devise 2.1.0 → 2.1.2

data/lib/devise/strategies/authenticatable.rb

@@ -9,7 +9,7 @@ module Devise
       attr_accessor :authentication_hash, :authentication_type, :password
 
       def store?
-        !mapping.to.skip_session_storage.include?(authentication_type)
+        super && !mapping.to.skip_session_storage.include?(authentication_type)
       end
 
       def valid?
@@ -18,13 +18,24 @@ module Devise
 
     private
 
-      # Simply invokes valid_for_authentication? with the given block and deal with the result.
+      # Receives a resource and check if it is valid by calling valid_for_authentication?
+      # An optional block that will be triggered while validating can be optionally
+      # given as parameter. Check Devise::Models::Authenticable.valid_for_authentication?
+      # for more information.
+      #
+      # In case the resource can't be validated, it will fail with the given
+      # unauthenticated_message.
       def validate(resource, &block)
+        unless resource
+          ActiveSupport::Deprecation.warn "an empty resource was given to #{self.class.name}#validate. " \
+            "Please ensure the resource is not nil", caller
+        end
+
         result = resource && resource.valid_for_authentication?(&block)
 
         case result
         when Symbol, String
-          ActiveSupport::Deprecation.warn "valid_for_authentication should return a boolean value"
+          ActiveSupport::Deprecation.warn "valid_for_authentication? should return a boolean value"
           fail!(result)
           return false
         end
@@ -84,8 +95,8 @@ module Devise
 
       # Extract the appropriate subhash for authentication from params.
       def params_auth_hash
-         params[scope]
-       end
+        params[scope]
+      end
 
       # Extract a hash with attributes:values from the http params.
       def http_auth_hash

data/lib/devise/strategies/base.rb

@@ -2,6 +2,11 @@ module Devise
   module Strategies
     # Base strategy for Devise. Responsible for verifying correct scope and mapping.
     class Base < ::Warden::Strategies::Base
+      # Whenever CSRF cannot be verified, we turn off any kind of storage
+      def store?
+        !env["devise.skip_storage"]
+      end
+
       # Checks if a valid scope was given for devise and find mapping based on this scope.
       def mapping
         @mapping ||= begin

data/lib/devise/strategies/database_authenticatable.rb

@@ -6,12 +6,11 @@ module Devise
     class DatabaseAuthenticatable < Authenticatable
       def authenticate!
         resource = valid_password? && mapping.to.find_for_database_authentication(authentication_hash)
+        return fail(:invalid) unless resource
 
         if validate(resource){ resource.valid_password?(password) }
           resource.after_database_authentication
           success!(resource)
-        elsif !halted?
-          fail(:invalid)
         end
       end
     end

data/lib/devise/strategies/rememberable.rb

@@ -19,11 +19,13 @@ module Devise
       def authenticate!
         resource = mapping.to.serialize_from_cookie(*remember_cookie)
 
+        unless resource
+          cookies.delete(remember_key)
+          return pass
+        end
+
         if validate(resource)
           success!(resource)
-        elsif !halted?
-          cookies.delete(remember_key)
-          pass
         end
       end
 

data/lib/devise/strategies/token_authenticatable.rb

@@ -16,12 +16,11 @@ module Devise
 
       def authenticate!
         resource = mapping.to.find_for_token_authentication(authentication_hash)
+        return fail(:invalid_token) unless resource
 
         if validate(resource)
           resource.after_token_authentication
           success!(resource)
-        elsif !halted?
-          fail(:invalid_token)
         end
       end
 

data/lib/devise/version.rb

@@ -1,3 +1,3 @@
 module Devise
-  VERSION = "2.1.0".freeze
+  VERSION = "2.1.2".freeze
 end

data/lib/generators/devise/views_generator.rb

@@ -10,6 +10,11 @@ module Devise
         argument :scope, :required => false, :default => nil,
                          :desc => "The scope to copy views to"
 
+        # Le sigh, ensure Thor won't handle opts as args
+        # It should be fixed in future Rails releases
+        class_option :form_builder, :aliases => "-b"
+        class_option :markerb
+
         public_task :copy_views
       end
 
@@ -98,6 +103,7 @@ module Devise
                        :desc => "The scope to copy views to"
 
       invoke SharedViewsGenerator
+
       hook_for :form_builder, :aliases => "-b",
                               :desc => "Form builder to be used",
                               :default => defined?(SimpleForm) ? "simple_form_for" : "form_for"

data/lib/generators/mongoid/devise_generator.rb

@@ -20,9 +20,12 @@ module Mongoid
       def migration_data
 <<RUBY
   ## Database authenticatable
-  field :email,              :type => String, :null => false, :default => ""
-  field :encrypted_password, :type => String, :null => false, :default => ""
+  field :email,              :type => String, :default => ""
+  field :encrypted_password, :type => String, :default => ""
 
+  validates_presence_of :email
+  validates_presence_of :encrypted_password
+  
   ## Recoverable
   field :reset_password_token,   :type => String
   field :reset_password_sent_at, :type => Time

data/lib/generators/templates/devise.rb

@@ -125,6 +125,9 @@ Devise.setup do |config|
   # The time you want to timeout the user session without activity. After this
   # time the user will be asked for credentials again. Default is 30 minutes.
   # config.timeout_in = 30.minutes
+  
+  # If true, expires auth token on session timeout.
+  # config.expire_auth_token_on_timeout = false
 
   # ==> Configuration for :lockable
   # Defines which strategy will be used to lock an account.
@@ -181,9 +184,8 @@ Devise.setup do |config|
   # devise role declared in your routes (usually :user).
   # config.default_scope = :user
 
-  # Configure sign_out behavior.
-  # Sign_out action can be scoped (i.e. /users/sign_out affects only :user scope).
-  # The default is true, which means any logout action will sign out all active scopes.
+  # Set this configuration to false if you want /users/sign_out to sign out
+  # only the current scope. By default, Devise signs out all scopes.
   # config.sign_out_all_scopes = true
 
   # ==> Navigation configuration
@@ -213,4 +215,18 @@ Devise.setup do |config|
   #   manager.intercept_401 = false
   #   manager.default_strategies(:scope => :user).unshift :some_external_strategy
   # end
-end
+
+  # ==> Mountable engine configurations
+  # When using Devise inside an engine, let's call it `MyEngine`, and this engine
+  # is mountable, there are some extra configurations to be taken into account.
+  # The following options are available, assuming the engine is mounted as:
+  #
+  #     mount MyEngine, at: "/my_engine"
+  #
+  # The router that invoked `devise_for`, in the example above, would be:
+  # config.router_name = :my_engine
+  #
+  # When using omniauth, Devise cannot automatically set Omniauth path,
+  # so you need to do it manually. For the users scope, it would be:
+  # config.omniauth_path_prefix = "/my_engine/users/auth"
+end

data/lib/generators/templates/simple_form_for/confirmations/new.html.erb

@@ -3,13 +3,13 @@
 <%= simple_form_for(resource, :as => resource_name, :url => confirmation_path(resource_name), :html => { :method => :post }) do |f| %>
   <%= f.error_notification %>
 
-  <div class="inputs">
+  <div class="form-inputs">
     <%= f.input :email, :required => true %>
   </div>
 
-  <div class="actions">
+  <div class="form-actions">
     <%= f.button :submit, "Resend confirmation instructions" %>
   </div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "devise/shared/links" %>

data/lib/generators/templates/simple_form_for/passwords/edit.html.erb

@@ -6,14 +6,14 @@
   <%= f.input :reset_password_token, :as => :hidden %>
   <%= f.full_error :reset_password_token %>
 
-  <div class="inputs">
+  <div class="form-inputs">
     <%= f.input :password, :label => "New password", :required => true %>
     <%= f.input :password_confirmation, :label => "Confirm your new password", :required => true %>
   </div>
 
-  <div class="actions">
+  <div class="form-actions">
     <%= f.button :submit, "Change my password" %>
   </div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "devise/shared/links" %>

data/lib/generators/templates/simple_form_for/passwords/new.html.erb

@@ -3,13 +3,13 @@
 <%= simple_form_for(resource, :as => resource_name, :url => password_path(resource_name), :html => { :method => :post }) do |f| %>
   <%= f.error_notification %>
 
-  <div class="inputs">
+  <div class="form-inputs">
     <%= f.input :email, :required => true %>
   </div>
 
-  <div class="actions">
+  <div class="form-actions">
     <%= f.button :submit, "Send me reset password instructions" %>
   </div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "devise/shared/links" %>

data/lib/generators/templates/simple_form_for/registrations/edit.html.erb

@@ -3,20 +3,20 @@
 <%= simple_form_for(resource, :as => resource_name, :url => registration_path(resource_name), :html => { :method => :put }) do |f| %>
   <%= f.error_notification %>
 
-  <div class="inputs">
+  <div class="form-inputs">
     <%= f.input :email, :required => true, :autofocus => true %>
     <%= f.input :password, :autocomplete => "off", :hint => "leave it blank if you don't want to change it", :required => false %>
     <%= f.input :password_confirmation, :required => false %>
     <%= f.input :current_password, :hint => "we need your current password to confirm your changes", :required => true %>
   </div>
 
-  <div class="actions">
+  <div class="form-actions">
     <%= f.button :submit, "Update" %>
   </div>
 <% end %>
 
 <h3>Cancel my account</h3>
 
-<p>Unhappy? <%= link_to "Cancel my account", registration_path(resource_name), :confirm => "Are you sure?", :method => :delete %>.</p>
+<p>Unhappy? <%= link_to "Cancel my account", registration_path(resource_name), :data => { :confirm => "Are you sure?" }, :method => :delete %>.</p>
 
 <%= link_to "Back", :back %>

data/lib/generators/templates/simple_form_for/registrations/new.html.erb

@@ -3,15 +3,15 @@
 <%= simple_form_for(resource, :as => resource_name, :url => registration_path(resource_name)) do |f| %>
   <%= f.error_notification %>
 
-  <div class="inputs">
+  <div class="form-inputs">
     <%= f.input :email, :required => true, :autofocus => true %>
     <%= f.input :password, :required => true %>
     <%= f.input :password_confirmation, :required => true %>
   </div>
 
-  <div class="actions">
+  <div class="form-actions">
     <%= f.button :submit, "Sign up" %>
   </div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "devise/shared/links" %>

data/lib/generators/templates/simple_form_for/sessions/new.html.erb

@@ -1,15 +1,15 @@
 <h2>Sign in</h2>
 
 <%= simple_form_for(resource, :as => resource_name, :url => session_path(resource_name)) do |f| %>
-  <div class="inputs">
+  <div class="form-inputs">
     <%= f.input :email, :required => false, :autofocus => true %>
     <%= f.input :password, :required => false %>
     <%= f.input :remember_me, :as => :boolean if devise_mapping.rememberable? %>
   </div>
 
-  <div class="actions">
+  <div class="form-actions">
     <%= f.button :submit, "Sign in" %>
   </div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "devise/shared/links" %>

data/lib/generators/templates/simple_form_for/unlocks/new.html.erb

@@ -3,13 +3,13 @@
 <%= simple_form_for(resource, :as => resource_name, :url => unlock_path(resource_name), :html => { :method => :post }) do |f| %>
   <%= f.error_notification %>
 
-  <div class="inputs">
+  <div class="form-inputs">
     <%= f.input :email, :required => true %>
   </div>
 
-  <div class="actions">
+  <div class="form-actions">
     <%= f.button :submit, "Resend unlock instructions" %>
   </div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "devise/shared/links" %>

data/test/controllers/helpers_test.rb

@@ -139,30 +139,27 @@ class ControllerAuthenticatableTest < ActionController::TestCase
     assert_equal nil, @controller.instance_variable_get(:@current_admin)
   end
 
-  test 'sign out clears up any signed in user by scope' do
+  test 'sign out logs out and clears up any signed in user by scope' do
     user = User.new
     @mock_warden.expects(:user).with(:scope => :user, :run_callbacks => false).returns(user)
     @mock_warden.expects(:logout).with(:user).returns(true)
+    @mock_warden.expects(:clear_strategies_cache!).with(:scope => :user).returns(true)
     @controller.instance_variable_set(:@current_user, user)
     @controller.sign_out(:user)
     assert_equal nil, @controller.instance_variable_get(:@current_user)
   end
-  
-  test 'sign out proxy to logout on warden' do
-    @mock_warden.expects(:user).with(:scope => :user, :run_callbacks => false).returns(true)
-    @mock_warden.expects(:logout).with(:user).returns(true)
-    @controller.sign_out(:user)
-  end
 
   test 'sign out accepts a resource as argument' do
     @mock_warden.expects(:user).with(:scope => :user, :run_callbacks => false).returns(true)
     @mock_warden.expects(:logout).with(:user).returns(true)
+    @mock_warden.expects(:clear_strategies_cache!).with(:scope => :user).returns(true)
     @controller.sign_out(User.new)
   end
 
   test 'sign out without args proxy to sign out all scopes' do
     @mock_warden.expects(:user).times(Devise.mappings.size)
     @mock_warden.expects(:logout).with().returns(true)
+    @mock_warden.expects(:clear_strategies_cache!).with().returns(true)
     @controller.sign_out
   end
 
@@ -232,6 +229,7 @@ class ControllerAuthenticatableTest < ActionController::TestCase
     swap Devise, :sign_out_all_scopes => false do
       @mock_warden.expects(:user).with(:scope => :admin, :run_callbacks => false).returns(true)
       @mock_warden.expects(:logout).with(:admin).returns(true)
+      @mock_warden.expects(:clear_strategies_cache!).with(:scope => :admin).returns(true)
       @controller.expects(:redirect_to).with(admin_root_path)
       @controller.instance_eval "def after_sign_out_path_for(resource); admin_root_path; end"
       @controller.sign_out_and_redirect(:admin)
@@ -242,6 +240,7 @@ class ControllerAuthenticatableTest < ActionController::TestCase
     swap Devise, :sign_out_all_scopes => true do
       @mock_warden.expects(:user).times(Devise.mappings.size)
       @mock_warden.expects(:logout).with().returns(true)
+      @mock_warden.expects(:clear_strategies_cache!).with().returns(true)
       @controller.expects(:redirect_to).with(admin_root_path)
       @controller.instance_eval "def after_sign_out_path_for(resource); admin_root_path; end"
       @controller.sign_out_and_redirect(:admin)

data/test/controllers/sessions_controller_test.rb

@@ -4,6 +4,15 @@ class SessionsControllerTest < ActionController::TestCase
   tests Devise::SessionsController
   include Devise::TestHelpers
 
+  test "#create works even with scoped views" do
+    swap Devise, :scoped_views => true do
+      request.env["devise.mapping"] = Devise.mappings[:user]
+      post :create
+      assert_equal 200, @response.status
+      assert_template "users/sessions/new"
+    end
+  end
+
   test "#create doesn't raise exception after Warden authentication fails when TestHelpers included" do
     request.env["devise.mapping"] = Devise.mappings[:user]
     post :create, :user => {
@@ -13,23 +22,21 @@ class SessionsControllerTest < ActionController::TestCase
     assert_equal 200, @response.status
     assert_template "devise/sessions/new"
   end
- 
-  if defined?(ActiveRecord) 
-    if ActiveRecord::Base.respond_to?(:mass_assignment_sanitizer)
-      test "#new doesn't raise mass-assignment exception even if sign-in key is attr_protected" do
-        request.env["devise.mapping"] = Devise.mappings[:user] 
 
-        ActiveRecord::Base.mass_assignment_sanitizer = :strict
-        User.class_eval { attr_protected :email }
-      
-        begin
-          assert_nothing_raised ActiveModel::MassAssignmentSecurity::Error do
-            get :new, :user => { :email => "allez viens!" }
-          end
-        ensure
-          ActiveRecord::Base.mass_assignment_sanitizer = :logger
-          User.class_eval { attr_accessible :email }
+  if defined?(ActiveRecord) && ActiveRecord::Base.respond_to?(:mass_assignment_sanitizer)
+    test "#new doesn't raise mass-assignment exception even if sign-in key is attr_protected" do
+      request.env["devise.mapping"] = Devise.mappings[:user]
+
+      ActiveRecord::Base.mass_assignment_sanitizer = :strict
+      User.class_eval { attr_protected :email }
+
+      begin
+        assert_nothing_raised ActiveModel::MassAssignmentSecurity::Error do
+          get :new, :user => { :email => "allez viens!" }
         end
+      ensure
+        ActiveRecord::Base.mass_assignment_sanitizer = :logger
+        User.class_eval { attr_accessible :email }
       end
     end
   end

data/test/integration/authenticatable_test.rb

@@ -75,13 +75,73 @@ class AuthenticationSanityTest < ActionController::IntegrationTest
     assert_not warden.authenticated?(:admin)
   end
 
-  test 'not signed in as admin should not be able to access private route restricted to admins' do
+  test 'signed in as user should not be able to access admins actions' do
+    sign_in_as_user
+    assert warden.authenticated?(:user)
+    assert_not warden.authenticated?(:admin)
+
+    get admins_path
+    assert_redirected_to new_admin_session_path
+  end
+
+  test 'signed in as admin should be able to access admin actions' do
+    sign_in_as_admin
+    assert warden.authenticated?(:admin)
+    assert_not warden.authenticated?(:user)
+
+    get admins_path
+
+    assert_response :success
+    assert_template 'admins/index'
+    assert_contain 'Welcome Admin'
+  end
+
+  test 'authenticated admin should not be able to sign as admin again' do
+    sign_in_as_admin
+    get new_admin_session_path
+
+    assert_response :redirect
+    assert_redirected_to admin_root_path
+    assert warden.authenticated?(:admin)
+  end
+
+  test 'authenticated admin should be able to sign out' do
+    sign_in_as_admin
+    assert warden.authenticated?(:admin)
+
+    get destroy_admin_session_path
+    assert_response :redirect
+    assert_redirected_to root_path
+
+    get root_path
+    assert_contain 'Signed out successfully'
+    assert_not warden.authenticated?(:admin)
+  end
+
+  test 'unauthenticated admin does not set message on sign out' do
+    get destroy_admin_session_path
+    assert_response :redirect
+    assert_redirected_to root_path
+
+    get root_path
+    assert_not_contain 'Signed out successfully'
+  end
+
+  test 'scope uses custom failure app' do
+    put "/en/accounts/management"
+    assert_equal "Oops, not found", response.body
+    assert_equal 404, response.status
+  end
+end
+
+class AuthenticationRoutesRestrictions < ActionController::IntegrationTest
+  test 'not signed in should not be able to access private route (authenticate denied)' do
     get private_path
     assert_redirected_to new_admin_session_path
     assert_not warden.authenticated?(:admin)
   end
 
-  test 'signed in as user should not be able to access private route restricted to admins' do
+  test 'signed in as user should not be able to access private route restricted to admins (authenticate denied)' do
     sign_in_as_user
     assert warden.authenticated?(:user)
     assert_not warden.authenticated?(:admin)
@@ -89,7 +149,7 @@ class AuthenticationSanityTest < ActionController::IntegrationTest
     assert_redirected_to new_admin_session_path
   end
 
-  test 'signed in as admin should be able to access private route restricted to admins' do
+  test 'signed in as admin should be able to access private route restricted to admins (authenticate accepted)' do
     sign_in_as_admin
     assert warden.authenticated?(:admin)
     assert_not warden.authenticated?(:user)
@@ -101,7 +161,29 @@ class AuthenticationSanityTest < ActionController::IntegrationTest
     assert_contain 'Private!'
   end
 
-  test 'signed in as admin should get admin dashboard' do
+  test 'signed in as inactive admin should not be able to access private/active route restricted to active admins (authenticate denied)' do
+    sign_in_as_admin(:active => false)
+    assert warden.authenticated?(:admin)
+    assert_not warden.authenticated?(:user)
+
+    assert_raises ActionController::RoutingError do
+      get "/private/active"
+    end
+  end
+
+  test 'signed in as active admin should be able to access private/active route restricted to active admins (authenticate accepted)' do
+    sign_in_as_admin(:active => true)
+    assert warden.authenticated?(:admin)
+    assert_not warden.authenticated?(:user)
+
+    get private_active_path
+
+    assert_response :success
+    assert_template 'home/private'
+    assert_contain 'Private!'
+  end
+
+  test 'signed in as admin should get admin dashboard (authenticated accepted)' do
     sign_in_as_admin
     assert warden.authenticated?(:admin)
     assert_not warden.authenticated?(:user)
@@ -113,7 +195,7 @@ class AuthenticationSanityTest < ActionController::IntegrationTest
     assert_contain 'Admin dashboard'
   end
 
-  test 'signed in as user should get user dashboard' do
+  test 'signed in as user should get user dashboard (authenticated accepted)' do
     sign_in_as_user
     assert warden.authenticated?(:user)
     assert_not warden.authenticated?(:admin)
@@ -125,86 +207,50 @@ class AuthenticationSanityTest < ActionController::IntegrationTest
     assert_contain 'User dashboard'
   end
 
-  test 'not signed in should get no dashboard' do
+  test 'not signed in should get no dashboard (authenticated denied)' do
     assert_raises ActionController::RoutingError do
       get dashboard_path
     end
   end
 
-  test 'signed in user should not see unauthenticated page' do
-    sign_in_as_user
-    assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
+  test 'signed in as inactive admin should not be able to access dashboard/active route restricted to active admins (authenticated denied)' do
+    sign_in_as_admin(:active => false)
+    assert warden.authenticated?(:admin)
+    assert_not warden.authenticated?(:user)
 
     assert_raises ActionController::RoutingError do
-      get join_path
+      get "/dashboard/active"
     end
   end
 
-  test 'not signed in users should see unautheticated page' do
-    get join_path
+  test 'signed in as active admin should be able to access dashboard/active route restricted to active admins (authenticated accepted)' do
+    sign_in_as_admin(:active => true)
+    assert warden.authenticated?(:admin)
+    assert_not warden.authenticated?(:user)
+
+    get dashboard_active_path
 
     assert_response :success
-    assert_template 'home/join'
-    assert_contain 'Join'
+    assert_template 'home/admin_dashboard'
+    assert_contain 'Admin dashboard'
   end
 
-  test 'signed in as user should not be able to access admins actions' do
+  test 'signed in user should not see unauthenticated page (unauthenticated denied)' do
     sign_in_as_user
     assert warden.authenticated?(:user)
     assert_not warden.authenticated?(:admin)
 
-    get admins_path
-    assert_redirected_to new_admin_session_path
+    assert_raises ActionController::RoutingError do
+      get join_path
+    end
   end
 
-  test 'signed in as admin should be able to access admin actions' do
-    sign_in_as_admin
-    assert warden.authenticated?(:admin)
-    assert_not warden.authenticated?(:user)
-
-    get admins_path
+  test 'not signed in users should see unautheticated page (unauthenticated accepted)' do
+    get join_path
 
     assert_response :success
-    assert_template 'admins/index'
-    assert_contain 'Welcome Admin'
-  end
-
-  test 'authenticated admin should not be able to sign as admin again' do
-    sign_in_as_admin
-    get new_admin_session_path
-
-    assert_response :redirect
-    assert_redirected_to admin_root_path
-    assert warden.authenticated?(:admin)
-  end
-
-  test 'authenticated admin should be able to sign out' do
-    sign_in_as_admin
-    assert warden.authenticated?(:admin)
-
-    get destroy_admin_session_path
-    assert_response :redirect
-    assert_redirected_to root_path
-
-    get root_path
-    assert_contain 'Signed out successfully'
-    assert_not warden.authenticated?(:admin)
-  end
-
-  test 'unauthenticated admin does not set message on sign out' do
-    get destroy_admin_session_path
-    assert_response :redirect
-    assert_redirected_to root_path
-
-    get root_path
-    assert_not_contain 'Signed out successfully'
-  end
-
-  test 'scope uses custom failure app' do
-    put "/en/accounts/management"
-    assert_equal "Oops, not found", response.body
-    assert_equal 404, response.status
+    assert_template 'home/join'
+    assert_contain 'Join'
   end
 end