devise_invitable 3.0.3 → 3.1.0

data/lib/devise_invitable/models.rb

@@ -1,4 +1,5 @@
 require 'active_support/deprecation'
+require 'active_support/security_utils'
 require 'devise_invitable/models/authenticatable'
 
 module Devise
@@ -30,16 +31,30 @@ module Devise
       attr_accessor :completing_invite
       attr_accessor :registering_directly
       attr_accessor :invited_by_for_next_invitation
-      attr_reader   :raw_invitation_token
+      attr_reader   :acceptance_token
 
       included do
         include ::DeviseInvitable::Inviter
         has_many :devise_invitations,
-          as: :invitable,
-          class_name: 'DeviseInvitable::Invitation',
-          dependent: :nullify,
-          autosave: true
-
+                 as: :invitable,
+                 class_name: 'DeviseInvitable::Invitation',
+                 dependent: :nullify,
+                 autosave: true
+        if defined?(Mongoid::Document) && self < Mongoid::Document
+          has_many :pending_invitations,
+                   as: :invitable,
+                   class_name: 'DeviseInvitable::Invitation',
+                   foreign_key: :invitable_id,
+                   inverse_of: false,
+                   scope: -> { pending.provisioning }
+        else
+          has_many :pending_invitations,
+                   -> { pending.provisioning },
+                   as: :invitable,
+                   class_name: 'DeviseInvitable::Invitation',
+                   foreign_key: :invitable_id,
+                   inverse_of: false
+        end
         extend ActiveModel::Callbacks
         define_model_callbacks :invitation_created
         define_model_callbacks :invitation_accepted
@@ -68,14 +83,22 @@ module Devise
           }
         elsif defined?(ActiveRecord) && defined?(ActiveRecord::Base) && self < ActiveRecord::Base
           scope :created_by_invite, lambda {
-            joins(:devise_invitations).merge(DeviseInvitable::Invitation.provisioning).distinct
+            invitation_ids = DeviseInvitable::Invitation.provisioning
+              .where(invitable_type: devise_invitable_base_class.name)
+              .select(:invitable_id)
+            where(id: invitation_ids)
           }
           scope :invitation_not_accepted, lambda {
-            joins(:devise_invitations).merge(DeviseInvitable::Invitation.pending)
-              .merge(DeviseInvitable::Invitation.provisioning).distinct
+            invitation_ids = DeviseInvitable::Invitation.pending.provisioning
+              .where(invitable_type: devise_invitable_base_class.name)
+              .select(:invitable_id)
+            where(id: invitation_ids)
           }
           scope :invitation_accepted, lambda {
-            joins(:devise_invitations).merge(DeviseInvitable::Invitation.accepted).distinct
+            invitation_ids = DeviseInvitable::Invitation.accepted
+              .where(invitable_type: devise_invitable_base_class.name)
+              .select(:invitable_id)
+            where(id: invitation_ids)
           }
           scope :no_active_invitation, lambda {
             invitation_ids = DeviseInvitable::Invitation.pending
@@ -123,6 +146,13 @@ module Devise
         current_invitation&.invitation_token = value
       end
 
+      # The public raw token is an encrypted acceptance envelope for new
+      # invitations. Before persistence it falls back to the underlying Devise
+      # token so invitation callbacks retain their historical behavior.
+      def raw_invitation_token
+        acceptance_token || @raw_invitation_token
+      end
+
       def invitation_created_at
         current_invitation&.invitation_created_at
       end
@@ -179,37 +209,42 @@ module Devise
         current_invitation.invitation_token = nil
       end
 
-      # Save the resource, accept the selected invitation, and supersede the
-      # other outstanding invitations for the same resource.
+      # Save the resource, accept the selected invitation, and resolve the
+      # other outstanding invitations for the same invite keys.
       def accept_invitation!
         if current_invitation&.pending?
+          @accepted_invitation_for_provisioned_resource = resource_previously_provisioned?
+          provisioning_acceptance = !accepted_invitation_for_provisioned_resource?
+          previous_confirmed_at = confirmed_at if respond_to?(:confirmed_at)
           @accepting_invitation = true
+          skip_reconfirmation! if respond_to?(:skip_reconfirmation!)
           run_callbacks :invitation_accepted do
             accepted_at = Time.now.utc
             self.confirmed_at ||= accepted_at if respond_to?(:confirmed_at=)
 
             if save
               current_invitation.invitable = self
-              current_invitation.resource_created_at ||= accepted_at
+              current_invitation.resource_created_at ||= accepted_at if provisioning_acceptance
               current_invitation.invitation_accepted_at = accepted_at
               current_invitation.invitation_token = nil
               current_invitation.save!
-              supersede_other_invitations!(accepted_at)
+              resolve_other_invitations_after_acceptance!(accepted_at)
+              reset_devise_invitation_associations
               true
             else
               false
             end
           end.tap do |saved|
-            rollback_accepted_invitation unless saved
+            rollback_accepted_invitation(previous_confirmed_at) unless saved
             @accepting_invitation = false
           end
         end
       end
 
-      def rollback_accepted_invitation
+      def rollback_accepted_invitation(previous_confirmed_at = nil)
         invitation = current_invitation
         invitation.reload if invitation&.persisted?
-        self.confirmed_at = nil if self.respond_to?(:confirmed_at=)
+        self.confirmed_at = previous_confirmed_at if respond_to?(:confirmed_at=)
       end
 
       # Verify wheather a user is created by invitation, irrespective to invitation status
@@ -217,12 +252,25 @@ module Devise
         devise_invitations.provisioning.exists?
       end
 
+      def resource_previously_provisioned?
+        persisted? && !invitation_pending?
+      end
+
+      def accepted_invitation_for_provisioned_resource?
+        !!@accepted_invitation_for_provisioned_resource
+      end
+
       # True only while this record is a placeholder created by an unresolved
       # invitation. An active resource may have other pending invitations.
       def invitation_pending?
         return false unless persisted?
 
-        devise_invitations.pending.provisioning.exists?
+        invitations = pending_invitations
+        if devise_invitable_association_loaded?(invitations)
+          return invitations.any?
+        end
+
+        invitations.exists?
       end
 
       def invited_to_sign_up?
@@ -246,6 +294,8 @@ module Devise
 
       # Reset invitation token and send invitation again
       def invite!(invited_by = nil, options = {})
+        options = options.dup
+        invitation_data = options.delete(:invitation_data)
         resource_was_new = new_record?
         # Required to workaround confirmable model's confirmation_required? method
         # being implemented to check for non-nil value of confirmed_at
@@ -258,6 +308,7 @@ module Devise
         self.downcase_keys if new_record_and_responds_to?(:downcase_keys)
         self.strip_whitespace if new_record_and_responds_to?(:strip_whitespace)
         invitation = build_devise_invitation(invited_by)
+        invitation.invitation_data = invitation_data
         if instance_variable_defined?(:@invited_by_for_next_invitation)
           remove_instance_variable(:@invited_by_for_next_invitation)
         end
@@ -265,6 +316,8 @@ module Devise
         generate_invitation_token
 
         run_callbacks :invitation_created do
+          invitation.invitation_data = DeviseInvitable::AcceptanceToken
+            .normalize_invitation_data(invitation.invitation_data)
           now = Time.now.utc
           invitation.invitation_created_at = now
 
@@ -276,8 +329,16 @@ module Devise
               invitation.resource_created_at = now if resource_was_new
             end
             invitation.save!
+            reset_devise_invitation_associations
+            generate_acceptance_token
             invitation.invited_by.decrement_invitation_limit! if invitation.invited_by.present?
-            deliver_invitation(options) unless skip_invitation
+            unless skip_invitation
+              if self.class.deliver_invitation_later
+                enqueue_invitation_delivery(options)
+              else
+                deliver_invitation(options)
+              end
+            end
           end
         end
       end
@@ -309,7 +370,8 @@ module Devise
 
       # Enforce password when invitation is being accepted
       def password_required?
-        (accepting_invitation? && self.class.require_password_on_accepting) || super
+        (accepting_invitation? && !resource_previously_provisioned? &&
+          self.class.require_password_on_accepting) || super
       end
 
       def unauthenticated_message
@@ -330,16 +392,12 @@ module Devise
 
       # Deliver the invitation email
       def deliver_invitation(options = {})
-        generate_invitation_token! unless @raw_invitation_token
-        marked_as_sent = false
-        unless current_invitation.invitation_sent_at
-          current_invitation.update_attribute :invitation_sent_at, Time.now.utc
-          marked_as_sent = true
-        end
-        send_devise_notification(:invitation_instructions, @raw_invitation_token, options)
-      rescue
-        current_invitation.update_attribute(:invitation_sent_at, nil) if marked_as_sent
-        raise
+        DeviseInvitable::InvitationDelivery.call(
+          current_invitation,
+          resource: self,
+          acceptance_token: acceptance_token,
+          options: options
+        )
       end
 
       # provide alias to the encrypted invitation_token stored by devise
@@ -371,24 +429,48 @@ module Devise
         invitation = current_invitation
         return unless invitation&.pending?
 
-        remove_placeholder = invitation.provisioning? && invitation_pending?
+        remove_placeholder = invitation.provisioning?
         invitation.update!(revoked_at: Time.now.utc, invitation_token: nil)
+        reset_devise_invitation_associations
         destroy if remove_placeholder
       end
 
       protected
 
+        def devise_invitable_association_loaded?(association)
+          return association.loaded? if association.respond_to?(:loaded?)
+
+          association._loaded?
+        end
+
+        def enqueue_invitation_delivery(options)
+          DeviseInvitable::InvitationDelivery.enqueue(
+            current_invitation,
+            resource: self,
+            acceptance_token: acceptance_token,
+            options: options
+          )
+        end
+
         def assign_invitation_attribute(attribute, value)
           return unless current_invitation
 
           current_invitation.public_send("#{attribute}=", value)
-          current_invitation.save! if current_invitation.persisted?
+          if current_invitation.persisted?
+            current_invitation.save!
+            reset_devise_invitation_associations
+          end
         end
 
         def block_from_invitation?
           invitation_pending?
         end
 
+        def reset_devise_invitation_associations
+          devise_invitations.reset
+          pending_invitations.reset
+        end
+
         # Checks if the invitation for the user is within the limit time.
         # We do this by calculating if the difference between today and the
         # invitation sent date does not exceed the invite for time configured.
@@ -426,19 +508,49 @@ module Devise
           generate_invitation_token && current_invitation.save!
         end
 
+        def generate_acceptance_token
+          @acceptance_token = DeviseInvitable::AcceptanceToken.generate(
+            invitation: current_invitation,
+            raw_token: @raw_invitation_token,
+            invite_key: current_invitation.invite_key_for_acceptance.presence ||
+              self.class.normalized_invite_keys(attributes),
+            invitation_data: current_invitation.invitation_data
+          )
+        end
+
+        def prepare_invitation_delivery
+          generate_invitation_token! unless @raw_invitation_token
+          generate_acceptance_token unless acceptance_token
+          acceptance_token
+        end
+
+        def send_invitation_notification_now(token, options)
+          devise_mailer
+            .send(:invitation_instructions, self, token, options)
+            .deliver_now
+        end
+
         def new_record_and_responds_to?(method)
           self.new_record? && self.respond_to?(method, true)
         end
 
         def build_devise_invitation(invited_by)
-          invite_key_values = self.class.invite_key_fields.each_with_object({}) do |key, values|
-            values[key] = public_send(key)
-          end
-          DeviseInvitable::Invitation.new(
+          invite_key_values = self.class.normalized_invite_keys(attributes)
+          invitation = DeviseInvitable::Invitation.new(
             invitable_type: self.class.devise_invitable_base_class.name,
-            invite_key: invite_key_values,
+            invite_key: {},
             invited_by: invited_by || invited_by_for_next_invitation
           )
+          invitation.transient_invite_key = invite_key_values
+          invitation
+        end
+
+        def resolve_other_invitations_after_acceptance!(time)
+          if self.class.supersede_other_invitations_on_accept
+            supersede_other_invitations!(time)
+          else
+            preserve_other_invitations!
+          end
         end
 
         def supersede_other_invitations!(time)
@@ -455,6 +567,16 @@ module Devise
           end
         end
 
+        def preserve_other_invitations!
+          self.class.pending_invitations_for(attributes).each do |invitation|
+            next if invitation.id == current_invitation.id
+
+            invitation.invitable = self
+            invitation.resource_created_at = nil if current_invitation.provisioning?
+            invitation.save!
+          end
+        end
+
         def resolve_invitations_after_registration!
           self.class.pending_invitations_for(attributes).each do |invitation|
             invitation.update!(
@@ -464,6 +586,7 @@ module Devise
               superseded_reason: 'registered'
             )
           end
+          reset_devise_invitation_associations
           self.registering_directly = false
         end
 
@@ -563,6 +686,10 @@ module Devise
           original_token = attributes.delete(:invitation_token)
           invitable = find_by_invitation_token(original_token, false)
           if invitable.errors.empty?
+            if invitable.resource_previously_provisioned?
+              attributes.delete(:password)
+              attributes.delete(:password_confirmation)
+            end
             invitable.assign_attributes(attributes)
             invitable.accept_invitation!
           end
@@ -577,12 +704,9 @@ module Devise
             return
           end
 
-          invitation_token = Devise.token_generator.digest(self, :invitation_token, original_token)
-          invitation = DeviseInvitable::Invitation.where(
-            invitable_type: devise_invitable_base_class.name,
-            invitation_token: invitation_token
-          ).first
-          invitable = invitation&.invitable || new(invitation ? invitation.invite_key : {})
+          invitation, invite_key = invitation_and_key_from_token(original_token)
+          invitable = invitation&.invitable || new(invite_key || {})
+          invitable.assign_attributes(invite_key) if invitation && invite_key.present?
           invitable.instance_variable_set(:@current_invitation, invitation)
           if invitation.nil?
             invitable.errors.add(:invitation_token, :invalid)
@@ -595,9 +719,14 @@ module Devise
         def pending_invitations_for(attributes)
           keys = normalized_invite_keys(attributes)
           digest = DeviseInvitable::Invitation.digest_for(devise_invitable_base_class.name, keys)
-          DeviseInvitable::Invitation.pending.where(
-            invitable_type: devise_invitable_base_class.name,
-            invite_key_digest: digest
+          DeviseInvitable::Invitation.to_adapter.find_all(
+            conditions: {
+              invitation_accepted_at: nil,
+              superseded_at: nil,
+              revoked_at: nil,
+              invitable_type: devise_invitable_base_class.name,
+              invite_key_digest: digest
+            }
           ).to_a
         end
 
@@ -638,6 +767,9 @@ module Devise
         Devise::Models.config(self, :allow_insecure_sign_in_after_accept)
         Devise::Models.config(self, :require_password_on_accepting)
         Devise::Models.config(self, :create_resource_on_invitation)
+        Devise::Models.config(self, :store_invite_keys_until_delivery)
+        Devise::Models.config(self, :deliver_invitation_later)
+        Devise::Models.config(self, :supersede_other_invitations_on_accept)
 
         def invited_by_class_name=(value)
           DeviseInvitable.warn_deprecated_invited_by_setting(:invited_by_class_name)
@@ -651,6 +783,44 @@ module Devise
 
         private
 
+          def invitation_and_key_from_token(original_token)
+            payload = DeviseInvitable::AcceptanceToken.decode(original_token)
+            return legacy_invitation_and_key(original_token) unless payload
+            return [nil, nil] unless payload[:invitable_type] == devise_invitable_base_class.name
+
+            invitation_token = Devise.token_generator.digest(
+              self,
+              :invitation_token,
+              payload[:raw_token]
+            )
+            invitation = DeviseInvitable::Invitation.to_adapter.find_first(
+              id: payload[:invitation_id],
+              invitable_type: devise_invitable_base_class.name,
+              invitation_token: invitation_token
+            )
+            invitation.invitation_data = payload[:invitation_data] || {} if invitation
+            invite_key = normalized_invite_keys(payload[:invite_key] || {})
+            expected_digest = DeviseInvitable::Invitation.digest_for(
+              devise_invitable_base_class.name,
+              invite_key
+            )
+            invitation = nil unless invitation &&
+              ActiveSupport::SecurityUtils.secure_compare(
+                invitation.invite_key_digest,
+                expected_digest
+              )
+            [invitation, invite_key]
+          end
+
+          def legacy_invitation_and_key(original_token)
+            invitation_token = Devise.token_generator.digest(self, :invitation_token, original_token)
+            invitation = DeviseInvitable::Invitation.to_adapter.find_first(
+              invitable_type: devise_invitable_base_class.name,
+              invitation_token: invitation_token
+            )
+            [invitation, invitation&.invite_key]
+          end
+
           def ensure_unique_invite_key_match!(required_attributes, attributes)
             filtered_attributes = attributes.to_h.with_indifferent_access
               .slice(*required_attributes)
@@ -658,7 +828,7 @@ module Devise
             return unless filtered_attributes.size == required_attributes.size
 
             filtered_attributes = devise_parameter_filter.filter(filtered_attributes)
-            matches = where(filtered_attributes).limit(2).to_a
+            matches = to_adapter.find_all(conditions: filtered_attributes, limit: 2).to_a
             return unless matches.many?
 
             raise DeviseInvitable::AmbiguousInviteKeyError,

data/lib/devise_invitable/version.rb

@@ -1,3 +1,3 @@
 module DeviseInvitable
-  VERSION = '3.0.3'.freeze
+  VERSION = '3.1.0'.freeze
 end

data/lib/devise_invitable.rb

@@ -1,9 +1,14 @@
 module DeviseInvitable
   class AmbiguousInviteKeyError < StandardError; end
+  class InvitationDataTooLargeError < ArgumentError; end
+  class MissingInviteKeyError < StandardError; end
   class ResourceAttributesRequirePlaceholderError < ArgumentError; end
 
+  autoload :AcceptanceToken, 'devise_invitable/acceptance_token'
   autoload :Inviter, 'devise_invitable/inviter'
   autoload :Invitation, 'devise_invitable/invitation'
+  autoload :InvitationDelivery, 'devise_invitable/invitation_delivery'
+  autoload :InvitationDeliveryJob, 'devise_invitable/invitation_delivery_job'
   autoload :Mailer, 'devise_invitable/mailer'
   autoload :Migrator, 'devise_invitable/migrator'
   autoload :Mapping, 'devise_invitable/mapping'
@@ -12,6 +17,15 @@ module DeviseInvitable
     autoload :Registrations, 'devise_invitable/controllers/registrations'
     autoload :Helpers, 'devise_invitable/controllers/helpers'
   end
+
+  def self.invitation_delivery_job
+    job = Devise.invitation_delivery_job
+    job = job.constantize if job.respond_to?(:constantize)
+    return job if job.respond_to?(:perform_later)
+
+    raise ArgumentError,
+      'Devise.invitation_delivery_job must respond to perform_later'
+  end
 end
 
 require 'devise'
@@ -101,10 +115,36 @@ module Devise
   @@require_password_on_accepting = true
 
   # Public: Create the invited resource as soon as an invitation is sent.
-  # When false, only the invitation and its invite keys are persisted and the
-  # resource is created when the invitation is accepted.
+  # When false, only the invitation record is persisted and the resource is
+  # created when the invitation is accepted.
   mattr_accessor :create_resource_on_invitation
   @@create_resource_on_invitation = false
+
+  # Public: Store invite keys until an invitation is delivered so a skipped,
+  # resource-less invitation can be delivered later. Stored keys are cleared
+  # after successful delivery.
+  mattr_accessor :store_invite_keys_until_delivery
+  @@store_invite_keys_until_delivery = false
+
+  # Public: Deliver invitation emails through the configured invitation job.
+  # Other Devise notifications continue to use send_devise_notification.
+  mattr_accessor :deliver_invitation_later
+  @@deliver_invitation_later = false
+
+  # Public: Active Job class used by Invitation#deliver_later. It may be a
+  # class or a class name and must respond to perform_later.
+  mattr_accessor :invitation_delivery_job
+  @@invitation_delivery_job = 'DeviseInvitable::InvitationDeliveryJob'
+
+  # Public: Queue used by the default invitation delivery job.
+  mattr_accessor :invitation_delivery_queue_name
+  @@invitation_delivery_queue_name = :mailers
+
+  # Public: Supersede other pending invitations for the same invite keys when
+  # one invitation is accepted. Disable this only when each invitation carries
+  # an independently acceptable application-specific context.
+  mattr_accessor :supersede_other_invitations_on_accept
+  @@supersede_other_invitations_on_accept = true
 end
 
 module DeviseInvitable

data/lib/generators/devise_invitable/install_generator.rb

@@ -51,6 +51,27 @@ module DeviseInvitable
   # Default: false
   # config.create_resource_on_invitation = true
 
+  # Store invite keys until delivery so skipped invitations without placeholder
+  # resources can be delivered later. Keys are cleared after successful delivery.
+  # Default: false
+  # config.store_invite_keys_until_delivery = true
+
+  # Deliver invitation emails with the configured invitation delivery job.
+  # Other Devise notifications still use send_devise_notification.
+  # Default: false
+  # config.deliver_invitation_later = true
+
+  # Active Job class and queue used by invitation.deliver_later. Configure a
+  # custom job class when invitations should inherit from ApplicationJob or use
+  # application-specific retry and callback behavior.
+  # config.invitation_delivery_job = "MyInvitationDeliveryJob"
+  # config.invitation_delivery_queue_name = :mailers
+
+  # Supersede other pending invitations for the same invite keys when one is
+  # accepted. Disable this only for independently acceptable invitation data.
+  # Default: true
+  # config.supersede_other_invitations_on_accept = false
+
   # The column name used for counter_cache column. If this is nil,
   # the #invited_by association is declared without counter_cache.
   # Default: nil

data/test/integration/invitation_test.rb

@@ -147,6 +147,32 @@ class InvitationTest < ActionDispatch::IntegrationTest
     Devise.allow_insecure_sign_in_after_accept = original_option_value
   end
 
+  test 'does not sign in an already provisioned user when accepting another invitation' do
+    original_create_resource = User.create_resource_on_invitation
+    original_supersede = User.supersede_other_invitations_on_accept
+    User.create_resource_on_invitation = false
+    User.supersede_other_invitations_on_accept = false
+
+    first_invited = User.invite!(email: 'valid@email.com')
+    first_token = first_invited.raw_invitation_token
+    second_invited = User.invite!(email: 'valid@email.com')
+    second_token = second_invited.raw_invitation_token
+    user = User.accept_invitation!(
+      invitation_token: first_token,
+      password: '123456789',
+      password_confirmation: '123456789'
+    )
+
+    set_password invitation_token: second_token
+
+    assert_equal new_user_session_path, current_path
+    assert user.reload.valid_password?('123456789')
+    refute user.valid_password?('987654321')
+  ensure
+    User.create_resource_on_invitation = original_create_resource
+    User.supersede_other_invitations_on_accept = original_supersede
+  end
+
   test 'clear token and set invitation_accepted_at after recover password instead of accept_invitation' do
     user = User.invite!(email: 'valid@email.com')