devise 1.1.rc1 → 1.1.rc2

data/lib/devise/schema.rb

@@ -13,6 +13,10 @@ module Devise
     # == Options
     # * :null - When true, allow columns to be null.
     # * :default - Should be set to "" when :null is false.
+    #
+    # == Notes
+    # For Datamapper compatibility, we explicitly hardcode the limit for the
+    # encrypter password field in 128 characters.
     def database_authenticatable(options={})
       null    = options[:null] || false
       default = options[:default] || ""
@@ -21,42 +25,42 @@ module Devise
         ActiveSupport::Deprecation.warn ":encryptor as option is deprecated, simply remove it."
       end
 
-      apply_schema :email,              String, :null => null, :default => default
-      apply_schema :encrypted_password, String, :null => null, :default => default, :limit => 128
-      apply_schema :password_salt,      String, :null => null, :default => default
+      apply_devise_schema :email,              String, :null => null, :default => default
+      apply_devise_schema :encrypted_password, String, :null => null, :default => default, :limit => 128
+      apply_devise_schema :password_salt,      String, :null => null, :default => default
     end      
 
     # Creates authentication_token.
     def token_authenticatable(options={})
-      apply_schema :authentication_token, String
+      apply_devise_schema :authentication_token, String
     end
 
     # Creates confirmation_token, confirmed_at and confirmation_sent_at.
     def confirmable
-      apply_schema :confirmation_token,   String
-      apply_schema :confirmed_at,         DateTime
-      apply_schema :confirmation_sent_at, DateTime
+      apply_devise_schema :confirmation_token,   String
+      apply_devise_schema :confirmed_at,         DateTime
+      apply_devise_schema :confirmation_sent_at, DateTime
     end
 
     # Creates reset_password_token.
     def recoverable
-      apply_schema :reset_password_token, String
+      apply_devise_schema :reset_password_token, String
     end
 
     # Creates remember_token and remember_created_at.
     def rememberable
-      apply_schema :remember_token,      String
-      apply_schema :remember_created_at, DateTime
+      apply_devise_schema :remember_token,      String
+      apply_devise_schema :remember_created_at, DateTime
     end
 
     # Creates sign_in_count, current_sign_in_at, last_sign_in_at,
     # current_sign_in_ip, last_sign_in_ip.
     def trackable
-      apply_schema :sign_in_count,      Integer, :default => 0
-      apply_schema :current_sign_in_at, DateTime
-      apply_schema :last_sign_in_at,    DateTime
-      apply_schema :current_sign_in_ip, String
-      apply_schema :last_sign_in_ip,    String
+      apply_devise_schema :sign_in_count,      Integer, :default => 0
+      apply_devise_schema :current_sign_in_at, DateTime
+      apply_devise_schema :last_sign_in_at,    DateTime
+      apply_devise_schema :current_sign_in_ip, String
+      apply_devise_schema :last_sign_in_ip,    String
     end
 
     # Creates failed_attempts, unlock_token and locked_at depending on the options given.
@@ -75,18 +79,18 @@ module Devise
       lock_strategy ||= :failed_attempts
 
       if lock_strategy == :failed_attempts
-        apply_schema :failed_attempts, Integer, :default => 0
+        apply_devise_schema :failed_attempts, Integer, :default => 0
       end
 
       if [:both, :email].include?(unlock_strategy)
-        apply_schema :unlock_token, String
+        apply_devise_schema :unlock_token, String
       end
 
-      apply_schema :locked_at, DateTime
+      apply_devise_schema :locked_at, DateTime
     end
 
     # Overwrite with specific modification to create your own schema.
-    def apply_schema(name, type, options={})
+    def apply_devise_schema(name, type, options={})
       raise NotImplementedError
     end
   end

data/lib/devise/strategies/authenticatable.rb

@@ -14,12 +14,23 @@ module Devise
 
     private
 
-      # Check if this is strategy is valid for http authentication.
+      # Check if this is strategy is valid for http authentication by:
+      #
+      #   * Validating if the model allows params authentication;
+      #   * If any of the authorization headers were sent;
+      #   * If all authentication keys are present;
+      #
       def valid_for_http_auth?
         http_authenticatable? && request.authorization && with_authentication_hash(http_auth_hash)
       end
 
-      # Check if this is strategy is valid for params authentication.
+      # Check if this is strategy is valid for params authentication by:
+      #
+      #   * Validating if the model allows params authentication;
+      #   * If the request hits the sessions controller through POST;
+      #   * If the params[scope] returns a hash with credentials;
+      #   * If all authentication keys are present;
+      #
       def valid_for_params_auth?
         params_authenticatable? && valid_request? &&
           valid_params? && with_authentication_hash(params_auth_hash)
@@ -51,12 +62,12 @@ module Devise
         valid_controller? && valid_verb?
       end
 
-      # Check if the controller is valid for params authentication.
+      # Check if the controller is the one registered for authentication.
       def valid_controller?
         mapping.controllers[:sessions] == params[:controller]
       end
 
-      # Check if the params_auth_hash is valid for params authentication.
+      # Check if it was a POST request.
       def valid_verb?
         request.post?
       end
@@ -66,6 +77,11 @@ module Devise
         params_auth_hash.is_a?(Hash)
       end
 
+      # Check if password is present and is not equal to "X" (default value for token).
+      def valid_password?
+        password.present? && password != "X"
+      end
+
       # Helper to decode credentials from HTTP.
       def decode_credentials
         username_and_password = request.authorization.split(' ', 2).last || ''

data/lib/devise/strategies/database_authenticatable.rb

@@ -5,7 +5,7 @@ module Devise
     # Default strategy for signing in a user, based on his email and password in the database.
     class DatabaseAuthenticatable < Authenticatable
       def authenticate!
-        resource = mapping.to.find_for_database_authentication(authentication_hash)
+        resource = valid_password? && mapping.to.find_for_database_authentication(authentication_hash)
 
         if validate(resource){ resource.valid_password?(password) }
           resource.after_database_authentication

data/lib/devise/strategies/token_authenticatable.rb

@@ -7,8 +7,8 @@ module Devise
     #
     #   http://myapp.example.com/?user_token=SECRET
     #
-    # For HTTP, you can pass the token as username. Since some clients may require a password,
-    # you can pass anything and it will simply be ignored.
+    # For HTTP, you can pass the token as username and blank password. Since some clients may require
+    # a password, you can pass "X" as password and it will simply be ignored.
     class TokenAuthenticatable < Authenticatable
       def authenticate!
         resource = mapping.to.find_for_token_authentication(authentication_hash)

data/lib/devise/test_helpers.rb

@@ -40,7 +40,8 @@ module Devise
           Warden::Manager._before_failure.each{ |hook| hook.call(env, result) }
 
           status, headers, body = Devise::FailureApp.call(env).to_a
-          @controller.send :redirect_to, headers["Location"]
+          @controller.send :render, :status => status, :text => body,
+            :content_type => headers["Content-Type"], :location => headers["Location"]
         else
           result
         end

data/lib/devise/version.rb

@@ -1,3 +1,3 @@
 module Devise
-  VERSION = "1.1.rc1".freeze
+  VERSION = "1.1.rc2".freeze
 end

data/lib/generators/devise/devise/devise_generator.rb

@@ -0,0 +1,86 @@
+require 'rails/generators/migration'
+
+module Devise
+  module Generators
+    class DeviseGenerator < Rails::Generators::NamedBase
+      include Rails::Generators::Migration
+
+      source_root File.expand_path("../templates", __FILE__)
+      namespace "devise"
+
+      desc "Generates a model with the given NAME (if one does not exist) with devise " <<
+           "configuration plus a migration file and devise routes."
+
+      def self.orm_has_migration?
+        Rails::Generators.options[:rails][:orm] == :active_record
+      end
+
+      def self.next_migration_number(path)
+        Time.now.utc.strftime("%Y%m%d%H%M%S")
+      end
+
+      class_option :orm
+      class_option :migration, :type => :boolean, :default => orm_has_migration?
+
+      def invoke_orm_model
+        return unless behavior == :invoke
+
+        if model_exists?
+          say "* Model already exists. Adding Devise behavior."
+        elsif options[:orm].present?
+          invoke "model", [name], :migration => false, :orm => options[:orm]
+
+          unless model_exists?
+            abort "Tried to invoke the model generator for '#{options[:orm]}' but could not find it.\n" <<
+              "Please create your model by hand before calling `rails g devise #{name}`."
+          end
+        else
+          abort "Cannot create a devise model because config.generators.orm is blank.\n" <<
+            "Please create your model by hand or configure your generators orm before calling `rails g devise #{name}`."
+        end
+      end
+
+      def inject_devise_config_into_model
+        devise_class_setup = <<-CONTENT
+
+  # Include default devise modules. Others available are:
+  # :token_authenticatable, :confirmable, :lockable and :timeoutable
+  devise :database_authenticatable, :registerable,
+         :recoverable, :rememberable, :trackable, :validatable
+
+CONTENT
+
+        case options[:orm].to_s
+        when "mongoid"
+          inject_into_file model_path, devise_class_setup, :after => "include Mongoid::Document\n"
+        when "data_mapper"
+          inject_into_file model_path, devise_class_setup, :after => "include DataMapper::Resource\n"
+        when "active_record"
+          inject_into_class model_path, class_name, devise_class_setup + <<-CONTENT
+  # Setup accessible (or protected) attributes for your model
+  attr_accessible :email, :password, :password_confirmation
+CONTENT
+        end
+      end
+
+      def copy_migration_template
+        return unless options.migration?
+        migration_template "migration.rb", "db/migrate/devise_create_#{table_name}"
+      end
+
+      def add_devise_routes
+        route "devise_for :#{table_name}"
+      end
+
+    protected
+
+      def model_exists?
+        File.exists?(File.join(destination_root, model_path))
+      end
+
+      def model_path
+        @model_path ||= File.join("app", "models", "#{file_path}.rb")
+      end
+    end
+  end
+end

data/lib/generators/devise/{templates → devise/templates}/migration.rb

@@ -2,11 +2,11 @@ class DeviseCreate<%= table_name.camelize %> < ActiveRecord::Migration
   def self.up
     create_table(:<%= table_name %>) do |t|
       t.database_authenticatable :null => false
-      t.confirmable
       t.recoverable
       t.rememberable
       t.trackable
 
+      # t.confirmable
       # t.lockable :lock_strategy => :<%= Devise.lock_strategy %>, :unlock_strategy => :<%= Devise.unlock_strategy %>
       # t.token_authenticatable
 
@@ -14,8 +14,8 @@ class DeviseCreate<%= table_name.camelize %> < ActiveRecord::Migration
     end
 
     add_index :<%= table_name %>, :email,                :unique => true
-    add_index :<%= table_name %>, :confirmation_token,   :unique => true
     add_index :<%= table_name %>, :reset_password_token, :unique => true
+    # add_index :<%= table_name %>, :confirmation_token,   :unique => true
     # add_index :<%= table_name %>, :unlock_token,         :unique => true
   end
 

data/lib/generators/devise/install/install_generator.rb

@@ -0,0 +1,24 @@
+require 'active_support/secure_random'
+
+module Devise
+  module Generators
+    class InstallGenerator < Rails::Generators::Base
+      source_root File.expand_path("../templates", __FILE__)
+
+      desc "Creates a Devise initializer and copy locale files to your application."
+      class_option :orm
+
+      def copy_initializer
+        template "devise.rb", "config/initializers/devise.rb"
+      end
+
+      def copy_locale
+        copy_file "../../../../../config/locales/en.yml", "config/locales/devise.en.yml"
+      end
+
+      def show_readme
+        readme "README"
+      end
+    end
+  end
+end

data/lib/generators/{devise_install → devise/install}/templates/README

@@ -8,7 +8,7 @@ Some setup you must do manually if you haven't yet:
 
        config.action_mailer.default_url_options = { :host => 'localhost:3000' }
 
-     This is a required Rails configuration. In production is must be the
+     This is a required Rails configuration. In production it must be the
      actual host of your application
 
   2. Ensure you have defined root_url to *something* in your config/routes.rb.

data/lib/generators/{devise_install → devise/install}/templates/devise.rb

@@ -1,9 +1,18 @@
 # Use this hook to configure devise mailer, warden hooks and so forth. The first
 # four configuration values can also be set straight in your models.
 Devise.setup do |config|
+  # ==> Mailer Configuration
   # Configure the e-mail address which will be shown in DeviseMailer.
   config.mailer_sender = "please-change-me@config-initializers-devise.com"
 
+  # Configure the class responsible to send e-mails.
+  # config.mailer = "Devise::Mailer"
+
+  # ==> ORM configuration
+  # Load and configure the ORM. Supports :active_record (default), :mongoid
+  # (bson_ext recommended) and :data_mapper (experimental).
+  require 'devise/orm/<%= options[:orm] %>'
+
   # ==> Configuration for any authentication mechanism
   # Configure which keys are used when authenticating an user. By default is
   # just :email. You can configure it to use [:username, :subdomain], so for
@@ -22,23 +31,26 @@ Devise.setup do |config|
   # config.http_authentication_realm = "Application"
 
   # ==> Configuration for :database_authenticatable
-  # Invoke `rake secret` and use the printed value to setup a pepper to generate
-  # the encrypted password. By default no pepper is used.
-  # config.pepper = "rake secret output"
-
-  # Configure how many times you want the password is reencrypted. Default is 10.
-  # config.stretches = 10
+  # For bcrypt, this is the cost for hashing the password and defaults to 10. If
+  # using other encryptors, it sets how many times you want the password re-encrypted.
+  config.stretches = 10
 
-  # Define which will be the encryption algorithm. Supported algorithms are :sha1
-  # (default), :sha512 and :bcrypt. Devise also supports encryptors from others
-  # authentication tools as :clearance_sha1, :authlogic_sha512 (then you should set
-  # stretches above to 20 for default behavior) and :restful_authentication_sha1
+  # Define which will be the encryption algorithm. Devise also supports encryptors
+  # from others authentication tools as :clearance_sha1, :authlogic_sha512 (then
+  # you should set stretches above to 20 for default behavior) and :restful_authentication_sha1
   # (then you should set stretches to 10, and copy REST_AUTH_SITE_KEY to pepper)
-  # config.encryptor = :sha1
+  config.encryptor = :bcrypt
+
+  # Setup a pepper to generate the encrypted password.
+  config.pepper = <%= ActiveSupport::SecureRandom.hex(64).inspect %>
 
   # ==> Configuration for :confirmable
-  # The time you want give to your user to confirm his account. During this time
+  # The time you want to give your user to confirm his account. During this time
   # he will be able to access your application without confirming. Default is nil.
+  # When confirm_within is zero, the user won't be able to sign in without confirming. 
+  # You can use this to let your user access some features of your application 
+  # without confirming the account, but blocking it after a certain period 
+  # (ie 2 days). 
   # config.confirm_within = 2.days
 
   # ==> Configuration for :rememberable
@@ -65,7 +77,7 @@ Devise.setup do |config|
 
   # Defines which strategy will be used to unlock an account.
   # :email = Sends an unlock link to the user email
-  # :time  = Reanables login after a certain ammount of time (see :unlock_in below)
+  # :time  = Re-enables login after a certain amount of time (see :unlock_in below)
   # :both  = Enables both strategies
   # :none  = No unlock strategy. You should handle unlocking by yourself.
   # config.unlock_strategy = :both
@@ -81,11 +93,7 @@ Devise.setup do |config|
   # Defines name of the authentication token params key
   # config.token_authentication_key = :auth_token
 
-  # ==> General configuration
-  # Load and configure the ORM. Supports :active_record (default), :mongoid
-  # (requires mongo_ext installed) and :data_mapper (experimental).
-  require 'devise/orm/active_record'
-
+  # ==> Scopes configuration
   # Turn scoped views on. Before rendering "sessions/new", it will first check for
   # "sessions/users/new". It's turned off by default because it's slower if you
   # are using only default views.
@@ -95,12 +103,23 @@ Devise.setup do |config|
   # accessing "/users/sign_in", it knows you are accessing an User. This makes
   # routes as "/sign_in" not possible, unless you tell Devise to use the default
   # scope, setting true below.
+  # Note that devise does not generate default routes. You also have to
+  # specify them in config/routes.rb
   # config.use_default_scope = true
 
   # Configure the default scope used by Devise. By default it's the first devise
   # role declared in your routes.
   # config.default_scope = :user
 
+  # ==> Navigation configuration
+  # Lists the formats that should be treated as navigational. Formats like
+  # :html, should redirect to the sign in page when the user does not have
+  # access, but formats like :xml or :json, should return 401.
+  # If you have any extra navigational formats, like :iphone or :mobile, you
+  # should add them to the navigational formats lists. Default is [:html]
+  # config.navigational_formats = [:html, :iphone]
+
+  # ==> Warden configuration
   # If you want to use other strategies, that are not (yet) supported by Devise,
   # you can configure them inside the config.warden block. The example below
   # allows you to setup OAuth, using http://github.com/roman/warden_oauth

data/lib/generators/devise/views/views_generator.rb

@@ -0,0 +1,63 @@
+module Devise
+  module Generators
+    class ViewsGenerator < Rails::Generators::Base
+      source_root File.expand_path("../../../../../app/views", __FILE__)
+      desc "Copies all Devise views to your application."
+
+      argument :scope, :required => false, :default => nil,
+                       :desc => "The scope to copy views to"
+
+      class_option :template_engine, :type => :string, :aliases => "-t", :default => "erb",
+                                     :desc => "Template engine for the views. Available options are 'erb' and 'haml'."
+
+      def copy_views
+        case options[:template_engine]
+        when "haml"
+          verify_haml_existence
+          verify_haml_version
+          create_and_copy_haml_views
+        else
+          directory "devise", "app/views/#{scope || :devise}"
+        end
+      end
+
+    protected
+
+      def verify_haml_existence
+        begin
+          require 'haml'
+        rescue LoadError
+          say "HAML is not installed, or it is not specified in your Gemfile."
+          exit
+        end
+      end
+
+      def verify_haml_version
+        unless Haml.version[:major] == 2 and Haml.version[:minor] >= 3 or Haml.version[:major] >= 3
+          say "To generate HAML templates, you need to install HAML 2.3 or above."
+          exit
+        end
+      end
+
+      def create_and_copy_haml_views
+        require 'tmpdir'
+        html_root = "#{self.class.source_root}/devise"
+
+        Dir.mktmpdir("devise-haml.") do |haml_root|
+          Dir["#{html_root}/**/*"].each do |path|
+            relative_path = path.sub(html_root, "")
+            source_path   = (haml_root + relative_path).sub(/erb$/, "haml")
+
+            if File.directory?(path)
+              FileUtils.mkdir_p(source_path)
+            else
+              `html2haml -r #{path} #{source_path}`
+            end
+          end
+
+          directory haml_root, "app/views/#{scope || :devise}"
+        end
+      end
+    end
+  end
+end