devise 0.4.3 → 0.5.0

data/CHANGELOG.rdoc

@@ -1,3 +1,13 @@
+== 0.5.0
+
+* bug fix
+  * Fixed a bug where remember me module was not working properly
+
+* enhancements
+  * Moved encryption strategy into the Encryptors module to allow several algorithms (by github.com/mhfs)
+  * Implemented encryptors for Clearance, Authlogic and Restful-Authentication (by github.com/mhfs)
+  * Added support for MongoMapper (by github.com/shingara)
+
 == 0.4.3
 
 * bug fix

data/README.rdoc

@@ -27,7 +27,7 @@ All gems are on gemcutter, so you need to add gemcutter to your sources if you h
 
   sudo gem sources -a http://gemcutter.org/
 
-Install warden gem if you don't have it installed (requires 0.5.1 or higher):
+Install warden gem if you don't have it installed (requires 0.5.2 or higher):
 
   sudo gem install warden
 
@@ -228,10 +228,26 @@ Devise mailer uses the same pattern to create subject messages:
 
 Take a look at our locale file to check all available messages.
 
+== Migrating from other solutions
+
+Devise implements encryption strategies for Clearance, Authlogic and Restful-Authentication. To make use of it set the desired encryptor in the encryptor initializer config option. You might also need to rename your encrypted password and salt columns to match Devises's one (encrypted_password and password_salt).
+
+== Other ORMs
+
+Devise was made to work from scratch with ActiveRecord. However it currently supports MongoMapper as well.
+To use it, just set Devise.orm or configure it in the initialization file (which is created with devise_install).
+
 == TODO
 
 Please refer to TODO file.
 
+== Contributors
+
+* José Valim (http://github.com/josevalim)
+* Carlos Antônio da Silva (http://github.com/carlosantoniodasilva)
+* Marcelo Silveira (http://github.com/mhfs)
+* Cyril Mougel (http://github.com/shingara)
+
 == Bugs and Feedback
 
 If you discover any bugs or want to drop a line, feel free to create an issue on

data/TODO

@@ -1,8 +1,6 @@
+* Allow authentication keys to be configured, so things like username and subdomain can be used
 * Devise::Timeoutable
 * Devise::TestHelper
 * Use request_ip in session cookies
 * Devise::BruteForceProtection
 * Devise::MagicColumns
-* Improve Generators to pass modules as arguments
-* Different cryptography providers
-* Devise::Invitable

data/app/controllers/confirmations_controller.rb

@@ -18,7 +18,7 @@ class ConfirmationsController < ApplicationController
     end
   end
 
-  # GET /resource/confirmation?perishable_token=abcdef
+  # GET /resource/confirmation?confirmation_token=abcdef
   def show
     self.resource = resource_class.confirm!(:confirmation_token => params[:confirmation_token])
 

data/app/controllers/passwords_controller.rb

@@ -20,7 +20,7 @@ class PasswordsController < ApplicationController
     end
   end
 
-  # GET /resource/password/edit?perishable_token=abcdef
+  # GET /resource/password/edit?reset_password_token=abcdef
   def edit
     self.resource = resource_class.new
     resource.reset_password_token = params[:reset_password_token]

data/generators/devise/templates/migration.rb

@@ -1,7 +1,7 @@
 class DeviseCreate<%= table_name.camelize %> < ActiveRecord::Migration
   def self.up
     create_table(:<%= table_name %>) do |t|
-      t.authenticatable
+      t.authenticatable :encryptor => :sha1
       t.confirmable
       t.recoverable
       t.rememberable

data/generators/devise_install/templates/devise.rb

@@ -8,6 +8,13 @@ Devise.setup do |config|
   # Configure how many times you want the password is reencrypted. Default is 10.
   # config.stretches = 10
 
+  # Define which will be the encryption algorithm. Supported algorithms are :sha1
+  # (default) and :sha512. Devise also supports encryptors from others authentication
+  # frameworks as :clearance_sha1, :authlogic_sha512 (then you should set stretches
+  # above to 20 for default behavior) and :restful_authentication_sha1 (then you
+  # should set stretches to 10, and copy REST_AUTH_SITE_KEY to pepper)
+  # config.encryptor = :sha1
+
   # The time you want give to your user to confirm his account. During this time
   # he will be able to access your application without confirming. Default is nil.
   # config.confirm_within = 2.days
@@ -18,6 +25,9 @@ Devise.setup do |config|
   # Configure the e-mail address which will be shown in DeviseMailer.
   # config.mailer_sender = "foo.bar@yourapp.com"
 
+  # Configure the ORM. Supports :active_record and :mongo_mapper
+  # config.orm = :active_record
+
   # If you want to use other strategies, that are not (yet) supported by Devise,
   # you can configure them inside the config.warden block. The example below
   # allows you to setup OAuth, using http://github.com/roman/warden_oauth

data/lib/devise.rb

@@ -8,7 +8,7 @@ module Devise
     :confirmations => :confirmable
   }.freeze
 
-  STRATEGIES  = [:rememberable, :authenticatable].freeze
+  STRATEGIES  = [:authenticatable].freeze
   TRUE_VALUES = [true, 1, '1', 't', 'T', 'true', 'TRUE'].freeze
 
   # Maps the messages types that comes from warden to a flash type.
@@ -18,26 +18,50 @@ module Devise
     :unconfirmed => :failure
   }
 
+  # Declare encryptors length which are used in migrations.
+  ENCRYPTORS_LENGTH = {
+    :sha1   => 40,
+    :sha512 => 128,
+    :clearance_sha1 => 40,
+    :restful_authentication_sha1 => 40,
+    :authlogic_sha512 => 128
+  }
+
   # Used to encrypt password. Please generate one with rake secret
   mattr_accessor :pepper
   @@pepper = nil
-  
+
   # The number of times to encrypt password.
   mattr_accessor :stretches
   @@stretches = 10
-  
+
   # Time interval where the remember me token is valid.
   mattr_accessor :remember_for
   @@remember_for = 2.weeks
-  
+
   # Time interval you can access your account before confirming your account.
   mattr_accessor :confirm_within
   @@confirm_within = 0.days
 
+  # Used to define the password encryption algorithm.
+  def self.encryptor=(value)
+    @@encryptor = if value.is_a?(Symbol)
+      ::Devise::Encryptors.const_get(value.to_s.classify)
+    else
+      value
+    end
+  end
+  mattr_reader :encryptor
+  @@encryptor = ::Devise::Encryptors::Sha1
+
   # Store scopes mappings.
   mattr_accessor :mappings
   @@mappings = {}
 
+  # Stores the chosen ORM.
+  mattr_accessor :orm
+  @@orm = :active_record
+
   class << self
     # Default way to setup Devise. Run script/generate devise_install to create
     # a fresh initializer with all configuration values.
@@ -86,6 +110,11 @@ module Devise
       # If the user provided a warden hook, call it now.
       @warden_config.try :call, manager
     end
+
+    # The class of the configured ORM
+    def orm_class
+      Devise::Orm.const_get(@@orm.to_s.camelize.to_sym)
+    end
   end
 end
 

data/lib/devise/encryptors/authlogic_sha512.rb

@@ -0,0 +1,28 @@
+require "digest/sha2"
+
+module Devise
+  # Implements a way of adding different encryptions.
+  # The class should implement a self.digest method that taks the following params:
+  #   - password
+  #   - stretches: the number of times the encryption will be applied
+  #   - salt: the password salt as defined by devise
+  #   - pepper: Devise config option
+  #
+  module Encryptors
+    # = AuthlogicSha512
+    # Simulates Authlogic's default encryption mechanism.
+    # Warning: it uses Devise's stretches configuration to port Authlogic's one. Should be set to 20 in the initializer to silumate
+    #  the default behavior.
+    class AuthlogicSha512
+      
+      # Gererates a default password digest based on salt, pepper and the
+      # incoming password.
+      def self.digest(password, stretches, salt, pepper)
+        digest = [password, salt].flatten.join('')
+        stretches.times { digest = Digest::SHA512.hexdigest(digest) }
+        digest
+      end
+
+    end
+  end
+end

data/lib/devise/encryptors/clearance_sha1.rb

@@ -0,0 +1,26 @@
+require "digest/sha1"
+
+module Devise
+  # Implements a way of adding different encryptions.
+  # The class should implement a self.digest method that taks the following params:
+  #   - password
+  #   - stretches: the number of times the encryption will be applied
+  #   - salt: the password salt as defined by devise
+  #   - pepper: Devise config option
+  #
+  module Encryptors
+    # = ClearanceSha1
+    # Simulates Clearance's default encryption mechanism.
+    # Warning: it uses Devise's pepper to port the concept of REST_AUTH_SITE_KEY
+    # Warning: it uses Devise's stretches configuration to port the concept of REST_AUTH_DIGEST_STRETCHES
+    class ClearanceSha1
+      
+      # Gererates a default password digest based on salt, pepper and the
+      # incoming password.
+      def self.digest(password, stretches, salt, pepper)
+        Digest::SHA1.hexdigest("--#{salt}--#{password}--")
+      end
+
+    end
+  end
+end

data/lib/devise/encryptors/restful_authentication_sha1.rb

@@ -0,0 +1,29 @@
+require "digest/sha1"
+
+module Devise
+  # Implements a way of adding different encryptions.
+  # The class should implement a self.digest method that taks the following params:
+  #   - password
+  #   - stretches: the number of times the encryption will be applied
+  #   - salt: the password salt as defined by devise
+  #   - pepper: Devise config option
+  #
+  module Encryptors
+    # = RestfulAuthenticationSha1
+    # Simulates Restful Authentication's default encryption mechanism.
+    # Warning: it uses Devise's pepper to port the concept of REST_AUTH_SITE_KEY
+    # Warning: it uses Devise's stretches configuration to port the concept of REST_AUTH_DIGEST_STRETCHES. Should be set to 10 in 
+    # the initializer to silumate the default behavior.
+    class RestfulAuthenticationSha1
+      
+      # Gererates a default password digest based on salt, pepper and the
+      # incoming password.
+      def self.digest(password, stretches, salt, pepper)
+        digest = pepper
+        stretches.times { digest = Digest::SHA1.hexdigest([digest, salt, password, pepper].flatten.join('--')) }
+        digest
+      end
+
+    end
+  end
+end

data/lib/devise/encryptors/sha1.rb

@@ -0,0 +1,34 @@
+require "digest/sha1"
+
+module Devise
+  # Implements a way of adding different encryptions.
+  # The class should implement a self.digest method that taks the following params:
+  #   - password
+  #   - stretches: the number of times the encryption will be applied
+  #   - salt: the password salt as defined by devise
+  #   - pepper: Devise config option
+  #
+  module Encryptors
+    # = Sha1
+    # Uses the Sha1 hash algorithm to encrypt passwords.
+    class Sha1
+      
+      # Gererates a default password digest based on stretches, salt, pepper and the
+      # incoming password.
+      def self.digest(password, stretches, salt, pepper)
+        digest = pepper
+        stretches.times { digest = self.secure_digest(salt, digest, password, pepper) }
+        digest
+      end
+
+      private
+
+        # Generate a SHA1 digest joining args. Generated token is something like
+        #   --arg1--arg2--arg3--argN--
+        def self.secure_digest(*tokens)
+          ::Digest::SHA1.hexdigest('--' << tokens.flatten.join('--') << '--')
+        end        
+      
+    end
+  end
+end

data/lib/devise/encryptors/sha512.rb

@@ -0,0 +1,34 @@
+require "digest/sha2"
+
+module Devise
+  # Implements a way of adding different encryptions.
+  # The class should implement a self.digest method that taks the following params:
+  #   - password
+  #   - stretches: the number of times the encryption will be applied
+  #   - salt: the password salt as defined by devise
+  #   - pepper: Devise config option
+  #
+  module Encryptors
+    # = Sha512
+    # Uses the Sha512 hash algorithm to encrypt passwords.
+    class Sha512
+      
+      # Gererates a default password digest based on salt, pepper and the
+      # incoming password.
+      def self.digest(password, stretches, salt, pepper)
+        digest = pepper
+        stretches.times { digest = self.secure_digest(salt, digest, password, pepper) }
+        digest
+      end
+
+      private
+
+        # Generate a Sha512 digest joining args. Generated token is something like
+        #   --arg1--arg2--arg3--argN--
+        def self.secure_digest(*tokens)
+          ::Digest::SHA512.hexdigest('--' << tokens.flatten.join('--') << '--')
+        end        
+      
+    end
+  end
+end

data/lib/devise/hooks/confirmable.rb

@@ -2,10 +2,10 @@
 # This is done by checking the time frame the user is able to sign in without
 # confirming it's account. If the user has not confirmed it's account during
 # this time frame, he/she will not able to sign in anymore.
-Warden::Manager.after_set_user do |record, auth, options|
+Warden::Manager.after_set_user do |record, warden, options|
   if record && record.respond_to?(:active?) && !record.active?
     scope = options[:scope]
-    auth.logout(scope)
+    warden.logout(scope)
     throw :warden, :scope => scope, :params => { :unconfirmed => true }
   end
 end

data/lib/devise/hooks/rememberable.rb

@@ -3,15 +3,17 @@
 # that specific user and adds a cookie with this user info to sign in this user
 # automatically without asking for credentials. Refer to rememberable strategy
 # for more info.
-Warden::Manager.after_authentication do |record, auth, options|
+Warden::Manager.after_authentication do |record, warden, options|
   scope = options[:scope]
-  remember_me = auth.params[scope].try(:fetch, :remember_me, nil)
+  remember_me = warden.params[scope].try(:fetch, :remember_me, nil)
 
   if Devise::TRUE_VALUES.include?(remember_me) && record.respond_to?(:remember_me!)
     record.remember_me!
-    auth.cookies['remember_token'] = {
+
+    warden.response.set_cookie "remember_#{scope}_token", {
       :value => record.class.serialize_into_cookie(record),
-      :expires => record.remember_expires_at
+      :expires => record.remember_expires_at,
+      :path => "/"
     }
   end
 end
@@ -19,9 +21,9 @@ end
 # Before logout hook to forget the user in the given scope, only if rememberable
 # is activated for this scope. Also clear remember token to ensure the user
 # won't be remembered again.
-Warden::Manager.before_logout do |record, auth, scope|
+Warden::Manager.before_logout do |record, warden, scope|
   if record.respond_to?(:forget_me!)
     record.forget_me!
-    auth.cookies.delete('remember_token')
+    warden.response.delete_cookie "remember_#{scope}_token"
   end
 end

data/lib/devise/mapping.rb

@@ -22,7 +22,7 @@ module Devise
   #   # is the modules included in the class
   #
   class Mapping #:nodoc:
-    attr_reader :name, :as, :path_names, :path_prefix
+    attr_reader :name, :as, :path_names, :path_prefix, :route_options
 
     # Loop through all mappings looking for a map that matches with the requested
     # path (ie /users/sign_in). If a path prefix is given, it's taken into account.
@@ -40,14 +40,13 @@ module Devise
     end
 
     def initialize(name, options) #:nodoc:
-      options.assert_valid_keys(:class_name, :as, :path_names, :singular, :path_prefix)
-
-      @as    = (options[:as] || name).to_sym
-      @klass = (options[:class_name] || name.to_s.classify).to_s
-      @name  = (options[:singular] || name.to_s.singularize).to_sym
-      @path_names  = options[:path_names] || {}
-      @path_prefix = options[:path_prefix] || ""
+      @as    = (options.delete(:as) || name).to_sym
+      @klass = (options.delete(:class_name) || name.to_s.classify).to_s
+      @name  = (options.delete(:singular) || name.to_s.singularize).to_sym
+      @path_names  = options.delete(:path_names) || {}
+      @path_prefix = options.delete(:path_prefix) || ""
       @path_prefix << "/" unless @path_prefix[-1] == ?/
+      @route_options = options || {}
 
       setup_path_names
     end

data/lib/devise/middlewares/rememberable.rb

@@ -0,0 +1,35 @@
+module Devise
+  module Middlewares
+    class Rememberable
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        auth = env['warden']
+        scopes = select_cookies(auth.request)
+        scopes.each do |scope, token|
+          mapping = Devise.mappings[scope]
+          next unless mapping && mapping.for.include?(:rememberable)
+          user = mapping.to.serialize_from_cookie(token)
+          auth.set_user(user, :scope => scope) if user
+        end
+
+        @app.call(env)
+      end
+
+      protected
+
+        def select_cookies(request)
+          scopes = {}
+          matching = /remember_(#{Devise.mappings.keys.join("|")})_token/
+          request.cookies.each do |key, value|
+            if key.to_s =~ matching
+              scopes[$1.to_sym] = value
+            end
+          end
+          scopes
+        end
+    end
+  end
+end

data/lib/devise/models.rb

@@ -92,6 +92,9 @@ module Devise
 
       # Convert new keys to methods which overwrites Devise defaults
       options.each { |key, value| send(:"#{key}=", value) }
+
+      # Call specific hooks for each ORM
+      Devise.orm_class.included_modules_hook(self, devise_modules)
     end
 
     # Stores all modules included inside the model, so we are able to verify

data/lib/devise/models/authenticatable.rb

@@ -1,4 +1,3 @@
-require 'digest/sha1'
 require 'devise/strategies/authenticatable'
 
 module Devise
@@ -49,22 +48,12 @@ module Devise
       end
 
       protected
-
-        # Gererates a default password digest based on salt, pepper and the
-        # incoming password.
-        def password_digest(password_to_digest)
-          digest = pepper
-          stretches.times { digest = secure_digest(password_salt, digest, password_to_digest, pepper) }
-          digest
-        end
-
-        # Generate a SHA1 digest joining args. Generated token is something like
-        #
-        #   --arg1--arg2--arg3--argN--
-        def secure_digest(*tokens)
-          ::Digest::SHA1.hexdigest('--' << tokens.flatten.join('--') << '--')
+      
+        # Digests the password using the configured encryptor
+        def password_digest(password)
+          encryptor.digest(password, stretches, password_salt, pepper)
         end
-
+      
         # Generate a friendly string randomically to be used as token.
         def friendly_token
           ActiveSupport::SecureRandom.base64(15).tr('+/=', '-_ ').strip.delete("\n")
@@ -92,6 +81,7 @@ module Devise
 
       Devise::Models.config(self, :pepper)
       Devise::Models.config(self, :stretches)
+      Devise::Models.config(self, :encryptor)
     end
   end
 end

data/lib/devise/models/rememberable.rb

@@ -1,6 +1,6 @@
 require 'digest/sha1'
 require 'devise/hooks/rememberable'
-require 'devise/strategies/rememberable'
+require 'devise/middlewares/rememberable'
 
 module Devise
   module Models

data/lib/devise/orm/active_record.rb

@@ -0,0 +1,37 @@
+module Devise
+  module Orm
+    # This module contains some helpers and handle schema (migrations):
+    #
+    #   create_table :accounts do |t|
+    #     t.authenticatable
+    #     t.confirmable
+    #     t.recoverable
+    #     t.rememberable
+    #     t.timestamps
+    #   end
+    #
+    # However this method does not add indexes. If you need them, here is the declaration:
+    #
+    #   add_index "accounts", ["email"],                :name => "email",                :unique => true
+    #   add_index "accounts", ["confirmation_token"],   :name => "confirmation_token",   :unique => true
+    #   add_index "accounts", ["reset_password_token"], :name => "reset_password_token", :unique => true
+    #
+    module ActiveRecord
+      # Required ORM hook. By default, do nothing on ActiveRecord.
+      def self.included_modules_hook(klass, modules)
+      end
+
+      include Devise::Schema
+
+      # Tell how to apply schema methods.
+      def apply_schema(name, type, options={})
+        column name, type.to_s.downcase.to_sym, options
+      end
+    end
+  end
+end
+
+if defined?(ActiveRecord)
+  ActiveRecord::Base.extend Devise::Models
+  ActiveRecord::ConnectionAdapters::TableDefinition.send :include, Devise::Orm::ActiveRecord
+end

data/lib/devise/orm/mongo_mapper.rb

@@ -0,0 +1,23 @@
+module Devise
+  module Orm
+    module MongoMapper
+      # Include attributes modules and set the proper ones.
+      def self.included_modules_hook(klass, modules)
+        klass.send :extend, self
+
+        modules.each do |mod|
+          klass.send(mod)
+        end
+      end
+
+      include Devise::Schema
+
+      # Tell how to apply schema methods.
+      def apply_schema(name, type, options={})
+        key name, type, options
+      end
+    end
+  end
+end
+
+MongoMapper::Document::ClassMethods.send(:include, Devise::Models)

data/lib/devise/rails.rb

@@ -2,10 +2,7 @@ require 'devise/rails/routes'
 require 'devise/rails/warden_compat'
 
 Rails.configuration.after_initialize do
-  if defined?(ActiveRecord)
-    ActiveRecord::Base.extend Devise::Models
-    ActiveRecord::ConnectionAdapters::TableDefinition.send :include, Devise::Migrations
-  end
+  require "devise/orm/#{Devise.orm}"
 
   # Adds Warden Manager to Rails middleware stack, configuring default devise
   # strategy and also the failure app.
@@ -13,5 +10,8 @@ Rails.configuration.after_initialize do
     Devise.configure_warden_manager(manager)
   end
 
+  # If using a rememberable module, include the middleware that log users.
+  Rails.configuration.middleware.use Devise::Middlewares::Rememberable
+
   I18n.load_path.unshift File.expand_path(File.join(File.dirname(__FILE__), 'locales', 'en.yml'))
 end

data/lib/devise/rails/routes.rb

@@ -64,6 +64,10 @@ module ActionController::Routing
       #
       #    map.devise_for :users, :path_prefix => "/:locale"
       #
+      #  Any other options will be passed to route definition. If you need conditions for your routes, just map:
+      #
+      #    map.devise_for :users, :conditions => { :subdomain => /.+/ }
+      #
       #  If you are using a dynamic prefix, like :locale above, you need to configure default_url_options through Devise. You can do that in config/initializers/devise.rb or setting a Devise.default_url_options:
       #
       #    Devise.default_url_options do
@@ -75,10 +79,12 @@ module ActionController::Routing
 
         resources.map!(&:to_sym)
         resources.each do |resource|
-          mapping = Devise::Mapping.new(resource, options)
+          mapping = Devise::Mapping.new(resource, options.dup)
           Devise.mappings[mapping.name] = mapping
 
-          with_options(:path_prefix => mapping.raw_path, :name_prefix => "#{mapping.name}_") do |routes|
+          route_options = mapping.route_options.merge(:path_prefix => mapping.raw_path, :name_prefix => "#{mapping.name}_")
+
+          with_options(route_options) do |routes|
             mapping.for.each do |strategy|
               send(strategy, routes, mapping) if self.respond_to?(strategy, true)
             end

data/lib/devise/rails/warden_compat.rb

@@ -1,6 +1,5 @@
 # Taken from RailsWarden, thanks to Hassox. http://github.com/hassox/rails_warden
 module Warden::Mixins::Common
-  # Gets the rails request object by default if it's available
   def request
     return @request if @request
     if env['action_controller.rescue.request']
@@ -19,8 +18,12 @@ module Warden::Mixins::Common
     raw_session.clear
   end
 
-  # Proxy to request cookies
-  def cookies
-    request.cookies
+  def response
+    return @response if @response
+    if env['action_controller.rescue.response']
+      @response = env['action_controller.rescue.response']
+    else
+      Rack::Response.new(env)
+    end
   end
 end

data/lib/devise/schema.rb

@@ -0,0 +1,43 @@
+module Devise
+  # Holds devise schema information. To use it, just include its methods
+  # and overwrite the apply_schema method.
+  module Schema
+
+    # Creates email, encrypted_password and password_salt.
+    #
+    # == Options
+    # * :null when true, allow columns to be null
+    # * :encryptor The encryptor going to be used, necessary for setting the proper encrypter password length
+    def authenticatable(options={})
+      null = options[:null] || false
+      encryptor = options[:encryptor] || :sha1
+
+      apply_schema :email,              String, :null => null, :limit => 100
+      apply_schema :encrypted_password, String, :null => null, :limit => Devise::ENCRYPTORS_LENGTH[encryptor]
+      apply_schema :password_salt,      String, :null => null, :limit => 20
+    end
+
+    # Creates confirmation_token, confirmed_at and confirmation_sent_at.
+    def confirmable
+      apply_schema :confirmation_token,   String, :limit => 20
+      apply_schema :confirmed_at,         DateTime
+      apply_schema :confirmation_sent_at, DateTime
+    end
+
+    # Creates reset_password_token.
+    def recoverable
+      apply_schema :reset_password_token, String, :limit => 20
+    end
+
+    # Creates remember_token and remember_created_at.
+    def rememberable
+      apply_schema :remember_token,      String, :limit => 20
+      apply_schema :remember_created_at, DateTime
+    end
+
+    # Overwrite with specific modification to create your own schema.
+    def apply_schema(name, tupe, options={})
+      raise NotImplementedError
+    end
+  end
+end

data/lib/devise/version.rb

@@ -1,3 +1,3 @@
 module Devise
-  VERSION = "0.4.3".freeze
+  VERSION = "0.5.0".freeze
 end

data/test/devise_test.rb

@@ -50,7 +50,7 @@ class DeviseTest < ActiveSupport::TestCase
     Devise.configure_warden_manager(manager)
 
     assert_equal Devise::Failure, manager.failure_app
-    assert_equal [:rememberable, :authenticatable], manager.default_strategies
+    assert_equal [:authenticatable], manager.default_strategies
     assert manager.silence_missing_strategies
   end
 

data/test/encryptors_test.rb

@@ -0,0 +1,28 @@
+class Encryptors < ActiveSupport::TestCase
+
+  test 'should match a password created by authlogic' do
+    authlogic = "b623c3bc9c775b0eb8edb218a382453396fec4146422853e66ecc4b6bc32d7162ee42074dcb5f180a770dc38b5df15812f09bbf497a4a1b95fe5e7d2b8eb7eb4"
+    encryptor = Devise::Encryptors::AuthlogicSha512.digest('123mudar', 20, 'usZK_z_EAaF61Gwkw-ed', '')
+    assert_equal authlogic, encryptor
+  end
+
+  test 'should match a password created by restful_authentication' do
+    restful_authentication = "93110f71309ce91366375ea44e2a6f5cc73fa8d4"
+    encryptor = Devise::Encryptors::RestfulAuthenticationSha1.digest('123mudar', 10, '48901d2b247a54088acb7f8ea3e695e50fe6791b', 'fee9a51ec0a28d11be380ca6dee6b4b760c1a3bf')
+    assert_equal restful_authentication, encryptor
+  end
+
+  test 'should match a password created by clearance' do
+    clearance = "0f40bbae18ddefd7066276c3ef209d40729b0378"
+    encryptor = Devise::Encryptors::ClearanceSha1.digest('123mudar', nil, '65c58472c207c829f28c68619d3e3aefed18ab3f', nil)
+    assert_equal clearance, encryptor
+  end
+
+  Devise::ENCRYPTORS_LENGTH.each do |key, value|
+    test "should have length #{value} for #{key.inspect}" do
+      swap Devise, :encryptor => key do
+        assert_equal value, Devise.encryptor.digest('a', 2, 'b', 'c').size
+      end
+    end
+  end
+end

data/test/integration/rememberable_test.rb

@@ -6,19 +6,17 @@ class RememberMeTest < ActionController::IntegrationTest
     Devise.remember_for = 1
     user = create_user
     user.remember_me!
-    cookies['remember_token'] = User.serialize_into_cookie(user) + add_to_token
+    cookies['remember_user_token'] = User.serialize_into_cookie(user) + add_to_token
     user
   end
 
   test 'do not remember the user if he has not checked remember me option' do
     user = sign_in_as_user
-
     assert_nil user.reload.remember_token
   end
 
   test 'generate remember token after sign in' do
     user = sign_in_as_user :remember_me => true
-
     assert_not_nil user.reload.remember_token
   end
 

data/test/mapping_test.rb

@@ -85,6 +85,14 @@ class MappingTest < ActiveSupport::TestCase
     end
   end
 
+  test 'should have default route options' do
+    assert_equal({}, Devise.mappings[:user].route_options)
+  end
+
+  test 'should allow passing route options to devise routes' do
+    assert_equal({ :requirements => { :extra => 'value' } }, Devise.mappings[:manager].route_options)
+  end
+
   test 'magic predicates' do
     mapping = Devise.mappings[:user]
     assert mapping.authenticatable?

data/test/models/authenticatable_test.rb

@@ -3,10 +3,8 @@ require 'digest/sha1'
 
 class AuthenticatableTest < ActiveSupport::TestCase
 
-  def encrypt_password(user, pepper=nil, stretches=1)
-    user.class_eval { define_method(:stretches) { stretches } } if stretches
-    user.password = '123456'
-    ::Digest::SHA1.hexdigest("--#{user.password_salt}--#{pepper}--123456--#{pepper}--")
+  def encrypt_password(user, pepper=User.pepper, stretches=User.stretches, encryptor = ::Devise::Encryptors::Sha1)
+    encryptor.digest('123456', stretches, user.password_salt, pepper)
   end
 
   test 'should respond to password and password confirmation' do
@@ -59,7 +57,7 @@ class AuthenticatableTest < ActiveSupport::TestCase
     assert_not_equal encrypted_password, user.encrypted_password
   end
 
-  test 'should encrypt password using a sha1 hash' do
+  test 'should fallback to Sha1 as default encryption' do
     user = new_user
     assert_equal encrypt_password(user), user.encrypted_password
   end
@@ -69,12 +67,15 @@ class AuthenticatableTest < ActiveSupport::TestCase
       Devise.pepper = ''
       user = new_user
       assert_equal encrypt_password(user), user.encrypted_password
+      assert_not_equal encrypt_password(user, 'another_pepper'), user.encrypted_password
       Devise.pepper = 'new_pepper'
       user = new_user
       assert_equal encrypt_password(user, 'new_pepper'), user.encrypted_password
+      assert_not_equal encrypt_password(user, 'another_pepper'), user.encrypted_password
       Devise.pepper = '123456'
       user = new_user
       assert_equal encrypt_password(user, '123456'), user.encrypted_password
+      assert_not_equal encrypt_password(user, 'another_pepper'), user.encrypted_password
     ensure
       Devise.pepper = nil
     end
@@ -85,11 +86,22 @@ class AuthenticatableTest < ActiveSupport::TestCase
       default_stretches = Devise.stretches
       Devise.stretches = 1
       user = new_user
-      assert_equal encrypt_password(user, nil, nil), user.encrypted_password
+      assert_equal encrypt_password(user, nil, 1), user.encrypted_password
+      assert_not_equal encrypt_password(user, nil, 2), user.encrypted_password
     ensure
       Devise.stretches = default_stretches
     end
   end
+  
+  test 'should respect encryptor configuration' do
+    begin 
+      Devise.encryptor = ::Devise::Encryptors::Sha512
+      user = create_user
+      assert_equal user.encrypted_password, encrypt_password(user, User.pepper, User.stretches, ::Devise::Encryptors::Sha512)
+    ensure
+      Devise.encryptor = ::Devise::Encryptors::Sha1
+    end
+  end
 
   test 'should test for a valid password' do
     user = create_user

data/test/rails_app/config/routes.rb

@@ -4,7 +4,9 @@ ActionController::Routing::Routes.draw do |map|
   map.devise_for :account, :path_names => {
     :sign_in => 'login', :sign_out => 'logout', :password => 'secret', :confirmation => 'verification'
   }
-  map.devise_for :organizers, :singular => 'manager', :path_prefix => '/:locale'
+  map.devise_for :organizers, :singular => 'manager',
+                              :path_prefix => '/:locale',
+                              :requirements => { :extra => 'value' }
 
   map.resources :users, :only => :index
   map.resources :admins, :only => :index

data/test/routes_test.rb

@@ -69,11 +69,14 @@ class MapRoutingTest < ActionController::TestCase
   end
 
   test 'map organizer with custom singular name' do
-    assert_recognizes({:controller => 'passwords', :action => 'new', :locale => "en"}, '/en/organizers/password/new')
+    assert_recognizes({:controller => 'passwords', :action => 'new', :locale => "en", :extra => 'value'}, '/en/organizers/password/new')
   end
 
   test 'map organizer with path prefix' do
-    assert_recognizes({:controller => 'sessions', :action => 'new', :locale => "en"}, '/en/organizers/sign_in')
+    assert_recognizes({:controller => 'sessions', :action => 'new', :locale => "en", :extra => 'value'}, '/en/organizers/sign_in')
   end
 
+  test 'map organizer with additional route options' do
+    assert_recognizes({:controller => 'passwords', :action => 'new', :locale => "en", :extra => 'value'}, '/en/organizers/password/new')
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: devise
 version: !ruby/object:Gem::Version 
-  version: 0.4.3
+  version: 0.5.0
 platform: ruby
 authors: 
 - "Jos\xC3\xA9 Valim"
@@ -10,7 +10,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2009-11-10 00:00:00 -02:00
+date: 2009-11-13 00:00:00 -02:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -63,24 +63,31 @@ files:
 - lib/devise/controllers/filters.rb
 - lib/devise/controllers/helpers.rb
 - lib/devise/controllers/url_helpers.rb
+- lib/devise/encryptors/authlogic_sha512.rb
+- lib/devise/encryptors/clearance_sha1.rb
+- lib/devise/encryptors/restful_authentication_sha1.rb
+- lib/devise/encryptors/sha1.rb
+- lib/devise/encryptors/sha512.rb
 - lib/devise/failure.rb
 - lib/devise/hooks/confirmable.rb
 - lib/devise/hooks/rememberable.rb
 - lib/devise/locales/en.yml
 - lib/devise/mapping.rb
-- lib/devise/migrations.rb
+- lib/devise/middlewares/rememberable.rb
 - lib/devise/models.rb
 - lib/devise/models/authenticatable.rb
 - lib/devise/models/confirmable.rb
 - lib/devise/models/recoverable.rb
 - lib/devise/models/rememberable.rb
 - lib/devise/models/validatable.rb
+- lib/devise/orm/active_record.rb
+- lib/devise/orm/mongo_mapper.rb
 - lib/devise/rails.rb
 - lib/devise/rails/routes.rb
 - lib/devise/rails/warden_compat.rb
+- lib/devise/schema.rb
 - lib/devise/strategies/authenticatable.rb
 - lib/devise/strategies/base.rb
-- lib/devise/strategies/rememberable.rb
 - lib/devise/version.rb
 - lib/devise/warden.rb
 has_rdoc: true
@@ -116,6 +123,7 @@ test_files:
 - test/controllers/helpers_test.rb
 - test/controllers/url_helpers_test.rb
 - test/devise_test.rb
+- test/encryptors_test.rb
 - test/failure_test.rb
 - test/integration/authenticatable_test.rb
 - test/integration/confirmable_test.rb

data/lib/devise/migrations.rb

@@ -1,51 +0,0 @@
-module Devise
-  # Helpers to migration:
-  #
-  #   create_table :accounts do |t|
-  #     t.authenticatable
-  #     t.confirmable
-  #     t.recoverable
-  #     t.rememberable
-  #     t.timestamps
-  #   end
-  #
-  # However this method does not add indexes. If you need them, here is the declaration:
-  #
-  #   add_index "accounts", ["email"],                :name => "email",                :unique => true
-  #   add_index "accounts", ["confirmation_token"],   :name => "confirmation_token",   :unique => true
-  #   add_index "accounts", ["reset_password_token"], :name => "reset_password_token", :unique => true
-  #
-  module Migrations
-
-    # Creates email, encrypted_password and password_salt.
-    #
-    def authenticatable(options={})
-      null = options[:null] || false
-      string :email,              :limit => 100, :null => null
-      string :encrypted_password, :limit =>  40, :null => null
-      string :password_salt,      :limit =>  20, :null => null
-    end
-
-    # Creates confirmation_token, confirmed_at and confirmation_sent_at.
-    #
-    def confirmable
-      string   :confirmation_token, :limit => 20
-      datetime :confirmed_at
-      datetime :confirmation_sent_at
-    end
-
-    # Creates reset_password_token.
-    #
-    def recoverable
-      string :reset_password_token, :limit => 20
-    end
-
-    # Creates remember_token and remember_created_at.
-    #
-    def rememberable
-      string   :remember_token, :limit => 20
-      datetime :remember_created_at
-    end
-
-  end
-end

data/lib/devise/strategies/rememberable.rb

@@ -1,35 +0,0 @@
-module Devise
-  module Strategies
-    # Remember the user through the remember token. This strategy is responsible
-    # to verify whether there is a cookie with the remember token, and to
-    # recreate the user from this cookie if it exists.  Must be called *before*
-    # authenticatable.
-    class Rememberable < Devise::Strategies::Base
-
-      # A valid strategy for rememberable needs a remember token in the cookies.
-      def valid?
-        super && remember_me_cookie.present?
-      end
-
-      # To authenticate a user we deserialize the cookie and attempt finding
-      # the record in the database. If the attempt fails, we pass to another
-      # strategy handle the authentication.
-      def authenticate!
-        if resource = mapping.to.serialize_from_cookie(remember_me_cookie)
-          success!(resource)
-        else
-          pass
-        end
-      end
-
-      private
-
-        # Accessor for remember cookie
-        def remember_me_cookie
-          cookies['remember_token']
-        end
-    end
-  end
-end
-
-Warden::Strategies.add(:rememberable, Devise::Strategies::Rememberable)