devise 3.2.2 → 4.8.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/CHANGELOG.md +281 -957
- data/MIT-LICENSE +2 -1
- data/README.md +410 -120
- data/app/controllers/devise/confirmations_controller.rb +11 -5
- data/app/controllers/devise/omniauth_callbacks_controller.rb +12 -6
- data/app/controllers/devise/passwords_controller.rb +21 -8
- data/app/controllers/devise/registrations_controller.rb +59 -26
- data/app/controllers/devise/sessions_controller.rb +47 -17
- data/app/controllers/devise/unlocks_controller.rb +9 -4
- data/app/controllers/devise_controller.rb +69 -33
- data/app/helpers/devise_helper.rb +23 -18
- data/app/mailers/devise/mailer.rb +13 -3
- data/app/views/devise/confirmations/new.html.erb +9 -5
- data/app/views/devise/mailer/confirmation_instructions.html.erb +1 -1
- data/app/views/devise/mailer/email_changed.html.erb +7 -0
- data/app/views/devise/mailer/password_change.html.erb +3 -0
- data/app/views/devise/mailer/reset_password_instructions.html.erb +1 -1
- data/app/views/devise/mailer/unlock_instructions.html.erb +1 -1
- data/app/views/devise/passwords/edit.html.erb +16 -7
- data/app/views/devise/passwords/new.html.erb +9 -5
- data/app/views/devise/registrations/edit.html.erb +29 -15
- data/app/views/devise/registrations/new.html.erb +20 -9
- data/app/views/devise/sessions/new.html.erb +19 -10
- data/app/views/devise/shared/_error_messages.html.erb +15 -0
- data/app/views/devise/shared/{_links.erb → _links.html.erb} +9 -9
- data/app/views/devise/unlocks/new.html.erb +9 -5
- data/config/locales/en.yml +24 -18
- data/lib/devise/controllers/helpers.rb +113 -33
- data/lib/devise/controllers/rememberable.rb +15 -6
- data/lib/devise/controllers/scoped_views.rb +3 -1
- data/lib/devise/controllers/sign_in_out.rb +47 -29
- data/lib/devise/controllers/store_location.rb +31 -5
- data/lib/devise/controllers/url_helpers.rb +10 -8
- data/lib/devise/delegator.rb +2 -0
- data/lib/devise/encryptor.rb +24 -0
- data/lib/devise/failure_app.rb +119 -40
- data/lib/devise/hooks/activatable.rb +7 -6
- data/lib/devise/hooks/csrf_cleaner.rb +5 -1
- data/lib/devise/hooks/forgetable.rb +2 -0
- data/lib/devise/hooks/lockable.rb +5 -3
- data/lib/devise/hooks/proxy.rb +4 -2
- data/lib/devise/hooks/rememberable.rb +4 -2
- data/lib/devise/hooks/timeoutable.rb +16 -9
- data/lib/devise/hooks/trackable.rb +3 -1
- data/lib/devise/mailers/helpers.rb +15 -12
- data/lib/devise/mapping.rb +9 -3
- data/lib/devise/models/authenticatable.rb +91 -61
- data/lib/devise/models/confirmable.rb +138 -43
- data/lib/devise/models/database_authenticatable.rb +112 -31
- data/lib/devise/models/lockable.rb +39 -18
- data/lib/devise/models/omniauthable.rb +3 -1
- data/lib/devise/models/recoverable.rb +64 -28
- data/lib/devise/models/registerable.rb +4 -0
- data/lib/devise/models/rememberable.rb +62 -33
- data/lib/devise/models/timeoutable.rb +4 -8
- data/lib/devise/models/trackable.rb +20 -4
- data/lib/devise/models/validatable.rb +16 -9
- data/lib/devise/models.rb +3 -1
- data/lib/devise/modules.rb +12 -10
- data/lib/devise/omniauth/config.rb +2 -0
- data/lib/devise/omniauth/url_helpers.rb +14 -5
- data/lib/devise/omniauth.rb +4 -5
- data/lib/devise/orm/active_record.rb +5 -1
- data/lib/devise/orm/mongoid.rb +6 -2
- data/lib/devise/parameter_filter.rb +4 -0
- data/lib/devise/parameter_sanitizer.rb +139 -65
- data/lib/devise/rails/deprecated_constant_accessor.rb +39 -0
- data/lib/devise/rails/routes.rb +151 -120
- data/lib/devise/rails/warden_compat.rb +3 -10
- data/lib/devise/rails.rb +10 -13
- data/lib/devise/secret_key_finder.rb +27 -0
- data/lib/devise/strategies/authenticatable.rb +21 -10
- data/lib/devise/strategies/base.rb +3 -1
- data/lib/devise/strategies/database_authenticatable.rb +14 -6
- data/lib/devise/strategies/rememberable.rb +15 -3
- data/lib/devise/test/controller_helpers.rb +167 -0
- data/lib/devise/test/integration_helpers.rb +63 -0
- data/lib/devise/test_helpers.rb +7 -124
- data/lib/devise/time_inflector.rb +4 -2
- data/lib/devise/token_generator.rb +3 -41
- data/lib/devise/version.rb +3 -1
- data/lib/devise.rb +107 -84
- data/lib/generators/active_record/devise_generator.rb +64 -12
- data/lib/generators/active_record/templates/migration.rb +9 -7
- data/lib/generators/active_record/templates/migration_existing.rb +9 -7
- data/lib/generators/devise/controllers_generator.rb +46 -0
- data/lib/generators/devise/devise_generator.rb +8 -6
- data/lib/generators/devise/install_generator.rb +18 -1
- data/lib/generators/devise/orm_helpers.rb +10 -21
- data/lib/generators/devise/views_generator.rb +49 -28
- data/lib/generators/mongoid/devise_generator.rb +21 -19
- data/lib/generators/templates/README +13 -12
- data/lib/generators/templates/controllers/README +14 -0
- data/lib/generators/templates/controllers/confirmations_controller.rb +30 -0
- data/lib/generators/templates/controllers/omniauth_callbacks_controller.rb +30 -0
- data/lib/generators/templates/controllers/passwords_controller.rb +34 -0
- data/lib/generators/templates/controllers/registrations_controller.rb +62 -0
- data/lib/generators/templates/controllers/sessions_controller.rb +27 -0
- data/lib/generators/templates/controllers/unlocks_controller.rb +30 -0
- data/lib/generators/templates/devise.rb +94 -37
- data/lib/generators/templates/markerb/confirmation_instructions.markerb +1 -1
- data/lib/generators/templates/markerb/email_changed.markerb +7 -0
- data/lib/generators/templates/markerb/password_change.markerb +3 -0
- data/lib/generators/templates/markerb/reset_password_instructions.markerb +1 -1
- data/lib/generators/templates/markerb/unlock_instructions.markerb +1 -1
- data/lib/generators/templates/simple_form_for/confirmations/new.html.erb +6 -2
- data/lib/generators/templates/simple_form_for/passwords/edit.html.erb +12 -4
- data/lib/generators/templates/simple_form_for/passwords/new.html.erb +5 -2
- data/lib/generators/templates/simple_form_for/registrations/edit.html.erb +14 -6
- data/lib/generators/templates/simple_form_for/registrations/new.html.erb +12 -4
- data/lib/generators/templates/simple_form_for/sessions/new.html.erb +11 -6
- data/lib/generators/templates/simple_form_for/unlocks/new.html.erb +5 -2
- metadata +50 -284
- data/.gitignore +0 -10
- data/.travis.yml +0 -20
- data/.yardopts +0 -9
- data/CONTRIBUTING.md +0 -14
- data/Gemfile +0 -31
- data/Gemfile.lock +0 -160
- data/Rakefile +0 -35
- data/devise.gemspec +0 -27
- data/devise.png +0 -0
- data/gemfiles/Gemfile.rails-3.2.x +0 -31
- data/gemfiles/Gemfile.rails-3.2.x.lock +0 -159
- data/test/controllers/custom_strategy_test.rb +0 -62
- data/test/controllers/helpers_test.rb +0 -276
- data/test/controllers/internal_helpers_test.rb +0 -120
- data/test/controllers/passwords_controller_test.rb +0 -31
- data/test/controllers/sessions_controller_test.rb +0 -99
- data/test/controllers/url_helpers_test.rb +0 -59
- data/test/delegator_test.rb +0 -19
- data/test/devise_test.rb +0 -94
- data/test/failure_app_test.rb +0 -232
- data/test/generators/active_record_generator_test.rb +0 -103
- data/test/generators/devise_generator_test.rb +0 -39
- data/test/generators/install_generator_test.rb +0 -13
- data/test/generators/mongoid_generator_test.rb +0 -23
- data/test/generators/views_generator_test.rb +0 -67
- data/test/helpers/devise_helper_test.rb +0 -51
- data/test/integration/authenticatable_test.rb +0 -713
- data/test/integration/confirmable_test.rb +0 -284
- data/test/integration/database_authenticatable_test.rb +0 -84
- data/test/integration/http_authenticatable_test.rb +0 -105
- data/test/integration/lockable_test.rb +0 -239
- data/test/integration/omniauthable_test.rb +0 -133
- data/test/integration/recoverable_test.rb +0 -334
- data/test/integration/registerable_test.rb +0 -349
- data/test/integration/rememberable_test.rb +0 -167
- data/test/integration/timeoutable_test.rb +0 -183
- data/test/integration/trackable_test.rb +0 -92
- data/test/mailers/confirmation_instructions_test.rb +0 -115
- data/test/mailers/reset_password_instructions_test.rb +0 -96
- data/test/mailers/unlock_instructions_test.rb +0 -91
- data/test/mapping_test.rb +0 -127
- data/test/models/authenticatable_test.rb +0 -13
- data/test/models/confirmable_test.rb +0 -454
- data/test/models/database_authenticatable_test.rb +0 -249
- data/test/models/lockable_test.rb +0 -298
- data/test/models/omniauthable_test.rb +0 -7
- data/test/models/recoverable_test.rb +0 -184
- data/test/models/registerable_test.rb +0 -7
- data/test/models/rememberable_test.rb +0 -183
- data/test/models/serializable_test.rb +0 -49
- data/test/models/timeoutable_test.rb +0 -51
- data/test/models/trackable_test.rb +0 -13
- data/test/models/validatable_test.rb +0 -127
- data/test/models_test.rb +0 -144
- data/test/omniauth/config_test.rb +0 -57
- data/test/omniauth/url_helpers_test.rb +0 -54
- data/test/orm/active_record.rb +0 -10
- data/test/orm/mongoid.rb +0 -13
- data/test/parameter_sanitizer_test.rb +0 -81
- data/test/rails_app/Rakefile +0 -6
- data/test/rails_app/app/active_record/admin.rb +0 -6
- data/test/rails_app/app/active_record/shim.rb +0 -2
- data/test/rails_app/app/active_record/user.rb +0 -6
- data/test/rails_app/app/controllers/admins/sessions_controller.rb +0 -6
- data/test/rails_app/app/controllers/admins_controller.rb +0 -11
- data/test/rails_app/app/controllers/application_controller.rb +0 -9
- data/test/rails_app/app/controllers/home_controller.rb +0 -25
- data/test/rails_app/app/controllers/publisher/registrations_controller.rb +0 -2
- data/test/rails_app/app/controllers/publisher/sessions_controller.rb +0 -2
- data/test/rails_app/app/controllers/users/omniauth_callbacks_controller.rb +0 -14
- data/test/rails_app/app/controllers/users_controller.rb +0 -31
- data/test/rails_app/app/helpers/application_helper.rb +0 -3
- data/test/rails_app/app/mailers/users/mailer.rb +0 -12
- data/test/rails_app/app/mongoid/admin.rb +0 -29
- data/test/rails_app/app/mongoid/shim.rb +0 -23
- data/test/rails_app/app/mongoid/user.rb +0 -39
- data/test/rails_app/app/views/admins/index.html.erb +0 -1
- data/test/rails_app/app/views/admins/sessions/new.html.erb +0 -2
- data/test/rails_app/app/views/home/admin_dashboard.html.erb +0 -1
- data/test/rails_app/app/views/home/index.html.erb +0 -1
- data/test/rails_app/app/views/home/join.html.erb +0 -1
- data/test/rails_app/app/views/home/private.html.erb +0 -1
- data/test/rails_app/app/views/home/user_dashboard.html.erb +0 -1
- data/test/rails_app/app/views/layouts/application.html.erb +0 -24
- data/test/rails_app/app/views/users/edit_form.html.erb +0 -1
- data/test/rails_app/app/views/users/index.html.erb +0 -1
- data/test/rails_app/app/views/users/mailer/confirmation_instructions.erb +0 -1
- data/test/rails_app/app/views/users/sessions/new.html.erb +0 -1
- data/test/rails_app/bin/bundle +0 -3
- data/test/rails_app/bin/rails +0 -4
- data/test/rails_app/bin/rake +0 -4
- data/test/rails_app/config/application.rb +0 -40
- data/test/rails_app/config/boot.rb +0 -14
- data/test/rails_app/config/database.yml +0 -18
- data/test/rails_app/config/environment.rb +0 -5
- data/test/rails_app/config/environments/development.rb +0 -30
- data/test/rails_app/config/environments/production.rb +0 -80
- data/test/rails_app/config/environments/test.rb +0 -36
- data/test/rails_app/config/initializers/backtrace_silencers.rb +0 -7
- data/test/rails_app/config/initializers/devise.rb +0 -181
- data/test/rails_app/config/initializers/inflections.rb +0 -2
- data/test/rails_app/config/initializers/secret_token.rb +0 -8
- data/test/rails_app/config/initializers/session_store.rb +0 -1
- data/test/rails_app/config/routes.rb +0 -104
- data/test/rails_app/config.ru +0 -4
- data/test/rails_app/db/migrate/20100401102949_create_tables.rb +0 -71
- data/test/rails_app/db/schema.rb +0 -55
- data/test/rails_app/lib/shared_admin.rb +0 -17
- data/test/rails_app/lib/shared_user.rb +0 -29
- data/test/rails_app/public/404.html +0 -26
- data/test/rails_app/public/422.html +0 -26
- data/test/rails_app/public/500.html +0 -26
- data/test/rails_app/public/favicon.ico +0 -0
- data/test/routes_test.rb +0 -250
- data/test/support/assertions.rb +0 -40
- data/test/support/helpers.rb +0 -70
- data/test/support/integration.rb +0 -92
- data/test/support/locale/en.yml +0 -8
- data/test/support/webrat/integrations/rails.rb +0 -24
- data/test/test_helper.rb +0 -27
- data/test/test_helpers_test.rb +0 -173
- data/test/test_models.rb +0 -33
data/lib/devise/rails/routes.rb
CHANGED
@@ -1,13 +1,12 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
1
3
|
require "active_support/core_ext/object/try"
|
2
4
|
require "active_support/core_ext/hash/slice"
|
3
5
|
|
4
|
-
module
|
5
|
-
|
6
|
-
|
7
|
-
|
8
|
-
def finalize_with_devise!
|
9
|
-
result = finalize_without_devise!
|
10
|
-
|
6
|
+
module Devise
|
7
|
+
module RouteSet
|
8
|
+
def finalize!
|
9
|
+
result = super
|
11
10
|
@devise_finalized ||= begin
|
12
11
|
if Devise.router_name.nil? && defined?(@devise_finalized) && self != Rails.application.try(:routes)
|
13
12
|
warn "[DEVISE] We have detected that you are using devise_for inside engine routes. " \
|
@@ -21,10 +20,16 @@ module ActionDispatch::Routing
|
|
21
20
|
Devise.regenerate_helpers!
|
22
21
|
true
|
23
22
|
end
|
24
|
-
|
25
23
|
result
|
26
24
|
end
|
27
|
-
|
25
|
+
end
|
26
|
+
end
|
27
|
+
|
28
|
+
module ActionDispatch::Routing
|
29
|
+
class RouteSet #:nodoc:
|
30
|
+
# Ensure Devise modules are included only after loading routes, because we
|
31
|
+
# need devise_for mappings already declared to create filters and helpers.
|
32
|
+
prepend Devise::RouteSet
|
28
33
|
end
|
29
34
|
|
30
35
|
class Mapper
|
@@ -43,20 +48,20 @@ module ActionDispatch::Routing
|
|
43
48
|
# needed routes:
|
44
49
|
#
|
45
50
|
# # Session routes for Authenticatable (default)
|
46
|
-
# new_user_session GET /users/sign_in {:
|
47
|
-
# user_session POST /users/sign_in {:
|
48
|
-
# destroy_user_session DELETE /users/sign_out {:
|
51
|
+
# new_user_session GET /users/sign_in {controller:"devise/sessions", action:"new"}
|
52
|
+
# user_session POST /users/sign_in {controller:"devise/sessions", action:"create"}
|
53
|
+
# destroy_user_session DELETE /users/sign_out {controller:"devise/sessions", action:"destroy"}
|
49
54
|
#
|
50
55
|
# # Password routes for Recoverable, if User model has :recoverable configured
|
51
|
-
# new_user_password GET /users/password/new(.:format) {:
|
52
|
-
# edit_user_password GET /users/password/edit(.:format) {:
|
53
|
-
# user_password PUT /users/password(.:format) {:
|
54
|
-
# POST /users/password(.:format) {:
|
56
|
+
# new_user_password GET /users/password/new(.:format) {controller:"devise/passwords", action:"new"}
|
57
|
+
# edit_user_password GET /users/password/edit(.:format) {controller:"devise/passwords", action:"edit"}
|
58
|
+
# user_password PUT /users/password(.:format) {controller:"devise/passwords", action:"update"}
|
59
|
+
# POST /users/password(.:format) {controller:"devise/passwords", action:"create"}
|
55
60
|
#
|
56
61
|
# # Confirmation routes for Confirmable, if User model has :confirmable configured
|
57
|
-
# new_user_confirmation GET /users/confirmation/new(.:format) {:
|
58
|
-
# user_confirmation GET /users/confirmation(.:format) {:
|
59
|
-
# POST /users/confirmation(.:format) {:
|
62
|
+
# new_user_confirmation GET /users/confirmation/new(.:format) {controller:"devise/confirmations", action:"new"}
|
63
|
+
# user_confirmation GET /users/confirmation(.:format) {controller:"devise/confirmations", action:"show"}
|
64
|
+
# POST /users/confirmation(.:format) {controller:"devise/confirmations", action:"create"}
|
60
65
|
#
|
61
66
|
# ==== Routes integration
|
62
67
|
#
|
@@ -84,71 +89,91 @@ module ActionDispatch::Routing
|
|
84
89
|
#
|
85
90
|
# You can configure your routes with some options:
|
86
91
|
#
|
87
|
-
# * :
|
92
|
+
# * class_name: set up a different class to be looked up by devise, if it cannot be
|
88
93
|
# properly found by the route name.
|
89
94
|
#
|
90
|
-
# devise_for :users, :
|
95
|
+
# devise_for :users, class_name: 'Account'
|
96
|
+
#
|
97
|
+
# * path: allows you to set up path name that will be used, as rails routes does.
|
98
|
+
# The following route configuration would set up your route as /accounts instead of /users:
|
99
|
+
#
|
100
|
+
# devise_for :users, path: 'accounts'
|
101
|
+
#
|
102
|
+
# * singular: set up the singular name for the given resource. This is used as the helper methods
|
103
|
+
# names in controller ("authenticate_#{singular}!", "#{singular}_signed_in?", "current_#{singular}"
|
104
|
+
# and "#{singular}_session"), as the scope name in routes and as the scope given to warden.
|
91
105
|
#
|
92
|
-
#
|
93
|
-
# The following route configuration would setup your route as /accounts instead of /users:
|
106
|
+
# devise_for :admins, singular: :manager
|
94
107
|
#
|
95
|
-
#
|
108
|
+
# devise_scope :manager do
|
109
|
+
# ...
|
110
|
+
# end
|
96
111
|
#
|
97
|
-
#
|
98
|
-
#
|
112
|
+
# class ManagerController < ApplicationController
|
113
|
+
# before_action authenticate_manager!
|
99
114
|
#
|
100
|
-
#
|
115
|
+
# def show
|
116
|
+
# @manager = current_manager
|
117
|
+
# ...
|
118
|
+
# end
|
119
|
+
# end
|
101
120
|
#
|
102
|
-
# * :
|
121
|
+
# * path_names: configure different path names to overwrite defaults :sign_in, :sign_out, :sign_up,
|
103
122
|
# :password, :confirmation, :unlock.
|
104
123
|
#
|
105
|
-
# devise_for :users, :
|
106
|
-
# :
|
124
|
+
# devise_for :users, path_names: {
|
125
|
+
# sign_in: 'login', sign_out: 'logout',
|
126
|
+
# password: 'secret', confirmation: 'verification',
|
127
|
+
# registration: 'register', edit: 'edit/profile'
|
128
|
+
# }
|
107
129
|
#
|
108
|
-
# * :
|
130
|
+
# * controllers: the controller which should be used. All routes by default points to Devise controllers.
|
109
131
|
# However, if you want them to point to custom controller, you should do:
|
110
132
|
#
|
111
|
-
# devise_for :users, :
|
133
|
+
# devise_for :users, controllers: { sessions: "users/sessions" }
|
112
134
|
#
|
113
|
-
# * :
|
135
|
+
# * failure_app: a rack app which is invoked whenever there is a failure. Strings representing a given
|
114
136
|
# are also allowed as parameter.
|
115
137
|
#
|
116
|
-
# * :
|
138
|
+
# * sign_out_via: the HTTP method(s) accepted for the :sign_out action (default: :delete),
|
117
139
|
# if you wish to restrict this to accept only :post or :delete requests you should do:
|
118
140
|
#
|
119
|
-
# devise_for :users, :
|
141
|
+
# devise_for :users, sign_out_via: [:get, :post]
|
120
142
|
#
|
121
143
|
# You need to make sure that your sign_out controls trigger a request with a matching HTTP method.
|
122
144
|
#
|
123
|
-
# * :
|
145
|
+
# * module: the namespace to find controllers (default: "devise", thus
|
124
146
|
# accessing devise/sessions, devise/registrations, and so on). If you want
|
125
147
|
# to namespace all at once, use module:
|
126
148
|
#
|
127
|
-
# devise_for :users, :
|
149
|
+
# devise_for :users, module: "users"
|
128
150
|
#
|
129
|
-
# * :
|
151
|
+
# * skip: tell which controller you want to skip routes from being created.
|
152
|
+
# It accepts :all as an option, meaning it will not generate any route at all:
|
130
153
|
#
|
131
|
-
# devise_for :users, :
|
154
|
+
# devise_for :users, skip: :sessions
|
132
155
|
#
|
133
|
-
# * :
|
156
|
+
# * only: the opposite of :skip, tell which controllers only to generate routes to:
|
134
157
|
#
|
135
|
-
# devise_for :users, :
|
158
|
+
# devise_for :users, only: :sessions
|
136
159
|
#
|
137
|
-
# * :
|
160
|
+
# * skip_helpers: skip generating Devise url helpers like new_session_path(@user).
|
138
161
|
# This is useful to avoid conflicts with previous routes and is false by default.
|
139
162
|
# It accepts true as option, meaning it will skip all the helpers for the controllers
|
140
163
|
# given in :skip but it also accepts specific helpers to be skipped:
|
141
164
|
#
|
142
|
-
# devise_for :users, :
|
143
|
-
# devise_for :users, :
|
165
|
+
# devise_for :users, skip: [:registrations, :confirmations], skip_helpers: true
|
166
|
+
# devise_for :users, skip_helpers: [:registrations, :confirmations]
|
167
|
+
#
|
168
|
+
# * format: include "(.:format)" in the generated routes? true by default, set to false to disable:
|
144
169
|
#
|
145
|
-
#
|
170
|
+
# devise_for :users, format: false
|
146
171
|
#
|
147
|
-
#
|
172
|
+
# * constraints: works the same as Rails' constraints
|
148
173
|
#
|
149
|
-
# * :
|
174
|
+
# * defaults: works the same as Rails' defaults
|
150
175
|
#
|
151
|
-
# * :
|
176
|
+
# * router_name: allows application level router name to be overwritten for the current scope
|
152
177
|
#
|
153
178
|
# ==== Scoping
|
154
179
|
#
|
@@ -170,7 +195,7 @@ module ActionDispatch::Routing
|
|
170
195
|
#
|
171
196
|
# class ApplicationController < ActionController::Base
|
172
197
|
# def self.default_url_options
|
173
|
-
# { :
|
198
|
+
# { locale: I18n.locale }
|
174
199
|
# end
|
175
200
|
# end
|
176
201
|
#
|
@@ -195,7 +220,7 @@ module ActionDispatch::Routing
|
|
195
220
|
# In order to get Devise to recognize the deactivate action, your devise_scope entry should look like this:
|
196
221
|
#
|
197
222
|
# devise_scope :owner do
|
198
|
-
# post "deactivate", :
|
223
|
+
# post "deactivate", to: "registrations#deactivate", as: "deactivate_registration"
|
199
224
|
# end
|
200
225
|
#
|
201
226
|
def devise_for(*resources)
|
@@ -221,7 +246,7 @@ module ActionDispatch::Routing
|
|
221
246
|
raise_no_devise_method_error!(mapping.class_name) unless mapping.to.respond_to?(:devise)
|
222
247
|
rescue NameError => e
|
223
248
|
raise unless mapping.class_name == resource.to_s.classify
|
224
|
-
warn "[WARNING] You provided devise_for #{resource.inspect} but there is "
|
249
|
+
warn "[WARNING] You provided devise_for #{resource.inspect} but there is " \
|
225
250
|
"no model #{mapping.class_name} defined in your application"
|
226
251
|
next
|
227
252
|
rescue NoMethodError => e
|
@@ -229,7 +254,14 @@ module ActionDispatch::Routing
|
|
229
254
|
raise_no_devise_method_error!(mapping.class_name)
|
230
255
|
end
|
231
256
|
|
232
|
-
|
257
|
+
if options[:controllers] && options[:controllers][:omniauth_callbacks]
|
258
|
+
unless mapping.omniauthable?
|
259
|
+
raise ArgumentError, "Mapping omniauth_callbacks on a resource that is not omniauthable\n" \
|
260
|
+
"Please add `devise :omniauthable` to the `#{mapping.class_name}` model"
|
261
|
+
end
|
262
|
+
end
|
263
|
+
|
264
|
+
routes = mapping.used_routes
|
233
265
|
|
234
266
|
devise_scope mapping.name do
|
235
267
|
with_devise_exclusive_scope mapping.fullpath, mapping.name, options do
|
@@ -252,10 +284,10 @@ module ActionDispatch::Routing
|
|
252
284
|
# end
|
253
285
|
#
|
254
286
|
# authenticate :user, lambda {|u| u.role == "admin"} do
|
255
|
-
# root :
|
287
|
+
# root to: "admin/dashboard#show", as: :user_root
|
256
288
|
# end
|
257
289
|
#
|
258
|
-
def authenticate(scope=nil, block=nil)
|
290
|
+
def authenticate(scope = nil, block = nil)
|
259
291
|
constraints_for(:authenticate!, scope, block) do
|
260
292
|
yield
|
261
293
|
end
|
@@ -266,20 +298,20 @@ module ActionDispatch::Routing
|
|
266
298
|
# a model and allows extra constraints to be done on the instance.
|
267
299
|
#
|
268
300
|
# authenticated :admin do
|
269
|
-
# root :
|
301
|
+
# root to: 'admin/dashboard#show', as: :admin_root
|
270
302
|
# end
|
271
303
|
#
|
272
304
|
# authenticated do
|
273
|
-
# root :
|
305
|
+
# root to: 'dashboard#show', as: :authenticated_root
|
274
306
|
# end
|
275
307
|
#
|
276
308
|
# authenticated :user, lambda {|u| u.role == "admin"} do
|
277
|
-
# root :
|
309
|
+
# root to: "admin/dashboard#show", as: :user_root
|
278
310
|
# end
|
279
311
|
#
|
280
|
-
# root :
|
312
|
+
# root to: 'landing#show'
|
281
313
|
#
|
282
|
-
def authenticated(scope=nil, block=nil)
|
314
|
+
def authenticated(scope = nil, block = nil)
|
283
315
|
constraints_for(:authenticate?, scope, block) do
|
284
316
|
yield
|
285
317
|
end
|
@@ -290,15 +322,15 @@ module ActionDispatch::Routing
|
|
290
322
|
#
|
291
323
|
# unauthenticated do
|
292
324
|
# as :user do
|
293
|
-
# root :
|
325
|
+
# root to: 'devise/registrations#new'
|
294
326
|
# end
|
295
327
|
# end
|
296
328
|
#
|
297
|
-
# root :
|
329
|
+
# root to: 'dashboard#show'
|
298
330
|
#
|
299
|
-
def unauthenticated(scope=nil)
|
331
|
+
def unauthenticated(scope = nil)
|
300
332
|
constraint = lambda do |request|
|
301
|
-
not request.env["warden"].authenticate? :
|
333
|
+
not request.env["warden"].authenticate? scope: scope
|
302
334
|
end
|
303
335
|
|
304
336
|
constraints(constraint) do
|
@@ -308,10 +340,10 @@ module ActionDispatch::Routing
|
|
308
340
|
|
309
341
|
# Sets the devise scope to be used in the controller. If you have custom routes,
|
310
342
|
# you are required to call this method (also aliased as :as) in order to specify
|
311
|
-
# to which controller it is
|
343
|
+
# to which controller it is targeted.
|
312
344
|
#
|
313
345
|
# as :user do
|
314
|
-
# get "sign_in", :
|
346
|
+
# get "sign_in", to: "devise/sessions#new"
|
315
347
|
# end
|
316
348
|
#
|
317
349
|
# Notice you cannot have two scopes mapping to the same URL. And remember, if
|
@@ -343,41 +375,42 @@ module ActionDispatch::Routing
|
|
343
375
|
protected
|
344
376
|
|
345
377
|
def devise_session(mapping, controllers) #:nodoc:
|
346
|
-
resource :session, :
|
347
|
-
get :new, :
|
348
|
-
post :create, :
|
349
|
-
match :destroy, :
|
378
|
+
resource :session, only: [], controller: controllers[:sessions], path: "" do
|
379
|
+
get :new, path: mapping.path_names[:sign_in], as: "new"
|
380
|
+
post :create, path: mapping.path_names[:sign_in]
|
381
|
+
match :destroy, path: mapping.path_names[:sign_out], as: "destroy", via: mapping.sign_out_via
|
350
382
|
end
|
351
383
|
end
|
352
384
|
|
353
385
|
def devise_password(mapping, controllers) #:nodoc:
|
354
|
-
resource :password, :
|
355
|
-
:
|
386
|
+
resource :password, only: [:new, :create, :edit, :update],
|
387
|
+
path: mapping.path_names[:password], controller: controllers[:passwords]
|
356
388
|
end
|
357
389
|
|
358
390
|
def devise_confirmation(mapping, controllers) #:nodoc:
|
359
|
-
resource :confirmation, :
|
360
|
-
:
|
391
|
+
resource :confirmation, only: [:new, :create, :show],
|
392
|
+
path: mapping.path_names[:confirmation], controller: controllers[:confirmations]
|
361
393
|
end
|
362
394
|
|
363
395
|
def devise_unlock(mapping, controllers) #:nodoc:
|
364
396
|
if mapping.to.unlock_strategy_enabled?(:email)
|
365
|
-
resource :unlock, :
|
366
|
-
:
|
397
|
+
resource :unlock, only: [:new, :create, :show],
|
398
|
+
path: mapping.path_names[:unlock], controller: controllers[:unlocks]
|
367
399
|
end
|
368
400
|
end
|
369
401
|
|
370
402
|
def devise_registration(mapping, controllers) #:nodoc:
|
371
403
|
path_names = {
|
372
|
-
:
|
373
|
-
:
|
404
|
+
new: mapping.path_names[:sign_up],
|
405
|
+
edit: mapping.path_names[:edit],
|
406
|
+
cancel: mapping.path_names[:cancel]
|
374
407
|
}
|
375
408
|
|
376
409
|
options = {
|
377
|
-
:
|
378
|
-
:
|
379
|
-
:
|
380
|
-
:
|
410
|
+
only: [:new, :create, :edit, :update, :destroy],
|
411
|
+
path: mapping.path_names[:registration],
|
412
|
+
path_names: path_names,
|
413
|
+
controller: controllers[:registrations]
|
381
414
|
}
|
382
415
|
|
383
416
|
resource :registration, options do
|
@@ -388,64 +421,62 @@ module ActionDispatch::Routing
|
|
388
421
|
def devise_omniauth_callback(mapping, controllers) #:nodoc:
|
389
422
|
if mapping.fullpath =~ /:[a-zA-Z_]/
|
390
423
|
raise <<-ERROR
|
391
|
-
Devise does not support scoping
|
424
|
+
Devise does not support scoping OmniAuth callbacks under a dynamic segment
|
392
425
|
and you have set #{mapping.fullpath.inspect}. You can work around by passing
|
393
|
-
`skip: :omniauth_callbacks`
|
394
|
-
|
395
|
-
|
396
|
-
|
397
|
-
|
398
|
-
|
399
|
-
|
400
|
-
|
401
|
-
match "/users/auth/:action/callback",
|
402
|
-
:constraints => { :action => /\A(google|facebook)\z/ },
|
403
|
-
:to => "devise/omniauth_callbacks",
|
404
|
-
:as => :omniauth_callback,
|
405
|
-
:via => [:get, :post]
|
426
|
+
`skip: :omniauth_callbacks` to the `devise_for` call and extract omniauth
|
427
|
+
options to another `devise_for` call outside the scope. Here is an example:
|
428
|
+
|
429
|
+
devise_for :users, only: :omniauth_callbacks, controllers: {omniauth_callbacks: 'users/omniauth_callbacks'}
|
430
|
+
|
431
|
+
scope '/(:locale)', locale: /ru|en/ do
|
432
|
+
devise_for :users, skip: :omniauth_callbacks
|
433
|
+
end
|
406
434
|
ERROR
|
407
435
|
end
|
408
|
-
|
409
|
-
|
436
|
+
current_scope = @scope.dup
|
437
|
+
if @scope.respond_to? :new
|
438
|
+
@scope = @scope.new path: nil
|
439
|
+
else
|
440
|
+
@scope[:path] = nil
|
441
|
+
end
|
410
442
|
path_prefix = Devise.omniauth_path_prefix || "/#{mapping.fullpath}/auth".squeeze("/")
|
411
443
|
|
412
444
|
set_omniauth_path_prefix!(path_prefix)
|
413
445
|
|
414
|
-
|
415
|
-
|
416
|
-
|
417
|
-
|
418
|
-
|
419
|
-
:as => :omniauth_authorize,
|
420
|
-
:via => [:get, :post]
|
446
|
+
mapping.to.omniauth_providers.each do |provider|
|
447
|
+
match "#{path_prefix}/#{provider}",
|
448
|
+
to: "#{controllers[:omniauth_callbacks]}#passthru",
|
449
|
+
as: "#{provider}_omniauth_authorize",
|
450
|
+
via: [:get, :post]
|
421
451
|
|
422
|
-
|
423
|
-
|
424
|
-
|
425
|
-
|
426
|
-
|
452
|
+
match "#{path_prefix}/#{provider}/callback",
|
453
|
+
to: "#{controllers[:omniauth_callbacks]}##{provider}",
|
454
|
+
as: "#{provider}_omniauth_callback",
|
455
|
+
via: [:get, :post]
|
456
|
+
end
|
427
457
|
ensure
|
428
|
-
@scope
|
458
|
+
@scope = current_scope
|
429
459
|
end
|
430
460
|
|
431
|
-
DEVISE_SCOPE_KEYS = [:as, :path, :module, :constraints, :defaults, :options]
|
432
|
-
|
433
461
|
def with_devise_exclusive_scope(new_path, new_as, options) #:nodoc:
|
434
|
-
|
435
|
-
DEVISE_SCOPE_KEYS.each { |k| old[k] = @scope[k] }
|
462
|
+
current_scope = @scope.dup
|
436
463
|
|
437
|
-
|
438
|
-
|
464
|
+
exclusive = { as: new_as, path: new_path, module: nil }
|
465
|
+
exclusive.merge!(options.slice(:constraints, :defaults, :options))
|
439
466
|
|
440
|
-
@scope.
|
467
|
+
if @scope.respond_to? :new
|
468
|
+
@scope = @scope.new exclusive
|
469
|
+
else
|
470
|
+
exclusive.each_pair { |key, value| @scope[key] = value }
|
471
|
+
end
|
441
472
|
yield
|
442
473
|
ensure
|
443
|
-
@scope
|
474
|
+
@scope = current_scope
|
444
475
|
end
|
445
476
|
|
446
|
-
def constraints_for(method_to_apply, scope=nil, block=nil)
|
477
|
+
def constraints_for(method_to_apply, scope = nil, block = nil)
|
447
478
|
constraint = lambda do |request|
|
448
|
-
request.env['warden'].send(method_to_apply, :
|
479
|
+
request.env['warden'].send(method_to_apply, scope: scope) &&
|
449
480
|
(block.nil? || block.call(request.env["warden"].user(scope)))
|
450
481
|
end
|
451
482
|
|
@@ -1,19 +1,12 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
1
3
|
module Warden::Mixins::Common
|
2
4
|
def request
|
3
5
|
@request ||= ActionDispatch::Request.new(env)
|
4
6
|
end
|
5
7
|
|
6
|
-
# Deprecate: Remove this check once we move to Rails 4 only.
|
7
|
-
NULL_STORE =
|
8
|
-
defined?(ActionController::RequestForgeryProtection::ProtectionMethods::NullSession::NullSessionHash) ?
|
9
|
-
ActionController::RequestForgeryProtection::ProtectionMethods::NullSession::NullSessionHash : nil
|
10
|
-
|
11
8
|
def reset_session!
|
12
|
-
|
13
|
-
# This is a bug that needs to be fixed in Rails.
|
14
|
-
unless NULL_STORE && request.session.is_a?(NULL_STORE)
|
15
|
-
request.reset_session
|
16
|
-
end
|
9
|
+
request.reset_session
|
17
10
|
end
|
18
11
|
|
19
12
|
def cookies
|
data/lib/devise/rails.rb
CHANGED
@@ -1,3 +1,5 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
1
3
|
require 'devise/rails/routes'
|
2
4
|
require 'devise/rails/warden_compat'
|
3
5
|
|
@@ -11,13 +13,15 @@ module Devise
|
|
11
13
|
end
|
12
14
|
|
13
15
|
# Force routes to be loaded if we are doing any eager load.
|
14
|
-
config.before_eager_load
|
16
|
+
config.before_eager_load do |app|
|
17
|
+
app.reload_routes! if Devise.reload_routes
|
18
|
+
end
|
15
19
|
|
16
20
|
initializer "devise.url_helpers" do
|
17
21
|
Devise.include_helpers(Devise::Controllers)
|
18
22
|
end
|
19
23
|
|
20
|
-
initializer "devise.omniauth" do |app|
|
24
|
+
initializer "devise.omniauth", after: :load_config_initializers, before: :build_middleware_stack do |app|
|
21
25
|
Devise.omniauth_configs.each do |provider, config|
|
22
26
|
app.middleware.use config.strategy_class, *config.args do |strategy|
|
23
27
|
config.strategy = strategy
|
@@ -29,22 +33,15 @@ module Devise
|
|
29
33
|
end
|
30
34
|
end
|
31
35
|
|
32
|
-
initializer "devise.secret_key" do
|
36
|
+
initializer "devise.secret_key" do |app|
|
37
|
+
Devise.secret_key ||= Devise::SecretKeyFinder.new(app).find
|
38
|
+
|
33
39
|
Devise.token_generator ||=
|
34
40
|
if secret_key = Devise.secret_key
|
35
41
|
Devise::TokenGenerator.new(
|
36
|
-
|
42
|
+
ActiveSupport::CachingKeyGenerator.new(ActiveSupport::KeyGenerator.new(secret_key))
|
37
43
|
)
|
38
44
|
end
|
39
45
|
end
|
40
|
-
|
41
|
-
initializer "devise.fix_routes_proxy_missing_respond_to_bug" do
|
42
|
-
# Deprecate: Remove once we move to Rails 4 only.
|
43
|
-
ActionDispatch::Routing::RoutesProxy.class_eval do
|
44
|
-
def respond_to?(method, include_private = false)
|
45
|
-
super || routes.url_helpers.respond_to?(method)
|
46
|
-
end
|
47
|
-
end
|
48
|
-
end
|
49
46
|
end
|
50
47
|
end
|
@@ -0,0 +1,27 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
module Devise
|
4
|
+
class SecretKeyFinder
|
5
|
+
def initialize(application)
|
6
|
+
@application = application
|
7
|
+
end
|
8
|
+
|
9
|
+
def find
|
10
|
+
if @application.respond_to?(:credentials) && key_exists?(@application.credentials)
|
11
|
+
@application.credentials.secret_key_base
|
12
|
+
elsif @application.respond_to?(:secrets) && key_exists?(@application.secrets)
|
13
|
+
@application.secrets.secret_key_base
|
14
|
+
elsif @application.config.respond_to?(:secret_key_base) && key_exists?(@application.config)
|
15
|
+
@application.config.secret_key_base
|
16
|
+
elsif @application.respond_to?(:secret_key_base) && key_exists?(@application)
|
17
|
+
@application.secret_key_base
|
18
|
+
end
|
19
|
+
end
|
20
|
+
|
21
|
+
private
|
22
|
+
|
23
|
+
def key_exists?(object)
|
24
|
+
object.secret_key_base.present?
|
25
|
+
end
|
26
|
+
end
|
27
|
+
end
|
@@ -1,3 +1,5 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
1
3
|
require 'devise/strategies/base'
|
2
4
|
|
3
5
|
module Devise
|
@@ -16,11 +18,18 @@ module Devise
|
|
16
18
|
valid_for_params_auth? || valid_for_http_auth?
|
17
19
|
end
|
18
20
|
|
21
|
+
# Override and set to false for things like OmniAuth that technically
|
22
|
+
# run through Authentication (user_set) very often, which would normally
|
23
|
+
# reset CSRF data in the session
|
24
|
+
def clean_up_csrf?
|
25
|
+
true
|
26
|
+
end
|
27
|
+
|
19
28
|
private
|
20
29
|
|
21
30
|
# Receives a resource and check if it is valid by calling valid_for_authentication?
|
22
|
-
#
|
23
|
-
# given as parameter. Check Devise::Models::
|
31
|
+
# A block that will be triggered while validating can be optionally
|
32
|
+
# given as parameter. Check Devise::Models::Authenticatable.valid_for_authentication?
|
24
33
|
# for more information.
|
25
34
|
#
|
26
35
|
# In case the resource can't be validated, it will fail with the given
|
@@ -29,7 +38,6 @@ module Devise
|
|
29
38
|
result = resource && resource.valid_for_authentication?(&block)
|
30
39
|
|
31
40
|
if result
|
32
|
-
decorate(resource)
|
33
41
|
true
|
34
42
|
else
|
35
43
|
if resource
|
@@ -40,7 +48,7 @@ module Devise
|
|
40
48
|
end
|
41
49
|
|
42
50
|
# Get values from params and set in the resource.
|
43
|
-
def
|
51
|
+
def remember_me(resource)
|
44
52
|
resource.remember_me = remember_me? if resource.respond_to?(:remember_me=)
|
45
53
|
end
|
46
54
|
|
@@ -49,9 +57,9 @@ module Devise
|
|
49
57
|
valid_params? && Devise::TRUE_VALUES.include?(params_auth_hash[:remember_me])
|
50
58
|
end
|
51
59
|
|
52
|
-
# Check if this is
|
60
|
+
# Check if this is a valid strategy for http authentication by:
|
53
61
|
#
|
54
|
-
# * Validating if the model allows
|
62
|
+
# * Validating if the model allows http authentication;
|
55
63
|
# * If any of the authorization headers were sent;
|
56
64
|
# * If all authentication keys are present;
|
57
65
|
#
|
@@ -59,7 +67,7 @@ module Devise
|
|
59
67
|
http_authenticatable? && request.authorization && with_authentication_hash(:http_auth, http_auth_hash)
|
60
68
|
end
|
61
69
|
|
62
|
-
# Check if this is
|
70
|
+
# Check if this is a valid strategy for params authentication by:
|
63
71
|
#
|
64
72
|
# * Validating if the model allows params authentication;
|
65
73
|
# * If the request hits the sessions controller through POST;
|
@@ -102,14 +110,17 @@ module Devise
|
|
102
110
|
params_auth_hash.is_a?(Hash)
|
103
111
|
end
|
104
112
|
|
105
|
-
#
|
113
|
+
# Note: unlike `Model.valid_password?`, this method does not actually
|
114
|
+
# ensure that the password in the params matches the password stored in
|
115
|
+
# the database. It only checks if the password is *present*. Do not rely
|
116
|
+
# on this method for validating that a given password is correct.
|
106
117
|
def valid_password?
|
107
|
-
password.present?
|
118
|
+
password.present?
|
108
119
|
end
|
109
120
|
|
110
121
|
# Helper to decode credentials from HTTP.
|
111
122
|
def decode_credentials
|
112
|
-
return [] unless request.authorization && request.authorization =~ /^Basic (.*)/
|
123
|
+
return [] unless request.authorization && request.authorization =~ /^Basic (.*)/mi
|
113
124
|
Base64.decode64($1).split(/:/, 2)
|
114
125
|
end
|
115
126
|
|