devise_invitable 1.4.0 → 1.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 49059f27df2618f9c0491fd1b7578b33619f2ef5
-  data.tar.gz: da0b1ff3962cba2784b8c082c013fb483ee0517e
+  metadata.gz: 21840c71f560017345f75d9152e44b295ccb8043
+  data.tar.gz: 8470539a88ef73abb3ef396a4c043e9405eecd57
 SHA512:
-  metadata.gz: 56e5cc31bd011a67887ea3338ee66682dc398008f4a18f094fec9084b0635efc8684d5251aca72a9d7daecf228ea06aeec84bca49a8dd24bd3750c063f7b2e56
-  data.tar.gz: 162bc6c70f81f0b65ca73233a5ebb5ac53895b5e6c57f4085d522807592feccb29ce93c113e1d67d974fa95ebf026054d137a6a5c01c1af3913bf84df14d2f7a
+  metadata.gz: 451e491d4a3a8135bc4d1447d1b9035624f2be5757f03544fe1bf8925e0b08df1317a57ec93cb20f293e5dc77397e3c1ba6a6e854f1b8a7646804ce6b43258fc
+  data.tar.gz: ee5f07eb0c08aca5310d36b42eb7fa20fee2bbc657a101a79981c5072e6da3593a813ca79bb08ef05d3494db65e228017f692dc96645c1e62b9ff3c4f189e4f8

data/CHANGELOG

@@ -1,9 +1,69 @@
+= 1.5.2
+
+- Fix #571, accept invitation when password changes only if reset_password_token was present
+- Add support for setting invited_by foreign key
+- Set random initial password for invited users
+- Don't override password while User.invite!
+
+= 1.5.1
+
+- Fix #562 Avoid using after_password_reset
+- Fix #564
+
+Compare: https://github.com/scambra/devise_invitable/compare/v1.5.0...v1.5.1
+
+= 1.5.0
+
+Override valid_password? and unauthenticated_message instead of active_for_authentication? and inactive_message, active_for_authentication? doesn't work for default behavior of invited users without password
+
+- Get list & check for user(s) created by invite irrespective of status
+- Update simple_form template's hash syntax
+- Update migration template's hash syntax
+- Check if after_password_reset is defined
+
+Compare: https://github.com/scambra/devise_invitable/compare/v1.4.2...v1.5.0
+
+= 1.4.2
+
+- Add option to allow controlling of auto sign in functionality for security
+- Add intermediate method in active_for_authentication? for more flexibility
+- Add intermediate block_from_invitation? method for more flexibility
+- Fix undefined method `invite_key_fields'
+- Fix override valid_password? instead of active_for_authentication? (fixes #541)
+
+Compare: https://github.com/scambra/devise_invitable/compare/v1.4.1...v1.4.2
+
+= 1.4.1
+
+- Begin testing against devise 3.4
+- Use current_inviter to get redirect path after invite
+  (https://github.com/scambra/devise_invitable/pull/523)
+
+Compare: https://github.com/scambra/devise_invitable/compare/v1.4.0...v1.4.1
+
 = 1.4.0
+
 Override active_for_authentication? and inactive_message instead of valid_password?
 To use counter_cache, invited_by_counter_cache must be set, no more checking of invitations_count to enable counter cache
 
+Compare: https://github.com/scambra/devise_invitable/compare/v1.3.6...v1.4.0
+
+= 1.3.6
+
+- Regenerate invitation token each time even if "skip_invitation" was true
+- Add passing a block to instance #invite! method
+- Improvements to tests
+
+Compare: https://github.com/scambra/devise_invitable/compare/v1.3.5...v1.3.6
+
+= 1.3.5
+
+No notes yet, contributions welcome.
+
 = 1.3.0
+
 Now devise 3.1 compatible, @token must be used instead of @resource.invitation_token in mail views
 
 = 1.2.0
+
 Add invitation_created_at column which is set when invitation is created even when sending is skipped. This new field is used to check invitation period valid

data/README.rdoc

@@ -1,9 +1,9 @@
 = DeviseInvitable
-{<img src="https://travis-ci.org/scambra/devise_invitable.png"/>}[http://travis-ci.org/scambra/devise_invitable]
+{<img src="https://travis-ci.org/scambra/devise_invitable.png"/>}[https://travis-ci.org/scambra/devise_invitable] {<img src="https://codeclimate.com/github/scambra/devise_invitable/badges/gpa.svg"/}[https://codeclimate.com/github/scambra/devise_invitable]
 
-It adds support to devise[http://github.com/plataformatec/devise] for sending invitations by email (it requires to be authenticated) and accept the invitation setting the password.
+It adds support to devise[https://github.com/plataformatec/devise] for sending invitations by email (it requires to be authenticated) and accept the invitation setting the password.
 
-DeviseInvitable currently supports Rails 3 and 4, if you want to use it with Rails 2.3 you must install version {0.2.3}[http://rubygems.org/gems/devise_invitable/versions/0.2.3]
+DeviseInvitable currently supports Rails 3 and 4, if you want to use it with Rails 2.3 you must install version {0.2.3}[https://rubygems.org/gems/devise_invitable/versions/0.2.3]
 
 If you want to use devise 3.0.x, you must use 1.2.1, newer versions require devise >= 3.1.0
 
@@ -28,7 +28,7 @@ When you are done, you are ready to add DeviseInvitable to any of your Devise mo
 
   rails generate devise_invitable MODEL
 
-Replace MODEL by the class name you want to add DeviseInvitable, like User, Admin, etc. This will add the :invitable flag to your model's Devise modules. The generator will also create a migration file (if your ORM support them). Continue reading this file to understand exactly what the generator produces and how to use it.
+Replace MODEL by the class name you want to add DeviseInvitable, like User, Admin, etc. This will add the :invitable flag to your model's Devise modules. The generator will also create a migration file (if your ORM supports them). Continue reading this file to understand exactly what the generator produces and how to use it.
 
 === Manual installation
 
@@ -132,6 +132,10 @@ or directly as parameters to the <tt>devise</tt> method:
 
 * invited_by_class_name: The class name of the inviting model. If this is nil, polymorphic association is used.
 
+* invited_by_foreign_key: The foreign key to the inviting model (only used if invited_by_class_name is set, otherwise :invited_by_id)
+
+* allow_insecure_sign_in_after_accept: automatically sign in the user after they set a password. Enabled by default.
+
 For more details, see <tt>config/initializers/devise.rb</tt> (after you invoked the "devise_invitable:install" generator described above).
 
 == Configuring views
@@ -148,11 +152,11 @@ Then turn scoped views on in config/initializers/devise.rb:
 
   config.scoped_views = true
 
-Please refer to {Devise's README}[http://github.com/plataformatec/devise] for more information about views.
+Please refer to {Devise's README}[https://github.com/plataformatec/devise] for more information about views.
 
 == Configuring controllers
 
-To change the controller's behavior, create a controller that inherits from <tt>Devise::InvitationsController</tt>. The available methods are: new, create, edit, and update. You should read the {original controllers source}[https://raw.github.com/scambra/devise_invitable/master/app/controllers/devise/invitations_controller.rb] before editing any of these actions. Your controller might now look something like this:
+To change the controller's behavior, create a controller that inherits from <tt>Devise::InvitationsController</tt>. The available methods are: new, create, edit, and update. You should read the {original controllers source}[https://github.com/scambra/devise_invitable/blob/master/app/controllers/devise/invitations_controller.rb] before editing any of these actions. Your controller might now look something like this:
 
    class Users::InvitationsController < Devise::InvitationsController
      def update
@@ -198,7 +202,7 @@ To change behaviour of inviting or accepting users, you can simply override two
 
 == Strong Parameters
 
-When you customize your own views, you may end up adding new attributes to forms. Rails 4 moved the parameter sanitization from the model to the controller, causing DeviseInvitable to handle this concern at the controller as well. Read about it in {devise README}[http://github.com/plataformatec/devise#strong-parameters]
+When you customize your own views, you may end up adding new attributes to forms. Rails 4 moved the parameter sanitization from the model to the controller, causing DeviseInvitable to handle this concern at the controller as well. Read about it in {devise README}[https://github.com/plataformatec/devise#strong-parameters]
 
 There are just two actions in DeviseInvitable that allows any set of parameters to be passed down to the model, therefore requiring sanitization. Their names and the permited parameters by default are:
 
@@ -254,9 +258,11 @@ You can add :skip_invitation to attributes hash if skip_invitation is added to a
   User.invite!(:email => "new_user@example.com", :name => "John Doe", :skip_invitation => true)
   # => the record will be created, but the invitation email will not be sent
 
-Skip_invitation skips sending the email, but sets invitation_token, so invited_to_sign_up? on the
+Skip_invitation skips sending the email, but sets invitation_token, so <tt>invited_to_sign_up?</tt> on the
 resulting user returns true.
 
+To check if a perticular user is created by invitation, irrespective to state of invitation one can use <tt>created_by_invite?</tt>
+
 **Warning**
 
 When using skip_invitation you must send the email with the user object instance that generated the tokens, as 
@@ -295,8 +301,9 @@ The callbacks support all options and arguments available to the standard callba
 
 A pair of scopes to find those users that have accepted, and those that have not accepted, invitations are defined:
 
-  User.invitation_accepted # => returns all Users for whom the invitation_accepted_at attribute is not nil
+  User.invitation_accepted     # => returns all Users for whom the invitation_accepted_at attribute is not nil
   User.invitation_not_accepted # => returns all Users for whom the invitation_accepted_at attribute is nil
+  User.created_by_invite       # => returns all Users who are created by invitations, irrespective to invitation status 
 
 == Integration in a Rails application
 
@@ -305,7 +312,7 @@ Instead, in your views, put a link to <tt>new_user_invitation_path</tt> or <tt>n
 
 After an invitation is created and sent, the inviter will be redirected to after_invite_path_for(resource_name), which is stored path or the same path as after_sign_in_path_for by default.
 
-After an invitation is accepted, the invitee will be redirected to after_accept_path_for(resource), which is the same path as after_sign_in_path_for by default. If you want to override the path, override invitations controller and define after_accept_path_for method. This is useful in the common case that a user is invited to a specific location in your application. More on {Devise's README}[http://github.com/plataformatec/devise], "Controller filters and helpers" section.
+After an invitation is accepted, the invitee will be redirected to after_accept_path_for(resource), which is the same path as after_sign_in_path_for by default. If you want to override the path, override invitations controller and define after_accept_path_for method. This is useful in the common case that a user is invited to a specific location in your application. More on {Devise's README}[https://github.com/plataformatec/devise], "Controller filters and helpers" section.
 
 The invitation email includes a link to accept the invitation that looks like this:  <tt>/users/invitation/accept?invitation_token=abcd123</tt>. When clicked, the invited must set a password in order to accept its invitation. Note that if the invitation_token is not present or not valid, the invited is redirected to after_sign_out_path_for(resource_name).
 
@@ -355,6 +362,7 @@ DeviseInvitable uses flash messages with I18n with the flash keys <tt>:send_inst
         send_instructions: 'An invitation email has been sent to %{email}.'
         invitation_token_invalid: 'The invitation token provided is not valid!'
         updated: 'Your password was set successfully. You are now signed in.'
+        updated_not_active: 'Your password was set successfully.'
 
 You can also create distinct messages based on the resource you've configured using the singular name given in routes:
 
@@ -365,6 +373,7 @@ You can also create distinct messages based on the resource you've configured us
           send_instructions: 'A new user invitation has been sent to %{email}.'
           invitation_token_invalid: 'Your invitation token is not valid!'
           updated: 'Welcome on board! You are now signed in.'
+          updated_not_active: 'Welcome on board! Sign in to continue.'
 
 The DeviseInvitable mailer uses the same pattern as Devise to create mail subject messages:
 
@@ -402,9 +411,9 @@ To test DeviseInvitable for the ActiveRecord ORM with RVM, Ruby 1.9.2, and Rubyg
 
 Check them all at:
 
-http://github.com/scambra/devise_invitable/contributors
+https://github.com/scambra/devise_invitable/contributors
 
-Special thanks to rymai[http://github.com/rymai] for the Rails 3 support, his fork was a great help.
+Special thanks to rymai[https://github.com/rymai] for the Rails 3 support, his fork was a great help.
 
 == Note on Patches/Pull Requests
 

data/app/controllers/devise/invitations_controller.rb

@@ -15,13 +15,15 @@ class Devise::InvitationsController < DeviseController
   # POST /resource/invitation
   def create
     self.resource = invite_resource
+    resource_invited = resource.errors.empty?
 
-    if resource.errors.empty?
-      yield resource if block_given?
+    yield resource if block_given?
+
+    if resource_invited
       if is_flashing_format? && self.resource.invitation_sent_at
         set_flash_message :notice, :send_instructions, :email => self.resource.email
       end
-      respond_with resource, :location => after_invite_path_for(resource)
+      respond_with resource, :location => after_invite_path_for(current_inviter)
     else
       respond_with_navigational(resource) { render :new }
     end
@@ -35,15 +37,24 @@ class Devise::InvitationsController < DeviseController
 
   # PUT /resource/invitation
   def update
+    raw_invitation_token = update_resource_params[:invitation_token]
     self.resource = accept_resource
-
-    if resource.errors.empty?
-      yield resource if block_given?
-      flash_message = resource.active_for_authentication? ? :updated : :updated_not_active
-      set_flash_message :notice, flash_message if is_flashing_format?
-      sign_in(resource_name, resource)
-      respond_with resource, :location => after_accept_path_for(resource)
+    invitation_accepted = resource.errors.empty?
+
+    yield resource if block_given?
+
+    if invitation_accepted
+      if Devise.allow_insecure_sign_in_after_accept
+        flash_message = resource.active_for_authentication? ? :updated : :updated_not_active
+        set_flash_message :notice, flash_message if is_flashing_format?
+        sign_in(resource_name, resource)
+        respond_with resource, :location => after_accept_path_for(resource)
+      else
+        set_flash_message :notice, :updated_not_active if is_flashing_format?
+        respond_with resource, :location => new_session_path(resource_name)
+      end
     else
+      resource.invitation_token = raw_invitation_token
       respond_with_navigational(resource){ render :edit }
     end
   end

data/app/controllers/devise_invitable/registrations_controller.rb

@@ -4,8 +4,8 @@ class DeviseInvitable::RegistrationsController < Devise::RegistrationsController
   def build_resource(hash = nil)
     hash ||= resource_params || {}
     if hash[:email]
-      self.resource = resource_class.where(:email => hash[:email], :encrypted_password => '').first
-      if self.resource
+      self.resource = resource_class.where(:email => hash[:email]).first
+      if self.resource and self.resource.invited_to_sign_up?
         self.resource.attributes = hash
         self.resource.send_confirmation_instructions if self.resource.confirmation_required_for_invited?
         self.resource.accept_invitation

data/config/locales/en.yml

@@ -1,13 +1,14 @@
 en:
   devise:
     failure:
-      invited: 'You have a pending invitation, accept it to finish creating your account.'
+      invited: "You have a pending invitation, accept it to finish creating your account."
     invitations:
-      send_instructions: 'An invitation email has been sent to %{email}.'
-      invitation_token_invalid: 'The invitation token provided is not valid!'
-      updated: 'Your password was set successfully. You are now signed in.'
+      send_instructions: "An invitation email has been sent to %{email}."
+      invitation_token_invalid: "The invitation token provided is not valid!"
+      updated: "Your password was set successfully. You are now signed in."
+      updated_not_active: "Your password was set successfully."
       no_invitations_remaining: "No invitations remaining"
-      invitation_removed: 'Your invitation was removed.'
+      invitation_removed: "Your invitation was removed."
       new:
         header: "Send invitation"
         submit_button: "Send an invitation"
@@ -16,8 +17,8 @@ en:
         submit_button: "Set my password"
     mailer:
       invitation_instructions:
-        subject: 'Invitation instructions'
-        hello: 'Hello %{email}'
-        someone_invited_you: 'Someone has invited you to %{url}, you can accept it through the link below.'
-        accept: 'Accept invitation'
+        subject: "Invitation instructions"
+        hello: "Hello %{email}"
+        someone_invited_you: "Someone has invited you to %{url}, you can accept it through the link below."
+        accept: "Accept invitation"
         ignore: "If you don't want to accept the invitation, please ignore this email.<br />Your account won't be created until you access the link above and set your password."

data/lib/devise_invitable/model.rb

@@ -34,6 +34,9 @@ module Devise
         else
           {:polymorphic => true}
         end
+	if fk = Devise.invited_by_foreign_key
+	  belongs_to_options[:foreign_key] = fk
+	end
         if defined?(ActiveRecord) && defined?(ActiveRecord::Base) && self < ActiveRecord::Base
           counter_cache = Devise.invited_by_counter_cache
           belongs_to_options.merge! :counter_cache => counter_cache if counter_cache
@@ -43,13 +46,13 @@ module Devise
         include ActiveSupport::Callbacks
         define_callbacks :invitation_accepted
 
-        attr_writer :skip_password
-
         scope :no_active_invitation, lambda { where(:invitation_token => nil) }
         if defined?(Mongoid) && defined?(Mongoid::Document) && self < Mongoid::Document
+          scope :created_by_invite, lambda { where(:invitation_sent_at.ne => nil) }
           scope :invitation_not_accepted, lambda { where(:invitation_accepted_at => nil, :invitation_token.ne => nil) }
           scope :invitation_accepted, lambda { where(:invitation_accepted_at.ne => nil) }
         else
+          scope :created_by_invite, lambda { where(arel_table[:invitation_sent_at].not_eq(nil)) }
           scope :invitation_not_accepted, lambda { where(arel_table[:invitation_token].not_eq(nil)).where(:invitation_accepted_at => nil) }
           scope :invitation_accepted, lambda { where(arel_table[:invitation_accepted_at].not_eq(nil)) }
 
@@ -61,7 +64,7 @@ module Devise
 
       def self.required_fields(klass)
         fields = [:invitation_token, :invitation_created_at, :invitation_sent_at, :invitation_accepted_at,
-         :invitation_limit, :invited_by_id, :invited_by_type]
+         :invitation_limit, Devise.invited_by_foreign_key || :invited_by_id, :invited_by_type]
         fields << :invitations_count if defined?(ActiveRecord) && self < ActiveRecord::Base
         fields -= [:invited_by_type] if Devise.invited_by_class_name
         fields
@@ -85,6 +88,11 @@ module Devise
         end
       end
 
+      # Verify wheather a user is created by invitation, irrespective to invitation status
+      def created_by_invite?
+        invitation_sent_at.present?
+      end
+
       # Verifies whether a user has been invited or not
       def invited_to_sign_up?
         persisted? && invitation_token.present?
@@ -102,27 +110,28 @@ module Devise
 
       # Reset invitation token and send invitation again
       def invite!(invited_by = nil)
+        # This is an order-dependant assignment, this can't be moved 
         was_invited = invited_to_sign_up?
 
         # Required to workaround confirmable model's confirmation_required? method
         # being implemented to check for non-nil value of confirmed_at
-        if self.new_record? && self.respond_to?(:confirmation_required?, true)
+        if new_record_and_responds_to?(:confirmation_required?)
           def self.confirmation_required?; false; end
         end
 
         yield self if block_given?
-        generate_invitation_token if self.invitation_token.nil? || (!@skip_invitation || @raw_invitation_token.nil?)
+        generate_invitation_token if no_token_present_or_skip_invitation?
         self.invitation_created_at = Time.now.utc
-        self.invitation_sent_at = self.invitation_created_at unless @skip_invitation
+        self.invitation_sent_at = self.invitation_created_at unless skip_invitation
         self.invited_by = invited_by if invited_by
 
         # Call these before_validate methods since we aren't validating on save
-        self.downcase_keys if self.new_record? && self.respond_to?(:downcase_keys, true)
-        self.strip_whitespace if self.new_record? && self.respond_to?(:strip_whitespace, true)
+        self.downcase_keys if new_record_and_responds_to?(:downcase_keys)
+        self.strip_whitespace if new_record_and_responds_to?(:strip_whitespace)
 
         if save(:validate => false)
           self.invited_by.decrement_invitation_limit! if !was_invited and self.invited_by.present?
-          deliver_invitation unless @skip_invitation
+          deliver_invitation unless skip_invitation
         end
       end
 
@@ -134,17 +143,18 @@ module Devise
       end
 
       # Only verify password when is not invited
-      def active_for_authentication?
-        super unless invited_to_sign_up?
+      def valid_password?(password)
+        super unless block_from_invitation?
       end
 
-      def inactive_message
-        invited_to_sign_up? ? :invited : super
+      def unauthenticated_message
+        block_from_invitation? ? :invited : super
       end
 
-      def after_password_reset
+      def clear_reset_password_token
+        reset_password_token_present = reset_password_token.present?
         super
-        accept_invitation! if invited_to_sign_up?
+        accept_invitation! if reset_password_token_present && invited_to_sign_up?
       end
 
       def clear_errors_on_valid_keys
@@ -170,11 +180,10 @@ module Devise
       end
 
       protected
-        # Overriding the method in Devise's :validatable module so password is not required on inviting
-        def password_required?
-          !@skip_password && super
-        end
 
+        def block_from_invitation?
+          invited_to_sign_up?
+        end
 
         # Checks if the invitation for the user is within the limit time.
         # We do this by calculating if the difference between today and the
@@ -212,6 +221,14 @@ module Devise
           generate_invitation_token && save(:validate => false)
         end
 
+        def new_record_and_responds_to?(method)
+          self.new_record? && self.respond_to?(method, true)
+        end
+
+        def no_token_present_or_skip_invitation?
+          self.invitation_token.nil? || (!skip_invitation || @raw_invitation_token.nil?)
+        end
+
       module ClassMethods
         # Return fields to invite
         def invite_key_fields
@@ -237,8 +254,10 @@ module Devise
           invitable = find_or_initialize_with_errors(invite_key_array, attributes_hash)
           invitable.assign_attributes(attributes)
           invitable.invited_by = invited_by
+          unless invitable.password
+            invitable.password = Devise.friendly_token[0, 20]
+          end
 
-          invitable.skip_password = true
           invitable.valid? if self.validate_on_invite
           if invitable.new_record?
             invitable.clear_errors_on_valid_keys if !self.validate_on_invite
@@ -254,13 +273,11 @@ module Devise
         end
 
         def invite!(attributes={}, invited_by=nil, &block)
-          invitable, mail = _invite(attributes.with_indifferent_access, invited_by, &block)
-          invitable
+          _invite(attributes.with_indifferent_access, invited_by, &block).first
         end
 
         def invite_mail!(attributes={}, invited_by=nil, &block)
-          invitable, mail = _invite(attributes, invited_by, &block)
-          mail
+          _invite(attributes, invited_by, &block).last
         end
 
         # Attempt to find a user by it's invitation_token to set it's password.
@@ -283,7 +300,6 @@ module Devise
 
           invitable = find_or_initialize_with_error_by(:invitation_token, invitation_token)
           invitable.errors.add(:invitation_token, :invalid) if invitable.invitation_token && invitable.persisted? && !invitable.valid_invitation?
-          invitable.invitation_token = original_token
           invitable unless only_valid && invitable.errors.present?
         end
 
@@ -302,6 +318,8 @@ module Devise
         Devise::Models.config(self, :invitation_limit)
         Devise::Models.config(self, :invite_key)
         Devise::Models.config(self, :resend_invitation)
+        Devise::Models.config(self, :allow_insecure_sign_in_after_accept)
+
       end
     end
   end

data/lib/devise_invitable/parameter_sanitizer.rb

@@ -20,7 +20,7 @@ module DeviseInvitable
     def attributes_for_with_invitable(kind)
       case kind
       when :invite
-        resource_class.invite_key_fields
+        resource_class.respond_to?(:invite_key_fields) ? resource_class.invite_key_fields : []
       when :accept_invitation
         [:password, :password_confirmation, :invitation_token]
       else attributes_for_without_invitable(kind)

data/lib/devise_invitable/version.rb

@@ -1,3 +1,3 @@
 module DeviseInvitable
-  VERSION = '1.4.0'
+  VERSION = '1.5.2'
 end

data/lib/devise_invitable.rb

@@ -62,10 +62,20 @@ module Devise
   mattr_accessor :invited_by_class_name
   @@invited_by_class_name = nil
 
+  # Public: The foreign key to the inviting model (if invited_by_class_name is set)
+  # (default: :invited_by_id)
+  mattr_accessor :invited_by_foreign_key
+  @@invited_by_foreign_key = nil
+
   # Public: The column name used for counter_cache column. If this is nil,
   # the #invited_by association is declared without counter_cache. (default: nil)
   mattr_accessor :invited_by_counter_cache
   @@invited_by_counter_cache = nil
+
+  # Public: Auto-login after the user accepts the invite. If this is false,
+  # the user will need to manually log in after accepting the invite (default: false).
+  mattr_accessor :allow_insecure_sign_in_after_accept
+  @@allow_insecure_sign_in_after_accept = true
 end
 
 Devise.add_module :invitable, :controller => :invitations, :model => 'devise_invitable/model', :route => {:invitation => [nil, :new, :accept]}

data/lib/generators/active_record/templates/migration.rb

@@ -6,28 +6,18 @@ class DeviseInvitableAddTo<%= table_name.camelize %> < ActiveRecord::Migration
       t.datetime   :invitation_sent_at
       t.datetime   :invitation_accepted_at
       t.integer    :invitation_limit
-      t.references :invited_by, :polymorphic => true
+      t.references :invited_by, polymorphic: true
       t.integer    :invitations_count, default: 0
       t.index      :invitations_count
-      t.index      :invitation_token, :unique => true # for invitable
+      t.index      :invitation_token, unique: true # for invitable
       t.index      :invited_by_id
     end
-
-    # And allow null encrypted_password and password_salt:
-    change_column_null :<%= table_name %>, :encrypted_password, true
-<% if class_name.constantize.columns_hash['password_salt'] -%>
-    change_column_null :<%= table_name %>, :password_salt,      true
-<% end -%>
   end
 
   def down
     change_table :<%= table_name %> do |t|
-      t.remove_references :invited_by, :polymorphic => true
+      t.remove_references :invited_by, polymorphic: true
       t.remove :invitations_count, :invitation_limit, :invitation_sent_at, :invitation_accepted_at, :invitation_token, :invitation_created_at
     end
-    change_column_null    :<%= table_name %>, :encrypted_password, false
-<% if class_name.constantize.columns_hash['password_salt'] -%>
-    change_column_null :<%= table_name %>, :password_salt,false
-<% end -%>
   end
 end

data/lib/generators/devise_invitable/install_generator.rb

@@ -52,11 +52,20 @@ module DeviseInvitable
   # Default: nil
   # config.invited_by_class_name = 'User'
 
+  # The foreign key to the inviting model (if invited_by_class_name is set)
+  # Default: :invited_by_id
+  # config.invited_by_foreign_key = :invited_by_id
+
   # The column name used for counter_cache column. If this is nil,
   # the #invited_by association is declared without counter_cache.
   # Default: nil
   # config.invited_by_counter_cache = :invitations_count
 
+  # Auto-login after the user accepts the invite. If this is false,
+  # the user will need to manually log in after accepting the invite.
+  # Default: false
+  # config.allow_insecure_sign_in_after_accept = true
+
 CONTENT
             end
           end

data/lib/generators/devise_invitable/templates/simple_form_for/invitations/edit.html.erb

@@ -1,6 +1,6 @@
 <h2><%= t 'devise.invitations.edit.header' %></h2>
 
-<%= simple_form_for resource, :as => resource_name, :url => invitation_path(resource_name), :html => { :method => :put } do |f| %>
+<%= simple_form_for resource, as: resource_name, url: invitation_path(resource_name), html: { method: :put } do |f| %>
   <%= devise_error_messages! %>
   <%= f.hidden_field :invitation_token %>
 

data/lib/generators/devise_invitable/templates/simple_form_for/invitations/new.html.erb

@@ -1,6 +1,6 @@
 <h2><%= t "devise.invitations.new.header" %></h2>
 
-<%= simple_form_for resource, :as => resource_name, :url => invitation_path(resource_name), :html => {:method => :post} do |f| %>
+<%= simple_form_for resource, as: resource_name, url: invitation_path(resource_name), html: { method: :post} do |f| %>
   <%= devise_error_messages! %>
 
 <% resource.class.invite_key_fields.each do |field| -%>

data/test/functional/controller_helpers_test.rb

@@ -4,11 +4,11 @@ class ControllerHelpersTest < ActionController::TestCase
   tests ApplicationController
 
   test "after invite path defaults to after sign in path" do
-    assert_equal @controller.after_sign_in_path_for(:user), @controller.after_invite_path_for(:user)
+    assert_equal @controller.send(:after_sign_in_path_for, :user), @controller.after_invite_path_for(:user)
   end
   
   test "after accept path defaults to after sign in path" do
-    assert_equal @controller.after_sign_in_path_for(:user), @controller.after_accept_path_for(:user)
+    assert_equal @controller.send(:after_sign_in_path_for, :user), @controller.after_accept_path_for(:user)
   end
   
   test 'after invite path is customizable from application controller' do
@@ -36,4 +36,4 @@ class ControllerHelpersTest < ActionController::TestCase
     assert Devise::InvitationsController.method_defined? :after_accept_path_for
     assert !Devise::InvitationsController.instance_methods(false).include?(:after_accept_path_for)
   end
-end
+end

data/test/functional/registrations_controller_test.rb

@@ -25,7 +25,9 @@ class DeviseInvitable::RegistrationsControllerTest < ActionController::TestCase
     sign_out @issuer
 
     @invitee = User.where(:email => invitee_email).first
-    assert @invitee.encrypted_password.blank?, "the password should be unset"
+    assert_nil @invitee.invitation_accepted_at
+    assert_not_nil @invitee.invitation_token
+    assert !@invitee.confirmed?
 
     # sign_up the invitee
     assert_difference('ActionMailer::Base.deliveries.size') do
@@ -47,8 +49,8 @@ class DeviseInvitable::RegistrationsControllerTest < ActionController::TestCase
     assert_nil @invitee.invitation_token
     assert @invitee.invited_by_id.present?
     assert @invitee.invited_by_type.present?
-    assert !@invitee.confirmed?
     assert @invitee.confirmation_token.present?
+    assert !@invitee.confirmed?
   end
 
   test "not invitable resources can register" do

data/test/integration/invitation_remove_test.rb

@@ -4,7 +4,7 @@ require 'integration_tests_helper'
 class InvitationRemoveTest < ActionDispatch::IntegrationTest
 
   test 'invited user can choose to remove his account/invite' do
-    user = User.invite!(:email => "valid@email.com")
+    User.invite!(:email => "valid@email.com")
 
     # remove!
     visit remove_user_invitation_path(:invitation_token => Thread.current[:token])

data/test/integration/invitation_test.rb

@@ -64,6 +64,25 @@ class InvitationTest < ActionDispatch::IntegrationTest
     assert_equal root_path, current_path
   end
 
+  test 'invited user without password should not be able to sign in' do
+    user = User.invite!(:email => "valid@email.com")
+    user.password = 'test'
+    sign_in_as_user user
+
+    assert_equal new_user_session_path, current_path
+    assert page.has_css?('p#alert', :text => 'You have a pending invitation, accept it to finish creating your account.')
+  end
+
+  test 'invited user with password should not be able to sign in' do
+    user = User.invite!(:email => "valid@email.com")
+    user.password = '987654321'
+    user.save
+    sign_in_as_user user
+
+    assert_equal new_user_session_path, current_path
+    assert page.has_css?('p#alert', :text => 'You have a pending invitation, accept it to finish creating your account.')
+  end
+
   test 'not authenticated user with invalid invitation token should not be able to set his password' do
     user = User.invite!(:email => "valid@email.com")
     user.accept_invitation!
@@ -80,7 +99,7 @@ class InvitationTest < ActionDispatch::IntegrationTest
     end
     assert_equal user_invitation_path, current_path
     assert page.has_css?('#error_explanation li', :text => /Password .*doesn\'t match/)
-    assert user.encrypted_password.blank?
+    assert !user.confirmed?
   end
 
   test 'not authenticated user with valid data should be able to change his password' do
@@ -90,6 +109,7 @@ class InvitationTest < ActionDispatch::IntegrationTest
     assert_equal root_path, current_path
     assert page.has_css?('p#notice', :text => 'Your password was set successfully. You are now signed in.')
     assert user.reload.valid_password?('987654321')
+    assert user.confirmed?
   end
 
   test 'after entering invalid data user should still be able to set his password' do
@@ -99,17 +119,32 @@ class InvitationTest < ActionDispatch::IntegrationTest
     end
     assert_equal user_invitation_path, current_path
     assert page.has_css?('#error_explanation')
-    assert user.encrypted_password.blank?
 
     set_password :visit => false
     assert page.has_css?('p#notice', :text => 'Your password was set successfully. You are now signed in.')
     assert user.reload.valid_password?('987654321')
   end
 
-  test 'sign in user automatically after setting it\'s password' do
-    user = User.invite!(:email => "valid@email.com")
+  test 'sign in user automatically after setting it\'s password if config.allow_insecure_sign_in_after_accept is true' do
+    original_option_value = Devise.allow_insecure_sign_in_after_accept
+    Devise.allow_insecure_sign_in_after_accept = true
+
+    User.invite!(:email => "valid@email.com")
     set_password :invitation_token => Thread.current[:token]
+
     assert_equal root_path, current_path
+    Devise.allow_insecure_sign_in_after_accept = original_option_value
+  end
+
+  test 'does not sign in user automatically after setting it\'s password if config.allow_insecure_sign_in_after_accept is false' do
+    original_option_value = Devise.allow_insecure_sign_in_after_accept
+    Devise.allow_insecure_sign_in_after_accept = false
+
+    User.invite!(:email => "valid@email.com")
+    set_password :invitation_token => Thread.current[:token]
+
+    assert_equal new_user_session_path, current_path
+    Devise.allow_insecure_sign_in_after_accept = original_option_value
   end
 
   test 'clear token and set invitation_accepted_at after recover password instead of accept_invitation' do
@@ -213,10 +248,20 @@ class InvitationTest < ActionDispatch::IntegrationTest
   end
 
   test 'authenticated admin should be able to send an admin invitation' do
-    sign_in_as_user Admin.create(:email => 'admin@test.com', :password => '123456', :password_confirmation => '123456')
+    admin = Admin.create(:email => 'admin@test.com', :password => '123456', :password_confirmation => '123456')
+    sign_in_as_user admin
 
     send_invitation new_admin_path
-    assert_equal root_path, current_path
+    assert_equal edit_admin_registration_path(admin), current_path
+    assert page.has_css?('p#notice', :text => 'An invitation email has been sent to user@test.com.')
+  end
+
+  test 'authenticated admin should be redirected to own page after send a free invitation' do
+    admin = Admin.create(:email => 'admin@test.com', :password => '123456', :password_confirmation => '123456')
+    sign_in_as_user admin
+
+    send_invitation new_free_invitation_path
+    assert_equal edit_admin_registration_path(admin), current_path
     assert page.has_css?('p#notice', :text => 'An invitation email has been sent to user@test.com.')
   end
 end

data/test/models/invitable_test.rb

@@ -169,7 +169,7 @@ class InvitableTest < ActiveSupport::TestCase
   end
 
   test 'should set password and password confirmation from params' do
-    invited_user = User.invite!(:email => "valid@email.com")
+    User.invite!(:email => "valid@email.com")
     user = User.accept_invitation!(:invitation_token => Thread.current[:token], :password => '123456789', :password_confirmation => '123456789')
     assert user.valid_password?('123456789')
   end
@@ -181,6 +181,11 @@ class InvitableTest < ActiveSupport::TestCase
     assert_not_equal old_encrypted_password, user.encrypted_password
   end
 
+  test 'should not override password on invite!' do
+    user = User.invite!(:email => "valid@email.com", :password => 'password', :password_confirmation => 'password', :skip_invitation => true)
+    assert user.valid?
+  end
+
   test 'should clear invitation token and set invitation_accepted_at while accepting the password' do
     user = User.invite!(:email => "valid@email.com")
     assert user.invitation_token.present?
@@ -406,7 +411,7 @@ class InvitableTest < ActiveSupport::TestCase
     user = new_user(:password => nil, :password_confirmation => nil)
     user.invite!
 
-    invited_user = User.accept_invitation!(
+    User.accept_invitation!(
       :invitation_token => Thread.current[:token],
       :password => 'new_password',
       :password_confirmation => 'new_password'
@@ -431,6 +436,21 @@ class InvitableTest < ActiveSupport::TestCase
     user.reload
     assert !user.valid_password?('new_password')
   end
+  
+  test 'should check if created by invitation' do
+    user = User.invite!(:email => "valid@email.com")
+    assert user.created_by_invite?
+    
+    invited_user = User.accept_invitation!(
+      :invitation_token => Thread.current[:token],
+      :password => 'new_password',
+      :password_confirmation => 'new_password',
+      :username => 'a'
+    )
+    user.reload
+    assert user.created_by_invite?
+  end
+
 
   test 'should set other attributes on accepting invitation' do
     user = new_user(:password => nil, :password_confirmation => nil)
@@ -480,13 +500,13 @@ class InvitableTest < ActiveSupport::TestCase
 
   test 'should not send an invitation if we want to skip the invitation' do
     assert_no_difference('ActionMailer::Base.deliveries.size') do
-      invited_user = User.invite!(:email => "valid@email.com", :username => "a"*50, :skip_invitation => true)
+      User.invite!(:email => "valid@email.com", :username => "a"*50, :skip_invitation => true)
     end
   end
 
   test 'should not send an invitation if we want to skip the invitation with block' do
     assert_no_difference('ActionMailer::Base.deliveries.size') do
-      invited_user = User.invite!(:email => "valid@email.com", :username => "a"*50) do |u|
+      User.invite!(:email => "valid@email.com", :username => "a"*50) do |u|
         u.skip_invitation = true
       end
     end
@@ -606,24 +626,28 @@ class InvitableTest < ActiveSupport::TestCase
   end
 
   test 'should return instance with errors if invitation_token is nil' do
-    registered_user = User.create(:email => 'admin@test.com', :password => '123456', :password_confirmation => '123456')
+    User.create(:email => 'admin@test.com', :password => '123456', :password_confirmation => '123456')
     user = User.accept_invitation!
     assert !user.errors.empty?
   end
 
-  test "should count accepted and not accepted invitations" do
+  test "should count invited, created_by_invite, accepted and not accepted invitations" do
     assert_equal 0, User.invitation_not_accepted.count
     assert_equal 0, User.invitation_accepted.count
+    assert_equal 0, User.created_by_invite.count
 
     User.invite!(:email => "invalid@email.com")
+    User.invite!(:email => "another_invalid@email.com")
     user = User.invite!(:email => "valid@email.com")
 
-    assert_equal 2, User.invitation_not_accepted.count
+    assert_equal 3, User.invitation_not_accepted.count
     assert_equal 0, User.invitation_accepted.count
+    assert_equal 3, User.created_by_invite.count
 
     user.accept_invitation!
-    assert_equal 1, User.invitation_not_accepted.count
+    assert_equal 2, User.invitation_not_accepted.count
     assert_equal 1, User.invitation_accepted.count
+    assert_equal 3, User.created_by_invite.count
   end
 
   test "should preserve return values of Devise::Recoverable#reset_password!" do

data/test/rails_app/app/controllers/application_controller.rb

@@ -3,6 +3,13 @@ class ApplicationController < ActionController::Base
   before_filter :configure_permitted_parameters, :if => :devise_controller?
 
   protected
+  def after_sign_in_path_for(resource)
+    if resource.is_a? Admin
+      edit_admin_registration_path(resource)
+    else
+      super
+    end
+  end
 
   def configure_permitted_parameters
     devise_parameter_sanitizer.for(:sign_up) { |u| u.permit(:email, :password, :bio) } if defined?(ActionController::StrongParameters)

data/test/rails_app/app/controllers/free_invitations_controller.rb

@@ -3,4 +3,10 @@ class FreeInvitationsController < Devise::InvitationsController
   def authenticate_inviter!
   # everyone can invite
   end
+  def current_inviter
+    current_admin || current_user
+  end
+  def after_invite_path_for(resource)
+    resource ? super : root_path
+  end
 end

data/test/rails_app/app/views/devise/sessions/new.html.erb

@@ -0,0 +1,17 @@
+<h2>Log in</h2>
+
+<%= form_for(resource, as: resource_name, url: session_path(resource_name)) do |f| %>
+  <div><%= f.label :email %><br />
+  <%= f.email_field :email, autofocus: true %></div>
+
+  <div><%= f.label :password %><br />
+    <%= f.password_field :password, autocomplete: "off" %></div>
+
+  <% if devise_mapping.rememberable? -%>
+    <div><%= f.check_box :remember_me %> <%= f.label :remember_me %></div>
+  <% end -%>
+
+  <div><%= f.submit "Log in" %></div>
+<% end %>
+
+<%= render "devise/shared/links" %>

data/test/rails_app/config/initializers/devise.rb

@@ -124,11 +124,20 @@ Devise.setup do |config|
   # Default: nil
   # config.invited_by_class_name = 'User'
 
+  # The foreign key to the inviting model (if invited_by_class_name is set)
+  # Default: :invited_by_id
+  # config.invited_by_foreign_key = :invited_by_id
+
   # The column name used for counter_cache column. If this is nil,
   # the #invited_by association is declared without counter_cache.
   # Default: nil
   config.invited_by_counter_cache = :invitations_count
 
+  # Auto-login after the user accepts the invite. If this is false,
+  # the user will need to manually log in after accepting the invite.
+  # Default: true
+  # config.allow_insecure_sign_in_after_accept = false
+
   # ==> Configuration for :confirmable
   # A period that the user is allowed to access the website even without
   # confirming his account. For instance, if set to 2.days, the user will be

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise_invitable
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.5.2
 platform: ruby
 authors:
 - Sergio Cambra
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-10-21 00:00:00.000000000 Z
+date: 2015-07-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -66,6 +66,9 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG
+- LICENSE
+- README.rdoc
 - app/controllers/devise/invitations_controller.rb
 - app/controllers/devise_invitable/registrations_controller.rb
 - app/views/devise/invitations/edit.html.erb
@@ -90,9 +93,6 @@ files:
 - lib/generators/devise_invitable/templates/simple_form_for/invitations/new.html.erb
 - lib/generators/devise_invitable/views_generator.rb
 - lib/generators/mongoid/devise_invitable_generator.rb
-- LICENSE
-- README.rdoc
-- CHANGELOG
 - test/functional/controller_helpers_test.rb
 - test/functional/registrations_controller_test.rb
 - test/generators/views_generator_test.rb
@@ -117,6 +117,7 @@ files:
 - test/rails_app/app/models/octopussy.rb
 - test/rails_app/app/models/user.rb
 - test/rails_app/app/views/admins/new.html.erb
+- test/rails_app/app/views/devise/sessions/new.html.erb
 - test/rails_app/app/views/free_invitations/new.html.erb
 - test/rails_app/app/views/home/index.html.erb
 - test/rails_app/app/views/layouts/application.html.erb
@@ -167,7 +168,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: 1.3.6
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.1.11
+rubygems_version: 2.4.5
 signing_key: 
 specification_version: 4
 summary: An invitation strategy for Devise
@@ -196,6 +197,7 @@ test_files:
 - test/rails_app/app/models/octopussy.rb
 - test/rails_app/app/models/user.rb
 - test/rails_app/app/views/admins/new.html.erb
+- test/rails_app/app/views/devise/sessions/new.html.erb
 - test/rails_app/app/views/free_invitations/new.html.erb
 - test/rails_app/app/views/home/index.html.erb
 - test/rails_app/app/views/layouts/application.html.erb