devise_invitable 2.0.14 → 3.0.1

data/test/models/separate_invitations_test.rb

@@ -0,0 +1,181 @@
+require 'test_helper'
+require 'model_tests_helper'
+
+class SeparateInvitationsTest < ActiveSupport::TestCase
+  setup do
+    @create_resource_on_invitation = User.create_resource_on_invitation
+    DeviseInvitable::Invitation.delete_all
+  end
+
+  teardown do
+    User.create_resource_on_invitation = @create_resource_on_invitation
+  end
+
+  test 'an invitation can be persisted without creating a resource' do
+    User.create_resource_on_invitation = false
+    registered = User.create!(email: 'registered@example.com', password: '123456789')
+
+    invited = User.invite!(email: 'deferred@example.com')
+    invitation = DeviseInvitable::Invitation.first
+
+    assert_predicate invited, :new_record?
+    assert_equal 0, User.where(email: 'deferred@example.com').count
+    assert_equal({ 'email' => 'deferred@example.com' }, invitation.invite_key.to_h.stringify_keys)
+    assert_nil invitation.invitable_id
+    assert_nil invitation.resource_created_at
+    assert_includes User.no_active_invitation, registered
+  end
+
+  test 'accepting one of multiple invitations creates the resource and supersedes the others' do
+    User.create_resource_on_invitation = false
+    first_inviter = User.create!(email: 'first@example.com', password: '123456789')
+    second_inviter = User.create!(email: 'second@example.com', password: '123456789')
+
+    User.invite!({ email: 'multiple@example.com' }, first_inviter)
+    first = DeviseInvitable::Invitation.order(id: :asc).first
+    User.invite!({ email: 'multiple@example.com' }, second_inviter)
+    accepted_token = Thread.current[:token]
+
+    user = User.accept_invitation!(
+      invitation_token: accepted_token,
+      password: '123456789',
+      password_confirmation: '123456789'
+    )
+
+    assert_predicate user, :persisted?
+    refute_predicate user, :invitation_pending?
+    assert DeviseInvitable::Invitation.accepted.where(invitable: user).exists?
+    assert_equal 'accepted_other_invitation', first.reload.superseded_reason
+    assert_equal first_inviter, first.invited_by
+    assert_equal second_inviter, DeviseInvitable::Invitation.accepted.find_by!(invitable: user).invited_by
+    assert_equal user, first.invitable
+  end
+
+  test 'resending stages the new inviter without changing the previous invitation' do
+    User.create_resource_on_invitation = true
+    first_inviter = User.create!(email: 'first@example.com', password: '123456789')
+    second_inviter = User.create!(email: 'second@example.com', password: '123456789')
+
+    User.invite!({ email: 'multiple@example.com' }, first_inviter)
+    first_invitation = DeviseInvitable::Invitation.order(id: :asc).first
+
+    User.invite!({ email: 'multiple@example.com' }, second_inviter) do |invitable|
+      assert_equal second_inviter, invitable.invited_by
+      assert_equal second_inviter, invitable.invited_by_for_next_invitation
+    end
+
+    assert_equal first_inviter, first_invitation.reload.invited_by
+    assert_equal second_inviter, DeviseInvitable::Invitation.order(id: :asc).last.invited_by
+  end
+
+  test 'an inviter exposes its sent invitations' do
+    inviter = Admin.create!(email: 'admin@example.com', password: '123456789')
+
+    User.invite!({ email: 'invited@example.com' }, inviter)
+
+    assert_equal [DeviseInvitable::Invitation.last], inviter.sent_invitations.to_a
+  end
+
+  test 'deleting an inviter preserves sent invitations' do
+    inviter = Admin.create!(email: 'admin@example.com', password: '123456789')
+    User.invite!({ email: 'invited@example.com' }, inviter)
+    invitation = DeviseInvitable::Invitation.last
+
+    inviter.destroy!
+
+    assert_predicate invitation.reload, :persisted?
+    assert_nil invitation.invited_by
+  end
+
+  test 'a placeholder is inactive until an invitation is accepted' do
+    User.create_resource_on_invitation = true
+
+    user = User.invite!(email: 'placeholder@example.com')
+    user.update!(confirmed_at: Time.now.utc)
+
+    assert_predicate user, :invitation_pending?
+    refute_predicate user, :active_for_authentication?
+    assert_nil user.valid_password?('unknown')
+
+    user.password = user.password_confirmation = '123456789'
+    assert user.accept_invitation!
+    refute_predicate user.reload, :invitation_pending?
+    assert_predicate user, :active_for_authentication?
+  end
+
+  test 'resource attributes raise when placeholder creation is disabled' do
+    User.create_resource_on_invitation = false
+
+    error = assert_raises DeviseInvitable::ResourceAttributesRequirePlaceholderError do
+      User.invite!(email: 'attributes@example.com', username: 'invited')
+    end
+
+    assert_includes error.message, 'username'
+    assert_includes error.message, 'create_resource_on_invitation is disabled'
+    assert_equal 0, DeviseInvitable::Invitation.count
+  end
+
+  test 'resource attributes assigned by a block raise when placeholder creation is disabled' do
+    User.create_resource_on_invitation = false
+
+    error = assert_raises DeviseInvitable::ResourceAttributesRequirePlaceholderError do
+      User.invite!(email: 'attributes@example.com') do |invitable|
+        invitable.username = 'invited'
+      end
+    end
+
+    assert_includes error.message, 'username'
+    assert_equal 0, DeviseInvitable::Invitation.count
+  end
+
+  test 'deferred invitations validate their invite keys' do
+    User.create_resource_on_invitation = false
+
+    invited = User.invite!(email: 'not-an-email')
+
+    assert_includes invited.errors.details[:email], error: :invalid
+    assert_equal 0, DeviseInvitable::Invitation.count
+  end
+
+  test 'legacy invitation data migration is idempotent' do
+    skip unless DEVISE_ORM == :mongoid
+
+    user = User.create!(email: 'legacy@example.com', password: '123456789')
+    created_at = 1.day.ago
+    User.collection.find(_id: user.id).update_one(
+      '$set' => {
+        invitation_token: 'legacy-digest',
+        invitation_created_at: created_at,
+        invitation_sent_at: created_at,
+        invited_by_type: 'User'
+      }
+    )
+
+    assert_equal 1, DeviseInvitable::Migrator.call(User)
+    assert_equal 0, DeviseInvitable::Migrator.call(User)
+
+    invitation = DeviseInvitable::Invitation.find_by!(invitation_token: 'legacy-digest')
+    assert_equal user, invitation.invitable
+    assert_equal({ 'email' => 'legacy@example.com' }, invitation.invite_key.to_h.stringify_keys)
+    assert_equal created_at.to_i, invitation.resource_created_at.to_i
+  end
+
+  test 'legacy invitation migration processes multiple resources in a batch' do
+    skip unless DEVISE_ORM == :mongoid
+
+    first = User.create!(email: 'first-legacy@example.com', password: '123456789')
+    second = User.create!(email: 'second-legacy@example.com', password: '123456789')
+    created_at = 1.day.ago
+    User.collection.find(_id: first.id).update_one(
+      '$set' => { invitation_token: 'first-legacy-digest', invitation_created_at: created_at }
+    )
+    User.collection.find(_id: second.id).update_one(
+      '$set' => { invitation_token: 'second-legacy-digest', invitation_created_at: created_at }
+    )
+
+    assert_equal 2, DeviseInvitable::Migrator.call(User)
+    assert_equal 2, DeviseInvitable::Invitation.where(:invitable_id.in => [first.id, second.id]).count
+    refute first.reload.attributes.key?('invitation_created_at')
+    refute second.reload.attributes.key?('invitation_created_at')
+  end
+end

data/test/models_test.rb

@@ -32,10 +32,19 @@ class ModelsTest < ActiveSupport::TestCase
     assert_nil User.invitation_limit
   end
 
+  test 'does not create placeholder resources by default' do
+    assert_equal false, Devise.create_resource_on_invitation
+  end
+
   test 'should have a default value for invite_key' do
     assert !User.invite_key.nil?
   end
 
+  test 'uses the root model class for invitations' do
+    assert_equal User, User.devise_invitable_base_class
+    assert_equal User, Invitable.devise_invitable_base_class
+  end
+
   test 'set a custom value for invite_for' do
     old_invite_for = User.invite_for
     User.invite_for = 5.days
@@ -63,6 +72,31 @@ class ModelsTest < ActiveSupport::TestCase
     User.invitation_limit = old_invitation_limit
   end
 
+  test 'warns when deprecated invited_by settings are configured globally' do
+    DeviseInvitable.deprecator.expects(:warn).with(includes('invited_by_class_name')).once
+    DeviseInvitable.deprecator.expects(:warn).with(includes('invited_by_foreign_key')).once
+
+    Devise.invited_by_class_name = 'Admin'
+    Devise.invited_by_foreign_key = :inviter_id
+  ensure
+    Devise.class_variable_set(:@@invited_by_class_name, nil)
+    Devise.class_variable_set(:@@invited_by_foreign_key, nil)
+  end
+
+  test 'warns when deprecated invited_by settings are configured on a model' do
+    DeviseInvitable.deprecator.expects(:warn).with(includes('invited_by_class_name')).once
+    DeviseInvitable.deprecator.expects(:warn).with(includes('invited_by_foreign_key')).once
+
+    model = Class.new(User) do
+      devise :invitable,
+        invited_by_class_name: 'Admin',
+        invited_by_foreign_key: :inviter_id
+    end
+
+    assert_equal 'Admin', model.invited_by_class_name
+    assert_equal :inviter_id, model.invited_by_foreign_key
+  end
+
   test 'set a default value for validate_on_invite' do
     assert_equal true, Invitable.validate_on_invite
   end

data/test/rails_app/app/controllers/boolean_inviter_invitations_controller.rb

@@ -0,0 +1,11 @@
+class BooleanInviterInvitationsController < Devise::InvitationsController
+  protected
+
+    def authenticate_inviter!
+      true
+    end
+
+    def current_user
+      User.find_by(email: 'boolean-inviter@example.com')
+    end
+end

data/test/rails_app/app/controllers/restricted_invitations_controller.rb

@@ -0,0 +1,9 @@
+class RestrictedInvitationsController < Devise::InvitationsController
+  protected
+
+    def authenticate_inviter!
+      return if current_admin
+
+      redirect_back fallback_location: root_path, alert: 'You are not authorized to access this page'
+    end
+end

data/test/rails_app/app/models/user.rb

@@ -34,9 +34,11 @@ class User < PARENT_MODEL_CLASS
     validates_presence_of :encrypted_password, if: :password_required?
   end
 
-  devise :database_authenticatable, :registerable, :validatable, :confirmable, :invitable, :recoverable
+  devise :database_authenticatable, :registerable, :validatable, :confirmable, :invitable, :recoverable,
+    create_resource_on_invitation: true
 
-  attr_accessor :after_invitation_created_callback_works, :after_invitation_accepted_callback_works, :bio, :token
+  attr_accessor :before_invitation_created_callback_works, :after_invitation_created_callback_works,
+    :after_invitation_accepted_callback_works, :bio, :token
   validates :username, length: { maximum: 20 }
 
   attr_accessor :testing_accepted_or_not_invited
@@ -52,6 +54,10 @@ class User < PARENT_MODEL_CLASS
     object.after_invitation_created_callback_works = true
   end
 
+  before_invitation_created do |object|
+    object.before_invitation_created_callback_works = true
+  end
+
   after_invitation_accepted do |object|
     object.after_invitation_accepted_callback_works = true
   end

data/test/rails_app/config/initializers/devise.rb

@@ -120,15 +120,6 @@ Devise.setup do |config|
   # Default: true
   # config.resend_invitation = false
 
-  # The class name of the inviting model. If this is nil,
-  # the #invited_by association is declared to be polymorphic.
-  # Default: nil
-  # config.invited_by_class_name = 'User'
-
-  # The foreign key to the inviting model (if invited_by_class_name is set)
-  # Default: :invited_by_id
-  # config.invited_by_foreign_key = :invited_by_id
-
   # The column name used for counter_cache column. If this is nil,
   # the #invited_by association is declared without counter_cache.
   # Default: nil

data/test/rails_app/config/routes.rb

@@ -1,7 +1,9 @@
 RailsApp::Application.routes.draw do
   devise_for :users
   devise_scope :user do
+    resource :boolean_inviter_invitation, only: [:new, :create]
     resource :free_invitation, only: [:new, :create]
+    resource :restricted_invitation, only: [:new, :create]
     resource :admin, only: [:new, :create]
   end
   devise_for :admins

data/test/rails_app/db/migrate/20100401102949_create_tables.rb

@@ -33,6 +33,28 @@ class CreateTables < (Rails.version < '5.1' ? ActiveRecord::Migration : ActiveRe
     end
     add_index :users, :invitation_token, :unique => true
 
+    create_table :devise_invitations do |t|
+      t.string :invitation_token
+      t.datetime :invitation_created_at
+      t.datetime :invitation_sent_at
+      t.datetime :invitation_accepted_at
+      t.datetime :superseded_at
+      t.string :superseded_reason
+      t.datetime :revoked_at
+      t.datetime :resource_created_at
+      t.json :invite_key, null: false, default: {}
+      t.string :invite_key_digest, null: false
+      t.integer :invitable_id
+      t.string :invitable_type
+      t.integer :invited_by_id
+      t.string :invited_by_type
+      t.timestamps
+    end
+    add_index :devise_invitations, :invitation_token, unique: true
+    add_index :devise_invitations, [:invitable_type, :invitable_id]
+    add_index :devise_invitations, [:invited_by_type, :invited_by_id]
+    add_index :devise_invitations, [:invitable_type, :invite_key_digest]
+
     create_table :admins do |t|
       ## Database authenticatable
       t.string :email,              :null => true, :default => ""

data/test/routes_test.rb

@@ -2,6 +2,12 @@ require 'test_helper'
 
 class RoutesTest < ActionController::TestCase
 
+  test 'preserve custom controller module for registrations' do
+    mapping = Devise::Mapping.new(:users, module: :users)
+
+    assert_equal 'users/registrations', mapping.controllers[:registrations]
+  end
+
   test 'map new user invitation' do
     assert_recognizes({ controller: 'devise/invitations', action: 'new' }, { path: 'users/invitation/new', method: :get })
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: devise_invitable
 version: !ruby/object:Gem::Version
-  version: 2.0.14
+  version: 3.0.1
 platform: ruby
 authors:
 - Sergio Cambra
@@ -15,42 +15,42 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '7.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '7.0'
 - !ruby/object:Gem::Dependency
   name: devise
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '4.6'
+        version: '5.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '4.6'
+        version: '5.0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: '2.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: '2.0'
 description: It adds support for send invitations by email (it requires to be authenticated)
   and accept the invitation by setting a password.
 email:
@@ -95,23 +95,30 @@ files:
 - config/locales/zh-TW.yml
 - lib/devise_invitable.rb
 - lib/devise_invitable/controllers/helpers.rb
+- lib/devise_invitable/invitation.rb
 - lib/devise_invitable/inviter.rb
 - lib/devise_invitable/mailer.rb
 - lib/devise_invitable/mapping.rb
+- lib/devise_invitable/migrator.rb
 - lib/devise_invitable/models.rb
 - lib/devise_invitable/models/authenticatable.rb
 - lib/devise_invitable/parameter_sanitizer.rb
 - lib/devise_invitable/rails.rb
 - lib/devise_invitable/routes.rb
 - lib/devise_invitable/version.rb
-- lib/generators/active_record/devise_invitable_generator.rb
-- lib/generators/active_record/templates/migration.rb
+- lib/generators/active_record/devise_invitable_install_generator.rb
+- lib/generators/active_record/devise_invitable_upgrade_generator.rb
+- lib/generators/active_record/templates/create_devise_invitations.rb
+- lib/generators/active_record/templates/upgrade_devise_invitations.rb
 - lib/generators/devise_invitable/devise_invitable_generator.rb
 - lib/generators/devise_invitable/install_generator.rb
 - lib/generators/devise_invitable/templates/simple_form_for/invitations/edit.html.erb
 - lib/generators/devise_invitable/templates/simple_form_for/invitations/new.html.erb
+- lib/generators/devise_invitable/upgrade_generator.rb
 - lib/generators/devise_invitable/views_generator.rb
-- lib/generators/mongoid/devise_invitable_generator.rb
+- lib/generators/mongoid/devise_invitable_install_generator.rb
+- lib/generators/mongoid/devise_invitable_upgrade_generator.rb
+- lib/tasks/devise_invitable_tasks.rake
 - test/functional/controller_helpers_test.rb
 - test/functional/registrations_controller_test.rb
 - test/generators/views_generator_test.rb
@@ -123,14 +130,17 @@ files:
 - test/mailers/parent_mailer_test.rb
 - test/model_tests_helper.rb
 - test/models/invitable_test.rb
+- test/models/separate_invitations_test.rb
 - test/models_test.rb
 - test/orm/active_record.rb
 - test/orm/mongoid.rb
 - test/rails_app/Rakefile
 - test/rails_app/app/controllers/admins_controller.rb
 - test/rails_app/app/controllers/application_controller.rb
+- test/rails_app/app/controllers/boolean_inviter_invitations_controller.rb
 - test/rails_app/app/controllers/free_invitations_controller.rb
 - test/rails_app/app/controllers/home_controller.rb
+- test/rails_app/app/controllers/restricted_invitations_controller.rb
 - test/rails_app/app/controllers/users_controller.rb
 - test/rails_app/app/helpers/application_helper.rb
 - test/rails_app/app/mailers/application_mailer.rb
@@ -182,7 +192,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.2.2
+      version: 2.7.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
@@ -204,14 +214,17 @@ test_files:
 - test/mailers/parent_mailer_test.rb
 - test/model_tests_helper.rb
 - test/models/invitable_test.rb
+- test/models/separate_invitations_test.rb
 - test/models_test.rb
 - test/orm/active_record.rb
 - test/orm/mongoid.rb
 - test/rails_app/Rakefile
 - test/rails_app/app/controllers/admins_controller.rb
 - test/rails_app/app/controllers/application_controller.rb
+- test/rails_app/app/controllers/boolean_inviter_invitations_controller.rb
 - test/rails_app/app/controllers/free_invitations_controller.rb
 - test/rails_app/app/controllers/home_controller.rb
+- test/rails_app/app/controllers/restricted_invitations_controller.rb
 - test/rails_app/app/controllers/users_controller.rb
 - test/rails_app/app/helpers/application_helper.rb
 - test/rails_app/app/mailers/application_mailer.rb

data/lib/generators/active_record/devise_invitable_generator.rb

@@ -1,19 +0,0 @@
-require 'rails/generators/active_record'
-
-module ActiveRecord
-  module Generators
-    class DeviseInvitableGenerator < ActiveRecord::Generators::Base
-      source_root File.expand_path('../templates', __FILE__)
-
-      def copy_devise_migration
-        migration_template 'migration.rb', "db/migrate/devise_invitable_add_to_#{table_name}.rb", migration_version: migration_version
-      end
-
-      def migration_version
-        if Rails::VERSION::MAJOR >= 5
-          "[#{Rails::VERSION::MAJOR}.#{Rails::VERSION::MINOR}]"
-        end
-      end
-    end
-  end
-end

data/lib/generators/active_record/templates/migration.rb

@@ -1,22 +0,0 @@
-class DeviseInvitableAddTo<%= table_name.camelize %> < ActiveRecord::Migration<%= migration_version %>
-  def up
-    change_table :<%= table_name %> do |t|
-      t.string     :invitation_token
-      t.datetime   :invitation_created_at
-      t.datetime   :invitation_sent_at
-      t.datetime   :invitation_accepted_at
-      t.integer    :invitation_limit
-      t.references :invited_by, polymorphic: true
-      t.integer    :invitations_count, default: 0
-      t.index      :invitation_token, unique: true # for invitable
-      t.index      :invited_by_id
-    end
-  end
-
-  def down
-    change_table :<%= table_name %> do |t|
-      t.remove_references :invited_by, polymorphic: true
-      t.remove :invitations_count, :invitation_limit, :invitation_sent_at, :invitation_accepted_at, :invitation_token, :invitation_created_at
-    end
-  end
-end

data/lib/generators/mongoid/devise_invitable_generator.rb

@@ -1,8 +0,0 @@
-require 'generators/devise/orm_helpers'
-
-module Mongoid
-  module Generators
-    class DeviseInvitableGenerator < Rails::Generators::NamedBase
-    end
-  end
-end