devise_invitable 1.3.4 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: ec084ea3f59520fb7b2cfb978cd79d53ec5c1488
-  data.tar.gz: 257a48340805f6bfe02bc4fd1279a8694ab24c5c
+  metadata.gz: 9ebdddd2e1426fdde9ad700f7f60e4cedf3e48ab
+  data.tar.gz: 3a783c0d76c73a4a6af2c07cda15b80904fecdcf
 SHA512:
-  metadata.gz: 51c1385e5d2235ef7d3004208e489ecd241e99ade5afd8d7f5a1289e48cc7e9af6ba599b058862b82c5eb9c64ee02dc63d1be1526d692ccd86c33099bda8c8a8
-  data.tar.gz: 86ff8fa5e4f3990ca8c5dee25acc0e663204b671337e479fc19cfc0c5d2145d79f85f5a68c1ac53790b8a4c967050e13b0a070cf8943c6c4d639684ad68898b7
+  metadata.gz: b85b1eabee1011a5175f98ca92f05f39a1f49e3da2666f17bafa8a87d22115700d6f7beee89261a5096d70dcfeec473834dc43bfcaa5a967b63fc78b7789bb7f
+  data.tar.gz: 483b574690f8a3064b7d4f941a7fad4e321fe89d677192b82e68d0d0f3feba49d92125054f17e89521c2810e9feb80de12ee135895728d7d1f633bdd845845ea

data/CHANGELOG

@@ -1,3 +1,9 @@
+Override valid_password? and unauthenticated_message instead of active_for_authentication? and inactive_message, active_for_authentication? doesn't work for default behavior of invited users without password
+
+= 1.4.0
+Override active_for_authentication? and inactive_message instead of valid_password?
+To use counter_cache, invited_by_counter_cache must be set, no more checking of invitations_count to enable counter cache
+
 = 1.3.0
 Now devise 3.1 compatible, @token must be used instead of @resource.invitation_token in mail views
 

data/README.rdoc

@@ -1,5 +1,5 @@
 = DeviseInvitable
-{<img src="https://travis-ci.org/scambra/devise_invitable.png"/>}[http://travis-ci.org/scambra/devise_invitable]
+{<img src="https://travis-ci.org/scambra/devise_invitable.png"/>}[http://travis-ci.org/scambra/devise_invitable] {<img src="https://codeclimate.com/github/scambra/devise_invitable/badges/gpa.svg"/}[https://codeclimate.com/github/scambra/devise_invitable]
 
 It adds support to devise[http://github.com/plataformatec/devise] for sending invitations by email (it requires to be authenticated) and accept the invitation setting the password.
 
@@ -16,7 +16,7 @@ Install DeviseInvitable gem, it will also install dependencies (such as devise a
 Add DeviseInvitable to your Gemfile (and Devise if you weren't using them):
 
   gem 'devise',           '>= 2.0.0'
-  gem 'devise_invitable', '~> 1.1.0'
+  gem 'devise_invitable', '~> 1.3.4'
 
 === Automatic installation
 
@@ -132,6 +132,8 @@ or directly as parameters to the <tt>devise</tt> method:
 
 * invited_by_class_name: The class name of the inviting model. If this is nil, polymorphic association is used.
 
+* allow_insecure_sign_in_after_accept: automatically sign in the user after they set a password. Enabled by default.
+
 For more details, see <tt>config/initializers/devise.rb</tt> (after you invoked the "devise_invitable:install" generator described above).
 
 == Configuring views
@@ -233,11 +235,16 @@ To send an invitation to a user, use the <tt>invite!</tt> class method. <tt>:ema
 
 If you want to create the invitation but not send it, you can set <tt>skip_invitation</tt> to true.
 
-  User.invite!(:email => "new_user@example.com", :name => "John Doe") do |u|
+  user = User.invite!(:email => "new_user@example.com", :name => "John Doe") do |u|
     u.skip_invitation = true
   end
   # => the record will be created, but the invitation email will not be sent
 
+When generating the <tt>accept_user_invitation_url</tt> yourself, you must use the <tt>raw_invitation_token</tt>
+the value is temporarily available when you invite a user and will be decrypted when recieved.
+
+  accept_user_invitation_url(:invitation_token => user.raw_invitation_token)
+
 When skip_invitation is used, you must also then set the invitation_sent_at field when the user is sent their
 token. Failure to do so will yield "Invalid invitation token" errors when the user attempts to accept the invite.
 You can set it like so:
@@ -249,9 +256,16 @@ You can add :skip_invitation to attributes hash if skip_invitation is added to a
   User.invite!(:email => "new_user@example.com", :name => "John Doe", :skip_invitation => true)
   # => the record will be created, but the invitation email will not be sent
 
-Skip_invitation skips sending the email, but sets invitation_token, so invited_to_sign_up? on the
+Skip_invitation skips sending the email, but sets invitation_token, so <tt>invited_to_sign_up?</tt> on the
 resulting user returns true.
 
+To check if a perticular user is created by invitation, irrespective to state of invitation one can use <tt>created_by_invite?</tt>
+
+**Warning**
+
+When using skip_invitation you must send the email with the user object instance that generated the tokens, as 
+user.raw_invitation_token is available only to the instance and is not persisted in the database.
+
 You can send an invitation to an existing user if your workflow creates them separately:
 
   user = User.find(42)
@@ -261,6 +275,8 @@ You can also set <tt>invited_by</tt> when using the <tt>invite!</tt> class metho
 
   User.invite!({:email => "new_user@example.com"}, current_user) # current_user will be set as invited_by
 
+
+
 === Accept an invitation
 
 To accept an invitation with a token use the <tt>accept_invitation!</tt> class method. <tt>:invitation_token</tt> must be present in the parameters hash. You can also include other attributes in the hash.
@@ -283,8 +299,9 @@ The callbacks support all options and arguments available to the standard callba
 
 A pair of scopes to find those users that have accepted, and those that have not accepted, invitations are defined:
 
-  User.invitation_accepted # => returns all Users for whom the invitation_accepted_at attribute is not nil
+  User.invitation_accepted     # => returns all Users for whom the invitation_accepted_at attribute is not nil
   User.invitation_not_accepted # => returns all Users for whom the invitation_accepted_at attribute is nil
+  User.created_by_invite       # => returns all Users who are created by invitations, irrespective to invitation status 
 
 == Integration in a Rails application
 
@@ -343,6 +360,7 @@ DeviseInvitable uses flash messages with I18n with the flash keys <tt>:send_inst
         send_instructions: 'An invitation email has been sent to %{email}.'
         invitation_token_invalid: 'The invitation token provided is not valid!'
         updated: 'Your password was set successfully. You are now signed in.'
+        updated_not_active: 'Your password was set successfully.'
 
 You can also create distinct messages based on the resource you've configured using the singular name given in routes:
 
@@ -353,6 +371,7 @@ You can also create distinct messages based on the resource you've configured us
           send_instructions: 'A new user invitation has been sent to %{email}.'
           invitation_token_invalid: 'Your invitation token is not valid!'
           updated: 'Welcome on board! You are now signed in.'
+          updated_not_active: 'Welcome on board! Sign in to continue.'
 
 The DeviseInvitable mailer uses the same pattern as Devise to create mail subject messages:
 
@@ -369,6 +388,12 @@ Take a look at the generated locale file (in <tt>config/locales/devise_invitable
 
 DeviseInvitable supports ActiveRecord and Mongoid, like Devise.
 
+== Wiki
+
+It's possible to find additional information about DeviseInvitable on the Wiki:
+
+https://github.com/scambra/devise_invitable/wiki
+
 == Testing
 
 To test DeviseInvitable for the ActiveRecord ORM with RVM, Ruby 1.9.2, and Rubygems 1.8.17:

data/app/controllers/devise/invitations_controller.rb

@@ -15,11 +15,15 @@ class Devise::InvitationsController < DeviseController
   # POST /resource/invitation
   def create
     self.resource = invite_resource
+    resource_invited = resource.errors.empty?
 
-    if resource.errors.empty?
-      yield resource if block_given?
-      set_flash_message :notice, :send_instructions, :email => self.resource.email if self.resource.invitation_sent_at
-      respond_with resource, :location => after_invite_path_for(resource)
+    yield resource if block_given?
+
+    if resource_invited
+      if is_flashing_format? && self.resource.invitation_sent_at
+        set_flash_message :notice, :send_instructions, :email => self.resource.email
+      end
+      respond_with resource, :location => after_invite_path_for(current_inviter)
     else
       respond_with_navigational(resource) { render :new }
     end
@@ -34,50 +38,57 @@ class Devise::InvitationsController < DeviseController
   # PUT /resource/invitation
   def update
     self.resource = accept_resource
+    invitation_accepted = resource.errors.empty?
+
+    yield resource if block_given?
 
-    if resource.errors.empty?
-      yield resource if block_given?
-      flash_message = resource.active_for_authentication? ? :updated : :updated_not_active                                                                                        
-      set_flash_message :notice, flash_message
-      sign_in(resource_name, resource)
-      respond_with resource, :location => after_accept_path_for(resource)
+    if invitation_accepted
+      if Devise.allow_insecure_sign_in_after_accept
+        flash_message = resource.active_for_authentication? ? :updated : :updated_not_active
+        set_flash_message :notice, flash_message if is_flashing_format?
+        sign_in(resource_name, resource)
+        respond_with resource, :location => after_accept_path_for(resource)
+      else
+        set_flash_message :notice, :updated_not_active if is_flashing_format?
+        respond_with resource, :location => new_session_path(resource_name)
+      end
     else
       respond_with_navigational(resource){ render :edit }
     end
   end
-  
+
   # GET /resource/invitation/remove?invitation_token=abcdef
   def destroy
     resource.destroy
-    set_flash_message :notice, :invitation_removed
+    set_flash_message :notice, :invitation_removed if is_flashing_format?
     redirect_to after_sign_out_path_for(resource_name)
   end
 
   protected
 
-  def invite_resource
-    resource_class.invite!(invite_params, current_inviter)
+  def invite_resource(&block)
+    resource_class.invite!(invite_params, current_inviter, &block)
   end
-  
+
   def accept_resource
     resource_class.accept_invitation!(update_resource_params)
   end
 
   def current_inviter
-    @current_inviter ||= authenticate_inviter!
+    authenticate_inviter!
   end
 
   def has_invitations_left?
     unless current_inviter.nil? || current_inviter.has_invitations_left?
       self.resource = resource_class.new
-      set_flash_message :alert, :no_invitations_remaining
+      set_flash_message :alert, :no_invitations_remaining if is_flashing_format?
       respond_with_navigational(resource) { render :new }
     end
   end
-  
+
   def resource_from_invitation_token
     unless params[:invitation_token] && self.resource = resource_class.find_by_invitation_token(params[:invitation_token], true)
-      set_flash_message(:alert, :invitation_token_invalid)
+      set_flash_message(:alert, :invitation_token_invalid) if is_flashing_format?
       redirect_to after_sign_out_path_for(resource_name)
     end
   end
@@ -89,6 +100,6 @@ class Devise::InvitationsController < DeviseController
   def update_resource_params
     devise_parameter_sanitizer.sanitize(:accept_invitation)
   end
-  
+
 end
 

data/app/views/devise/mailer/invitation_instructions.html.erb

@@ -1,8 +1,7 @@
-<p>Hello <%= @resource.email %>!</p>
+<p><%= t("devise.mailer.invitation_instructions.hello", email: @resource.email) %></p>
 
-<p>Someone has invited you to <%= root_url %>, you can accept it through the link below.</p>
+<p><%= t("devise.mailer.invitation_instructions.someone_invited_you", url: root_url) %></p>
 
-<p><%= link_to 'Accept invitation', accept_invitation_url(@resource, :invitation_token => @token) %></p>
+<p><%= link_to t("devise.mailer.invitation_instructions.accept"), accept_invitation_url(@resource, :invitation_token => @token) %></p>
 
-<p>If you don't want to accept the invitation, please ignore this email.<br />
-Your account won't be created until you access the link above and set your password.</p>
+<p><%= t("devise.mailer.invitation_instructions.ignore").html_safe %></p>

data/config/locales/en.yml

@@ -1,11 +1,14 @@
 en:
   devise:
+    failure:
+      invited: "You have a pending invitation, accept it to finish creating your account."
     invitations:
-      send_instructions: 'An invitation email has been sent to %{email}.'
-      invitation_token_invalid: 'The invitation token provided is not valid!'
-      updated: 'Your password was set successfully. You are now signed in.'
+      send_instructions: "An invitation email has been sent to %{email}."
+      invitation_token_invalid: "The invitation token provided is not valid!"
+      updated: "Your password was set successfully. You are now signed in."
+      updated_not_active: "Your password was set successfully."
       no_invitations_remaining: "No invitations remaining"
-      invitation_removed: 'Your invitation was removed.'
+      invitation_removed: "Your invitation was removed."
       new:
         header: "Send invitation"
         submit_button: "Send an invitation"
@@ -14,4 +17,8 @@ en:
         submit_button: "Set my password"
     mailer:
       invitation_instructions:
-        subject: 'Invitation instructions'
+        subject: "Invitation instructions"
+        hello: "Hello %{email}"
+        someone_invited_you: "Someone has invited you to %{url}, you can accept it through the link below."
+        accept: "Accept invitation"
+        ignore: "If you don't want to accept the invitation, please ignore this email.<br />Your account won't be created until you access the link above and set your password."

data/lib/devise_invitable/model.rb

@@ -34,12 +34,8 @@ module Devise
         else
           {:polymorphic => true}
         end
-        if defined?(ActiveRecord) && self < ActiveRecord::Base
+        if defined?(ActiveRecord) && defined?(ActiveRecord::Base) && self < ActiveRecord::Base
           counter_cache = Devise.invited_by_counter_cache
-          if !counter_cache && Devise.invited_by_class_name
-            klass = Devise.invited_by_class_name.constantize
-            counter_cache = klass.table_exists? && klass.columns_hash['invitations_count'].try('name')
-          end
           belongs_to_options.merge! :counter_cache => counter_cache if counter_cache
         end
         belongs_to :invited_by, belongs_to_options
@@ -49,11 +45,13 @@ module Devise
 
         attr_writer :skip_password
 
-        scope :active, lambda { where(:invitation_token => nil) }
+        scope :no_active_invitation, lambda { where(:invitation_token => nil) }
         if defined?(Mongoid) && defined?(Mongoid::Document) && self < Mongoid::Document
+          scope :created_by_invite, lambda { where(:invitation_sent_at.ne => nil) }
           scope :invitation_not_accepted, lambda { where(:invitation_accepted_at => nil, :invitation_token.ne => nil) }
           scope :invitation_accepted, lambda { where(:invitation_accepted_at.ne => nil) }
         else
+          scope :created_by_invite, lambda { where(arel_table[:invitation_sent_at].not_eq(nil)) }
           scope :invitation_not_accepted, lambda { where(arel_table[:invitation_token].not_eq(nil)).where(:invitation_accepted_at => nil) }
           scope :invitation_accepted, lambda { where(arel_table[:invitation_accepted_at].not_eq(nil)) }
 
@@ -89,6 +87,11 @@ module Devise
         end
       end
 
+      # Verify wheather a user is created by invitation, irrespective to invitation status
+      def created_by_invite?
+        invitation_sent_at.present?
+      end
+
       # Verifies whether a user has been invited or not
       def invited_to_sign_up?
         persisted? && invitation_token.present?
@@ -106,26 +109,28 @@ module Devise
 
       # Reset invitation token and send invitation again
       def invite!(invited_by = nil)
+        # This is an order-dependant assignment, this can't be moved 
         was_invited = invited_to_sign_up?
 
         # Required to workaround confirmable model's confirmation_required? method
         # being implemented to check for non-nil value of confirmed_at
-        if self.new_record? && self.respond_to?(:confirmation_required?, true)
+        if new_record_and_responds_to?(:confirmation_required?)
           def self.confirmation_required?; false; end
         end
 
-        generate_invitation_token if self.invitation_token.nil? || (!@skip_invitation && @raw_invitation_token.nil?)
+        yield self if block_given?
+        generate_invitation_token if no_token_present_or_skip_invitation?
         self.invitation_created_at = Time.now.utc
-        self.invitation_sent_at = self.invitation_created_at unless @skip_invitation
+        self.invitation_sent_at = self.invitation_created_at unless skip_invitation
         self.invited_by = invited_by if invited_by
 
         # Call these before_validate methods since we aren't validating on save
-        self.downcase_keys if self.new_record? && self.respond_to?(:downcase_keys, true)
-        self.strip_whitespace if self.new_record? && self.respond_to?(:strip_whitespace, true)
+        self.downcase_keys if new_record_and_responds_to?(:downcase_keys)
+        self.strip_whitespace if new_record_and_responds_to?(:strip_whitespace)
 
         if save(:validate => false)
           self.invited_by.decrement_invitation_limit! if !was_invited and self.invited_by.present?
-          deliver_invitation unless @skip_invitation
+          deliver_invitation unless skip_invitation
         end
       end
 
@@ -138,11 +143,15 @@ module Devise
 
       # Only verify password when is not invited
       def valid_password?(password)
-        super unless invited_to_sign_up?
+        super unless block_from_invitation?
+      end
+
+      def unauthenticated_message
+        block_from_invitation? ? :invited : super
       end
 
       def after_password_reset
-        super
+        super if defined?(super)
         accept_invitation! if invited_to_sign_up?
       end
 
@@ -171,10 +180,17 @@ module Devise
       protected
         # Overriding the method in Devise's :validatable module so password is not required on inviting
         def password_required?
-          !@skip_password && super
+          !skip_password && super
+        end
+
+        def skip_password
+          @skip_password ||= false
+        end
+
+        def block_from_invitation?
+          invited_to_sign_up?
         end
 
-        
         # Checks if the invitation for the user is within the limit time.
         # We do this by calculating if the difference between today and the
         # invitation sent date does not exceed the invite for time configured.
@@ -211,6 +227,14 @@ module Devise
           generate_invitation_token && save(:validate => false)
         end
 
+        def new_record_and_responds_to?(method)
+          self.new_record? && self.respond_to?(method, true)
+        end
+
+        def no_token_present_or_skip_invitation?
+          self.invitation_token.nil? || (!skip_invitation || @raw_invitation_token.nil?)
+        end
+
       module ClassMethods
         # Return fields to invite
         def invite_key_fields
@@ -253,13 +277,11 @@ module Devise
         end
 
         def invite!(attributes={}, invited_by=nil, &block)
-          invitable, mail = _invite(attributes.with_indifferent_access, invited_by, &block)
-          invitable
+          _invite(attributes.with_indifferent_access, invited_by, &block).first
         end
 
         def invite_mail!(attributes={}, invited_by=nil, &block)
-          invitable, mail = _invite(attributes, invited_by, &block)
-          mail
+          _invite(attributes, invited_by, &block).last
         end
 
         # Attempt to find a user by it's invitation_token to set it's password.
@@ -301,6 +323,8 @@ module Devise
         Devise::Models.config(self, :invitation_limit)
         Devise::Models.config(self, :invite_key)
         Devise::Models.config(self, :resend_invitation)
+        Devise::Models.config(self, :allow_insecure_sign_in_after_accept)
+
       end
     end
   end

data/lib/devise_invitable/parameter_sanitizer.rb

@@ -20,7 +20,7 @@ module DeviseInvitable
     def attributes_for_with_invitable(kind)
       case kind
       when :invite
-        resource_class.invite_key_fields
+        resource_class.respond_to?(:invite_key_fields) ? resource_class.invite_key_fields : []
       when :accept_invitation
         [:password, :password_confirmation, :invitation_token]
       else attributes_for_without_invitable(kind)

data/lib/devise_invitable/rails.rb

@@ -7,12 +7,14 @@ module DeviseInvitable
 
     # We use to_prepare instead of after_initialize here because Devise is a Rails engine; its
     # mailer is reloaded like the rest of the user's app.  Got to make sure that our mailer methods
-    # are included each time Devise::Mailer is (re)loaded.
+    # are included each time Devise.mailer is (re)loaded.
     config.to_prepare do
-      require 'devise/mailer'
-      Devise::Mailer.send :include, DeviseInvitable::Mailer
+      Devise.mailer.send :include, DeviseInvitable::Mailer
+      unless Devise.mailer.ancestors.include?(Devise::Mailers::Helpers)
+        Devise.mailer.send :include, Devise::Mailers::Helpers 
+      end
     end
-    # extend mapping with after_initialize becuase is not reloaded
+    # extend mapping with after_initialize because it's not reloaded
     config.after_initialize do
       Devise::Mapping.send :include, DeviseInvitable::Mapping
       Devise::ParameterSanitizer.send :include, DeviseInvitable::ParameterSanitizer

data/lib/devise_invitable/version.rb

@@ -1,3 +1,3 @@
 module DeviseInvitable
-  VERSION = '1.3.4'
+  VERSION = '1.5.0'
 end

data/lib/devise_invitable.rb

@@ -66,6 +66,11 @@ module Devise
   # the #invited_by association is declared without counter_cache. (default: nil)
   mattr_accessor :invited_by_counter_cache
   @@invited_by_counter_cache = nil
+
+  # Public: Auto-login after the user accepts the invite. If this is false,
+  # the user will need to manually log in after accepting the invite (default: false).
+  mattr_accessor :allow_insecure_sign_in_after_accept
+  @@allow_insecure_sign_in_after_accept = true
 end
 
 Devise.add_module :invitable, :controller => :invitations, :model => 'devise_invitable/model', :route => {:invitation => [nil, :new, :accept]}

data/lib/generators/active_record/devise_invitable_generator.rb

@@ -6,7 +6,7 @@ module ActiveRecord
       source_root File.expand_path("../templates", __FILE__)
 
       def copy_devise_migration
-        migration_template "migration.rb", "db/migrate/devise_invitable_add_to_#{table_name}"
+        migration_template "migration.rb", "db/migrate/devise_invitable_add_to_#{table_name}.rb"
       end
     end
   end

data/lib/generators/active_record/templates/migration.rb

@@ -6,10 +6,10 @@ class DeviseInvitableAddTo<%= table_name.camelize %> < ActiveRecord::Migration
       t.datetime   :invitation_sent_at
       t.datetime   :invitation_accepted_at
       t.integer    :invitation_limit
-      t.references :invited_by, :polymorphic => true
+      t.references :invited_by, polymorphic: true
       t.integer    :invitations_count, default: 0
       t.index      :invitations_count
-      t.index      :invitation_token, :unique => true # for invitable
+      t.index      :invitation_token, unique: true # for invitable
       t.index      :invited_by_id
     end
 
@@ -22,8 +22,12 @@ class DeviseInvitableAddTo<%= table_name.camelize %> < ActiveRecord::Migration
 
   def down
     change_table :<%= table_name %> do |t|
-      t.remove_references :invited_by, :polymorphic => true
+      t.remove_references :invited_by, polymorphic: true
       t.remove :invitations_count, :invitation_limit, :invitation_sent_at, :invitation_accepted_at, :invitation_token, :invitation_created_at
     end
+    change_column_null    :<%= table_name %>, :encrypted_password, false
+<% if class_name.constantize.columns_hash['password_salt'] -%>
+    change_column_null :<%= table_name %>, :password_salt,false
+<% end -%>
   end
 end

data/lib/generators/devise_invitable/install_generator.rb

@@ -57,6 +57,11 @@ module DeviseInvitable
   # Default: nil
   # config.invited_by_counter_cache = :invitations_count
 
+  # Auto-login after the user accepts the invite. If this is false,
+  # the user will need to manually log in after accepting the invite.
+  # Default: false
+  # config.allow_insecure_sign_in_after_accept = true
+
 CONTENT
             end
           end

data/lib/generators/devise_invitable/templates/simple_form_for/invitations/edit.html.erb

@@ -1,11 +1,11 @@
 <h2><%= t 'devise.invitations.edit.header' %></h2>
 
-<%= simple_form_for resource, :as => resource_name, :url => invitation_path(resource_name), :html => { :method => :put } do |f| %>
+<%= simple_form_for resource, as: resource_name, url: invitation_path(resource_name), html: { method: :put } do |f| %>
   <%= devise_error_messages! %>
   <%= f.hidden_field :invitation_token %>
 
   <%= f.input :password %>
   <%= f.input :password_confirmation %>
 
-  <%= f.submit t("devise.invitations.edit.submit_button") %>
+  <%= f.button :submit, t("devise.invitations.edit.submit_button") %>
 <% end %>

data/lib/generators/devise_invitable/templates/simple_form_for/invitations/new.html.erb

@@ -1,11 +1,11 @@
 <h2><%= t "devise.invitations.new.header" %></h2>
 
-<%= simple_form_for resource, :as => resource_name, :url => invitation_path(resource_name), :html => {:method => :post} do |f| %>
+<%= simple_form_for resource, as: resource_name, url: invitation_path(resource_name), html: { method: :post} do |f| %>
   <%= devise_error_messages! %>
 
 <% resource.class.invite_key_fields.each do |field| -%>
   <%= f.input field %>
 <% end -%>
 
-<%= f.submit t("devise.invitations.new.submit_button") %>
+<%= f.button :submit, t("devise.invitations.new.submit_button") %>
 <% end %>

data/test/functional/controller_helpers_test.rb

@@ -4,11 +4,11 @@ class ControllerHelpersTest < ActionController::TestCase
   tests ApplicationController
 
   test "after invite path defaults to after sign in path" do
-    assert_equal @controller.after_sign_in_path_for(:user), @controller.after_invite_path_for(:user)
+    assert_equal @controller.send(:after_sign_in_path_for, :user), @controller.after_invite_path_for(:user)
   end
   
   test "after accept path defaults to after sign in path" do
-    assert_equal @controller.after_sign_in_path_for(:user), @controller.after_accept_path_for(:user)
+    assert_equal @controller.send(:after_sign_in_path_for, :user), @controller.after_accept_path_for(:user)
   end
   
   test 'after invite path is customizable from application controller' do
@@ -36,4 +36,4 @@ class ControllerHelpersTest < ActionController::TestCase
     assert Devise::InvitationsController.method_defined? :after_accept_path_for
     assert !Devise::InvitationsController.instance_methods(false).include?(:after_accept_path_for)
   end
-end
+end

data/test/functional/registrations_controller_test.rb

@@ -25,7 +25,7 @@ class DeviseInvitable::RegistrationsControllerTest < ActionController::TestCase
     sign_out @issuer
 
     @invitee = User.where(:email => invitee_email).first
-    assert_blank @invitee.encrypted_password, "the password should be unset"
+    assert @invitee.encrypted_password.blank?, "the password should be unset"
 
     # sign_up the invitee
     assert_difference('ActionMailer::Base.deliveries.size') do
@@ -42,13 +42,13 @@ class DeviseInvitable::RegistrationsControllerTest < ActionController::TestCase
       @invitee.save!
     end
 
-    assert_present @invitee.encrypted_password
+    assert @invitee.encrypted_password.present?
     assert_not_nil @invitee.invitation_accepted_at
     assert_nil @invitee.invitation_token
-    assert_present @invitee.invited_by_id
-    assert_present @invitee.invited_by_type
+    assert @invitee.invited_by_id.present?
+    assert @invitee.invited_by_type.present?
     assert !@invitee.confirmed?
-    assert_present @invitee.confirmation_token
+    assert @invitee.confirmation_token.present?
   end
 
   test "not invitable resources can register" do
@@ -58,7 +58,7 @@ class DeviseInvitable::RegistrationsControllerTest < ActionController::TestCase
     post :create, :admin => {:email => invitee_email, :password => "1password"}
 
     @invitee = Admin.where(:email => invitee_email).first
-    assert_present @invitee.encrypted_password
+    assert @invitee.encrypted_password.present?
   end
 
   test "missing params on a create should not cause an error" do

data/test/generators_test.rb

@@ -17,18 +17,18 @@ class GeneratorsTest < ActiveSupport::TestCase
 
   test "rails g devise_invitable:install" do
     @output = `cd #{RAILS_APP_PATH} && rails g devise_invitable:install -p`
-    assert @output.match(%r{(inject|insert).+  config/initializers/devise\.rb\n})
-    assert @output.match(%r|create.+  config/locales/devise_invitable\.en\.yml\n|)
+    assert @output.match(%r{(inject|insert).*  config/initializers/devise\.rb\n})
+    assert @output.match(%r|create.*  config/locales/devise_invitable\.en\.yml\n|)
   end
 
   test "rails g devise_invitable Octopussy" do
     @output = `cd #{RAILS_APP_PATH} && rails g devise_invitable Octopussy -p`
-    assert @output.match(%r{(inject|insert).+  app/models/octopussy\.rb\n})
-    assert @output.match(%r|invoke.+  #{DEVISE_ORM}\n|)
+    assert @output.match(%r{(inject|insert).*  app/models/octopussy\.rb\n})
+    assert @output.match(%r|invoke.*  #{DEVISE_ORM}\n|)
     if DEVISE_ORM == :active_record
-      assert @output.match(%r|create.+  db/migrate/\d{14}_devise_invitable_add_to_octopussies\.rb\n|)
+      assert @output.match(%r|create.*  db/migrate/\d{14}_devise_invitable_add_to_octopussies\.rb\n|)
     elsif DEVISE_ORM == :mongoid
-      assert !@output.match(%r|create.+  db/migrate/\d{14}_devise_invitable_add_to_octopussies\.rb\n|)
+      assert !@output.match(%r|create.*  db/migrate/\d{14}_devise_invitable_add_to_octopussies\.rb\n|)
     end
   end
 end

data/test/integration/invitation_remove_test.rb

@@ -4,7 +4,7 @@ require 'integration_tests_helper'
 class InvitationRemoveTest < ActionDispatch::IntegrationTest
 
   test 'invited user can choose to remove his account/invite' do
-    user = User.invite!(:email => "valid@email.com")
+    User.invite!(:email => "valid@email.com")
 
     # remove!
     visit remove_user_invitation_path(:invitation_token => Thread.current[:token])

data/test/integration/invitation_test.rb

@@ -64,6 +64,25 @@ class InvitationTest < ActionDispatch::IntegrationTest
     assert_equal root_path, current_path
   end
 
+  test 'invited user without password should not be able to sign in' do
+    user = User.invite!(:email => "valid@email.com")
+    user.password = 'test'
+    sign_in_as_user user
+
+    assert_equal new_user_session_path, current_path
+    assert page.has_css?('p#alert', :text => 'You have a pending invitation, accept it to finish creating your account.')
+  end
+
+  test 'invited user with password should not be able to sign in' do
+    user = User.invite!(:email => "valid@email.com")
+    user.password = '987654321'
+    user.save
+    sign_in_as_user user
+
+    assert_equal new_user_session_path, current_path
+    assert page.has_css?('p#alert', :text => 'You have a pending invitation, accept it to finish creating your account.')
+  end
+
   test 'not authenticated user with invalid invitation token should not be able to set his password' do
     user = User.invite!(:email => "valid@email.com")
     user.accept_invitation!
@@ -80,7 +99,7 @@ class InvitationTest < ActionDispatch::IntegrationTest
     end
     assert_equal user_invitation_path, current_path
     assert page.has_css?('#error_explanation li', :text => /Password .*doesn\'t match/)
-    assert_blank user.encrypted_password
+    assert user.encrypted_password.blank?
   end
 
   test 'not authenticated user with valid data should be able to change his password' do
@@ -99,17 +118,33 @@ class InvitationTest < ActionDispatch::IntegrationTest
     end
     assert_equal user_invitation_path, current_path
     assert page.has_css?('#error_explanation')
-    assert_blank user.encrypted_password
+    assert user.encrypted_password.blank?
 
     set_password :visit => false
     assert page.has_css?('p#notice', :text => 'Your password was set successfully. You are now signed in.')
     assert user.reload.valid_password?('987654321')
   end
 
-  test 'sign in user automatically after setting it\'s password' do
-    user = User.invite!(:email => "valid@email.com")
+  test 'sign in user automatically after setting it\'s password if config.allow_insecure_sign_in_after_accept is true' do
+    original_option_value = Devise.allow_insecure_sign_in_after_accept
+    Devise.allow_insecure_sign_in_after_accept = true
+
+    User.invite!(:email => "valid@email.com")
     set_password :invitation_token => Thread.current[:token]
+
     assert_equal root_path, current_path
+    Devise.allow_insecure_sign_in_after_accept = original_option_value
+  end
+
+  test 'does not sign in user automatically after setting it\'s password if config.allow_insecure_sign_in_after_accept is false' do
+    original_option_value = Devise.allow_insecure_sign_in_after_accept
+    Devise.allow_insecure_sign_in_after_accept = false
+
+    User.invite!(:email => "valid@email.com")
+    set_password :invitation_token => Thread.current[:token]
+
+    assert_equal new_user_session_path, current_path
+    Devise.allow_insecure_sign_in_after_accept = original_option_value
   end
 
   test 'clear token and set invitation_accepted_at after recover password instead of accept_invitation' do
@@ -213,10 +248,20 @@ class InvitationTest < ActionDispatch::IntegrationTest
   end
 
   test 'authenticated admin should be able to send an admin invitation' do
-    sign_in_as_user Admin.create(:email => 'admin@test.com', :password => '123456', :password_confirmation => '123456')
+    admin = Admin.create(:email => 'admin@test.com', :password => '123456', :password_confirmation => '123456')
+    sign_in_as_user admin
 
     send_invitation new_admin_path
-    assert_equal root_path, current_path
+    assert_equal edit_admin_registration_path(admin), current_path
+    assert page.has_css?('p#notice', :text => 'An invitation email has been sent to user@test.com.')
+  end
+
+  test 'authenticated admin should be redirected to own page after send a free invitation' do
+    admin = Admin.create(:email => 'admin@test.com', :password => '123456', :password_confirmation => '123456')
+    sign_in_as_user admin
+
+    send_invitation new_free_invitation_path
+    assert_equal edit_admin_registration_path(admin), current_path
     assert page.has_css?('p#notice', :text => 'An invitation email has been sent to user@test.com.')
   end
 end

data/test/integration_tests_helper.rb

@@ -1,9 +1,9 @@
-class ActionController::IntegrationTest
+class ActionDispatch::IntegrationTest
 
   def warden
     request.env['warden']
   end
-  
+
   def create_full_user
     @user ||= begin
       user = User.create!(
@@ -24,7 +24,7 @@ class ActionController::IntegrationTest
     visit send("new_#{resource_name}_session_path")
     fill_in "#{resource_name}_email", :with => user.email
     fill_in "#{resource_name}_password", :with => user.password
-    click_button 'Sign in'
+    click_button 'Log in'
   end
 
   # Fix assert_redirect_to in integration sessions because they don't take into

data/test/models/invitable_test.rb

@@ -28,14 +28,40 @@ class InvitableTest < ActiveSupport::TestCase
   test 'should regenerate invitation token each time' do
     user = new_user
     user.invite!
-    token = user.invitation_token
+
     assert_not_nil user.invitation_token
+    assert_not_nil user.raw_invitation_token
     assert_not_nil user.invitation_created_at
+
     3.times do
       user = User.find(user.id)
-      user.invite!
-      assert_not_equal token, user.invitation_token
-      token = user.invitation_token
+
+      assert_not_same user.invitation_token, lambda {
+        user.invite!
+        user.invitation_token
+      }.call
+      assert_not_nil user.raw_invitation_token
+    end
+  end
+
+  test 'should regenerate invitation token each time even if "skip_invitation" was true' do
+    user = new_user
+    user.skip_invitation = true
+    user.invite!
+
+    assert_not_nil user.invitation_token
+    assert_not_nil user.invitation_created_at
+
+    3.times do
+      user = User.find(user.id)
+      user.skip_invitation = true
+
+      assert_not_same user.invitation_token, lambda {
+        user.invite!
+        user.invitation_token
+      }.call
+      assert_not_nil user.invitation_token
+      assert_not_nil user.raw_invitation_token
     end
   end
 
@@ -143,7 +169,7 @@ class InvitableTest < ActiveSupport::TestCase
   end
 
   test 'should set password and password confirmation from params' do
-    invited_user = User.invite!(:email => "valid@email.com")
+    User.invite!(:email => "valid@email.com")
     user = User.accept_invitation!(:invitation_token => Thread.current[:token], :password => '123456789', :password_confirmation => '123456789')
     assert user.valid_password?('123456789')
   end
@@ -157,21 +183,21 @@ class InvitableTest < ActiveSupport::TestCase
 
   test 'should clear invitation token and set invitation_accepted_at while accepting the password' do
     user = User.invite!(:email => "valid@email.com")
-    assert_present user.invitation_token
+    assert user.invitation_token.present?
     assert_nil user.invitation_accepted_at
     user.accept_invitation!
     user.reload
     assert_nil user.invitation_token
-    assert_present user.invitation_accepted_at
+    assert user.invitation_accepted_at.present?
   end
 
   test 'should not clear invitation token or set accepted_at if record is invalid' do
     user = User.invite!(:email => "valid@email.com")
-    assert_present user.invitation_token
+    assert user.invitation_token.present?
     assert_nil user.invitation_accepted_at
     User.accept_invitation!(:invitation_token => user.invitation_token, :password => '123456789', :password_confirmation => '987654321')
     user.reload
-    assert_present user.invitation_token
+    assert user.invitation_token.present?
     assert_nil user.invitation_accepted_at
   end
 
@@ -182,8 +208,8 @@ class InvitableTest < ActiveSupport::TestCase
     user.reset_password_sent_at = Time.now.utc
     user.save
 
-    assert_present user.reset_password_token
-    assert_present user.invitation_token
+    assert user.reset_password_token.present?
+    assert user.invitation_token.present?
     User.reset_password_by_token(:reset_password_token => token, :password => '123456789', :password_confirmation => '123456789')
     assert_nil user.reload.reset_password_token
     assert_nil user.reload.invitation_token
@@ -197,11 +223,11 @@ class InvitableTest < ActiveSupport::TestCase
     user.reset_password_sent_at = Time.now.utc
     user.save
 
-    assert_present user.reset_password_token
-    assert_present user.invitation_token
+    assert user.reset_password_token.present?
+    assert user.invitation_token.present?
     User.reset_password_by_token(:reset_password_token => token, :password => '123456789', :password_confirmation => '12345678')
-    assert_present user.reload.reset_password_token
-    assert_present user.reload.invitation_token
+    assert user.reload.reset_password_token.present?
+    assert user.reload.invitation_token.present?
     assert user.invited_to_sign_up?
   end
 
@@ -212,7 +238,7 @@ class InvitableTest < ActiveSupport::TestCase
     user.reset_password_sent_at = Time.now.utc
     user.save
 
-    assert_present user.reset_password_token
+    assert user.reset_password_token.present?
     assert_nil user.invitation_token
     User.reset_password_by_token(:reset_password_token => token, :password => '123456789', :password_confirmation => '123456789')
     assert_nil user.reload.invitation_token
@@ -231,7 +257,7 @@ class InvitableTest < ActiveSupport::TestCase
   test 'should return a record with invitation token and no errors to send invitation by email' do
     invited_user = User.invite!(:email => "valid@email.com")
     assert invited_user.errors.blank?
-    assert_present invited_user.invitation_token
+    assert invited_user.invitation_token.present?
     assert_equal 'valid@email.com', invited_user.email
     assert invited_user.persisted?
   end
@@ -380,7 +406,7 @@ class InvitableTest < ActiveSupport::TestCase
     user = new_user(:password => nil, :password_confirmation => nil)
     user.invite!
 
-    invited_user = User.accept_invitation!(
+    User.accept_invitation!(
       :invitation_token => Thread.current[:token],
       :password => 'new_password',
       :password_confirmation => 'new_password'
@@ -405,6 +431,21 @@ class InvitableTest < ActiveSupport::TestCase
     user.reload
     assert !user.valid_password?('new_password')
   end
+  
+  test 'should check if created by invitation' do
+    user = User.invite!(:email => "valid@email.com")
+    assert user.created_by_invite?
+    
+    invited_user = User.accept_invitation!(
+      :invitation_token => Thread.current[:token],
+      :password => 'new_password',
+      :password_confirmation => 'new_password',
+      :username => 'a'
+    )
+    user.reload
+    assert user.created_by_invite?
+  end
+
 
   test 'should set other attributes on accepting invitation' do
     user = new_user(:password => nil, :password_confirmation => nil)
@@ -454,13 +495,13 @@ class InvitableTest < ActiveSupport::TestCase
 
   test 'should not send an invitation if we want to skip the invitation' do
     assert_no_difference('ActionMailer::Base.deliveries.size') do
-      invited_user = User.invite!(:email => "valid@email.com", :username => "a"*50, :skip_invitation => true)
+      User.invite!(:email => "valid@email.com", :username => "a"*50, :skip_invitation => true)
     end
   end
 
   test 'should not send an invitation if we want to skip the invitation with block' do
     assert_no_difference('ActionMailer::Base.deliveries.size') do
-      invited_user = User.invite!(:email => "valid@email.com", :username => "a"*50) do |u|
+      User.invite!(:email => "valid@email.com", :username => "a"*50) do |u|
         u.skip_invitation = true
       end
     end
@@ -472,7 +513,18 @@ class InvitableTest < ActiveSupport::TestCase
     assert_no_difference('ActionMailer::Base.deliveries.size') do
       user.invite!
     end
-    assert_present user.invitation_created_at
+    assert user.invitation_created_at.present?
+    assert_nil user.invitation_sent_at
+  end
+
+  test 'user.invite! should not send an invitation if we want to skip the invitation with block' do
+    user = new_user
+    assert_no_difference('ActionMailer::Base.deliveries.size') do
+      user.invite! do |u|
+        u.skip_invitation = true
+      end
+    end
+    assert user.invitation_created_at.present?
     assert_nil user.invitation_sent_at
   end
 
@@ -569,24 +621,28 @@ class InvitableTest < ActiveSupport::TestCase
   end
 
   test 'should return instance with errors if invitation_token is nil' do
-    registered_user = User.create(:email => 'admin@test.com', :password => '123456', :password_confirmation => '123456')
+    User.create(:email => 'admin@test.com', :password => '123456', :password_confirmation => '123456')
     user = User.accept_invitation!
     assert !user.errors.empty?
   end
 
-  test "should count accepted and not accepted invitations" do
+  test "should count invited, created_by_invite, accepted and not accepted invitations" do
     assert_equal 0, User.invitation_not_accepted.count
     assert_equal 0, User.invitation_accepted.count
+    assert_equal 0, User.created_by_invite.count
 
     User.invite!(:email => "invalid@email.com")
+    User.invite!(:email => "another_invalid@email.com")
     user = User.invite!(:email => "valid@email.com")
 
-    assert_equal 2, User.invitation_not_accepted.count
+    assert_equal 3, User.invitation_not_accepted.count
     assert_equal 0, User.invitation_accepted.count
+    assert_equal 3, User.created_by_invite.count
 
     user.accept_invitation!
-    assert_equal 1, User.invitation_not_accepted.count
+    assert_equal 2, User.invitation_not_accepted.count
     assert_equal 1, User.invitation_accepted.count
+    assert_equal 3, User.created_by_invite.count
   end
 
   test "should preserve return values of Devise::Recoverable#reset_password!" do

data/test/rails_app/app/controllers/application_controller.rb

@@ -3,6 +3,13 @@ class ApplicationController < ActionController::Base
   before_filter :configure_permitted_parameters, :if => :devise_controller?
 
   protected
+  def after_sign_in_path_for(resource)
+    if resource.is_a? Admin
+      edit_admin_registration_path(resource)
+    else
+      super
+    end
+  end
 
   def configure_permitted_parameters
     devise_parameter_sanitizer.for(:sign_up) { |u| u.permit(:email, :password, :bio) } if defined?(ActionController::StrongParameters)

data/test/rails_app/app/controllers/free_invitations_controller.rb

@@ -3,4 +3,10 @@ class FreeInvitationsController < Devise::InvitationsController
   def authenticate_inviter!
   # everyone can invite
   end
+  def current_inviter
+    current_admin || current_user
+  end
+  def after_invite_path_for(resource)
+    resource ? super : root_path
+  end
 end

data/test/rails_app/app/views/devise/sessions/new.html.erb

@@ -0,0 +1,17 @@
+<h2>Log in</h2>
+
+<%= form_for(resource, as: resource_name, url: session_path(resource_name)) do |f| %>
+  <div><%= f.label :email %><br />
+  <%= f.email_field :email, autofocus: true %></div>
+
+  <div><%= f.label :password %><br />
+    <%= f.password_field :password, autocomplete: "off" %></div>
+
+  <% if devise_mapping.rememberable? -%>
+    <div><%= f.check_box :remember_me %> <%= f.label :remember_me %></div>
+  <% end -%>
+
+  <div><%= f.submit "Log in" %></div>
+<% end %>
+
+<%= render "devise/shared/links" %>

data/test/rails_app/config/initializers/devise.rb

@@ -129,6 +129,11 @@ Devise.setup do |config|
   # Default: nil
   config.invited_by_counter_cache = :invitations_count
 
+  # Auto-login after the user accepts the invite. If this is false,
+  # the user will need to manually log in after accepting the invite.
+  # Default: true
+  # config.allow_insecure_sign_in_after_accept = false
+
   # ==> Configuration for :confirmable
   # A period that the user is allowed to access the website even without
   # confirming his account. For instance, if set to 2.days, the user will be

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise_invitable
 version: !ruby/object:Gem::Version
-  version: 1.3.4
+  version: 1.5.0
 platform: ruby
 authors:
 - Sergio Cambra
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-02-27 00:00:00.000000000 Z
+date: 2015-06-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -66,6 +66,9 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG
+- LICENSE
+- README.rdoc
 - app/controllers/devise/invitations_controller.rb
 - app/controllers/devise_invitable/registrations_controller.rb
 - app/views/devise/invitations/edit.html.erb
@@ -90,9 +93,6 @@ files:
 - lib/generators/devise_invitable/templates/simple_form_for/invitations/new.html.erb
 - lib/generators/devise_invitable/views_generator.rb
 - lib/generators/mongoid/devise_invitable_generator.rb
-- LICENSE
-- README.rdoc
-- CHANGELOG
 - test/functional/controller_helpers_test.rb
 - test/functional/registrations_controller_test.rb
 - test/generators/views_generator_test.rb
@@ -117,6 +117,7 @@ files:
 - test/rails_app/app/models/octopussy.rb
 - test/rails_app/app/models/user.rb
 - test/rails_app/app/views/admins/new.html.erb
+- test/rails_app/app/views/devise/sessions/new.html.erb
 - test/rails_app/app/views/free_invitations/new.html.erb
 - test/rails_app/app/views/home/index.html.erb
 - test/rails_app/app/views/layouts/application.html.erb
@@ -167,7 +168,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: 1.3.6
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.1.11
+rubygems_version: 2.4.5
 signing_key: 
 specification_version: 4
 summary: An invitation strategy for Devise
@@ -196,6 +197,7 @@ test_files:
 - test/rails_app/app/models/octopussy.rb
 - test/rails_app/app/models/user.rb
 - test/rails_app/app/views/admins/new.html.erb
+- test/rails_app/app/views/devise/sessions/new.html.erb
 - test/rails_app/app/views/free_invitations/new.html.erb
 - test/rails_app/app/views/home/index.html.erb
 - test/rails_app/app/views/layouts/application.html.erb