devise_invitable 2.0.13 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c5d960efc9d5ef35fa1fdfefbde6fa6ab687d0c3d0de519a1112d1dec57224bd
-  data.tar.gz: 9e6e81c91625d7bce472c5055d0f9f16bfc349d462eb90bbfa57bc33c766cded
+  metadata.gz: 52005f95e25dca6edd01fb9193500a319035974cdf3cd643133ae7c2f42e7825
+  data.tar.gz: 25b2fa545162bb87340c1133811bacf61861fc2eb914b002618531815f576fe7
 SHA512:
-  metadata.gz: 9745971bbb21f82d7f3659f594ef9ad4621844df9af9a8c0f58dd6df6f436bcf256b100712233db860a124b104185478c9efcce46d37df639ccbc57d9bc1fd06
-  data.tar.gz: 373944acfbdb815a64aa86832be27ca6c02c0e9a70b0b6a82ec738a5bb807b27f4f9908aa4bf6f9cfdd01194d8bfa84ac287454c01d390237e54bf26d66a46f9
+  metadata.gz: 6f512c5c9be3eb3a5b80abc6adec76b5dd5432f4ed02e3596f9ab9c9bc297589b452556c0a828f0a64db91bd7152ad8b31f43b91a82b013e7bce32e1fd76bf13
+  data.tar.gz: 10d177422be705e605c9287785cc0d6ec42d5b42ae40ee646d7bb8f6c08521612217fb3735ae790975bfc7da7b7f6b459eb0beeb2d3c06e9648d340f9538526a

data/CHANGELOG.md

@@ -1,3 +1,44 @@
+## 3.0.0
+
+- Drop support for Ruby < 2.7, Rails < 7.0, and Devise < 5.0
+- Store invitations in a shared `devise_invitations` table/collection with
+  polymorphic `invitable` and `invited_by` associations, allowing multiple
+  invitations and inviters for the same resource ([#228](https://github.com/scambra/devise_invitable/issues/228),
+  [#388](https://github.com/scambra/devise_invitable/issues/388))
+- Defer resource creation until invitation acceptance by default. Add
+  `create_resource_on_invitation` to optionally create placeholder resources
+  immediately; additional resource attributes require this option
+- Add `invitation_pending?` and prevent pending placeholders from
+  authenticating through both password validation and
+  `active_for_authentication?`
+- Accept only the invitation whose token was used and supersede other pending
+  invitations. Direct registration supersedes matching invitations without
+  marking them accepted
+- Make the install generator create the shared invitations store through ORM
+  hooks. The model generator now only adds `:invitable` and no longer creates
+  per-model invitation-column migrations
+- Add `devise_invitable:upgrade MODEL` to generate an Active Record data
+  migration from the legacy per-model columns, with `--invite-keys` support
+- Add `devise_invitable:migrate_invitations[MODEL]` for Mongoid legacy-data
+  upgrades; Mongoid indexes continue to be created with
+  `db:mongoid:create_indexes`
+
+## 2.0.14
+- Fix `NameError` when `Devise.parent_mailer` is an application mailer ([#930](https://github.com/scambra/devise_invitable/pull/930))
+
+## 2.0.13
+- Avoid loading Action Mailer and Active Job before application initialization ([#926](https://github.com/scambra/devise_invitable/pull/926))
+- Test against Devise 5 while retaining support for Devise 4.6 and newer
+- Fix email interpolation in the Hong Kong and Taiwanese Chinese translations ([#927](https://github.com/scambra/devise_invitable/pull/927))
+
+## 2.0.12
+- Add Ruby 3.4 and Rails 8.0 compatibility coverage ([#920](https://github.com/scambra/devise_invitable/pull/920))
+- Fix the Italian invitation instructions ([#923](https://github.com/scambra/devise_invitable/issues/923))
+- Correct the Brazilian Portuguese locale identifier ([#924](https://github.com/scambra/devise_invitable/pull/924))
+
+## 2.0.11
+- Make `invitation_due_at` return `nil` for users who were not invited ([#919](https://github.com/scambra/devise_invitable/pull/919))
+
 ## 2.0.10
 - Use invited_by_class_name and invited_by_foreign_key settings from the model
 

data/README.md

@@ -12,10 +12,11 @@ invitation setting the password.
 
 ## Requirements
 
-The latest version of DeviseInvitable works with Devise >= 4.6.
+The latest version of DeviseInvitable requires Ruby >= 2.7, Rails >= 7.0,
+and Devise >= 5.0.
 
-If you want to use devise_invitable with earlier Devise releases (4.0 <= x <
-4.6), use version 1.7.5.
+Use DeviseInvitable 2.x with Devise 4.6 through 4.9. For earlier Devise 4
+releases, use DeviseInvitable 1.7.5.
 
 ## Installation
 
@@ -28,7 +29,7 @@ gem install devise_invitable
 Add DeviseInvitable to your Gemfile:
 
 ```ruby
-gem 'devise_invitable', '~> 2.0.0'
+gem 'devise_invitable', '~> 3.0'
 ```
 
 ### Automatic installation
@@ -49,8 +50,8 @@ rails generate devise_invitable MODEL
 
 Replace MODEL by the class name you want to add DeviseInvitable, like `User`,
 `Admin`, etc. This will add the `:invitable` flag to your model's Devise
-modules. The generator will also create a migration file (if your ORM supports
-them).
+modules. The shared invitations table is created by the install generator, so
+the model generator does not create a migration.
 
 ### Manual installation
 
@@ -67,81 +68,57 @@ class User < ActiveRecord::Base
 end
 ```
 
-#### ActiveRecord Migration
-Add `t.invitable` to your Devise model migration:
+#### Active Record schema
 
-```ruby
-create_table :users do
-  ...
-    ## Invitable
-    t.string   :invitation_token
-    t.datetime :invitation_created_at
-    t.datetime :invitation_sent_at
-    t.datetime :invitation_accepted_at
-    t.integer  :invitation_limit
-    t.integer  :invited_by_id
-    t.string   :invited_by_type
-  ...
-end
-add_index :users, :invitation_token, unique: true
-```
+Invitations are stored in the shared `devise_invitations` table generated by
+`devise_invitable:install`. It contains the token and lifecycle timestamps,
+the configured invite keys, and polymorphic `invitable` and `invited_by`
+associations. Invitation columns are not added to each Devise model.
 
-or for a model that already exists, define a migration to add DeviseInvitable
-to your model:
+Run the generated migration:
 
-```ruby
-def change
-    add_column :users, :invitation_token, :string
-    add_column :users, :invitation_created_at, :datetime
-    add_column :users, :invitation_sent_at, :datetime
-    add_column :users, :invitation_accepted_at, :datetime
-    add_column :users, :invitation_limit, :integer
-    add_column :users, :invited_by_id, :integer
-    add_column :users, :invited_by_type, :string
-    add_index :users, :invitation_token, unique: true
-end
+```shell
+rails db:migrate
 ```
 
-If you previously used devise_invitable with a `:limit` on
-`:invitation_token`, remove it:
+#### Upgrading from resource-backed invitation columns
 
-```ruby
-def up
-  change_column :users, :invitation_token, :string, limit: nil
-end
+Generate one upgrade migration for every model that already uses
+`:invitable`:
 
-def down
-  change_column :users, :invitation_token, :string, limit: 60
-end
+```shell
+rails generate devise_invitable:upgrade User
+rails db:migrate
 ```
 
-## Mongoid Field Definitions
-If you are using Mongoid, define the following fields and indexes within your
-invitable model:
+Pass every configured invite key when it is not just `email`:
 
-```ruby
-field :invitation_token, type: String
-field :invitation_created_at, type: Time
-field :invitation_sent_at, type: Time
-field :invitation_accepted_at, type: Time
-field :invitation_limit, type: Integer
-
-index( { invitation_token: 1 }, { background: true} )
-index( { invitation_by_id: 1 }, { background: true} )
+```shell
+rails generate devise_invitable:upgrade User --invite-keys email username
 ```
 
-You do not need to define a `belongs_to` relationship, as DeviseInvitable does
-this on your behalf:
-```ruby
-belongs_to :invited_by, polymorphic: true
-```
+The generated migration creates the shared table if necessary, copies existing
+invitation data, and removes the old invitation lifecycle and `invited_by`
+columns. It intentionally leaves `invitation_limit` and `invitations_count`
+alone because those describe inviters rather than individual invitations. Its
+down direction is irreversible because multiple invitations cannot be moved
+losslessly back onto one resource row.
+
+## Mongoid
+
+Mongoid fields and indexes for `DeviseInvitable::Invitation` are defined by the
+gem. Create the indexes after deployment:
 
-Remember to create indexes within the MongoDB database after deploying your
-changes.
 ```shell
 rake db:mongoid:create_indexes
 ```
 
+To migrate legacy embedded invitation fields for a model, run:
+
+```shell
+rails devise_invitable:migrate_invitations[User]
+```
+
 ## Model configuration
 
 DeviseInvitable adds some new configuration options:
@@ -181,17 +158,25 @@ invite key as hash keys, and values that respond to the `===` operator
 (including procs and regexes). The default value is looking for users by
 email and validating with `Devise.email_regexp`.
 
-*   `validate_on_invite`: force a record to be valid before being actually
-invited.
+*   `validate_on_invite`: with placeholder creation enabled, force the resource
+to be valid before it is invited. Deferred invitations validate their invite
+keys because no resource is persisted yet.
 
 *   `resend_invitation`: resend invitation if user with invited status is
 invited again. Enabled by default.
 
-*   `invited_by_class_name`: the class name of the inviting model. If this is
-`nil`, polymorphic association is used.
+*   `invited_by_class_name` and `invited_by_foreign_key` are deprecated and
+have no effect. This applies to both initializer configuration and options
+passed to `devise :invitable` on a model. Invitations always use the
+polymorphic `invited_by_id` and `invited_by_type` columns in the shared
+invitations table.
 
-*   `invited_by_foreign_key`: the foreign key to the inviting model (only used
-if `invited_by_class_name` is set, otherwise `:invited_by_id`)
+*   `create_resource_on_invitation`: create a placeholder resource when the
+invitation is sent. It is disabled by default, so only invite keys are stored
+until acceptance. Enable it when the application needs an addressable resource
+before signup or needs to store additional permitted resource attributes from
+the invitation form. Arbitrary resource attributes are rejected when this is
+disabled.
 
 *   `invited_by_counter_cache`: the column name used for counter_cache column.
 If this is `nil` (default value), the `invited_by` association is declared
@@ -378,24 +363,45 @@ end
 
 ### Send an invitation
 
-To send an invitation to a user, use the `invite!` class method. **Note: This
-will create a user, and send an email for the invite.** `:email` must be
-present in the parameters hash. You can also include other attributes in the
-hash. The record will not be validated.
+To send an invitation to a user, use the `invite!` class method. `:email` must
+be present in the parameters hash. By default this stores an invitation without
+creating a user. Set `create_resource_on_invitation: true` on the Devise model
+to create a placeholder user immediately and allow other resource attributes.
 
 ```ruby
-User.invite!(email: 'new_user@example.com', name: 'John Doe')
+User.invite!(email: 'new_user@example.com')
 # => an invitation email will be sent to new_user@example.com
 ```
 
+To persist additional resource attributes, enable placeholders:
+
+```ruby
+class User < ApplicationRecord
+  devise :database_authenticatable, :invitable,
+    create_resource_on_invitation: true
+end
+
+User.invite!(email: 'new_user@example.com', name: 'John Doe')
+```
+
+Multiple invitations can be sent for the same invite keys. Accepting one marks
+that invitation accepted and supersedes the others. If the invitee registers
+directly, all matching pending invitations are superseded rather than marked
+accepted.
+
+Placeholder resources expose `invitation_pending?`. Pending placeholders are
+rejected by both Devise's password validation and
+`active_for_authentication?` checks until an invitation is accepted or the
+resource is claimed by direct registration.
+
 If you want to create the invitation but not send it, you can set
 `skip_invitation` to `true`.
 
 ```ruby
-user = User.invite!(email: 'new_user@example.com', name: 'John Doe') do |u|
+user = User.invite!(email: 'new_user@example.com') do |u|
   u.skip_invitation = true
 end
-# => the record will be created, but the invitation email will not be sent
+# => the invitation will be stored, but its email will not be sent
 ```
 
 When generating the `accept_user_invitation_url` yourself, you must use the
@@ -420,12 +426,13 @@ You can add `:skip_invitation` to attributes hash if `skip_invitation` is
 added to `attr_accessible`.
 
 ```ruby
-User.invite!(email: 'new_user@example.com', name: 'John Doe', skip_invitation: true)
-# => the record will be created, but the invitation email will not be sent
+User.invite!(email: 'new_user@example.com', skip_invitation: true)
+# => the invitation will be stored, but its email will not be sent
 ```
 
-`skip_invitation` skips sending the email, but sets `invitation_token`, so
-`invited_to_sign_up?` on the resulting user returns `true`.
+`skip_invitation` skips sending the email but still creates a pending
+`DeviseInvitable::Invitation`. With placeholders enabled,
+`invited_to_sign_up?` and `invitation_pending?` return `true` on the resource.
 
 To check if a particular user is created by invitation, irrespective to state
 of invitation one can use `created_by_invite?`
@@ -452,6 +459,14 @@ user = User.find(42)
 user.invite!(current_user)  # current user is optional to set the invited_by attribute
 ```
 
+Whenever possible, prefer the `User.invite!` class method described above. The
+instance method creates another invitation and does not perform the
+class method's checks for an existing registered account. Only call it from a
+trusted, authorized workflow after verifying that the user is eligible to be
+invited. In particular, do not expose it through an unauthenticated endpoint,
+as doing so could allow an attacker to disrupt or take over an existing
+account.
+
 ### Find by invitation token
 
 To find by invitation token use the `find_by_invitation_token` class method.
@@ -499,9 +514,9 @@ A pair of scopes to find those users that have accepted, and those that have
 not accepted, invitations are defined:
 
 ```ruby
-User.invitation_accepted     # => returns all Users for whom the invitation_accepted_at attribute is not nil
-User.invitation_not_accepted # => returns all Users for whom the invitation_accepted_at attribute is nil
-User.created_by_invite       # => returns all Users who are created by invitations, irrespective to invitation status
+User.invitation_accepted     # => resources with at least one accepted invitation
+User.invitation_not_accepted # => resources provisioned by a pending invitation
+User.created_by_invite       # => resources created through the invitation workflow
 ```
 
 ## Integration in a Rails application
@@ -533,8 +548,9 @@ the `invitation_token` is not present or not valid, the invited is redirected
 to `invalid_token_path_for(resource_name)`, which by default is
 `after_sign_out_path_for(resource_name)`.
 
-The controller sets the `invited_by_id` attribute for the new user to the
-current user.  This will let you easily keep track of who invited whom.
+The controller sets the invitation's polymorphic `invited_by` association to
+the current user. This keeps every inviter when the same address is invited
+more than once.
 
 ## Controller filter
 
@@ -571,21 +587,16 @@ end
 
 ## Has many invitations
 
-If you want to get all records invited by a resource, you should define
-`has_many` association in the model allowed to send invitations.
-
-For the default behavior, define it like this:
+The `DeviseInvitable::Inviter` module defines a `sent_invitations` association
+containing every invitation sent by the resource:
 
 ```ruby
-has_many :invitations, class_name: self.to_s, as: :invited_by
+current_user.sent_invitations
+current_admin.sent_invitations
 ```
 
-For the previous example, where admins send invitations to users, define it
-like this:
-
-```ruby
-has_many :invitations, class_name: 'User', as: :invited_by
-```
+Deleting an inviter preserves its sent invitations and clears their
+`invited_by` association.
 
 ## I18n
 

data/app/controllers/devise/invitations_controller.rb

@@ -69,7 +69,7 @@ class Devise::InvitationsController < DeviseController
 
   # GET /resource/invitation/remove?invitation_token=abcdef
   def destroy
-    resource.destroy
+    resource.revoke_invitation!
     set_flash_message :notice, :invitation_removed if is_flashing_format?
     redirect_to after_sign_out_path_for(resource_name)
   end

data/app/controllers/devise_invitable/registrations_controller.rb

@@ -2,16 +2,21 @@ class DeviseInvitable::RegistrationsController < Devise::RegistrationsController
   protected
 
     def build_resource(hash = {})
-      if hash[:email]
-        self.resource = resource_class.where(email: hash[:email]).first
-        if self.resource && self.resource.respond_to?(:invited_to_sign_up?) && self.resource.invited_to_sign_up?
-          self.resource.attributes = hash
-          self.resource.send_confirmation_instructions if self.resource.confirmation_required_for_invited?
-          self.resource.accept_invitation
-        else
-          self.resource = nil
-        end
-      end
+      build_invited_resource(hash) if hash[:email]
       self.resource ||= super
+      if self.resource.respond_to?(:registering_directly=) && resource_class.pending_invitations_for(hash).any?
+        self.resource.registering_directly = true
+      end
+      self.resource
+    end
+
+    def build_invited_resource(hash)
+      self.resource = resource_class.where(email: hash[:email]).first
+      if self.resource && self.resource.respond_to?(:invited_to_sign_up?) && self.resource.invited_to_sign_up?
+        self.resource.attributes = hash
+        self.resource.send_confirmation_instructions if self.resource.confirmation_required_for_invited?
+      else
+        self.resource = nil
+      end
     end
 end

data/lib/devise_invitable/invitation.rb

@@ -0,0 +1,89 @@
+require 'digest'
+
+module DeviseInvitable
+  invitation_base =
+    if defined?(ActiveRecord::Base)
+      ActiveRecord::Base
+    else
+      Object
+    end
+
+  class Invitation < invitation_base
+    self.table_name = 'devise_invitations' if respond_to?(:table_name=)
+
+    if defined?(Mongoid::Document) && !defined?(ActiveRecord::Base)
+      include Mongoid::Document
+      include Mongoid::Timestamps
+
+      store_in collection: 'devise_invitations'
+
+      field :invitation_token, type: String
+      field :invitation_created_at, type: Time
+      field :invitation_sent_at, type: Time
+      field :invitation_accepted_at, type: Time
+      field :superseded_at, type: Time
+      field :superseded_reason, type: String
+      field :revoked_at, type: Time
+      field :resource_created_at, type: Time
+      field :invite_key, type: Hash, default: {}
+      field :invite_key_digest, type: String
+      field :invitable_type, type: String
+      field :invitable_id
+      field :invited_by_type, type: String
+      field :invited_by_id
+
+      index({ invitation_token: 1 }, unique: true, sparse: true)
+      index({ invitable_type: 1, invitable_id: 1 })
+      index({ invited_by_type: 1, invited_by_id: 1 })
+      index({ invitable_type: 1, invite_key_digest: 1 })
+    end
+
+    belongs_to :invitable, polymorphic: true, optional: true
+    invited_by_options = { polymorphic: true, optional: true, autosave: true }
+    if defined?(ActiveRecord::Base) && Devise.invited_by_counter_cache
+      invited_by_options[:counter_cache] = Devise.invited_by_counter_cache
+    end
+    belongs_to :invited_by, **invited_by_options
+
+    before_validation :set_invite_key_digest
+
+    scope :pending, lambda {
+      where(invitation_accepted_at: nil, superseded_at: nil, revoked_at: nil)
+    }
+    if defined?(Mongoid::Document) && !defined?(ActiveRecord::Base)
+      scope :provisioning, -> { where(:resource_created_at.ne => nil) }
+      scope :accepted, -> { where(:invitation_accepted_at.ne => nil) }
+    else
+      scope :provisioning, -> { where.not(resource_created_at: nil) }
+      scope :accepted, -> { where.not(invitation_accepted_at: nil) }
+    end
+
+    def pending?
+      invitation_accepted_at.nil? && superseded_at.nil? && revoked_at.nil?
+    end
+
+    def provisioning?
+      resource_created_at.present?
+    end
+
+    def invitation_period_valid?(period)
+      period.to_i.zero? || (invitation_created_at && invitation_created_at.utc >= period.ago)
+    end
+
+    def invite_key
+      value = super
+      value.respond_to?(:with_indifferent_access) ? value.with_indifferent_access : value
+    end
+
+    def self.digest_for(resource_type, invite_key)
+      components = invite_key.to_h.map { |key, value| [key.to_s, value.to_s] }.sort.flatten
+      Digest::SHA256.hexdigest(([resource_type] + components).join("\0"))
+    end
+
+    private
+
+      def set_invite_key_digest
+        self.invite_key_digest = self.class.digest_for(invitable_type, invite_key)
+      end
+  end
+end

data/lib/devise_invitable/inviter.rb

@@ -3,17 +3,32 @@ module DeviseInvitable
     extend ActiveSupport::Concern
 
     included do
+      has_many :sent_invitations,
+        class_name: 'DeviseInvitable::Invitation',
+        as: :invited_by,
+        dependent: :nullify
+
       extend ClassMethods
       attr_writer :invitation_limit unless respond_to? :invitation_limit
     end
 
     def invitation_limit
-      self[:invitation_limit] || self.class.invitation_limit
+      stored_limit =
+        if invitation_limit_attribute?
+          self[:invitation_limit]
+        else
+          @invitation_limit
+        end
+      stored_limit || self.class.invitation_limit
     end
 
     # Return true if this user has invitations left to send
     def has_invitations_left?
       if self.class.invitation_limit.present?
+        unless invitation_limit_attribute?
+          return sent_invitations.count < self.class.invitation_limit
+        end
+
         if invitation_limit
           return invitation_limit > 0
         else
@@ -28,11 +43,18 @@ module DeviseInvitable
 
       def decrement_invitation_limit!
         if self.class.invitation_limit.present?
+          return unless invitation_limit_attribute?
+
           self.invitation_limit ||= self.class.invitation_limit
           self.update_attribute(:invitation_limit, invitation_limit - 1)
         end
       end
 
+      def invitation_limit_attribute?
+        (respond_to?(:has_attribute?) && has_attribute?(:invitation_limit)) ||
+          (self.class.respond_to?(:fields) && self.class.fields.key?('invitation_limit'))
+      end
+
       module ClassMethods
         Devise::Models.config(self, :invitation_limit)
       end

data/lib/devise_invitable/migrator.rb

@@ -0,0 +1,113 @@
+module DeviseInvitable
+  class Migrator
+    BATCH_SIZE = 1_000
+
+    LEGACY_FIELDS = %w[
+      invitation_token invitation_created_at invitation_sent_at
+      invitation_accepted_at invited_by_id invited_by_type
+    ].freeze
+
+    def self.call(model_class)
+      new(model_class).call
+    end
+
+    def initialize(model_class)
+      unless defined?(Mongoid::Document) && model_class < Mongoid::Document
+        raise ArgumentError, 'DeviseInvitable::Migrator only supports Mongoid models'
+      end
+
+      @model_class = model_class
+    end
+
+    def call
+      migrated = 0
+      each_legacy_resource_batch do |resources|
+        migrated_identities = migrated_identities_for(resources)
+        resources_to_migrate = resources.reject do |resource|
+          migrated_identities.include?(migration_identity(resource))
+        end
+
+        insert_invitations(resources_to_migrate)
+        remove_legacy_fields(resources)
+        migrated += resources_to_migrate.size
+      end
+      migrated
+    end
+
+    private
+
+      attr_reader :model_class
+
+      def resources_with_legacy_invitations
+        model_class.where(:invitation_created_at.ne => nil)
+      end
+
+      def each_legacy_resource_batch(&block)
+        resources_with_legacy_invitations
+          .batch_size(BATCH_SIZE)
+          .each_slice(BATCH_SIZE, &block)
+      end
+
+      def migrated_identities_for(resources)
+        resource_ids = resources.map(&:id)
+        DeviseInvitable::Invitation.where(
+          invitable_type: model_class.devise_invitable_base_class.name
+        ).in(
+          invitable_id: resource_ids
+        ).pluck(
+          :invitable_id, :invitation_created_at
+        ).to_h { |identity| [identity, true] }
+      end
+
+      def migration_identity(resource)
+        [resource.id, legacy_value(resource, 'invitation_created_at')]
+      end
+
+      def insert_invitations(resources)
+        return if resources.empty?
+
+        now = Time.now.utc
+        attributes = resources.map { |resource| invitation_attributes(resource, now) }
+        DeviseInvitable::Invitation.collection.insert_many(attributes)
+      end
+
+      def invitation_attributes(resource, now)
+        created_at = legacy_value(resource, 'invitation_created_at')
+        invite_key = invite_key_for(resource)
+        {
+          invitation_token: legacy_value(resource, 'invitation_token'),
+          invitation_created_at: created_at,
+          invitation_sent_at: legacy_value(resource, 'invitation_sent_at'),
+          invitation_accepted_at: legacy_value(resource, 'invitation_accepted_at'),
+          resource_created_at: created_at,
+          invite_key: invite_key,
+          invite_key_digest: DeviseInvitable::Invitation.digest_for(
+            model_class.devise_invitable_base_class.name,
+            invite_key
+          ),
+          invitable_type: model_class.devise_invitable_base_class.name,
+          invitable_id: resource.id,
+          invited_by_type: legacy_value(resource, 'invited_by_type'),
+          invited_by_id: legacy_value(resource, 'invited_by_id'),
+          created_at: now,
+          updated_at: now
+        }
+      end
+
+      def invite_key_for(resource)
+        model_class.invite_key_fields.each_with_object({}) do |key, values|
+          values[key] = resource.public_send(key)
+        end
+      end
+
+      def legacy_value(resource, field)
+        resource.attributes[field]
+      end
+
+      def remove_legacy_fields(resources)
+        return if resources.empty?
+
+        model_class.in(id: resources.map(&:id)).unset(*LEGACY_FIELDS)
+      end
+  end
+end