devise 1.1.9 → 1.2.rc

data/lib/devise/controllers/helpers.rb

@@ -5,8 +5,57 @@ module Devise
       extend ActiveSupport::Concern
 
       included do
-        helper_method :warden, :signed_in?, :devise_controller?, :anybody_signed_in?,
-                      *Devise.mappings.keys.map { |m| [:"current_#{m}", :"#{m}_signed_in?", :"#{m}_session"] }.flatten
+        helper_method :warden, :signed_in?, :devise_controller?, :anybody_signed_in?
+      end
+
+      # Define authentication filters and accessor helpers based on mappings.
+      # These filters should be used inside the controllers as before_filters,
+      # so you can control the scope of the user who should be signed in to
+      # access that specific controller/action.
+      # Example:
+      #
+      #   Roles:
+      #     User
+      #     Admin
+      #
+      #   Generated methods:
+      #     authenticate_user!  # Signs user in or redirect
+      #     authenticate_admin! # Signs admin in or redirect
+      #     user_signed_in?     # Checks whether there is an user signed in or not
+      #     admin_signed_in?    # Checks whether there is an admin signed in or not
+      #     current_user        # Current signed in user
+      #     current_admin       # Current signed in admin
+      #     user_session        # Session data available only to the user scope
+      #     admin_session       # Session data available only to the admin scope
+      #
+      #   Use:
+      #     before_filter :authenticate_user!  # Tell devise to use :user map
+      #     before_filter :authenticate_admin! # Tell devise to use :admin map
+      #
+      def self.define_helpers(mapping) #:nodoc:
+        mapping = mapping.name
+
+        class_eval <<-METHODS, __FILE__, __LINE__ + 1
+          def authenticate_#{mapping}!
+            warden.authenticate!(:scope => :#{mapping})
+          end
+
+          def #{mapping}_signed_in?
+            !!current_#{mapping}
+          end
+
+          def current_#{mapping}
+            @current_#{mapping} ||= warden.authenticate(:scope => :#{mapping})
+          end
+
+          def #{mapping}_session
+            current_#{mapping} && warden.session(:#{mapping})
+          end
+        METHODS
+
+        ActiveSupport.on_load(:action_controller) do
+          helper_method "current_#{mapping}", "#{mapping}_signed_in?", "#{mapping}_session"
+        end
       end
 
       # The main accessor for the warden proxy instance
@@ -16,7 +65,7 @@ module Devise
 
       # Return true if it's a devise_controller. false to all controllers unless
       # the controllers defined inside devise. Useful if you want to apply a before
-      # filter to all controller, except the ones in devise:
+      # filter to all controllers, except the ones in devise:
       #
       #   before_filter :my_filter, :unless => { |c| c.devise_controller? }
       def devise_controller?
@@ -38,15 +87,30 @@ module Devise
       # Sign in an user that already was authenticated. This helper is useful for logging
       # users in after sign up.
       #
-      # Examples:
+      # All options given to sign_in is passed forward to the set_user method in warden.
+      # The only exception is the :bypass option, which bypass warden callbacks and stores
+      # the user straight in session. This option is useful in cases the user is already
+      # signed in, but we want to refresh the credentials in session.
       #
-      #   sign_in :user, @user    # sign_in(scope, resource)
-      #   sign_in @user           # sign_in(resource)
+      # Examples:
       #
-      def sign_in(resource_or_scope, resource=nil)
-        scope      = Devise::Mapping.find_scope!(resource_or_scope)
-        resource ||= resource_or_scope
-        warden.set_user(resource, :scope => scope)
+      #   sign_in :user, @user                      # sign_in(scope, resource)
+      #   sign_in @user                             # sign_in(resource)
+      #   sign_in @user, :event => :authentication  # sign_in(resource, options)
+      #   sign_in @user, :bypass => true            # sign_in(resource, options)
+      # 
+      def sign_in(resource_or_scope, *args)
+        options  = args.extract_options!
+        scope    = Devise::Mapping.find_scope!(resource_or_scope)
+        resource = args.last || resource_or_scope
+
+        expire_session_data_after_sign_in!
+
+        if options[:bypass]
+          warden.session_serializer.store(resource, scope)
+        else
+          warden.set_user(resource, options.merge!(:scope => scope))
+        end
       end
 
       # Sign out a given user or scope. This helper is useful for signing out an user
@@ -57,7 +121,8 @@ module Devise
       #   sign_out :user     # sign_out(scope)
       #   sign_out @user     # sign_out(resource)
       #
-      def sign_out(resource_or_scope)
+      def sign_out(resource_or_scope=nil)
+        return sign_out_all_scopes unless resource_or_scope
         scope = Devise::Mapping.find_scope!(resource_or_scope)
         warden.user(scope) # Without loading user here, before_logout hook is not called
         warden.raw_session.inspect # Without this inspect here. The session does not clear.
@@ -65,13 +130,10 @@ module Devise
       end
 
       # Sign out all active users or scopes. This helper is useful for signing out all roles
-      # in one click.
+      # in one click. This signs out ALL scopes in warden.
       def sign_out_all_scopes
-        # Not "warden.logout" since we need to sign_out only devise-defined scopes.
-        scopes = Devise.mappings.keys
-        scopes.each { |scope| warden.user(scope) }
         warden.raw_session.inspect
-        warden.logout(*scopes)
+        warden.logout
       end
 
       # Returns and delete the url stored in the session for the given scope. Useful
@@ -118,36 +180,6 @@ module Devise
         respond_to?(home_path, true) ? send(home_path) : root_path
       end
 
-      # The default url to be used after updating a resource. This is used by all Devise
-      # controllers and you can overwrite it in your ApplicationController to
-      # provide a custom hook for a custom resource.
-      #
-      # By default, it first tries to find a resource_root_path, otherwise it
-      # uses the root path. For a user scope, you can define the default url in
-      # the following way:
-      #
-      #   map.user_root '/users', :controller => 'users' # creates user_root_path
-      #
-      #   map.resources :users do |users|
-      #     users.root # creates user_root_path
-      #   end
-      #
-      #
-      # If none of these are defined, root_path is used. However, if this default
-      # is not enough, you can customize it, for example:
-      #
-      #   def after_update_path_for(resource)
-      #     if resource.is_a?(User) && resource.can_publish?
-      #       publisher_url
-      #     else
-      #       super
-      #     end
-      #   end
-      #
-      def after_update_path_for(resource_or_scope)
-        after_sign_in_path_for(resource_or_scope)
-      end
-
       # Method used by sessions controller to sign out an user. You can overwrite
       # it in your ApplicationController to provide a custom hook for a custom
       # scope. Notice that differently from +after_sign_in_path_for+ this method
@@ -159,14 +191,23 @@ module Devise
       end
 
       # Sign in an user and tries to redirect first to the stored location and
-      # then to the url specified by after_sign_in_path_for.
-      #
-      # If just a symbol is given, consider that the user was already signed in
-      # through other means and just perform the redirection.
-      def sign_in_and_redirect(resource_or_scope, resource=nil)
-        scope      = Devise::Mapping.find_scope!(resource_or_scope)
-        resource ||= resource_or_scope
-        sign_in(scope, resource) unless warden.user(scope) == resource
+      # then to the url specified by after_sign_in_path_for. It accepts the same
+      # parameters as the sign_in method.
+      def sign_in_and_redirect(resource_or_scope, *args)
+        options  = args.extract_options!
+        scope    = Devise::Mapping.find_scope!(resource_or_scope)
+        resource = args.last || resource_or_scope
+
+        if warden.user(scope) == resource
+          expire_session_data_after_sign_in!
+        else
+          sign_in(scope, resource, options)
+        end
+
+        redirect_for_sign_in(scope, resource)
+      end
+
+      def redirect_for_sign_in(scope, resource) #:nodoc:
         redirect_to stored_location_for(scope) || after_sign_in_path_for(resource)
       end
 
@@ -174,64 +215,19 @@ module Devise
       # after_sign_out_path_for.
       def sign_out_and_redirect(resource_or_scope)
         scope = Devise::Mapping.find_scope!(resource_or_scope)
-        if Devise.sign_out_all_scopes
-          sign_out_all_scopes
-        else
-          sign_out(scope)
-        end
-        redirect_to after_sign_out_path_for(scope)
+        Devise.sign_out_all_scopes ? sign_out : sign_out(scope)
+        redirect_for_sign_out(scope)
       end
 
-      # Override Rails' handle unverified request to sign out all scopes.
-      def handle_unverified_request
-        sign_out_all_scopes
-        super # call the default behaviour which resets the session
+      def redirect_for_sign_out(scope) #:nodoc:
+        redirect_to after_sign_out_path_for(scope)
       end
 
-      # Define authentication filters and accessor helpers based on mappings.
-      # These filters should be used inside the controllers as before_filters,
-      # so you can control the scope of the user who should be signed in to
-      # access that specific controller/action.
-      # Example:
-      #
-      #   Roles:
-      #     User
-      #     Admin
-      #
-      #   Generated methods:
-      #     authenticate_user!  # Signs user in or redirect
-      #     authenticate_admin! # Signs admin in or redirect
-      #     user_signed_in?     # Checks whether there is an user signed in or not
-      #     admin_signed_in?    # Checks whether there is an admin signed in or not
-      #     current_user        # Current signed in user
-      #     current_admin       # Currend signed in admin
-      #     user_session        # Session data available only to the user scope
-      #     admin_session       # Session data available only to the admin scope
-      #
-      #   Use:
-      #     before_filter :authenticate_user!  # Tell devise to use :user map
-      #     before_filter :authenticate_admin! # Tell devise to use :admin map
-      #
-      Devise.mappings.each_key do |mapping|
-        class_eval <<-METHODS, __FILE__, __LINE__ + 1
-          def authenticate_#{mapping}!
-            warden.authenticate!(:scope => :#{mapping})
-          end
-
-          def #{mapping}_signed_in?
-            warden.authenticate?(:scope => :#{mapping})
-          end
-
-          def current_#{mapping}
-            @current_#{mapping} ||= warden.authenticate(:scope => :#{mapping})
-          end
-
-          def #{mapping}_session
-            current_#{mapping} && warden.session(:#{mapping})
-          end
-        METHODS
+      # A hook called to expire session data after sign up/in. All keys
+      # stored under "devise." namespace are removed after sign in.
+      def expire_session_data_after_sign_in!
+        session.keys.grep(/^devise\./).each { |k| session.delete(k) }
       end
-
     end
   end
 end

data/lib/devise/controllers/internal_helpers.rb

@@ -10,7 +10,7 @@ module Devise
       included do
         helper DeviseHelper
 
-        helpers = %w(resource scope_name resource_name
+        helpers = %w(resource scope_name resource_name signed_in_resource
                      resource_class devise_mapping devise_controller?)
         hide_action *helpers
         helper_method *helpers
@@ -35,6 +35,11 @@ module Devise
         devise_mapping.to
       end
 
+      # Returns a signed in resource from session (if one exists)
+      def signed_in_resource
+        warden.authenticate(:scope => resource_name)
+      end
+
       # Attempt to find the mapped route for devise based on request path
       def devise_mapping
         @devise_mapping ||= request.env["devise.mapping"]
@@ -49,7 +54,12 @@ module Devise
 
       # Checks whether it's a devise mapped resource or not.
       def is_devise_resource? #:nodoc:
-        raise ActionController::UnknownAction unless devise_mapping
+        unknown_action!("Could not find devise mapping for path #{request.fullpath.inspect}") unless devise_mapping
+      end
+
+      def unknown_action!(msg)
+        logger.debug "[Devise] #{msg}" if logger
+        raise ActionController::UnknownAction, msg
       end
 
       # Sets the resource creating an instance variable
@@ -68,7 +78,10 @@ module Devise
       # Example:
       #   before_filter :require_no_authentication, :only => :new
       def require_no_authentication
-        redirect_to after_sign_in_path_for(resource_name) if warden.authenticated?(resource_name)
+        if warden.authenticated?(resource_name)
+          resource = warden.user(resource_name)
+          redirect_to after_sign_in_path_for(resource)
+        end
       end
 
       # Sets the flash message with :key, using I18n. By default you are able
@@ -85,12 +98,15 @@ module Devise
       #
       # Please refer to README or en.yml locale file to check what messages are
       # available.
-      def set_flash_message(key, kind)
-        flash[key] = I18n.t(:"#{resource_name}.#{kind}", :resource_name => resource_name,
-                            :scope => [:devise, controller_name.to_sym], :default => kind)
+      def set_flash_message(key, kind, options={}) #:nodoc:
+        options[:scope] = "devise.#{controller_name}"
+        options[:default] = Array(options[:default]).unshift(kind.to_sym)
+        options[:resource_name] = resource_name
+        message = I18n.t("#{resource_name}.#{kind}", options)
+        flash[key] = message if message.present?
       end
 
-      def clean_up_passwords(object)
+      def clean_up_passwords(object) #:nodoc:
         object.clean_up_passwords if object.respond_to?(:clean_up_passwords)
       end
     end

data/lib/devise/controllers/scoped_views.rb

@@ -17,17 +17,15 @@ module Devise
 
       # Render a view for the specified scope. Turned off by default.
       # Accepts just :controller as option.
-      def render_with_scope(action, options={})
-        controller_name = options.delete(:controller) || self.controller_name
-
+      def render_with_scope(action, path=self.controller_path)
         if self.class.scoped_views?
           begin
-            render :template => "#{devise_mapping.plural}/#{controller_name}/#{action}"
+            render :template => "#{devise_mapping.scoped_path}/#{path.split("/").last}/#{action}"
           rescue ActionView::MissingTemplate
-            render :template => "#{controller_path}/#{action}"
+            render :template => "#{path}/#{action}"
           end
         else
-          render :template => "#{controller_path}/#{action}"
+          render :template => "#{path}/#{action}"
         end
       end
     end

data/lib/devise/controllers/url_helpers.rb

@@ -19,13 +19,11 @@ module Devise
     # Those helpers are added to your ApplicationController.
     module UrlHelpers
 
-      Devise::ROUTES.values.uniq.each do |module_name|
+      Devise::URL_HELPERS.each do |module_name, actions|
         [:path, :url].each do |path_or_url|
-          actions = [ nil, :new_ ]
-          actions << :edit_    if [:password, :registration].include?(module_name)
-          actions << :destroy_ if [:session].include?(module_name)
-
           actions.each do |action|
+            action = action ? "#{action}_" : ""
+
             class_eval <<-URL_HELPERS, __FILE__, __LINE__ + 1
               def #{action}#{module_name}_#{path_or_url}(resource_or_scope, *args)
                 scope = Devise::Mapping.find_scope!(resource_or_scope)

data/lib/devise/encryptors/base.rb

@@ -13,7 +13,7 @@ module Devise
       end
 
       def self.salt(stretches)
-        Devise.friendly_token
+        Devise.friendly_token[0,20]
       end
     end
   end

data/lib/devise/encryptors/restful_authentication_sha1.rb

@@ -5,10 +5,10 @@ module Devise
     # = RestfulAuthenticationSha1
     # Simulates Restful Authentication's default encryption mechanism.
     # Warning: it uses Devise's pepper to port the concept of REST_AUTH_SITE_KEY
-    # Warning: it uses Devise's stretches configuration to port the concept of REST_AUTH_DIGEST_STRETCHES. Should be set to 10 in 
-    # the initializer to silumate the default behavior.
+    # Warning: it uses Devise's stretches configuration to port the concept of REST_AUTH_DIGEST_STRETCHES. Should be set to 10 in
+    # the initializer to simulate the default behavior.
     class RestfulAuthenticationSha1 < Base
-      
+
       # Gererates a default password digest based on salt, pepper and the
       # incoming password.
       def self.digest(password, stretches, salt, pepper)
@@ -19,4 +19,4 @@ module Devise
 
     end
   end
-end
+end

data/lib/devise/failure_app.rb

@@ -33,7 +33,7 @@ module Devise
 
     def http_auth
       self.status = 401
-      self.headers["WWW-Authenticate"] = %(Basic realm=#{Devise.http_authentication_realm.inspect})
+      self.headers["WWW-Authenticate"] = %(Basic realm=#{Devise.http_authentication_realm.inspect}) if http_auth_header?
       self.content_type = request.format.to_s
       self.response_body = http_auth_body
     end
@@ -41,12 +41,12 @@ module Devise
     def recall
       env["PATH_INFO"]  = attempted_path
       flash.now[:alert] = i18n_message(:invalid)
-      self.response = recall_controller.action(warden_options[:recall]).call(env)
+      self.response = recall_app(warden_options[:recall]).call(env)
     end
 
     def redirect
       store_location!
-      flash[:alert] = i18n_message unless flash[:notice]
+      flash[:alert] = i18n_message
       redirect_to redirect_url
     end
 
@@ -67,17 +67,37 @@ module Devise
       send(:"new_#{scope}_session_path")
     end
 
+    # Choose whether we should respond in a http authentication fashion,
+    # including 401 and optional headers.
+    #
+    # This method allows the user to explicitly disable http authentication
+    # on ajax requests in case they want to redirect on failures instead of
+    # handling the errors on their own. This is useful in case your ajax API
+    # is the same as your public API and uses a format like JSON (so you
+    # cannot mark JSON as a navigational format).
     def http_auth?
-      !Devise.navigational_formats.include?(request_format) || (request.xhr? && Devise.http_authenticatable_on_xhr)
+      if request.xhr?
+        Devise.http_authenticatable_on_xhr
+      else
+        !(request.format && Devise.navigational_formats.include?(request.format.to_sym))
+      end
+    end
+
+    # It does not make sense to send authenticate headers in ajax requests
+    # or if the user disabled them.
+    def http_auth_header?
+      Devise.mappings[scope].to.http_authenticatable && !request.xhr?
     end
 
     def http_auth_body
-      method = :"to_#{request_format}"
+      return i18n_message unless request.format
+      method = "to_#{request.format.to_sym}"
       {}.respond_to?(method) ? { :error => i18n_message }.send(method) : i18n_message
     end
 
-    def recall_controller
-      "#{params[:controller].camelize}Controller".constantize
+    def recall_app(app)
+      controller, action = app.split("#")
+      "#{controller.camelize}Controller".constantize.action(action)
     end
 
     def warden
@@ -89,7 +109,7 @@ module Devise
     end
 
     def scope
-      @scope ||= warden_options[:scope]
+      @scope ||= warden_options[:scope] || Devise.default_scope
     end
 
     def attempted_path
@@ -101,19 +121,7 @@ module Devise
     # yet, but we still need to store the uri based on scope, so different scopes
     # would never use the same uri to redirect.
     def store_location!
-      session[:"#{scope}_return_to"] = attempted_path if request.get? && !http_auth?
-    end
-
-    MIME_REFERENCES = Mime::HTML.respond_to?(:ref)
-
-    def request_format
-      @request_format ||= if request.format.respond_to?(:ref)
-        request.format.ref
-      elsif MIME_REFERENCES
-        request.format
-      else # Rails < 3.0.4
-        request.format.to_sym
-      end
+      session["#{scope}_return_to"] = attempted_path if request.get? && !http_auth?
     end
   end
 end