devise 1.5.3 → 2.0.0

data/lib/devise/models/confirmable.rb

@@ -9,11 +9,16 @@ module Devise
     #
     # Confirmable adds the following options to devise_for:
     #
-    #   * +confirm_within+: the time you want to allow the user to access his account
+    #   * +allow_unconfirmed_access_for+: the time you want to allow the user to access his account
     #     before confirming it. After this period, the user access is denied. You can
     #     use this to let your user access some features of your application without
     #     confirming the account, but blocking it after a certain period (ie 7 days).
-    #     By default confirm_within is zero, it means users always have to confirm to sign in.
+    #     By default allow_unconfirmed_access_for is zero, it means users always have to confirm to sign in.
+    #   * +reconfirmable+: requires any email changes to be confirmed (exactly the same way as
+    #     initial account confirmation) to be applied. Requires additional unconfirmed_email
+    #     db field to be setup (t.reconfirmable in migrations). Until confirmed new email is
+    #     stored in unconfirmed email column, and copied to email column on successful
+    #     confirmation.
     #
     # == Examples
     #
@@ -27,15 +32,28 @@ module Devise
       included do
         before_create :generate_confirmation_token, :if => :confirmation_required?
         after_create  :send_confirmation_instructions, :if => :confirmation_required?
+        before_update :postpone_email_change_until_confirmation, :if => :postpone_email_change?
+        after_update :send_confirmation_instructions, :if => :reconfirmation_required?
       end
 
-      # Confirm a user by setting its confirmed_at to actual time. If the user
-      # is already confirmed, add en error to email field
+      # Confirm a user by setting it's confirmed_at to actual time. If the user
+      # is already confirmed, add an error to email field. If the user is invalid
+      # add errors
       def confirm!
-        unless_confirmed do
+        pending_any_confirmation do
           self.confirmation_token = nil
           self.confirmed_at = Time.now.utc
-          save(:validate => false)
+
+          if self.class.reconfirmable && unconfirmed_email.present?
+            @bypass_postpone = true
+            self.email = unconfirmed_email
+            self.unconfirmed_email = nil
+
+            # We need to validate in such cases to enforce e-mail uniqueness
+            save(:validate => true)
+          else
+            save(:validate => false)
+          end
         end
       end
 
@@ -44,15 +62,22 @@ module Devise
         !!confirmed_at
       end
 
+      def pending_reconfirmation?
+        self.class.reconfirmable && unconfirmed_email.present?
+      end
+
       # Send confirmation instructions by email
       def send_confirmation_instructions
-        generate_confirmation_token! if self.confirmation_token.nil?
+        self.confirmation_token = nil if reconfirmation_required?
+        @reconfirmation_required = false
+
+        generate_confirmation_token! if self.confirmation_token.blank?
         self.devise_mailer.confirmation_instructions(self).deliver
       end
 
       # Resend confirmation token. This method does not need to generate a new token.
       def resend_confirmation_token
-        unless_confirmed { send_confirmation_instructions }
+        pending_any_confirmation { send_confirmation_instructions }
       end
 
       # Overwrites active_for_authentication? for confirmation
@@ -74,6 +99,14 @@ module Devise
         self.confirmed_at = Time.now.utc
       end
 
+      def headers_for(action)
+        headers = super
+        if action == :confirmation_instructions && pending_reconfirmation?
+          headers[:to] = unconfirmed_email
+        end
+        headers
+      end
+
       protected
 
         # Callback to overwrite if confirmation is required or not.
@@ -88,26 +121,25 @@ module Devise
         #
         # Example:
         #
-        #   # confirm_within = 1.day and confirmation_sent_at = today
+        #   # allow_unconfirmed_access_for = 1.day and confirmation_sent_at = today
         #   confirmation_period_valid?   # returns true
         #
-        #   # confirm_within = 5.days and confirmation_sent_at = 4.days.ago
+        #   # allow_unconfirmed_access_for = 5.days and confirmation_sent_at = 4.days.ago
         #   confirmation_period_valid?   # returns true
         #
-        #   # confirm_within = 5.days and confirmation_sent_at = 5.days.ago
+        #   # allow_unconfirmed_access_for = 5.days and confirmation_sent_at = 5.days.ago
         #   confirmation_period_valid?   # returns false
         #
-        #   # confirm_within = 0.days
+        #   # allow_unconfirmed_access_for = 0.days
         #   confirmation_period_valid?   # will always return false
         #
         def confirmation_period_valid?
-          confirmation_sent_at && confirmation_sent_at.utc >= self.class.confirm_within.ago
+          confirmation_sent_at && confirmation_sent_at.utc >= self.class.allow_unconfirmed_access_for.ago
         end
 
-        # Checks whether the record is confirmed or not, yielding to the block
-        # if it's already confirmed, otherwise adds an error to email.
-        def unless_confirmed
-          unless confirmed?
+        # Checks whether the record requires any confirmation.
+        def pending_any_confirmation
+          if !confirmed? || pending_reconfirmation?
             yield
           else
             self.errors.add(:email, :already_confirmed)
@@ -118,7 +150,6 @@ module Devise
         # Generates a new random token for confirmation, and stores the time
         # this token is being generated
         def generate_confirmation_token
-          self.confirmed_at = nil
           self.confirmation_token = self.class.confirmation_token
           self.confirmation_sent_at = Time.now.utc
         end
@@ -132,13 +163,32 @@ module Devise
           confirm! unless confirmed?
         end
 
+        def postpone_email_change_until_confirmation
+          @reconfirmation_required = true
+          self.unconfirmed_email = self.email
+          self.email = self.email_was
+        end
+
+        def postpone_email_change?
+          postpone = self.class.reconfirmable && email_changed? && !@bypass_postpone
+          @bypass_postpone = nil
+          postpone
+        end
+
+        def reconfirmation_required?
+          self.class.reconfirmable && @reconfirmation_required
+        end
+
       module ClassMethods
         # Attempt to find a user by its email. If a record is found, send new
-        # confirmation instructions to it. If not user is found, returns a new user
-        # with an email not found error.
+        # confirmation instructions to it. If not, try searching for a user by unconfirmed_email
+        # field. If no user is found, returns a new user with an email not found error.
         # Options must contain the user email
         def send_confirmation_instructions(attributes={})
-          confirmable = find_or_initialize_with_errors(confirmation_keys, attributes, :not_found)
+          confirmable = find_by_unconfirmed_email_with_errors(attributes) if reconfirmable
+          unless confirmable.try(:persisted?)
+            confirmable = find_or_initialize_with_errors(confirmation_keys, attributes, :not_found)
+          end
           confirmable.resend_confirmation_token if confirmable.persisted?
           confirmable
         end
@@ -158,7 +208,15 @@ module Devise
           generate_token(:confirmation_token)
         end
 
-        Devise::Models.config(self, :confirm_within, :confirmation_keys)
+        # Find a record for confirmation by unconfirmed email field
+        def find_by_unconfirmed_email_with_errors(attributes = {})
+          unconfirmed_required_attributes = confirmation_keys.map { |k| k == :email ? :unconfirmed_email : k }
+          unconfirmed_attributes = attributes.symbolize_keys
+          unconfirmed_attributes[:unconfirmed_email] = unconfirmed_attributes.delete(:email)
+          find_or_initialize_with_errors(unconfirmed_required_attributes, unconfirmed_attributes, :not_found)
+        end
+
+        Devise::Models.config(self, :allow_unconfirmed_access_for, :confirmation_keys, :reconfirmable)
       end
     end
   end

data/lib/devise/models/database_authenticatable.rb

@@ -25,8 +25,6 @@ module Devise
       included do
         attr_reader :password, :current_password
         attr_accessor :password_confirmation
-        before_validation :downcase_keys
-        before_validation :strip_whitespace
       end
 
       # Generates password encryption based on the given value.
@@ -103,15 +101,6 @@ module Devise
 
     protected
 
-      # Downcase case-insensitive keys
-      def downcase_keys
-        (self.class.case_insensitive_keys || []).each { |k| self[k].try(:downcase!) }
-      end
-
-      def strip_whitespace
-        (self.class.strip_whitespace_keys || []).each { |k| self[k].try(:strip!) }
-      end
-
       # Digests the password using bcrypt.
       def password_digest(password)
         ::BCrypt::Password.create("#{password}#{self.class.pepper}", :cost => self.class.stretches).to_s

data/lib/devise/models/lockable.rb

@@ -79,7 +79,7 @@ module Devise
         # if the user can login or not (wrong password, etc)
         unlock_access! if lock_expired?
 
-        if super
+        if super && !access_locked?
           self.failed_attempts = 0
           save(:validate => false)
           true

data/lib/devise/models/recoverable.rb

@@ -29,6 +29,7 @@ module Devise
       def reset_password!(new_password, new_password_confirmation)
         self.password = new_password
         self.password_confirmation = new_password_confirmation
+
         if valid?
           clear_reset_password_token
           after_password_reset
@@ -39,7 +40,7 @@ module Devise
 
       # Resets reset password token and send reset password instructions by email
       def send_reset_password_instructions
-        generate_reset_password_token! if should_generate_token?
+        generate_reset_password_token! if should_generate_reset_token?
         self.devise_mailer.reset_password_instructions(self).deliver
       end
 
@@ -64,20 +65,19 @@ module Devise
       #   reset_password_period_valid?   # will always return false
       #
       def reset_password_period_valid?
-        return true unless respond_to?(:reset_password_sent_at)
         reset_password_sent_at && reset_password_sent_at.utc >= self.class.reset_password_within.ago
       end
 
       protected
 
-        def should_generate_token?
+        def should_generate_reset_token?
           reset_password_token.nil? || !reset_password_period_valid?
         end
 
         # Generates a new random token for reset password
         def generate_reset_password_token
           self.reset_password_token = self.class.reset_password_token
-          self.reset_password_sent_at = Time.now.utc if respond_to?(:reset_password_sent_at=)
+          self.reset_password_sent_at = Time.now.utc
           self.reset_password_token
         end
 
@@ -90,7 +90,7 @@ module Devise
         # Removes reset_password token
         def clear_reset_password_token
           self.reset_password_token = nil
-          self.reset_password_sent_at = nil if respond_to?(:reset_password_sent_at=)
+          self.reset_password_sent_at = nil
         end
 
         def after_password_reset

data/lib/devise/models/rememberable.rb

@@ -21,11 +21,6 @@ module Devise
     #     used to calculate the expires time for the cookie created to remember
     #     the user. By default remember_for is 2.weeks.
     #
-    #   * +remember_across_browsers+: if a valid remember token can be re-used
-    #     between multiple browsers. By default remember_across_browsers is true
-    #     and cannot be turned off if you are using password salt instead of remember
-    #     token.
-    #
     #   * +extend_remember_period+: if true, extends the user's remember period
     #     when remembered via cookie. False by default.
     #
@@ -49,7 +44,6 @@ module Devise
       # Generate a new remember token and save the record without validations
       # unless remember_across_browsers is true and the user already has a valid token.
       def remember_me!(extend_period=false)
-        self.remember_token = self.class.remember_token if respond_to?(:remember_token) && generate_remember_token?
         self.remember_created_at = Time.now.utc if generate_remember_timestamp?(extend_period)
         save(:validate => false)
       end
@@ -75,14 +69,12 @@ module Devise
       end
 
       def rememberable_value
-        if respond_to?(:remember_token)
-          remember_token
-        elsif respond_to?(:authenticatable_salt) && (salt = authenticatable_salt)
+        if salt = authenticatable_salt
           salt
         else
-          raise "The #{self.class.name} class does not respond to remember_token and " <<
-            "authenticatable_salt returns nil. In order to use rememberable, you must " <<
-            "add a remember_token field to your model or ensure a password is always set."
+          raise "authenticable_salt returned nil for the #{self.class.name} model. " \
+            "In order to use rememberable, you must ensure a password is always set " \
+            "or implement rememberable_value in your model with your own logic."
         end
       end
 
@@ -92,12 +84,6 @@ module Devise
 
     protected
 
-      # Generate a token unless remember_across_browsers is true and there is
-      # an existing remember_token or the existing remember_token has expried.
-      def generate_remember_token? #:nodoc:
-        !(self.class.remember_across_browsers && remember_token) || remember_expired?
-      end
-
       # Generate a timestamp if extend_remember_period is true, if no remember_token
       # exists, or if an existing remember token has expired.
       def generate_remember_timestamp?(extend_period) #:nodoc:
@@ -121,8 +107,7 @@ module Devise
           generate_token(:remember_token)
         end
 
-        Devise::Models.config(self, :remember_for, :remember_across_browsers,
-          :extend_remember_period, :cookie_options)
+        Devise::Models.config(self, :remember_for, :extend_remember_period, :cookie_options)
       end
     end
   end

data/lib/devise/models/serializable.rb

@@ -9,8 +9,11 @@ module Devise
     module Serializable
       extend ActiveSupport::Concern
 
-      # TODO: to_xml does not call serializable_hash. Hopefully someone will fix this in AR.
-      %w(to_xml serializable_hash).each do |method|
+      array = %w(serializable_hash)
+      # to_xml does not call serializable_hash on 3.1
+      array << "to_xml" if Rails::VERSION::STRING[0,3] == "3.1"
+
+      array.each do |method|
         class_eval <<-RUBY, __FILE__, __LINE__
           def #{method}(options=nil)
             options ||= {}

data/lib/devise/models/timeoutable.rb

@@ -23,7 +23,6 @@ module Devise
       # Checks whether the user session has expired based on configured time.
       def timedout?(last_access)
         return false if remember_exists_and_not_expired?
-
         !timeout_in.nil? && last_access && last_access <= timeout_in.ago
       end
 
@@ -34,8 +33,7 @@ module Devise
       private
 
       def remember_exists_and_not_expired?
-        return false unless respond_to?(:remember_expired?)
-
+        return false unless respond_to?(:remember_created_at)
         remember_created_at && !remember_expired?
       end
 

data/lib/devise/models/token_authenticatable.rb

@@ -24,9 +24,6 @@ module Devise
     #
     #   * +token_authentication_key+: Defines name of the authentication token params key. E.g. /users/sign_in?some_key=...
     #
-    #   * +stateless_token+: By default, when you sign up with a token, Devise will store the user in session
-    #     as any other authentication strategy. You can set stateless_token to true to avoid this.
-    #
     module TokenAuthenticatable
       extend ActiveSupport::Concern
 
@@ -65,7 +62,7 @@ module Devise
           generate_token(:authentication_token)
         end
 
-        ::Devise::Models.config(self, :token_authentication_key, :stateless_token)
+        ::Devise::Models.config(self, :token_authentication_key)
       end
     end
   end

data/lib/devise/models/validatable.rb

@@ -23,7 +23,7 @@ module Devise
 
         base.class_eval do
           validates_presence_of   :email, :if => :email_required?
-          validates_uniqueness_of :email, :case_sensitive => (case_insensitive_keys != false), :allow_blank => true, :if => :email_changed?
+          validates_uniqueness_of :email, :allow_blank => true, :if => :email_changed?
           validates_format_of     :email, :with  => email_regexp, :allow_blank => true, :if => :email_changed?
 
           validates_presence_of     :password, :if => :password_required?

data/lib/devise/models.rb

@@ -48,7 +48,6 @@ module Devise
     # for a complete description on those values.
     #
     def devise(*modules)
-      include Devise::Models::Authenticatable
       options = modules.extract_options!.dup
 
       selected_modules = modules.map(&:to_sym).uniq.sort_by do |s|
@@ -56,6 +55,7 @@ module Devise
       end
 
       devise_modules_hook! do
+        include Devise::Models::Authenticatable
         selected_modules.each do |m|
           mod = Devise::Models.const_get(m.to_s.classify)
 

data/lib/devise/modules.rb

@@ -5,8 +5,8 @@ Devise.with_options :model => true do |d|
   d.with_options :strategy => true do |s|
     routes = [nil, :new, :destroy]
     s.add_module :database_authenticatable, :controller => :sessions, :route => { :session => routes }
-    s.add_module :token_authenticatable
-    s.add_module :rememberable
+    s.add_module :token_authenticatable,    :controller => :sessions, :route => { :session => routes }, :no_input => true
+    s.add_module :rememberable, :no_input => true
   end
 
   # Other authentications

data/lib/devise/orm/active_record.rb

@@ -26,6 +26,12 @@ module Devise
 
         # Tell how to apply schema methods.
         def apply_devise_schema(name, type, options={})
+          @__devise_warning_raised ||= begin
+            $stderr.puts "\n[DEVISE] You are using t.database_authenticatable and others in your migration " \
+              "and this feature is deprecated. Please simply use Rails helpers instead as mentioned here:\n" \
+              "https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.0-migration-schema-style\n\n"
+            true
+          end
           column name, type.to_s.downcase.to_sym, options
         end
       end

data/lib/devise/param_filter.rb

@@ -35,7 +35,7 @@ module Devise
 
     # Determine which values should be transformed to string or passed as-is to the query builder underneath
     def param_requires_string_conversion?(value)
-      true unless value.is_a?(TrueClass) || value.is_a?(FalseClass) || value.is_a?(Fixnum)
+      [Fixnum, TrueClass, FalseClass, Regexp].none? {|clz| value.is_a? clz }
     end
   end
 end

data/lib/devise/path_checker.rb

@@ -3,7 +3,11 @@ module Devise
     include Rails.application.routes.url_helpers
 
     def self.default_url_options(*args)
-      ApplicationController.default_url_options(*args)
+      if defined?(ApplicationController)
+        ApplicationController.default_url_options(*args)
+      else
+        {}
+      end
     end
 
     def initialize(env, scope)

data/lib/devise/rails/routes.rb

@@ -84,15 +84,16 @@ module ActionDispatch::Routing
     #
     #    You need to make sure that your sign_out controls trigger a request with a matching HTTP method.
     #
-    #  * :module => the namespace to find controlers. By default, devise will access devise/sessions,
-    #    devise/registrations and so on. If you want to namespace all at once, use module:
+    #  * :module => the namespace to find controllers (default: "devise", thus
+    #    accessing devise/sessions, devise/registrations, and so on). If you want
+    #    to namespace all at once, use module:
     #
     #      devise_for :users, :module => "users"
     #
     #    Notice that whenever you use namespace in the router DSL, it automatically sets the module.
     #    So the following setup:
     #
-    #      namespace :publisher
+    #      namespace :publisher do
     #        devise_for :account
     #      end
     #
@@ -135,15 +136,15 @@ module ActionDispatch::Routing
     #     devise_for :users
     #   end
     #
-    # However, since Devise uses the request path to retrieve the current user, it has one caveats.
-    # If you are using a dynamic segment, as below:
+    # However, since Devise uses the request path to retrieve the current user,
+    # this has one caveat: If you are using a dynamic segment, like so ...
     #
     #   scope ":locale" do
     #     devise_for :users
     #   end
     #
-    # You are required to configure default_url_options in your ApplicationController class level, so
-    # Devise can pick it:
+    # you are required to configure default_url_options in your
+    # ApplicationController class, so Devise can pick it:
     #
     #   class ApplicationController < ActionController::Base
     #     def self.default_url_options
@@ -207,7 +208,12 @@ module ActionDispatch::Routing
         routes  = mapping.used_routes
 
         devise_scope mapping.name do
-          yield if block_given?
+          if block_given?
+            ActiveSupport::Deprecation.warn "Passing a block to devise_for is deprecated. " \
+              "Please call devise_scope :#{mapping.name} do ... end with the block instead", caller
+            yield
+          end
+
           with_devise_exclusive_scope mapping.fullpath, mapping.name, options do
             routes.each { |mod| send("devise_#{mod}", mapping, mapping.controllers) }
           end
@@ -369,13 +375,13 @@ module ActionDispatch::Routing
       end
 
       def with_devise_exclusive_scope(new_path, new_as, options) #:nodoc:
-        old_as, old_path, old_module, old_constraints, old_defaults, old_options = 
+        old_as, old_path, old_module, old_constraints, old_defaults, old_options =
           *@scope.values_at(:as, :path, :module, :constraints, :defaults, :options)
         @scope[:as], @scope[:path], @scope[:module], @scope[:constraints], @scope[:defaults], @scope[:options] =
           new_as, new_path, nil, *options.values_at(:constraints, :defaults, :options)
         yield
       ensure
-        @scope[:as], @scope[:path], @scope[:module], @scope[:constraints], @scope[:defaults], @scope[:options] = 
+        @scope[:as], @scope[:path], @scope[:module], @scope[:constraints], @scope[:defaults], @scope[:options] =
           old_as, old_path, old_module, old_constraints, old_defaults, old_options
       end
 

data/lib/devise/rails/warden_compat.rb

@@ -34,87 +34,4 @@ class Warden::SessionSerializer
       end
     end
   end
-end
-
-unless Devise.rack_session?
-  # We cannot use Rails Indifferent Hash because it messes up the flash object.
-  class Devise::IndifferentHash < Hash
-    alias_method :regular_writer, :[]= unless method_defined?(:regular_writer)
-    alias_method :regular_update, :update unless method_defined?(:regular_update)
-
-    def [](key)
-      super(convert_key(key))
-    end
-
-    def []=(key, value)
-      regular_writer(convert_key(key), value)
-    end
-
-    alias_method :store, :[]=
-
-    def update(other_hash)
-      other_hash.each_pair { |key, value| regular_writer(convert_key(key), value) }
-      self
-    end
-
-    alias_method :merge!, :update
-
-    def key?(key)
-      super(convert_key(key))
-    end
-
-    alias_method :include?, :key?
-    alias_method :has_key?, :key?
-    alias_method :member?, :key?
-
-    def fetch(key, *extras)
-      super(convert_key(key), *extras)
-    end
-
-    def values_at(*indices)
-      indices.collect {|key| self[convert_key(key)]}
-    end
-
-    def merge(hash)
-      self.dup.update(hash)
-    end
-
-    def delete(key)
-      super(convert_key(key))
-    end
-
-    def stringify_keys!; self end
-    def stringify_keys; dup end
-
-    undef :symbolize_keys!
-    def symbolize_keys; to_hash.symbolize_keys end
-
-    def to_options!; self end
-    def to_hash; Hash.new.update(self) end
-
-    protected
-
-    def convert_key(key)
-      key.kind_of?(Symbol) ? key.to_s : key
-    end
-  end
-
-  class ActionDispatch::Request
-    def reset_session
-      session.destroy if session && session.respond_to?(:destroy)
-      self.session = {}
-      @env['action_dispatch.request.flash_hash'] = nil
-    end
-  end
-
-  Warden::Manager.after_set_user :event => [:set_user, :authentication] do |record, warden, options|
-    if options[:scope] && warden.authenticated?(options[:scope])
-      request, flash = warden.request, warden.env['action_dispatch.request.flash_hash']
-      backup = request.session.to_hash
-      backup.delete("session_id")
-      request.reset_session
-      warden.env['action_dispatch.request.flash_hash'] = flash
-      request.session = Devise::IndifferentHash.new.update(backup)
-    end
-  end
 end