devise_invitable 1.4.1 → 1.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 3baf83979bda300001727d86af188f93a91bf95c
-  data.tar.gz: 74d6ac1f55c041e7075e4c1e8ec026e470fdfe12
+  metadata.gz: 751224bca4a80bf6eb364d3c11d58a2771d36acf
+  data.tar.gz: e5a102a756fd4061ee2bffdc345dfc1dd94f15f5
 SHA512:
-  metadata.gz: 0b08b0b990d88fd99aed53e4d3082db8354bda2e5046fad13901debde5ecb614ba5cdcea7e11709798ea16d4dc99dac27dbd622534179cf1d9a3cbaaaba38bda
-  data.tar.gz: 3ca119718132addd0b7b331ac4fe81c4e21852b6480ef10c3ed742492b82e86e6fbd01f84957e5a7b6426aba2bbd5eaeb8f65460730399f3e286e125355ca77f
+  metadata.gz: d7ed72e6393da5bd986570e981d13c3bc3b1d39af6b12c0ebc7499e4b95d838ed8458833f631f766934c46808b2a9c2026a78d307c2f78196b9addecc4541d57
+  data.tar.gz: 5ace95e6bdb544c6e67669d7c6576ba09a74985c92974db6a43a2898b28080cf2bb9d7615acf138969efc24c4949e2149dc1ed51dea4c7512c6933d52c9ccbf5

data/CHANGELOG

@@ -1,3 +1,5 @@
+Override valid_password? and unauthenticated_message instead of active_for_authentication? and inactive_message, active_for_authentication? doesn't work for default behavior of invited users without password
+
 = 1.4.0
 Override active_for_authentication? and inactive_message instead of valid_password?
 To use counter_cache, invited_by_counter_cache must be set, no more checking of invitations_count to enable counter cache

data/README.rdoc

@@ -132,6 +132,8 @@ or directly as parameters to the <tt>devise</tt> method:
 
 * invited_by_class_name: The class name of the inviting model. If this is nil, polymorphic association is used.
 
+* allow_insecure_sign_in_after_accept: automatically sign in the user after they set a password. Enabled by default.
+
 For more details, see <tt>config/initializers/devise.rb</tt> (after you invoked the "devise_invitable:install" generator described above).
 
 == Configuring views
@@ -355,6 +357,7 @@ DeviseInvitable uses flash messages with I18n with the flash keys <tt>:send_inst
         send_instructions: 'An invitation email has been sent to %{email}.'
         invitation_token_invalid: 'The invitation token provided is not valid!'
         updated: 'Your password was set successfully. You are now signed in.'
+        updated_not_active: 'Your password was set successfully.'
 
 You can also create distinct messages based on the resource you've configured using the singular name given in routes:
 
@@ -365,6 +368,7 @@ You can also create distinct messages based on the resource you've configured us
           send_instructions: 'A new user invitation has been sent to %{email}.'
           invitation_token_invalid: 'Your invitation token is not valid!'
           updated: 'Welcome on board! You are now signed in.'
+          updated_not_active: 'Welcome on board! Sign in to continue.'
 
 The DeviseInvitable mailer uses the same pattern as Devise to create mail subject messages:
 

data/app/controllers/devise/invitations_controller.rb

@@ -43,10 +43,15 @@ class Devise::InvitationsController < DeviseController
     yield resource if block_given?
 
     if invitation_accepted
-      flash_message = resource.active_for_authentication? ? :updated : :updated_not_active
-      set_flash_message :notice, flash_message if is_flashing_format?
-      sign_in(resource_name, resource)
-      respond_with resource, :location => after_accept_path_for(resource)
+      if Devise.allow_insecure_sign_in_after_accept
+        flash_message = resource.active_for_authentication? ? :updated : :updated_not_active
+        set_flash_message :notice, flash_message if is_flashing_format?
+        sign_in(resource_name, resource)
+        respond_with resource, :location => after_accept_path_for(resource)
+      else
+        set_flash_message :notice, :updated_not_active if is_flashing_format?
+        respond_with resource, :location => new_session_path(resource_name)
+      end
     else
       respond_with_navigational(resource){ render :edit }
     end

data/config/locales/en.yml

@@ -6,6 +6,7 @@ en:
       send_instructions: "An invitation email has been sent to %{email}."
       invitation_token_invalid: "The invitation token provided is not valid!"
       updated: "Your password was set successfully. You are now signed in."
+      updated_not_active: "Your password was set successfully."
       no_invitations_remaining: "No invitations remaining"
       invitation_removed: "Your invitation was removed."
       new:

data/lib/devise_invitable.rb

@@ -66,6 +66,11 @@ module Devise
   # the #invited_by association is declared without counter_cache. (default: nil)
   mattr_accessor :invited_by_counter_cache
   @@invited_by_counter_cache = nil
+
+  # Public: Auto-login after the user accepts the invite. If this is false,
+  # the user will need to manually log in after accepting the invite (default: false).
+  mattr_accessor :allow_insecure_sign_in_after_accept
+  @@allow_insecure_sign_in_after_accept = true
 end
 
 Devise.add_module :invitable, :controller => :invitations, :model => 'devise_invitable/model', :route => {:invitation => [nil, :new, :accept]}

data/lib/devise_invitable/model.rb

@@ -134,12 +134,12 @@ module Devise
       end
 
       # Only verify password when is not invited
-      def active_for_authentication?
-        super unless invited_to_sign_up?
+      def valid_password?(password)
+        super unless block_from_invitation?
       end
 
-      def inactive_message
-        invited_to_sign_up? ? :invited : super
+      def unauthenticated_message
+        block_from_invitation? ? :invited : super
       end
 
       def after_password_reset
@@ -179,6 +179,10 @@ module Devise
           @skip_password ||= false
         end
 
+        def block_from_invitation?
+          invited_to_sign_up?
+        end
+
         # Checks if the invitation for the user is within the limit time.
         # We do this by calculating if the difference between today and the
         # invitation sent date does not exceed the invite for time configured.
@@ -303,6 +307,7 @@ module Devise
         Devise::Models.config(self, :invitation_limit)
         Devise::Models.config(self, :invite_key)
         Devise::Models.config(self, :resend_invitation)
+        Devise::Models.config(self, :allow_insecure_sign_in_after_accept)
       end
     end
   end

data/lib/devise_invitable/parameter_sanitizer.rb

@@ -20,7 +20,7 @@ module DeviseInvitable
     def attributes_for_with_invitable(kind)
       case kind
       when :invite
-        resource_class.invite_key_fields
+        resource_class.respond_to?(:invite_key_fields) ? resource_class.invite_key_fields : []
       when :accept_invitation
         [:password, :password_confirmation, :invitation_token]
       else attributes_for_without_invitable(kind)

data/lib/devise_invitable/version.rb

@@ -1,3 +1,3 @@
 module DeviseInvitable
-  VERSION = '1.4.1'
+  VERSION = '1.4.2'
 end

data/lib/generators/devise_invitable/install_generator.rb

@@ -57,6 +57,11 @@ module DeviseInvitable
   # Default: nil
   # config.invited_by_counter_cache = :invitations_count
 
+  # Auto-login after the user accepts the invite. If this is false,
+  # the user will need to manually log in after accepting the invite.
+  # Default: false
+  # config.allow_insecure_sign_in_after_accept = true
+
 CONTENT
             end
           end

data/test/integration/invitation_test.rb

@@ -64,6 +64,25 @@ class InvitationTest < ActionDispatch::IntegrationTest
     assert_equal root_path, current_path
   end
 
+  test 'invited user without password should not be able to sign in' do
+    user = User.invite!(:email => "valid@email.com")
+    user.password = 'test'
+    sign_in_as_user user
+
+    assert_equal new_user_session_path, current_path
+    assert page.has_css?('p#alert', :text => 'You have a pending invitation, accept it to finish creating your account.')
+  end
+
+  test 'invited user with password should not be able to sign in' do
+    user = User.invite!(:email => "valid@email.com")
+    user.password = '987654321'
+    user.save
+    sign_in_as_user user
+
+    assert_equal new_user_session_path, current_path
+    assert page.has_css?('p#alert', :text => 'You have a pending invitation, accept it to finish creating your account.')
+  end
+
   test 'not authenticated user with invalid invitation token should not be able to set his password' do
     user = User.invite!(:email => "valid@email.com")
     user.accept_invitation!
@@ -106,10 +125,26 @@ class InvitationTest < ActionDispatch::IntegrationTest
     assert user.reload.valid_password?('987654321')
   end
 
-  test 'sign in user automatically after setting it\'s password' do
+  test 'sign in user automatically after setting it\'s password if config.allow_insecure_sign_in_after_accept is true' do
+    original_option_value = Devise.allow_insecure_sign_in_after_accept
+    Devise.allow_insecure_sign_in_after_accept = true
+
     User.invite!(:email => "valid@email.com")
     set_password :invitation_token => Thread.current[:token]
+
     assert_equal root_path, current_path
+    Devise.allow_insecure_sign_in_after_accept = original_option_value
+  end
+
+  test 'does not sign in user automatically after setting it\'s password if config.allow_insecure_sign_in_after_accept is false' do
+    original_option_value = Devise.allow_insecure_sign_in_after_accept
+    Devise.allow_insecure_sign_in_after_accept = false
+
+    User.invite!(:email => "valid@email.com")
+    set_password :invitation_token => Thread.current[:token]
+
+    assert_equal new_user_session_path, current_path
+    Devise.allow_insecure_sign_in_after_accept = original_option_value
   end
 
   test 'clear token and set invitation_accepted_at after recover password instead of accept_invitation' do

data/test/rails_app/config/application.rb

@@ -20,5 +20,6 @@ module RailsApp
   class Application < Rails::Application
     config.filter_parameters << :password
     config.action_mailer.default_url_options = { :host => "localhost:3000" }
+    config.i18n.enforce_available_locales = true
   end
 end

data/test/rails_app/config/initializers/devise.rb

@@ -129,6 +129,11 @@ Devise.setup do |config|
   # Default: nil
   config.invited_by_counter_cache = :invitations_count
 
+  # Auto-login after the user accepts the invite. If this is false,
+  # the user will need to manually log in after accepting the invite.
+  # Default: true
+  # config.allow_insecure_sign_in_after_accept = false
+
   # ==> Configuration for :confirmable
   # A period that the user is allowed to access the website even without
   # confirming his account. For instance, if set to 2.days, the user will be

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise_invitable
 version: !ruby/object:Gem::Version
-  version: 1.4.1
+  version: 1.4.2
 platform: ruby
 authors:
 - Sergio Cambra
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-02-17 00:00:00.000000000 Z
+date: 2015-03-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler