devise_invitable 1.4.1 → 1.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 3baf83979bda300001727d86af188f93a91bf95c
-  data.tar.gz: 74d6ac1f55c041e7075e4c1e8ec026e470fdfe12
+  metadata.gz: 09f7285fbf0dcc7da0b16e9a26bbc9c385e19720
+  data.tar.gz: 0b862b791cd58df3fc8ad6eba813c76534e89cba
 SHA512:
-  metadata.gz: 0b08b0b990d88fd99aed53e4d3082db8354bda2e5046fad13901debde5ecb614ba5cdcea7e11709798ea16d4dc99dac27dbd622534179cf1d9a3cbaaaba38bda
-  data.tar.gz: 3ca119718132addd0b7b331ac4fe81c4e21852b6480ef10c3ed742492b82e86e6fbd01f84957e5a7b6426aba2bbd5eaeb8f65460730399f3e286e125355ca77f
+  metadata.gz: 8bf23dd018217299609a033f0ea3666a4f0358580a6b2a14bff4405666ae82217de809b1fdac77a12269349337d8756a601c635e427962fa343c81d4bdf0c765
+  data.tar.gz: 560b395e0616d53b6b2d3164cd9ccd34a017517256f627a098c4971b4b85a55f41f61810f735dc2c51d9afcfb1acf848574bf1b32e2185b8ec47b9afe47d946c

data/CHANGELOG

@@ -1,3 +1,5 @@
+Override valid_password? and unauthenticated_message instead of active_for_authentication? and inactive_message, active_for_authentication? doesn't work for default behavior of invited users without password
+
 = 1.4.0
 Override active_for_authentication? and inactive_message instead of valid_password?
 To use counter_cache, invited_by_counter_cache must be set, no more checking of invitations_count to enable counter cache

data/README.rdoc

@@ -1,5 +1,5 @@
 = DeviseInvitable
-{<img src="https://travis-ci.org/scambra/devise_invitable.png"/>}[http://travis-ci.org/scambra/devise_invitable]
+{<img src="https://travis-ci.org/scambra/devise_invitable.png"/>}[http://travis-ci.org/scambra/devise_invitable] {<img src="https://codeclimate.com/github/scambra/devise_invitable/badges/gpa.svg"/}[https://codeclimate.com/github/scambra/devise_invitable]
 
 It adds support to devise[http://github.com/plataformatec/devise] for sending invitations by email (it requires to be authenticated) and accept the invitation setting the password.
 
@@ -28,7 +28,7 @@ When you are done, you are ready to add DeviseInvitable to any of your Devise mo
 
   rails generate devise_invitable MODEL
 
-Replace MODEL by the class name you want to add DeviseInvitable, like User, Admin, etc. This will add the :invitable flag to your model's Devise modules. The generator will also create a migration file (if your ORM support them). Continue reading this file to understand exactly what the generator produces and how to use it.
+Replace MODEL by the class name you want to add DeviseInvitable, like User, Admin, etc. This will add the :invitable flag to your model's Devise modules. The generator will also create a migration file (if your ORM supports them). Continue reading this file to understand exactly what the generator produces and how to use it.
 
 === Manual installation
 
@@ -132,6 +132,8 @@ or directly as parameters to the <tt>devise</tt> method:
 
 * invited_by_class_name: The class name of the inviting model. If this is nil, polymorphic association is used.
 
+* allow_insecure_sign_in_after_accept: automatically sign in the user after they set a password. Enabled by default.
+
 For more details, see <tt>config/initializers/devise.rb</tt> (after you invoked the "devise_invitable:install" generator described above).
 
 == Configuring views
@@ -254,9 +256,11 @@ You can add :skip_invitation to attributes hash if skip_invitation is added to a
   User.invite!(:email => "new_user@example.com", :name => "John Doe", :skip_invitation => true)
   # => the record will be created, but the invitation email will not be sent
 
-Skip_invitation skips sending the email, but sets invitation_token, so invited_to_sign_up? on the
+Skip_invitation skips sending the email, but sets invitation_token, so <tt>invited_to_sign_up?</tt> on the
 resulting user returns true.
 
+To check if a perticular user is created by invitation, irrespective to state of invitation one can use <tt>created_by_invite?</tt>
+
 **Warning**
 
 When using skip_invitation you must send the email with the user object instance that generated the tokens, as 
@@ -295,8 +299,9 @@ The callbacks support all options and arguments available to the standard callba
 
 A pair of scopes to find those users that have accepted, and those that have not accepted, invitations are defined:
 
-  User.invitation_accepted # => returns all Users for whom the invitation_accepted_at attribute is not nil
+  User.invitation_accepted     # => returns all Users for whom the invitation_accepted_at attribute is not nil
   User.invitation_not_accepted # => returns all Users for whom the invitation_accepted_at attribute is nil
+  User.created_by_invite       # => returns all Users who are created by invitations, irrespective to invitation status 
 
 == Integration in a Rails application
 
@@ -355,6 +360,7 @@ DeviseInvitable uses flash messages with I18n with the flash keys <tt>:send_inst
         send_instructions: 'An invitation email has been sent to %{email}.'
         invitation_token_invalid: 'The invitation token provided is not valid!'
         updated: 'Your password was set successfully. You are now signed in.'
+        updated_not_active: 'Your password was set successfully.'
 
 You can also create distinct messages based on the resource you've configured using the singular name given in routes:
 
@@ -365,6 +371,7 @@ You can also create distinct messages based on the resource you've configured us
           send_instructions: 'A new user invitation has been sent to %{email}.'
           invitation_token_invalid: 'Your invitation token is not valid!'
           updated: 'Welcome on board! You are now signed in.'
+          updated_not_active: 'Welcome on board! Sign in to continue.'
 
 The DeviseInvitable mailer uses the same pattern as Devise to create mail subject messages:
 

data/app/controllers/devise/invitations_controller.rb

@@ -37,17 +37,24 @@ class Devise::InvitationsController < DeviseController
 
   # PUT /resource/invitation
   def update
+    raw_invitation_token = update_resource_params[:invitation_token]
     self.resource = accept_resource
     invitation_accepted = resource.errors.empty?
 
     yield resource if block_given?
 
     if invitation_accepted
-      flash_message = resource.active_for_authentication? ? :updated : :updated_not_active
-      set_flash_message :notice, flash_message if is_flashing_format?
-      sign_in(resource_name, resource)
-      respond_with resource, :location => after_accept_path_for(resource)
+      if Devise.allow_insecure_sign_in_after_accept
+        flash_message = resource.active_for_authentication? ? :updated : :updated_not_active
+        set_flash_message :notice, flash_message if is_flashing_format?
+        sign_in(resource_name, resource)
+        respond_with resource, :location => after_accept_path_for(resource)
+      else
+        set_flash_message :notice, :updated_not_active if is_flashing_format?
+        respond_with resource, :location => new_session_path(resource_name)
+      end
     else
+      resource.invitation_token = raw_invitation_token
       respond_with_navigational(resource){ render :edit }
     end
   end

data/config/locales/en.yml

@@ -6,6 +6,7 @@ en:
       send_instructions: "An invitation email has been sent to %{email}."
       invitation_token_invalid: "The invitation token provided is not valid!"
       updated: "Your password was set successfully. You are now signed in."
+      updated_not_active: "Your password was set successfully."
       no_invitations_remaining: "No invitations remaining"
       invitation_removed: "Your invitation was removed."
       new:

data/lib/devise_invitable/model.rb

@@ -47,9 +47,11 @@ module Devise
 
         scope :no_active_invitation, lambda { where(:invitation_token => nil) }
         if defined?(Mongoid) && defined?(Mongoid::Document) && self < Mongoid::Document
+          scope :created_by_invite, lambda { where(:invitation_sent_at.ne => nil) }
           scope :invitation_not_accepted, lambda { where(:invitation_accepted_at => nil, :invitation_token.ne => nil) }
           scope :invitation_accepted, lambda { where(:invitation_accepted_at.ne => nil) }
         else
+          scope :created_by_invite, lambda { where(arel_table[:invitation_sent_at].not_eq(nil)) }
           scope :invitation_not_accepted, lambda { where(arel_table[:invitation_token].not_eq(nil)).where(:invitation_accepted_at => nil) }
           scope :invitation_accepted, lambda { where(arel_table[:invitation_accepted_at].not_eq(nil)) }
 
@@ -85,6 +87,11 @@ module Devise
         end
       end
 
+      # Verify wheather a user is created by invitation, irrespective to invitation status
+      def created_by_invite?
+        invitation_sent_at.present?
+      end
+
       # Verifies whether a user has been invited or not
       def invited_to_sign_up?
         persisted? && invitation_token.present?
@@ -102,23 +109,24 @@ module Devise
 
       # Reset invitation token and send invitation again
       def invite!(invited_by = nil)
+        # This is an order-dependant assignment, this can't be moved 
         was_invited = invited_to_sign_up?
 
         # Required to workaround confirmable model's confirmation_required? method
         # being implemented to check for non-nil value of confirmed_at
-        if self.new_record? && self.respond_to?(:confirmation_required?, true)
+        if new_record_and_responds_to?(:confirmation_required?)
           def self.confirmation_required?; false; end
         end
 
         yield self if block_given?
-        generate_invitation_token if self.invitation_token.nil? || (!skip_invitation || @raw_invitation_token.nil?)
+        generate_invitation_token if no_token_present_or_skip_invitation?
         self.invitation_created_at = Time.now.utc
         self.invitation_sent_at = self.invitation_created_at unless skip_invitation
         self.invited_by = invited_by if invited_by
 
         # Call these before_validate methods since we aren't validating on save
-        self.downcase_keys if self.new_record? && self.respond_to?(:downcase_keys, true)
-        self.strip_whitespace if self.new_record? && self.respond_to?(:strip_whitespace, true)
+        self.downcase_keys if new_record_and_responds_to?(:downcase_keys)
+        self.strip_whitespace if new_record_and_responds_to?(:strip_whitespace)
 
         if save(:validate => false)
           self.invited_by.decrement_invitation_limit! if !was_invited and self.invited_by.present?
@@ -134,15 +142,15 @@ module Devise
       end
 
       # Only verify password when is not invited
-      def active_for_authentication?
-        super unless invited_to_sign_up?
+      def valid_password?(password)
+        super unless block_from_invitation?
       end
 
-      def inactive_message
-        invited_to_sign_up? ? :invited : super
+      def unauthenticated_message
+        block_from_invitation? ? :invited : super
       end
 
-      def after_password_reset
+      def clear_reset_password_token
         super
         accept_invitation! if invited_to_sign_up?
       end
@@ -179,6 +187,10 @@ module Devise
           @skip_password ||= false
         end
 
+        def block_from_invitation?
+          invited_to_sign_up?
+        end
+
         # Checks if the invitation for the user is within the limit time.
         # We do this by calculating if the difference between today and the
         # invitation sent date does not exceed the invite for time configured.
@@ -215,6 +227,14 @@ module Devise
           generate_invitation_token && save(:validate => false)
         end
 
+        def new_record_and_responds_to?(method)
+          self.new_record? && self.respond_to?(method, true)
+        end
+
+        def no_token_present_or_skip_invitation?
+          self.invitation_token.nil? || (!skip_invitation || @raw_invitation_token.nil?)
+        end
+
       module ClassMethods
         # Return fields to invite
         def invite_key_fields
@@ -284,7 +304,6 @@ module Devise
 
           invitable = find_or_initialize_with_error_by(:invitation_token, invitation_token)
           invitable.errors.add(:invitation_token, :invalid) if invitable.invitation_token && invitable.persisted? && !invitable.valid_invitation?
-          invitable.invitation_token = original_token
           invitable unless only_valid && invitable.errors.present?
         end
 
@@ -303,6 +322,8 @@ module Devise
         Devise::Models.config(self, :invitation_limit)
         Devise::Models.config(self, :invite_key)
         Devise::Models.config(self, :resend_invitation)
+        Devise::Models.config(self, :allow_insecure_sign_in_after_accept)
+
       end
     end
   end

data/lib/devise_invitable/parameter_sanitizer.rb

@@ -20,7 +20,7 @@ module DeviseInvitable
     def attributes_for_with_invitable(kind)
       case kind
       when :invite
-        resource_class.invite_key_fields
+        resource_class.respond_to?(:invite_key_fields) ? resource_class.invite_key_fields : []
       when :accept_invitation
         [:password, :password_confirmation, :invitation_token]
       else attributes_for_without_invitable(kind)

data/lib/devise_invitable/version.rb

@@ -1,3 +1,3 @@
 module DeviseInvitable
-  VERSION = '1.4.1'
+  VERSION = '1.5.1'
 end

data/lib/devise_invitable.rb

@@ -66,6 +66,11 @@ module Devise
   # the #invited_by association is declared without counter_cache. (default: nil)
   mattr_accessor :invited_by_counter_cache
   @@invited_by_counter_cache = nil
+
+  # Public: Auto-login after the user accepts the invite. If this is false,
+  # the user will need to manually log in after accepting the invite (default: false).
+  mattr_accessor :allow_insecure_sign_in_after_accept
+  @@allow_insecure_sign_in_after_accept = true
 end
 
 Devise.add_module :invitable, :controller => :invitations, :model => 'devise_invitable/model', :route => {:invitation => [nil, :new, :accept]}

data/lib/generators/active_record/templates/migration.rb

@@ -6,10 +6,10 @@ class DeviseInvitableAddTo<%= table_name.camelize %> < ActiveRecord::Migration
       t.datetime   :invitation_sent_at
       t.datetime   :invitation_accepted_at
       t.integer    :invitation_limit
-      t.references :invited_by, :polymorphic => true
+      t.references :invited_by, polymorphic: true
       t.integer    :invitations_count, default: 0
       t.index      :invitations_count
-      t.index      :invitation_token, :unique => true # for invitable
+      t.index      :invitation_token, unique: true # for invitable
       t.index      :invited_by_id
     end
 
@@ -22,7 +22,7 @@ class DeviseInvitableAddTo<%= table_name.camelize %> < ActiveRecord::Migration
 
   def down
     change_table :<%= table_name %> do |t|
-      t.remove_references :invited_by, :polymorphic => true
+      t.remove_references :invited_by, polymorphic: true
       t.remove :invitations_count, :invitation_limit, :invitation_sent_at, :invitation_accepted_at, :invitation_token, :invitation_created_at
     end
     change_column_null    :<%= table_name %>, :encrypted_password, false

data/lib/generators/devise_invitable/install_generator.rb

@@ -57,6 +57,11 @@ module DeviseInvitable
   # Default: nil
   # config.invited_by_counter_cache = :invitations_count
 
+  # Auto-login after the user accepts the invite. If this is false,
+  # the user will need to manually log in after accepting the invite.
+  # Default: false
+  # config.allow_insecure_sign_in_after_accept = true
+
 CONTENT
             end
           end

data/lib/generators/devise_invitable/templates/simple_form_for/invitations/edit.html.erb

@@ -1,6 +1,6 @@
 <h2><%= t 'devise.invitations.edit.header' %></h2>
 
-<%= simple_form_for resource, :as => resource_name, :url => invitation_path(resource_name), :html => { :method => :put } do |f| %>
+<%= simple_form_for resource, as: resource_name, url: invitation_path(resource_name), html: { method: :put } do |f| %>
   <%= devise_error_messages! %>
   <%= f.hidden_field :invitation_token %>
 

data/lib/generators/devise_invitable/templates/simple_form_for/invitations/new.html.erb

@@ -1,6 +1,6 @@
 <h2><%= t "devise.invitations.new.header" %></h2>
 
-<%= simple_form_for resource, :as => resource_name, :url => invitation_path(resource_name), :html => {:method => :post} do |f| %>
+<%= simple_form_for resource, as: resource_name, url: invitation_path(resource_name), html: { method: :post} do |f| %>
   <%= devise_error_messages! %>
 
 <% resource.class.invite_key_fields.each do |field| -%>

data/test/functional/registrations_controller_test.rb

@@ -26,6 +26,9 @@ class DeviseInvitable::RegistrationsControllerTest < ActionController::TestCase
 
     @invitee = User.where(:email => invitee_email).first
     assert @invitee.encrypted_password.blank?, "the password should be unset"
+    assert_nil @invitee.invitation_accepted_at
+    assert_not_nil @invitee.invitation_token
+    assert !@invitee.confirmed?
 
     # sign_up the invitee
     assert_difference('ActionMailer::Base.deliveries.size') do
@@ -47,8 +50,8 @@ class DeviseInvitable::RegistrationsControllerTest < ActionController::TestCase
     assert_nil @invitee.invitation_token
     assert @invitee.invited_by_id.present?
     assert @invitee.invited_by_type.present?
-    assert !@invitee.confirmed?
     assert @invitee.confirmation_token.present?
+    assert !@invitee.confirmed?
   end
 
   test "not invitable resources can register" do

data/test/integration/invitation_test.rb

@@ -64,6 +64,25 @@ class InvitationTest < ActionDispatch::IntegrationTest
     assert_equal root_path, current_path
   end
 
+  test 'invited user without password should not be able to sign in' do
+    user = User.invite!(:email => "valid@email.com")
+    user.password = 'test'
+    sign_in_as_user user
+
+    assert_equal new_user_session_path, current_path
+    assert page.has_css?('p#alert', :text => 'You have a pending invitation, accept it to finish creating your account.')
+  end
+
+  test 'invited user with password should not be able to sign in' do
+    user = User.invite!(:email => "valid@email.com")
+    user.password = '987654321'
+    user.save
+    sign_in_as_user user
+
+    assert_equal new_user_session_path, current_path
+    assert page.has_css?('p#alert', :text => 'You have a pending invitation, accept it to finish creating your account.')
+  end
+
   test 'not authenticated user with invalid invitation token should not be able to set his password' do
     user = User.invite!(:email => "valid@email.com")
     user.accept_invitation!
@@ -106,10 +125,26 @@ class InvitationTest < ActionDispatch::IntegrationTest
     assert user.reload.valid_password?('987654321')
   end
 
-  test 'sign in user automatically after setting it\'s password' do
+  test 'sign in user automatically after setting it\'s password if config.allow_insecure_sign_in_after_accept is true' do
+    original_option_value = Devise.allow_insecure_sign_in_after_accept
+    Devise.allow_insecure_sign_in_after_accept = true
+
     User.invite!(:email => "valid@email.com")
     set_password :invitation_token => Thread.current[:token]
+
     assert_equal root_path, current_path
+    Devise.allow_insecure_sign_in_after_accept = original_option_value
+  end
+
+  test 'does not sign in user automatically after setting it\'s password if config.allow_insecure_sign_in_after_accept is false' do
+    original_option_value = Devise.allow_insecure_sign_in_after_accept
+    Devise.allow_insecure_sign_in_after_accept = false
+
+    User.invite!(:email => "valid@email.com")
+    set_password :invitation_token => Thread.current[:token]
+
+    assert_equal new_user_session_path, current_path
+    Devise.allow_insecure_sign_in_after_accept = original_option_value
   end
 
   test 'clear token and set invitation_accepted_at after recover password instead of accept_invitation' do

data/test/models/invitable_test.rb

@@ -431,6 +431,21 @@ class InvitableTest < ActiveSupport::TestCase
     user.reload
     assert !user.valid_password?('new_password')
   end
+  
+  test 'should check if created by invitation' do
+    user = User.invite!(:email => "valid@email.com")
+    assert user.created_by_invite?
+    
+    invited_user = User.accept_invitation!(
+      :invitation_token => Thread.current[:token],
+      :password => 'new_password',
+      :password_confirmation => 'new_password',
+      :username => 'a'
+    )
+    user.reload
+    assert user.created_by_invite?
+  end
+
 
   test 'should set other attributes on accepting invitation' do
     user = new_user(:password => nil, :password_confirmation => nil)
@@ -611,19 +626,23 @@ class InvitableTest < ActiveSupport::TestCase
     assert !user.errors.empty?
   end
 
-  test "should count accepted and not accepted invitations" do
+  test "should count invited, created_by_invite, accepted and not accepted invitations" do
     assert_equal 0, User.invitation_not_accepted.count
     assert_equal 0, User.invitation_accepted.count
+    assert_equal 0, User.created_by_invite.count
 
     User.invite!(:email => "invalid@email.com")
+    User.invite!(:email => "another_invalid@email.com")
     user = User.invite!(:email => "valid@email.com")
 
-    assert_equal 2, User.invitation_not_accepted.count
+    assert_equal 3, User.invitation_not_accepted.count
     assert_equal 0, User.invitation_accepted.count
+    assert_equal 3, User.created_by_invite.count
 
     user.accept_invitation!
-    assert_equal 1, User.invitation_not_accepted.count
+    assert_equal 2, User.invitation_not_accepted.count
     assert_equal 1, User.invitation_accepted.count
+    assert_equal 3, User.created_by_invite.count
   end
 
   test "should preserve return values of Devise::Recoverable#reset_password!" do

data/test/rails_app/config/initializers/devise.rb

@@ -129,6 +129,11 @@ Devise.setup do |config|
   # Default: nil
   config.invited_by_counter_cache = :invitations_count
 
+  # Auto-login after the user accepts the invite. If this is false,
+  # the user will need to manually log in after accepting the invite.
+  # Default: true
+  # config.allow_insecure_sign_in_after_accept = false
+
   # ==> Configuration for :confirmable
   # A period that the user is allowed to access the website even without
   # confirming his account. For instance, if set to 2.days, the user will be

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise_invitable
 version: !ruby/object:Gem::Version
-  version: 1.4.1
+  version: 1.5.1
 platform: ruby
 authors:
 - Sergio Cambra
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-02-17 00:00:00.000000000 Z
+date: 2015-06-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler