES,
-      :route => ROUTES,
-      :controller => CONTROLLERS
-    }
+    if strategy = options[:strategy]
+      STRATEGIES[module_name] = (strategy == true ? module_name : strategy)
+    end
 
-    config.each do |key, value|
-      next unless options[key]
-      name = (options[key] == true ? module_name : options[key])
+    if controller = options[:controller]
+      CONTROLLERS[module_name] = (controller == true ? module_name : controller)
+    end
 
-      if value.is_a?(Hash)
-        value[module_name] = name
+    if route = options[:route]
+      case route
+      when TrueClass
+        key, value = module_name, []
+      when Symbol
+        key, value = route, []
+      when Hash
+        key, value = route.keys.first, route.values.flatten
       else
-        value << name unless value.include?(name)
+        raise ArgumentError, ":route should be true, a Symbol or a Hash"
       end
+
+      URL_HELPERS[key] ||= []
+      URL_HELPERS[key].concat(value)
+      URL_HELPERS[key].uniq!
+
+      ROUTES[module_name] = key
     end
 
     if options[:model]
-      model_path = (options[:model] == true ? "devise/models/#{module_name}" : options[:model])
-      Devise::Models.send(:autoload, module_name.to_s.camelize.to_sym, model_path)
+      path = (options[:model] == true ? "devise/models/#{module_name}" : options[:model])
+      Devise::Models.send(:autoload, module_name.to_s.camelize.to_sym, path)
     end
 
     Devise::Mapping.add_module module_name
@@ -265,12 +340,39 @@ module Devise
     @@warden_config_block = block
   end
 
+  # Specify an omniauth provider.
+  #
+  #   config.omniauth :github, APP_ID, APP_SECRET
+  #
+  def self.omniauth(provider, *args)
+    @@helpers << Devise::OmniAuth::UrlHelpers
+    @@omniauth_configs[provider] = Devise::OmniAuth::Config.new(provider, args)
+  end
+
+  # Include helpers in the given scope to AC and AV.
+  def self.include_helpers(scope)
+    ActiveSupport.on_load(:action_controller) do
+      include scope::Helpers if defined?(scope::Helpers)
+      include scope::UrlHelpers
+    end
+
+    ActiveSupport.on_load(:action_view) do
+      include scope::UrlHelpers
+    end
+  end
+
+  # Returns true if Rails version is bigger than 3.0.x
+  def self.rack_session?
+    Rails::VERSION::STRING[0,3] != "3.0"
+  end
+
   # A method used internally to setup warden manager from the Rails initialize
   # block.
   def self.configure_warden! #:nodoc:
     @@warden_configured ||= begin
       warden_config.failure_app   = Devise::FailureApp
       warden_config.default_scope = Devise.default_scope
+      warden_config.intercept_401 = false
 
       Devise.mappings.each_value do |mapping|
         warden_config.scope_defaults mapping.name, :strategies => mapping.strategies
@@ -283,7 +385,17 @@ module Devise
 
   # Generate a friendly string randomically to be used as token.
   def self.friendly_token
-    ActiveSupport::SecureRandom.base64(15).tr('+/=', '-_ ').strip.delete("\n")
+    ActiveSupport::SecureRandom.base64(15).tr('+/=', 'xyz')
+  end
+
+  # constant-time comparison algorithm to prevent timing attacks
+  def self.secure_compare(a, b)
+    return false if a.blank? || b.blank? || a.bytesize != b.bytesize
+    l = a.unpack "C#{a.bytesize}"
+
+    res = 0
+    b.each_byte { |byte| res |= byte ^ l.shift }
+    res == 0
   end
 end
 

data/lib/generators/active_record/devise_generator.rb

@@ -10,7 +10,7 @@ module ActiveRecord
       source_root File.expand_path("../templates", __FILE__)
 
       def generate_model
-        invoke "active_record:model", [name], :migration => false unless model_exists?
+        invoke "active_record:model", [name], :migration => false unless model_exists? && behavior == :invoke
       end
 
       def copy_devise_migration
@@ -18,7 +18,7 @@ module ActiveRecord
       end
 
       def inject_devise_content
-        inject_into_class model_path, class_name, model_contents + <<-CONTENT
+        inject_into_class(model_path, class_name, model_contents + <<CONTENT) if model_exists?
   # Setup accessible (or protected) attributes for your model
   attr_accessible :email, :password, :password_confirmation, :remember_me
 CONTENT

data/lib/generators/active_record/templates/migration.rb

@@ -6,6 +6,7 @@ class DeviseCreate<%= table_name.camelize %> < ActiveRecord::Migration
       t.rememberable
       t.trackable
 
+      # t.encryptable
       # t.confirmable
       # t.lockable :lock_strategy => :<%= Devise.lock_strategy %>, :unlock_strategy => :<%= Devise.unlock_strategy %>
       # t.token_authenticatable
@@ -21,6 +22,7 @@ class DeviseCreate<%= table_name.camelize %> < ActiveRecord::Migration
     add_index :<%= table_name %>, :reset_password_token, :unique => true
     # add_index :<%= table_name %>, :confirmation_token,   :unique => true
     # add_index :<%= table_name %>, :unlock_token,         :unique => true
+    # add_index :<%= table_name %>, :authentication_token, :unique => true
   end
 
   def self.down

data/lib/generators/devise/devise_generator.rb

@@ -10,7 +10,9 @@ module Devise
       hook_for :orm
 
       def add_devise_routes
-        route "devise_for :#{table_name}"
+        devise_route  = "devise_for :#{plural_name}"
+        devise_route += %Q(, :class_name => "#{class_name}") if class_name.include?("::")
+        route devise_route
       end
     end
   end

data/lib/generators/devise/orm_helpers.rb

@@ -4,7 +4,7 @@ module Devise
       def model_contents
 <<-CONTENT
   # Include default devise modules. Others available are:
-  # :token_authenticatable, :confirmable, :lockable and :timeoutable
+  # :token_authenticatable, :encryptable, :confirmable, :lockable, :timeoutable and :omniauthable
   devise :database_authenticatable, :registerable,
          :recoverable, :rememberable, :trackable, :validatable