devise_invitable 1.5.1 → 1.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 09f7285fbf0dcc7da0b16e9a26bbc9c385e19720
-  data.tar.gz: 0b862b791cd58df3fc8ad6eba813c76534e89cba
+  metadata.gz: 21840c71f560017345f75d9152e44b295ccb8043
+  data.tar.gz: 8470539a88ef73abb3ef396a4c043e9405eecd57
 SHA512:
-  metadata.gz: 8bf23dd018217299609a033f0ea3666a4f0358580a6b2a14bff4405666ae82217de809b1fdac77a12269349337d8756a601c635e427962fa343c81d4bdf0c765
-  data.tar.gz: 560b395e0616d53b6b2d3164cd9ccd34a017517256f627a098c4971b4b85a55f41f61810f735dc2c51d9afcfb1acf848574bf1b32e2185b8ec47b9afe47d946c
+  metadata.gz: 451e491d4a3a8135bc4d1447d1b9035624f2be5757f03544fe1bf8925e0b08df1317a57ec93cb20f293e5dc77397e3c1ba6a6e854f1b8a7646804ce6b43258fc
+  data.tar.gz: ee5f07eb0c08aca5310d36b42eb7fa20fee2bbc657a101a79981c5072e6da3593a813ca79bb08ef05d3494db65e228017f692dc96645c1e62b9ff3c4f189e4f8

data/CHANGELOG

@@ -1,11 +1,69 @@
+= 1.5.2
+
+- Fix #571, accept invitation when password changes only if reset_password_token was present
+- Add support for setting invited_by foreign key
+- Set random initial password for invited users
+- Don't override password while User.invite!
+
+= 1.5.1
+
+- Fix #562 Avoid using after_password_reset
+- Fix #564
+
+Compare: https://github.com/scambra/devise_invitable/compare/v1.5.0...v1.5.1
+
+= 1.5.0
+
 Override valid_password? and unauthenticated_message instead of active_for_authentication? and inactive_message, active_for_authentication? doesn't work for default behavior of invited users without password
 
+- Get list & check for user(s) created by invite irrespective of status
+- Update simple_form template's hash syntax
+- Update migration template's hash syntax
+- Check if after_password_reset is defined
+
+Compare: https://github.com/scambra/devise_invitable/compare/v1.4.2...v1.5.0
+
+= 1.4.2
+
+- Add option to allow controlling of auto sign in functionality for security
+- Add intermediate method in active_for_authentication? for more flexibility
+- Add intermediate block_from_invitation? method for more flexibility
+- Fix undefined method `invite_key_fields'
+- Fix override valid_password? instead of active_for_authentication? (fixes #541)
+
+Compare: https://github.com/scambra/devise_invitable/compare/v1.4.1...v1.4.2
+
+= 1.4.1
+
+- Begin testing against devise 3.4
+- Use current_inviter to get redirect path after invite
+  (https://github.com/scambra/devise_invitable/pull/523)
+
+Compare: https://github.com/scambra/devise_invitable/compare/v1.4.0...v1.4.1
+
 = 1.4.0
+
 Override active_for_authentication? and inactive_message instead of valid_password?
 To use counter_cache, invited_by_counter_cache must be set, no more checking of invitations_count to enable counter cache
 
+Compare: https://github.com/scambra/devise_invitable/compare/v1.3.6...v1.4.0
+
+= 1.3.6
+
+- Regenerate invitation token each time even if "skip_invitation" was true
+- Add passing a block to instance #invite! method
+- Improvements to tests
+
+Compare: https://github.com/scambra/devise_invitable/compare/v1.3.5...v1.3.6
+
+= 1.3.5
+
+No notes yet, contributions welcome.
+
 = 1.3.0
+
 Now devise 3.1 compatible, @token must be used instead of @resource.invitation_token in mail views
 
 = 1.2.0
+
 Add invitation_created_at column which is set when invitation is created even when sending is skipped. This new field is used to check invitation period valid

data/README.rdoc

@@ -1,9 +1,9 @@
 = DeviseInvitable
-{<img src="https://travis-ci.org/scambra/devise_invitable.png"/>}[http://travis-ci.org/scambra/devise_invitable] {<img src="https://codeclimate.com/github/scambra/devise_invitable/badges/gpa.svg"/}[https://codeclimate.com/github/scambra/devise_invitable]
+{<img src="https://travis-ci.org/scambra/devise_invitable.png"/>}[https://travis-ci.org/scambra/devise_invitable] {<img src="https://codeclimate.com/github/scambra/devise_invitable/badges/gpa.svg"/}[https://codeclimate.com/github/scambra/devise_invitable]
 
-It adds support to devise[http://github.com/plataformatec/devise] for sending invitations by email (it requires to be authenticated) and accept the invitation setting the password.
+It adds support to devise[https://github.com/plataformatec/devise] for sending invitations by email (it requires to be authenticated) and accept the invitation setting the password.
 
-DeviseInvitable currently supports Rails 3 and 4, if you want to use it with Rails 2.3 you must install version {0.2.3}[http://rubygems.org/gems/devise_invitable/versions/0.2.3]
+DeviseInvitable currently supports Rails 3 and 4, if you want to use it with Rails 2.3 you must install version {0.2.3}[https://rubygems.org/gems/devise_invitable/versions/0.2.3]
 
 If you want to use devise 3.0.x, you must use 1.2.1, newer versions require devise >= 3.1.0
 
@@ -132,6 +132,8 @@ or directly as parameters to the <tt>devise</tt> method:
 
 * invited_by_class_name: The class name of the inviting model. If this is nil, polymorphic association is used.
 
+* invited_by_foreign_key: The foreign key to the inviting model (only used if invited_by_class_name is set, otherwise :invited_by_id)
+
 * allow_insecure_sign_in_after_accept: automatically sign in the user after they set a password. Enabled by default.
 
 For more details, see <tt>config/initializers/devise.rb</tt> (after you invoked the "devise_invitable:install" generator described above).
@@ -150,11 +152,11 @@ Then turn scoped views on in config/initializers/devise.rb:
 
   config.scoped_views = true
 
-Please refer to {Devise's README}[http://github.com/plataformatec/devise] for more information about views.
+Please refer to {Devise's README}[https://github.com/plataformatec/devise] for more information about views.
 
 == Configuring controllers
 
-To change the controller's behavior, create a controller that inherits from <tt>Devise::InvitationsController</tt>. The available methods are: new, create, edit, and update. You should read the {original controllers source}[https://raw.github.com/scambra/devise_invitable/master/app/controllers/devise/invitations_controller.rb] before editing any of these actions. Your controller might now look something like this:
+To change the controller's behavior, create a controller that inherits from <tt>Devise::InvitationsController</tt>. The available methods are: new, create, edit, and update. You should read the {original controllers source}[https://github.com/scambra/devise_invitable/blob/master/app/controllers/devise/invitations_controller.rb] before editing any of these actions. Your controller might now look something like this:
 
    class Users::InvitationsController < Devise::InvitationsController
      def update
@@ -200,7 +202,7 @@ To change behaviour of inviting or accepting users, you can simply override two
 
 == Strong Parameters
 
-When you customize your own views, you may end up adding new attributes to forms. Rails 4 moved the parameter sanitization from the model to the controller, causing DeviseInvitable to handle this concern at the controller as well. Read about it in {devise README}[http://github.com/plataformatec/devise#strong-parameters]
+When you customize your own views, you may end up adding new attributes to forms. Rails 4 moved the parameter sanitization from the model to the controller, causing DeviseInvitable to handle this concern at the controller as well. Read about it in {devise README}[https://github.com/plataformatec/devise#strong-parameters]
 
 There are just two actions in DeviseInvitable that allows any set of parameters to be passed down to the model, therefore requiring sanitization. Their names and the permited parameters by default are:
 
@@ -310,7 +312,7 @@ Instead, in your views, put a link to <tt>new_user_invitation_path</tt> or <tt>n
 
 After an invitation is created and sent, the inviter will be redirected to after_invite_path_for(resource_name), which is stored path or the same path as after_sign_in_path_for by default.
 
-After an invitation is accepted, the invitee will be redirected to after_accept_path_for(resource), which is the same path as after_sign_in_path_for by default. If you want to override the path, override invitations controller and define after_accept_path_for method. This is useful in the common case that a user is invited to a specific location in your application. More on {Devise's README}[http://github.com/plataformatec/devise], "Controller filters and helpers" section.
+After an invitation is accepted, the invitee will be redirected to after_accept_path_for(resource), which is the same path as after_sign_in_path_for by default. If you want to override the path, override invitations controller and define after_accept_path_for method. This is useful in the common case that a user is invited to a specific location in your application. More on {Devise's README}[https://github.com/plataformatec/devise], "Controller filters and helpers" section.
 
 The invitation email includes a link to accept the invitation that looks like this:  <tt>/users/invitation/accept?invitation_token=abcd123</tt>. When clicked, the invited must set a password in order to accept its invitation. Note that if the invitation_token is not present or not valid, the invited is redirected to after_sign_out_path_for(resource_name).
 
@@ -409,9 +411,9 @@ To test DeviseInvitable for the ActiveRecord ORM with RVM, Ruby 1.9.2, and Rubyg
 
 Check them all at:
 
-http://github.com/scambra/devise_invitable/contributors
+https://github.com/scambra/devise_invitable/contributors
 
-Special thanks to rymai[http://github.com/rymai] for the Rails 3 support, his fork was a great help.
+Special thanks to rymai[https://github.com/rymai] for the Rails 3 support, his fork was a great help.
 
 == Note on Patches/Pull Requests
 

data/app/controllers/devise_invitable/registrations_controller.rb

@@ -4,8 +4,8 @@ class DeviseInvitable::RegistrationsController < Devise::RegistrationsController
   def build_resource(hash = nil)
     hash ||= resource_params || {}
     if hash[:email]
-      self.resource = resource_class.where(:email => hash[:email], :encrypted_password => '').first
-      if self.resource
+      self.resource = resource_class.where(:email => hash[:email]).first
+      if self.resource and self.resource.invited_to_sign_up?
         self.resource.attributes = hash
         self.resource.send_confirmation_instructions if self.resource.confirmation_required_for_invited?
         self.resource.accept_invitation

data/lib/devise_invitable.rb

@@ -62,6 +62,11 @@ module Devise
   mattr_accessor :invited_by_class_name
   @@invited_by_class_name = nil
 
+  # Public: The foreign key to the inviting model (if invited_by_class_name is set)
+  # (default: :invited_by_id)
+  mattr_accessor :invited_by_foreign_key
+  @@invited_by_foreign_key = nil
+
   # Public: The column name used for counter_cache column. If this is nil,
   # the #invited_by association is declared without counter_cache. (default: nil)
   mattr_accessor :invited_by_counter_cache

data/lib/devise_invitable/model.rb

@@ -34,6 +34,9 @@ module Devise
         else
           {:polymorphic => true}
         end
+	if fk = Devise.invited_by_foreign_key
+	  belongs_to_options[:foreign_key] = fk
+	end
         if defined?(ActiveRecord) && defined?(ActiveRecord::Base) && self < ActiveRecord::Base
           counter_cache = Devise.invited_by_counter_cache
           belongs_to_options.merge! :counter_cache => counter_cache if counter_cache
@@ -43,8 +46,6 @@ module Devise
         include ActiveSupport::Callbacks
         define_callbacks :invitation_accepted
 
-        attr_writer :skip_password
-
         scope :no_active_invitation, lambda { where(:invitation_token => nil) }
         if defined?(Mongoid) && defined?(Mongoid::Document) && self < Mongoid::Document
           scope :created_by_invite, lambda { where(:invitation_sent_at.ne => nil) }
@@ -63,7 +64,7 @@ module Devise
 
       def self.required_fields(klass)
         fields = [:invitation_token, :invitation_created_at, :invitation_sent_at, :invitation_accepted_at,
-         :invitation_limit, :invited_by_id, :invited_by_type]
+         :invitation_limit, Devise.invited_by_foreign_key || :invited_by_id, :invited_by_type]
         fields << :invitations_count if defined?(ActiveRecord) && self < ActiveRecord::Base
         fields -= [:invited_by_type] if Devise.invited_by_class_name
         fields
@@ -151,8 +152,9 @@ module Devise
       end
 
       def clear_reset_password_token
+        reset_password_token_present = reset_password_token.present?
         super
-        accept_invitation! if invited_to_sign_up?
+        accept_invitation! if reset_password_token_present && invited_to_sign_up?
       end
 
       def clear_errors_on_valid_keys
@@ -178,14 +180,6 @@ module Devise
       end
 
       protected
-        # Overriding the method in Devise's :validatable module so password is not required on inviting
-        def password_required?
-          !skip_password && super
-        end
-
-        def skip_password
-          @skip_password ||= false
-        end
 
         def block_from_invitation?
           invited_to_sign_up?
@@ -260,8 +254,10 @@ module Devise
           invitable = find_or_initialize_with_errors(invite_key_array, attributes_hash)
           invitable.assign_attributes(attributes)
           invitable.invited_by = invited_by
+          unless invitable.password
+            invitable.password = Devise.friendly_token[0, 20]
+          end
 
-          invitable.skip_password = true
           invitable.valid? if self.validate_on_invite
           if invitable.new_record?
             invitable.clear_errors_on_valid_keys if !self.validate_on_invite

data/lib/devise_invitable/version.rb

@@ -1,3 +1,3 @@
 module DeviseInvitable
-  VERSION = '1.5.1'
+  VERSION = '1.5.2'
 end

data/lib/generators/active_record/templates/migration.rb

@@ -12,12 +12,6 @@ class DeviseInvitableAddTo<%= table_name.camelize %> < ActiveRecord::Migration
       t.index      :invitation_token, unique: true # for invitable
       t.index      :invited_by_id
     end
-
-    # And allow null encrypted_password and password_salt:
-    change_column_null :<%= table_name %>, :encrypted_password, true
-<% if class_name.constantize.columns_hash['password_salt'] -%>
-    change_column_null :<%= table_name %>, :password_salt,      true
-<% end -%>
   end
 
   def down
@@ -25,9 +19,5 @@ class DeviseInvitableAddTo<%= table_name.camelize %> < ActiveRecord::Migration
       t.remove_references :invited_by, polymorphic: true
       t.remove :invitations_count, :invitation_limit, :invitation_sent_at, :invitation_accepted_at, :invitation_token, :invitation_created_at
     end
-    change_column_null    :<%= table_name %>, :encrypted_password, false
-<% if class_name.constantize.columns_hash['password_salt'] -%>
-    change_column_null :<%= table_name %>, :password_salt,false
-<% end -%>
   end
 end

data/lib/generators/devise_invitable/install_generator.rb

@@ -52,6 +52,10 @@ module DeviseInvitable
   # Default: nil
   # config.invited_by_class_name = 'User'
 
+  # The foreign key to the inviting model (if invited_by_class_name is set)
+  # Default: :invited_by_id
+  # config.invited_by_foreign_key = :invited_by_id
+
   # The column name used for counter_cache column. If this is nil,
   # the #invited_by association is declared without counter_cache.
   # Default: nil

data/test/functional/registrations_controller_test.rb

@@ -25,7 +25,6 @@ class DeviseInvitable::RegistrationsControllerTest < ActionController::TestCase
     sign_out @issuer
 
     @invitee = User.where(:email => invitee_email).first
-    assert @invitee.encrypted_password.blank?, "the password should be unset"
     assert_nil @invitee.invitation_accepted_at
     assert_not_nil @invitee.invitation_token
     assert !@invitee.confirmed?

data/test/integration/invitation_test.rb

@@ -99,7 +99,7 @@ class InvitationTest < ActionDispatch::IntegrationTest
     end
     assert_equal user_invitation_path, current_path
     assert page.has_css?('#error_explanation li', :text => /Password .*doesn\'t match/)
-    assert user.encrypted_password.blank?
+    assert !user.confirmed?
   end
 
   test 'not authenticated user with valid data should be able to change his password' do
@@ -109,6 +109,7 @@ class InvitationTest < ActionDispatch::IntegrationTest
     assert_equal root_path, current_path
     assert page.has_css?('p#notice', :text => 'Your password was set successfully. You are now signed in.')
     assert user.reload.valid_password?('987654321')
+    assert user.confirmed?
   end
 
   test 'after entering invalid data user should still be able to set his password' do
@@ -118,7 +119,6 @@ class InvitationTest < ActionDispatch::IntegrationTest
     end
     assert_equal user_invitation_path, current_path
     assert page.has_css?('#error_explanation')
-    assert user.encrypted_password.blank?
 
     set_password :visit => false
     assert page.has_css?('p#notice', :text => 'Your password was set successfully. You are now signed in.')

data/test/models/invitable_test.rb

@@ -181,6 +181,11 @@ class InvitableTest < ActiveSupport::TestCase
     assert_not_equal old_encrypted_password, user.encrypted_password
   end
 
+  test 'should not override password on invite!' do
+    user = User.invite!(:email => "valid@email.com", :password => 'password', :password_confirmation => 'password', :skip_invitation => true)
+    assert user.valid?
+  end
+
   test 'should clear invitation token and set invitation_accepted_at while accepting the password' do
     user = User.invite!(:email => "valid@email.com")
     assert user.invitation_token.present?

data/test/rails_app/config/initializers/devise.rb

@@ -124,6 +124,10 @@ Devise.setup do |config|
   # Default: nil
   # config.invited_by_class_name = 'User'
 
+  # The foreign key to the inviting model (if invited_by_class_name is set)
+  # Default: :invited_by_id
+  # config.invited_by_foreign_key = :invited_by_id
+
   # The column name used for counter_cache column. If this is nil,
   # the #invited_by association is declared without counter_cache.
   # Default: nil

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise_invitable
 version: !ruby/object:Gem::Version
-  version: 1.5.1
+  version: 1.5.2
 platform: ruby
 authors:
 - Sergio Cambra
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-06-16 00:00:00.000000000 Z
+date: 2015-07-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler