devise 4.7.2 → 4.9.2
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +70 -1
- data/MIT-LICENSE +1 -1
- data/README.md +55 -29
- data/app/controllers/devise/confirmations_controller.rb +1 -0
- data/app/controllers/devise/passwords_controller.rb +2 -2
- data/app/controllers/devise/registrations_controller.rb +1 -1
- data/app/controllers/devise/sessions_controller.rb +1 -1
- data/app/controllers/devise/unlocks_controller.rb +1 -0
- data/app/controllers/devise_controller.rb +1 -0
- data/app/helpers/devise_helper.rb +18 -6
- data/app/mailers/devise/mailer.rb +5 -5
- data/app/views/devise/registrations/edit.html.erb +1 -1
- data/app/views/devise/shared/_error_messages.html.erb +1 -1
- data/app/views/devise/shared/_links.html.erb +1 -1
- data/config/locales/en.yml +1 -1
- data/lib/devise/controllers/helpers.rb +7 -7
- data/lib/devise/controllers/responder.rb +35 -0
- data/lib/devise/controllers/sign_in_out.rb +6 -4
- data/lib/devise/controllers/url_helpers.rb +1 -1
- data/lib/devise/failure_app.rb +6 -3
- data/lib/devise/hooks/csrf_cleaner.rb +6 -1
- data/lib/devise/hooks/lockable.rb +2 -5
- data/lib/devise/mapping.rb +1 -1
- data/lib/devise/models/authenticatable.rb +11 -7
- data/lib/devise/models/confirmable.rb +18 -39
- data/lib/devise/models/database_authenticatable.rb +9 -28
- data/lib/devise/models/lockable.rb +11 -3
- data/lib/devise/models/omniauthable.rb +2 -2
- data/lib/devise/models/recoverable.rb +8 -19
- data/lib/devise/models/rememberable.rb +1 -1
- data/lib/devise/models/timeoutable.rb +1 -1
- data/lib/devise/models/validatable.rb +4 -9
- data/lib/devise/models.rb +1 -0
- data/lib/devise/omniauth.rb +2 -5
- data/lib/devise/orm.rb +71 -0
- data/lib/devise/rails/deprecated_constant_accessor.rb +39 -0
- data/lib/devise/rails/routes.rb +4 -4
- data/lib/devise/test/controller_helpers.rb +1 -1
- data/lib/devise/version.rb +1 -1
- data/lib/devise.rb +30 -7
- data/lib/generators/active_record/devise_generator.rb +17 -2
- data/lib/generators/devise/devise_generator.rb +1 -1
- data/lib/generators/devise/install_generator.rb +1 -1
- data/lib/generators/templates/devise.rb +10 -8
- data/lib/generators/templates/simple_form_for/registrations/edit.html.erb +1 -1
- metadata +17 -5
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 7640b97ddd188a63e29076d8d94b0a4ebaecc23aad53b8e608b4b1d029818570
|
|
4
|
+
data.tar.gz: 7e8b512895f0fd73e307bebe494ea3d7d0bd9ecd562b917016b1f7f56d483d2c
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: b7cd4534d2abb7ba16353d4f41ea63ed0334eccf68c1357dc37c68b51ad90f1a9cb8544e8f90c2249b2067bdfd0b6c19d245562a1eecef2291ea8705143878ec
|
|
7
|
+
data.tar.gz: f9bc9ea3a1dfdf86ab79dc47839c79b07fd5613dddfb40022fa508729dded4971dd30055f6f8b901c6a9182513414750825064db278d7865ae7a4576513c08f7
|
data/CHANGELOG.md
CHANGED
|
@@ -1,4 +1,73 @@
|
|
|
1
|
-
###
|
|
1
|
+
### Unreleased
|
|
2
|
+
|
|
3
|
+
* deprecations
|
|
4
|
+
* Bring back `Devise.activerecord51?` and deprecate it, in order to avoid breakage with some libraries that apparently relied on it.
|
|
5
|
+
|
|
6
|
+
### 4.9.1 - 2023-03-31
|
|
7
|
+
|
|
8
|
+
* enhancements
|
|
9
|
+
* Allow resource class scopes to override the global configuration for `sign_in_after_reset_password` behaviour. [#5429](https://github.com/heartcombo/devise/pull/5429) [@mattr](https://github.com/mattr)
|
|
10
|
+
* Refactor conditional dirty tracking logic to a centralized module to simplify usage throughout the codebase. [#5575](https://github.com/heartcombo/devise/pull/5575)
|
|
11
|
+
* Improve support for Devise in apps with Active Record and Mongoid ORMs loaded, so it does not incorrectly uses new Active Record dirty tracking APIs with a Mongoid Devise model. [#5576](https://github.com/heartcombo/devise/pull/5576)
|
|
12
|
+
|
|
13
|
+
* bug fixes
|
|
14
|
+
* Failure app will respond with configured `redirect_status` instead of `error_status` if the recall app returns a redirect status (300..399) [#5573](https://github.com/heartcombo/devise/pull/5573)
|
|
15
|
+
* Fix frozen string exception in validatable. [#5563](https://github.com/heartcombo/devise/pull/5563) [#5465](https://github.com/heartcombo/devise/pull/5465) [@mameier](https://github.com/mameier)
|
|
16
|
+
|
|
17
|
+
### 4.9.0 - 2023-02-17
|
|
18
|
+
|
|
19
|
+
* enhancements
|
|
20
|
+
* Add support for Ruby 3.1/3.2.
|
|
21
|
+
* Add support for Hotwire + Turbo, default in Rails 7+.
|
|
22
|
+
* Devise uses the latest `responders` version (v3.1.0 or higher), which allows configuring the status used for validation error responses (`error_status`) and for redirects after POST/PUT/PATCH/DELETE requests (`redirect_status`). For backwards compatibility, Devise keeps `error_status` as `:ok` which returns a `200 OK` response, and `redirect_status` to `:found` which returns a `302 Found` response, but you can configure it to return `422 Unprocessable Entity` and `303 See Other` respectively, to match the behavior expected by Hotwire/Turbo:
|
|
23
|
+
|
|
24
|
+
```ruby
|
|
25
|
+
# config/initializers/devise.rb
|
|
26
|
+
Devise.setup do |config|
|
|
27
|
+
# ...
|
|
28
|
+
config.responder.error_status = :unprocessable_entity
|
|
29
|
+
config.responder.redirect_status = :see_other
|
|
30
|
+
# ...
|
|
31
|
+
end
|
|
32
|
+
```
|
|
33
|
+
|
|
34
|
+
These configs are already generated by default with new apps, and existing apps may opt-in as described above. Trying to set these with an older version of `responders` will issue a warning and have no effect, so please upgrade the `responders` version if you're upgrading Devise for this integration. Note that these defaults may change in future versions of Devise, to better match the Rails + Hotwire/Turbo defaults across the board.
|
|
35
|
+
* If you have a custom responder set on your application and expect it to affect Devise as well, you may need to override the Devise responder entirely with `config.responder = MyApplicationResponder`, so that it uses your custom one. The main reason Devise uses a custom responder is to be able to configure the statuses as described above, but you can also change that config on your own responder if you want. Check the `responders` readme for more info on that.
|
|
36
|
+
* If you have created a custom responder and/or failure app just to customize responses for better Hotwire/Turbo integration, they should no longer be necessary.
|
|
37
|
+
* `:turbo_stream` is now treated as a navigational format, so it works like HTML navigation when using Turbo. Note: if you relied on `:turbo_stream` to be treated as a non-navigational format before, you can reconfigure your `navigational_formats` in the Devise initializer file to exclude it.
|
|
38
|
+
* OmniAuth "Sign in with" links were changed to buttons that generate HTML forms with method=POST, instead of using link + method=POST that required rails-ujs to work. Since rails-ujs is no longer the default for new Rails apps, this allows the OmniAuth buttons to work in any scenario, with or without rails-ujs and/or Turbo. This only affects apps that are using the default `devise/shared/_links.html.erb` partial from Devise with OmniAuth enabled.
|
|
39
|
+
* The "Cancel my account" button was changed to include the `data-turbo-confirm` option, so that it works with both rails-ujs and Turbo by default.
|
|
40
|
+
* Devise does not provide "sign out" links/buttons in its shared views, but if you're using `sign_out_via` with `:delete` (the default), and are using links with `method: :delete`, those need to be updated with `data: { turbo_method: :delete }` instead for Turbo.
|
|
41
|
+
* Check [this upgrade guide](https://github.com/heartcombo/devise/wiki/How-To:-Upgrade-to-Devise-4.9.0-[Hotwire-Turbo-integration]) for more detailed information.
|
|
42
|
+
|
|
43
|
+
### 4.8.1 - 2021-12-16
|
|
44
|
+
|
|
45
|
+
* enhancements
|
|
46
|
+
* Add support for Rails 7.0. Please note that Turbo integration is not fully supported by Devise yet.
|
|
47
|
+
|
|
48
|
+
### 4.8.0 - 2021-04-29
|
|
49
|
+
|
|
50
|
+
* enhancements
|
|
51
|
+
* Devise now enables the upgrade of OmniAuth 2+. Previously Devise would raise an error if you'd try to upgrade. Please note that OmniAuth 2 is considered a security upgrade and recommended to everyone. You can read more about the details (and possible necessary changes to your app as part of the upgrade) in [their release notes](https://github.com/omniauth/omniauth/releases/tag/v2.0.0). [Devise's OmniAuth Overview wiki](https://github.com/heartcombo/devise/wiki/OmniAuth:-Overview) was also updated to cover OmniAuth 2.0 requirements.
|
|
52
|
+
- Note that the upgrade required Devise shared links that initiate the OmniAuth flow to be changed to `method: :post`, which is now a requirement for OmniAuth, part of the security improvement. If you have copied and customized the Devise shared links partial to your app, or if you have other links in your app that initiate the OmniAuth flow, they will have to be updated to use `method: :post`, or changed to use buttons (e.g. `button_to`) to work with OmniAuth 2. (if you're using links with `method: :post`, make sure your app has `rails-ujs` or `jquery-ujs` included in order for these links to work properly.)
|
|
53
|
+
- As part of the OmniAuth 2.0 upgrade you might also need to add the [`omniauth-rails_csrf_protection`](https://github.com/cookpad/omniauth-rails_csrf_protection) gem to your app if you don't have it already. (and you don't want to roll your own code to verify requests.) Check the OmniAuth v2 release notes for more info.
|
|
54
|
+
* Introduce `Lockable#reset_failed_attempts!` model method to reset failed attempts counter to 0 after the user signs in.
|
|
55
|
+
- This logic existed inside the lockable warden hook and is triggered automatically after the user signs in. The new model method is an extraction to allow you to override it in the application to implement things like switching to a write database if you're using the new multi-DB infrastructure from Rails for example, similar to how it's already possible with `Trackable#update_tracked_fields!`.
|
|
56
|
+
* Add support for Ruby 3.
|
|
57
|
+
* Add support for Rails 6.1.
|
|
58
|
+
* Move CI to GitHub Actions.
|
|
59
|
+
|
|
60
|
+
* deprecations
|
|
61
|
+
* `Devise::Models::Authenticatable::BLACKLIST_FOR_SERIALIZATION` is deprecated in favor of `Devise::Models::Authenticatable::UNSAFE_ATTRIBUTES_FOR_SERIALIZATION` (@hanachin)
|
|
62
|
+
|
|
63
|
+
### 4.7.3 - 2020-09-20
|
|
64
|
+
|
|
65
|
+
* bug fixes
|
|
66
|
+
* Do not modify `:except` option given to `#serializable_hash`. (by @dpep)
|
|
67
|
+
* Fix thor deprecation when running the devise generator. (by @deivid-rodriguez)
|
|
68
|
+
* Fix hanging tests for streaming controllers using Devise. (by @afn)
|
|
69
|
+
|
|
70
|
+
### 4.7.2 - 2020-06-10
|
|
2
71
|
|
|
3
72
|
* enhancements
|
|
4
73
|
* Increase default stretches to 12 (by @sergey-alekseev)
|
data/MIT-LICENSE
CHANGED
data/README.md
CHANGED
|
@@ -1,7 +1,4 @@
|
|
|
1
|
-
](http://travis-ci.org/heartcombo/devise)
|
|
4
|
-
[](https://codeclimate.com/github/heartcombo/devise)
|
|
1
|
+
|
|
5
2
|
|
|
6
3
|
Devise is a flexible authentication solution for Rails based on Warden. It:
|
|
7
4
|
|
|
@@ -12,16 +9,16 @@ Devise is a flexible authentication solution for Rails based on Warden. It:
|
|
|
12
9
|
|
|
13
10
|
It's composed of 10 modules:
|
|
14
11
|
|
|
15
|
-
* [Database Authenticatable](http://www.rubydoc.info/github/heartcombo/devise/
|
|
16
|
-
* [Omniauthable](http://www.rubydoc.info/github/heartcombo/devise/
|
|
17
|
-
* [Confirmable](http://www.rubydoc.info/github/heartcombo/devise/
|
|
18
|
-
* [Recoverable](http://www.rubydoc.info/github/heartcombo/devise/
|
|
19
|
-
* [Registerable](http://www.rubydoc.info/github/heartcombo/devise/
|
|
20
|
-
* [Rememberable](http://www.rubydoc.info/github/heartcombo/devise/
|
|
21
|
-
* [Trackable](http://www.rubydoc.info/github/heartcombo/devise/
|
|
22
|
-
* [Timeoutable](http://www.rubydoc.info/github/heartcombo/devise/
|
|
23
|
-
* [Validatable](http://www.rubydoc.info/github/heartcombo/devise/
|
|
24
|
-
* [Lockable](http://www.rubydoc.info/github/heartcombo/devise/
|
|
12
|
+
* [Database Authenticatable](http://www.rubydoc.info/github/heartcombo/devise/main/Devise/Models/DatabaseAuthenticatable): hashes and stores a password in the database to validate the authenticity of a user while signing in. The authentication can be done both through POST requests or HTTP Basic Authentication.
|
|
13
|
+
* [Omniauthable](http://www.rubydoc.info/github/heartcombo/devise/main/Devise/Models/Omniauthable): adds OmniAuth (https://github.com/omniauth/omniauth) support.
|
|
14
|
+
* [Confirmable](http://www.rubydoc.info/github/heartcombo/devise/main/Devise/Models/Confirmable): sends emails with confirmation instructions and verifies whether an account is already confirmed during sign in.
|
|
15
|
+
* [Recoverable](http://www.rubydoc.info/github/heartcombo/devise/main/Devise/Models/Recoverable): resets the user password and sends reset instructions.
|
|
16
|
+
* [Registerable](http://www.rubydoc.info/github/heartcombo/devise/main/Devise/Models/Registerable): handles signing up users through a registration process, also allowing them to edit and destroy their account.
|
|
17
|
+
* [Rememberable](http://www.rubydoc.info/github/heartcombo/devise/main/Devise/Models/Rememberable): manages generating and clearing a token for remembering the user from a saved cookie.
|
|
18
|
+
* [Trackable](http://www.rubydoc.info/github/heartcombo/devise/main/Devise/Models/Trackable): tracks sign in count, timestamps and IP address.
|
|
19
|
+
* [Timeoutable](http://www.rubydoc.info/github/heartcombo/devise/main/Devise/Models/Timeoutable): expires sessions that have not been active in a specified period of time.
|
|
20
|
+
* [Validatable](http://www.rubydoc.info/github/heartcombo/devise/main/Devise/Models/Validatable): provides validations of email and password. It's optional and can be customized, so you're able to define your own validations.
|
|
21
|
+
* [Lockable](http://www.rubydoc.info/github/heartcombo/devise/main/Devise/Models/Lockable): locks an account after a specified number of failed sign-in attempts. Can unlock via email or after a specified time period.
|
|
25
22
|
|
|
26
23
|
## Table of Contents
|
|
27
24
|
|
|
@@ -54,7 +51,6 @@ It's composed of 10 modules:
|
|
|
54
51
|
- [Other ORMs](#other-orms)
|
|
55
52
|
- [Rails API mode](#rails-api-mode)
|
|
56
53
|
- [Additional information](#additional-information)
|
|
57
|
-
- [Heroku](#heroku)
|
|
58
54
|
- [Warden](#warden)
|
|
59
55
|
- [Contributors](#contributors)
|
|
60
56
|
- [License](#license)
|
|
@@ -93,7 +89,7 @@ https://groups.google.com/group/plataformatec-devise
|
|
|
93
89
|
|
|
94
90
|
You can view the Devise documentation in RDoc format here:
|
|
95
91
|
|
|
96
|
-
http://rubydoc.info/github/heartcombo/devise/
|
|
92
|
+
http://rubydoc.info/github/heartcombo/devise/main/frames
|
|
97
93
|
|
|
98
94
|
If you need to use Devise with previous versions of Rails, you can always run "gem server" from the command line after you install the gem to access the old documentation.
|
|
99
95
|
|
|
@@ -119,8 +115,8 @@ You will usually want to write tests for your changes. To run the test suite, g
|
|
|
119
115
|
Devise works with multiple Ruby and Rails versions, and ActiveRecord and Mongoid ORMs, which means you can run the test suite with some modifiers: `DEVISE_ORM` and `BUNDLE_GEMFILE`.
|
|
120
116
|
|
|
121
117
|
### DEVISE_ORM
|
|
122
|
-
Since Devise
|
|
123
|
-
The default value of `DEVISE_ORM` is `active_record`. To run the tests for
|
|
118
|
+
Since Devise supports both Mongoid and ActiveRecord, we rely on this variable to run specific code for each ORM.
|
|
119
|
+
The default value of `DEVISE_ORM` is `active_record`. To run the tests for Mongoid, you can pass `mongoid`:
|
|
124
120
|
```
|
|
125
121
|
DEVISE_ORM=mongoid bin/test
|
|
126
122
|
|
|
@@ -132,7 +128,7 @@ Please note that the command output will show the variable value being used.
|
|
|
132
128
|
|
|
133
129
|
### BUNDLE_GEMFILE
|
|
134
130
|
We can use this variable to tell bundler what Gemfile it should use (instead of the one in the current directory).
|
|
135
|
-
Inside the [gemfiles](https://github.com/heartcombo/devise/tree/
|
|
131
|
+
Inside the [gemfiles](https://github.com/heartcombo/devise/tree/main/gemfiles) directory, we have one for each version of Rails we support. When you send us a pull request, it may happen that the test suite breaks using some of them. If that's the case, you can simulate the same environment using the `BUNDLE_GEMFILE` variable.
|
|
136
132
|
For example, if the tests broke using Ruby 2.4.2 and Rails 4.1, you can do the following:
|
|
137
133
|
```bash
|
|
138
134
|
rbenv shell 2.4.2 # or rvm use 2.4.2
|
|
@@ -273,7 +269,7 @@ Besides `:stretches`, you can define `:pepper`, `:encryptor`, `:confirm_within`,
|
|
|
273
269
|
|
|
274
270
|
### Strong Parameters
|
|
275
271
|
|
|
276
|
-
|
|
272
|
+
The Parameter Sanitizer API has changed for Devise 4 :warning:
|
|
277
273
|
|
|
278
274
|
*For previous Devise versions see https://github.com/heartcombo/devise/tree/3-stable#strong-parameters*
|
|
279
275
|
|
|
@@ -313,7 +309,7 @@ class ApplicationController < ActionController::Base
|
|
|
313
309
|
end
|
|
314
310
|
```
|
|
315
311
|
|
|
316
|
-
Devise allows you to completely change Devise defaults or invoke custom
|
|
312
|
+
Devise allows you to completely change Devise defaults or invoke custom behavior by passing a block:
|
|
317
313
|
|
|
318
314
|
To permit simple scalar values for username and email, use this
|
|
319
315
|
|
|
@@ -386,7 +382,7 @@ $ rails generate devise:views users
|
|
|
386
382
|
```
|
|
387
383
|
|
|
388
384
|
If you would like to generate only a few sets of views, like the ones for the `registerable` and `confirmable` module,
|
|
389
|
-
you can pass a list of
|
|
385
|
+
you can pass a list of views to the generator with the `-v` flag.
|
|
390
386
|
|
|
391
387
|
```console
|
|
392
388
|
$ rails generate devise:views -v registrations confirmations
|
|
@@ -414,7 +410,7 @@ If the customization at the views level is not enough, you can customize each co
|
|
|
414
410
|
...
|
|
415
411
|
end
|
|
416
412
|
```
|
|
417
|
-
|
|
413
|
+
Use the `-c` flag to specify one or more controllers, for example: `rails generate devise:controllers users -c sessions`)
|
|
418
414
|
|
|
419
415
|
2. Tell the router to use this controller:
|
|
420
416
|
|
|
@@ -422,7 +418,7 @@ If the customization at the views level is not enough, you can customize each co
|
|
|
422
418
|
devise_for :users, controllers: { sessions: 'users/sessions' }
|
|
423
419
|
```
|
|
424
420
|
|
|
425
|
-
3.
|
|
421
|
+
3. Recommended but not required: copy (or move) the views from `devise/sessions` to `users/sessions`. Rails will continue using the views from `devise/sessions` due to inheritance if you skip this step, but having the views matching the controller(s) keeps things consistent.
|
|
426
422
|
|
|
427
423
|
4. Finally, change or extend the desired controller actions.
|
|
428
424
|
|
|
@@ -436,7 +432,7 @@ If the customization at the views level is not enough, you can customize each co
|
|
|
436
432
|
end
|
|
437
433
|
```
|
|
438
434
|
|
|
439
|
-
Or you can simply add new
|
|
435
|
+
Or you can simply add new behavior to it:
|
|
440
436
|
|
|
441
437
|
```ruby
|
|
442
438
|
class Users::SessionsController < Devise::SessionsController
|
|
@@ -460,7 +456,7 @@ Devise also ships with default routes. If you need to customize them, you should
|
|
|
460
456
|
devise_for :users, path: 'auth', path_names: { sign_in: 'login', sign_out: 'logout', password: 'secret', confirmation: 'verification', unlock: 'unblock', registration: 'register', sign_up: 'cmon_let_me_in' }
|
|
461
457
|
```
|
|
462
458
|
|
|
463
|
-
Be sure to check `devise_for` [documentation](http://www.rubydoc.info/github/heartcombo/devise/
|
|
459
|
+
Be sure to check `devise_for` [documentation](http://www.rubydoc.info/github/heartcombo/devise/main/ActionDispatch/Routing/Mapper%3Adevise_for) for details.
|
|
464
460
|
|
|
465
461
|
If you have the need for more deep customization, for instance to also allow "/sign_in" besides "/users/sign_in", all you need to do is create your routes normally and wrap them in a `devise_scope` block in the router:
|
|
466
462
|
|
|
@@ -478,6 +474,36 @@ Please note: You will still need to add `devise_for` in your routes in order to
|
|
|
478
474
|
devise_for :users, skip: :all
|
|
479
475
|
```
|
|
480
476
|
|
|
477
|
+
### Hotwire/Turbo
|
|
478
|
+
|
|
479
|
+
Devise integrates with Hotwire/Turbo by treating such requests as navigational, and configuring certain responses for errors and redirects to match the expected behavior. New apps are generated with the following response configuration by default, and existing apps may opt-in by adding the config to their Devise initializers:
|
|
480
|
+
|
|
481
|
+
```ruby
|
|
482
|
+
Devise.setup do |config|
|
|
483
|
+
# ...
|
|
484
|
+
# When using Devise with Hotwire/Turbo, the http status for error responses
|
|
485
|
+
# and some redirects must match the following. The default in Devise for existing
|
|
486
|
+
# apps is `200 OK` and `302 Found respectively`, but new apps are generated with
|
|
487
|
+
# these new defaults that match Hotwire/Turbo behavior.
|
|
488
|
+
# Note: These might become the new default in future versions of Devise.
|
|
489
|
+
config.responder.error_status = :unprocessable_entity
|
|
490
|
+
config.responder.redirect_status = :see_other
|
|
491
|
+
end
|
|
492
|
+
```
|
|
493
|
+
|
|
494
|
+
**Important**: these custom responses require the `responders` gem version to be `3.1.0` or higher, please make sure you update it if you're going to use this configuration. Check [this upgrade guide](https://github.com/heartcombo/devise/wiki/How-To:-Upgrade-to-Devise-4.9.0-[Hotwire-Turbo-integration]) for more info.
|
|
495
|
+
|
|
496
|
+
_Note_: the above statuses configuration may become the default for Devise in a future release.
|
|
497
|
+
|
|
498
|
+
There are a couple other changes you might need to make in your app to work with Hotwire/Turbo, if you're migrating from rails-ujs:
|
|
499
|
+
|
|
500
|
+
* The `data-confirm` option that adds a confirmation modal to buttons/forms before submission needs to change to `data-turbo-confirm`, so that Turbo handles those appropriately.
|
|
501
|
+
* The `data-method` option that sets the request method for link submissions needs to change to `data-turbo-method`. This is not necessary for `button_to` or `form`s since Turbo can handle those.
|
|
502
|
+
|
|
503
|
+
If you're setting up Devise to sign out via `:delete`, and you're using links (instead of buttons wrapped in a form) to sign out with the `method: :delete` option, they will need to be updated as described above. (Devise does not provide sign out links/buttons in its shared views.)
|
|
504
|
+
|
|
505
|
+
Make sure to inspect your views looking for those, and change appropriately.
|
|
506
|
+
|
|
481
507
|
### I18n
|
|
482
508
|
|
|
483
509
|
Devise uses flash messages with I18n, in conjunction with the flash keys :notice and :alert. To customize your app, you can set up your locale file:
|
|
@@ -681,12 +707,12 @@ end
|
|
|
681
707
|
|
|
682
708
|
### Password reset tokens and Rails logs
|
|
683
709
|
|
|
684
|
-
If you enable the [Recoverable](http://rubydoc.info/github/heartcombo/devise/
|
|
710
|
+
If you enable the [Recoverable](http://rubydoc.info/github/heartcombo/devise/main/Devise/Models/Recoverable) module, note that a stolen password reset token could give an attacker access to your application. Devise takes effort to generate random, secure tokens, and stores only token digests in the database, never plaintext. However the default logging behavior in Rails can cause plaintext tokens to leak into log files:
|
|
685
711
|
|
|
686
712
|
1. Action Mailer logs the entire contents of all outgoing emails to the DEBUG level. Password reset tokens delivered to users in email will be leaked.
|
|
687
713
|
2. Active Job logs all arguments to every enqueued job at the INFO level. If you configure Devise to use `deliver_later` to send password reset emails, password reset tokens will be leaked.
|
|
688
714
|
|
|
689
|
-
Rails sets the production logger level to
|
|
715
|
+
Rails sets the production logger level to INFO by default. Consider changing your production logger level to WARN if you wish to prevent tokens from being leaked into your logs. In `config/environments/production.rb`:
|
|
690
716
|
|
|
691
717
|
```ruby
|
|
692
718
|
config.log_level = :warn
|
|
@@ -741,6 +767,6 @@ https://github.com/heartcombo/devise/graphs/contributors
|
|
|
741
767
|
|
|
742
768
|
## License
|
|
743
769
|
|
|
744
|
-
MIT License. Copyright 2020 Rafael França,
|
|
770
|
+
MIT License. Copyright 2020-2023 Rafael França, Leonardo Tegon, Carlos Antônio da Silva. Copyright 2009-2019 Plataformatec.
|
|
745
771
|
|
|
746
772
|
The Devise logo is licensed under [Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License](https://creativecommons.org/licenses/by-nc-nd/4.0/).
|
|
@@ -27,6 +27,7 @@ class Devise::ConfirmationsController < DeviseController
|
|
|
27
27
|
set_flash_message!(:notice, :confirmed)
|
|
28
28
|
respond_with_navigational(resource){ redirect_to after_confirmation_path_for(resource_name, resource) }
|
|
29
29
|
else
|
|
30
|
+
# TODO: use `error_status` when the default changes to `:unprocessable_entity`.
|
|
30
31
|
respond_with_navigational(resource.errors, status: :unprocessable_entity){ render :new }
|
|
31
32
|
end
|
|
32
33
|
end
|
|
@@ -36,7 +36,7 @@ class Devise::PasswordsController < DeviseController
|
|
|
36
36
|
|
|
37
37
|
if resource.errors.empty?
|
|
38
38
|
resource.unlock_access! if unlockable?(resource)
|
|
39
|
-
if
|
|
39
|
+
if resource_class.sign_in_after_reset_password
|
|
40
40
|
flash_message = resource.active_for_authentication? ? :updated : :updated_not_active
|
|
41
41
|
set_flash_message!(:notice, flash_message)
|
|
42
42
|
resource.after_database_authentication
|
|
@@ -53,7 +53,7 @@ class Devise::PasswordsController < DeviseController
|
|
|
53
53
|
|
|
54
54
|
protected
|
|
55
55
|
def after_resetting_password_path_for(resource)
|
|
56
|
-
|
|
56
|
+
resource_class.sign_in_after_reset_password ? after_sign_in_path_for(resource) : new_session_path(resource_name)
|
|
57
57
|
end
|
|
58
58
|
|
|
59
59
|
# The path used after sending reset password instructions
|
|
@@ -67,7 +67,7 @@ class Devise::RegistrationsController < DeviseController
|
|
|
67
67
|
Devise.sign_out_all_scopes ? sign_out : sign_out(resource_name)
|
|
68
68
|
set_flash_message! :notice, :destroyed
|
|
69
69
|
yield resource if block_given?
|
|
70
|
-
respond_with_navigational(resource){ redirect_to after_sign_out_path_for(resource_name) }
|
|
70
|
+
respond_with_navigational(resource){ redirect_to after_sign_out_path_for(resource_name), status: Devise.responder.redirect_status }
|
|
71
71
|
end
|
|
72
72
|
|
|
73
73
|
# GET /resource/cancel
|
|
@@ -77,7 +77,7 @@ class Devise::SessionsController < DeviseController
|
|
|
77
77
|
# support returning empty response on GET request
|
|
78
78
|
respond_to do |format|
|
|
79
79
|
format.all { head :no_content }
|
|
80
|
-
format.any(*navigational_formats) { redirect_to after_sign_out_path_for(resource_name) }
|
|
80
|
+
format.any(*navigational_formats) { redirect_to after_sign_out_path_for(resource_name), status: Devise.responder.redirect_status }
|
|
81
81
|
end
|
|
82
82
|
end
|
|
83
83
|
end
|
|
@@ -29,6 +29,7 @@ class Devise::UnlocksController < DeviseController
|
|
|
29
29
|
set_flash_message! :notice, :unlocked
|
|
30
30
|
respond_with_navigational(resource){ redirect_to after_unlock_path_for(resource) }
|
|
31
31
|
else
|
|
32
|
+
# TODO: use `error_status` when the default changes to `:unprocessable_entity`.
|
|
32
33
|
respond_with_navigational(resource.errors, status: :unprocessable_entity){ render :new }
|
|
33
34
|
end
|
|
34
35
|
end
|
|
@@ -15,6 +15,7 @@ class DeviseController < Devise.parent_controller.constantize
|
|
|
15
15
|
end
|
|
16
16
|
|
|
17
17
|
prepend_before_action :assert_is_devise_resource!
|
|
18
|
+
self.responder = Devise.responder
|
|
18
19
|
respond_to :html if mimes_for_respond_to.empty?
|
|
19
20
|
|
|
20
21
|
# Override prefixes to consider the scoped view.
|
|
@@ -1,14 +1,26 @@
|
|
|
1
1
|
# frozen_string_literal: true
|
|
2
2
|
|
|
3
3
|
module DeviseHelper
|
|
4
|
-
# Retain this method for backwards compatibility, deprecated in
|
|
5
|
-
# devise/shared/error_messages partial
|
|
4
|
+
# Retain this method for backwards compatibility, deprecated in favor of modifying the
|
|
5
|
+
# devise/shared/error_messages partial.
|
|
6
6
|
def devise_error_messages!
|
|
7
7
|
ActiveSupport::Deprecation.warn <<-DEPRECATION.strip_heredoc
|
|
8
|
-
[Devise] `DeviseHelper
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
8
|
+
[Devise] `DeviseHelper#devise_error_messages!` is deprecated and will be
|
|
9
|
+
removed in the next major version.
|
|
10
|
+
|
|
11
|
+
Devise now uses a partial under "devise/shared/error_messages" to display
|
|
12
|
+
error messages by default, and make them easier to customize. Update your
|
|
13
|
+
views changing calls from:
|
|
14
|
+
|
|
15
|
+
<%= devise_error_messages! %>
|
|
16
|
+
|
|
17
|
+
to:
|
|
18
|
+
|
|
19
|
+
<%= render "devise/shared/error_messages", resource: resource %>
|
|
20
|
+
|
|
21
|
+
To start customizing how errors are displayed, you can copy the partial
|
|
22
|
+
from devise to your `app/views` folder. Alternatively, you can run
|
|
23
|
+
`rails g devise:views` which will copy all of them again to your app.
|
|
12
24
|
DEPRECATION
|
|
13
25
|
|
|
14
26
|
return "" if resource.errors.empty?
|
|
@@ -4,26 +4,26 @@ if defined?(ActionMailer)
|
|
|
4
4
|
class Devise::Mailer < Devise.parent_mailer.constantize
|
|
5
5
|
include Devise::Mailers::Helpers
|
|
6
6
|
|
|
7
|
-
def confirmation_instructions(record, token, opts={})
|
|
7
|
+
def confirmation_instructions(record, token, opts = {})
|
|
8
8
|
@token = token
|
|
9
9
|
devise_mail(record, :confirmation_instructions, opts)
|
|
10
10
|
end
|
|
11
11
|
|
|
12
|
-
def reset_password_instructions(record, token, opts={})
|
|
12
|
+
def reset_password_instructions(record, token, opts = {})
|
|
13
13
|
@token = token
|
|
14
14
|
devise_mail(record, :reset_password_instructions, opts)
|
|
15
15
|
end
|
|
16
16
|
|
|
17
|
-
def unlock_instructions(record, token, opts={})
|
|
17
|
+
def unlock_instructions(record, token, opts = {})
|
|
18
18
|
@token = token
|
|
19
19
|
devise_mail(record, :unlock_instructions, opts)
|
|
20
20
|
end
|
|
21
21
|
|
|
22
|
-
def email_changed(record, opts={})
|
|
22
|
+
def email_changed(record, opts = {})
|
|
23
23
|
devise_mail(record, :email_changed, opts)
|
|
24
24
|
end
|
|
25
25
|
|
|
26
|
-
def password_change(record, opts={})
|
|
26
|
+
def password_change(record, opts = {})
|
|
27
27
|
devise_mail(record, :password_change, opts)
|
|
28
28
|
end
|
|
29
29
|
end
|
|
@@ -38,6 +38,6 @@
|
|
|
38
38
|
|
|
39
39
|
<h3>Cancel my account</h3>
|
|
40
40
|
|
|
41
|
-
<
|
|
41
|
+
<div>Unhappy? <%= button_to "Cancel my account", registration_path(resource_name), data: { confirm: "Are you sure?", turbo_confirm: "Are you sure?" }, method: :delete %></div>
|
|
42
42
|
|
|
43
43
|
<%= link_to "Back", :back %>
|
|
@@ -20,6 +20,6 @@
|
|
|
20
20
|
|
|
21
21
|
<%- if devise_mapping.omniauthable? %>
|
|
22
22
|
<%- resource_class.omniauth_providers.each do |provider| %>
|
|
23
|
-
<%=
|
|
23
|
+
<%= button_to "Sign in with #{OmniAuth::Utils.camelize(provider)}", omniauth_authorize_path(resource_name, provider), data: { turbo: false } %><br />
|
|
24
24
|
<% end %>
|
|
25
25
|
<% end %>
|
data/config/locales/en.yml
CHANGED
|
@@ -44,7 +44,7 @@ en:
|
|
|
44
44
|
signed_up_but_unconfirmed: "A message with a confirmation link has been sent to your email address. Please follow the link to activate your account."
|
|
45
45
|
update_needs_confirmation: "You updated your account successfully, but we need to verify your new email address. Please check your email and follow the confirmation link to confirm your new email address."
|
|
46
46
|
updated: "Your account has been updated successfully."
|
|
47
|
-
updated_but_not_signed_in: "Your account has been updated successfully, but since your password was changed, you need to sign in again"
|
|
47
|
+
updated_but_not_signed_in: "Your account has been updated successfully, but since your password was changed, you need to sign in again."
|
|
48
48
|
sessions:
|
|
49
49
|
signed_in: "Signed in successfully."
|
|
50
50
|
signed_out: "Signed out successfully."
|
|
@@ -36,14 +36,14 @@ module Devise
|
|
|
36
36
|
# before_action ->{ authenticate_blogger! :admin } # Redirects to the admin login page
|
|
37
37
|
# current_blogger :user # Preferably returns a User if one is signed in
|
|
38
38
|
#
|
|
39
|
-
def devise_group(group_name, opts={})
|
|
39
|
+
def devise_group(group_name, opts = {})
|
|
40
40
|
mappings = "[#{ opts[:contains].map { |m| ":#{m}" }.join(',') }]"
|
|
41
41
|
|
|
42
42
|
class_eval <<-METHODS, __FILE__, __LINE__ + 1
|
|
43
|
-
def authenticate_#{group_name}!(
|
|
43
|
+
def authenticate_#{group_name}!(favorite = nil, opts = {})
|
|
44
44
|
unless #{group_name}_signed_in?
|
|
45
45
|
mappings = #{mappings}
|
|
46
|
-
mappings.unshift mappings.delete(
|
|
46
|
+
mappings.unshift mappings.delete(favorite.to_sym) if favorite
|
|
47
47
|
mappings.each do |mapping|
|
|
48
48
|
opts[:scope] = mapping
|
|
49
49
|
warden.authenticate!(opts) if !devise_controller? || opts.delete(:force)
|
|
@@ -57,9 +57,9 @@ module Devise
|
|
|
57
57
|
end
|
|
58
58
|
end
|
|
59
59
|
|
|
60
|
-
def current_#{group_name}(
|
|
60
|
+
def current_#{group_name}(favorite = nil)
|
|
61
61
|
mappings = #{mappings}
|
|
62
|
-
mappings.unshift mappings.delete(
|
|
62
|
+
mappings.unshift mappings.delete(favorite.to_sym) if favorite
|
|
63
63
|
mappings.each do |mapping|
|
|
64
64
|
current = warden.authenticate(scope: mapping)
|
|
65
65
|
return current if current
|
|
@@ -113,7 +113,7 @@ module Devise
|
|
|
113
113
|
mapping = mapping.name
|
|
114
114
|
|
|
115
115
|
class_eval <<-METHODS, __FILE__, __LINE__ + 1
|
|
116
|
-
def authenticate_#{mapping}!(opts={})
|
|
116
|
+
def authenticate_#{mapping}!(opts = {})
|
|
117
117
|
opts[:scope] = :#{mapping}
|
|
118
118
|
warden.authenticate!(opts) if !devise_controller? || opts.delete(:force)
|
|
119
119
|
end
|
|
@@ -252,7 +252,7 @@ module Devise
|
|
|
252
252
|
# Overwrite Rails' handle unverified request to sign out all scopes,
|
|
253
253
|
# clear run strategies and remove cached variables.
|
|
254
254
|
def handle_unverified_request
|
|
255
|
-
super # call the default
|
|
255
|
+
super # call the default behavior which resets/nullifies/raises
|
|
256
256
|
request.env["devise.skip_storage"] = true
|
|
257
257
|
sign_out_all_scopes(false)
|
|
258
258
|
end
|
|
@@ -0,0 +1,35 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
module Devise
|
|
4
|
+
module Controllers
|
|
5
|
+
# Custom Responder to configure default statuses that only apply to Devise,
|
|
6
|
+
# and allow to integrate more easily with Hotwire/Turbo.
|
|
7
|
+
class Responder < ActionController::Responder
|
|
8
|
+
if respond_to?(:error_status=) && respond_to?(:redirect_status=)
|
|
9
|
+
self.error_status = :ok
|
|
10
|
+
self.redirect_status = :found
|
|
11
|
+
else
|
|
12
|
+
# TODO: remove this support for older Rails versions, which aren't supported by Turbo
|
|
13
|
+
# and/or responders. It won't allow configuring a custom response, but it allows Devise
|
|
14
|
+
# to use these methods and defaults across the implementation more easily.
|
|
15
|
+
def self.error_status
|
|
16
|
+
:ok
|
|
17
|
+
end
|
|
18
|
+
|
|
19
|
+
def self.redirect_status
|
|
20
|
+
:found
|
|
21
|
+
end
|
|
22
|
+
|
|
23
|
+
def self.error_status=(*)
|
|
24
|
+
warn "[DEVISE] Setting the error status on the Devise responder has no effect with this " \
|
|
25
|
+
"version of `responders`, please make sure you're using a newer version. Check the changelog for more info."
|
|
26
|
+
end
|
|
27
|
+
|
|
28
|
+
def self.redirect_status=(*)
|
|
29
|
+
warn "[DEVISE] Setting the redirect status on the Devise responder has no effect with this " \
|
|
30
|
+
"version of `responders`, please make sure you're using a newer version. Check the changelog for more info."
|
|
31
|
+
end
|
|
32
|
+
end
|
|
33
|
+
end
|
|
34
|
+
end
|
|
35
|
+
end
|
|
@@ -10,7 +10,7 @@ module Devise
|
|
|
10
10
|
# cause exceptions to be thrown from this method; if you simply want to check
|
|
11
11
|
# if a scope has already previously been authenticated without running
|
|
12
12
|
# authentication hooks, you can directly call `warden.authenticated?(scope: scope)`
|
|
13
|
-
def signed_in?(scope=nil)
|
|
13
|
+
def signed_in?(scope = nil)
|
|
14
14
|
[scope || Devise.mappings.keys].flatten.any? do |_scope|
|
|
15
15
|
warden.authenticate?(scope: _scope)
|
|
16
16
|
end
|
|
@@ -21,7 +21,7 @@ module Devise
|
|
|
21
21
|
# to the set_user method in warden.
|
|
22
22
|
# If you are using a custom warden strategy and the timeoutable module, you have to
|
|
23
23
|
# set `env["devise.skip_timeout"] = true` in the request to use this method, like we do
|
|
24
|
-
# in the sessions controller: https://github.com/heartcombo/devise/blob/
|
|
24
|
+
# in the sessions controller: https://github.com/heartcombo/devise/blob/main/app/controllers/devise/sessions_controller.rb#L7
|
|
25
25
|
#
|
|
26
26
|
# Examples:
|
|
27
27
|
#
|
|
@@ -77,7 +77,7 @@ module Devise
|
|
|
77
77
|
# sign_out :user # sign_out(scope)
|
|
78
78
|
# sign_out @user # sign_out(resource)
|
|
79
79
|
#
|
|
80
|
-
def sign_out(resource_or_scope=nil)
|
|
80
|
+
def sign_out(resource_or_scope = nil)
|
|
81
81
|
return sign_out_all_scopes unless resource_or_scope
|
|
82
82
|
scope = Devise::Mapping.find_scope!(resource_or_scope)
|
|
83
83
|
user = warden.user(scope: scope, run_callbacks: false) # If there is no user
|
|
@@ -92,7 +92,7 @@ module Devise
|
|
|
92
92
|
# Sign out all active users or scopes. This helper is useful for signing out all roles
|
|
93
93
|
# in one click. This signs out ALL scopes in warden. Returns true if there was at least one logout
|
|
94
94
|
# and false if there was no user logged in on all scopes.
|
|
95
|
-
def sign_out_all_scopes(lock=true)
|
|
95
|
+
def sign_out_all_scopes(lock = true)
|
|
96
96
|
users = Devise.mappings.keys.map { |s| warden.user(scope: s, run_callbacks: false) }
|
|
97
97
|
|
|
98
98
|
warden.logout
|
|
@@ -106,10 +106,12 @@ module Devise
|
|
|
106
106
|
private
|
|
107
107
|
|
|
108
108
|
def expire_data_after_sign_in!
|
|
109
|
+
# TODO: remove once Rails 5.2+ and forward are only supported.
|
|
109
110
|
# session.keys will return an empty array if the session is not yet loaded.
|
|
110
111
|
# This is a bug in both Rack and Rails.
|
|
111
112
|
# A call to #empty? forces the session to be loaded.
|
|
112
113
|
session.empty?
|
|
114
|
+
|
|
113
115
|
session.keys.grep(/^devise\./).each { |k| session.delete(k) }
|
|
114
116
|
end
|
|
115
117
|
|
data/lib/devise/failure_app.rb
CHANGED
|
@@ -71,8 +71,11 @@ module Devise
|
|
|
71
71
|
end
|
|
72
72
|
|
|
73
73
|
flash.now[:alert] = i18n_message(:invalid) if is_flashing_format?
|
|
74
|
-
|
|
75
|
-
|
|
74
|
+
self.response = recall_app(warden_options[:recall]).call(request.env).tap { |response|
|
|
75
|
+
response[0] = Rack::Utils.status_code(
|
|
76
|
+
response[0].in?(300..399) ? Devise.responder.redirect_status : Devise.responder.error_status
|
|
77
|
+
)
|
|
78
|
+
}
|
|
76
79
|
end
|
|
77
80
|
|
|
78
81
|
def redirect
|
|
@@ -168,7 +171,7 @@ module Devise
|
|
|
168
171
|
end
|
|
169
172
|
|
|
170
173
|
def skip_format?
|
|
171
|
-
%w(html */*).include? request_format.to_s
|
|
174
|
+
%w(html */* turbo_stream).include? request_format.to_s
|
|
172
175
|
end
|
|
173
176
|
|
|
174
177
|
# Choose whether we should respond in an HTTP authentication fashion,
|