devise 1.5.4 → 2.0.0.rc

data/lib/devise/models/confirmable.rb

@@ -9,11 +9,16 @@ module Devise
     #
     # Confirmable adds the following options to devise_for:
     #
-    #   * +confirm_within+: the time you want to allow the user to access his account
+    #   * +allow_unconfirmed_access_for+: the time you want to allow the user to access his account
     #     before confirming it. After this period, the user access is denied. You can
     #     use this to let your user access some features of your application without
     #     confirming the account, but blocking it after a certain period (ie 7 days).
-    #     By default confirm_within is zero, it means users always have to confirm to sign in.
+    #     By default allow_unconfirmed_access_for is zero, it means users always have to confirm to sign in.
+    #   * +reconfirmable+: requires any email changes to be confirmed (exactly the same way as
+    #     initial account confirmation) to be applied. Requires additional unconfirmed_email
+    #     db field to be setup (t.reconfirmable in migrations). Until confirmed new email is
+    #     stored in unconfirmed email column, and copied to email column on successful
+    #     confirmation.
     #
     # == Examples
     #
@@ -27,15 +32,26 @@ module Devise
       included do
         before_create :generate_confirmation_token, :if => :confirmation_required?
         after_create  :send_confirmation_instructions, :if => :confirmation_required?
+        before_update :postpone_email_change_until_confirmation, :if => :postpone_email_change?
+        after_update :send_confirmation_instructions, :if => :reconfirmation_required?
       end
 
-      # Confirm a user by setting its confirmed_at to actual time. If the user
-      # is already confirmed, add en error to email field
+      # Confirm a user by setting it's confirmed_at to actual time. If the user
+      # is already confirmed, add an error to email field. If the user is invalid
+      # add errors
       def confirm!
         unless_confirmed do
           self.confirmation_token = nil
           self.confirmed_at = Time.now.utc
-          save(:validate => false)
+
+          if self.class.reconfirmable
+            @bypass_postpone = true
+            self.email = unconfirmed_email if unconfirmed_email.present?
+            self.unconfirmed_email = nil
+            save
+          else
+            save(:validate => false)
+          end
         end
       end
 
@@ -44,9 +60,14 @@ module Devise
         !!confirmed_at
       end
 
+      def pending_reconfirmation?
+        self.class.reconfirmable && unconfirmed_email.present?
+      end
+
       # Send confirmation instructions by email
       def send_confirmation_instructions
-        generate_confirmation_token! if self.confirmation_token.nil?
+        @reconfirmation_required = false
+        generate_confirmation_token! if self.confirmation_token.blank?
         self.devise_mailer.confirmation_instructions(self).deliver
       end
 
@@ -74,6 +95,14 @@ module Devise
         self.confirmed_at = Time.now.utc
       end
 
+      def headers_for(action)
+        headers = super
+        if action == :confirmation_instructions && pending_reconfirmation?
+          headers[:to] = unconfirmed_email
+        end
+        headers
+      end
+
       protected
 
         # Callback to overwrite if confirmation is required or not.
@@ -88,26 +117,26 @@ module Devise
         #
         # Example:
         #
-        #   # confirm_within = 1.day and confirmation_sent_at = today
+        #   # allow_unconfirmed_access_for = 1.day and confirmation_sent_at = today
         #   confirmation_period_valid?   # returns true
         #
-        #   # confirm_within = 5.days and confirmation_sent_at = 4.days.ago
+        #   # allow_unconfirmed_access_for = 5.days and confirmation_sent_at = 4.days.ago
         #   confirmation_period_valid?   # returns true
         #
-        #   # confirm_within = 5.days and confirmation_sent_at = 5.days.ago
+        #   # allow_unconfirmed_access_for = 5.days and confirmation_sent_at = 5.days.ago
         #   confirmation_period_valid?   # returns false
         #
-        #   # confirm_within = 0.days
+        #   # allow_unconfirmed_access_for = 0.days
         #   confirmation_period_valid?   # will always return false
         #
         def confirmation_period_valid?
-          confirmation_sent_at && confirmation_sent_at.utc >= self.class.confirm_within.ago
+          confirmation_sent_at && confirmation_sent_at.utc >= self.class.allow_unconfirmed_access_for.ago
         end
 
-        # Checks whether the record is confirmed or not, yielding to the block
+        # Checks whether the record is confirmed or not or a new email has been added, yielding to the block
         # if it's already confirmed, otherwise adds an error to email.
         def unless_confirmed
-          unless confirmed?
+          unless confirmed? && !pending_reconfirmation?
             yield
           else
             self.errors.add(:email, :already_confirmed)
@@ -118,7 +147,6 @@ module Devise
         # Generates a new random token for confirmation, and stores the time
         # this token is being generated
         def generate_confirmation_token
-          self.confirmed_at = nil
           self.confirmation_token = self.class.confirmation_token
           self.confirmation_sent_at = Time.now.utc
         end
@@ -132,13 +160,32 @@ module Devise
           confirm! unless confirmed?
         end
 
+        def postpone_email_change_until_confirmation
+          @reconfirmation_required = true
+          self.unconfirmed_email = self.email
+          self.email = self.email_was
+        end
+
+        def postpone_email_change?
+          postpone = self.class.reconfirmable && email_changed? && !@bypass_postpone
+          @bypass_postpone = nil
+          postpone
+        end
+
+        def reconfirmation_required?
+          self.class.reconfirmable && @reconfirmation_required
+        end
+
       module ClassMethods
         # Attempt to find a user by its email. If a record is found, send new
-        # confirmation instructions to it. If not user is found, returns a new user
-        # with an email not found error.
+        # confirmation instructions to it. If not, try searching for a user by unconfirmed_email
+        # field. If no user is found, returns a new user with an email not found error.
         # Options must contain the user email
         def send_confirmation_instructions(attributes={})
-          confirmable = find_or_initialize_with_errors(confirmation_keys, attributes, :not_found)
+          confirmable = find_by_unconfirmed_email_with_errors(attributes) if reconfirmable
+          unless confirmable.try(:persisted?)
+            confirmable = find_or_initialize_with_errors(confirmation_keys, attributes, :not_found)
+          end
           confirmable.resend_confirmation_token if confirmable.persisted?
           confirmable
         end
@@ -158,7 +205,15 @@ module Devise
           generate_token(:confirmation_token)
         end
 
-        Devise::Models.config(self, :confirm_within, :confirmation_keys)
+        # Find a record for confirmation by unconfirmed email field
+        def find_by_unconfirmed_email_with_errors(attributes = {})
+          unconfirmed_required_attributes = confirmation_keys.map { |k| k == :email ? :unconfirmed_email : k }
+          unconfirmed_attributes = attributes.symbolize_keys
+          unconfirmed_attributes[:unconfirmed_email] = unconfirmed_attributes.delete(:email)
+          find_or_initialize_with_errors(unconfirmed_required_attributes, unconfirmed_attributes, :not_found)
+        end
+
+        Devise::Models.config(self, :allow_unconfirmed_access_for, :confirmation_keys, :reconfirmable)
       end
     end
   end

data/lib/devise/models/database_authenticatable.rb

@@ -25,8 +25,6 @@ module Devise
       included do
         attr_reader :password, :current_password
         attr_accessor :password_confirmation
-        before_validation :downcase_keys
-        before_validation :strip_whitespace
       end
 
       # Generates password encryption based on the given value.
@@ -103,15 +101,6 @@ module Devise
 
     protected
 
-      # Downcase case-insensitive keys
-      def downcase_keys
-        (self.class.case_insensitive_keys || []).each { |k| self[k].try(:downcase!) }
-      end
-
-      def strip_whitespace
-        (self.class.strip_whitespace_keys || []).each { |k| self[k].try(:strip!) }
-      end
-
       # Digests the password using bcrypt.
       def password_digest(password)
         ::BCrypt::Password.create("#{password}#{self.class.pepper}", :cost => self.class.stretches).to_s

data/lib/devise/models/recoverable.rb

@@ -29,6 +29,7 @@ module Devise
       def reset_password!(new_password, new_password_confirmation)
         self.password = new_password
         self.password_confirmation = new_password_confirmation
+
         if valid?
           clear_reset_password_token
           after_password_reset
@@ -39,7 +40,7 @@ module Devise
 
       # Resets reset password token and send reset password instructions by email
       def send_reset_password_instructions
-        generate_reset_password_token! if should_generate_token?
+        generate_reset_password_token! if should_generate_reset_token?
         self.devise_mailer.reset_password_instructions(self).deliver
       end
 
@@ -64,20 +65,19 @@ module Devise
       #   reset_password_period_valid?   # will always return false
       #
       def reset_password_period_valid?
-        return true unless respond_to?(:reset_password_sent_at)
         reset_password_sent_at && reset_password_sent_at.utc >= self.class.reset_password_within.ago
       end
 
       protected
 
-        def should_generate_token?
+        def should_generate_reset_token?
           reset_password_token.nil? || !reset_password_period_valid?
         end
 
         # Generates a new random token for reset password
         def generate_reset_password_token
           self.reset_password_token = self.class.reset_password_token
-          self.reset_password_sent_at = Time.now.utc if respond_to?(:reset_password_sent_at=)
+          self.reset_password_sent_at = Time.now.utc
           self.reset_password_token
         end
 
@@ -90,7 +90,7 @@ module Devise
         # Removes reset_password token
         def clear_reset_password_token
           self.reset_password_token = nil
-          self.reset_password_sent_at = nil if respond_to?(:reset_password_sent_at=)
+          self.reset_password_sent_at = nil
         end
 
         def after_password_reset

data/lib/devise/models/rememberable.rb

@@ -21,11 +21,6 @@ module Devise
     #     used to calculate the expires time for the cookie created to remember
     #     the user. By default remember_for is 2.weeks.
     #
-    #   * +remember_across_browsers+: if a valid remember token can be re-used
-    #     between multiple browsers. By default remember_across_browsers is true
-    #     and cannot be turned off if you are using password salt instead of remember
-    #     token.
-    #
     #   * +extend_remember_period+: if true, extends the user's remember period
     #     when remembered via cookie. False by default.
     #
@@ -49,7 +44,6 @@ module Devise
       # Generate a new remember token and save the record without validations
       # unless remember_across_browsers is true and the user already has a valid token.
       def remember_me!(extend_period=false)
-        self.remember_token = self.class.remember_token if respond_to?(:remember_token) && generate_remember_token?
         self.remember_created_at = Time.now.utc if generate_remember_timestamp?(extend_period)
         save(:validate => false)
       end
@@ -75,14 +69,12 @@ module Devise
       end
 
       def rememberable_value
-        if respond_to?(:remember_token)
-          remember_token
-        elsif respond_to?(:authenticatable_salt) && (salt = authenticatable_salt)
+        if salt = authenticatable_salt
           salt
         else
-          raise "The #{self.class.name} class does not respond to remember_token and " <<
-            "authenticatable_salt returns nil. In order to use rememberable, you must " <<
-            "add a remember_token field to your model or ensure a password is always set."
+          raise "authenticable_salt returned nil for the #{self.class.name} model. " \
+            "In order to use rememberable, you must ensure a password is always set " \
+            "or implement rememberable_value in your model with your own logic."
         end
       end
 
@@ -92,12 +84,6 @@ module Devise
 
     protected
 
-      # Generate a token unless remember_across_browsers is true and there is
-      # an existing remember_token or the existing remember_token has expried.
-      def generate_remember_token? #:nodoc:
-        !(self.class.remember_across_browsers && remember_token) || remember_expired?
-      end
-
       # Generate a timestamp if extend_remember_period is true, if no remember_token
       # exists, or if an existing remember token has expired.
       def generate_remember_timestamp?(extend_period) #:nodoc:
@@ -121,8 +107,7 @@ module Devise
           generate_token(:remember_token)
         end
 
-        Devise::Models.config(self, :remember_for, :remember_across_browsers,
-          :extend_remember_period, :cookie_options)
+        Devise::Models.config(self, :remember_for, :extend_remember_period, :cookie_options)
       end
     end
   end

data/lib/devise/models/timeoutable.rb

@@ -23,7 +23,6 @@ module Devise
       # Checks whether the user session has expired based on configured time.
       def timedout?(last_access)
         return false if remember_exists_and_not_expired?
-
         !timeout_in.nil? && last_access && last_access <= timeout_in.ago
       end
 
@@ -34,8 +33,7 @@ module Devise
       private
 
       def remember_exists_and_not_expired?
-        return false unless respond_to?(:remember_expired?)
-
+        return false unless respond_to?(:remember_created_at)
         remember_created_at && !remember_expired?
       end
 

data/lib/devise/models/token_authenticatable.rb

@@ -24,9 +24,6 @@ module Devise
     #
     #   * +token_authentication_key+: Defines name of the authentication token params key. E.g. /users/sign_in?some_key=...
     #
-    #   * +stateless_token+: By default, when you sign up with a token, Devise will store the user in session
-    #     as any other authentication strategy. You can set stateless_token to true to avoid this.
-    #
     module TokenAuthenticatable
       extend ActiveSupport::Concern
 
@@ -65,7 +62,7 @@ module Devise
           generate_token(:authentication_token)
         end
 
-        ::Devise::Models.config(self, :token_authentication_key, :stateless_token)
+        ::Devise::Models.config(self, :token_authentication_key)
       end
     end
   end

data/lib/devise/models/validatable.rb

@@ -23,7 +23,7 @@ module Devise
 
         base.class_eval do
           validates_presence_of   :email, :if => :email_required?
-          validates_uniqueness_of :email, :case_sensitive => (case_insensitive_keys != false), :allow_blank => true, :if => :email_changed?
+          validates_uniqueness_of :email, :allow_blank => true, :if => :email_changed?
           validates_format_of     :email, :with  => email_regexp, :allow_blank => true, :if => :email_changed?
 
           validates_presence_of     :password, :if => :password_required?

data/lib/devise/orm/active_record.rb

@@ -26,6 +26,12 @@ module Devise
 
         # Tell how to apply schema methods.
         def apply_devise_schema(name, type, options={})
+          @__devise_warning_raised ||= begin
+            $stderr.puts "\n[DEVISE] You are using t.database_authenticatable and others in your migration " \
+              "and this feature is deprecated. Please simply use Rails helpers instead as mentioned here:\n" \
+              "https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.0-migration-schema-style\n\n"
+            true
+          end
           column name, type.to_s.downcase.to_sym, options
         end
       end

data/lib/devise/param_filter.rb

@@ -33,8 +33,9 @@ module Devise
 
     private
 
+    # Determine which values should be transformed to string or passed as-is to the query builder underneath
     def param_requires_string_conversion?(value)
-      true
+      true unless value.is_a?(TrueClass) || value.is_a?(FalseClass) || value.is_a?(Fixnum)
     end
   end
 end

data/lib/devise/rails.rb

@@ -41,5 +41,36 @@ module Devise
         end
       end
     end
+
+    initializer "devise.deprecations" do
+      unless defined?(Rails::Generators)
+        if Devise.case_insensitive_keys == false
+          warn "\n[DEVISE] Devise.case_insensitive_keys is false which is no longer " \
+            "supported. If you want to continue running on this mode, please ensure " \
+            "you are not using validatable (you can copy the validations directly to your model) " \
+            "and set case_insensitive_keys to an empty array.\n"
+        end
+
+        if Devise.apply_schema && defined?(Mongoid)
+          warn "\n[DEVISE] Devise.apply_schema is true. This means Devise was " \
+            "automatically configuring your DB. This no longer happens. You should " \
+            "set Devise.apply_schema to false and manually set the fields used by Devise as shown here: " \
+            "https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.0-migration-schema-style\n"
+        end
+
+        # TODO: Deprecate the true value of this option as well
+        if Devise.use_salt_as_remember_token == false
+          warn "\n[DEVISE] Devise.use_salt_as_remember_token is false which is no longer " \
+            "supported. Devise now only uses the salt as remember token and the remember_token " \
+            "column can be removed from your models.\n"
+        end
+
+        if Devise.reset_password_within.nil?
+          warn "\n[DEVISE] Devise.reset_password_within is nil. Please set this value to " \
+            "an interval (for example, 6.hours) and add a reset_password_sent_at field to " \
+            "your Devise models (if they don't have one already).\n"
+        end
+      end
+    end
   end
 end

data/lib/devise/schema.rb

@@ -40,6 +40,11 @@ module Devise
       apply_devise_schema :confirmation_sent_at, DateTime
     end
 
+    # Creates unconfirmed_email
+    def reconfirmable
+      apply_devise_schema :unconfirmed_email,    String
+    end
+
     # Creates reset_password_token and reset_password_sent_at.
     #
     # == Options

data/lib/devise/strategies/authenticatable.rb

@@ -6,7 +6,11 @@ module Devise
     # parameters both from params or from http authorization headers. See database_authenticatable
     # for an example.
     class Authenticatable < Base
-      attr_accessor :authentication_hash, :password
+      attr_accessor :authentication_hash, :authentication_type, :password
+
+      def store?
+        !mapping.to.skip_session_storage.include?(authentication_type)
+      end
 
       def valid?
         valid_for_params_auth? || valid_for_http_auth?
@@ -47,7 +51,7 @@ module Devise
       #   * If all authentication keys are present;
       #
       def valid_for_http_auth?
-        http_authenticatable? && request.authorization && with_authentication_hash(http_auth_hash)
+        http_authenticatable? && request.authorization && with_authentication_hash(:http_auth, http_auth_hash)
       end
 
       # Check if this is strategy is valid for params authentication by:
@@ -58,8 +62,8 @@ module Devise
       #   * If all authentication keys are present;
       #
       def valid_for_params_auth?
-        params_authenticatable? && valid_request? &&
-          valid_params? && with_authentication_hash(params_auth_hash)
+        params_authenticatable? && valid_params_request? &&
+          valid_params? && with_authentication_hash(:params_auth, params_auth_hash)
       end
 
       # Check if the model accepts this strategy as http authenticatable.
@@ -83,8 +87,8 @@ module Devise
         Hash[*keys.zip(decode_credentials).flatten]
       end
 
-      # By default, a request is valid  if the controller is allowed and the VERB is POST.
-      def valid_request?
+      # By default, a request is valid if the controller set the proper env variable.
+      def valid_params_request?
         !!env["devise.allow_params_authentication"]
       end
 
@@ -105,8 +109,8 @@ module Devise
       end
 
       # Sets the authentication hash and the password from params_auth_hash or http_auth_hash.
-      def with_authentication_hash(auth_values)
-        self.authentication_hash = {}
+      def with_authentication_hash(auth_type, auth_values)
+        self.authentication_hash, self.authentication_type = {}, auth_type
         self.password = auth_values[:password]
 
         parse_authentication_key_values(auth_values, authentication_keys) &&