devise_invitable 2.0.14 → 3.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e29dc7f305f5cb11941463a2115645c6de83ac0fde470243f8c4ee9c23535c7f
-  data.tar.gz: 1351e523f14e6dcb0243df3a6b0eca0156e0185e25fd488335c8acf4b260c7b7
+  metadata.gz: 96e5afbd2a5df8b9d94f1b1cbe30a2544f6c759b9c5c4ccb4f1de2a37a8f6e3a
+  data.tar.gz: ccef0234148611c07c9eae801b104da63066fd856ea3d1bd592180936e1a3042
 SHA512:
-  metadata.gz: 667c2b93fe46151947c3845fd19c4b370d5c9435331cc84ef52e2d375ba06e9748aa57539333b7951dd8b6a09ae6ebdc8ad8e9bb177b5e5d7741bec1691f9b6a
-  data.tar.gz: a7403ae4e341a1a1eaf8431addfc9336534ef1fbaacee60614880f0fa94d772bface4433929088c7025766c264c8820b5608914eabb1f8a76624b2ea6116a62c
+  metadata.gz: e81ee3d1513dded1dbaaf4685bea5fe71c6d4f08bc57bec248407488ce9f0122498a3dac8c9e80a0db7cf8812bc36c88b570d4688cad52360076d439e172a8ae
+  data.tar.gz: db4f74177f9f44b361f689a3ebb58e49e42827e07ee39f98dfb9c907a0d1e4e2704381d24e101d41014fc8a1125eb9dbdd01131e694b572580669bb7c8ae2b9d

data/CHANGELOG.md

@@ -1,3 +1,69 @@
+## Unreleased
+
+## 3.0.1
+
+- Raise `DeviseInvitable::AmbiguousInviteKeyError` instead of selecting an
+  arbitrary resource when an invite key matches multiple records
+  ([#878](https://github.com/scambra/devise_invitable/issues/878))
+- Use the signed-in resource as the inviter when a custom
+  `authenticate_inviter!` method returns a boolean success value
+  ([#825](https://github.com/scambra/devise_invitable/issues/825))
+- Do not assign attributes or modify associations on an existing resource when
+  its invitation is rejected ([#747](https://github.com/scambra/devise_invitable/issues/747))
+- Avoid uninitialized `@accepting_invitation` warnings on supported Ruby 2.7
+  ([#776](https://github.com/scambra/devise_invitable/issues/776))
+- Document personal-data storage and retention considerations for deferred and
+  placeholder invitations ([#777](https://github.com/scambra/devise_invitable/issues/777))
+- Add regression coverage for custom `authenticate_inviter!` methods that
+  redirect unauthorized inviters ([#893](https://github.com/scambra/devise_invitable/issues/893))
+- Add regression coverage to ensure `devise_for` preserves a custom controller
+  `module` instead of replacing its registrations controller
+  ([#877](https://github.com/scambra/devise_invitable/issues/877))
+- Add regression coverage that instance-level `invite!` runs both the before
+  and after invitation-created callbacks
+  ([#640](https://github.com/scambra/devise_invitable/issues/640))
+
+## 3.0.0
+
+- Drop support for Ruby < 2.7, Rails < 7.0, and Devise < 5.0
+- Store invitations in a shared `devise_invitations` table/collection with
+  polymorphic `invitable` and `invited_by` associations, allowing multiple
+  invitations and inviters for the same resource ([#228](https://github.com/scambra/devise_invitable/issues/228),
+  [#388](https://github.com/scambra/devise_invitable/issues/388))
+- Defer resource creation until invitation acceptance by default. Add
+  `create_resource_on_invitation` to optionally create placeholder resources
+  immediately; additional resource attributes require this option
+- Add `invitation_pending?` and prevent pending placeholders from
+  authenticating through both password validation and
+  `active_for_authentication?`
+- Accept only the invitation whose token was used and supersede other pending
+  invitations. Direct registration supersedes matching invitations without
+  marking them accepted
+- Make the install generator create the shared invitations store through ORM
+  hooks. The model generator now only adds `:invitable` and no longer creates
+  per-model invitation-column migrations
+- Add `devise_invitable:upgrade MODEL` to generate an Active Record data
+  migration from the legacy per-model columns, with `--invite-keys` support
+- Add `devise_invitable:migrate_invitations[MODEL]` for Mongoid legacy-data
+  upgrades; Mongoid indexes continue to be created with
+  `db:mongoid:create_indexes`
+
+## 2.0.14
+- Fix `NameError` when `Devise.parent_mailer` is an application mailer ([#930](https://github.com/scambra/devise_invitable/pull/930))
+
+## 2.0.13
+- Avoid loading Action Mailer and Active Job before application initialization ([#926](https://github.com/scambra/devise_invitable/pull/926))
+- Test against Devise 5 while retaining support for Devise 4.6 and newer
+- Fix email interpolation in the Hong Kong and Taiwanese Chinese translations ([#927](https://github.com/scambra/devise_invitable/pull/927))
+
+## 2.0.12
+- Add Ruby 3.4 and Rails 8.0 compatibility coverage ([#920](https://github.com/scambra/devise_invitable/pull/920))
+- Fix the Italian invitation instructions ([#923](https://github.com/scambra/devise_invitable/issues/923))
+- Correct the Brazilian Portuguese locale identifier ([#924](https://github.com/scambra/devise_invitable/pull/924))
+
+## 2.0.11
+- Make `invitation_due_at` return `nil` for users who were not invited ([#919](https://github.com/scambra/devise_invitable/pull/919))
+
 ## 2.0.10
 - Use invited_by_class_name and invited_by_foreign_key settings from the model
 

data/README.md

@@ -12,10 +12,11 @@ invitation setting the password.
 
 ## Requirements
 
-The latest version of DeviseInvitable works with Devise >= 4.6.
+The latest version of DeviseInvitable requires Ruby >= 2.7, Rails >= 7.0,
+and Devise >= 5.0.
 
-If you want to use devise_invitable with earlier Devise releases (4.0 <= x <
-4.6), use version 1.7.5.
+Use DeviseInvitable 2.x with Devise 4.6 through 4.9. For earlier Devise 4
+releases, use DeviseInvitable 1.7.5.
 
 ## Installation
 
@@ -28,7 +29,7 @@ gem install devise_invitable
 Add DeviseInvitable to your Gemfile:
 
 ```ruby
-gem 'devise_invitable', '~> 2.0.0'
+gem 'devise_invitable', '~> 3.0'
 ```
 
 ### Automatic installation
@@ -49,8 +50,8 @@ rails generate devise_invitable MODEL
 
 Replace MODEL by the class name you want to add DeviseInvitable, like `User`,
 `Admin`, etc. This will add the `:invitable` flag to your model's Devise
-modules. The generator will also create a migration file (if your ORM supports
-them).
+modules. The shared invitations table is created by the install generator, so
+the model generator does not create a migration.
 
 ### Manual installation
 
@@ -67,81 +68,57 @@ class User < ActiveRecord::Base
 end
 ```
 
-#### ActiveRecord Migration
-Add `t.invitable` to your Devise model migration:
+#### Active Record schema
 
-```ruby
-create_table :users do
-  ...
-    ## Invitable
-    t.string   :invitation_token
-    t.datetime :invitation_created_at
-    t.datetime :invitation_sent_at
-    t.datetime :invitation_accepted_at
-    t.integer  :invitation_limit
-    t.integer  :invited_by_id
-    t.string   :invited_by_type
-  ...
-end
-add_index :users, :invitation_token, unique: true
-```
+Invitations are stored in the shared `devise_invitations` table generated by
+`devise_invitable:install`. It contains the token and lifecycle timestamps,
+the configured invite keys, and polymorphic `invitable` and `invited_by`
+associations. Invitation columns are not added to each Devise model.
 
-or for a model that already exists, define a migration to add DeviseInvitable
-to your model:
+Run the generated migration:
 
-```ruby
-def change
-    add_column :users, :invitation_token, :string
-    add_column :users, :invitation_created_at, :datetime
-    add_column :users, :invitation_sent_at, :datetime
-    add_column :users, :invitation_accepted_at, :datetime
-    add_column :users, :invitation_limit, :integer
-    add_column :users, :invited_by_id, :integer
-    add_column :users, :invited_by_type, :string
-    add_index :users, :invitation_token, unique: true
-end
+```shell
+rails db:migrate
 ```
 
-If you previously used devise_invitable with a `:limit` on
-`:invitation_token`, remove it:
+#### Upgrading from resource-backed invitation columns
 
-```ruby
-def up
-  change_column :users, :invitation_token, :string, limit: nil
-end
+Generate one upgrade migration for every model that already uses
+`:invitable`:
 
-def down
-  change_column :users, :invitation_token, :string, limit: 60
-end
+```shell
+rails generate devise_invitable:upgrade User
+rails db:migrate
 ```
 
-## Mongoid Field Definitions
-If you are using Mongoid, define the following fields and indexes within your
-invitable model:
+Pass every configured invite key when it is not just `email`:
 
-```ruby
-field :invitation_token, type: String
-field :invitation_created_at, type: Time
-field :invitation_sent_at, type: Time
-field :invitation_accepted_at, type: Time
-field :invitation_limit, type: Integer
-
-index( { invitation_token: 1 }, { background: true} )
-index( { invitation_by_id: 1 }, { background: true} )
+```shell
+rails generate devise_invitable:upgrade User --invite-keys email username
 ```
 
-You do not need to define a `belongs_to` relationship, as DeviseInvitable does
-this on your behalf:
-```ruby
-belongs_to :invited_by, polymorphic: true
-```
+The generated migration creates the shared table if necessary, copies existing
+invitation data, and removes the old invitation lifecycle and `invited_by`
+columns. It intentionally leaves `invitation_limit` and `invitations_count`
+alone because those describe inviters rather than individual invitations. Its
+down direction is irreversible because multiple invitations cannot be moved
+losslessly back onto one resource row.
+
+## Mongoid
+
+Mongoid fields and indexes for `DeviseInvitable::Invitation` are defined by the
+gem. Create the indexes after deployment:
 
-Remember to create indexes within the MongoDB database after deploying your
-changes.
 ```shell
 rake db:mongoid:create_indexes
 ```
 
+To migrate legacy embedded invitation fields for a model, run:
+
+```shell
+rails devise_invitable:migrate_invitations[User]
+```
+
 ## Model configuration
 
 DeviseInvitable adds some new configuration options:
@@ -181,17 +158,25 @@ invite key as hash keys, and values that respond to the `===` operator
 (including procs and regexes). The default value is looking for users by
 email and validating with `Devise.email_regexp`.
 
-*   `validate_on_invite`: force a record to be valid before being actually
-invited.
+*   `validate_on_invite`: with placeholder creation enabled, force the resource
+to be valid before it is invited. Deferred invitations validate their invite
+keys because no resource is persisted yet.
 
 *   `resend_invitation`: resend invitation if user with invited status is
 invited again. Enabled by default.
 
-*   `invited_by_class_name`: the class name of the inviting model. If this is
-`nil`, polymorphic association is used.
+*   `invited_by_class_name` and `invited_by_foreign_key` are deprecated and
+have no effect. This applies to both initializer configuration and options
+passed to `devise :invitable` on a model. Invitations always use the
+polymorphic `invited_by_id` and `invited_by_type` columns in the shared
+invitations table.
 
-*   `invited_by_foreign_key`: the foreign key to the inviting model (only used
-if `invited_by_class_name` is set, otherwise `:invited_by_id`)
+*   `create_resource_on_invitation`: create a placeholder resource when the
+invitation is sent. It is disabled by default, so only invite keys are stored
+until acceptance. Enable it when the application needs an addressable resource
+before signup or needs to store additional permitted resource attributes from
+the invitation form. Arbitrary resource attributes are rejected when this is
+disabled.
 
 *   `invited_by_counter_cache`: the column name used for counter_cache column.
 If this is `nil` (default value), the `invited_by` association is declared
@@ -261,6 +246,34 @@ above is `'users/invitations'`, so our routes.rb would have this line:
 devise_for :users, controllers: { invitations: 'users/invitations' }
 ```
 
+The invitations controller prepends its authentication, invitation-limit, and
+token-loading callbacks. These callbacks may render or redirect and halt the
+callback chain before an ordinary callback inherited from
+`ApplicationController` runs. If application context must be available even
+when one of these guards halts the request, prepend that setup in the custom
+invitations controller. For example, an around callback can set and restore
+the locale so flash messages created by the guards use the requested locale:
+
+```ruby
+class Users::InvitationsController < Devise::InvitationsController
+  prepend_around_action :use_locale
+
+  private
+
+    def use_locale(&action)
+      I18n.with_locale(locale_from_request, &action)
+    end
+
+    def locale_from_request
+      params[:locale].presence_in(I18n.available_locales.map(&:to_s)) ||
+        I18n.default_locale
+    end
+end
+```
+
+The same ordering rule applies to tenant selection, request tracing, and other
+setup that must run before Devise Invitable's controller guards.
+
 be sure that you generate the views and put them into the controller that you
 generated, so for this example it would be:
 
@@ -378,24 +391,75 @@ end
 
 ### Send an invitation
 
-To send an invitation to a user, use the `invite!` class method. **Note: This
-will create a user, and send an email for the invite.** `:email` must be
-present in the parameters hash. You can also include other attributes in the
-hash. The record will not be validated.
+To send an invitation to a user, use the `invite!` class method. `:email` must
+be present in the parameters hash. By default this stores an invitation without
+creating a user. Set `create_resource_on_invitation: true` on the Devise model
+to create a placeholder user immediately and allow other resource attributes.
 
 ```ruby
-User.invite!(email: 'new_user@example.com', name: 'John Doe')
+User.invite!(email: 'new_user@example.com')
 # => an invitation email will be sent to new_user@example.com
 ```
 
+To persist additional resource attributes, enable placeholders:
+
+```ruby
+class User < ApplicationRecord
+  devise :database_authenticatable, :invitable,
+    create_resource_on_invitation: true
+end
+
+User.invite!(email: 'new_user@example.com', name: 'John Doe')
+```
+
+Multiple invitations can be sent for the same invite keys. Accepting one marks
+that invitation accepted and supersedes the others. If the invitee registers
+directly, all matching pending invitations are superseded rather than marked
+accepted.
+
+Placeholder resources expose `invitation_pending?`. Pending placeholders are
+rejected by both Devise's password validation and
+`active_for_authentication?` checks until an invitation is accepted or the
+resource is claimed by direct registration.
+
+### Privacy and data retention
+
+Invitation keys commonly contain personal data such as an email address. With
+the default `create_resource_on_invitation: false`, no resource row is created,
+but the invite-key values are stored in plaintext in the
+`devise_invitations.invite_key` JSON column so the resource can be created when
+the invitation is accepted. `invite_key_digest` is used for matching; it does
+not replace the stored values and should not be treated as anonymization.
+
+With `create_resource_on_invitation: true`, the resource and any additional
+attributes or associations supplied to `invite!` are persisted immediately.
+Choose this mode only when the application needs a placeholder and its privacy
+policy permits storing that data before acceptance.
+
+`invite_for` limits token validity but does not delete invitation or resource
+records. Applications are responsible for choosing a lawful basis for
+processing, disclosing that processing where required, limiting invited data,
+restricting access, protecting it at rest, and deleting pending, revoked,
+superseded, and accepted invitation data according to their retention policy.
+Consent is one possible lawful basis under GDPR, but it is not the only one.
+See the [European Commission GDPR principles](https://commission.europa.eu/law/law-topic/data-protection/information-business-and-organisations/principles-gdpr_en)
+and obtain appropriate legal advice for the application.
+
+A one-way hash alone is insufficient for the built-in deferred-invitation
+flow, because devise_invitable must recover the invite keys to create the
+resource at acceptance. Applications that must not retain the email address
+need a custom flow, such as asking the invitee to enter it during acceptance
+and verifying it against a stored digest, or using suitably protected
+reversible storage.
+
 If you want to create the invitation but not send it, you can set
 `skip_invitation` to `true`.
 
 ```ruby
-user = User.invite!(email: 'new_user@example.com', name: 'John Doe') do |u|
+user = User.invite!(email: 'new_user@example.com') do |u|
   u.skip_invitation = true
 end
-# => the record will be created, but the invitation email will not be sent
+# => the invitation will be stored, but its email will not be sent
 ```
 
 When generating the `accept_user_invitation_url` yourself, you must use the
@@ -420,12 +484,13 @@ You can add `:skip_invitation` to attributes hash if `skip_invitation` is
 added to `attr_accessible`.
 
 ```ruby
-User.invite!(email: 'new_user@example.com', name: 'John Doe', skip_invitation: true)
-# => the record will be created, but the invitation email will not be sent
+User.invite!(email: 'new_user@example.com', skip_invitation: true)
+# => the invitation will be stored, but its email will not be sent
 ```
 
-`skip_invitation` skips sending the email, but sets `invitation_token`, so
-`invited_to_sign_up?` on the resulting user returns `true`.
+`skip_invitation` skips sending the email but still creates a pending
+`DeviseInvitable::Invitation`. With placeholders enabled,
+`invited_to_sign_up?` and `invitation_pending?` return `true` on the resource.
 
 To check if a particular user is created by invitation, irrespective to state
 of invitation one can use `created_by_invite?`
@@ -452,6 +517,14 @@ user = User.find(42)
 user.invite!(current_user)  # current user is optional to set the invited_by attribute
 ```
 
+Whenever possible, prefer the `User.invite!` class method described above. The
+instance method creates another invitation and does not perform the
+class method's checks for an existing registered account. Only call it from a
+trusted, authorized workflow after verifying that the user is eligible to be
+invited. In particular, do not expose it through an unauthenticated endpoint,
+as doing so could allow an attacker to disrupt or take over an existing
+account.
+
 ### Find by invitation token
 
 To find by invitation token use the `find_by_invitation_token` class method.
@@ -499,9 +572,9 @@ A pair of scopes to find those users that have accepted, and those that have
 not accepted, invitations are defined:
 
 ```ruby
-User.invitation_accepted     # => returns all Users for whom the invitation_accepted_at attribute is not nil
-User.invitation_not_accepted # => returns all Users for whom the invitation_accepted_at attribute is nil
-User.created_by_invite       # => returns all Users who are created by invitations, irrespective to invitation status
+User.invitation_accepted     # => resources with at least one accepted invitation
+User.invitation_not_accepted # => resources provisioned by a pending invitation
+User.created_by_invite       # => resources created through the invitation workflow
 ```
 
 ## Integration in a Rails application
@@ -533,8 +606,9 @@ the `invitation_token` is not present or not valid, the invited is redirected
 to `invalid_token_path_for(resource_name)`, which by default is
 `after_sign_out_path_for(resource_name)`.
 
-The controller sets the `invited_by_id` attribute for the new user to the
-current user.  This will let you easily keep track of who invited whom.
+The controller sets the invitation's polymorphic `invited_by` association to
+the current user. This keeps every inviter when the same address is invited
+more than once.
 
 ## Controller filter
 
@@ -571,21 +645,16 @@ end
 
 ## Has many invitations
 
-If you want to get all records invited by a resource, you should define
-`has_many` association in the model allowed to send invitations.
-
-For the default behavior, define it like this:
+The `DeviseInvitable::Inviter` module defines a `sent_invitations` association
+containing every invitation sent by the resource:
 
 ```ruby
-has_many :invitations, class_name: self.to_s, as: :invited_by
+current_user.sent_invitations
+current_admin.sent_invitations
 ```
 
-For the previous example, where admins send invitations to users, define it
-like this:
-
-```ruby
-has_many :invitations, class_name: 'User', as: :invited_by
-```
+Deleting an inviter preserves its sent invitations and clears their
+`invited_by` association.
 
 ## I18n
 

data/app/controllers/devise/invitations_controller.rb

@@ -69,7 +69,7 @@ class Devise::InvitationsController < DeviseController
 
   # GET /resource/invitation/remove?invitation_token=abcdef
   def destroy
-    resource.destroy
+    resource.revoke_invitation!
     set_flash_message :notice, :invitation_removed if is_flashing_format?
     redirect_to after_sign_out_path_for(resource_name)
   end
@@ -85,7 +85,13 @@ class Devise::InvitationsController < DeviseController
     end
 
     def current_inviter
-      authenticate_inviter!
+      authenticated = authenticate_inviter!
+      return authenticated if authenticated.respond_to?(:has_invitations_left?)
+
+      # Custom API/token authenticators may return true on success instead of
+      # the authenticated resource, so fall back to Devise's current scope.
+      current_resource_method = :"current_#{resource_name}"
+      send(current_resource_method) if respond_to?(current_resource_method, true)
     end
 
     def has_invitations_left?

data/app/controllers/devise_invitable/registrations_controller.rb

@@ -2,16 +2,21 @@ class DeviseInvitable::RegistrationsController < Devise::RegistrationsController
   protected
 
     def build_resource(hash = {})
-      if hash[:email]
-        self.resource = resource_class.where(email: hash[:email]).first
-        if self.resource && self.resource.respond_to?(:invited_to_sign_up?) && self.resource.invited_to_sign_up?
-          self.resource.attributes = hash
-          self.resource.send_confirmation_instructions if self.resource.confirmation_required_for_invited?
-          self.resource.accept_invitation
-        else
-          self.resource = nil
-        end
-      end
+      build_invited_resource(hash) if hash[:email]
       self.resource ||= super
+      if self.resource.respond_to?(:registering_directly=) && resource_class.pending_invitations_for(hash).any?
+        self.resource.registering_directly = true
+      end
+      self.resource
+    end
+
+    def build_invited_resource(hash)
+      self.resource = resource_class.where(email: hash[:email]).first
+      if self.resource && self.resource.respond_to?(:invited_to_sign_up?) && self.resource.invited_to_sign_up?
+        self.resource.attributes = hash
+        self.resource.send_confirmation_instructions if self.resource.confirmation_required_for_invited?
+      else
+        self.resource = nil
+      end
     end
 end

data/lib/devise_invitable/invitation.rb

@@ -0,0 +1,89 @@
+require 'digest'
+
+module DeviseInvitable
+  invitation_base =
+    if defined?(ActiveRecord::Base)
+      ActiveRecord::Base
+    else
+      Object
+    end
+
+  class Invitation < invitation_base
+    self.table_name = 'devise_invitations' if respond_to?(:table_name=)
+
+    if defined?(Mongoid::Document) && !defined?(ActiveRecord::Base)
+      include Mongoid::Document
+      include Mongoid::Timestamps
+
+      store_in collection: 'devise_invitations'
+
+      field :invitation_token, type: String
+      field :invitation_created_at, type: Time
+      field :invitation_sent_at, type: Time
+      field :invitation_accepted_at, type: Time
+      field :superseded_at, type: Time
+      field :superseded_reason, type: String
+      field :revoked_at, type: Time
+      field :resource_created_at, type: Time
+      field :invite_key, type: Hash, default: {}
+      field :invite_key_digest, type: String
+      field :invitable_type, type: String
+      field :invitable_id
+      field :invited_by_type, type: String
+      field :invited_by_id
+
+      index({ invitation_token: 1 }, unique: true, sparse: true)
+      index({ invitable_type: 1, invitable_id: 1 })
+      index({ invited_by_type: 1, invited_by_id: 1 })
+      index({ invitable_type: 1, invite_key_digest: 1 })
+    end
+
+    belongs_to :invitable, polymorphic: true, optional: true
+    invited_by_options = { polymorphic: true, optional: true, autosave: true }
+    if defined?(ActiveRecord::Base) && Devise.invited_by_counter_cache
+      invited_by_options[:counter_cache] = Devise.invited_by_counter_cache
+    end
+    belongs_to :invited_by, **invited_by_options
+
+    before_validation :set_invite_key_digest
+
+    scope :pending, lambda {
+      where(invitation_accepted_at: nil, superseded_at: nil, revoked_at: nil)
+    }
+    if defined?(Mongoid::Document) && !defined?(ActiveRecord::Base)
+      scope :provisioning, -> { where(:resource_created_at.ne => nil) }
+      scope :accepted, -> { where(:invitation_accepted_at.ne => nil) }
+    else
+      scope :provisioning, -> { where.not(resource_created_at: nil) }
+      scope :accepted, -> { where.not(invitation_accepted_at: nil) }
+    end
+
+    def pending?
+      invitation_accepted_at.nil? && superseded_at.nil? && revoked_at.nil?
+    end
+
+    def provisioning?
+      resource_created_at.present?
+    end
+
+    def invitation_period_valid?(period)
+      period.to_i.zero? || (invitation_created_at && invitation_created_at.utc >= period.ago)
+    end
+
+    def invite_key
+      value = super
+      value.respond_to?(:with_indifferent_access) ? value.with_indifferent_access : value
+    end
+
+    def self.digest_for(resource_type, invite_key)
+      components = invite_key.to_h.map { |key, value| [key.to_s, value.to_s] }.sort.flatten
+      Digest::SHA256.hexdigest(([resource_type] + components).join("\0"))
+    end
+
+    private
+
+      def set_invite_key_digest
+        self.invite_key_digest = self.class.digest_for(invitable_type, invite_key)
+      end
+  end
+end

data/lib/devise_invitable/inviter.rb

@@ -3,17 +3,32 @@ module DeviseInvitable
     extend ActiveSupport::Concern
 
     included do
+      has_many :sent_invitations,
+        class_name: 'DeviseInvitable::Invitation',
+        as: :invited_by,
+        dependent: :nullify
+
       extend ClassMethods
       attr_writer :invitation_limit unless respond_to? :invitation_limit
     end
 
     def invitation_limit
-      self[:invitation_limit] || self.class.invitation_limit
+      stored_limit =
+        if invitation_limit_attribute?
+          self[:invitation_limit]
+        else
+          @invitation_limit
+        end
+      stored_limit || self.class.invitation_limit
     end
 
     # Return true if this user has invitations left to send
     def has_invitations_left?
       if self.class.invitation_limit.present?
+        unless invitation_limit_attribute?
+          return sent_invitations.count < self.class.invitation_limit
+        end
+
         if invitation_limit
           return invitation_limit > 0
         else
@@ -28,11 +43,18 @@ module DeviseInvitable
 
       def decrement_invitation_limit!
         if self.class.invitation_limit.present?
+          return unless invitation_limit_attribute?
+
           self.invitation_limit ||= self.class.invitation_limit
           self.update_attribute(:invitation_limit, invitation_limit - 1)
         end
       end
 
+      def invitation_limit_attribute?
+        (respond_to?(:has_attribute?) && has_attribute?(:invitation_limit)) ||
+          (self.class.respond_to?(:fields) && self.class.fields.key?('invitation_limit'))
+      end
+
       module ClassMethods
         Devise::Models.config(self, :invitation_limit)
       end