devise_invitable 1.5.3 → 1.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 34b7a909db3f99e89240bf2b81107b5981e656cb
-  data.tar.gz: 47f3c423acd3c430232c028e130174c23720081e
+  metadata.gz: 1c29d1de12fe88af51d1a7e23efd9829db040271
+  data.tar.gz: e4ea042b56eac21a082f284d66b2f0d129555a83
 SHA512:
-  metadata.gz: fb028f99d4fc760cdecc7f747b3070fa7c2373d3e5655cdb51c2526245a546f1c8b4b84175810b9b8c1df33f054a0b5b1c4190f2280eda5d31f6f7377e7cffbf
-  data.tar.gz: e04a795483022a82a601790ad24d682934322e45348026bd6a3b387b8284b41ca8403e55afddaf57b51d630961cb2650e8fbcea15d9144c07d3e1fde8f23976f
+  metadata.gz: d11eadb4b2f24ca4500a85fbb7c0636c7cca291f2b43dd9af7321bce5a88942e286fe2412ad4a51ae1556cf4441f7244e8910ccac189751a8b073a54510a1335
+  data.tar.gz: a1e51d0f15d30630bbf44f04d1ef7fcabc279ea405f931a0ef390939bfd5ce71d3dc117a178f927d081634344aba03eb96904f04199bbf53558b05d3f6d18351

data/CHANGELOG

@@ -1,3 +1,29 @@
+= 1.6.0
+
+- Support devise 4.0 and rails 5.0
+- Add before/after invitation_created callbacks
+- Fix invitation_due_at when invite_for is 0
+- Add plain text mailer template
+- Ruby 1.9 not supported anymore
+- Adds :require_password_on_accepting config option, and ensure invitation is not accepted if password is required and removed from form
+
+= 1.5.5
+
+- Add optional options hash to invite! methods, they will be used for send_devise_notification call
+
+= 1.5.4
+
+- Ensure that all invited user passwords conform to a format
+- Call set_minimum_password_length (if exists) on accept invitation as devise does
+- Controllers inheriting from Devise::InvitationsController will now use 'devise.invitations' translations
+  when using Devise >= 3.5. See https://github.com/plataformatec/devise/pull/3407 for more details.
+- Add invitation due date to mailer
+
+= 1.5.3
+
+- Fix #585, avoid generating new password if there already is a encrypted one
+- Give error if trying to register with a registered email
+
 = 1.5.2
 
 - Fix #571, accept invitation when password changes only if reset_password_token was present

data/README.rdoc

@@ -1,11 +1,13 @@
 = DeviseInvitable
-{<img src="https://travis-ci.org/scambra/devise_invitable.png"/>}[https://travis-ci.org/scambra/devise_invitable] {<img src="https://codeclimate.com/github/scambra/devise_invitable/badges/gpa.svg"/}[https://codeclimate.com/github/scambra/devise_invitable]
+{<img src="https://badge.fury.io/rb/devise_invitable.svg"/>}[http://badge.fury.io/rb/devise_invitable] {<img src="https://travis-ci.org/scambra/devise_invitable.png"/>}[https://travis-ci.org/scambra/devise_invitable] {<img src="https://codeclimate.com/github/scambra/devise_invitable/badges/gpa.svg"/}[https://codeclimate.com/github/scambra/devise_invitable]
 
 It adds support to devise[https://github.com/plataformatec/devise] for sending invitations by email (it requires to be authenticated) and accept the invitation setting the password.
 
 DeviseInvitable currently supports Rails 3 and 4, if you want to use it with Rails 2.3 you must install version {0.2.3}[https://rubygems.org/gems/devise_invitable/versions/0.2.3]
 
-If you want to use devise 3.0.x, you must use 1.2.1, newer versions require devise >= 3.1.0
+It works with Devise >= 3.2
+If you want to use devise 3.0.x, you must use 1.2.1 or lower
+If you want to use devise 3.1.x, you must use 1.3.2 or lower
 
 == Installation
 
@@ -130,12 +132,16 @@ or directly as parameters to the <tt>devise</tt> method:
 
 * resend_invitation: resend invitation if user with invited status is invited again. Enabled by default.
 
-* invited_by_class_name: The class name of the inviting model. If this is nil, polymorphic association is used.
+* invited_by_class_name: the class name of the inviting model. If this is nil, polymorphic association is used.
 
-* invited_by_foreign_key: The foreign key to the inviting model (only used if invited_by_class_name is set, otherwise :invited_by_id)
+* invited_by_foreign_key: the foreign key to the inviting model (only used if invited_by_class_name is set, otherwise :invited_by_id)
+
+* invited_by_counter_cache: the column name used for counter_cache column. If this is nil (default value), the invited_by association is declared without counter_cache.
 
 * allow_insecure_sign_in_after_accept: automatically sign in the user after they set a password. Enabled by default.
 
+* require_password_on_accepting: require password when user accepts the invitation. Enabled by default. Disable if you don't want to ask or enforce to set password while accepting, because is set when user is invited or it will be set later.
+
 For more details, see <tt>config/initializers/devise.rb</tt> (after you invoked the "devise_invitable:install" generator described above).
 
 == Configuring views
@@ -160,7 +166,7 @@ To change the controller's behavior, create a controller that inherits from <tt>
 
    class Users::InvitationsController < Devise::InvitationsController
      def update
-       if this
+       if some_condition
          redirect_to root_path
        else
          super
@@ -174,7 +180,7 @@ Now just tell Devise that you want to use your controller, the controller above
 
 be sure that you generate the views and put them into the controller that you generated, so for this example it would be:
 
-  rails generate devise_invitable:views users/invitations
+  rails generate devise_invitable:views users
 
 To change behaviour of inviting or accepting users, you can simply override two methods:
 
@@ -185,7 +191,7 @@ To change behaviour of inviting or accepting users, you can simply override two
     # should return an instance of resource class
     def invite_resource
       ## skip sending emails on invite
-      resource_class.invite!(invite_params, current_inviter) do |u|
+      super do |u|
         u.skip_invitation = true
       end
     end
@@ -247,25 +253,25 @@ the value is temporarily available when you invite a user and will be decrypted
 
   accept_user_invitation_url(:invitation_token => user.raw_invitation_token)
 
-When skip_invitation is used, you must also then set the invitation_sent_at field when the user is sent their
-token. Failure to do so will yield "Invalid invitation token" errors when the user attempts to accept the invite.
+When <tt>skip_invitation</tt> is used, you must also then set the <tt>invitation_sent_at</tt> field when the user is sent their
+token. Failure to do so will yield <tt>Invalid invitation token</tt> error when the user attempts to accept the invite.
 You can set it like so:
 
   user.deliver_invitation
 
-You can add :skip_invitation to attributes hash if skip_invitation is added to attr_accessible.
+You can add <tt>:skip_invitation</tt> to attributes hash if <tt>skip_invitation</tt> is added to <tt>attr_accessible</tt>.
 
   User.invite!(:email => "new_user@example.com", :name => "John Doe", :skip_invitation => true)
   # => the record will be created, but the invitation email will not be sent
 
-Skip_invitation skips sending the email, but sets invitation_token, so <tt>invited_to_sign_up?</tt> on the
+<tt>skip_invitation</tt> skips sending the email, but sets <tt>invitation_token</tt>, so <tt>invited_to_sign_up?</tt> on the
 resulting user returns true.
 
-To check if a perticular user is created by invitation, irrespective to state of invitation one can use <tt>created_by_invite?</tt>
+To check if a particular user is created by invitation, irrespective to state of invitation one can use <tt>created_by_invite?</tt>
 
 **Warning**
 
-When using skip_invitation you must send the email with the user object instance that generated the tokens, as 
+When using skip_invitation you must send the email with the user object instance that generated the tokens, as
 user.raw_invitation_token is available only to the instance and is not persisted in the database.
 
 You can send an invitation to an existing user if your workflow creates them separately:
@@ -287,12 +293,17 @@ To accept an invitation with a token use the <tt>accept_invitation!</tt> class m
 
 === Callbacks
 
-A callback event is fired before and after an invitation is accepted (User#accept_invitation!). For example, in your resource model you can add:
+A callback event is fired before and after an invitation is created (User#invite!) or accepted (User#accept_invitation!). For example, in your resource model you can add:
 
+  before_invitation_created :email_admins
   after_invitation_accepted :email_invited_by
 
+  def email_admins
+    # ...
+  end
+
   def email_invited_by
-     # ...
+    # ...
   end
 
 The callbacks support all options and arguments available to the standard callbacks provided by AR.
@@ -303,7 +314,7 @@ A pair of scopes to find those users that have accepted, and those that have not
 
   User.invitation_accepted     # => returns all Users for whom the invitation_accepted_at attribute is not nil
   User.invitation_not_accepted # => returns all Users for whom the invitation_accepted_at attribute is nil
-  User.created_by_invite       # => returns all Users who are created by invitations, irrespective to invitation status 
+  User.created_by_invite       # => returns all Users who are created by invitations, irrespective to invitation status
 
 == Integration in a Rails application
 
@@ -398,9 +409,9 @@ https://github.com/scambra/devise_invitable/wiki
 
 == Testing
 
-To test DeviseInvitable for the ActiveRecord ORM with RVM, Ruby 1.9.2, and Rubygems 1.8.17:
+To test DeviseInvitable for the ActiveRecord ORM with RVM, Ruby 2.0.0:
 
-  rvm use 1.9.2
+  rvm use 2.0.0
   rvm gemset create devise_invitable
   rvm gemset use devise_invitable
   gem install bundler

data/app/controllers/devise/invitations_controller.rb

@@ -1,10 +1,19 @@
 class Devise::InvitationsController < DeviseController
+  if Rails::VERSION::MAJOR >= 5
+    prepend_before_action :authenticate_inviter!, :only => [:new, :create]
+    prepend_before_action :has_invitations_left?, :only => [:create]
+    prepend_before_action :require_no_authentication, :only => [:edit, :update, :destroy]
+    prepend_before_action :resource_from_invitation_token, :only => [:edit, :destroy]
+  else
+    prepend_before_filter :authenticate_inviter!, :only => [:new, :create]
+    prepend_before_filter :has_invitations_left?, :only => [:create]
+    prepend_before_filter :require_no_authentication, :only => [:edit, :update, :destroy]
+    prepend_before_filter :resource_from_invitation_token, :only => [:edit, :destroy]
+  end
 
-  prepend_before_filter :authenticate_inviter!, :only => [:new, :create]
-  prepend_before_filter :has_invitations_left?, :only => [:create]
-  prepend_before_filter :require_no_authentication, :only => [:edit, :update, :destroy]
-  prepend_before_filter :resource_from_invitation_token, :only => [:edit, :destroy]
-  helper_method :after_sign_in_path_for
+  if respond_to? :helper_method
+    helper_method :after_sign_in_path_for
+  end
 
   # GET /resource/invitation/new
   def new
@@ -31,6 +40,7 @@ class Devise::InvitationsController < DeviseController
 
   # GET /resource/invitation/accept?invitation_token=abcdef
   def edit
+    set_minimum_password_length if respond_to? :set_minimum_password_length
     resource.invitation_token = params[:invitation_token]
     render :edit
   end
@@ -103,5 +113,8 @@ class Devise::InvitationsController < DeviseController
     devise_parameter_sanitizer.sanitize(:accept_invitation)
   end
 
+  def translation_scope
+    'devise.invitations'
+  end
 end
 

data/app/views/devise/invitations/edit.html.erb

@@ -4,11 +4,13 @@
   <%= devise_error_messages! %>
   <%= f.hidden_field :invitation_token %>
 
+  <% if f.object.class.require_password_on_accepting %>
   <p><%= f.label :password %><br />
   <%= f.password_field :password %></p>
 
   <p><%= f.label :password_confirmation %><br />
   <%= f.password_field :password_confirmation %></p>
+  <% end %>
 
   <p><%= f.submit t("devise.invitations.edit.submit_button") %></p>
 <% end %>

data/app/views/devise/mailer/invitation_instructions.html.erb

@@ -4,4 +4,8 @@
 
 <p><%= link_to t("devise.mailer.invitation_instructions.accept"), accept_invitation_url(@resource, :invitation_token => @token) %></p>
 
+<% if @resource.invitation_due_at %>
+  <p><%= t("devise.mailer.invitation_instructions.accept_until", due_date: l(@resource.invitation_due_at, format: :'devise.mailer.invitation_instructions.accept_until_format')) %></p>
+<% end %>
+
 <p><%= t("devise.mailer.invitation_instructions.ignore").html_safe %></p>

data/app/views/devise/mailer/invitation_instructions.text.erb

@@ -0,0 +1,11 @@
+<%= t("devise.mailer.invitation_instructions.hello", email: @resource.email) %>
+
+<%= t("devise.mailer.invitation_instructions.someone_invited_you", url: root_url) %>
+
+<%= accept_invitation_url(@resource, :invitation_token => @token) %>
+
+<% if @resource.invitation_due_at %>
+  <%= t("devise.mailer.invitation_instructions.accept_until", due_date: l(@resource.invitation_due_at, format: :'devise.mailer.invitation_instructions.accept_until_format')) %>
+<% end %>
+
+<%= strip_tags t("devise.mailer.invitation_instructions.ignore") %>

data/config/locales/en.yml

@@ -21,4 +21,11 @@ en:
         hello: "Hello %{email}"
         someone_invited_you: "Someone has invited you to %{url}, you can accept it through the link below."
         accept: "Accept invitation"
-        ignore: "If you don't want to accept the invitation, please ignore this email.<br />Your account won't be created until you access the link above and set your password."
+        accept_until: "This invitation will be due in %{due_date}."
+        ignore: "If you don't want to accept the invitation, please ignore this email.<br />\nYour account won't be created until you access the link above and set your password."
+  time:
+    formats:
+      devise:
+        mailer:
+          invitation_instructions:
+            accept_until_format: "%B %d, %Y %I:%M %p"

data/lib/devise_invitable/controllers/helpers.rb

@@ -2,7 +2,6 @@ module DeviseInvitable::Controllers::Helpers
   extend ActiveSupport::Concern
 
   included do
-    hide_action :after_invite_path_for, :after_accept_path_for
   end
   
   def after_invite_path_for(resource)

data/lib/devise_invitable/mapping.rb

@@ -1,14 +1,10 @@
 module DeviseInvitable
   module Mapping
-    def self.included(base)
-      base.alias_method_chain :default_controllers, :invitable
-    end
-    
     private
-    def default_controllers_with_invitable(options)
+    def default_controllers(options)
       options[:controllers] ||= {}
       options[:controllers][:registrations] ||= "devise_invitable/registrations"
-      default_controllers_without_invitable(options)
+      super
     end
   end
-end
+end

data/lib/devise_invitable/model.rb

@@ -34,16 +34,18 @@ module Devise
         else
           {:polymorphic => true}
         end
-	if fk = Devise.invited_by_foreign_key
-	  belongs_to_options[:foreign_key] = fk
-	end
+        if fk = Devise.invited_by_foreign_key
+          belongs_to_options[:foreign_key] = fk
+        end
         if defined?(ActiveRecord) && defined?(ActiveRecord::Base) && self < ActiveRecord::Base
           counter_cache = Devise.invited_by_counter_cache
           belongs_to_options.merge! :counter_cache => counter_cache if counter_cache
+          belongs_to_options.merge! :optional => true if ActiveRecord::VERSION::MAJOR >= 5
         end
         belongs_to :invited_by, belongs_to_options
 
         include ActiveSupport::Callbacks
+        define_callbacks :invitation_created
         define_callbacks :invitation_accepted
 
         scope :no_active_invitation, lambda { where(:invitation_token => nil) }
@@ -56,7 +58,14 @@ module Devise
           scope :invitation_not_accepted, lambda { where(arel_table[:invitation_token].not_eq(nil)).where(:invitation_accepted_at => nil) }
           scope :invitation_accepted, lambda { where(arel_table[:invitation_accepted_at].not_eq(nil)) }
 
-          [:before_invitation_accepted, :after_invitation_accepted].each do |callback_method|
+          callbacks = [
+            :before_invitation_created,
+            :after_invitation_created,
+            :before_invitation_accepted,
+            :after_invitation_accepted,
+          ]
+
+          callbacks.each do |callback_method|
             send callback_method
           end
         end
@@ -79,6 +88,7 @@ module Devise
       # Accept an invitation by clearing invitation token and and setting invitation_accepted_at
       # Saves the model and confirms it if model is confirmable, running invitation_accepted callbacks
       def accept_invitation!
+        @accepting_invitation = true
         if self.invited_to_sign_up? && self.valid?
           run_callbacks :invitation_accepted do
             self.accept_invitation
@@ -98,6 +108,11 @@ module Devise
         persisted? && invitation_token.present?
       end
 
+      # Returns true if accept_invitation! was called
+      def accepting_invitation?
+        @accepting_invitation
+      end
+
       # Verifies whether a user accepted an invitation (or is accepting it)
       def invitation_accepted?
         invitation_accepted_at.present?
@@ -109,8 +124,8 @@ module Devise
       end
 
       # Reset invitation token and send invitation again
-      def invite!(invited_by = nil)
-        # This is an order-dependant assignment, this can't be moved 
+      def invite!(invited_by = nil, options = {})
+        # This is an order-dependant assignment, this can't be moved
         was_invited = invited_to_sign_up?
 
         # Required to workaround confirmable model's confirmation_required? method
@@ -121,17 +136,20 @@ module Devise
 
         yield self if block_given?
         generate_invitation_token if no_token_present_or_skip_invitation?
-        self.invitation_created_at = Time.now.utc
-        self.invitation_sent_at = self.invitation_created_at unless skip_invitation
-        self.invited_by = invited_by if invited_by
 
-        # Call these before_validate methods since we aren't validating on save
-        self.downcase_keys if new_record_and_responds_to?(:downcase_keys)
-        self.strip_whitespace if new_record_and_responds_to?(:strip_whitespace)
+        run_callbacks :invitation_created do
+          self.invitation_created_at = Time.now.utc
+          self.invitation_sent_at = self.invitation_created_at unless skip_invitation
+          self.invited_by = invited_by if invited_by
+
+          # Call these before_validate methods since we aren't validating on save
+          self.downcase_keys if new_record_and_responds_to?(:downcase_keys)
+          self.strip_whitespace if new_record_and_responds_to?(:strip_whitespace)
 
-        if save(:validate => false)
-          self.invited_by.decrement_invitation_limit! if !was_invited and self.invited_by.present?
-          deliver_invitation unless skip_invitation
+          if save(:validate => false)
+            self.invited_by.decrement_invitation_limit! if !was_invited and self.invited_by.present?
+            deliver_invitation(options) unless skip_invitation
+          end
         end
       end
 
@@ -144,7 +162,12 @@ module Devise
 
       # Only verify password when is not invited
       def valid_password?(password)
-        super unless block_from_invitation?
+        super unless !accepting_invitation? && block_from_invitation?
+      end
+
+      # Enforce password when invitation is being accepted
+      def password_required?
+        (accepting_invitation? && self.class.require_password_on_accepting) || super
       end
 
       def unauthenticated_message
@@ -164,10 +187,10 @@ module Devise
       end
 
       # Deliver the invitation email
-      def deliver_invitation
+      def deliver_invitation(options = {})
         generate_invitation_token! unless @raw_invitation_token
         self.update_attribute :invitation_sent_at, Time.now.utc unless self.invitation_sent_at
-        send_devise_notification(:invitation_instructions, @raw_invitation_token)
+        send_devise_notification(:invitation_instructions, @raw_invitation_token, options)
       end
 
       # provide alias to the encrypted invitation_token stored by devise
@@ -179,6 +202,14 @@ module Devise
         respond_to?(:confirmation_required?, true) && confirmation_required?
       end
 
+      def invitation_due_at
+        return nil if (self.class.invite_for == 0 || self.class.invite_for.nil?)
+        #return nil unless self.class.invite_for
+
+        time = self.invitation_created_at || self.invitation_sent_at
+        time + self.class.invite_for
+      end
+
       protected
 
         def block_from_invitation?
@@ -242,7 +273,7 @@ module Devise
         # email is resent unless resend_invitation is set to false.
         # Attributes must contain the user's email, other attributes will be
         # set in the record
-        def _invite(attributes={}, invited_by=nil, &block)
+        def _invite(attributes={}, invited_by=nil, options = {}, &block)
           invite_key_array = invite_key_fields
           attributes_hash = {}
           invite_key_array.each do |k,v|
@@ -255,7 +286,7 @@ module Devise
           invitable.assign_attributes(attributes)
           invitable.invited_by = invited_by
           unless invitable.password || invitable.encrypted_password.present?
-            invitable.password = Devise.friendly_token[0, 20]
+            invitable.password = random_password
           end
 
           invitable.valid? if self.validate_on_invite
@@ -268,16 +299,16 @@ module Devise
           end
 
           yield invitable if block_given?
-          mail = invitable.invite! if invitable.errors.empty?
+          mail = invitable.invite!(nil, options) if invitable.errors.empty?
           [invitable, mail]
         end
 
-        def invite!(attributes={}, invited_by=nil, &block)
-          _invite(attributes.with_indifferent_access, invited_by, &block).first
+        def invite!(attributes={}, invited_by=nil, options = {}, &block)
+          _invite(attributes.with_indifferent_access, invited_by, options, &block).first
         end
 
-        def invite_mail!(attributes={}, invited_by=nil, &block)
-          _invite(attributes, invited_by, &block).last
+        def invite_mail!(attributes={}, invited_by=nil, options = {}, &block)
+          _invite(attributes, invited_by, options, &block).last
         end
 
         # Attempt to find a user by it's invitation_token to set it's password.
@@ -304,6 +335,14 @@ module Devise
         end
 
         # Callback convenience methods
+        def before_invitation_created(*args, &blk)
+          set_callback(:invitation_created, :before, *args, &blk)
+        end
+
+        def after_invitation_created(*args, &blk)
+          set_callback(:invitation_created, :after, *args, &blk)
+        end
+
         def before_invitation_accepted(*args, &blk)
           set_callback(:invitation_accepted, :before, *args, &blk)
         end
@@ -319,9 +358,20 @@ module Devise
         Devise::Models.config(self, :invite_key)
         Devise::Models.config(self, :resend_invitation)
         Devise::Models.config(self, :allow_insecure_sign_in_after_accept)
+        Devise::Models.config(self, :require_password_on_accepting)
+
+        private
+
+        # The random password, as set after an invitation, must conform
+        # to any password format validation rules of the application.
+        # This default fixes the most common scenarios: Passwords must contain
+        # lower + upper case, a digit and a symbol.
+        # For more unusual rules, this method can be overridden.
+        def random_password
+          "aA1!" + Devise.friendly_token[0, 20]
+        end
 
       end
     end
   end
 end
-

data/lib/devise_invitable/parameter_sanitizer.rb

@@ -1,29 +1,37 @@
 module DeviseInvitable
   module ParameterSanitizer
-    def invite
-      permit self.for(:invite)
-    end
-
-    def accept_invitation
-      permit self.for(:accept_invitation)
-    end
+    if defined?(Devise::BaseSanitizer)
+      def invite
+        permit self.for(:invite)
+      end
 
-    def self.included(base)
-      base.alias_method_chain :attributes_for, :invitable
+      def accept_invitation
+        permit self.for(:accept_invitation)
+      end
     end
 
     private
-    def permit(keys)
-      default_params.permit(*Array(keys))
-    end
 
-    def attributes_for_with_invitable(kind)
-      case kind
-      when :invite
-        resource_class.respond_to?(:invite_key_fields) ? resource_class.invite_key_fields : []
-      when :accept_invitation
-        [:password, :password_confirmation, :invitation_token]
-      else attributes_for_without_invitable(kind)
+    if defined?(Devise::BaseSanitizer)
+      def permit(keys)
+        default_params.permit(*Array(keys))
+      end
+
+      def attributes_for(kind)
+        case kind
+        when :invite
+          resource_class.respond_to?(:invite_key_fields) ? resource_class.invite_key_fields : []
+        when :accept_invitation
+          [:password, :password_confirmation, :invitation_token]
+        else
+          super
+        end
+      end
+    else
+      def initialize(resource_class, resource_name, params)
+        super
+        permit(:invite, keys: (resource_class.respond_to?(:invite_key_fields) ? resource_class.invite_key_fields : []) )
+        permit(:accept_invitation, keys: [:password, :password_confirmation, :invitation_token] )
       end
     end
   end

data/lib/devise_invitable/rails.rb

@@ -16,8 +16,8 @@ module DeviseInvitable
     end
     # extend mapping with after_initialize because it's not reloaded
     config.after_initialize do
-      Devise::Mapping.send :include, DeviseInvitable::Mapping
-      Devise::ParameterSanitizer.send :include, DeviseInvitable::ParameterSanitizer
+      Devise::Mapping.send :prepend, DeviseInvitable::Mapping
+      Devise::ParameterSanitizer.send :prepend, DeviseInvitable::ParameterSanitizer
     end
   end
 end

data/lib/devise_invitable/version.rb

@@ -1,3 +1,3 @@
 module DeviseInvitable
-  VERSION = '1.5.3'
+  VERSION = '1.6.0'
 end

data/lib/devise_invitable.rb

@@ -72,10 +72,16 @@ module Devise
   mattr_accessor :invited_by_counter_cache
   @@invited_by_counter_cache = nil
 
-  # Public: Auto-login after the user accepts the invite. If this is false,
+  # Public: Auto-login after the user accepts the invitation. If this is false,
   # the user will need to manually log in after accepting the invite (default: true).
   mattr_accessor :allow_insecure_sign_in_after_accept
   @@allow_insecure_sign_in_after_accept = true
+
+  # Public: Require password when user accepts the invitation. Set to false if
+  # you don't want to ask or enforce to set password while accepting, because is
+  # set when user is invited or it will be set later (default: true).
+  mattr_accessor :require_password_on_accepting
+  @@require_password_on_accepting = true
 end
 
 Devise.add_module :invitable, :controller => :invitations, :model => 'devise_invitable/model', :route => {:invitation => [nil, :new, :accept]}

data/lib/generators/devise_invitable/install_generator.rb

@@ -63,8 +63,8 @@ module DeviseInvitable
 
   # Auto-login after the user accepts the invite. If this is false,
   # the user will need to manually log in after accepting the invite.
-  # Default: false
-  # config.allow_insecure_sign_in_after_accept = true
+  # Default: true
+  # config.allow_insecure_sign_in_after_accept = false
 
 CONTENT
             end