devise_invitable 1.4.1 → 1.5.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 3baf83979bda300001727d86af188f93a91bf95c
-  data.tar.gz: 74d6ac1f55c041e7075e4c1e8ec026e470fdfe12
+  metadata.gz: 34b7a909db3f99e89240bf2b81107b5981e656cb
+  data.tar.gz: 47f3c423acd3c430232c028e130174c23720081e
 SHA512:
-  metadata.gz: 0b08b0b990d88fd99aed53e4d3082db8354bda2e5046fad13901debde5ecb614ba5cdcea7e11709798ea16d4dc99dac27dbd622534179cf1d9a3cbaaaba38bda
-  data.tar.gz: 3ca119718132addd0b7b331ac4fe81c4e21852b6480ef10c3ed742492b82e86e6fbd01f84957e5a7b6426aba2bbd5eaeb8f65460730399f3e286e125355ca77f
+  metadata.gz: fb028f99d4fc760cdecc7f747b3070fa7c2373d3e5655cdb51c2526245a546f1c8b4b84175810b9b8c1df33f054a0b5b1c4190f2280eda5d31f6f7377e7cffbf
+  data.tar.gz: e04a795483022a82a601790ad24d682934322e45348026bd6a3b387b8284b41ca8403e55afddaf57b51d630961cb2650e8fbcea15d9144c07d3e1fde8f23976f

data/CHANGELOG

@@ -1,9 +1,69 @@
+= 1.5.2
+
+- Fix #571, accept invitation when password changes only if reset_password_token was present
+- Add support for setting invited_by foreign key
+- Set random initial password for invited users
+- Don't override password while User.invite!
+
+= 1.5.1
+
+- Fix #562 Avoid using after_password_reset
+- Fix #564
+
+Compare: https://github.com/scambra/devise_invitable/compare/v1.5.0...v1.5.1
+
+= 1.5.0
+
+Override valid_password? and unauthenticated_message instead of active_for_authentication? and inactive_message, active_for_authentication? doesn't work for default behavior of invited users without password
+
+- Get list & check for user(s) created by invite irrespective of status
+- Update simple_form template's hash syntax
+- Update migration template's hash syntax
+- Check if after_password_reset is defined
+
+Compare: https://github.com/scambra/devise_invitable/compare/v1.4.2...v1.5.0
+
+= 1.4.2
+
+- Add option to allow controlling of auto sign in functionality for security
+- Add intermediate method in active_for_authentication? for more flexibility
+- Add intermediate block_from_invitation? method for more flexibility
+- Fix undefined method `invite_key_fields'
+- Fix override valid_password? instead of active_for_authentication? (fixes #541)
+
+Compare: https://github.com/scambra/devise_invitable/compare/v1.4.1...v1.4.2
+
+= 1.4.1
+
+- Begin testing against devise 3.4
+- Use current_inviter to get redirect path after invite
+  (https://github.com/scambra/devise_invitable/pull/523)
+
+Compare: https://github.com/scambra/devise_invitable/compare/v1.4.0...v1.4.1
+
 = 1.4.0
+
 Override active_for_authentication? and inactive_message instead of valid_password?
 To use counter_cache, invited_by_counter_cache must be set, no more checking of invitations_count to enable counter cache
 
+Compare: https://github.com/scambra/devise_invitable/compare/v1.3.6...v1.4.0
+
+= 1.3.6
+
+- Regenerate invitation token each time even if "skip_invitation" was true
+- Add passing a block to instance #invite! method
+- Improvements to tests
+
+Compare: https://github.com/scambra/devise_invitable/compare/v1.3.5...v1.3.6
+
+= 1.3.5
+
+No notes yet, contributions welcome.
+
 = 1.3.0
+
 Now devise 3.1 compatible, @token must be used instead of @resource.invitation_token in mail views
 
 = 1.2.0
+
 Add invitation_created_at column which is set when invitation is created even when sending is skipped. This new field is used to check invitation period valid

data/README.rdoc

@@ -1,9 +1,9 @@
 = DeviseInvitable
-{<img src="https://travis-ci.org/scambra/devise_invitable.png"/>}[http://travis-ci.org/scambra/devise_invitable]
+{<img src="https://travis-ci.org/scambra/devise_invitable.png"/>}[https://travis-ci.org/scambra/devise_invitable] {<img src="https://codeclimate.com/github/scambra/devise_invitable/badges/gpa.svg"/}[https://codeclimate.com/github/scambra/devise_invitable]
 
-It adds support to devise[http://github.com/plataformatec/devise] for sending invitations by email (it requires to be authenticated) and accept the invitation setting the password.
+It adds support to devise[https://github.com/plataformatec/devise] for sending invitations by email (it requires to be authenticated) and accept the invitation setting the password.
 
-DeviseInvitable currently supports Rails 3 and 4, if you want to use it with Rails 2.3 you must install version {0.2.3}[http://rubygems.org/gems/devise_invitable/versions/0.2.3]
+DeviseInvitable currently supports Rails 3 and 4, if you want to use it with Rails 2.3 you must install version {0.2.3}[https://rubygems.org/gems/devise_invitable/versions/0.2.3]
 
 If you want to use devise 3.0.x, you must use 1.2.1, newer versions require devise >= 3.1.0
 
@@ -15,8 +15,8 @@ Install DeviseInvitable gem, it will also install dependencies (such as devise a
 
 Add DeviseInvitable to your Gemfile (and Devise if you weren't using them):
 
-  gem 'devise',           '>= 2.0.0'
-  gem 'devise_invitable', '~> 1.3.4'
+  gem 'devise',           '~> 3.5.2'
+  gem 'devise_invitable', '~> 1.5.2'
 
 === Automatic installation
 
@@ -28,7 +28,7 @@ When you are done, you are ready to add DeviseInvitable to any of your Devise mo
 
   rails generate devise_invitable MODEL
 
-Replace MODEL by the class name you want to add DeviseInvitable, like User, Admin, etc. This will add the :invitable flag to your model's Devise modules. The generator will also create a migration file (if your ORM support them). Continue reading this file to understand exactly what the generator produces and how to use it.
+Replace MODEL by the class name you want to add DeviseInvitable, like User, Admin, etc. This will add the :invitable flag to your model's Devise modules. The generator will also create a migration file (if your ORM supports them). Continue reading this file to understand exactly what the generator produces and how to use it.
 
 === Manual installation
 
@@ -132,6 +132,10 @@ or directly as parameters to the <tt>devise</tt> method:
 
 * invited_by_class_name: The class name of the inviting model. If this is nil, polymorphic association is used.
 
+* invited_by_foreign_key: The foreign key to the inviting model (only used if invited_by_class_name is set, otherwise :invited_by_id)
+
+* allow_insecure_sign_in_after_accept: automatically sign in the user after they set a password. Enabled by default.
+
 For more details, see <tt>config/initializers/devise.rb</tt> (after you invoked the "devise_invitable:install" generator described above).
 
 == Configuring views
@@ -148,11 +152,11 @@ Then turn scoped views on in config/initializers/devise.rb:
 
   config.scoped_views = true
 
-Please refer to {Devise's README}[http://github.com/plataformatec/devise] for more information about views.
+Please refer to {Devise's README}[https://github.com/plataformatec/devise] for more information about views.
 
 == Configuring controllers
 
-To change the controller's behavior, create a controller that inherits from <tt>Devise::InvitationsController</tt>. The available methods are: new, create, edit, and update. You should read the {original controllers source}[https://raw.github.com/scambra/devise_invitable/master/app/controllers/devise/invitations_controller.rb] before editing any of these actions. Your controller might now look something like this:
+To change the controller's behavior, create a controller that inherits from <tt>Devise::InvitationsController</tt>. The available methods are: new, create, edit, and update. You should read the {original controllers source}[https://github.com/scambra/devise_invitable/blob/master/app/controllers/devise/invitations_controller.rb] before editing any of these actions. Your controller might now look something like this:
 
    class Users::InvitationsController < Devise::InvitationsController
      def update
@@ -198,7 +202,7 @@ To change behaviour of inviting or accepting users, you can simply override two
 
 == Strong Parameters
 
-When you customize your own views, you may end up adding new attributes to forms. Rails 4 moved the parameter sanitization from the model to the controller, causing DeviseInvitable to handle this concern at the controller as well. Read about it in {devise README}[http://github.com/plataformatec/devise#strong-parameters]
+When you customize your own views, you may end up adding new attributes to forms. Rails 4 moved the parameter sanitization from the model to the controller, causing DeviseInvitable to handle this concern at the controller as well. Read about it in {devise README}[https://github.com/plataformatec/devise#strong-parameters]
 
 There are just two actions in DeviseInvitable that allows any set of parameters to be passed down to the model, therefore requiring sanitization. Their names and the permited parameters by default are:
 
@@ -254,9 +258,11 @@ You can add :skip_invitation to attributes hash if skip_invitation is added to a
   User.invite!(:email => "new_user@example.com", :name => "John Doe", :skip_invitation => true)
   # => the record will be created, but the invitation email will not be sent
 
-Skip_invitation skips sending the email, but sets invitation_token, so invited_to_sign_up? on the
+Skip_invitation skips sending the email, but sets invitation_token, so <tt>invited_to_sign_up?</tt> on the
 resulting user returns true.
 
+To check if a perticular user is created by invitation, irrespective to state of invitation one can use <tt>created_by_invite?</tt>
+
 **Warning**
 
 When using skip_invitation you must send the email with the user object instance that generated the tokens, as 
@@ -295,8 +301,9 @@ The callbacks support all options and arguments available to the standard callba
 
 A pair of scopes to find those users that have accepted, and those that have not accepted, invitations are defined:
 
-  User.invitation_accepted # => returns all Users for whom the invitation_accepted_at attribute is not nil
+  User.invitation_accepted     # => returns all Users for whom the invitation_accepted_at attribute is not nil
   User.invitation_not_accepted # => returns all Users for whom the invitation_accepted_at attribute is nil
+  User.created_by_invite       # => returns all Users who are created by invitations, irrespective to invitation status 
 
 == Integration in a Rails application
 
@@ -305,7 +312,7 @@ Instead, in your views, put a link to <tt>new_user_invitation_path</tt> or <tt>n
 
 After an invitation is created and sent, the inviter will be redirected to after_invite_path_for(resource_name), which is stored path or the same path as after_sign_in_path_for by default.
 
-After an invitation is accepted, the invitee will be redirected to after_accept_path_for(resource), which is the same path as after_sign_in_path_for by default. If you want to override the path, override invitations controller and define after_accept_path_for method. This is useful in the common case that a user is invited to a specific location in your application. More on {Devise's README}[http://github.com/plataformatec/devise], "Controller filters and helpers" section.
+After an invitation is accepted, the invitee will be redirected to after_accept_path_for(resource), which is the same path as after_sign_in_path_for by default. If you want to override the path, override invitations controller and define after_accept_path_for method. This is useful in the common case that a user is invited to a specific location in your application. More on {Devise's README}[https://github.com/plataformatec/devise], "Controller filters and helpers" section.
 
 The invitation email includes a link to accept the invitation that looks like this:  <tt>/users/invitation/accept?invitation_token=abcd123</tt>. When clicked, the invited must set a password in order to accept its invitation. Note that if the invitation_token is not present or not valid, the invited is redirected to after_sign_out_path_for(resource_name).
 
@@ -355,6 +362,7 @@ DeviseInvitable uses flash messages with I18n with the flash keys <tt>:send_inst
         send_instructions: 'An invitation email has been sent to %{email}.'
         invitation_token_invalid: 'The invitation token provided is not valid!'
         updated: 'Your password was set successfully. You are now signed in.'
+        updated_not_active: 'Your password was set successfully.'
 
 You can also create distinct messages based on the resource you've configured using the singular name given in routes:
 
@@ -365,6 +373,7 @@ You can also create distinct messages based on the resource you've configured us
           send_instructions: 'A new user invitation has been sent to %{email}.'
           invitation_token_invalid: 'Your invitation token is not valid!'
           updated: 'Welcome on board! You are now signed in.'
+          updated_not_active: 'Welcome on board! Sign in to continue.'
 
 The DeviseInvitable mailer uses the same pattern as Devise to create mail subject messages:
 
@@ -402,9 +411,9 @@ To test DeviseInvitable for the ActiveRecord ORM with RVM, Ruby 1.9.2, and Rubyg
 
 Check them all at:
 
-http://github.com/scambra/devise_invitable/contributors
+https://github.com/scambra/devise_invitable/contributors
 
-Special thanks to rymai[http://github.com/rymai] for the Rails 3 support, his fork was a great help.
+Special thanks to rymai[https://github.com/rymai] for the Rails 3 support, his fork was a great help.
 
 == Note on Patches/Pull Requests
 

data/app/controllers/devise/invitations_controller.rb

@@ -37,17 +37,24 @@ class Devise::InvitationsController < DeviseController
 
   # PUT /resource/invitation
   def update
+    raw_invitation_token = update_resource_params[:invitation_token]
     self.resource = accept_resource
     invitation_accepted = resource.errors.empty?
 
     yield resource if block_given?
 
     if invitation_accepted
-      flash_message = resource.active_for_authentication? ? :updated : :updated_not_active
-      set_flash_message :notice, flash_message if is_flashing_format?
-      sign_in(resource_name, resource)
-      respond_with resource, :location => after_accept_path_for(resource)
+      if Devise.allow_insecure_sign_in_after_accept
+        flash_message = resource.active_for_authentication? ? :updated : :updated_not_active
+        set_flash_message :notice, flash_message if is_flashing_format?
+        sign_in(resource_name, resource)
+        respond_with resource, :location => after_accept_path_for(resource)
+      else
+        set_flash_message :notice, :updated_not_active if is_flashing_format?
+        respond_with resource, :location => new_session_path(resource_name)
+      end
     else
+      resource.invitation_token = raw_invitation_token
       respond_with_navigational(resource){ render :edit }
     end
   end

data/app/controllers/devise_invitable/registrations_controller.rb

@@ -4,11 +4,13 @@ class DeviseInvitable::RegistrationsController < Devise::RegistrationsController
   def build_resource(hash = nil)
     hash ||= resource_params || {}
     if hash[:email]
-      self.resource = resource_class.where(:email => hash[:email], :encrypted_password => '').first
-      if self.resource
+      self.resource = resource_class.where(:email => hash[:email]).first
+      if self.resource && self.resource.respond_to?(:invited_to_sign_up?) && self.resource.invited_to_sign_up?
         self.resource.attributes = hash
         self.resource.send_confirmation_instructions if self.resource.confirmation_required_for_invited?
         self.resource.accept_invitation
+      else
+        self.resource = nil
       end
     end
     self.resource ||= super

data/config/locales/en.yml

@@ -6,6 +6,7 @@ en:
       send_instructions: "An invitation email has been sent to %{email}."
       invitation_token_invalid: "The invitation token provided is not valid!"
       updated: "Your password was set successfully. You are now signed in."
+      updated_not_active: "Your password was set successfully."
       no_invitations_remaining: "No invitations remaining"
       invitation_removed: "Your invitation was removed."
       new:

data/lib/devise_invitable/model.rb

@@ -34,6 +34,9 @@ module Devise
         else
           {:polymorphic => true}
         end
+	if fk = Devise.invited_by_foreign_key
+	  belongs_to_options[:foreign_key] = fk
+	end
         if defined?(ActiveRecord) && defined?(ActiveRecord::Base) && self < ActiveRecord::Base
           counter_cache = Devise.invited_by_counter_cache
           belongs_to_options.merge! :counter_cache => counter_cache if counter_cache
@@ -43,13 +46,13 @@ module Devise
         include ActiveSupport::Callbacks
         define_callbacks :invitation_accepted
 
-        attr_writer :skip_password
-
         scope :no_active_invitation, lambda { where(:invitation_token => nil) }
         if defined?(Mongoid) && defined?(Mongoid::Document) && self < Mongoid::Document
+          scope :created_by_invite, lambda { where(:invitation_sent_at.ne => nil) }
           scope :invitation_not_accepted, lambda { where(:invitation_accepted_at => nil, :invitation_token.ne => nil) }
           scope :invitation_accepted, lambda { where(:invitation_accepted_at.ne => nil) }
         else
+          scope :created_by_invite, lambda { where(arel_table[:invitation_sent_at].not_eq(nil)) }
           scope :invitation_not_accepted, lambda { where(arel_table[:invitation_token].not_eq(nil)).where(:invitation_accepted_at => nil) }
           scope :invitation_accepted, lambda { where(arel_table[:invitation_accepted_at].not_eq(nil)) }
 
@@ -61,7 +64,7 @@ module Devise
 
       def self.required_fields(klass)
         fields = [:invitation_token, :invitation_created_at, :invitation_sent_at, :invitation_accepted_at,
-         :invitation_limit, :invited_by_id, :invited_by_type]
+         :invitation_limit, Devise.invited_by_foreign_key || :invited_by_id, :invited_by_type]
         fields << :invitations_count if defined?(ActiveRecord) && self < ActiveRecord::Base
         fields -= [:invited_by_type] if Devise.invited_by_class_name
         fields
@@ -85,6 +88,11 @@ module Devise
         end
       end
 
+      # Verify wheather a user is created by invitation, irrespective to invitation status
+      def created_by_invite?
+        invitation_sent_at.present?
+      end
+
       # Verifies whether a user has been invited or not
       def invited_to_sign_up?
         persisted? && invitation_token.present?
@@ -102,23 +110,24 @@ module Devise
 
       # Reset invitation token and send invitation again
       def invite!(invited_by = nil)
+        # This is an order-dependant assignment, this can't be moved 
         was_invited = invited_to_sign_up?
 
         # Required to workaround confirmable model's confirmation_required? method
         # being implemented to check for non-nil value of confirmed_at
-        if self.new_record? && self.respond_to?(:confirmation_required?, true)
+        if new_record_and_responds_to?(:confirmation_required?)
           def self.confirmation_required?; false; end
         end
 
         yield self if block_given?
-        generate_invitation_token if self.invitation_token.nil? || (!skip_invitation || @raw_invitation_token.nil?)
+        generate_invitation_token if no_token_present_or_skip_invitation?
         self.invitation_created_at = Time.now.utc
         self.invitation_sent_at = self.invitation_created_at unless skip_invitation
         self.invited_by = invited_by if invited_by
 
         # Call these before_validate methods since we aren't validating on save
-        self.downcase_keys if self.new_record? && self.respond_to?(:downcase_keys, true)
-        self.strip_whitespace if self.new_record? && self.respond_to?(:strip_whitespace, true)
+        self.downcase_keys if new_record_and_responds_to?(:downcase_keys)
+        self.strip_whitespace if new_record_and_responds_to?(:strip_whitespace)
 
         if save(:validate => false)
           self.invited_by.decrement_invitation_limit! if !was_invited and self.invited_by.present?
@@ -134,17 +143,18 @@ module Devise
       end
 
       # Only verify password when is not invited
-      def active_for_authentication?
-        super unless invited_to_sign_up?
+      def valid_password?(password)
+        super unless block_from_invitation?
       end
 
-      def inactive_message
-        invited_to_sign_up? ? :invited : super
+      def unauthenticated_message
+        block_from_invitation? ? :invited : super
       end
 
-      def after_password_reset
+      def clear_reset_password_token
+        reset_password_token_present = reset_password_token.present?
         super
-        accept_invitation! if invited_to_sign_up?
+        accept_invitation! if reset_password_token_present && invited_to_sign_up?
       end
 
       def clear_errors_on_valid_keys
@@ -170,13 +180,9 @@ module Devise
       end
 
       protected
-        # Overriding the method in Devise's :validatable module so password is not required on inviting
-        def password_required?
-          !skip_password && super
-        end
 
-        def skip_password
-          @skip_password ||= false
+        def block_from_invitation?
+          invited_to_sign_up?
         end
 
         # Checks if the invitation for the user is within the limit time.
@@ -215,6 +221,14 @@ module Devise
           generate_invitation_token && save(:validate => false)
         end
 
+        def new_record_and_responds_to?(method)
+          self.new_record? && self.respond_to?(method, true)
+        end
+
+        def no_token_present_or_skip_invitation?
+          self.invitation_token.nil? || (!skip_invitation || @raw_invitation_token.nil?)
+        end
+
       module ClassMethods
         # Return fields to invite
         def invite_key_fields
@@ -240,8 +254,10 @@ module Devise
           invitable = find_or_initialize_with_errors(invite_key_array, attributes_hash)
           invitable.assign_attributes(attributes)
           invitable.invited_by = invited_by
+          unless invitable.password || invitable.encrypted_password.present?
+            invitable.password = Devise.friendly_token[0, 20]
+          end
 
-          invitable.skip_password = true
           invitable.valid? if self.validate_on_invite
           if invitable.new_record?
             invitable.clear_errors_on_valid_keys if !self.validate_on_invite
@@ -284,7 +300,6 @@ module Devise
 
           invitable = find_or_initialize_with_error_by(:invitation_token, invitation_token)
           invitable.errors.add(:invitation_token, :invalid) if invitable.invitation_token && invitable.persisted? && !invitable.valid_invitation?
-          invitable.invitation_token = original_token
           invitable unless only_valid && invitable.errors.present?
         end
 
@@ -303,6 +318,8 @@ module Devise
         Devise::Models.config(self, :invitation_limit)
         Devise::Models.config(self, :invite_key)
         Devise::Models.config(self, :resend_invitation)
+        Devise::Models.config(self, :allow_insecure_sign_in_after_accept)
+
       end
     end
   end

data/lib/devise_invitable/parameter_sanitizer.rb

@@ -20,7 +20,7 @@ module DeviseInvitable
     def attributes_for_with_invitable(kind)
       case kind
       when :invite
-        resource_class.invite_key_fields
+        resource_class.respond_to?(:invite_key_fields) ? resource_class.invite_key_fields : []
       when :accept_invitation
         [:password, :password_confirmation, :invitation_token]
       else attributes_for_without_invitable(kind)

data/lib/devise_invitable/version.rb

@@ -1,3 +1,3 @@
 module DeviseInvitable
-  VERSION = '1.4.1'
+  VERSION = '1.5.3'
 end

data/lib/devise_invitable.rb

@@ -62,10 +62,20 @@ module Devise
   mattr_accessor :invited_by_class_name
   @@invited_by_class_name = nil
 
+  # Public: The foreign key to the inviting model (if invited_by_class_name is set)
+  # (default: :invited_by_id)
+  mattr_accessor :invited_by_foreign_key
+  @@invited_by_foreign_key = nil
+
   # Public: The column name used for counter_cache column. If this is nil,
   # the #invited_by association is declared without counter_cache. (default: nil)
   mattr_accessor :invited_by_counter_cache
   @@invited_by_counter_cache = nil
+
+  # Public: Auto-login after the user accepts the invite. If this is false,
+  # the user will need to manually log in after accepting the invite (default: true).
+  mattr_accessor :allow_insecure_sign_in_after_accept
+  @@allow_insecure_sign_in_after_accept = true
 end
 
 Devise.add_module :invitable, :controller => :invitations, :model => 'devise_invitable/model', :route => {:invitation => [nil, :new, :accept]}

data/lib/generators/active_record/templates/migration.rb

@@ -6,28 +6,18 @@ class DeviseInvitableAddTo<%= table_name.camelize %> < ActiveRecord::Migration
       t.datetime   :invitation_sent_at
       t.datetime   :invitation_accepted_at
       t.integer    :invitation_limit
-      t.references :invited_by, :polymorphic => true
+      t.references :invited_by, polymorphic: true
       t.integer    :invitations_count, default: 0
       t.index      :invitations_count
-      t.index      :invitation_token, :unique => true # for invitable
+      t.index      :invitation_token, unique: true # for invitable
       t.index      :invited_by_id
     end
-
-    # And allow null encrypted_password and password_salt:
-    change_column_null :<%= table_name %>, :encrypted_password, true
-<% if class_name.constantize.columns_hash['password_salt'] -%>
-    change_column_null :<%= table_name %>, :password_salt,      true
-<% end -%>
   end
 
   def down
     change_table :<%= table_name %> do |t|
-      t.remove_references :invited_by, :polymorphic => true
+      t.remove_references :invited_by, polymorphic: true
       t.remove :invitations_count, :invitation_limit, :invitation_sent_at, :invitation_accepted_at, :invitation_token, :invitation_created_at
     end
-    change_column_null    :<%= table_name %>, :encrypted_password, false
-<% if class_name.constantize.columns_hash['password_salt'] -%>
-    change_column_null :<%= table_name %>, :password_salt,false
-<% end -%>
   end
 end

data/lib/generators/devise_invitable/install_generator.rb

@@ -52,11 +52,20 @@ module DeviseInvitable
   # Default: nil
   # config.invited_by_class_name = 'User'
 
+  # The foreign key to the inviting model (if invited_by_class_name is set)
+  # Default: :invited_by_id
+  # config.invited_by_foreign_key = :invited_by_id
+
   # The column name used for counter_cache column. If this is nil,
   # the #invited_by association is declared without counter_cache.
   # Default: nil
   # config.invited_by_counter_cache = :invitations_count
 
+  # Auto-login after the user accepts the invite. If this is false,
+  # the user will need to manually log in after accepting the invite.
+  # Default: false
+  # config.allow_insecure_sign_in_after_accept = true
+
 CONTENT
             end
           end

data/lib/generators/devise_invitable/templates/simple_form_for/invitations/edit.html.erb

@@ -1,6 +1,6 @@
 <h2><%= t 'devise.invitations.edit.header' %></h2>
 
-<%= simple_form_for resource, :as => resource_name, :url => invitation_path(resource_name), :html => { :method => :put } do |f| %>
+<%= simple_form_for resource, as: resource_name, url: invitation_path(resource_name), html: { method: :put } do |f| %>
   <%= devise_error_messages! %>
   <%= f.hidden_field :invitation_token %>
 

data/lib/generators/devise_invitable/templates/simple_form_for/invitations/new.html.erb

@@ -1,6 +1,6 @@
 <h2><%= t "devise.invitations.new.header" %></h2>
 
-<%= simple_form_for resource, :as => resource_name, :url => invitation_path(resource_name), :html => {:method => :post} do |f| %>
+<%= simple_form_for resource, as: resource_name, url: invitation_path(resource_name), html: { method: :post} do |f| %>
   <%= devise_error_messages! %>
 
 <% resource.class.invite_key_fields.each do |field| -%>

data/test/functional/registrations_controller_test.rb

@@ -25,7 +25,9 @@ class DeviseInvitable::RegistrationsControllerTest < ActionController::TestCase
     sign_out @issuer
 
     @invitee = User.where(:email => invitee_email).first
-    assert @invitee.encrypted_password.blank?, "the password should be unset"
+    assert_nil @invitee.invitation_accepted_at
+    assert_not_nil @invitee.invitation_token
+    assert !@invitee.confirmed?
 
     # sign_up the invitee
     assert_difference('ActionMailer::Base.deliveries.size') do
@@ -47,18 +49,63 @@ class DeviseInvitable::RegistrationsControllerTest < ActionController::TestCase
     assert_nil @invitee.invitation_token
     assert @invitee.invited_by_id.present?
     assert @invitee.invited_by_type.present?
-    assert !@invitee.confirmed?
     assert @invitee.confirmation_token.present?
+    assert !@invitee.confirmed?
+  end
+
+  test "non-invited users may still sign up directly by themselves" do
+    register_email = "invitee@example.org"
+    # sign_up the invitee
+    assert_difference('ActionMailer::Base.deliveries.size') do
+      post :create, :user => {:email => register_email, :password => "1password", :bio => '.'}
+    end
+    assert_nil @controller.current_user
+
+    @user = User.where(:email => register_email).first
+
+    # do not send emails on model changes
+    assert_no_difference('ActionMailer::Base.deliveries.size') do
+      @user.bio = "I am a robot"
+      @user.save!
+      @user.bio = "I am a human"
+      @user.save!
+    end
+
+    assert @user.encrypted_password.present?
+    assert_nil @user.invitation_accepted_at
+    assert_nil @user.invitation_token
+    assert_nil @user.invited_by
+    assert @user.confirmation_token.present?
+    assert !@user.confirmed?
   end
 
   test "not invitable resources can register" do
     @request.env["devise.mapping"] = Devise.mappings[:admin]
     invitee_email = "invitee@example.org"
 
+    assert_nil Admin.where(:email => invitee_email).first
+
+    post :create, :admin => {:email => invitee_email, :password => "1password"}
+
+    @invitee = Admin.where(:email => invitee_email).first
+    assert @invitee.encrypted_password.present?
+  end
+
+  test "not invitable resources are not logged in after sign up again" do
+    @request.env["devise.mapping"] = Devise.mappings[:admin]
+    invitee_email = "invitee@example.org"
+
     post :create, :admin => {:email => invitee_email, :password => "1password"}
+    assert_response 302
 
     @invitee = Admin.where(:email => invitee_email).first
     assert @invitee.encrypted_password.present?
+
+    sign_out @invitee
+    post :create, :admin => {:email => invitee_email, :password => "2password"}
+    assert_response 200
+    assert_equal @invitee.encrypted_password, Admin.where(:email => invitee_email).first.encrypted_password
+    assert @controller.send(:resource).errors.present?
   end
 
   test "missing params on a create should not cause an error" do

data/test/integration/invitation_test.rb

@@ -64,6 +64,25 @@ class InvitationTest < ActionDispatch::IntegrationTest
     assert_equal root_path, current_path
   end
 
+  test 'invited user without password should not be able to sign in' do
+    user = User.invite!(:email => "valid@email.com")
+    user.password = 'test'
+    sign_in_as_user user
+
+    assert_equal new_user_session_path, current_path
+    assert page.has_css?('p#alert', :text => 'You have a pending invitation, accept it to finish creating your account.')
+  end
+
+  test 'invited user with password should not be able to sign in' do
+    user = User.invite!(:email => "valid@email.com")
+    user.password = '987654321'
+    user.save
+    sign_in_as_user user
+
+    assert_equal new_user_session_path, current_path
+    assert page.has_css?('p#alert', :text => 'You have a pending invitation, accept it to finish creating your account.')
+  end
+
   test 'not authenticated user with invalid invitation token should not be able to set his password' do
     user = User.invite!(:email => "valid@email.com")
     user.accept_invitation!
@@ -80,7 +99,7 @@ class InvitationTest < ActionDispatch::IntegrationTest
     end
     assert_equal user_invitation_path, current_path
     assert page.has_css?('#error_explanation li', :text => /Password .*doesn\'t match/)
-    assert user.encrypted_password.blank?
+    assert !user.confirmed?
   end
 
   test 'not authenticated user with valid data should be able to change his password' do
@@ -90,6 +109,7 @@ class InvitationTest < ActionDispatch::IntegrationTest
     assert_equal root_path, current_path
     assert page.has_css?('p#notice', :text => 'Your password was set successfully. You are now signed in.')
     assert user.reload.valid_password?('987654321')
+    assert user.confirmed?
   end
 
   test 'after entering invalid data user should still be able to set his password' do
@@ -99,17 +119,32 @@ class InvitationTest < ActionDispatch::IntegrationTest
     end
     assert_equal user_invitation_path, current_path
     assert page.has_css?('#error_explanation')
-    assert user.encrypted_password.blank?
 
     set_password :visit => false
     assert page.has_css?('p#notice', :text => 'Your password was set successfully. You are now signed in.')
     assert user.reload.valid_password?('987654321')
   end
 
-  test 'sign in user automatically after setting it\'s password' do
+  test 'sign in user automatically after setting it\'s password if config.allow_insecure_sign_in_after_accept is true' do
+    original_option_value = Devise.allow_insecure_sign_in_after_accept
+    Devise.allow_insecure_sign_in_after_accept = true
+
     User.invite!(:email => "valid@email.com")
     set_password :invitation_token => Thread.current[:token]
+
     assert_equal root_path, current_path
+    Devise.allow_insecure_sign_in_after_accept = original_option_value
+  end
+
+  test 'does not sign in user automatically after setting it\'s password if config.allow_insecure_sign_in_after_accept is false' do
+    original_option_value = Devise.allow_insecure_sign_in_after_accept
+    Devise.allow_insecure_sign_in_after_accept = false
+
+    User.invite!(:email => "valid@email.com")
+    set_password :invitation_token => Thread.current[:token]
+
+    assert_equal new_user_session_path, current_path
+    Devise.allow_insecure_sign_in_after_accept = original_option_value
   end
 
   test 'clear token and set invitation_accepted_at after recover password instead of accept_invitation' do

data/test/models/invitable_test.rb

@@ -181,6 +181,11 @@ class InvitableTest < ActiveSupport::TestCase
     assert_not_equal old_encrypted_password, user.encrypted_password
   end
 
+  test 'should not override password on invite!' do
+    user = User.invite!(:email => "valid@email.com", :password => 'password', :password_confirmation => 'password', :skip_invitation => true)
+    assert user.valid?
+  end
+
   test 'should clear invitation token and set invitation_accepted_at while accepting the password' do
     user = User.invite!(:email => "valid@email.com")
     assert user.invitation_token.present?
@@ -195,8 +200,10 @@ class InvitableTest < ActiveSupport::TestCase
     user = User.invite!(:email => "valid@email.com")
     assert user.invitation_token.present?
     assert_nil user.invitation_accepted_at
+    old_encrypted_password = user.encrypted_password
     User.accept_invitation!(:invitation_token => user.invitation_token, :password => '123456789', :password_confirmation => '987654321')
     user.reload
+    assert_equal old_encrypted_password, user.encrypted_password
     assert user.invitation_token.present?
     assert_nil user.invitation_accepted_at
   end
@@ -432,6 +439,21 @@ class InvitableTest < ActiveSupport::TestCase
     assert !user.valid_password?('new_password')
   end
 
+  test 'should check if created by invitation' do
+    user = User.invite!(:email => "valid@email.com")
+    assert user.created_by_invite?
+
+    invited_user = User.accept_invitation!(
+      :invitation_token => Thread.current[:token],
+      :password => 'new_password',
+      :password_confirmation => 'new_password',
+      :username => 'a'
+    )
+    user.reload
+    assert user.created_by_invite?
+  end
+
+
   test 'should set other attributes on accepting invitation' do
     user = new_user(:password => nil, :password_confirmation => nil)
     user.invite!
@@ -611,19 +633,23 @@ class InvitableTest < ActiveSupport::TestCase
     assert !user.errors.empty?
   end
 
-  test "should count accepted and not accepted invitations" do
+  test "should count invited, created_by_invite, accepted and not accepted invitations" do
     assert_equal 0, User.invitation_not_accepted.count
     assert_equal 0, User.invitation_accepted.count
+    assert_equal 0, User.created_by_invite.count
 
     User.invite!(:email => "invalid@email.com")
+    User.invite!(:email => "another_invalid@email.com")
     user = User.invite!(:email => "valid@email.com")
 
-    assert_equal 2, User.invitation_not_accepted.count
+    assert_equal 3, User.invitation_not_accepted.count
     assert_equal 0, User.invitation_accepted.count
+    assert_equal 3, User.created_by_invite.count
 
     user.accept_invitation!
-    assert_equal 1, User.invitation_not_accepted.count
+    assert_equal 2, User.invitation_not_accepted.count
     assert_equal 1, User.invitation_accepted.count
+    assert_equal 3, User.created_by_invite.count
   end
 
   test "should preserve return values of Devise::Recoverable#reset_password!" do

data/test/rails_app/config/initializers/devise.rb

@@ -124,11 +124,20 @@ Devise.setup do |config|
   # Default: nil
   # config.invited_by_class_name = 'User'
 
+  # The foreign key to the inviting model (if invited_by_class_name is set)
+  # Default: :invited_by_id
+  # config.invited_by_foreign_key = :invited_by_id
+
   # The column name used for counter_cache column. If this is nil,
   # the #invited_by association is declared without counter_cache.
   # Default: nil
   config.invited_by_counter_cache = :invitations_count
 
+  # Auto-login after the user accepts the invite. If this is false,
+  # the user will need to manually log in after accepting the invite.
+  # Default: true
+  # config.allow_insecure_sign_in_after_accept = false
+
   # ==> Configuration for :confirmable
   # A period that the user is allowed to access the website even without
   # confirming his account. For instance, if set to 2.days, the user will be

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise_invitable
 version: !ruby/object:Gem::Version
-  version: 1.4.1
+  version: 1.5.3
 platform: ruby
 authors:
 - Sergio Cambra
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-02-17 00:00:00.000000000 Z
+date: 2015-09-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler