devise_invitable 1.1.8 → 1.3.0

data/CHANGELOG

@@ -0,0 +1,5 @@
+= 1.3.0
+Now devise 3.1 compatible, @token must be used instead of @resource.invitation_token in mail views
+
+= 1.2.0
+Add invitation_created_at column which is set when invitation is created even when sending is skipped. This new field is used to check invitation period valid

data/README.rdoc

@@ -3,7 +3,9 @@
 
 It adds support to devise[http://github.com/plataformatec/devise] for send invitations by email (it requires to be authenticated) and accept the invitation setting the password.
 
-DeviseInvitable currently only support Rails 3, if you want to use it with Rails 2.3 you must install version {0.2.3}[http://rubygems.org/gems/devise_invitable/versions/0.2.3]
+DeviseInvitable currently supports Rails 3 and 4, if you want to use it with Rails 2.3 you must install version {0.2.3}[http://rubygems.org/gems/devise_invitable/versions/0.2.3]
+
+If you want to use devise 3.0.x, you must use 1.2.1, newer versions require devise >= 3.1.0
 
 == Installation
 
@@ -45,7 +47,8 @@ Add t.invitable to your Devise model migration:
   create_table :users do
     ...
       ## Invitable
-      t.string   :invitation_token, :limit => 60
+      t.string   :invitation_token
+      t.datetime :invitation_created_at
       t.datetime :invitation_sent_at
       t.datetime :invitation_accepted_at
       t.integer  :invitation_limit
@@ -57,14 +60,15 @@ Add t.invitable to your Devise model migration:
 
 or for a model that already exists, define a migration to add DeviseInvitable to your model:
 
-  change_table :users do |t|
-      t.string   :invitation_token, :limit => 60
-      t.datetime :invitation_sent_at
-      t.datetime :invitation_accepted_at
-      t.integer  :invitation_limit
-      t.integer  :invited_by_id
-      t.string   :invited_by_type
-
+  def change
+      add_column :users, :invitation_token, :string
+      add_column :users, :invitation_created_at, :datetime
+      add_column :users, :invitation_sent_at, :datetime 
+      add_column :users, :invitation_accepted_at, :datetime
+      add_column :users, :invitation_limit, :integer
+      add_column :users, :invited_by_id, :integer
+      add_column :users, :invited_by_type, :string
+      add_index :users, :invitation_token, :unique => true
   end
 
   # Allow null encrypted_password
@@ -72,10 +76,21 @@ or for a model that already exists, define a migration to add DeviseInvitable to
   # Allow null password_salt (add it if you are using Devise's encryptable module)
   change_column :users, :password_salt, :string, :null => true
 
+If you previously used devise_invitable with a :limit on :invitation_token, remove it:
+
+  def up
+    change_column :users, :invitation_token, :string, :limit => nil
+  end
+  
+  def down
+    change_column :users, :invitation_token, :string, :limit => 60
+  end
+
 == Mongoid Field Definitions
 If you are using Mongoid, define the following fields and indexes within your invitable model:
 
   field :invitation_token, type: String
+  field :invitation_created_at, type: Time
   field :invitation_sent_at, type: Time
   field :invitation_accepted_at, type: Time
   field :invitation_limit, type: Integer
@@ -129,6 +144,10 @@ You can also use the generator to generate scoped views:
 
   rails generate devise_invitable:views users
 
+Then turn scoped views on in config/initializers/devise.rb:
+
+  config.scoped_views = true
+
 Please refer to {Devise's README}[http://github.com/plataformatec/devise] for more information about views.
 
 == Configuring controllers
@@ -153,6 +172,15 @@ be sure that you generate the views and put them into the controller that you ge
 
   rails generate devise_invitable:views users/invitations
 
+== Strong Parameters
+
+When you customize your own views, you may end up adding new attributes to forms. Rails 4 moved the parameter sanitization from the model to the controller, causing DeviseInvitable to handle this concern at the controller as well. Read about it in {devise README}[http://github.com/plataformatec/devise#strong-parameters]
+
+There are just two actions in DeviseInvitable that allows any set of parameters to be passed down to the model, therefore requiring sanitization. Their names and the permited parameters by default are:
+
+* invite (Devise::InvitationsController#create) - Permits only the authentication keys (like email)
+* accept_invitation (Devise::InvitationsController#update) - Permits invitation_token plus password and password_confirmation
+
 == Usage
 
 === Send an invitation
@@ -173,8 +201,7 @@ When skip_invitation is used, you must also then set the invitation_sent_at fiel
 token. Failure to do so will yield "Invalid invitation token" errors when the user attempts to accept the invite.
 You can set it like so:
 
-  user.invitation_sent_at = Time.now.utc
-  user.save!
+  user.deliver_invitation
 
 You can add :skip_invitation to attributes hash if skip_invitation is added to attr_accessible.
 

data/app/controllers/devise/invitations_controller.rb

@@ -8,16 +8,16 @@ class Devise::InvitationsController < DeviseController
 
   # GET /resource/invitation/new
   def new
-    build_resource
+    self.resource = resource_class.new
     render :new
   end
 
   # POST /resource/invitation
   def create
-    self.resource = resource_class.invite!(resource_params, current_inviter)
+    self.resource = invite_resource
 
     if resource.errors.empty?
-      set_flash_message :notice, :send_instructions, :email => self.resource.email
+      set_flash_message :notice, :send_instructions, :email => self.resource.email if self.resource.invitation_sent_at
       respond_with resource, :location => after_invite_path_for(resource)
     else
       respond_with_navigational(resource) { render :new }
@@ -26,12 +26,13 @@ class Devise::InvitationsController < DeviseController
 
   # GET /resource/invitation/accept?invitation_token=abcdef
   def edit
+    resource.invitation_token = params[:invitation_token]
     render :edit
   end
 
   # PUT /resource/invitation
   def update
-    self.resource = resource_class.accept_invitation!(resource_params)
+    self.resource = resource_class.accept_invitation!(update_resource_params)
 
     if resource.errors.empty?
       flash_message = resource.active_for_authentication? ? :updated : :updated_not_active                                                                                        
@@ -51,24 +52,37 @@ class Devise::InvitationsController < DeviseController
   end
 
   protected
+
+  def invite_resource
+    resource_class.invite!(invite_params, current_inviter)
+  end
+
   def current_inviter
     @current_inviter ||= authenticate_inviter!
   end
 
   def has_invitations_left?
     unless current_inviter.nil? || current_inviter.has_invitations_left?
-      build_resource
+      self.resource = resource_class.new
       set_flash_message :alert, :no_invitations_remaining
       respond_with_navigational(resource) { render :new }
     end
   end
   
   def resource_from_invitation_token
-    unless params[:invitation_token] && self.resource = resource_class.to_adapter.find_first(params.slice(:invitation_token))
+    unless params[:invitation_token] && self.resource = resource_class.find_by_invitation_token(params[:invitation_token], true)
       set_flash_message(:alert, :invitation_token_invalid)
       redirect_to after_sign_out_path_for(resource_name)
     end
   end
+
+  def invite_params
+    devise_parameter_sanitizer.sanitize(:invite)
+  end
+
+  def update_resource_params
+    devise_parameter_sanitizer.sanitize(:accept_invitation)
+  end
   
 end
 

data/app/controllers/devise_invitable/registrations_controller.rb

@@ -1,8 +1,8 @@
 class DeviseInvitable::RegistrationsController < Devise::RegistrationsController
   protected
 
-  def build_resource(*args)
-    hash = args.pop || resource_params || {}
+  def build_resource(hash = nil)
+    hash ||= resource_params || {}
     if hash[:email]
       self.resource = resource_class.where(:email => hash[:email], :encrypted_password => '').first
       if self.resource

data/app/views/devise/mailer/invitation_instructions.html.erb

@@ -2,7 +2,7 @@
 
 <p>Someone has invited you to <%= root_url %>, you can accept it through the link below.</p>
 
-<p><%= link_to 'Accept invitation', accept_invitation_url(@resource, :invitation_token => @resource.invitation_token) %></p>
+<p><%= link_to 'Accept invitation', accept_invitation_url(@resource, :invitation_token => @token) %></p>
 
 <p>If you don't want to accept the invitation, please ignore this email.<br />
 Your account won't be created until you access the link above and set your password.</p>

data/lib/devise_invitable/mailer.rb

@@ -4,13 +4,9 @@ module DeviseInvitable
   module Mailer
 
     # Deliver an invitation email
-    def invitation_instructions(record, opts={})
-      # optional arguments introduced in Devise 2.2.0, remove check once support for < 2.2.0 is dropped.
-      if Gem::Version.new(Devise::VERSION.dup) < Gem::Version.new('2.2.0')
-        devise_mail(record, :invitation_instructions)
-      else
-        devise_mail(record, :invitation_instructions, opts)
-      end
+    def invitation_instructions(record, token, opts={})
+      @token = token
+      devise_mail(record, :invitation_instructions, opts)
     end
   end
 end

data/lib/devise_invitable/model.rb

@@ -42,7 +42,7 @@ module Devise
         attr_writer :skip_password
 
         scope :active, lambda { where(:invitation_token => nil) }
-        if defined?(Mongoid) && self < Mongoid::Document
+        if defined?(Mongoid) && defined?(Mongoid::Document) && self < Mongoid::Document
           scope :invitation_not_accepted, lambda { where(:invitation_accepted_at => nil, :invitation_token.ne => nil) }
           scope :invitation_accepted, lambda { where(:invitation_accepted_at.ne => nil) }
         else
@@ -50,15 +50,13 @@ module Devise
           scope :invitation_accepted, lambda { where(arel_table[:invitation_accepted_at].not_eq(nil)) }
 
           [:before_invitation_accepted, :after_invitation_accepted].each do |callback_method|
-            send callback_method do
-              notify_observers callback_method
-            end
+            send callback_method
           end
         end
       end
 
       def self.required_fields(klass)
-        fields = [:invitation_token, :invitation_sent_at, :invitation_accepted_at,
+        fields = [:invitation_token, :invitation_created_at, :invitation_sent_at, :invitation_accepted_at,
          :invitation_limit, :invited_by_id, :invited_by_type]
         if Devise.invited_by_class_name
           fields -= [:invited_by_type]
@@ -66,14 +64,6 @@ module Devise
         fields
       end
 
-      def invitation_fields
-        fields = [:invitation_sent_at, :invited_by_id, :invited_by_type]
-        if Devise.invited_by_class_name
-          fields -= [:invited_by_type]
-        end
-        fields
-      end
-
       # Accept an invitation by clearing invitation token and and setting invitation_accepted_at
       def accept_invitation
         self.invitation_accepted_at = Time.now.utc
@@ -113,11 +103,6 @@ module Devise
         invitation_accepted? || !invited_to_sign_up?
       end
 
-      def invited?
-        ActiveSupport::Deprecation.warn "invited? is deprecated and will be removed from DeviseInvitable 1.1.0 (use invited_to_sign_up? instead)"
-        invited_to_sign_up?
-      end
-
       # Reset invitation token and send invitation again
       def invite!(invited_by = nil)
         was_invited = invited_to_sign_up?
@@ -128,8 +113,9 @@ module Devise
           def self.confirmation_required?; false; end
         end
 
-        generate_invitation_token if self.invitation_token.nil?
-        self.invitation_sent_at = Time.now.utc unless @skip_invitation
+        generate_invitation_token if self.invitation_token.nil? || (!@skip_invitation && @raw_invitation_token.nil?)
+        self.invitation_created_at = Time.now.utc
+        self.invitation_sent_at = self.invitation_created_at unless @skip_invitation
         self.invited_by = invited_by if invited_by
 
         # Call these before_validate methods since we aren't validating on save
@@ -159,13 +145,19 @@ module Devise
         accept_invitation! if invited_to_sign_up?
       end
 
-      def invite_key_valid?
-        return true unless self.class.invite_key.is_a? Hash # FIXME: remove this line when deprecation is removed
-        self.class.invite_key.all? do |key, regexp|
-          regexp.nil? || self.send(key).try(:match, regexp)
+      def clear_errors_on_valid_keys
+        self.class.invite_key.each do |key, regexp|
+          self.errors.delete(key) if regexp.nil? || self.send(key).try(:match, regexp)
         end
       end
 
+      # Deliver the invitation email
+      def deliver_invitation
+        generate_invitation_token! unless @raw_invitation_token
+        self.update_attribute :invitation_sent_at, Time.now.utc unless self.invitation_sent_at
+        send_devise_notification(:invitation_instructions, @raw_invitation_token)
+      end
+
       protected
         # Overriding the method in Devise's :validatable module so password is not required on inviting
         def password_required?
@@ -176,11 +168,6 @@ module Devise
           respond_to?(:confirmation_required?, true) && confirmation_required? && invitation_accepted?
         end
 
-        # Deliver the invitation email
-        def deliver_invitation
-          send_devise_notification(:invitation_instructions)
-        end
-
         # Checks if the invitation for the user is within the limit time.
         # We do this by calculating if the difference between today and the
         # invitation sent date does not exceed the invite for time configured.
@@ -201,32 +188,35 @@ module Devise
         #   invitation_period_valid?   # will always return true
         #
         def invitation_period_valid?
-          invitation_sent_at && (self.class.invite_for.to_i.zero? || invitation_sent_at.utc >= self.class.invite_for.ago)
+          time = invitation_created_at || invitation_sent_at
+          time && (self.class.invite_for.to_i.zero? || time.utc >= self.class.invite_for.ago)
         end
 
         # Generates a new random token for invitation, and stores the time
         # this token is being generated
         def generate_invitation_token
-          self.invitation_token   = self.class.invitation_token
+          raw, enc = Devise.token_generator.generate(self.class, :invitation_token)
+          @raw_invitation_token = raw
+          self.invitation_token = enc
+        end
+
+        def generate_invitation_token!
+          generate_invitation_token && save(:validate => false)
         end
 
       module ClassMethods
         # Return fields to invite
         def invite_key_fields
-          if invite_key.is_a? Hash
-            invite_key.keys
-          else
-            ActiveSupport::Deprecation.warn("invite_key should be a hash like {#{invite_key.inspect} => /.../}")
-            Array(invite_key)
-          end
+          invite_key.keys
         end
 
-        # Attempt to find a user by it's email. If a record is not found, create a new
-        # user and send invitation to it. If user is found, returns the user with an
-        # email already exists error.
-        # If user is found and still have pending invitation, email is resend unless
-        # resend_invitation is set to false
-        # Attributes must contain the user email, other attributes will be set in the record
+        # Attempt to find a user by its email. If a record is not found,
+        # create a new user and send an invitation to it. If the user is found,
+        # return the user with an email already exists error.
+        # If the user is found and still has a pending invitation, invitation
+        # email is resent unless resend_invitation is set to false.
+        # Attributes must contain the user's email, other attributes will be
+        # set in the record
         def _invite(attributes={}, invited_by=nil, &block)
           invite_key_array = invite_key_fields
           attributes_hash = {}
@@ -235,34 +225,26 @@ module Devise
           end
 
           invitable = find_or_initialize_with_errors(invite_key_array, attributes_hash)
-          invitable.assign_attributes(attributes, :as => inviter_role(invited_by))
+          invitable.assign_attributes(attributes)
           invitable.invited_by = invited_by
 
           invitable.skip_password = true
           invitable.valid? if self.validate_on_invite
           if invitable.new_record?
-            invitable.errors.clear if !self.validate_on_invite and invitable.invite_key_valid?
+            invitable.clear_errors_on_valid_keys if !self.validate_on_invite
           elsif !invitable.invited_to_sign_up? || !self.resend_invitation
             invite_key_array.each do |key|
               invitable.errors.add(key, :taken)
             end
           end
 
-          if invitable.errors.empty?
-            yield invitable if block_given?
-            mail = invitable.invite!
-          end
+          yield invitable if block_given?
+          mail = invitable.invite! if invitable.errors.empty?
           [invitable, mail]
         end
 
-        # Override this method if the invitable is using Mass Assignment Security
-        # and the inviter has a non-default role.
-        def inviter_role(inviter)
-          :default
-        end
-
         def invite!(attributes={}, invited_by=nil, &block)
-          invitable, mail = _invite(attributes, invited_by, &block)
+          invitable, mail = _invite(attributes.with_indifferent_access, invited_by, &block)
           invitable
         end
 
@@ -277,15 +259,27 @@ module Devise
         # error in invitation_token attribute.
         # Attributes must contain invitation_token, password and confirmation
         def accept_invitation!(attributes={})
-          invitable = find_or_initialize_with_error_by(:invitation_token, attributes.delete(:invitation_token))
-          invitable.errors.add(:invitation_token, :invalid) if invitable.invitation_token && invitable.persisted? && !invitable.valid_invitation?
+          original_token = attributes.delete(:invitation_token)
+          invitable = find_by_invitation_token(original_token, false)
           if invitable.errors.empty?
-            invitable.assign_attributes(attributes, :as => inviter_role(self))
+            invitable.assign_attributes(attributes)
             invitable.accept_invitation!
           end
           invitable
         end
 
+        def find_by_invitation_token(original_token, only_valid)
+          invitation_token = Devise.token_generator.digest(self, :invitation_token, original_token)
+          
+          invitable = find_or_initialize_with_error_by(:invitation_token, invitation_token)
+          if !invitable.persisted? && Devise.allow_insecure_token_lookup
+            invitable = find_or_initialize_with_error_by(:invitation_token, original_token)
+          end
+          invitable.errors.add(:invitation_token, :invalid) if invitable.invitation_token && invitable.persisted? && !invitable.valid_invitation?
+          invitable.invitation_token = original_token
+          invitable unless only_valid && invitable.errors.present?
+        end
+
         # Generate a token checking if one does not already exist in the database.
         def invitation_token
           generate_token(:invitation_token)

data/lib/devise_invitable/parameter_sanitizer.rb

@@ -0,0 +1,11 @@
+module DeviseInvitable
+  module ParameterSanitizer
+    def invite
+      default_params.permit(resource_class.invite_key_fields)
+    end
+
+    def accept_invitation
+      default_params.permit([:password, :password_confirmation, :invitation_token])
+    end
+  end
+end

data/lib/devise_invitable/rails.rb

@@ -17,6 +17,7 @@ module DeviseInvitable
     # extend mapping with after_initialize becuase is not reloaded
     config.after_initialize do
       Devise::Mapping.send :include, DeviseInvitable::Mapping
+      Devise::ParameterSanitizer.send :include, DeviseInvitable::ParameterSanitizer
     end
   end
 end

data/lib/devise_invitable/version.rb

@@ -1,3 +1,3 @@
 module DeviseInvitable
-  VERSION = '1.1.8'
+  VERSION = '1.3.0'
 end

data/lib/devise_invitable.rb

@@ -2,6 +2,7 @@ module DeviseInvitable
   autoload :Inviter, 'devise_invitable/inviter'
   autoload :Mailer, 'devise_invitable/mailer'
   autoload :Mapping, 'devise_invitable/mapping'
+  autoload :ParameterSanitizer, 'devise_invitable/parameter_sanitizer'
   module Controllers
     autoload :UrlHelpers, 'devise_invitable/controllers/url_helpers'
     autoload :Registrations, 'devise_invitable/controllers/registrations'

data/lib/generators/active_record/templates/migration.rb

@@ -1,7 +1,8 @@
 class DeviseInvitableAddTo<%= table_name.camelize %> < ActiveRecord::Migration
   def up
     change_table :<%= table_name %> do |t|
-      t.string     :invitation_token, :limit => 60
+      t.string     :invitation_token
+      t.datetime   :invitation_created_at
       t.datetime   :invitation_sent_at
       t.datetime   :invitation_accepted_at
       t.integer    :invitation_limit
@@ -20,7 +21,7 @@ class DeviseInvitableAddTo<%= table_name.camelize %> < ActiveRecord::Migration
   def down
     change_table :<%= table_name %> do |t|
       t.remove_references :invited_by, :polymorphic => true
-      t.remove :invitation_limit, :invitation_sent_at, :invitation_accepted_at, :invitation_token
+      t.remove :invitation_limit, :invitation_sent_at, :invitation_accepted_at, :invitation_token, :invitation_created_at
     end
   end
 end

data/test/functional/controller_helpers_test.rb

@@ -0,0 +1,39 @@
+require 'test_helper'
+
+class ControllerHelpersTest < ActionController::TestCase
+  tests ApplicationController
+
+  test "after invite path defaults to after sign in path" do
+    assert_equal @controller.after_sign_in_path_for(:user), @controller.after_invite_path_for(:user)
+  end
+  
+  test "after accept path defaults to after sign in path" do
+    assert_equal @controller.after_sign_in_path_for(:user), @controller.after_accept_path_for(:user)
+  end
+  
+  test 'after invite path is customizable from application controller' do
+    custom_path = 'customized/after/invite/path'
+    @controller.instance_eval "def after_invite_path_for(resource) '#{custom_path}' end"
+    assert_equal @controller.after_invite_path_for(:user), custom_path
+  end
+  
+  test 'after accept path is customizable from application controller' do
+    custom_path = 'customized/after/accept/path'
+    @controller.instance_eval "def after_accept_path_for(resource) '#{custom_path}' end"
+    assert_equal @controller.after_accept_path_for(:user), custom_path
+  end
+  
+  test 'is not a devise controller' do
+    assert !@controller.devise_controller?
+  end
+  
+  test 'invitations controller respects definition for after invite path in application controller' do
+    assert Devise::InvitationsController.method_defined? :after_invite_path_for
+    assert !Devise::InvitationsController.instance_methods(false).include?(:after_invite_path_for)
+  end
+  
+  test 'invitations controller respects definition for after accept path in application controller' do
+    assert Devise::InvitationsController.method_defined? :after_accept_path_for
+    assert !Devise::InvitationsController.instance_methods(false).include?(:after_accept_path_for)
+  end
+end

data/test/functional/registrations_controller_test.rb

@@ -0,0 +1,59 @@
+require 'test_helper'
+require 'model_tests_helper'
+
+class DeviseInvitable::RegistrationsControllerTest < ActionController::TestCase
+  def setup
+    @issuer = new_user#users(:issuer)
+    @issuer.valid?
+    assert @issuer.valid?, 'starting with a valid user record'
+
+    # josevalim: you are required to do that because the routes sets this kind
+    # of stuff automatically. But functional tests are not using the routes.
+    # see https://github.com/plataformatec/devise/issues/1196
+    @request.env["devise.mapping"] = Devise.mappings[:user]
+  end
+
+  test "invited users may still sign up directly by themselves" do
+    # invite the invitee
+    sign_in @issuer
+    invitee_email = "invitee@example.org"
+
+    User.invite!(:email => invitee_email) do |u|
+      u.skip_invitation = true
+      u.invited_by = @issuer
+    end
+    sign_out @issuer
+
+    @invitee = User.where(:email => invitee_email).first
+    assert_blank @invitee.encrypted_password, "the password should be unset"
+
+    # sign_up the invitee
+    assert_difference('ActionMailer::Base.deliveries.size') do
+      post :create, :user => {:email => invitee_email, :password => "1password", :bio => '.'}
+    end
+
+    @invitee = User.where(:email => invitee_email).first
+    assert_present @invitee.encrypted_password
+    assert_not_nil @invitee.invitation_accepted_at
+    assert_nil @invitee.invitation_token
+    assert_present @invitee.invited_by_id
+    assert_present @invitee.invited_by_type
+    assert !@invitee.confirmed?
+    assert_present @invitee.confirmation_token
+  end
+
+  test "not invitable resources can register" do
+    @request.env["devise.mapping"] = Devise.mappings[:admin]
+    invitee_email = "invitee@example.org"
+
+    post :create, :admin => {:email => invitee_email, :password => "1password"}
+
+    @invitee = Admin.where(:email => invitee_email).first
+    assert_present @invitee.encrypted_password
+  end
+
+  test "missing params on a create should not cause an error" do
+
+    assert_nothing_raised { post :create }
+  end
+end

data/test/generators/views_generator_test.rb

@@ -0,0 +1,40 @@
+require 'test_helper'
+require 'fileutils'
+require 'rails/generators'
+require File.expand_path('../../lib/generators/devise_invitable/views_generator.rb', File.dirname(__FILE__))
+
+class ViewsGeneratorTest < ::Rails::Generators::TestCase
+  tests DeviseInvitable::Generators::ViewsGenerator
+  destination File.expand_path('../../tmp', File.dirname(__FILE__))
+
+  test 'views get copied' do
+    run_generator
+
+    assert_directory @mailer_path       = 'app/views/devise/mailer'
+    assert_directory @invitations_path  = 'app/views/devise/invitations'
+    assert_files
+  end
+
+  test 'views can be scoped' do
+    run_generator %w(octopussies)
+
+    assert_directory @mailer_path       = 'app/views/octopussies/mailer'
+    assert_directory @invitations_path  = 'app/views/octopussies/invitations'
+    assert_files
+  end
+
+  def teardown
+    FileUtils.rm_r Dir['../../tmp/*']
+  end
+
+  private
+  def assert_files
+    assert views = { @invitations_path => %w/edit.html.erb new.html.erb/, @mailer_path => %w/invitation_instructions.html.erb/ }
+
+    views.each do |path, files|
+      files.each do |file|
+        assert_file File.join path, file
+      end
+    end
+  end
+end