devise_token_auth 0.1.43 → 1.2.0

data/app/controllers/devise_token_auth/registrations_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth
   class RegistrationsController < DeviseTokenAuth::ApplicationController
     before_action :set_user_by_token, only: [:destroy, :update]
@@ -6,21 +8,19 @@ module DeviseTokenAuth
     skip_after_action :update_auth_header, only: [:create, :destroy]
 
     def create
-      @resource            = resource_class.new(sign_up_params.except(:confirm_success_url))
-      @resource.provider   = provider
+      build_resource
 
-      # honor devise configuration for case_insensitive_keys
-      if resource_class.case_insensitive_keys.include?(:email)
-        @resource.email = sign_up_params[:email].try :downcase
-      else
-        @resource.email = sign_up_params[:email]
+      unless @resource.present?
+        raise DeviseTokenAuth::Errors::NoResourceDefinedError,
+              "#{self.class.name} #build_resource does not define @resource,"\
+              ' execution stopped.'
       end
 
       # give redirect value from params priority
-      @redirect_url = sign_up_params[:confirm_success_url]
-
-      # fall back to default value if provided
-      @redirect_url ||= DeviseTokenAuth.default_confirm_success_url
+      @redirect_url = params.fetch(
+        :confirm_success_url,
+        DeviseTokenAuth.default_confirm_success_url
+      )
 
       # success redirect url is required
       if confirmable_enabled? && !@redirect_url
@@ -28,46 +28,40 @@ module DeviseTokenAuth
       end
 
       # if whitelist is set, validate redirect_url against whitelist
-      if DeviseTokenAuth.redirect_whitelist
-        unless DeviseTokenAuth::Url.whitelisted?(@redirect_url)
-          return render_create_error_redirect_url_not_allowed
-        end
-      end
+      return render_create_error_redirect_url_not_allowed if blacklisted_redirect_url?(@redirect_url)
 
-      begin
-        # override email confirmation, must be sent manually from ctrl
-        resource_class.set_callback("create", :after, :send_on_create_confirmation_instructions)
-        resource_class.skip_callback("create", :after, :send_on_create_confirmation_instructions)
-        if @resource.respond_to? :skip_confirmation_notification!
-          # Fix duplicate e-mails by disabling Devise confirmation e-mail
-          @resource.skip_confirmation_notification!
-        end
-        if @resource.save
-          yield @resource if block_given?
+      # override email confirmation, must be sent manually from ctrl
+      callback_name = defined?(ActiveRecord) && resource_class < ActiveRecord::Base ? :commit : :create
+      resource_class.set_callback(callback_name, :after, :send_on_create_confirmation_instructions)
+      resource_class.skip_callback(callback_name, :after, :send_on_create_confirmation_instructions)
 
-          unless @resource.confirmed?
-            # user will require email authentication
-            @resource.send_confirmation_instructions({
-              client_config: params[:config_name],
-              redirect_url: @redirect_url
-            })
+      if @resource.respond_to? :skip_confirmation_notification!
+        # Fix duplicate e-mails by disabling Devise confirmation e-mail
+        @resource.skip_confirmation_notification!
+      end
 
-          else
-            # email auth has been bypassed, authenticate user
-            @client_id, @token = @resource.create_token
+      if @resource.save
+        yield @resource if block_given?
 
-            @resource.save!
+        unless @resource.confirmed?
+          # user will require email authentication
+          @resource.send_confirmation_instructions({
+            client_config: params[:config_name],
+            redirect_url: @redirect_url
+          })
+        end
 
-            update_auth_header
-          end
-          render_create_success
-        else
-          clean_up_passwords @resource
-          render_create_error
+        if active_for_authentication?
+          # email auth has been bypassed, authenticate user
+          @token = @resource.create_token
+          @resource.save!
+          update_auth_header
         end
-      rescue ActiveRecord::RecordNotUnique
+
+        render_create_success
+      else
         clean_up_passwords @resource
-        render_create_error_email_already_exists
+        render_create_error
       end
     end
 
@@ -88,7 +82,6 @@ module DeviseTokenAuth
       if @resource
         @resource.destroy
         yield @resource if block_given?
-
         render_destroy_success
       else
         render_destroy_error
@@ -96,7 +89,7 @@ module DeviseTokenAuth
     end
 
     def sign_up_params
-      params.permit([*params_for_resource(:sign_up), :confirm_success_url])
+      params.permit(*params_for_resource(:sign_up))
     end
 
     def account_update_params
@@ -105,6 +98,18 @@ module DeviseTokenAuth
 
     protected
 
+    def build_resource
+      @resource            = resource_class.new(sign_up_params)
+      @resource.provider   = provider
+
+      # honor devise configuration for case_insensitive_keys
+      if resource_class.case_insensitive_keys.include?(:email)
+        @resource.email = sign_up_params[:email].try(:downcase)
+      else
+        @resource.email = sign_up_params[:email]
+      end
+    end
+
     def render_create_error_missing_confirm_success_url
       response = {
         status: 'error',
@@ -138,15 +143,6 @@ module DeviseTokenAuth
       }, status: 422
     end
 
-    def render_create_error_email_already_exists
-      response = {
-        status: 'error',
-        data:   resource_data
-      }
-      message = I18n.t('devise_token_auth.registrations.email_already_exists', email: @resource.email)
-      render_error(422, message, response)
-    end
-
     def render_update_success
       render json: {
         status: 'success',
@@ -162,7 +158,7 @@ module DeviseTokenAuth
     end
 
     def render_update_error_user_not_found
-      render_error(404, I18n.t('devise_token_auth.registrations.user_not_found'), { status: 'error' })
+      render_error(404, I18n.t('devise_token_auth.registrations.user_not_found'), status: 'error')
     end
 
     def render_destroy_success
@@ -173,7 +169,7 @@ module DeviseTokenAuth
     end
 
     def render_destroy_error
-      render_error(404, I18n.t('devise_token_auth.registrations.account_to_destroy_not_found'), { status: 'error' })
+      render_error(404, I18n.t('devise_token_auth.registrations.account_to_destroy_not_found'), status: 'error')
     end
 
     private
@@ -181,12 +177,12 @@ module DeviseTokenAuth
     def resource_update_method
       if DeviseTokenAuth.check_current_password_before_update == :attributes
         'update_with_password'
-      elsif DeviseTokenAuth.check_current_password_before_update == :password && account_update_params.has_key?(:password)
+      elsif DeviseTokenAuth.check_current_password_before_update == :password && account_update_params.key?(:password)
         'update_with_password'
-      elsif account_update_params.has_key?(:current_password)
+      elsif account_update_params.key?(:current_password)
         'update_with_password'
       else
-        'update_attributes'
+        'update'
       end
     end
 
@@ -199,7 +195,11 @@ module DeviseTokenAuth
     end
 
     def validate_post_data which, message
-      render_error(:unprocessable_entity, message, { status: 'error' }) if which.empty?
+      render_error(:unprocessable_entity, message, status: 'error') if which.empty?
+    end
+
+    def active_for_authentication?
+      !@resource.respond_to?(:active_for_authentication?) || @resource.active_for_authentication?
     end
   end
 end

data/app/controllers/devise_token_auth/sessions_controller.rb

@@ -1,8 +1,10 @@
+# frozen_string_literal: true
+
 # see http://www.emilsoman.com/blog/2013/05/18/building-a-tested/
 module DeviseTokenAuth
   class SessionsController < DeviseTokenAuth::ApplicationController
-    before_action :set_user_by_token, :only => [:destroy]
-    after_action :reset_session, :only => [:destroy]
+    before_action :set_user_by_token, only: [:destroy]
+    after_action :reset_session, only: [:destroy]
 
     def new
       render_new_error
@@ -22,9 +24,9 @@ module DeviseTokenAuth
       if @resource && valid_params?(field, q_value) && (!@resource.respond_to?(:active_for_authentication?) || @resource.active_for_authentication?)
         valid_password = @resource.valid_password?(resource_params[:password])
         if (@resource.respond_to?(:valid_for_authentication?) && !@resource.valid_for_authentication? { valid_password }) || !valid_password
-         return render_create_error_bad_credentials
+          return render_create_error_bad_credentials
         end
-        @client_id, @token = @resource.create_token
+        @token = @resource.create_token
         @resource.save
 
         sign_in(:user, @resource, store: false, bypass: false)
@@ -46,13 +48,19 @@ module DeviseTokenAuth
     def destroy
       # remove auth instance variables so that after_action does not run
       user = remove_instance_variable(:@resource) if @resource
-      client_id = remove_instance_variable(:@client_id) if @client_id
-      remove_instance_variable(:@token) if @token
+      client = @token.client
+      @token.clear!
 
-      if user && client_id && user.tokens[client_id]
-        user.tokens.delete(client_id)
+      if user && client && user.tokens[client]
+        user.tokens.delete(client)
         user.save!
 
+        if DeviseTokenAuth.cookie_enabled
+          # If a cookie is set with a domain specified then it must be deleted with that domain specified
+          # See https://api.rubyonrails.org/classes/ActionDispatch/Cookies.html
+          cookies.delete(DeviseTokenAuth.cookie_name, domain: DeviseTokenAuth.cookie_attributes[:domain])
+        end
+
         yield user if block_given?
 
         render_destroy_success
@@ -85,14 +93,11 @@ module DeviseTokenAuth
         auth_val.downcase!
       end
 
-      return {
-        key: auth_key,
-        val: auth_val
-      }
+      { key: auth_key, val: auth_val }
     end
 
     def render_new_error
-      render_error(405, I18n.t("devise_token_auth.sessions.not_supported"))
+      render_error(405, I18n.t('devise_token_auth.sessions.not_supported'))
     end
 
     def render_create_success
@@ -102,15 +107,15 @@ module DeviseTokenAuth
     end
 
     def render_create_error_not_confirmed
-      render_error(401, I18n.t("devise_token_auth.sessions.not_confirmed", email: @resource.email))
+      render_error(401, I18n.t('devise_token_auth.sessions.not_confirmed', email: @resource.email))
     end
 
     def render_create_error_account_locked
-      render_error(401, I18n.t("devise.mailer.unlock_instructions.account_lock_msg"))
+      render_error(401, I18n.t('devise.mailer.unlock_instructions.account_lock_msg'))
     end
 
     def render_create_error_bad_credentials
-      render_error(401, I18n.t("devise_token_auth.sessions.bad_credentials"))
+      render_error(401, I18n.t('devise_token_auth.sessions.bad_credentials'))
     end
 
     def render_destroy_success
@@ -120,7 +125,7 @@ module DeviseTokenAuth
     end
 
     def render_destroy_error
-      render_error(404, I18n.t("devise_token_auth.sessions.user_not_found"))
+      render_error(404, I18n.t('devise_token_auth.sessions.user_not_found'))
     end
 
     private
@@ -128,6 +133,5 @@ module DeviseTokenAuth
     def resource_params
       params.permit(*params_for_resource(:sign_in))
     end
-
   end
 end

data/app/controllers/devise_token_auth/token_validations_controller.rb

@@ -1,7 +1,9 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth
   class TokenValidationsController < DeviseTokenAuth::ApplicationController
-    skip_before_action :assert_is_devise_resource!, :only => [:validate_token]
-    before_action :set_user_by_token, :only => [:validate_token]
+    skip_before_action :assert_is_devise_resource!, only: [:validate_token]
+    before_action :set_user_by_token, only: [:validate_token]
 
     def validate_token
       # @resource will have been set by set_user_by_token concern
@@ -23,7 +25,7 @@ module DeviseTokenAuth
     end
 
     def render_validate_token_error
-      render_error(401, I18n.t("devise_token_auth.token_validations.invalid"))
+      render_error(401, I18n.t('devise_token_auth.token_validations.invalid'))
     end
   end
 end

data/app/controllers/devise_token_auth/unlocks_controller.rb

@@ -1,13 +1,13 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth
   class UnlocksController < DeviseTokenAuth::ApplicationController
-    skip_after_action :update_auth_header, :only => [:create, :show]
+    skip_after_action :update_auth_header, only: [:create, :show]
 
     # this action is responsible for generating unlock tokens and
     # sending emails
     def create
-      unless resource_params[:email]
-        return render_create_error_missing_email
-      end
+      return render_create_error_missing_email unless resource_params[:email]
 
       @email = get_case_insensitive_field_from_resource_params(:email)
       @resource = find_resource(:email, @email)
@@ -15,11 +15,11 @@ module DeviseTokenAuth
       if @resource
         yield @resource if block_given?
 
-        @resource.send_unlock_instructions({
+        @resource.send_unlock_instructions(
           email: @email,
           provider: 'email',
           client_config: params[:config_name]
-        })
+        )
 
         if @resource.errors.empty?
           return render_create_success
@@ -34,14 +34,14 @@ module DeviseTokenAuth
     def show
       @resource = resource_class.unlock_access_by_token(params[:unlock_token])
 
-      if @resource && @resource.id
-        client_id, token = @resource.create_token
+      if @resource.persisted?
+        token = @resource.create_token
         @resource.save!
         yield @resource if block_given?
 
-        redirect_header_options = {unlock: true}
-        redirect_headers = build_redirect_headers(token,
-                                                  client_id,
+        redirect_header_options = { unlock: true }
+        redirect_headers = build_redirect_headers(token.token,
+                                                  token.client,
                                                   redirect_header_options)
         redirect_to(@resource.build_auth_url(after_unlock_path_for(@resource),
                                              redirect_headers))
@@ -57,29 +57,33 @@ module DeviseTokenAuth
     end
 
     def render_create_error_missing_email
-      render_error(401, I18n.t("devise_token_auth.unlocks.missing_email"))
+      render_error(401, I18n.t('devise_token_auth.unlocks.missing_email'))
     end
 
     def render_create_success
       render json: {
         success: true,
-        message: I18n.t("devise_token_auth.unlocks.sended", email: @email)
+        message: success_message('unlocks', @email)
       }
     end
 
     def render_create_error(errors)
       render json: {
         success: false,
-        errors: errors,
+        errors: errors
       }, status: 400
     end
 
     def render_show_error
-      raise ActionController::RoutingError.new('Not Found')
+      raise ActionController::RoutingError, 'Not Found'
     end
 
     def render_not_found_error
-      render_error(404, I18n.t("devise_token_auth.unlocks.user_not_found", email: @email))
+      if Devise.paranoid
+        render_error(404, I18n.t('devise_token_auth.unlocks.sended_paranoid'))
+      else
+        render_error(404, I18n.t('devise_token_auth.unlocks.user_not_found', email: @email))
+      end
     end
 
     def resource_params

data/app/models/devise_token_auth/concerns/active_record_support.rb

@@ -0,0 +1,14 @@
+module DeviseTokenAuth::Concerns::ActiveRecordSupport
+  extend ActiveSupport::Concern
+
+  included do
+    serialize :tokens, DeviseTokenAuth::Concerns::TokensSerialization
+  end
+
+  class_methods do
+    # It's abstract replacement .find_by
+    def dta_find_by(attrs = {})
+      find_by(attrs)
+    end
+  end
+end

data/app/models/devise_token_auth/concerns/confirmable_support.rb

@@ -0,0 +1,28 @@
+module DeviseTokenAuth::Concerns::ConfirmableSupport
+  extend ActiveSupport::Concern
+
+  included do
+    # Override standard devise `postpone_email_change?` method
+    # for not to use `will_save_change_to_email?` & `email_changed?` methods.
+    def postpone_email_change?
+      postpone = self.class.reconfirmable &&
+        email_value_in_database != email &&
+        !@bypass_confirmation_postpone &&
+        self.email.present? &&
+        (!@skip_reconfirmation_in_callback || !email_value_in_database.nil?)
+      @bypass_confirmation_postpone = false
+      postpone
+    end
+  end
+
+  protected
+
+  def email_value_in_database
+    rails51 = Rails.gem_version >= Gem::Version.new("5.1.x")
+    if rails51 && respond_to?(:email_in_database)
+      email_in_database
+    else
+      email_was
+    end
+  end
+end

data/app/models/devise_token_auth/concerns/mongoid_support.rb

@@ -0,0 +1,19 @@
+module DeviseTokenAuth::Concerns::MongoidSupport
+  extend ActiveSupport::Concern
+
+  def as_json(options = {})
+    options[:except] = (options[:except] || []) + [:_id]
+    hash = super(options)
+    hash['id'] = to_param
+    hash
+  end
+
+  class_methods do
+    # It's abstract replacement .find_by
+    def dta_find_by(attrs = {})
+      find_by(attrs)
+    rescue Mongoid::Errors::DocumentNotFound
+      nil
+    end
+  end
+end

data/app/models/devise_token_auth/concerns/tokens_serialization.rb

@@ -0,0 +1,31 @@
+module DeviseTokenAuth::Concerns::TokensSerialization
+  extend self
+  # Serialization hash to json
+  def dump(object)
+    JSON.generate(object && object.transform_values do |token|
+      serialize_updated_at(token).compact
+    end.compact)
+  end
+
+  # Deserialization json to hash
+  def load(json)
+    case json
+    when String
+      JSON.parse(json)
+    when NilClass
+      {}
+    else
+      json
+    end
+  end
+
+  private
+
+  def serialize_updated_at(token)
+    updated_at_key = ['updated_at', :updated_at].find(&token.method(:[]))
+
+    return token unless token[updated_at_key].respond_to?(:iso8601)
+
+    token.merge updated_at_key => token[updated_at_key].iso8601
+  end
+end