devise 1.1.9 → 1.2.rc

data/lib/devise/hooks/forgetable.rb

@@ -5,7 +5,8 @@
 Warden::Manager.before_logout do |record, warden, options|
   if record.respond_to?(:forget_me!)
     record.forget_me! unless record.frozen?
-    cookie_options = record.cookie_domain? ? { :domain => record.cookie_domain } : {}
+    cookie_options = Rails.configuration.session_options.slice(:path, :domain, :secure)
+    cookie_options.merge!(record.cookie_options)
     warden.cookies.delete("remember_#{options[:scope]}_token", cookie_options)
   end
 end

data/lib/devise/hooks/rememberable.rb

@@ -10,20 +10,22 @@ module Devise
 
         if succeeded? && resource.respond_to?(:remember_me!) && remember_me?
           resource.remember_me!(extend_remember_period?)
-
-          configuration = {
-            :value => resource.class.serialize_into_cookie(resource),
-            :expires => resource.remember_expires_at,
-            :path => "/"
-          }
-
-          configuration[:domain] = resource.cookie_domain if resource.cookie_domain?
-          cookies.signed["remember_#{scope}_token"] = configuration
+          cookies.signed["remember_#{scope}_token"] = cookie_values(resource)
         end
       end
 
     protected
 
+      def cookie_values(resource)
+        options = Rails.configuration.session_options.slice(:path, :domain, :secure)
+        options.merge!(resource.cookie_options)
+        options.merge!(
+          :value => resource.class.serialize_into_cookie(resource),
+          :expires => resource.remember_expires_at
+        )
+        options
+      end
+
       def succeeded?
         @result == :success
       end

data/lib/devise/mapping.rb

@@ -22,7 +22,7 @@ module Devise
   #   # is the modules included in the class
   #
   class Mapping #:nodoc:
-    attr_reader :singular, :plural, :path, :controllers, :path_names, :class_name
+    attr_reader :singular, :scoped_path, :path, :controllers, :path_names, :class_name, :sign_out_via
     alias :name :singular
 
     # Receives an object and find a scope for it. If a scope cannot be found,
@@ -37,12 +37,17 @@ module Devise
         Devise.mappings.each_value { |m| return m.name if duck.is_a?(m.to) }
       end
 
-      raise "Could not find a valid mapping for #{duck}"
+      raise "Could not find a valid mapping for #{duck.inspect}"
+    end
+
+    def self.find_by_path!(path, path_type=:fullpath)
+      Devise.mappings.each_value { |m| return m if path.include?(m.send(path_type)) }
+      raise "Could not find a valid mapping for path #{path.inspect}"
     end
 
     def initialize(name, options) #:nodoc:
-      @plural   = (options[:as] ? "#{options[:as]}_#{name}" : name).to_sym
-      @singular = (options[:singular] || @plural.to_s.singularize).to_sym
+      @scoped_path = options[:as] ? "#{options[:as]}/#{name}" : name.to_s
+      @singular = (options[:singular] || @scoped_path.tr('/', '_').singularize).to_sym
 
       @class_name = (options[:class_name] || name.to_s.classify).to_s
       @ref = ActiveSupport::Dependencies.ref(@class_name)
@@ -57,6 +62,8 @@ module Devise
       @path_names = Hash.new { |h,k| h[k] = k.to_s }
       @path_names.merge!(:registration => "")
       @path_names.merge!(options[:path_names] || {})
+
+      @sign_out_via = options[:sign_out_via] || Devise.sign_out_via
     end
 
     # Return modules for the mapping.
@@ -82,7 +89,7 @@ module Devise
     end
 
     def fullpath
-      "#{@path_prefix}/#{@path}".squeeze("/")
+      "/#{@path_prefix}/#{@path}".squeeze("/")
     end
 
     # Create magic predicates for verifying what module is activated by this map.

data/lib/devise/models.rb

@@ -47,20 +47,6 @@ module Devise
     def devise(*modules)
       include Devise::Models::Authenticatable
       options = modules.extract_options!
-
-      if modules.delete(:authenticatable)
-        ActiveSupport::Deprecation.warn ":authenticatable as module is deprecated. Please give :database_authenticatable instead.", caller
-        modules << :database_authenticatable
-      end
-
-      if modules.delete(:activatable)
-        ActiveSupport::Deprecation.warn ":activatable as module is deprecated. It's included in your model by default.", caller
-      end
-
-      if modules.delete(:http_authenticatable)
-        ActiveSupport::Deprecation.warn ":http_authenticatable as module is deprecated and is on by default. Revert by setting :http_authenticatable => false.", caller
-      end
-
       self.devise_modules += Devise::ALL & modules.map(&:to_sym).uniq
 
       devise_modules_hook! do

data/lib/devise/models/authenticatable.rb

@@ -4,18 +4,25 @@ module Devise
   module Models
     # Authenticable module. Holds common settings for authentication.
     #
-    # == Configuration:
+    # == Options
     #
-    # You can overwrite configuration values by setting in globally in Devise,
-    # using devise method or overwriting the respective instance method.
+    # Authenticatable adds the following options to devise_for:
     #
-    #   authentication_keys: parameters used for authentication. By default [:email].
+    #   * +authentication_keys+: parameters used for authentication. By default [:email].
     #
-    #   http_authenticatable: if this model allows http authentication. By default true.
-    #   It also accepts an array specifying the strategies that should allow http.
+    #   * +request_keys+: parameters from the request object used for authentication.
+    #     By specifying a symbol (which should be a request method), it will automatically be
+    #     passed to find_for_authentication method and considered in your model lookup.
     #
-    #   params_authenticatable: if this model allows authentication through request params. By default true.
-    #   It also accepts an array specifying the strategies that should allow params authentication.
+    #     For instance, if you set :request_keys to [:subdomain], :subdomain will be considered
+    #     as key on authentication. This can also be a hash where the value is a boolean expliciting
+    #     if the value is required or not.
+    #
+    #   * +http_authenticatable+: if this model allows http authentication. By default true.
+    #     It also accepts an array specifying the strategies that should allow http.
+    #
+    #   * +params_authenticatable+: if this model allows authentication through request params. By default true.
+    #     It also accepts an array specifying the strategies that should allow params authentication.
     #
     # == Active?
     #
@@ -66,8 +73,11 @@ module Devise
         :inactive
       end
 
+      def authenticatable_salt
+      end
+
       module ClassMethods
-        Devise::Models.config(self, :authentication_keys, :http_authenticatable, :params_authenticatable)
+        Devise::Models.config(self, :authentication_keys, :request_keys, :case_insensitive_keys, :http_authenticatable, :params_authenticatable)
 
         def params_authenticatable?(strategy)
           params_authenticatable.is_a?(Array) ?
@@ -90,44 +100,44 @@ module Devise
         #   end
         #
         def find_for_authentication(conditions)
-          filter_auth_params(conditions)
-          find(:first, :conditions => conditions)
+          case_insensitive_keys.each { |k| conditions[k].try(:downcase!) }
+          to_adapter.find_first(conditions)
         end
 
         # Find an initialize a record setting an error if it can't be found.
         def find_or_initialize_with_error_by(attribute, value, error=:invalid) #:nodoc:
-          if value.present?
-            conditions = { attribute => value }
-            record = find(:first, :conditions => conditions)
-          end
+          find_or_initialize_with_errors([attribute], { attribute => value }, error)
+        end
+
+        # Find an initialize a group of attributes based on a list of required attributes.
+        def find_or_initialize_with_errors(required_attributes, attributes, error=:invalid) #:nodoc:
+          case_insensitive_keys.each { |k| attributes[k].try(:downcase!) }
+          
+          attributes = attributes.slice(*required_attributes)
+          attributes.delete_if { |key, value| value.blank? }
 
+          if attributes.size == required_attributes.size
+            record = to_adapter.find_first(attributes)
+          end
+          
           unless record
             record = new
-            if value.present?
-              record.send(:"#{attribute}=", value)
-            else
-              error = :blank
+
+            required_attributes.each do |key|
+              value = attributes[key]
+              record.send("#{key}=", value)
+              record.errors.add(key, value.present? ? error : :blank)
             end
-            record.errors.add(attribute, error)
           end
 
           record
         end
 
-        protected
-
-        # Force keys to be string to avoid injection on mongoid related database.
-        def filter_auth_params(conditions)
-          conditions.each do |k, v|
-            conditions[k] = v.to_s
-          end
-        end
-
         # Generate a token by looping and ensuring does not already exist.
         def generate_token(column)
           loop do
             token = Devise.friendly_token
-            break token unless find(:first, :conditions => { column => token })
+            break token unless to_adapter.find_first({ column => token })
           end
         end
       end

data/lib/devise/models/confirmable.rb

@@ -3,28 +3,24 @@ module Devise
     # Confirmable is responsible to verify if an account is already confirmed to
     # sign in, and to send emails with confirmation instructions.
     # Confirmation instructions are sent to the user email after creating a
-    # record, after updating it's email and also when manually requested by
-    # a new confirmation instruction request.
-    # Whenever the user update it's email, his account is automatically unconfirmed,
-    # it means it won't be able to sign in again without confirming the account
-    # again through the email that was sent.
+    # record and when manually requested by a new confirmation instruction request.
     #
-    # Configuration:
+    # == Options
     #
-    #   confirm_within: the time you want the user will have to confirm it's account
-    #                   without blocking his access. When confirm_within is zero, the
-    #                   user won't be able to sign in without confirming. You can
-    #                   use this to let your user access some features of your
-    #                   application without confirming the account, but blocking it
-    #                   after a certain period (ie 7 days). By default confirm_within is
-    #                   zero, it means users always have to confirm to sign in.
+    # Confirmable adds the following options to devise_for:
     #
-    # Examples:
+    #   * +confirm_within+: the time you want to allow the user to access his account
+    #     before confirming it. After this period, the user access is denied. You can
+    #     use this to let your user access some features of your application without
+    #     confirming the account, but blocking it after a certain period (ie 7 days).
+    #     By default confirm_within is zero, it means users always have to confirm to sign in.
+    #
+    # == Examples
     #
     #   User.find(1).confirm!      # returns true unless it's already confirmed
     #   User.find(1).confirmed?    # true/false
     #   User.find(1).send_confirmation_instructions # manually send instructions
-    #   User.find(1).resend_confirmation! # generates a new token and resent it
+    #
     module Confirmable
       extend ActiveSupport::Concern
 

data/lib/devise/models/database_authenticatable.rb

@@ -1,25 +1,18 @@
 require 'devise/strategies/database_authenticatable'
+require 'bcrypt'
 
 module Devise
   module Models
     # Authenticable Module, responsible for encrypting password and validating
     # authenticity of a user while signing in.
     #
-    # Configuration:
+    # == Options
     #
-    # You can overwrite configuration values by setting in globally in Devise,
-    # using devise method or overwriting the respective instance method.
+    # DatabaseAuthenticable adds the following options to devise_for:
     #
-    #   pepper: encryption key used for creating encrypted password. Each time
-    #           password changes, it's gonna be encrypted again, and this key
-    #           is added to the password and salt to create a secure hash.
-    #           Always use `rake secret' to generate a new key.
+    #   * +stretches+: the cost given to bcrypt.
     #
-    #   stretches: defines how many times the password will be encrypted.
-    #
-    #   encryptor: the encryptor going to be used. By default :sha1.
-    #
-    # Examples:
+    # == Examples
     #
     #    User.find(1).valid_password?('password123')         # returns true/false
     #
@@ -29,22 +22,18 @@ module Devise
       included do
         attr_reader :password, :current_password
         attr_accessor :password_confirmation
+        before_save :downcase_keys
       end
 
-      # Regenerates password salt and encrypted password each time password is set,
-      # and then trigger any "after_changed_password"-callbacks.
+      # Generates password encryption based on the given value.
       def password=(new_password)
         @password = new_password
-
-        if @password.present?
-          self.password_salt = self.class.password_salt
-          self.encrypted_password = password_digest(@password)
-        end
+        self.encrypted_password = password_digest(@password) if @password.present?
       end
 
       # Verifies whether an incoming_password (ie from sign in) is the user password.
-      def valid_password?(incoming_password)
-        Devise.secure_compare(password_digest(incoming_password), self.encrypted_password)
+      def valid_password?(password)
+        ::BCrypt::Password.new(self.encrypted_password) == "#{password}#{self.class.pepper}"
       end
 
       # Set password and password confirmation to nil
@@ -78,26 +67,25 @@ module Devise
       def after_database_authentication
       end
 
+      # A reliable way to expose the salt regardless of the implementation.
+      def authenticatable_salt
+        self.encrypted_password[0,29] if self.encrypted_password
+      end
+
     protected
 
-      # Digests the password using the configured encryptor.
+      # Downcase case-insensitive keys
+      def downcase_keys
+        self.class.case_insensitive_keys.each { |k| self[k].try(:downcase!) }
+      end
+
+      # Digests the password using bcrypt.
       def password_digest(password)
-        if self.password_salt.present?
-          self.class.encryptor_class.digest(password, self.class.stretches, self.password_salt, self.class.pepper)
-        end
+        ::BCrypt::Password.create("#{password}#{self.class.pepper}", :cost => self.class.stretches).to_s
       end
 
       module ClassMethods
-        Devise::Models.config(self, :pepper, :stretches, :encryptor)
-
-        # Returns the class for the configured encryptor.
-        def encryptor_class
-          @encryptor_class ||= ::Devise::Encryptors.const_get(encryptor.to_s.classify)
-        end
-
-        def password_salt
-          self.encryptor_class.salt(self.stretches)
-        end
+        Devise::Models.config(self, :pepper, :stretches)
 
         # We assume this method already gets the sanitized values from the
         # DatabaseAuthenticatable strategy. If you are using this method on

data/lib/devise/models/encryptable.rb

@@ -0,0 +1,65 @@
+require 'devise/strategies/database_authenticatable'
+
+module Devise
+  module Models
+    # Encryptable Module adds support to several encryptors.
+    #
+    # == Options
+    #
+    # Encryptable adds the following options to devise_for:
+    #
+    #   * +pepper+: a random string used to provide a more secure hash.
+    #
+    #   * +encryptor+: the encryptor going to be used. By default is nil.
+    #
+    # == Examples
+    #
+    #    User.find(1).valid_password?('password123') # returns true/false
+    #
+    module Encryptable
+      extend ActiveSupport::Concern
+
+      included do
+        attr_reader :password, :current_password
+        attr_accessor :password_confirmation
+      end
+
+      # Generates password salt.
+      def password=(new_password)
+        self.password_salt = self.class.password_salt if new_password.present?
+        super
+      end
+
+      def authenticatable_salt
+        self.password_salt
+      end
+
+      # Verifies whether an incoming_password (ie from sign in) is the user password.
+      def valid_password?(incoming_password)
+        password_digest(incoming_password) == self.encrypted_password
+      end
+
+    protected
+
+      # Digests the password using the configured encryptor.
+      def password_digest(password)
+        if self.password_salt.present?
+          self.class.encryptor_class.digest(password, self.class.stretches, self.password_salt, self.class.pepper)
+        end
+      end
+
+      module ClassMethods
+        Devise::Models.config(self, :encryptor)
+
+        # Returns the class for the configured encryptor.
+        def encryptor_class
+          @encryptor_class ||= ::Devise::Encryptors.const_get(encryptor.to_s.classify)
+        end
+
+        def password_salt
+          self.encryptor_class.salt(self.stretches)
+        end
+      end
+    end
+  end
+end

data/lib/devise/models/lockable.rb

@@ -7,13 +7,14 @@ module Devise
     # will unlock the user automatically after some configured time (ie 2.hours).
     # It's also possible to setup lockable to use both email and time strategies.
     #
-    # Configuration:
+    # == Options
     #
-    #   maximum_attempts: how many attempts should be accepted before blocking the user.
-    #   lock_strategy: lock the user account by :failed_attempts or :none.
-    #   unlock_strategy: unlock the user account by :time, :email, :both or :none.
-    #   unlock_in: the time you want to lock the user after to lock happens. Only
-    #              available when unlock_strategy is :time or :both.
+    # Lockable adds the following options to devise_for:
+    #
+    #   * +maximum_attempts+: how many attempts should be accepted before blocking the user.
+    #   * +lock_strategy+: lock the user account by :failed_attempts or :none.
+    #   * +unlock_strategy+: unlock the user account by :time, :email, :both or :none.
+    #   * +unlock_in+: the time you want to lock the user after to lock happens. Only available when unlock_strategy is :time or :both.
     #
     module Lockable
       extend  ActiveSupport::Concern
@@ -131,7 +132,7 @@ module Devise
         # with an email not found error.
         # Options must contain the user email
         def send_unlock_instructions(attributes={})
-         lockable = find_or_initialize_with_error_by(:email, attributes[:email], :not_found)
+         lockable = find_or_initialize_with_errors(authentication_keys, attributes, :not_found)
          lockable.resend_unlock_token if lockable.persisted?
          lockable
         end