devise 0.1.0

data/MIT-LICENSE

@@ -0,0 +1,20 @@
+Copyright 2009 Plataforma Tecnologia. http://blog.plataformatec.com.br
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.rdoc

@@ -0,0 +1,220 @@
+== Devise
+
+Devise is a flexible authentication solution for Rails based on Warden. It:
+
+* Is Rack based;
+* Is a complete MVC solution based on Rails engines;
+* Allows you to have multiple roles (or models/scopes) signed in at the same time;
+* Is based on a modularity concept: use just what you really need.
+
+Right now it's composed of five mainly modules:
+
+* Authenticable: responsible for encrypting password and validating authenticity of a user while signing in.
+* Confirmable: responsible for verifying whether an account is already confirmed to sign in, and to send emails with confirmation instructions.
+* Recoverable: takes care of reseting the user password and send reset instructions.
+* Rememberable: manages generating and clearing token for remember the user from a saved cookie.
+* Validatable: creates all needed validations for email and password. It's totally optional, so you're able to to customize validations by yourself.
+
+There's an example application using Devise at http://github.com/plataformatec/devise_example .
+
+== Dependencies
+
+Devise is based on Warden (http://github.com/hassox/warden), a Rack Authentication Framework so you need to install it as a gem. Please ensure you have it installed in order to use devise (see instalation below).
+
+== Installation
+
+All gems are on gemcutter, so you need to add gemcutter to your sources if you haven't yet:
+
+  sudo gem sources -a http://gemcutter.org/
+
+Install warden gem if you don't have it installed (requires 0.5.0 or higher):
+
+  sudo gem install warden
+
+Install devise inside your app:
+
+  sudo gem install devise
+
+And you're ready to go.
+
+== Basic Usage
+
+Devise must be setted up within the model (or models) you want to use, and devise routes must be created inside your routes.rb file.
+
+We're assuming here you want a User model. First of all you have to setup a migration with the following fields:
+
+  create_table :users do
+    t.authenticable
+    t.confirmable
+    t.recoverable
+    t.rememberable
+    t.timestamps
+  end
+
+You may also want to add some indexes to improve performance:
+
+  add_index :your_table, :email
+  add_index :your_table, :confirmation_token    # for confirmable
+  add_index :your_table, :reset_password_token  # for recoverable
+
+Now let's setup a User model adding the devise line to have your authentication working:
+
+  class User < ActiveRecord::Base
+    devise
+  end
+
+This line adds devise authenticable automatically for you inside your User class. You could also include the other modules as below:
+
+  # Same as using only devise, authenticable is activated by default
+  devise :authenticable
+
+  # Include authenticable + confirmable
+  devise :confirmable
+
+  # Include authenticable + recoverable
+  devise :recoverable
+
+  # Include authenticable + rememberable modules
+  devise :rememberable
+
+  # Include authenticable + confirmable + recoverable + rememberable + validatable
+  devise :confirmable, :recoverable, :rememberable, :validatable
+
+  # Same as above, include all of them
+  devise :all
+
+  # Include all except recoverable
+  devise :all, :except => :recoverable
+
+Note that validations aren't added by default, so you're able to customize it. In order to have automatic validations working just include :validatable.
+
+In addition to :except, you can provide some options to devise call:
+
+* pepper: setup a pepper to generate de encrypted password. By default no pepper is used:
+
+  devise :all, :pepper => 'my_pepper'
+
+* stretches: configure how many times you want the password is reencrypted.
+
+  devise :all, :stretches => 20
+
+The next step after setting up your model is to configure your routes for devise. You do this by opening up your config/routes.rb and adding:
+
+  map.devise_for :users
+
+This is going to look inside you User model and create the needed routes:
+
+  # Session routes for Authenticable (default)
+       new_user_session GET  /users/sign_in                    {:controller=>"sessions", :action=>"new"}
+           user_session POST /users/sign_in                    {:controller=>"sessions", :action=>"create"}
+   destroy_user_session GET  /users/sign_out                   {:controller=>"sessions", :action=>"destroy"}
+
+  # Password routes for Recoverable, if User model has :recoverable configured
+      new_user_password GET  /users/password/new(.:format)     {:controller=>"passwords", :action=>"new"}
+     edit_user_password GET  /users/password/edit(.:format)    {:controller=>"passwords", :action=>"edit"}
+          user_password PUT  /users/password(.:format)         {:controller=>"passwords", :action=>"update"}
+                        POST /users/password(.:format)         {:controller=>"passwords", :action=>"create"}
+
+  # Confirmation routes for Confirmable, if User model has :confirmable configured
+  new_user_confirmation GET  /users/confirmation/new(.:format) {:controller=>"confirmations", :action=>"new"}
+      user_confirmation GET  /users/confirmation(.:format)     {:controller=>"confirmations", :action=>"show"}
+                        POST /users/confirmation(.:format)     {:controller=>"confirmations", :action=>"create"}
+
+You can run the routes rake task to verify what routes are being created by devise.
+There are also some options available for configuring your routes:
+
+* :class_name => setup a different class to be looked up by devise, if it cannot be correctly find by the route name.
+
+  map.devise_for :users, :class_name => 'Account'
+
+* :as => allows you to setup path name that will be used, as rails routes does. The following route configuration would setup your route as /accounts instead of /users:
+
+  map.devise_for :users, :as => 'accounts'
+
+* :singular => setup the name used to create named routes. By default, for a :users key, it is going to be the singularized version, :user. To configure a named route like account_session_path instead of user_session_path just do:
+
+  map.devise_for :users, :singular => :account
+
+* :path_names => configure different path names to overwrite defaults :sign_in, :sign_out, :password and :confirmation.
+
+  map.devise_for :users, :path_names => { :sign_in => 'login', :sign_out => 'logout', :password => 'secret', :confirmation => 'verification' }
+
+And that is it! Devise is gonna create some helpers to use inside your controllers and views. To setup a controller that needs user authentication, just add this before_filter:
+
+  before_filter :authenticate_user!
+
+To verify if a user is signed in, you have the following helper:
+
+  user_signed_in?
+
+And to get the current signed in user this helper is available:
+
+  current_user
+
+You have also access to the session for this scope:
+
+  user_session
+
+After signing in a user, confirming it's account or updating it's password, devise will look for a scoped root path to redirect. Example: For a :user resource, it will use user_root_path if it exists, otherwise default root_path will be used.
+
+Devise let's you setup as many roles as you want, so let's say you already have this User model and also want an Admin model with the same authentication stuff, but not confirmation or password recovery. Just follow the same steps:
+
+  # Create a migration with the required fields
+  create_table :admins do |t|
+    t.authenticable
+  end
+
+  # Inside your Admin model
+  devise :validatable
+
+  # Inside your routes
+  map.devise_for :admin
+
+  # Inside your protected controller
+  before_filter :authenticate_admin!
+
+  # Inside your controllers and views
+  admin_signed_in?
+  current_admin
+  admin_session
+
+== I18n
+
+Devise check for flash messages using i18n, so you're able to customize them easily. For example, to change the sign in message you should setup your locale file this way:
+
+  en:
+    devise:
+      sessions:
+        signed_in: 'Signed in successfully.'
+
+You can also create distinct messages based on the resource you've configured:
+
+  en:
+    devise:
+      sessions:
+        user:
+          signed_in: 'Welcome user, you are signed in.'
+        admin:
+          signed_in: 'Hello admin!'
+
+Devise notifier uses the same pattern to create subject messages, but it is not able to know what scope you are, he just know the record (ie user instance) that was sent to it. So you need to customize messages based on the model class name (usually the same as the resource name, if you follow basic conventions):
+
+  en:
+    devise:
+      notifier:
+        confirmation_instructions: 'Hello everybody!'
+        user:
+          confirmation_instructions: 'Hello User! Please confirm your email'
+          reset_password_instructions: 'Reset instructions'
+
+Take a look at our locale file to check all available messages.
+
+== TODO
+
+Please refer to TODO file.
+
+== Bugs and Feedback
+
+If you discover any bugs or want to drop a line, feel free to create an issue.
+
+MIT License. Copyright 2009 Plataforma Tecnologia. http://blog.plataformatec.com.br

data/Rakefile

@@ -0,0 +1,45 @@
+# encoding: UTF-8
+
+require 'rake'
+require 'rake/testtask'
+require 'rake/rdoctask'
+require File.join(File.dirname(__FILE__), 'lib', 'devise', 'version')
+
+desc 'Default: run unit tests.'
+task :default => :test
+
+desc 'Test Devise.'
+Rake::TestTask.new(:test) do |t|
+  t.libs << 'lib'
+  t.libs << 'test'
+  t.pattern = 'test/**/*_test.rb'
+  t.verbose = true
+end
+
+desc 'Generate documentation for Devise.'
+Rake::RDocTask.new(:rdoc) do |rdoc|
+  rdoc.rdoc_dir = 'rdoc'
+  rdoc.title    = 'Devise'
+  rdoc.options << '--line-numbers' << '--inline-source'
+  rdoc.rdoc_files.include('README.rdoc')
+  rdoc.rdoc_files.include('lib/**/*.rb')
+end
+
+begin
+  require 'jeweler'
+  Jeweler::Tasks.new do |s|
+    s.name = "devise"
+    s.version = "0.1.0"
+    s.summary = "Flexible authentication solution for Rails with Warden"
+    s.email = "contact@plataformatec.com.br"
+    s.homepage = "http://github.com/plataformatec/devise"
+    s.description = "Flexible authentication solution for Rails with Warden"
+    s.authors = ['José Valim', 'Carlos Antônio']
+    s.files =  FileList["[A-Z]*", "{app,config,lib}/**/*", "init.rb"]
+    s.add_dependency("warden", "~> 0.5.0")
+  end
+
+  Jeweler::GemcutterTasks.new
+rescue LoadError
+  puts "Jeweler, or one of its dependencies, is not available. Install it with: sudo gem install technicalpickles-jeweler -s http://gems.github.com"
+end

data/TODO

@@ -0,0 +1,37 @@
+* Add customizable time frame for remember me
+* Add customizable time frame for confirmation and filters
+
+* Create generators
+* Use request_ip in session cookies
+* Session timeout
+
+* Devise::BruteForceProtection
+* Devise::MagicColumns
+* Devise::Invitable
+
+== Done
+
+* Devise::Authenticable
+* Devise::Confirmable
+* Devise::Recoverable
+* Devise::Validatable
+* Devise::Migratable
+* SessionsController
+* PasswordsController
+* ConfirmationsController
+* Create an example app
+* devise :authenticable, :confirmable, :recoverable for ActiveRecord
+* Allow multiple models per controller
+* Add mappings
+* Use sign_in and sign_out in SessionsController
+* Use path_names in routes
+* Store session[:return_to] in session
+* Clear perishable_token in :confirmable and :recoverable
+* Remove perishable token and create attributes for confirmation_token and reset_password_token
+* Add confirmation_sent_at for confirmable
+* Add confirmable filters
+* Sign user in automatically after confirming or changing it's password
+
+* Add remember me
+* Mailer subjects namespaced by model
+* Allow stretches and pepper per model

data/app/controllers/confirmations_controller.rb

@@ -0,0 +1,32 @@
+class ConfirmationsController < ApplicationController
+  before_filter :is_devise_resource?
+
+  # GET /resource/confirmation/new
+  def new
+  end
+
+  # POST /resource/confirmation
+  def create
+    self.resource = resource_class.send_confirmation_instructions(params[resource_name])
+
+    if resource.errors.empty?
+      set_flash_message :success, :send_instructions
+      redirect_to new_session_path(resource_name)
+    else
+      render :new
+    end
+  end
+
+  # GET /resource/confirmation?perishable_token=abcdef
+  def show
+    self.resource = resource_class.confirm!(:confirmation_token => params[:confirmation_token])
+
+    if resource.errors.empty?
+      sign_in(resource_name, resource)
+      set_flash_message :success, :confirmed
+      redirect_to home_or_root_path
+    else
+      render :new
+    end
+  end
+end

data/app/controllers/passwords_controller.rb

@@ -0,0 +1,38 @@
+class PasswordsController < ApplicationController
+  before_filter :is_devise_resource?, :require_no_authentication
+
+  # GET /resource/password/new
+  def new
+  end
+
+  # POST /resource/password
+  def create
+    self.resource = resource_class.send_reset_password_instructions(params[resource_name])
+
+    if resource.errors.empty?
+      set_flash_message :success, :send_instructions
+      redirect_to new_session_path(resource_name)
+    else
+      render :new
+    end
+  end
+
+  # GET /resource/password/edit?perishable_token=abcdef
+  def edit
+    self.resource = resource_class.new
+    resource.reset_password_token = params[:reset_password_token]
+  end
+
+  # PUT /resource/password
+  def update
+    self.resource = resource_class.reset_password!(params[resource_name])
+
+    if resource.errors.empty?
+      sign_in(resource_name, resource)
+      set_flash_message :success, :updated
+      redirect_to home_or_root_path
+    else
+      render :edit
+    end
+  end
+end

data/app/controllers/sessions_controller.rb

@@ -0,0 +1,35 @@
+class SessionsController < ApplicationController
+  before_filter :is_devise_resource?
+  before_filter :require_no_authentication, :only => [ :new, :create ]
+
+  # GET /resource/sign_in
+  def new
+    unauthenticated! if params[:unauthenticated]
+  end
+
+  # POST /resource/sign_in
+  def create
+    if authenticate(resource_name)
+      set_flash_message :success, :signed_in
+      redirect_back_or_to home_or_root_path
+    else
+      unauthenticated!
+      render :new
+    end
+  end
+
+  # GET /resource/sign_out
+  def destroy
+    set_flash_message :success, :signed_out if signed_in?(resource_name)
+    sign_out(resource_name)
+    redirect_to root_path
+  end
+
+  protected
+
+    def unauthenticated!
+      flash.now[:failure] = I18n.t(:"#{resource_name}.unauthenticated",
+                                   :scope => [:devise, :sessions], :default => :unauthenticated)
+    end
+
+end

data/app/models/notifier.rb

@@ -0,0 +1,47 @@
+class Notifier < ::ActionMailer::Base
+  cattr_accessor :sender
+
+  # Deliver confirmation instructions when the user is created or its email is
+  # updated, and also when confirmation is manually requested
+  def confirmation_instructions(record)
+    setup_mail(record, :confirmation_instructions)
+  end
+
+  # Deliver reset password instructions when manually requested
+  def reset_password_instructions(record)
+    setup_mail(record, :reset_password_instructions)
+  end
+
+  private
+
+    # Configure default email options
+    def setup_mail(record, key)
+      subject      translate(record, key)
+      from         self.class.sender
+      recipients   record.email
+      sent_on      Time.now
+      content_type 'text/html'
+      body         underscore_name(record) => record, :resource => record
+    end
+
+    # Setup subject namespaced by model. It means you're able to setup your
+    # messages using specific resource scope, or provide a default one.
+    # Example (i18n locale file):
+    #
+    #   en:
+    #     devise:
+    #       notifier:
+    #         confirmation_instructions: '...'
+    #         user:
+    #           notifier:
+    #             confirmation_instructions: '...'
+    def translate(record, key)
+      I18n.t(:"#{underscore_name(record)}.#{key}",
+             :scope => [:devise, :notifier],
+             :default => key)
+    end
+
+    def underscore_name(record)
+      @underscore_name ||= record.class.name.underscore.to_sym
+    end
+end