devise_token_auth 0.1.43 → 0.2.0

data/Rakefile

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 begin
   require 'bundler/setup'
 rescue LoadError

data/app/controllers/devise_token_auth/application_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth
   class ApplicationController < DeviseController
     include DeviseTokenAuth::Concerns::SetUserByToken
@@ -17,6 +19,10 @@ module DeviseTokenAuth
 
     protected
 
+    def blacklisted_redirect_url?
+      DeviseTokenAuth.redirect_whitelist && !DeviseTokenAuth::Url.whitelisted?(@redirect_url)
+    end
+
     def build_redirect_headers(access_token, client, redirect_header_options = {})
       {
         DeviseTokenAuth.headers_names[:"access-token"] => access_token,

data/app/controllers/devise_token_auth/concerns/resource_finder.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth::Concerns::ResourceFinder
   extend ActiveSupport::Concern
   include DeviseTokenAuth::Controllers::Helpers

data/app/controllers/devise_token_auth/concerns/set_user_by_token.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth::Concerns::SetUserByToken
   extend ActiveSupport::Concern
   include DeviseTokenAuth::Concerns::ResourceFinder
@@ -11,7 +13,7 @@ module DeviseTokenAuth::Concerns::SetUserByToken
 
   # keep track of request duration
   def set_request_start
-    @request_started_at = Time.now
+    @request_started_at = Time.zone.now
     @used_auth_by_token = true
 
     # initialize instance variables
@@ -60,7 +62,9 @@ module DeviseTokenAuth::Concerns::SetUserByToken
       if devise_warden_user && devise_warden_user.tokens[@client_id].nil?
         @used_auth_by_token = false
         @resource = devise_warden_user
-        @resource.create_new_auth_token
+        # REVIEW: The following line _should_ be safe to remove;
+        #  the generated token does not get used anywhere.
+        # @resource.create_new_auth_token
       end
     end
 
@@ -131,22 +135,13 @@ module DeviseTokenAuth::Concerns::SetUserByToken
           if @is_batch_request
             auth_header = @resource.extend_batch_buffer(@token, @client_id)
 
-            # Do not return token for batch requests to avoid invalidated
-            # tokens returned to the client in case of race conditions.
-            # Use a blank string for the header to still be present and
-            # being passed in a XHR response in case of
-            # 304 Not Modified responses.
-            auth_header[DeviseTokenAuth.headers_names[:"access-token"]] = ' '
-            auth_header[DeviseTokenAuth.headers_names[:"expiry"]] = ' '
-
           # update Authorization response header with new token
           else
             auth_header = @resource.create_new_auth_token(@client_id)
-          end
-
-          # update the response header
-          response.headers.merge!(auth_header)
 
+            # update the response header
+            response.headers.merge!(auth_header)
+          end
         end # end lock
       end # end ensure_pristine_resource
     end

data/app/controllers/devise_token_auth/confirmations_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth
   class ConfirmationsController < DeviseTokenAuth::ApplicationController
     def show
@@ -6,7 +8,7 @@ module DeviseTokenAuth
       if @resource && @resource.id
         expiry = nil
         if defined?(@resource.sign_in_count) && @resource.sign_in_count > 0
-          expiry = (Time.now + 1.second).to_i
+          expiry = (Time.zone.now + 1.second).to_i
         end
 
         client_id, token = @resource.create_token expiry: expiry

data/app/controllers/devise_token_auth/omniauth_callbacks_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth
   class OmniauthCallbacksController < DeviseTokenAuth::ApplicationController
 

data/app/controllers/devise_token_auth/passwords_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth
   class PasswordsController < DeviseTokenAuth::ApplicationController
     before_action :set_user_by_token, :only => [:update]
@@ -11,21 +13,13 @@ module DeviseTokenAuth
       end
 
       # give redirect value from params priority
-      @redirect_url = params[:redirect_url]
-
-      # fall back to default value if provided
-      @redirect_url ||= DeviseTokenAuth.default_password_reset_url
-
-      unless @redirect_url
-        return render_create_error_missing_redirect_url
-      end
+      @redirect_url = params.fetch(
+          :redirect_url,
+          DeviseTokenAuth.default_password_reset_url
+        )
 
-      # if whitelist is set, validate redirect_url against whitelist
-      if DeviseTokenAuth.redirect_whitelist
-        unless DeviseTokenAuth::Url.whitelisted?(@redirect_url)
-          return render_create_error_not_allowed_redirect_url
-        end
-      end
+      return render_create_error_missing_redirect_url unless @redirect_url
+      return render_create_error_not_allowed_redirect_url if blacklisted_redirect_url?
 
       @email = get_case_insensitive_field_from_resource_params(:email)
       @resource = find_resource(:uid, @email)

data/app/controllers/devise_token_auth/registrations_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth
   class RegistrationsController < DeviseTokenAuth::ApplicationController
     before_action :set_user_by_token, only: [:destroy, :update]
@@ -6,21 +8,18 @@ module DeviseTokenAuth
     skip_after_action :update_auth_header, only: [:create, :destroy]
 
     def create
-      @resource            = resource_class.new(sign_up_params.except(:confirm_success_url))
-      @resource.provider   = provider
+      build_resource
 
-      # honor devise configuration for case_insensitive_keys
-      if resource_class.case_insensitive_keys.include?(:email)
-        @resource.email = sign_up_params[:email].try :downcase
-      else
-        @resource.email = sign_up_params[:email]
+      unless @resource.present?
+        raise DeviseTokenAuth::Errors::NoResourceDefinedError,
+          "#{self.class.name} #build_resource does not define @resource, execution stopped"
       end
 
       # give redirect value from params priority
-      @redirect_url = sign_up_params[:confirm_success_url]
-
-      # fall back to default value if provided
-      @redirect_url ||= DeviseTokenAuth.default_confirm_success_url
+      @redirect_url = params.fetch(
+        :confirm_success_url,
+        DeviseTokenAuth.default_confirm_success_url
+      )
 
       # success redirect url is required
       if confirmable_enabled? && !@redirect_url
@@ -28,20 +27,18 @@ module DeviseTokenAuth
       end
 
       # if whitelist is set, validate redirect_url against whitelist
-      if DeviseTokenAuth.redirect_whitelist
-        unless DeviseTokenAuth::Url.whitelisted?(@redirect_url)
-          return render_create_error_redirect_url_not_allowed
-        end
-      end
+      return render_create_error_redirect_url_not_allowed if blacklisted_redirect_url?
 
       begin
         # override email confirmation, must be sent manually from ctrl
         resource_class.set_callback("create", :after, :send_on_create_confirmation_instructions)
         resource_class.skip_callback("create", :after, :send_on_create_confirmation_instructions)
+
         if @resource.respond_to? :skip_confirmation_notification!
           # Fix duplicate e-mails by disabling Devise confirmation e-mail
           @resource.skip_confirmation_notification!
         end
+
         if @resource.save
           yield @resource if block_given?
 
@@ -51,13 +48,10 @@ module DeviseTokenAuth
               client_config: params[:config_name],
               redirect_url: @redirect_url
             })
-
           else
             # email auth has been bypassed, authenticate user
             @client_id, @token = @resource.create_token
-
             @resource.save!
-
             update_auth_header
           end
           render_create_success
@@ -88,7 +82,6 @@ module DeviseTokenAuth
       if @resource
         @resource.destroy
         yield @resource if block_given?
-
         render_destroy_success
       else
         render_destroy_error
@@ -96,7 +89,7 @@ module DeviseTokenAuth
     end
 
     def sign_up_params
-      params.permit([*params_for_resource(:sign_up), :confirm_success_url])
+      params.permit(*params_for_resource(:sign_up))
     end
 
     def account_update_params
@@ -105,6 +98,18 @@ module DeviseTokenAuth
 
     protected
 
+    def build_resource
+      @resource            = resource_class.new(sign_up_params)
+      @resource.provider   = provider
+
+      # honor devise configuration for case_insensitive_keys
+      if resource_class.case_insensitive_keys.include?(:email)
+        @resource.email = sign_up_params[:email].try(:downcase)
+      else
+        @resource.email = sign_up_params[:email]
+      end
+    end
+
     def render_create_error_missing_confirm_success_url
       response = {
         status: 'error',

data/app/controllers/devise_token_auth/sessions_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # see http://www.emilsoman.com/blog/2013/05/18/building-a-tested/
 module DeviseTokenAuth
   class SessionsController < DeviseTokenAuth::ApplicationController

data/app/controllers/devise_token_auth/token_validations_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth
   class TokenValidationsController < DeviseTokenAuth::ApplicationController
     skip_before_action :assert_is_devise_resource!, :only => [:validate_token]

data/app/controllers/devise_token_auth/unlocks_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth
   class UnlocksController < DeviseTokenAuth::ApplicationController
     skip_after_action :update_auth_header, :only => [:create, :show]

data/app/models/devise_token_auth/concerns/user.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'bcrypt'
 
 module DeviseTokenAuth::Concerns::User
@@ -91,13 +93,15 @@ module DeviseTokenAuth::Concerns::User
   def create_token(client_id: nil, token: nil, expiry: nil, **token_extras)
     client_id ||= SecureRandom.urlsafe_base64(nil, false)
     token     ||= SecureRandom.urlsafe_base64(nil, false)
-    expiry    ||= (Time.now + token_lifespan).to_i
+    expiry    ||= (Time.zone.now + token_lifespan).to_i
 
     self.tokens[client_id] = {
       token: BCrypt::Password.create(token),
       expiry: expiry
     }.merge!(token_extras)
 
+    clean_old_tokens
+
     [client_id, token, expiry]
   end
 
@@ -139,7 +143,7 @@ module DeviseTokenAuth::Concerns::User
       expiry && token &&
 
       # ensure that the token has not yet expired
-      DateTime.strptime(expiry.to_s, '%s') > Time.now &&
+      DateTime.strptime(expiry.to_s, '%s') > Time.zone.now &&
 
       # ensure that the token is valid
       DeviseTokenAuth::Concerns::User.tokens_match?(token_hash, token)
@@ -158,7 +162,7 @@ module DeviseTokenAuth::Concerns::User
       updated_at && last_token &&
 
       # ensure that previous token falls within the batch buffer throttle time of the last request
-      Time.parse(updated_at) > Time.now - DeviseTokenAuth.batch_request_buffer_throttle &&
+      Time.parse(updated_at) > Time.zone.now - DeviseTokenAuth.batch_request_buffer_throttle &&
 
       # ensure that the token is valid
       ::BCrypt::Password.new(last_token) == token
@@ -168,7 +172,7 @@ module DeviseTokenAuth::Concerns::User
 
   # update user's auth token (should happen on each request)
   def create_new_auth_token(client_id=nil)
-    now = Time.now
+    now = Time.zone.now
 
     client_id, token = create_token(
       client_id: client_id,
@@ -196,17 +200,12 @@ module DeviseTokenAuth::Concerns::User
 
   def update_auth_header(token, client_id='default')
     headers = build_auth_header(token, client_id)
-    while tokens.length > 0 && DeviseTokenAuth.max_number_of_devices < tokens.length
-      oldest_client_id, _tk = tokens.min_by { |_cid, v| v[:expiry] || v["expiry"] }
-      tokens.delete(oldest_client_id)
-    end
-
+    clean_old_tokens
     save!
 
     headers
   end
 
-
   def build_auth_url(base_url, args)
     args[:uid]    = uid
     args[:expiry] = tokens[args[:client_id]]['expiry']
@@ -214,9 +213,8 @@ module DeviseTokenAuth::Concerns::User
     DeviseTokenAuth::Url.generate(base_url, args)
   end
 
-
   def extend_batch_buffer(token, client_id)
-    self.tokens[client_id]['updated_at'] = Time.now
+    self.tokens[client_id]['updated_at'] = Time.zone.now
     update_auth_header(token, client_id)
   end
 
@@ -242,19 +240,46 @@ module DeviseTokenAuth::Concerns::User
     if tokens
       tokens.delete_if do |cid, v|
         expiry = v[:expiry] || v["expiry"]
-        DateTime.strptime(expiry.to_s, '%s') < Time.now
+        DateTime.strptime(expiry.to_s, '%s') < Time.zone.now
       end
     end
   end
 
+  def should_remove_tokens_after_password_reset?
+    if Rails::VERSION::MAJOR <= 5
+      encrypted_password_changed? &&
+      DeviseTokenAuth.remove_tokens_after_password_reset
+    else
+      saved_change_to_encrypted_password? &&
+      DeviseTokenAuth.remove_tokens_after_password_reset
+    end
+  end
+
   def remove_tokens_after_password_reset
-    should_remove_old_tokens = DeviseTokenAuth.remove_tokens_after_password_reset &&
-                               encrypted_password_changed? && tokens && tokens.many?
+    return unless should_remove_tokens_after_password_reset?
 
-    if should_remove_old_tokens
+    if tokens.present? && tokens.many?
       client_id, token_data = tokens.max_by { |cid, v| v[:expiry] || v["expiry"] }
       self.tokens = {client_id => token_data}
     end
   end
 
+  def max_client_tokens_exceeded?
+    tokens.length > DeviseTokenAuth.max_number_of_devices
+  end
+
+  def clean_old_tokens
+    if tokens.present? && max_client_tokens_exceeded?
+      # Using Enumerable#sort_by on a Hash will typecast it into an associative
+      #   Array (i.e. an Array of key-value Array pairs). However, since Hashes
+      #   have an internal order in Ruby 1.9+, the resulting sorted associative
+      #   Array can be converted back into a Hash, while maintaining the sorted
+      #   order.
+      self.tokens = tokens.sort_by { |_cid, v| v[:expiry] || v['expiry'] }.to_h
+
+      # Since the tokens are sorted by expiry, shift the oldest client token
+      #   off the Hash until it no longer exceeds the maximum number of clients
+      tokens.shift while max_client_tokens_exceeded?
+    end
+  end
 end

data/app/models/devise_token_auth/concerns/user_omniauth_callbacks.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth::Concerns::UserOmniauthCallbacks
   extend ActiveSupport::Concern
 

data/app/validators/email_validator.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class EmailValidator < ActiveModel::EachValidator
   def validate_each(record, attribute, value)
     unless value =~ /\A([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})\z/i
@@ -18,4 +20,4 @@ class EmailValidator < ActiveModel::EachValidator
 
     message
   end
-end
+end

data/config/initializers/devise.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # Use this hook to configure devise mailer, warden hooks and so forth.
 # Many of these configuration options can be set straight in your model.
 Devise.setup do |config|

data/config/locales/da-DK.yml

@@ -26,7 +26,7 @@ da-DK:
     unlocks:
       missing_email: "Du skal udfylde en email."
       sended: "En email er blevet sendt til '%{email}', som indeholder instruktioner for at låse kontoen op."
-      user_not_found: "Kan ikke finde en burger med email '%{email}'."
+      user_not_found: "Kan ikke finde en bruger med email '%{email}'."
   errors:
     messages:
       validate_sign_up_params: "Angiv venligst passende registeringsdata i request body."

data/config/locales/sv.yml

@@ -0,0 +1,50 @@
+sv:
+  devise_token_auth:
+    sessions:
+      not_confirmed: "Ett bekräftelse-email har skickats till '%{email}'. Följ instruktionerna i emailet så kan ditt konto aktiveras"
+      bad_credentials: "Ogiltig login-information. Vänligen försök igen."
+      not_supported: "Använd POST /sign_in för att logga in. GET stöds inte."
+      user_not_found: "Användaren hittades inte eller var inte inloggad."
+    token_validations:
+      invalid: "Ogiltig token-information"
+    registrations:
+      missing_confirm_success_url: "Saknar 'confirm_success_url'-parameter."
+      redirect_url_not_allowed: "Omdirigering till '%{redirect_url}' ej tillåten."
+      email_already_exists: "Det finns redan ett konto för '%{email}'"
+      account_with_uid_destroyed: "Kontot med UID '%{uid}' har tagits bort."
+      account_to_destroy_not_found: "Kunde inte hitta kontot för borttagning."
+      user_not_found: "Användaren hittades ej."
+    passwords:
+      missing_email: "Du måste ange en emailadress."
+      missing_redirect_url: "Saknar en omdirigerings-URL."
+      not_allowed_redirect_url: "Omdirigering till '%{redirect_url}' ej tillåten."
+      sended: "Ett email har skickats till '%{email}' med instruktioner för hur du skapar ett nytt lösenord."
+      user_not_found: "Kunde inte hitta användaren med email '%{email}'."
+      password_not_required: "Det har kontot kräver inget lösenord. Logga in via ditt '%{provider}'-konto istället."
+      missing_passwords: "Du måste fylla i fälten 'Lösenord' och 'Upprepa lösenord'."
+      successfully_updated: "Ditt lösenord har ändrats."
+    unlocks:
+      missing_email: "Du måste ange en emailadress."
+      sended: "Ett email har skickats till '%{email}' med instruktioner för hur du låser upp ditt konto."
+      user_not_found: "Kunde inte hitta användaren med emailadressen '%{email}'."
+  errors:
+    messages:
+      validate_sign_up_params: "Vänligen skicka giltig data för att skapa konto i request-bodyn."
+      validate_account_update_params: "Vänligen skicka giltig data för att uppdatera konto i request-bodyn."
+      not_email: "är inte en emailadress"
+  devise:
+    mailer:
+      confirmation_instructions:
+        confirm_link_msg: "Du kan bekräfta ditt kontos emailadress genom att besöka länken nedan:"
+        confirm_account_link: "Bekräfta mitt konto"
+      reset_password_instructions:
+        request_reset_link_msg: "Någon har begärt en länk för att ändra ditt lösenord. Du kan göra detta via länken nedan."
+        password_change_link: "Byt mitt lösenord"
+        ignore_mail_msg: "Om du inte begärt detta, vänligen bortse från detta mail."
+        no_changes_msg: "Ditt lösenord kommer inte att ändras förrän du använder länken ovan och skapar ett nytt."
+      unlock_instructions:
+        account_lock_msg: "Ditt konto har låsts efter för många misslyckade loginförsök."
+        unlock_link_msg: "Klicka på länken nedan för att låsa upp ditt konto:"
+        unlock_link: "Lås upp mitt konto"
+  hello: "hej"
+  welcome: "välkommen"