devise_invitable 2.0.14 → 3.0.1

data/lib/devise_invitable.rb

@@ -1,6 +1,11 @@
 module DeviseInvitable
+  class AmbiguousInviteKeyError < StandardError; end
+  class ResourceAttributesRequirePlaceholderError < ArgumentError; end
+
   autoload :Inviter, 'devise_invitable/inviter'
+  autoload :Invitation, 'devise_invitable/invitation'
   autoload :Mailer, 'devise_invitable/mailer'
+  autoload :Migrator, 'devise_invitable/migrator'
   autoload :Mapping, 'devise_invitable/mapping'
   autoload :ParameterSanitizer, 'devise_invitable/parameter_sanitizer'
   module Controllers
@@ -10,6 +15,7 @@ module DeviseInvitable
 end
 
 require 'devise'
+require 'active_support/deprecation'
 require 'devise_invitable/routes'
 require 'devise_invitable/rails'
 
@@ -58,16 +64,26 @@ module Devise
   mattr_accessor :resend_invitation
   @@resend_invitation = true
 
-  # Public: The class name of the inviting model. If this is nil,
-  # the #invited_by association is declared to be polymorphic. (default: nil)
+  # Deprecated compatibility setting. Invitations now always use a polymorphic
+  # invited_by association.
   mattr_accessor :invited_by_class_name
   @@invited_by_class_name = nil
 
-  # Public: The foreign key to the inviting model (if invited_by_class_name is set)
-  # (default: :invited_by_id)
+  def self.invited_by_class_name=(value)
+    DeviseInvitable.warn_deprecated_invited_by_setting(:invited_by_class_name)
+    @@invited_by_class_name = value
+  end
+
+  # Deprecated compatibility setting. The shared invitations table always uses
+  # invited_by_id and invited_by_type.
   mattr_accessor :invited_by_foreign_key
   @@invited_by_foreign_key = nil
 
+  def self.invited_by_foreign_key=(value)
+    DeviseInvitable.warn_deprecated_invited_by_setting(:invited_by_foreign_key)
+    @@invited_by_foreign_key = value
+  end
+
   # Public: The column name used for counter_cache column. If this is nil,
   # the #invited_by association is declared without counter_cache. (default: nil)
   mattr_accessor :invited_by_counter_cache
@@ -83,6 +99,26 @@ module Devise
   # set when user is invited or it will be set later (default: true).
   mattr_accessor :require_password_on_accepting
   @@require_password_on_accepting = true
+
+  # Public: Create the invited resource as soon as an invitation is sent.
+  # When false, only the invitation and its invite keys are persisted and the
+  # resource is created when the invitation is accepted.
+  mattr_accessor :create_resource_on_invitation
+  @@create_resource_on_invitation = false
+end
+
+module DeviseInvitable
+  def self.deprecator
+    @deprecator ||= ActiveSupport::Deprecation.new('3.0', 'DeviseInvitable')
+  end
+
+  def self.warn_deprecated_invited_by_setting(setting)
+    deprecator.warn(
+      "The #{setting} setting is deprecated and has no effect. " \
+      "Invitations now always use a polymorphic invited_by association " \
+      "with invited_by_id and invited_by_type."
+    )
+  end
 end
 
 Devise.add_module :invitable, controller: :invitations, model: 'devise_invitable/models', route: { invitation: [nil, :new, :accept] }

data/lib/generators/active_record/devise_invitable_install_generator.rb

@@ -0,0 +1,22 @@
+require 'rails/generators/active_record'
+
+module ActiveRecord
+  module Generators
+    class DeviseInvitableInstallGenerator < ActiveRecord::Generators::Base
+      source_root File.expand_path('../templates', __FILE__)
+      argument :name, type: :string, default: 'devise_invitation'
+
+      def copy_devise_invitations_migration
+        migration_template 'create_devise_invitations.rb',
+          'db/migrate/create_devise_invitations.rb',
+          migration_version: migration_version
+      end
+
+      def migration_version
+        if Rails::VERSION::MAJOR >= 5
+          "[#{Rails::VERSION::MAJOR}.#{Rails::VERSION::MINOR}]"
+        end
+      end
+    end
+  end
+end

data/lib/generators/active_record/devise_invitable_upgrade_generator.rb

@@ -0,0 +1,28 @@
+require 'rails/generators/active_record'
+
+module ActiveRecord
+  module Generators
+    class DeviseInvitableUpgradeGenerator < ActiveRecord::Generators::Base
+      source_root File.expand_path('../templates', __FILE__)
+
+      class_option :invite_keys, type: :array, default: ['email']
+
+      def copy_upgrade_migration
+        migration_template 'upgrade_devise_invitations.rb',
+          "db/migrate/upgrade_#{table_name}_devise_invitations.rb",
+          migration_version: migration_version,
+          invite_keys: options[:invite_keys]
+      end
+
+      def migration_version
+        if Rails::VERSION::MAJOR >= 5
+          "[#{Rails::VERSION::MAJOR}.#{Rails::VERSION::MINOR}]"
+        end
+      end
+
+      def invite_keys
+        options[:invite_keys]
+      end
+    end
+  end
+end

data/lib/generators/active_record/templates/create_devise_invitations.rb

@@ -0,0 +1,23 @@
+class CreateDeviseInvitations < ActiveRecord::Migration<%= migration_version %>
+  def change
+    create_table :devise_invitations do |t|
+      t.string :invitation_token
+      t.datetime :invitation_created_at
+      t.datetime :invitation_sent_at
+      t.datetime :invitation_accepted_at
+      t.datetime :superseded_at
+      t.string :superseded_reason
+      t.datetime :revoked_at
+      t.datetime :resource_created_at
+      t.json :invite_key, null: false, default: {}
+      t.string :invite_key_digest, null: false
+      t.references :invitable, polymorphic: true
+      t.references :invited_by, polymorphic: true
+      t.timestamps
+    end
+
+    add_index :devise_invitations, :invitation_token, unique: true
+    add_index :devise_invitations, [:invitable_type, :invite_key_digest],
+      name: 'index_devise_invitations_on_type_and_invite_key'
+  end
+end

data/lib/generators/active_record/templates/upgrade_devise_invitations.rb

@@ -0,0 +1,72 @@
+require 'digest'
+
+class Upgrade<%= table_name.camelize %>DeviseInvitations < ActiveRecord::Migration<%= migration_version %>
+  OLD_INVITATION_COLUMNS = %i[
+    invitation_token invitation_created_at invitation_sent_at
+    invitation_accepted_at invited_by_id invited_by_type
+  ].freeze
+
+  def up
+    create_devise_invitations_table unless table_exists?(:devise_invitations)
+
+    resource_class = Class.new(ActiveRecord::Base) do
+      self.table_name = '<%= table_name %>'
+      self.inheritance_column = :_type_disabled
+    end
+    invitation_class = Class.new(ActiveRecord::Base) do
+      self.table_name = 'devise_invitations'
+    end
+
+    resource_class.where.not(invitation_created_at: nil).find_each do |resource|
+      invite_key = resource.attributes.slice(<%= invite_keys.map(&:to_s).map(&:inspect).join(', ') %>)
+      digest_components = invite_key.map { |key, value| [key.to_s, value.to_s] }.sort.flatten
+      invitation_class.create!(
+        invitation_token: resource.invitation_token,
+        invitation_created_at: resource.invitation_created_at,
+        invitation_sent_at: resource.invitation_sent_at,
+        invitation_accepted_at: resource.invitation_accepted_at,
+        resource_created_at: resource.invitation_created_at,
+        invite_key: invite_key,
+        invite_key_digest: Digest::SHA256.hexdigest((['<%= class_name %>'] + digest_components).join("\0")),
+        invitable_type: '<%= class_name %>',
+        invitable_id: resource.id,
+        invited_by_type: resource.invited_by_type,
+        invited_by_id: resource.invited_by_id,
+        created_at: resource.invitation_created_at,
+        updated_at: resource.invitation_accepted_at || resource.invitation_sent_at || resource.invitation_created_at
+      )
+    end
+
+    OLD_INVITATION_COLUMNS.each do |column|
+      remove_column :<%= table_name %>, column if column_exists?(:<%= table_name %>, column)
+    end
+  end
+
+  def down
+    raise ActiveRecord::IrreversibleMigration,
+      'Multiple invitation records cannot be losslessly moved back onto <%= table_name %>'
+  end
+
+  private
+
+    def create_devise_invitations_table
+      create_table :devise_invitations do |t|
+        t.string :invitation_token
+        t.datetime :invitation_created_at
+        t.datetime :invitation_sent_at
+        t.datetime :invitation_accepted_at
+        t.datetime :superseded_at
+        t.string :superseded_reason
+        t.datetime :revoked_at
+        t.datetime :resource_created_at
+        t.json :invite_key, null: false, default: {}
+        t.string :invite_key_digest, null: false
+        t.references :invitable, polymorphic: true
+        t.references :invited_by, polymorphic: true
+        t.timestamps
+      end
+      add_index :devise_invitations, :invitation_token, unique: true
+      add_index :devise_invitations, [:invitable_type, :invite_key_digest],
+        name: 'index_devise_invitations_on_type_and_invite_key'
+    end
+end

data/lib/generators/devise_invitable/devise_invitable_generator.rb

@@ -3,14 +3,12 @@ module DeviseInvitable
     class DeviseInvitableGenerator < Rails::Generators::NamedBase
       namespace 'devise_invitable'
 
-      desc 'Add :invitable directive in the given model. Also generate migration for ActiveRecord'
+      desc 'Add the :invitable directive to the given model.'
 
       def inject_devise_invitable_content
         path = File.join('app', 'models', "#{file_path}.rb")
         inject_into_file(path, 'invitable, :', after: 'devise :') if File.exist?(path)
       end
-
-      hook_for :orm
     end
   end
-end
+end

data/lib/generators/devise_invitable/install_generator.rb

@@ -2,14 +2,16 @@ module DeviseInvitable
   module Generators
     class InstallGenerator < Rails::Generators::Base
       source_root File.expand_path('../../templates', __FILE__)
-      desc 'Add DeviseInvitable config variables to the Devise initializer and copy DeviseInvitable locale files to your application.'
+      desc 'Install the invitations store, add configuration, and copy the English locale.'
+
+      hook_for :orm, as: :devise_invitable_install
 
       def add_config_options_to_initializer
         devise_initializer_path = 'config/initializers/devise.rb'
         if File.exist?(devise_initializer_path)
           old_content = File.read(devise_initializer_path)
 
-          if old_content.match(Regexp.new(/^\s# ==> Configuration for :invitable\n/))
+          if old_content.match(/^\s*# ==> Configuration for :invitable\n/)
             false
           else
             inject_into_file(devise_initializer_path, before: "  # ==> Configuration for :confirmable\n") do
@@ -44,14 +46,10 @@ module DeviseInvitable
   # Default: true
   # config.resend_invitation = false
 
-  # The class name of the inviting model. If this is nil,
-  # the #invited_by association is declared to be polymorphic.
-  # Default: nil
-  # config.invited_by_class_name = 'User'
-
-  # The foreign key to the inviting model (if invited_by_class_name is set)
-  # Default: :invited_by_id
-  # config.invited_by_foreign_key = :invited_by_id
+  # Create a placeholder resource as soon as an invitation is sent. When false,
+  # the resource is created only after the invitation is accepted.
+  # Default: false
+  # config.create_resource_on_invitation = true
 
   # The column name used for counter_cache column. If this is nil,
   # the #invited_by association is declared without counter_cache.

data/lib/generators/devise_invitable/upgrade_generator.rb

@@ -0,0 +1,16 @@
+module DeviseInvitable
+  module Generators
+    class UpgradeGenerator < Rails::Generators::NamedBase
+      namespace 'devise_invitable:upgrade'
+
+      class_option :invite_keys,
+        type: :array,
+        default: ['email'],
+        desc: 'Columns used as invite keys in the old resource table'
+
+      desc 'Generate a migration from resource-backed invitations to the invitations table.'
+
+      hook_for :orm, as: :devise_invitable_upgrade
+    end
+  end
+end

data/lib/generators/mongoid/devise_invitable_install_generator.rb

@@ -0,0 +1,7 @@
+module Mongoid
+  module Generators
+    class DeviseInvitableInstallGenerator < Rails::Generators::Base
+      desc 'DeviseInvitable stores its Mongoid field definitions in the gem model.'
+    end
+  end
+end

data/lib/generators/mongoid/devise_invitable_upgrade_generator.rb

@@ -0,0 +1,11 @@
+module Mongoid
+  module Generators
+    class DeviseInvitableUpgradeGenerator < Rails::Generators::NamedBase
+      desc 'Print the Mongoid invitation data migration command.'
+
+      def show_migration_task
+        say "Run: bin/rails devise_invitable:migrate_invitations[#{class_name}]"
+      end
+    end
+  end
+end

data/lib/tasks/devise_invitable_tasks.rake

@@ -0,0 +1,10 @@
+namespace :devise_invitable do
+  desc 'Move legacy invitation fields into devise_invitations (MODEL=User also supported)'
+  task :migrate_invitations, [:model] => :environment do |_task, args|
+    model_name = args[:model] || ENV['MODEL']
+    raise ArgumentError, 'Pass a model name: rake devise_invitable:migrate_invitations[User]' if model_name.blank?
+
+    count = DeviseInvitable::Migrator.call(model_name.constantize)
+    puts "Migrated #{count} invitation#{'s' unless count == 1} for #{model_name}"
+  end
+end

data/test/functional/registrations_controller_test.rb

@@ -25,6 +25,7 @@ class DeviseInvitable::RegistrationsControllerTest < ActionController::TestCase
     sign_out @issuer
 
     @invitee = User.where(email: invitee_email).first
+    invitation = @invitee.current_invitation
     assert_nil @invitee.invitation_accepted_at
     assert_not_nil @invitee.invitation_token
     assert !@invitee.confirmed?
@@ -45,10 +46,11 @@ class DeviseInvitable::RegistrationsControllerTest < ActionController::TestCase
     end
 
     assert @invitee.encrypted_password.present?
-    assert_not_nil @invitee.invitation_accepted_at
+    assert_nil @invitee.invitation_accepted_at
     assert_nil @invitee.invitation_token
-    assert @invitee.invited_by_id.present?
-    assert @invitee.invited_by_type.present?
+    assert_equal 'registered', invitation.reload.superseded_reason
+    assert_equal @issuer, invitation.invited_by
+    refute_predicate @invitee, :invitation_pending?
     assert @invitee.confirmation_token.present?
     assert !@invitee.confirmed?
   end
@@ -79,6 +81,25 @@ class DeviseInvitable::RegistrationsControllerTest < ActionController::TestCase
     assert !@user.confirmed?
   end
 
+  test "registration supersedes invitations when placeholders are disabled" do
+    User.create_resource_on_invitation = false
+    invitee_email = 'deferred@example.org'
+    User.invite!(email: invitee_email)
+    invitation = DeviseInvitable::Invitation.first
+
+    assert_nil User.where(email: invitee_email).first
+
+    post :create, params: { user: { email: invitee_email, password: '1password', bio: '.' } }
+
+    invitee = User.find_by!(email: invitee_email)
+    assert_equal invitee, invitation.reload.invitable
+    assert_equal 'registered', invitation.superseded_reason
+    assert_nil invitation.invitation_accepted_at
+    refute_predicate invitee, :invitation_pending?
+  ensure
+    User.create_resource_on_invitation = true
+  end
+
   test "not invitable resources can register" do
     @request.env['devise.mapping'] = Devise.mappings[:admin]
     invitee_email = 'invitee@example.org'

data/test/generators_test.rb

@@ -6,30 +6,37 @@ require 'generators/devise_invitable/devise_invitable_generator'
 class GeneratorsTest < ActiveSupport::TestCase
   RAILS_APP_PATH = File.expand_path("../rails_app", __FILE__)
 
-  test "rails g should include the 6 generators" do
+  test "rails g should include the generators" do
     @output     = `cd #{RAILS_APP_PATH} && rails g`
-    generators  = %w/devise_invitable devise_invitable:form_for devise_invitable:install devise_invitable:invitation_views devise_invitable:simple_form_for devise_invitable:views/
+    generators  = %w/devise_invitable devise_invitable:form_for devise_invitable:install devise_invitable:invitation_views devise_invitable:simple_form_for devise_invitable:upgrade devise_invitable:views/
 
     generators.each do |generator|
-      @output.include? generator
+      assert_includes @output, generator
     end
   end
 
   test "rails g devise_invitable:install" do
     @output = `cd #{RAILS_APP_PATH} && rails g devise_invitable:install -p`
-    puts @output
-    assert @output.match(%r{(inject|insert|File unchanged! The supplied flag value not found!).*  config/initializers/devise\.rb\n})
     assert @output.match(%r|create.*  config/locales/devise_invitable\.en\.yml\n|)
+    if DEVISE_ORM == :active_record
+      assert_match(%r|create.*db/migrate/\d{14}_create_devise_invitations\.rb|, @output)
+    end
   end
 
   test "rails g devise_invitable Octopussy" do
     @output = `cd #{RAILS_APP_PATH} && rails g devise_invitable Octopussy -p`
     assert @output.match(%r{(inject|insert|File unchanged! The supplied flag value not found!).*  app/models/octopussy\.rb\n})
-    assert @output.match(%r|invoke.*  #{DEVISE_ORM}\n|)
+    assert_no_match(%r|invoke.*  #{DEVISE_ORM}\n|, @output)
+    assert_no_match(%r|db/migrate/\d{14}_devise_invitable_add_to_octopussies\.rb|, @output)
+  end
+
+
+  test "rails g devise_invitable:upgrade User" do
+    @output = `cd #{RAILS_APP_PATH} && rails g devise_invitable:upgrade User -p`
     if DEVISE_ORM == :active_record
-      assert @output.match(%r|create.*  db/migrate/\d{14}_devise_invitable_add_to_octopussies\.rb\n|)
-    elsif DEVISE_ORM == :mongoid
-      assert !@output.match(%r|create.*  db/migrate/\d{14}_devise_invitable_add_to_octopussies\.rb\n|)
+      assert_match(%r|create.*db/migrate/\d{14}_upgrade_users_devise_invitations\.rb|, @output)
+    else
+      assert_match(/devise_invitable:migrate_invitations\[User\]/, @output)
     end
   end
 end

data/test/integration/invitation_test.rb

@@ -152,7 +152,7 @@ class InvitationTest < ActionDispatch::IntegrationTest
 
     visit new_user_password_path
     fill_in 'user_email', with: 'valid@email.com'
-    click_button 'Send me reset password instructions'
+    find('input[type="submit"]').click
 
     visit edit_user_password_path(reset_password_token: Thread.current[:token])
     set_password visit: false, button: 'Change my password'
@@ -209,7 +209,7 @@ class InvitationTest < ActionDispatch::IntegrationTest
     assert_equal 2, user.invitation_limit
   end
 
-  test 'should not decrement invitation limit when trying to invite again a user which is invited' do
+  test 'should decrement invitation limit for each invitation record' do
     User.stubs(:invitation_limit).returns(3)
 
     user = create_full_user
@@ -227,7 +227,7 @@ class InvitationTest < ActionDispatch::IntegrationTest
     assert_equal root_path, current_path
     assert page.has_css?('p#notice', text: 'An invitation email has been sent to user@test.com.')
     user = User.find(user.id)
-    assert_equal 2, user.invitation_limit
+    assert_equal 1, user.invitation_limit
   end
 
   test 'invited_by should be set when user invites someone' do
@@ -247,6 +247,27 @@ class InvitationTest < ActionDispatch::IntegrationTest
     assert_redirected_to new_admin_session_path
   end
 
+  test 'custom inviter authentication can redirect without rendering twice' do
+    sign_in_as_user
+
+    get new_restricted_invitation_path
+
+    assert_redirected_to root_path
+    assert_equal 'You are not authorized to access this page', flash[:alert]
+  end
+
+  test 'boolean inviter authentication uses the signed in resource as inviter' do
+    inviter = User.create!(
+      email: 'boolean-inviter@example.com',
+      password: '123456',
+      password_confirmation: '123456'
+    )
+
+    post boolean_inviter_invitation_path, params: { user: { email: 'boolean-invitee@example.com' } }
+
+    assert_equal inviter, User.find_by!(email: 'boolean-invitee@example.com').invited_by
+  end
+
   test 'authenticated admin should be able to send an admin invitation' do
     admin = Admin.create(email: 'admin@test.com', password: '123456', password_confirmation: '123456')
     sign_in_as_user admin

data/test/mailers/invitation_mail_test.rb

@@ -101,6 +101,7 @@ class InvitationMailTest < ActionMailer::TestCase
 
       def initialize(*args); end
       def deliver; end
+      def deliver_now; end
     end
     Devise.mailer = 'InvitationMailTest::CustomMailer'
 

data/test/models/invitable_test.rb

@@ -15,6 +15,17 @@ class InvitableTest < ActiveSupport::TestCase
     assert_nil new_user.invitation_token
   end
 
+  test 'accepting_invitation? does not warn before invitation acceptance' do
+    original_verbose = $VERBOSE
+    $VERBOSE = true
+
+    _, warnings = capture_io { refute_predicate new_user, :accepting_invitation? }
+
+    refute_includes warnings, 'instance variable @accepting_invitation not initialized'
+  ensure
+    $VERBOSE = original_verbose
+  end
+
   test 'should update the invitations count counter cache' do
     if defined?(ActiveRecord)
       current_user = new_user
@@ -430,6 +441,30 @@ class InvitableTest < ActiveSupport::TestCase
     assert_equal [{error: :taken}], same_user.errors.details[:email]
   end
 
+  test 'should not modify associations when an existing user cannot be invited' do
+    existing_user = User.create!(email: 'existing@email.com', password: '123456789')
+    User.invite!({ email: 'invitee@email.com' }, existing_user)
+    sent_invitation = existing_user.sent_invitations.first
+
+    invited_user = User.invite!(
+      email: existing_user.email,
+      sent_invitation_ids: []
+    )
+
+    assert_equal [{ error: :taken }], invited_user.errors.details[:email]
+    assert_equal existing_user, sent_invitation.reload.invited_by
+  end
+
+  test 'should reject an invite key that matches multiple records' do
+    2.times do
+      User.new(email: 'duplicate@email.com').save(validate: false)
+    end
+
+    assert_raises DeviseInvitable::AmbiguousInviteKeyError do
+      User.invite!(email: 'duplicate@email.com')
+    end
+  end
+
   test 'should return a record with errors if user with pending invitation was found by e-mail' do
     existing_user = User.invite!(email: 'valid@email.com')
     user = User.invite!(email: 'valid@email.com')
@@ -447,7 +482,7 @@ class InvitableTest < ActiveSupport::TestCase
     end
   end
 
-  test 'should return a record with errors if user was found by e-mail with validate_on_invite' do
+  test 'should not assign or validate other attributes if user was found by e-mail' do
     begin
       validate_on_invite = User.validate_on_invite
       User.validate_on_invite = true
@@ -456,7 +491,8 @@ class InvitableTest < ActiveSupport::TestCase
       user = User.invite!(email: 'valid@email.com', username: 'a' * 50)
       assert_equal user, existing_user
       assert_equal [{error: :taken}], user.errors.details[:email]
-      refute_empty user.errors[:username]
+      assert_empty user.errors[:username]
+      assert_nil user.username
     ensure
       User.validate_on_invite = validate_on_invite
     end
@@ -741,8 +777,10 @@ class InvitableTest < ActiveSupport::TestCase
 
   test "user.invite! should trigger callbacks" do
     user = User.new(email: 'valid@email.com')
+    assert_callbacks_not_fired :before_invitation_created, user
     assert_callbacks_not_fired :after_invitation_created, user
     user.invite!
+    assert_callbacks_fired :before_invitation_created, user
     assert_callbacks_fired :after_invitation_created, user
   end