devise 3.5.1 → 4.8.0

data/lib/devise/rails/routes.rb

@@ -1,13 +1,12 @@
+# frozen_string_literal: true
+
 require "active_support/core_ext/object/try"
 require "active_support/core_ext/hash/slice"
 
-module ActionDispatch::Routing
-  class RouteSet #:nodoc:
-    # Ensure Devise modules are included only after loading routes, because we
-    # need devise_for mappings already declared to create filters and helpers.
-    def finalize_with_devise!
-      result = finalize_without_devise!
-
+module Devise
+  module RouteSet
+    def finalize!
+      result = super
       @devise_finalized ||= begin
         if Devise.router_name.nil? && defined?(@devise_finalized) && self != Rails.application.try(:routes)
           warn "[DEVISE] We have detected that you are using devise_for inside engine routes. " \
@@ -21,10 +20,16 @@ module ActionDispatch::Routing
         Devise.regenerate_helpers!
         true
       end
-
       result
     end
-    alias_method_chain :finalize!, :devise
+  end
+end
+
+module ActionDispatch::Routing
+  class RouteSet #:nodoc:
+    # Ensure Devise modules are included only after loading routes, because we
+    # need devise_for mappings already declared to create filters and helpers.
+    prepend Devise::RouteSet
   end
 
   class Mapper
@@ -84,20 +89,34 @@ module ActionDispatch::Routing
     #
     # You can configure your routes with some options:
     #
-    #  * class_name: setup a different class to be looked up by devise, if it cannot be
+    #  * class_name: set up a different class to be looked up by devise, if it cannot be
     #    properly found by the route name.
     #
     #      devise_for :users, class_name: 'Account'
     #
-    #  * path: allows you to setup path name that will be used, as rails routes does.
-    #    The following route configuration would setup your route as /accounts instead of /users:
+    #  * path: allows you to set up path name that will be used, as rails routes does.
+    #    The following route configuration would set up your route as /accounts instead of /users:
     #
     #      devise_for :users, path: 'accounts'
     #
-    #  * singular: setup the singular name for the given resource. This is used as the instance variable
-    #    name in controller, as the name in routes and the scope given to warden.
+    #  * singular: set up the singular name for the given resource. This is used as the helper methods
+    #    names in controller ("authenticate_#{singular}!", "#{singular}_signed_in?", "current_#{singular}"
+    #    and "#{singular}_session"), as the scope name in routes and as the scope given to warden.
     #
-    #      devise_for :users, singular: :user
+    #      devise_for :admins, singular: :manager
+    #
+    #      devise_scope :manager do
+    #        ...
+    #      end
+    #
+    #      class ManagerController < ApplicationController
+    #        before_action authenticate_manager!
+    #
+    #        def show
+    #          @manager = current_manager
+    #          ...
+    #        end
+    #      end
     #
     #  * path_names: configure different path names to overwrite defaults :sign_in, :sign_out, :sign_up,
     #    :password, :confirmation, :unlock.
@@ -116,10 +135,10 @@ module ActionDispatch::Routing
     #  * failure_app: a rack app which is invoked whenever there is a failure. Strings representing a given
     #    are also allowed as parameter.
     #
-    #  * sign_out_via: the HTTP method(s) accepted for the :sign_out action (default: :get),
+    #  * sign_out_via: the HTTP method(s) accepted for the :sign_out action (default: :delete),
     #    if you wish to restrict this to accept only :post or :delete requests you should do:
     #
-    #      devise_for :users, sign_out_via: [:post, :delete]
+    #      devise_for :users, sign_out_via: [:get, :post]
     #
     #    You need to make sure that your sign_out controls trigger a request with a matching HTTP method.
     #
@@ -268,7 +287,7 @@ module ActionDispatch::Routing
     #     root to: "admin/dashboard#show", as: :user_root
     #   end
     #
-    def authenticate(scope=nil, block=nil)
+    def authenticate(scope = nil, block = nil)
       constraints_for(:authenticate!, scope, block) do
         yield
       end
@@ -292,7 +311,7 @@ module ActionDispatch::Routing
     #
     #   root to: 'landing#show'
     #
-    def authenticated(scope=nil, block=nil)
+    def authenticated(scope = nil, block = nil)
       constraints_for(:authenticate?, scope, block) do
         yield
       end
@@ -309,7 +328,7 @@ module ActionDispatch::Routing
     #
     #   root to: 'dashboard#show'
     #
-    def unauthenticated(scope=nil)
+    def unauthenticated(scope = nil)
       constraint = lambda do |request|
         not request.env["warden"].authenticate? scope: scope
       end
@@ -321,7 +340,7 @@ module ActionDispatch::Routing
 
     # Sets the devise scope to be used in the controller. If you have custom routes,
     # you are required to call this method (also aliased as :as) in order to specify
-    # to which controller it is targetted.
+    # to which controller it is targeted.
     #
     #   as :user do
     #     get "sign_in", to: "devise/sessions#new"
@@ -404,42 +423,39 @@ module ActionDispatch::Routing
           raise <<-ERROR
 Devise does not support scoping OmniAuth callbacks under a dynamic segment
 and you have set #{mapping.fullpath.inspect}. You can work around by passing
-`skip: :omniauth_callbacks` and manually defining the routes. Here is an example:
-
-    match "/users/auth/:provider",
-      constraints: { provider: /google|facebook/ },
-      to: "devise/omniauth_callbacks#passthru",
-      as: :omniauth_authorize,
-      via: [:get, :post]
-
-    match "/users/auth/:action/callback",
-      constraints: { action: /google|facebook/ },
-      to: "devise/omniauth_callbacks#:action",
-      as: :omniauth_callback,
-      via: [:get, :post]
+`skip: :omniauth_callbacks` to the `devise_for` call and extract omniauth
+options to another `devise_for` call outside the scope. Here is an example:
+
+    devise_for :users, only: :omniauth_callbacks, controllers: {omniauth_callbacks: 'users/omniauth_callbacks'}
+
+    scope '/(:locale)', locale: /ru|en/ do
+      devise_for :users, skip: :omniauth_callbacks
+    end
 ERROR
         end
-
-        path, @scope[:path] = @scope[:path], nil
+        current_scope = @scope.dup
+        if @scope.respond_to? :new
+          @scope = @scope.new path: nil
+        else
+          @scope[:path] = nil
+        end
         path_prefix = Devise.omniauth_path_prefix || "/#{mapping.fullpath}/auth".squeeze("/")
 
         set_omniauth_path_prefix!(path_prefix)
 
-        providers = Regexp.union(mapping.to.omniauth_providers.map(&:to_s))
+        mapping.to.omniauth_providers.each do |provider|
+          match "#{path_prefix}/#{provider}",
+            to: "#{controllers[:omniauth_callbacks]}#passthru",
+            as: "#{provider}_omniauth_authorize",
+            via: [:get, :post]
 
-        match "#{path_prefix}/:provider",
-          constraints: { provider: providers },
-          to: "#{controllers[:omniauth_callbacks]}#passthru",
-          as: :omniauth_authorize,
-          via: [:get, :post]
-
-        match "#{path_prefix}/:action/callback",
-          constraints: { action: providers },
-          to: "#{controllers[:omniauth_callbacks]}#:action",
-          as: :omniauth_callback,
-          via: [:get, :post]
+          match "#{path_prefix}/#{provider}/callback",
+            to: "#{controllers[:omniauth_callbacks]}##{provider}",
+            as: "#{provider}_omniauth_callback",
+            via: [:get, :post]
+        end
       ensure
-        @scope[:path] = path
+        @scope = current_scope
       end
 
       def with_devise_exclusive_scope(new_path, new_as, options) #:nodoc:
@@ -448,13 +464,17 @@ ERROR
         exclusive = { as: new_as, path: new_path, module: nil }
         exclusive.merge!(options.slice(:constraints, :defaults, :options))
 
-        exclusive.each_pair { |key, value| @scope[key] = value }
+        if @scope.respond_to? :new
+          @scope = @scope.new exclusive
+        else
+          exclusive.each_pair { |key, value| @scope[key] = value }
+        end
         yield
       ensure
         @scope = current_scope
       end
 
-      def constraints_for(method_to_apply, scope=nil, block=nil)
+      def constraints_for(method_to_apply, scope = nil, block = nil)
         constraint = lambda do |request|
           request.env['warden'].send(method_to_apply, scope: scope) &&
             (block.nil? || block.call(request.env["warden"].user(scope)))

data/lib/devise/rails/warden_compat.rb

@@ -1,19 +1,12 @@
+# frozen_string_literal: true
+
 module Warden::Mixins::Common
   def request
     @request ||= ActionDispatch::Request.new(env)
   end
 
-  # Deprecate: Remove this check once we move to Rails 4 only.
-  NULL_STORE =
-    defined?(ActionController::RequestForgeryProtection::ProtectionMethods::NullSession::NullSessionHash) ?
-      ActionController::RequestForgeryProtection::ProtectionMethods::NullSession::NullSessionHash : nil
-
   def reset_session!
-    # Calling reset_session on NULL_STORE causes it fail.
-    # This is a bug that needs to be fixed in Rails.
-    unless NULL_STORE && request.session.is_a?(NULL_STORE)
-      request.reset_session
-    end
+    request.reset_session
   end
 
   def cookies

data/lib/devise/rails.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'devise/rails/routes'
 require 'devise/rails/warden_compat'
 
@@ -11,7 +13,9 @@ module Devise
     end
 
     # Force routes to be loaded if we are doing any eager load.
-    config.before_eager_load { |app| app.reload_routes! }
+    config.before_eager_load do |app|
+      app.reload_routes! if Devise.reload_routes
+    end
 
     initializer "devise.url_helpers" do
       Devise.include_helpers(Devise::Controllers)
@@ -30,27 +34,14 @@ module Devise
     end
 
     initializer "devise.secret_key" do |app|
-      if app.respond_to?(:secrets)
-        Devise.secret_key ||= app.secrets.secret_key_base
-      elsif app.config.respond_to?(:secret_key_base)
-        Devise.secret_key ||= app.config.secret_key_base
-      end
+      Devise.secret_key ||= Devise::SecretKeyFinder.new(app).find
 
       Devise.token_generator ||=
         if secret_key = Devise.secret_key
           Devise::TokenGenerator.new(
-            Devise::CachingKeyGenerator.new(Devise::KeyGenerator.new(secret_key))
+            ActiveSupport::CachingKeyGenerator.new(ActiveSupport::KeyGenerator.new(secret_key))
           )
         end
     end
-
-    initializer "devise.fix_routes_proxy_missing_respond_to_bug" do
-      # Deprecate: Remove once we move to Rails 4 only.
-      ActionDispatch::Routing::RoutesProxy.class_eval do
-        def respond_to?(method, include_private = false)
-          super || routes.url_helpers.respond_to?(method)
-        end
-      end
-    end
   end
 end

data/lib/devise/secret_key_finder.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Devise
+  class SecretKeyFinder
+    def initialize(application)
+      @application = application
+    end
+
+    def find
+      if @application.respond_to?(:credentials) && key_exists?(@application.credentials)
+        @application.credentials.secret_key_base
+      elsif @application.respond_to?(:secrets) && key_exists?(@application.secrets)
+        @application.secrets.secret_key_base
+      elsif @application.config.respond_to?(:secret_key_base) && key_exists?(@application.config)
+        @application.config.secret_key_base
+      elsif @application.respond_to?(:secret_key_base) && key_exists?(@application)
+        @application.secret_key_base
+      end
+    end
+
+    private
+
+    def key_exists?(object)
+      object.secret_key_base.present?
+    end
+  end
+end

data/lib/devise/strategies/authenticatable.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'devise/strategies/base'
 
 module Devise
@@ -26,8 +28,8 @@ module Devise
     private
 
       # Receives a resource and check if it is valid by calling valid_for_authentication?
-      # An optional block that will be triggered while validating can be optionally
-      # given as parameter. Check Devise::Models::Authenticable.valid_for_authentication?
+      # A block that will be triggered while validating can be optionally
+      # given as parameter. Check Devise::Models::Authenticatable.valid_for_authentication?
       # for more information.
       #
       # In case the resource can't be validated, it will fail with the given
@@ -118,7 +120,7 @@ module Devise
 
       # Helper to decode credentials from HTTP.
       def decode_credentials
-        return [] unless request.authorization && request.authorization =~ /^Basic (.*)/m
+        return [] unless request.authorization && request.authorization =~ /^Basic (.*)/mi
         Base64.decode64($1).split(/:/, 2)
       end
 

data/lib/devise/strategies/base.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Devise
   module Strategies
     # Base strategy for Devise. Responsible for verifying correct scope and mapping.

data/lib/devise/strategies/database_authenticatable.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'devise/strategies/authenticatable'
 
 module Devise
@@ -6,16 +8,21 @@ module Devise
     class DatabaseAuthenticatable < Authenticatable
       def authenticate!
         resource  = password.present? && mapping.to.find_for_database_authentication(authentication_hash)
-        encrypted = false
+        hashed = false
 
-        if validate(resource){ encrypted = true; resource.valid_password?(password) }
+        if validate(resource){ hashed = true; resource.valid_password?(password) }
           remember_me(resource)
           resource.after_database_authentication
           success!(resource)
         end
 
-        mapping.to.new.password = password if !encrypted && Devise.paranoid
-        fail(:not_found_in_database) unless resource
+        # In paranoid mode, hash the password even when a resource doesn't exist for the given authentication key.
+        # This is necessary to prevent enumeration attacks - e.g. the request is faster when a resource doesn't
+        # exist in the database if the password hashing algorithm is not called.
+        mapping.to.new.password = password if !hashed && Devise.paranoid
+        unless resource
+          Devise.paranoid ? fail(:invalid) : fail(:not_found_in_database)
+        end
       end
     end
   end

data/lib/devise/strategies/rememberable.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'devise/strategies/authenticatable'
 
 module Devise
@@ -25,8 +27,7 @@ module Devise
         end
 
         if validate(resource)
-          remember_me(resource)
-          extend_remember_me_period(resource)
+          remember_me(resource) if extend_remember_me?(resource)
           resource.after_remembered
           success!(resource)
         end
@@ -43,10 +44,8 @@ module Devise
 
     private
 
-      def extend_remember_me_period(resource)
-        if resource.respond_to?(:extend_remember_period=)
-          resource.extend_remember_period = mapping.to.extend_remember_period
-        end
+      def extend_remember_me?(resource)
+        resource.respond_to?(:extend_remember_period) && resource.extend_remember_period
       end
 
       def remember_me?

data/lib/devise/test/controller_helpers.rb

@@ -0,0 +1,167 @@
+# frozen_string_literal: true
+
+module Devise
+  module Test
+    # `Devise::Test::ControllerHelpers` provides a facility to test controllers
+    # in isolation when using `ActionController::TestCase` allowing you to
+    # quickly sign_in or sign_out a user. Do not use
+    # `Devise::Test::ControllerHelpers` in integration tests.
+    #
+    # Examples
+    #
+    #  class PostsTest < ActionController::TestCase
+    #    include Devise::Test::ControllerHelpers
+    #
+    #    test 'authenticated users can GET index' do
+    #      sign_in users(:bob)
+    #
+    #      get :index
+    #      assert_response :success
+    #    end
+    #  end
+    #
+    # Important: you should not test Warden specific behavior (like callbacks)
+    # using `Devise::Test::ControllerHelpers` since it is a stub of the actual
+    # behavior. Such callbacks should be tested in your integration suite instead.
+    module ControllerHelpers
+      extend ActiveSupport::Concern
+
+      included do
+        setup :setup_controller_for_warden, :warden
+      end
+
+      # Override process to consider warden.
+      def process(*)
+        _catch_warden { super }
+
+        @response
+      end
+
+      ruby2_keywords(:process) if respond_to?(:ruby2_keywords, true)
+
+      # We need to set up the environment variables and the response in the controller.
+      def setup_controller_for_warden #:nodoc:
+        @request.env['action_controller.instance'] = @controller
+      end
+
+      # Quick access to Warden::Proxy.
+      def warden #:nodoc:
+        @request.env['warden'] ||= begin
+          manager = Warden::Manager.new(nil) do |config|
+            config.merge! Devise.warden_config
+          end
+          Warden::Proxy.new(@request.env, manager)
+        end
+      end
+
+      # sign_in a given resource by storing its keys in the session.
+      # This method bypass any warden authentication callback.
+      #
+      # * +resource+ - The resource that should be authenticated
+      # * +scope+    - An optional +Symbol+ with the scope where the resource
+      #                should be signed in with.
+      # Examples:
+      #
+      # sign_in users(:alice)
+      # sign_in users(:alice), scope: :admin
+      def sign_in(resource, deprecated = nil, scope: nil)
+        if deprecated.present?
+          scope = resource
+          resource = deprecated
+
+          ActiveSupport::Deprecation.warn <<-DEPRECATION.strip_heredoc
+            [Devise] sign_in(:#{scope}, resource) on controller tests is deprecated and will be removed from Devise.
+            Please use sign_in(resource, scope: :#{scope}) instead.
+          DEPRECATION
+        end
+
+        scope ||= Devise::Mapping.find_scope!(resource)
+
+        warden.instance_variable_get(:@users).delete(scope)
+        warden.session_serializer.store(resource, scope)
+      end
+
+      # Sign out a given resource or scope by calling logout on Warden.
+      # This method bypass any warden logout callback.
+      #
+      # Examples:
+      #
+      #   sign_out :user     # sign_out(scope)
+      #   sign_out @user     # sign_out(resource)
+      #
+      def sign_out(resource_or_scope)
+        scope = Devise::Mapping.find_scope!(resource_or_scope)
+        @controller.instance_variable_set(:"@current_#{scope}", nil)
+        user = warden.instance_variable_get(:@users).delete(scope)
+        warden.session_serializer.delete(scope, user)
+      end
+
+      protected
+
+      # Catch warden continuations and handle like the middleware would.
+      # Returns nil when interrupted, otherwise the normal result of the block.
+      def _catch_warden(&block)
+        result = catch(:warden, &block)
+
+        env = @controller.request.env
+
+        result ||= {}
+
+        # Set the response. In production, the rack result is returned
+        # from Warden::Manager#call, which the following is modelled on.
+        case result
+        when Array
+          if result.first == 401 && intercept_401?(env) # does this happen during testing?
+            _process_unauthenticated(env)
+          else
+            result
+          end
+        when Hash
+          _process_unauthenticated(env, result)
+        else
+          result
+        end
+      end
+
+      def _process_unauthenticated(env, options = {})
+        options[:action] ||= :unauthenticated
+        proxy = request.env['warden']
+        result = options[:result] || proxy.result
+
+        ret = case result
+        when :redirect
+          body = proxy.message || "You are being redirected to #{proxy.headers['Location']}"
+          [proxy.status, proxy.headers, [body]]
+        when :custom
+          proxy.custom_response
+        else
+          request.env["PATH_INFO"] = "/#{options[:action]}"
+          request.env["warden.options"] = options
+          Warden::Manager._run_callbacks(:before_failure, env, options)
+
+          status, headers, response = Devise.warden_config[:failure_app].call(env).to_a
+          @controller.response.headers.merge!(headers)
+          @controller.response.content_type = headers["Content-Type"] unless Rails::VERSION::MAJOR >= 5
+          @controller.status = status
+          @controller.response_body = response.body
+          nil # causes process return @response
+        end
+
+        # ensure that the controller response is set up. In production, this is
+        # not necessary since warden returns the results to rack. However, at
+        # testing time, we want the response to be available to the testing
+        # framework to verify what would be returned to rack.
+        if ret.is_a?(Array)
+          status, headers, body = *ret
+          # ensure the controller response is set to our response.
+          @controller.response ||= @response
+          @response.status = status
+          @response.headers.merge!(headers)
+          @response.body = body
+        end
+
+        ret
+      end
+    end
+  end
+end

data/lib/devise/test/integration_helpers.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+module Devise
+  # Devise::Test::IntegrationHelpers is a helper module for facilitating
+  # authentication on Rails integration tests to bypass the required steps for
+  # signin in or signin out a record.
+  #
+  # Examples
+  #
+  #  class PostsTest < ActionDispatch::IntegrationTest
+  #    include Devise::Test::IntegrationHelpers
+  #
+  #    test 'authenticated users can see posts' do
+  #      sign_in users(:bob)
+  #
+  #      get '/posts'
+  #      assert_response :success
+  #    end
+  #  end
+  module Test
+    module IntegrationHelpers
+      def self.included(base)
+        base.class_eval do
+          include Warden::Test::Helpers
+
+          setup :setup_integration_for_devise
+          teardown :teardown_integration_for_devise
+        end
+      end
+
+      # Signs in a specific resource, mimicking a successful sign in
+      # operation through +Devise::SessionsController#create+.
+      #
+      # * +resource+ - The resource that should be authenticated
+      # * +scope+    - An optional +Symbol+ with the scope where the resource
+      #                should be signed in with.
+      def sign_in(resource, scope: nil)
+        scope ||= Devise::Mapping.find_scope!(resource)
+
+        login_as(resource, scope: scope)
+      end
+
+      # Signs out a specific scope from the session.
+      #
+      # * +resource_or_scope+ - The resource or scope that should be signed out.
+      def sign_out(resource_or_scope)
+        scope = Devise::Mapping.find_scope!(resource_or_scope)
+
+        logout scope
+      end
+
+      protected
+
+      def setup_integration_for_devise
+        Warden.test_mode!
+      end
+
+      def teardown_integration_for_devise
+        Warden.test_reset!
+      end
+    end
+  end
+end