devise 1.1.pre3 → 1.1.pre4

data/README.rdoc

@@ -9,24 +9,27 @@ Devise is a flexible authentication solution for Rails based on Warden. It:
 
 Right now it's composed of 12 modules:
 
-* Authenticatable: responsible for encrypting password and validating authenticity of a user while signing in.
-* Token Authenticatable: validates authenticity of a user while signing in using an authentication token (also known as "single access token").
+* Authenticatable: encrypts a password and validates the authenticity of a user while signing in.
+* Token Authenticatable: validates the authenticity of a user while signing in using an authentication token (also known as "single access token").
 * HttpAuthenticatable: sign in users using basic HTTP authentication.
-* Confirmable: responsible for verifying whether an account is already confirmed to sign in, and to send emails with confirmation instructions.
-* Recoverable: takes care of reseting the user password and send reset instructions.
+* Confirmable: sends emails with confirmation instructions and verifies whether an account is already confirmed during sign in.
+* Recoverable: resets the user password and sends reset instructions.
 * Registerable: handles signing up users through a registration process.
-* Rememberable: manages generating and clearing token for remember the user from a saved cookie.
-* Trackable: tracks sign in count, timestamps and ip.
-* Timeoutable: expires sessions without activity in a certain period of time.
-* Validatable: creates all needed validations for email and password. It's totally optional, so you're able to to customize validations by yourself.
-* Lockable: takes care of locking an account based on the number of failed sign in attempts. Handles unlock via expire and email.
-* Activatable: if you need to activate accounts by other means, which are not through confirmation, use this module.
+* Rememberable: manages generating and clearing a token for remembering the user from a saved cookie.
+* Trackable: tracks sign in count, timestamps and IP address.
+* Timeoutable: expires sessions that have no activity in a specified period of time.
+* Validatable: provides validations of email and password. It's optional and can be customized, so you're able to define your own validations.
+* Lockable: locks an account after a specified number of failed sign-in attempts. Can unlock via email or after a specified time period.
+* Activatable: use this module if you need to activate accounts by means other than confirmation.
 
-There's an example application using Devise at http://github.com/plataformatec/devise_example .
+== Examples
+
+* Example application using Devise at http://github.com/plataformatec/devise_example
+* Example Rails 2.3 web app combining subdomains with Devise at http://github.com/fortuity/subdomain-authentication
 
 == Dependencies
 
-Devise is based on Warden (http://github.com/hassox/warden), a Rack Authentication Framework so you need to install it as a gem. Please ensure you have it installed in order to use devise (see installation below).
+Devise is based on Warden (http://github.com/hassox/warden), a Rack Authentication Framework. You need to install Warden as a gem. Please ensure you have it installed in order to use Devise (see installation below).
 
 == Installation
 
@@ -34,7 +37,7 @@ Devise master branch now supports Rails 3 and is NOT backward compatible. You ca
 
   sudo gem install devise --version=1.1.pre
 
-After installing them, you need configure warden and devise gems inside your gemfile:
+After installing the Warden and Devise gems, you need to configure the gems inside your gemfile:
 
   gem 'warden'
   gem 'devise'
@@ -61,15 +64,15 @@ Or checkout from the v1.0 branch:
 
 This is a walkthrough with all steps you need to setup a devise resource, including model, migration, route files, and optional configuration. You MUST also check out the *Generators* section below to help you start.
 
-Devise must be set up within the model (or models) you want to use, and devise routes must be created inside your config/routes.rb file.
+Devise must be set up within the model (or models) you want to use. Devise routes must be created inside your config/routes.rb file.
 
-We're assuming here you want a User model with some modules, as outlined below:
+We're assuming here you want a User model with some Devise modules, as outlined below:
 
   class User < ActiveRecord::Base
     devise :authenticatable, :confirmable, :recoverable, :rememberable, :trackable, :validatable
   end
 
-After you choose which modules to use, you need to setup your migrations. Luckily, devise has some helpers to save you from this boring work:
+After you choose which modules to use, you need to set up your migrations. Luckily, Devise has some helpers to save you from this boring work:
 
   create_table :users do |t|
     t.authenticatable
@@ -80,53 +83,53 @@ After you choose which modules to use, you need to setup your migrations. Luckil
     t.timestamps
   end
 
-Remember that Devise don't rely on _attr_accessible_ or _attr_protected_ inside its modules, so be sure to setup what attributes are accessible or protected in your model.
+Devise doesn't use _attr_accessible_ or _attr_protected_ inside its modules, so be sure to define attributes as accessible or protected in your model.
 
-The next setup after setting up your model is to configure your routes. You do this by opening up your config/routes.rb and adding:
+Configure your routes after setting up your model. Open your config/routes.rb file and add:
 
   devise_for :users
 
-This is going to look inside you User model and create a set of needed routes (you can see them by running `rake routes`).
+This will use your User model to create a set of needed routes (you can see them by running `rake routes`).
 
-There are also some options available for configuring your routes, as :class_name (to set the class for that route), :path_prefix, :as and :path_names, where the last two have the same meaning as in common routes. The available :path_names are:
+Options for configuring your routes include :class_name (to set the class for that route), :path_prefix, :as and :path_names, where the last two have the same meaning as in common routes. The available :path_names are:
 
-  devise_for :users, :as => "usuarios", :path_names => { :sign_in => 'login', :sign_out => 'logout', :password => 'secret', :confirmation => 'verification', :unlock => 'unblock' }
+  devise_for :users, :as => "usuarios", :path_names => { :sign_in => 'login', :sign_out => 'logout', :sign_up => 'register', :password => 'secret', :confirmation => 'verification', :unlock => 'unblock' }
 
-Be sure to check devise_for documentation for detailed description.
+Be sure to check devise_for documentation for details.
 
-After this steps, run your migrations, and you are ready to go! But don't finish reading, we still have a lot to tell you:
+After creating your models and routes, run your migrations, and you are ready to go! But don't stop reading here, we still have a lot to tell you:
 
 == Controller filters and helpers
 
-Devise is gonna create some helpers to use inside your controllers and views. To setup a controller that needs user authentication, just add this before_filter:
+Devise will create some helpers to use inside your controllers and views. To set up a controller with user authentication, just add this before_filter:
 
   before_filter :authenticate_user!
 
-To verify if a user is signed in, you have the following helper:
+To verify if a user is signed in, use the following helper:
 
   user_signed_in?
 
-And to get the current signed in user this helper is available:
+For the current signed-in user, this helper is available:
 
   current_user
 
-You have also access to the session for this scope:
+You can access the session for this scope:
 
   user_session
 
-After signing in a user, confirming it's account or updating it's password, devise will look for a scoped root path to redirect. Example: For a :user resource, it will use user_root_path if it exists, otherwise default root_path will be used. This means that you need to set the root inside your routes:
+After signing in a user, confirming the account or updating the password, Devise will look for a scoped root path to redirect. Example: For a :user resource, it will use user_root_path if it exists, otherwise default root_path will be used. This means that you need to set the root inside your routes:
 
   root :to => "home"
 
-You can also overwrite after_sign_in_path_for and after_sign_out_path_for to customize better your redirect hooks.
+You can also overwrite after_sign_in_path_for and after_sign_out_path_for to customize your redirect hooks.
 
-Finally, you also need to setup default url options for the mailer in each environment. Here's is the configuration for config/environments/development.rb:
+Finally, you need to set up default url options for the mailer in each environment. Here is the configuration for config/environments/development.rb:
 
   config.action_mailer.default_url_options = { :host => 'localhost:3000' }
 
 == Tidying up
 
-Devise let's you setup as many roles as you want, so let's say you already have this User model and also want an Admin model with just authentication, trackable, lockable and timeoutable stuff and none of confirmation or password recovery. Just follow the same steps:
+Devise allows you to set up as many roles as you want. For example, you may have a User model and also want an Admin model with just authentication, trackable, lockable and timeoutable features and no confirmation or password-recovery features. Just follow these steps:
 
   # Create a migration with the required fields
   create_table :admins do |t|
@@ -151,35 +154,37 @@ Devise let's you setup as many roles as you want, so let's say you already have
 
 == Generators
 
-Devise comes with some generators to help you start:
+Devise has generators to help you get started:
 
   rails generate devise_install
 
-This will generate an initializer, with a description of all configuration values. You can also generate models through:
+This will generate an initializer, with a description of all configuration values.
+
+You can also generate models:
 
   rails generate devise Model
 
-A model configured with all devise modules and attr_accessible for default fields will be created. The generator will also create the migration and configure your routes for devise.
+This will create a model named "Model" configured with default Devise modules and attr_accessible set for default fields. The generator will also create the migration and configure your routes for Devise.
 
 == Model configuration
 
-The devise method in your models also accept some options to configure its modules. For example, you can chose which encryptor to use in authenticatable simply doing:
+The devise method in your models also accepts some options to configure its modules. For example, you can choose which encryptor to use in authenticatable:
 
   devise :authenticatable, :confirmable, :recoverable, :encryptor => :bcrypt
 
-Besides :encryptor, you can provide :pepper, :stretches, :confirm_within, :remember_for, :timeout_in, :unlock_in and others. All those are described in the initializer created when you invoke the devise_install generator describer above.
+Besides :encryptor, you can define :pepper, :stretches, :confirm_within, :remember_for, :timeout_in, :unlock_in and other values. For details, see the initializer file that was created when you invoked the devise_install generator described above.
 
 == Configuring controllers and views
 
-One of Devise goals is to help you bootstrap your application with authentication really fast. Another goal is to not be in your way when you need to customize it.
+We built Devise to help you quickly develop an application that uses authentication. We don't want to be in your way when you need to customize it.
 
-Since devise is an engine, it has all default views inside the gem. They are good to get you started, but you will want to customize them at some point. And Devise has a generator to copy them all to your application:
+Since Devise is an engine, all its default views are packaged inside the gem. The default views will get you started but you may want to customize them. Devise has a generator to copy the default views to your application. After they've been copied to your application, you can make changes as required:
 
   rails generate devise_views
 
-If you have more than one role in your application, you will notice that Devise uses the same views for all roles you have. But what if you need so different views to each of them? Devise also has an easy way to accomplish it: just setup config.scoped_views to true inside "config/initializers/devise.rb".
+If you have more than one role in your application (such as "user" and "admin"), you will notice that Devise uses the same views for all roles. You may need different views for each role. Devise offers an easy way to customize views for each role. Just set config.scoped_views to "true" inside "config/initializers/devise.rb".
 
-After doing so you will be able to have views based on the scope like "users/sessions/new" and "admins/sessions/new". If no view is found within the scope, Devise will fallback to the default view at "devise/sessions/new".
+After doing so you will be able to have views based on the scope like "users/sessions/new" and "admins/sessions/new". If no view is found within the scope, Devise will use the default view at "devise/sessions/new".
 
 Finally, if the customization at the views level is not enough, you can customize each controller by following these steps:
 
@@ -192,13 +197,13 @@ Finally, if the customization at the views level is not enough, you can customiz
 
     devise_for :admins, :controllers => { :sessions = "admin/sessions" }
 
-  3) And finally, since we changed the controller, it won't use "devise/sessions" as views anymore, so remember to make a copy of "devise/sessions" to "admin/sessions".
+  3) And finally, since we changed the controller, it won't use the "devise/sessions" views, so remember to copy "devise/sessions" to "admin/sessions".
 
-Remember that Devise uses flash messages to let users know if sign in wass successful or not. Devise expects your application to call "flash[:notice]" and "flash[:alert]" as appropriate.
+Remember that Devise uses flash messages to let users know if sign in was successful or failed. Devise expects your application to call "flash[:notice]" and "flash[:alert]" as appropriate.
 
 == I18n
 
-Devise uses flash messages with I18n with the flash keys :success and :failure. To customize your app, you can setup your locale file this way:
+Devise uses flash messages with I18n with the flash keys :success and :failure. To customize your app, you can set up your locale file:
 
   en:
     devise:
@@ -215,7 +220,7 @@ You can also create distinct messages based on the resource you've configured us
         admin:
           signed_in: 'Hello admin!'
 
-Devise mailer uses the same pattern to create subject messages:
+The Devise mailer uses the same pattern to create subject messages:
 
   en:
     devise:
@@ -243,15 +248,15 @@ You can include the Devise Test Helpers in all of your tests by adding the follo
     include Devise::TestHelpers
   end
 
-Do not use such helpers for integration tests like Cucumber, Webrat... Just fill in the form or explicitly set the user in session. For more tips, check the wiki (http://wiki.github.com/plataformatec/devise).
+Do not use such helpers for integration tests such as Cucumber or Webrat. Instead, fill in the form or explicitly set the user in session. For more tips, check the wiki (http://wiki.github.com/plataformatec/devise).
 
 == Migrating from other solutions
 
-Devise implements encryption strategies for Clearance, Authlogic and Restful-Authentication. To make use of it set the desired encryptor in the encryptor initializer config option. You might also need to rename your encrypted password and salt columns to match Devises's one (encrypted_password and password_salt).
+Devise implements encryption strategies for Clearance, Authlogic and Restful-Authentication. To make use of these strategies, set the desired encryptor in the encryptor initializer config option. You might also need to rename your encrypted password and salt columns to match Devise's fields (encrypted_password and password_salt).
 
 == Other ORMs
 
-Devise supports both ActiveRecord (default) and MongoMapper, and has experimental Datamapper supports (in a sense that Devise test suite does not run completely with Datamapper). To choose other ORM, you just need to configure it in the initializer file.
+Devise supports ActiveRecord (by default) and MongoMapper. We offer experimental Datamapper support (with the limitation that the Devise test suite does not run completely with Datamapper). To choose other ORM, you just need to configure it in the initializer file.
 
 == TODO
 
@@ -264,15 +269,28 @@ Please refer to TODO file.
 
 == Contributors
 
-We have a long running list of contributors. Check them in the CHANGELOG or do `git shortlog -s -n` in the cloned repository.
+We have a long list of valued contributors. See the CHANGELOG or do `git shortlog -s -n` in the cloned repository.
+
+== Related Applications
+
+* http://github.com/scambra/devise_invitable adds support to Devise for sending invitations by email.
+
+* http://github.com/grimen/devise_facebook_connectable adds support for Facebook Connect authentication, and optionally fetching user info from Facebook in the same step.
 
 == Bugs and Feedback
 
-If you discover any bugs or want to drop a line, feel free to create an issue on
-GitHub or send an e-mail to the mailing list.
+If you discover any bugs, please create an issue on GitHub.
+
+http://github.com/plataformatec/devise/issues
+
+For support, send an e-mail to the mailing list.
+
+http://groups.google.com/group/plataformatec-devise
+
+See the wiki for additional documentation and support.
 
-http://github.com/plataformatec/devise/issues | 
-http://groups.google.com/group/plataformatec-devise | 
 http://wiki.github.com/plataformatec/devise/
 
+== License
+
 MIT License. Copyright 2009 Plataforma Tecnologia. http://blog.plataformatec.com.br

data/app/controllers/devise/registrations_controller.rb

@@ -30,28 +30,28 @@ class Devise::RegistrationsController < ApplicationController
 
   # PUT /resource
   def update
-    if self.resource.update_with_password(params[resource_name])
+    if resource.update_with_password(params[resource_name])
       set_flash_message :notice, :updated
       redirect_to after_sign_in_path_for(self.resource)
     else
-      build_resource
-      send(:"current_#{resource_name}").reload
       render_with_scope :edit
     end
   end
 
   # DELETE /resource
   def destroy
-    self.resource.destroy
+    resource.destroy
     set_flash_message :notice, :destroyed
     sign_out_and_redirect(self.resource)
   end
 
   protected
 
-    # Authenticates the current scope and dup the resource
+    # Authenticates the current scope and gets a copy of the current resource.
+    # We need to use a copy because we don't want actions like update changing
+    # the current user in place.
     def authenticate_scope!
       send(:"authenticate_#{resource_name}!")
-      self.resource = send(:"current_#{resource_name}")
+      self.resource = resource_class.find(send(:"current_#{resource_name}").id)
     end
 end

data/lib/devise.rb

@@ -1,6 +1,5 @@
 module Devise
   autoload :FailureApp, 'devise/failure_app'
-  autoload :Models, 'devise/models'
   autoload :Schema, 'devise/schema'
   autoload :TestHelpers, 'devise/test_helpers'
 
@@ -21,39 +20,17 @@ module Devise
     autoload :Sha1, 'devise/encryptors/sha1'
   end
 
-  ALL = []
-
-  # Authentication ones first
-  ALL.push :authenticatable, :http_authenticatable, :token_authenticatable, :rememberable
-
-  # Misc after
-  ALL.push :recoverable, :registerable, :validatable
-
-  # The ones which can sign out after
-  ALL.push :activatable, :confirmable, :lockable, :timeoutable
-
-  # Stats for last, so we make sure the user is really signed in
-  ALL.push :trackable
-
-  # Maps controller names to devise modules.
-  CONTROLLERS = {
-    :sessions => [:authenticatable, :token_authenticatable],
-    :passwords => [:recoverable],
-    :confirmations => [:confirmable],
-    :registrations => [:registerable],
-    :unlocks => [:lockable]
-  }
-
-  # Routes for generating url helpers.
-  ROUTES = [:session, :password, :confirmation, :registration, :unlock]
-
-  STRATEGIES  = [:rememberable, :http_authenticatable, :token_authenticatable, :authenticatable]
+  # Constants which holds devise configuration for extensions. Those should
+  # not be modified by the "end user".
+  ALL            = []
+  CONTROLLERS    = {}
+  ROUTES         = []
+  STRATEGIES     = []
+  FLASH_MESSAGES = [:unauthenticated]
 
+  # True values used to check params
   TRUE_VALUES = [true, 1, '1', 't', 'T', 'true', 'TRUE']
 
-  # Maps the messages types that are used in flash message.
-  FLASH_MESSAGES = [:unauthenticated, :unconfirmed, :invalid, :invalid_token, :timeout, :inactive, :locked]
-
   # Declare encryptors length which are used in migrations.
   ENCRYPTORS_LENGTH = {
     :sha1   => 40,
@@ -142,101 +119,90 @@ module Devise
   mattr_accessor :http_authentication_realm
   @@http_authentication_realm = "Application"
 
-  class << self
-    # Default way to setup Devise. Run script/generate devise_install to create
-    # a fresh initializer with all configuration values.
-    def setup
-      yield self
-    end
+  # Default way to setup Devise. Run rails generate devise_install to create
+  # a fresh initializer with all configuration values.
+  def self.setup
+    yield self
+  end
 
-    # TODO Remove me on 1.1.0 final
-    def orm=(value)
-      ActiveSupport::Deprecation.warn "Devise.orm= and config.orm= are deprecated. " <<
-        "Just load \"devise/orm/\#{ORM_NAME}\" if Devise supports your ORM"
+  # Make Devise aware of an 3rd party Devise-module. For convenience.
+  #
+  # == Options:
+  #
+  #   +strategy+    - Boolean value representing if this module got a custom *strategy*.
+  #                   Default is +false+. Note: Devise will auto-detect this in such case if this is true.
+  #   +model+       - String representing the load path to a custom *model* for this module (to autoload.)
+  #                   Default is +nil+ (i.e. +false+).
+  #   +controller+  - Symbol representing the name of an exisiting or custom *controller* for this module.
+  #                   Default is +nil+ (i.e. +false+).
+  #   +route+       - Symbol representing the named *router* helper for this module.
+  #                   Default is +nil+ (i.e. +false+).
+  #   +flash+       - Symbol representing the *flash messages* used by this helper.
+  #                   Default is +nil+ (i.e. +false+).
+  #
+  # == Examples:
+  #
+  #   Devise.add_module(:party_module)
+  #   Devise.add_module(:party_module, :strategy => true, :controller => :sessions)
+  #   Devise.add_module(:party_module, :autoload => 'party_module/model')
+  #
+  def self.add_module(module_name, options = {})
+    ALL << module_name
+    options.assert_valid_keys(:strategy, :model, :controller, :route, :flash)
+
+    { :strategy => STRATEGIES, :flash => FLASH_MESSAGES, :route => ROUTES }.each do |key, value|
+      next unless options[key]
+      name = (options[key] == true ? module_name : options[key])
+      value.unshift(name) unless value.include?(name)
     end
 
-    # TODO Remove me on 1.1.0 final
-    def default_url_options
-      ActiveSupport::Deprecation.warn "Devise.default_url_options and config.default_url_options are deprecated. " <<
-        "Just modify ApplicationController.default_url_options and Devise will automatically pick it up"
+    if options[:controller]
+      Devise::CONTROLLERS[module_name] = options[:controller].to_sym
     end
 
-    # Sets warden configuration using a block that will be invoked on warden
-    # initialization.
-    #
-    #  Devise.initialize do |config|
-    #    config.confirm_within = 2.days
-    #
-    #    config.warden do |manager|
-    #      # Configure warden to use other strategies, like oauth.
-    #      manager.oauth(:twitter)
-    #    end
-    #  end
-    def warden(&block)
-      @warden_config = block
+    if options[:model]
+      model_path = (options[:model] == true ? "devise/models/#{module_name}" : options[:model])
+      Devise::Models.send(:autoload, module_name.to_s.camelize.to_sym, model_path)
     end
 
-    # A method used internally to setup warden manager from the Rails initialize
-    # block.
-    def configure_warden(config) #:nodoc:
-      config.default_strategies *Devise::STRATEGIES
-      config.failure_app = Devise::FailureApp
-      config.silence_missing_strategies!
-      config.default_scope = Devise.default_scope
+    Devise::Mapping.register module_name
+  end
 
-      # If the user provided a warden hook, call it now.
-      @warden_config.try :call, config
-    end
+  # Sets warden configuration using a block that will be invoked on warden
+  # initialization.
+  #
+  #  Devise.initialize do |config|
+  #    config.confirm_within = 2.days
+  #
+  #    config.warden do |manager|
+  #      # Configure warden to use other strategies, like oauth.
+  #      manager.oauth(:twitter)
+  #    end
+  #  end
+  def self.warden(&block)
+    @warden_config = block
+  end
 
-    # Generate a friendly string randomically to be used as token.
-    def friendly_token
-      ActiveSupport::SecureRandom.base64(15).tr('+/=', '-_ ').strip.delete("\n")
-    end
+  # A method used internally to setup warden manager from the Rails initialize
+  # block.
+  def self.configure_warden(config) #:nodoc:
+    config.default_strategies *Devise::STRATEGIES
+    config.failure_app = Devise::FailureApp
+    config.silence_missing_strategies!
+    config.default_scope = Devise.default_scope
 
-    # Make Devise aware of an 3rd party Devise-module. For convenience.
-    #
-    # == Options:
-    #
-    #   +strategy+    - Boolean value representing if this module got a custom *strategy*.
-    #                   Default is +false+. Note: Devise will auto-detect this in such case if this is true.
-    #   +model+       - String representing a load path to a custom *model* for this module (to autoload).
-    #                   Default is +nil+ (i.e. +false+).
-    #   +controller+  - Symbol representing a name of an exisiting or custom *controller* for this module.
-    #                   Default is +nil+ (i.e. +false+).
-    #
-    # == Examples:
-    #
-    #   Devise.add_module(:party_module)
-    #   Devise.add_module(:party_module, :strategy => true, :controller => :sessions)
-    #   Devise.add_module(:party_module, :model => 'party_module/model')
-    #
-    def add_module(module_name, options = {})
-      Devise::ALL.unshift module_name        unless Devise::ALL.include?(module_name)
-      Devise::STRATEGIES.unshift module_name if options[:strategy] && !Devise::STRATEGIES.include?(module_name)
-
-      if options[:controller]
-        controller = options[:controller].to_sym
-        Devise::CONTROLLERS[controller] ||= []
-        Devise::CONTROLLERS[controller].unshift module_name unless Devise::CONTROLLERS[controller].include?(module_name)
-      end
-
-      if options[:model]
-        Devise::Models.module_eval do
-          autoload :"#{module_name.to_s.classify}", options[:model]
-        end
-      end
-
-      Devise::Mapping.register module_name
-    end
+    # If the user provided a warden hook, call it now.
+    @warden_config.try :call, config
   end
-end
 
-begin
-  require 'warden'
-rescue
-  gem 'warden'
-  require 'warden'
+  # Generate a friendly string randomically to be used as token.
+  def self.friendly_token
+    ActiveSupport::SecureRandom.base64(15).tr('+/=', '-_ ').strip.delete("\n")
+  end
 end
 
+require 'warden'
 require 'devise/mapping'
+require 'devise/models'
+require 'devise/modules'
 require 'devise/rails'

data/lib/devise/controllers/internal_helpers.rb

@@ -52,7 +52,8 @@ module Devise
 
       # Checks whether it's a devise mapped resource or not.
       def is_devise_resource? #:nodoc:
-        raise ActionController::UnknownAction unless devise_mapping && devise_mapping.allows?(controller_name)
+        raise ActionController::UnknownAction unless devise_mapping &&
+          devise_mapping.allowed_controllers.include?(controller_path)
       end
 
       # Sets the resource creating an instance variable

data/lib/devise/hooks/rememberable.rb

@@ -22,9 +22,11 @@ end
 # Before logout hook to forget the user in the given scope, only if rememberable
 # is activated for this scope. Also clear remember token to ensure the user
 # won't be remembered again.
+# Notice that we forget the user if the record is frozen. This usually means the
+# user was just deleted.
 Warden::Manager.before_logout do |record, warden, scope|
   if record.respond_to?(:forget_me!)
-    record.forget_me!
+    record.forget_me! unless record.frozen?
     warden.response.delete_cookie "remember_#{scope}_token"
   end
 end

data/lib/devise/hooks/trackable.rb

@@ -1,18 +1,7 @@
 # After each sign in, update sign in time, sign in count and sign in IP.
 Warden::Manager.after_set_user :except => :fetch do |record, warden, options|
   scope = options[:scope]
-  if Devise.mappings[scope].try(:trackable?) && warden.authenticated?(scope)
-    old_current, new_current  = record.current_sign_in_at, Time.now
-    record.last_sign_in_at    = old_current || new_current
-    record.current_sign_in_at = new_current
-
-    old_current, new_current  = record.current_sign_in_ip, warden.request.remote_ip
-    record.last_sign_in_ip    = old_current || new_current
-    record.current_sign_in_ip = new_current
-
-    record.sign_in_count ||= 0
-    record.sign_in_count += 1
-
-    record.save(:validate => false)
+  if record.respond_to?(:update_tracked_fields!) && warden.authenticated?(scope)
+    record.update_tracked_fields!(warden.request)
   end
 end

data/lib/devise/mapping.rb

@@ -18,11 +18,11 @@ module Devise
   #   mapping.to   #=> User
   #   # is the class to be loaded from routes, given in the route as :class_name.
   #
-  #   mapping.for  #=> [:authenticatable]
+  #   mapping.modules  #=> [:authenticatable]
   #   # is the modules included in the class
   #
   class Mapping #:nodoc:
-    attr_reader :name, :as, :path_names, :path_prefix
+    attr_reader :name, :as, :controllers, :path_names, :path_prefix
 
     # Loop through all mappings looking for a map that matches with the requested
     # path (ie /users/sign_in). If a path prefix is given, it's taken into account.
@@ -62,15 +62,20 @@ module Devise
       @name  = (options.delete(:scope) || name.to_s.singularize).to_sym
 
       @path_prefix = "/#{options.delete(:path_prefix)}/".squeeze("/")
+
+      @controllers = Hash.new { |h,k| h[k] = "devise/#{k}" }
+      @controllers.merge!(options.delete(:controllers) || {})
+
       @path_names  = Hash.new { |h,k| h[k] = k.to_s }
       @path_names.merge!(options.delete(:path_names) || {})
     end
 
     # Return modules for the mapping.
-    def for
-      @for ||= to.devise_modules
+    def modules
+      @modules ||= to.devise_modules
     end
 
+    # Gives the class the mapping points to.
     # Reload mapped class each time when cache_classes is false.
     def to
       return @to if @to
@@ -79,9 +84,14 @@ module Devise
       klass
     end
 
-    # Check if the respective controller has a module in the mapping class.
-    def allows?(controller)
-      (self.for & CONTROLLERS[controller.to_sym]).present?
+    # Keep a list of allowed controllers for this mapping. It's useful to ensure
+    # that an Admin cannot access the registrations controller unless it has
+    # :registerable in the model.
+    def allowed_controllers
+      @allowed_controllers ||= begin
+        canonical = CONTROLLERS.values_at(*self.modules).compact
+        @controllers.values_at(*canonical)
+      end
     end
 
     # Return in which position in the path prefix devise should find the as mapping.
@@ -98,18 +108,15 @@ module Devise
     # Example:
     #
     #   def confirmable?
-    #     self.for.include?(:confirmable)
+    #     self.modules.include?(:confirmable)
     #   end
     #
-    def self.register(*modules)
-      modules.each do |m|
-        class_eval <<-METHOD, __FILE__, __LINE__ + 1
-          def #{m}?
-            self.for.include?(:#{m})
-          end
-        METHOD
-      end
+    def self.register(m)
+      class_eval <<-METHOD, __FILE__, __LINE__ + 1
+        def #{m}?
+          self.modules.include?(:#{m})
+        end
+      METHOD
     end
-    Devise::Mapping.register *ALL
   end
 end

data/lib/devise/models.rb

@@ -1,16 +1,5 @@
 module Devise
   module Models
-    autoload :Activatable, 'devise/models/activatable'
-    autoload :Authenticatable, 'devise/models/authenticatable'
-    autoload :Confirmable, 'devise/models/confirmable'
-    autoload :Lockable, 'devise/models/lockable'
-    autoload :Recoverable, 'devise/models/recoverable'
-    autoload :Rememberable, 'devise/models/rememberable'
-    autoload :Registerable, 'devise/models/registerable'
-    autoload :Timeoutable, 'devise/models/timeoutable'
-    autoload :Trackable, 'devise/models/trackable'
-    autoload :Validatable, 'devise/models/validatable'
-
     # Creates configuration values for Devise and for the given module.
     #
     #   Devise::Models.config(Devise::Authenticable, :stretches, 10)

data/lib/devise/models/trackable.rb

@@ -11,6 +11,20 @@ module Devise
     # * last_sign_in_at    - Holds the remote ip of the previous sign in
     #
     module Trackable
+      def update_tracked_fields!(request)
+        old_current, new_current = self.current_sign_in_at, Time.now
+        self.last_sign_in_at     = old_current || new_current
+        self.current_sign_in_at  = new_current
+
+        old_current, new_current = self.current_sign_in_ip, request.remote_ip
+        self.last_sign_in_ip     = old_current || new_current
+        self.current_sign_in_ip  = new_current
+
+        self.sign_in_count ||= 0
+        self.sign_in_count += 1
+
+        save(:validate => false)
+      end
     end
   end
 end

data/lib/devise/modules.rb

@@ -0,0 +1,25 @@
+require 'active_support/core_ext/object/with_options'
+
+Devise.with_options :model => true do |d|
+  # Strategies first
+  d.with_options :strategy => true do |s|
+    s.add_module :authenticatable,       :controller => :sessions, :flash => :invalid,       :route => :session
+    s.add_module :http_authenticatable
+    s.add_module :token_authenticatable, :controller => :sessions, :flash => :invalid_token, :route => :session
+    s.add_module :rememberable
+  end
+
+  # Misc after   
+  d.add_module :recoverable,  :controller => :passwords,     :route => :password
+  d.add_module :registerable, :controller => :registrations, :route => :registration
+  d.add_module :validatable
+
+  # The ones which can sign out after
+  d.add_module :activatable,                                 :flash => :inactive
+  d.add_module :confirmable,  :controller => :confirmations, :flash => :unconfirmed, :route => :confirmation
+  d.add_module :lockable,     :controller => :unlocks,       :flash => :locked,      :route => :unlock
+  d.add_module :timeoutable,                                 :flash => :timeout
+
+  # Stats for last, so we make sure the user is really signed in
+  d.add_module :trackable
+end

data/lib/devise/rails/routes.rb

@@ -87,17 +87,20 @@ module ActionDispatch::Routing
       options = resources.extract_options!
       resources.map!(&:to_sym)
 
-      controllers = Hash.new { |h,k| h[k] = "devise/#{k}" }
-      controllers.merge!(options.delete(:controllers) || {})
-
       resources.each do |resource|
-        mapping = Devise::Mapping.new(resource, options.dup)
+        mapping = Devise::Mapping.new(resource, options)
+
+        unless mapping.to.respond_to?(:devise)
+          raise "#{mapping.to.name} does not respond to 'devise' method. This usually means you haven't " <<
+            "loaded your ORM file or it's being loaded to late. To fix it, be sure to require 'devise/orm/YOUR_ORM' " <<
+            "inside 'config/initializers/devise.rb' or before your application definition in 'config/application.rb'"
+        end
 
         Devise.default_scope ||= mapping.name
         Devise.mappings[mapping.name] = mapping
 
-        mapping.for.each do |mod|
-          send(mod, mapping, controllers) if self.respond_to?(mod, true)
+        mapping.modules.each do |mod|
+          send(mod, mapping, mapping.controllers) if self.respond_to?(mod, true)
         end
       end
     end

data/lib/devise/schema.rb

@@ -9,12 +9,13 @@ module Devise
     # * :null - When true, allow columns to be null.
     # * :encryptor - The encryptor going to be used, necessary for setting the proper encrypter password length.
     def authenticatable(options={})
-      null       = options[:null] || false
-      encryptor  = options[:encryptor] || (respond_to?(:encryptor) ? self.encryptor : :sha1)
+      null      = options[:null] || false
+      default   = options[:default]
+      encryptor = options[:encryptor] || (respond_to?(:encryptor) ? self.encryptor : :sha1)
 
-      apply_schema :email,              String, :null => null
-      apply_schema :encrypted_password, String, :null => null, :limit => Devise::ENCRYPTORS_LENGTH[encryptor]
-      apply_schema :password_salt,      String, :null => null
+      apply_schema :email,              String, :null => null, :default => default
+      apply_schema :encrypted_password, String, :null => null, :default => default, :limit => Devise::ENCRYPTORS_LENGTH[encryptor]
+      apply_schema :password_salt,      String, :null => null, :default => default
     end
 
     # Creates authentication_token.

data/lib/devise/strategies/authenticatable.rb

@@ -23,7 +23,7 @@ module Devise
       protected
 
         def valid_controller?
-          params[:controller] =~ /sessions$/
+          mapping.controllers[:sessions] == params[:controller]
         end
 
         def valid_params?

data/lib/devise/version.rb

@@ -1,3 +1,3 @@
 module Devise
-  VERSION = "1.1.pre3".freeze
+  VERSION = "1.1.pre4".freeze
 end

data/test/devise_test.rb

@@ -25,7 +25,7 @@ class DeviseTest < ActiveSupport::TestCase
     Devise.configure_warden(config)
 
     assert_equal Devise::FailureApp, config.failure_app
-    assert_equal [:rememberable, :http_authenticatable, :token_authenticatable, :authenticatable], config.default_strategies
+    assert_equal [:rememberable, :token_authenticatable, :http_authenticatable, :authenticatable], config.default_strategies
     assert_equal :user, config.default_scope
     assert config.silence_missing_strategies?
   end
@@ -58,10 +58,9 @@ class DeviseTest < ActiveSupport::TestCase
     Devise::STRATEGIES.delete(:banana)
 
     assert_nothing_raised(Exception) { Devise.add_module(:kivi, :controller => :fruits) }
-    assert_not_nil Devise::CONTROLLERS[:fruits]
-    assert_equal 1, Devise::CONTROLLERS[:fruits].select { |v| v == :kivi }.size
+    assert_equal :fruits, Devise::CONTROLLERS[:kivi]
     Devise::ALL.delete(:kivi)
-    Devise::CONTROLLERS.delete(:fruits)
+    Devise::CONTROLLERS.delete(:kivi)
 
     assert_nothing_raised(Exception) { Devise.add_module(:authenticatable_again, :model => 'devise/model/authenticatable') }
     assert defined?(Devise::Models::AuthenticatableAgain)

data/test/mapping_test.rb

@@ -5,7 +5,7 @@ class MappingTest < ActiveSupport::TestCase
   test 'store options' do
     mapping = Devise.mappings[:user]
     assert_equal User,                mapping.to
-    assert_equal User.devise_modules, mapping.for
+    assert_equal User.devise_modules, mapping.modules
     assert_equal :users,              mapping.as
   end
 
@@ -18,15 +18,15 @@ class MappingTest < ActiveSupport::TestCase
   end
 
   test 'allows a controller depending on the mapping' do
-    mapping = Devise.mappings[:user]
-    assert mapping.allows?(:sessions)
-    assert mapping.allows?(:confirmations)
-    assert mapping.allows?(:passwords)
-
-    mapping = Devise.mappings[:admin]
-    assert mapping.allows?(:sessions)
-    assert_not mapping.allows?(:confirmations)
-    assert_not mapping.allows?(:passwords)
+    allowed = Devise.mappings[:user].allowed_controllers
+    assert allowed.include?("devise/sessions")
+    assert allowed.include?("devise/confirmations")
+    assert allowed.include?("devise/passwords")
+
+    allowed = Devise.mappings[:admin].allowed_controllers
+    assert allowed.include?("sessions")
+    assert_not allowed.include?("devise/confirmations")
+    assert_not allowed.include?("devise/passwords")
   end
 
   test 'find mapping by path' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: devise
 version: !ruby/object:Gem::Version 
-  version: 1.1.pre3
+  version: 1.1.pre4
 platform: ruby
 authors: 
 - "Jos\xC3\xA9 Valim"
@@ -10,7 +10,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2010-02-24 00:00:00 +01:00
+date: 2010-03-03 00:00:00 +01:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -90,6 +90,7 @@ files:
 - lib/devise/models/token_authenticatable.rb
 - lib/devise/models/trackable.rb
 - lib/devise/models/validatable.rb
+- lib/devise/modules.rb
 - lib/devise/orm/active_record.rb
 - lib/devise/orm/data_mapper.rb
 - lib/devise/orm/mongo_mapper.rb