devise 1.1.9 → 1.2.rc

data/CHANGELOG.rdoc

@@ -1,32 +1,40 @@
-== 1.1.9
+== 1.2.rc
 
-* bugfix
-  * double check if warden has not halted
-
-== 1.1.8
-
-* bugfix
-  * Ensure you can't inject Mongoid queries using token authenticatable
-
-== 1.1.7
-
-* bugfix
-  * Fix a backward incompatible change with versions prior to Rails 3.0.4
-
-== 1.1.6
-
-* bugfix
-  * Use a more secure e-mail regexp
-  * Implement Rails 3.0.4 handle unverified request
-  * Use secure_compare to compare passwords
-
-== 1.1.5
+* deprecations
+  * cookie_domain is deprecated in favor of cookie_options
+  * after_update_path_for can no longer be defined in ApplicationController
+
+* enhancements
+  * Added OmniAuth support
+  * Added ORM adapter to abstract ORM iteraction
+  * sign_out_via is available in the router to configure the method used for sign out (by github.com/martinrehfeld)
+  * Improved Ajax requests handling in failure app (by github.com/spastorino)
+  * Added request_keys to easily use request specific values (like subdomain) in authentication
+  * Increased the size of friendly_token to 60 characters (reduces the chances of a successful brute attack)
+  * Ensure the friendly token does not include "_" or "-" since some e-mails may not autolink it properly (by github.com/rymai)
+  * Extracted encryptors into :encryptable for better bcrypt support
+  * :rememberable is now able to use salt as token if no remember_token is provided
+  * Store the salt in session and expire the session if the user changes his password
+  * Allow :stateless_token to be set to true avoiding users to be stored in session through token authentication
+  * cookie_options uses session_options values by default
+  * Sign up now check if the user is active or not and redirect him accordingly setting the inactive_signed_up message
+  * Use ActiveModel#to_key instead of #id
+  * sign_out_all_scopes now destroys the whole session
+  * Added case_insensitive_keys that automatically downcases the given keys, by default downcases only e-mail (by github.com/adahl)
+
+* default behavior changes
+  * sign_out_all_scopes defaults to true as security measure
+  * http authenticatable is disabled by default
+  * Devise does not intercept 401 returned from applications
 
 * bugfix
-  * Ensure to convert keys on indifferent hash
-
-* defaults
-  * Set config.http_authenticatable to false to avoid confusion
+  * after_sign_in_path_for always receives a resource
+  * Do not execute Warden::Callbacks on Devise::TestHelpers (by github.com/sgronblo)
+  * Password recovery and account unlocking takes into account authentication keys (by github.com/RStankov)
+  * FailureApp now properly handles nil request.format
+  * Fix a bug causing FailureApp to return with HTTP Auth Headers for IE7
+  * Ensure namespaces has proper scoped views
+  * Ensure Devise does not set empty flash messages (by github.com/sxross)
 
 == 1.1.4
 

data/README.rdoc

@@ -7,10 +7,11 @@ Devise is a flexible authentication solution for Rails based on Warden. It:
 * Allows you to have multiple roles (or models/scopes) signed in at the same time;
 * Is based on a modularity concept: use just what you really need.
 
-Right now it's composed of 11 modules:
+It's composed of 12 modules:
 
 * Database Authenticatable: encrypts and stores a password in the database to validate the authenticity of an user while signing in. The authentication can be done both through POST requests or HTTP Basic Authentication.
-* Token Authenticatable: signs in an user based on an authentication token (also known as "single access token"). The token can be given both through query string or HTTP Basic Authentication.
+* Token Authenticatable: signs in a user based on an authentication token (also known as "single access token"). The token can be given both through query string or HTTP Basic Authentication.
+* Omniauthable: adds Omniauth (github.com/intridea/omniauth) support;
 * Confirmable: sends emails with confirmation instructions and verifies whether an account is already confirmed during sign in.
 * Recoverable: resets the user password and sends reset instructions.
 * Registerable: handles signing up users through a registration process, also allowing them to edit and destroy their account.
@@ -19,58 +20,75 @@ Right now it's composed of 11 modules:
 * Timeoutable: expires sessions that have no activity in a specified period of time.
 * Validatable: provides validations of email and password. It's optional and can be customized, so you're able to define your own validations.
 * Lockable: locks an account after a specified number of failed sign-in attempts. Can unlock via email or after a specified time period.
+* Encryptable: allows support of other authentication mechanisms besides Bcrypt (the default).
 
-== Installation
+== Information
 
-Devise 1.1 supports Rails 3 and is NOT backward compatible. You can use the latest Rails 3 beta gem with Devise latest gem:
+=== The Devise Wiki
 
-  gem install devise --version=1.1.7
+The Devise Wiki has lots of additional information about Devise including many "how-to" articles and answers to the most frequently asked questions. Please browse the Wiki after finishing this README:
 
-If you want to use Rails master (from git repository) you need to use Devise from git repository and vice-versa.
+http://wiki.github.com/plataformatec/devise
 
-After you install Devise and add it to your Gemfile, you need to run the generator:
+=== Bug reports
 
-  rails generate devise:install
+If you discover a problem with Devise, we would like to know about it. However, we ask that you please review these guidelines before submitting a bug report:
 
-The generator will install an initializer which describes ALL Devise's configuration options and you MUST take a look at it. When you are done, you are ready to add Devise to any of your models using the generator:
+http://github.com/plataformatec/devise/wiki/Bug-reports
 
-  rails generate devise MODEL
+If you found a security bug, do *NOT* use the GitHub Issue tracker. Send private GitHub message or email to the maintainers listed in the bottom of the README.
 
-Replace MODEL by the class name you want to add devise, like User, Admin, etc. This will create a model (if one does not exist) and configure it with default Devise modules. The generator will also create a migration file (if your ORM support them) and configure your routes. Continue reading this file to understand exactly what the generator produces and how to use it.
+=== Google Group
+
+If you have any questions, comments, or concerns please use the Google Group instead of the GitHub Issues tracker:
+
+http://groups.google.com/group/plataformatec-devise
+
+=== RDocs
 
-== Rails 2.3
+You can view the Devise documentation in RDoc format here:
 
-If you want to use the Rails 2.3.x version, you should do:
+http://rubydoc.info/github/plataformatec/devise/master/frames
 
-  gem install devise --version=1.0.10
+If you need to use Devise with Rails 2.3, you can always run `gem server` from the command line after you install the gem to access the old documentation.
 
-And please check the README at the v1.0 branch since this one is based on Rails 3:
+=== Example Applications
 
-  http://github.com/plataformatec/devise/tree/v1.0
+There are a few example applications available on GitHub that demonstrate various features of Devise with different versions of Rails. You can view them here:
 
-== Ecosystem
+http://github.com/plataformatec/devise/wiki/Example-Applications
 
-Devise ecosystem is growing solid day after day. If you just need a walkthrough about setting up Devise, this README will work great. But if you need more documentation and resources, please check both the wiki and rdoc:
+=== Extensions
 
-* http://rdoc.info/projects/plataformatec/devise
-* http://wiki.github.com/plataformatec/devise
+Our community has created a number of extensions that add functionality above and beyond what is included with Devise. You can view a list of available extensions and add your own here:
 
-Both links above are for Devise with Rails 3. If you need to use Devise with Rails 2.3, you can always run `gem server` from the command line after you install the gem to access the old documentation.
+http://github.com/plataformatec/devise/wiki/Extensions
 
-Another great way to learn Devise are Ryan Bates' screencasts:
+=== Contributing
 
-* http://railscasts.com/episodes/209-introducing-devise
-* http://railscasts.com/episodes/210-customizing-devise
+We hope that you will consider contributing to Devise. Please read this short overview for some information about how to get started:
 
-And a few example applications:
+http://github.com/plataformatec/devise/wiki/Contributing
 
-* Rails 2.3 app using Devise at http://github.com/plataformatec/devise_example
-* Rails 2.3 app using Devise with subdomains at http://github.com/fortuity/subdomain-authentication
-* Rails 3.0 app with Mongoid at http://github.com/fortuity/rails3-mongoid-devise
+== Installation
+
+You can use the latest Rails 3 gem with the latest Devise gem:
+
+  gem install devise
+
+After you install Devise and add it to your Gemfile, you need to run the generator:
 
-Finally, Devise also has several extensions built by the community. Don't forget to check them at the end of this README. If you want to write an extension on your own, you should also check Warden (http://github.com/hassox/warden), a Rack Authentication Framework which Devise depends on.
+  rails generate devise:install
 
-== Basic Usage
+The generator will install an initializer which describes ALL Devise's configuration options and you MUST take a look at it. When you are done, you are ready to add Devise to any of your models using the generator:
+
+  rails generate devise MODEL
+
+Replace MODEL by the class name you want to add devise, like User, Admin, etc. This will create a model (if one does not exist) and configure it with default Devise modules. The generator will also create a migration file (if your ORM support them) and configure your routes. Continue reading this file to understand exactly what the generator produces and how to use it.
+
+Support for Rails 2.3.x can be found by installing Devise 1.0.x from the v1.0 branch.
+
+== Getting started
 
 This is a walkthrough with all steps you need to setup a devise resource, including model, migration, route files, and optional configuration.
 
@@ -99,17 +117,11 @@ Configure your routes after setting up your model. Open your config/routes.rb fi
 
   devise_for :users
 
-This will use your User model to create a set of needed routes (you can see them by running `rake routes`).
-
-Options for configuring your routes include :class_name (to set the class for that route), :path_prefix, :path and :path_names, where the last two have the same meaning as in common routes. The available :path_names are:
-
-  devise_for :users, :path => "usuarios", :path_names => { :sign_in => 'login', :sign_out => 'logout', :password => 'secret', :confirmation => 'verification', :unlock => 'unblock', :registration => 'register', :sign_up => 'cmon_let_me_in' }
-
-Be sure to check devise_for documentation for details.
+This will use your User model to create a set of needed routes (you can see them by running `rake routes`). If you invoked the devise generator, you noticed that this is exactly what the generator produces for us: model, routes and migrations.
 
-This exactly what the devise generator produces for you: model, routes and migrations. Don't forget to run rake db:migrate and you are ready to go! But don't stop reading here, we still have a lot to tell you.
+Don't forget to run rake db:migrate and you are ready to go! But don't stop reading here, we still have a lot to tell you.
 
-== Controller filters and helpers
+=== Controller filters and helpers
 
 Devise will create some helpers to use inside your controllers and views. To set up a controller with user authentication, just add this before_filter:
 
@@ -137,7 +149,25 @@ Finally, you need to set up default url options for the mailer in each environme
 
   config.action_mailer.default_url_options = { :host => 'localhost:3000' }
 
-== Tidying up
+Notice that if your devise model is not called "user" but "member", then the helpers you should use are:
+
+  before_filter :authenticate_member!
+
+  member_signed_in?
+
+  current_member
+
+  member_session
+
+=== Configuring Models
+
+The devise method in your models also accepts some options to configure its modules. For example, you can choose which encryptor to use in database_authenticatable:
+
+  devise :database_authenticatable, :confirmable, :recoverable, :stretches => 20
+
+Besides :stretches, you can define :pepper, :encryptor, :confirm_within, :remember_for, :timeout_in, :unlock_in and other values. For details, see the initializer file that was created when you invoked the "devise:install" generator described above.
+
+=== Configuring multiple models
 
 Devise allows you to set up as many roles as you want. For example, you may have a User model and also want an Admin model with just authentication, trackable, lockable and timeoutable features and no confirmation or password-recovery features. Just follow these steps:
 
@@ -163,15 +193,7 @@ Devise allows you to set up as many roles as you want. For example, you may have
   current_admin
   admin_session
 
-== Model configuration
-
-The devise method in your models also accepts some options to configure its modules. For example, you can choose which encryptor to use in database_authenticatable:
-
-  devise :database_authenticatable, :confirmable, :recoverable, :encryptor => :bcrypt
-
-Besides :encryptor, you can define :pepper, :stretches, :confirm_within, :remember_for, :timeout_in, :unlock_in and other values. For details, see the initializer file that was created when you invoked the "devise:install" generator described above.
-
-== Configuring views
+=== Configuring views
 
 We built Devise to help you quickly develop an application that uses authentication. However, we don't want to be in your way when you need to customize it.
 
@@ -179,11 +201,15 @@ Since Devise is an engine, all its views are packaged inside the gem. These view
 
   rails generate devise:views
 
-However, if you have more than one role in your application (such as "User" and "Admin"), you will notice that Devise uses the same views for all roles. Fortunately, Devise offers an easy way to customize views. All you need to do is set "config.scoped_views = true" inside "config/initializers/devise.rb".
+If you are using HAML, you will need hpricot installed to convert Devise views to HAML.
+
+If you have more than one role in your application (such as "User" and "Admin"), you will notice that Devise uses the same views for all roles. Fortunately, Devise offers an easy way to customize views. All you need to do is set "config.scoped_views = true" inside "config/initializers/devise.rb".
 
-After doing so, you will be able to have views based on the role like "users/sessions/new" and "admins/sessions/new". If no view is found within the scope, Devise will use the default view at "devise/sessions/new".
+After doing so, you will be able to have views based on the role like "users/sessions/new" and "admins/sessions/new". If no view is found within the scope, Devise will use the default view at "devise/sessions/new". You can also use the generator to generate scoped views:
 
-== Configuring controllers
+  rails generate devise:views users
+
+=== Configuring controllers
 
 If the customization at the views level is not enough, you can customize each controller by following these steps:
 
@@ -194,13 +220,35 @@ If the customization at the views level is not enough, you can customize each co
 
 2) Tell the router to use this controller:
 
-    devise_for :admins, :controllers => { :sessions => "admin/sessions" }
+    devise_for :admins, :controllers => { :sessions => "admins/sessions" }
 
 3) And since we changed the controller, it won't use the "devise/sessions" views, so remember to copy "devise/sessions" to "admin/sessions".
 
 Remember that Devise uses flash messages to let users know if sign in was successful or failed. Devise expects your application to call "flash[:notice]" and "flash[:alert]" as appropriate.
 
-== I18n
+=== Configuring routes
+
+Devise also ships with default routes. If you need to customize them, you should probably be able to do it through the devise_for method. It accepts several options like :class_name, :path_prefix and so on, including the possibility to change path names for I18n:
+
+  devise_for :users, :path => "usuarios", :path_names => { :sign_in => 'login', :sign_out => 'logout', :password => 'secret', :confirmation => 'verification', :unlock => 'unblock', :registration => 'register', :sign_up => 'cmon_let_me_in' }
+
+Be sure to check devise_for documentation for details.
+
+If you have the need for more deep customization, for instance to also allow "/sign_in" besides "/users/sign_in", all you need to do is to create your routes normally and wrap them in a +devise_scope+ block in the router:
+
+  devise_scope :user do
+    get "sign_in", :to => "devise/sessions#new"
+  end
+
+This way you tell devise to use the scope :user when "/sign_in" is accessed. Notice +devise_scope+ is also aliased as +as+ and you can also give a block to +devise_for+, resulting in the same behavior:
+
+  devise_for :users do
+    get "sign_in", :to => "devise/sessions#new"
+  end
+
+Feel free to choose the one you prefer!
+
+=== I18n
 
 Devise uses flash messages with I18n with the flash keys :success and :failure. To customize your app, you can set up your locale file:
 
@@ -219,19 +267,22 @@ You can also create distinct messages based on the resource you've configured us
         admin:
           signed_in: 'Hello admin!'
 
-The Devise mailer uses the same pattern to create subject messages:
+The Devise mailer uses a similar pattern to create subject messages:
 
   en:
     devise:
       mailer:
-        confirmation_instructions: 'Hello everybody!'
-        user:
-          confirmation_instructions: 'Hello User! Please confirm your email'
-          reset_password_instructions: 'Reset instructions'
+        confirmation_instructions:
+          subject: 'Hello everybody!'
+          user_subject: 'Hello User! Please confirm your email'
+        reset_password_instructions:
+          subject: 'Reset instructions'
+
+Take a look at our locale file to check all available messages. You may also be interested in one of the many translations that are available on our wiki:
 
-Take a look at our locale file to check all available messages.
+http://github.com/plataformatec/devise/wiki/I18n
 
-== Test helpers
+=== Test helpers
 
 Devise includes some tests helpers for functional specs. To use them, you just need to include Devise::TestHelpers in your test class and use the sign_in and sign_out method. Such methods have the same signature as in controllers:
 
@@ -241,70 +292,53 @@ Devise includes some tests helpers for functional specs. To use them, you just n
   sign_out :user         # sign_out(scope)
   sign_out @user         # sign_out(resource)
 
-You can include the Devise Test Helpers in all of your tests by adding the following to the bottom of your test/test_helper.rb or spec/spec_helper.rb file:
+You can include the Devise Test Helpers in all of your tests by adding the following to the bottom of your test/test_helper.rb file:
 
   class ActionController::TestCase
     include Devise::TestHelpers
   end
 
-Do not use such helpers for integration tests such as Cucumber or Webrat. Instead, fill in the form or explicitly set the user in session. For more tips, check the wiki (http://wiki.github.com/plataformatec/devise).
-
-== Migrating from other solutions
-
-Devise implements encryption strategies for Clearance, Authlogic and Restful-Authentication. To make use of these strategies, set the desired encryptor in the encryptor initializer config option. You might also need to rename your encrypted password and salt columns to match Devise's fields (encrypted_password and password_salt).
+If you're using RSpec and want the helpers automatically included within all +describe+ blocks, add a file called spec/support/devise.rb with the following contents:
 
-== Other ORMs
-
-Devise supports ActiveRecord (by default) and Mongoid. We offer experimental Datamapper support (with the limitation that the Devise test suite does not run completely with Datamapper). To choose other ORM, you just need to configure it in the initializer file.
-
-== Extensions
-
-Devise also has extensions created by the community:
-
-* http://github.com/scambra/devise_invitable adds support to Devise for sending invitations by email.
+  RSpec.configure do |config|
+    config.include Devise::TestHelpers, :type => :controller
+  end
 
-* http://github.com/grimen/devise_facebook_connectable adds support for Facebook Connect authentication, and optionally fetching user info from Facebook in the same step.
+Do not use such helpers for integration tests such as Cucumber or Webrat. Instead, fill in the form or explicitly set the user in session. For more tips, check the wiki (http://wiki.github.com/plataformatec/devise).
 
-* http://github.com/joshk/devise_imapable adds support for imap based authentication, excellent for internal apps when an LDAP server isn't available.
+=== OAuth2
 
-* http://github.com/cschiewek/devise_ldap_authenticatable adds support for LDAP authentication via simple bind.
+Devise comes with OAuth support out of the box if you're using Devise from the git repository (for now). You can read more about OAuth2 support in the wiki:
 
-Please consult their respective documentation for more information and requirements.
+* http://github.com/plataformatec/devise/wiki/OAuth2:-Overview
+* http://github.com/plataformatec/devise/wiki/OAuth2:-Testing
 
-== TODO
+=== Other ORMs
 
-Please refer to TODO file.
+Devise supports ActiveRecord (default) and Mongoid. To choose other ORM, you just need to require it in the initializer file.
 
-== Security
+=== Migrating from other solutions
 
-Needless to say, security is extremely important to Devise. If you find yourself in a possible security issue with Devise, please go through the following steps, trying to reproduce the bug:
+Devise implements encryption strategies for Clearance, Authlogic and Restful-Authentication. To make use of these strategies, you need set the desired encryptor in the encryptor initializer config option and add :encryptable to your model. You might also need to rename your encrypted password and salt columns to match Devise's fields (encrypted_password and password_salt).
 
-1) Look at the source code a bit to find out whether your assumptions are correct;
-2) If possible, provide a way to reproduce the bug: a small app on Github or a step-by-step to reproduce;
-3) E-mail us or send a Github private message instead of using the normal issues;
+== Additional information
 
-Being able to reproduce the bug is the first step to fix it. Thanks for your understanding.
+=== Warden
 
-== Maintainers
+Devise is based on Warden, which is a general Rack authentication framework created by Daniel Neighman. We encourage you to read more about Warden here:
 
-* José Valim (http://github.com/josevalim)
-* Carlos Antônio da Silva (http://github.com/carlosantoniodasilva)
+http://github.com/hassox/warden
 
-== Contributors
+=== Contributors
 
 We have a long list of valued contributors. Check them all at:
 
 http://github.com/plataformatec/devise/contributors
 
-== Bugs and Feedback
-
-If you discover any bugs, please create an issue on GitHub.
-
-http://github.com/plataformatec/devise/issues
+=== Maintainers
 
-For support, send an e-mail to the mailing list.
-
-http://groups.google.com/group/plataformatec-devise
+* José Valim (http://github.com/josevalim)
+* Carlos Antônio da Silva (http://github.com/carlosantoniodasilva)
 
 == License
 

data/app/controllers/devise/confirmations_controller.rb

@@ -3,7 +3,7 @@ class Devise::ConfirmationsController < ApplicationController
 
   # GET /resource/confirmation/new
   def new
-    build_resource
+    build_resource({})
     render_with_scope :new
   end
 

data/app/controllers/devise/omniauth_callbacks_controller.rb

@@ -0,0 +1,26 @@
+class Devise::OmniauthCallbacksController < ApplicationController
+  include Devise::Controllers::InternalHelpers
+
+  def failure
+    set_flash_message :alert, :failure, :kind => failed_strategy.name.to_s.humanize, :reason => failure_message
+    redirect_to after_omniauth_failure_path_for(resource_name)
+  end
+
+  protected
+
+  def failed_strategy
+    env["omniauth.failed_strategy"]
+  end
+
+  def failure_message
+    exception = env["omniauth.error"]
+    error   = exception.error_reason if exception.respond_to?(:error_reason)
+    error ||= exception.error        if exception.respond_to?(:error)
+    error ||= env["omniauth.failure_key"]
+    error.to_s.humanize if error
+  end
+
+  def after_omniauth_failure_path_for(scope)
+    new_session_path(scope)
+  end
+end