kingsman 0.0.0.beta → 0.1.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (116) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +10 -0
  3. data/README.md +5 -4
  4. data/app/controllers/kingsman/confirmations_controller.rb +54 -0
  5. data/app/controllers/kingsman/omniauth_callbacks_controller.rb +36 -0
  6. data/app/controllers/kingsman/passwords_controller.rb +83 -0
  7. data/app/controllers/kingsman/registrations_controller.rb +168 -0
  8. data/app/controllers/kingsman/sessions_controller.rb +83 -0
  9. data/app/controllers/kingsman/unlocks_controller.rb +52 -0
  10. data/app/controllers/kingsman_controller.rb +252 -0
  11. data/app/jobs/application_job.rb +2 -0
  12. data/app/mailers/kingsman/mailer.rb +30 -0
  13. data/app/views/kingsman/confirmations/new.html.erb +16 -0
  14. data/app/views/kingsman/home/index.html.erb +1 -0
  15. data/app/views/kingsman/mailer/confirmation_instructions.html.erb +5 -0
  16. data/app/views/kingsman/mailer/email_changed.html.erb +7 -0
  17. data/app/views/kingsman/mailer/password_change.html.erb +3 -0
  18. data/app/views/kingsman/mailer/reset_password_instructions.html.erb +8 -0
  19. data/app/views/kingsman/mailer/unlock_instructions.html.erb +7 -0
  20. data/app/views/kingsman/passwords/edit.html.erb +25 -0
  21. data/app/views/kingsman/passwords/new.html.erb +16 -0
  22. data/app/views/kingsman/registrations/edit.html.erb +42 -0
  23. data/app/views/kingsman/registrations/new.html.erb +29 -0
  24. data/app/views/kingsman/sessions/new.html.erb +26 -0
  25. data/app/views/kingsman/shared/_error_messages.html.erb +15 -0
  26. data/app/views/kingsman/shared/_links.html.erb +25 -0
  27. data/app/views/kingsman/unlocks/new.html.erb +16 -0
  28. data/app/views/kingsman/up/index.html.erb +11 -0
  29. data/config/application.rb +0 -0
  30. data/config/locales/en.yml +63 -0
  31. data/config.ru +6 -0
  32. data/lib/generators/active_record/kingsman_generator.rb +127 -0
  33. data/lib/generators/active_record/templates/migration.rb +20 -0
  34. data/lib/generators/active_record/templates/migration_existing.rb +27 -0
  35. data/lib/generators/kingsman/controllers_generator.rb +46 -0
  36. data/lib/generators/kingsman/install_generator.rb +42 -0
  37. data/lib/generators/kingsman/kingsman_generator.rb +28 -0
  38. data/lib/generators/kingsman/orm_helpers.rb +40 -0
  39. data/lib/generators/kingsman/views_generator.rb +145 -0
  40. data/lib/generators/mongoid/kingsman_generator.rb +57 -0
  41. data/lib/generators/templates/README +36 -0
  42. data/lib/generators/templates/controllers/README +14 -0
  43. data/lib/generators/templates/controllers/confirmations_controller.rb +30 -0
  44. data/lib/generators/templates/controllers/omniauth_callbacks_controller.rb +30 -0
  45. data/lib/generators/templates/controllers/passwords_controller.rb +34 -0
  46. data/lib/generators/templates/controllers/registrations_controller.rb +62 -0
  47. data/lib/generators/templates/controllers/sessions_controller.rb +27 -0
  48. data/lib/generators/templates/controllers/unlocks_controller.rb +30 -0
  49. data/lib/generators/templates/kingsman.rb +313 -0
  50. data/lib/generators/templates/markerb/confirmation_instructions.markerb +5 -0
  51. data/lib/generators/templates/markerb/email_changed.markerb +7 -0
  52. data/lib/generators/templates/markerb/password_change.markerb +3 -0
  53. data/lib/generators/templates/markerb/reset_password_instructions.markerb +8 -0
  54. data/lib/generators/templates/markerb/unlock_instructions.markerb +7 -0
  55. data/lib/generators/templates/simple_form_for/confirmations/new.html.erb +20 -0
  56. data/lib/generators/templates/simple_form_for/passwords/edit.html.erb +27 -0
  57. data/lib/generators/templates/simple_form_for/passwords/new.html.erb +18 -0
  58. data/lib/generators/templates/simple_form_for/registrations/edit.html.erb +35 -0
  59. data/lib/generators/templates/simple_form_for/registrations/new.html.erb +25 -0
  60. data/lib/generators/templates/simple_form_for/sessions/new.html.erb +20 -0
  61. data/lib/generators/templates/simple_form_for/unlocks/new.html.erb +19 -0
  62. data/lib/kingsman/autoloader.rb +31 -0
  63. data/lib/kingsman/controllers/helpers.rb +221 -0
  64. data/lib/kingsman/controllers/rememberable.rb +57 -0
  65. data/lib/kingsman/controllers/responder.rb +35 -0
  66. data/lib/kingsman/controllers/scoped_views.rb +19 -0
  67. data/lib/kingsman/controllers/sign_in_out.rb +112 -0
  68. data/lib/kingsman/controllers/store_location.rb +76 -0
  69. data/lib/kingsman/controllers/url_helpers.rb +72 -0
  70. data/lib/kingsman/delegator.rb +18 -0
  71. data/lib/kingsman/encryptor.rb +19 -0
  72. data/lib/kingsman/failure_app.rb +280 -0
  73. data/lib/kingsman/hooks/activatable.rb +12 -0
  74. data/lib/kingsman/hooks/csrf_cleaner.rb +14 -0
  75. data/lib/kingsman/hooks/forgetable.rb +11 -0
  76. data/lib/kingsman/hooks/lockable.rb +9 -0
  77. data/lib/kingsman/hooks/proxy.rb +23 -0
  78. data/lib/kingsman/hooks/rememberable.rb +9 -0
  79. data/lib/kingsman/hooks/timeoutable.rb +35 -0
  80. data/lib/kingsman/hooks/trackable.rb +11 -0
  81. data/lib/kingsman/hooks.rb +6 -0
  82. data/lib/kingsman/jets/routes.rb +195 -0
  83. data/lib/kingsman/jets/warden_compat.rb +15 -0
  84. data/lib/kingsman/jets.rb +39 -0
  85. data/lib/kingsman/mailers/helpers.rb +93 -0
  86. data/lib/kingsman/mapping.rb +148 -0
  87. data/lib/kingsman/models/authenticatable.rb +310 -0
  88. data/lib/kingsman/models/confirmable.rb +369 -0
  89. data/lib/kingsman/models/database_authenticatable.rb +206 -0
  90. data/lib/kingsman/models/lockable.rb +214 -0
  91. data/lib/kingsman/models/omniauthable.rb +29 -0
  92. data/lib/kingsman/models/recoverable.rb +156 -0
  93. data/lib/kingsman/models/registerable.rb +29 -0
  94. data/lib/kingsman/models/rememberable.rb +158 -0
  95. data/lib/kingsman/models/timeoutable.rb +45 -0
  96. data/lib/kingsman/models/trackable.rb +51 -0
  97. data/lib/kingsman/models/validatable.rb +68 -0
  98. data/lib/kingsman/models.rb +122 -0
  99. data/lib/kingsman/modules.rb +33 -0
  100. data/lib/kingsman/omniauth/config.rb +47 -0
  101. data/lib/kingsman/omniauth/url_helpers.rb +28 -0
  102. data/lib/kingsman/omniauth.rb +20 -0
  103. data/lib/kingsman/orm/active_record.rb +13 -0
  104. data/lib/kingsman/orm/mongoid.rb +8 -0
  105. data/lib/kingsman/orm.rb +37 -0
  106. data/lib/kingsman/parameter_filter.rb +44 -0
  107. data/lib/kingsman/parameter_sanitizer.rb +173 -0
  108. data/lib/kingsman/secret_key_finder.rb +27 -0
  109. data/lib/kingsman/strategies/authenticatable.rb +178 -0
  110. data/lib/kingsman/strategies/base.rb +22 -0
  111. data/lib/kingsman/strategies/database_authenticatable.rb +31 -0
  112. data/lib/kingsman/strategies/rememberable.rb +67 -0
  113. data/lib/kingsman/token_generator.rb +32 -0
  114. data/lib/kingsman/version.rb +1 -1
  115. data/lib/kingsman.rb +427 -3
  116. metadata +304 -11
@@ -0,0 +1,369 @@
1
+ # frozen_string_literal: true
2
+
3
+ module Kingsman
4
+ module Models
5
+ # Confirmable is responsible to verify if an account is already confirmed to
6
+ # sign in, and to send emails with confirmation instructions.
7
+ # Confirmation instructions are sent to the user email after creating a
8
+ # record and when manually requested by a new confirmation instruction request.
9
+ #
10
+ # Confirmable tracks the following columns:
11
+ #
12
+ # * confirmation_token - A unique random token
13
+ # * confirmed_at - A timestamp when the user clicked the confirmation link
14
+ # * confirmation_sent_at - A timestamp when the confirmation_token was generated (not sent)
15
+ # * unconfirmed_email - An email address copied from the email attr. After confirmation
16
+ # this value is copied to the email attr then cleared
17
+ #
18
+ # == Options
19
+ #
20
+ # Confirmable adds the following options to +kingsman+:
21
+ #
22
+ # * +allow_unconfirmed_access_for+: the time you want to allow the user to access their account
23
+ # before confirming it. After this period, the user access is denied. You can
24
+ # use this to let your user access some features of your application without
25
+ # confirming the account, but blocking it after a certain period (ie 7 days).
26
+ # By default allow_unconfirmed_access_for is zero, it means users always have to confirm to sign in.
27
+ # * +reconfirmable+: requires any email changes to be confirmed (exactly the same way as
28
+ # initial account confirmation) to be applied. Requires additional unconfirmed_email
29
+ # db field to be set up (t.reconfirmable in migrations). Until confirmed, new email is
30
+ # stored in unconfirmed email column, and copied to email column on successful
31
+ # confirmation. Also, when used in conjunction with `send_email_changed_notification`,
32
+ # the notification is sent to the original email when the change is requested,
33
+ # not when the unconfirmed email is confirmed.
34
+ # * +confirm_within+: the time before a sent confirmation token becomes invalid.
35
+ # You can use this to force the user to confirm within a set period of time.
36
+ # Confirmable will not generate a new token if a repeat confirmation is requested
37
+ # during this time frame, unless the user's email changed too.
38
+ #
39
+ # == Examples
40
+ #
41
+ # User.find(1).confirm # returns true unless it's already confirmed
42
+ # User.find(1).confirmed? # true/false
43
+ # User.find(1).send_confirmation_instructions # manually send instructions
44
+ #
45
+ module Confirmable
46
+ extend ActiveSupport::Concern
47
+
48
+ included do
49
+ before_create :generate_confirmation_token, if: :confirmation_required?
50
+ after_create :skip_reconfirmation_in_callback!, if: :send_confirmation_notification?
51
+ if Kingsman::Orm.active_record?(self) # ActiveRecord
52
+ after_commit :send_on_create_confirmation_instructions, on: :create, if: :send_confirmation_notification?
53
+ after_commit :send_reconfirmation_instructions, on: :update, if: :reconfirmation_required?
54
+ else # Mongoid
55
+ after_create :send_on_create_confirmation_instructions, if: :send_confirmation_notification?
56
+ after_update :send_reconfirmation_instructions, if: :reconfirmation_required?
57
+ end
58
+ before_update :postpone_email_change_until_confirmation_and_regenerate_confirmation_token, if: :postpone_email_change?
59
+ end
60
+
61
+ def initialize(*args, &block)
62
+ @bypass_confirmation_postpone = false
63
+ @skip_reconfirmation_in_callback = false
64
+ @reconfirmation_required = false
65
+ @skip_confirmation_notification = false
66
+ @raw_confirmation_token = nil
67
+ super
68
+ end
69
+
70
+ def self.required_fields(klass)
71
+ required_methods = [:confirmation_token, :confirmed_at, :confirmation_sent_at]
72
+ required_methods << :unconfirmed_email if klass.reconfirmable
73
+ required_methods
74
+ end
75
+
76
+ # Confirm a user by setting it's confirmed_at to actual time. If the user
77
+ # is already confirmed, add an error to email field. If the user is invalid
78
+ # add errors
79
+ def confirm(args = {})
80
+ pending_any_confirmation do
81
+ if confirmation_period_expired?
82
+ self.errors.add(:email, :confirmation_period_expired,
83
+ period: Kingsman::TimeInflector.time_ago_in_words(self.class.confirm_within.ago))
84
+ return false
85
+ end
86
+
87
+ self.confirmed_at = Time.now.utc
88
+
89
+ saved = if pending_reconfirmation?
90
+ skip_reconfirmation!
91
+ self.email = unconfirmed_email
92
+ self.unconfirmed_email = nil
93
+
94
+ # We need to validate in such cases to enforce e-mail uniqueness
95
+ save(validate: true)
96
+ else
97
+ save(validate: args[:ensure_valid] == true)
98
+ end
99
+
100
+ after_confirmation if saved
101
+ saved
102
+ end
103
+ end
104
+
105
+ # Verifies whether a user is confirmed or not
106
+ def confirmed?
107
+ !!confirmed_at
108
+ end
109
+
110
+ def pending_reconfirmation?
111
+ self.class.reconfirmable && unconfirmed_email.present?
112
+ end
113
+
114
+ # Send confirmation instructions by email
115
+ def send_confirmation_instructions
116
+ unless @raw_confirmation_token
117
+ generate_confirmation_token!
118
+ end
119
+
120
+ opts = pending_reconfirmation? ? { to: unconfirmed_email } : { }
121
+ send_kingsman_notification(:confirmation_instructions, @raw_confirmation_token, opts)
122
+ end
123
+
124
+ def send_reconfirmation_instructions
125
+ @reconfirmation_required = false
126
+
127
+ unless @skip_confirmation_notification
128
+ send_confirmation_instructions
129
+ end
130
+ end
131
+
132
+ # Resend confirmation token.
133
+ # Regenerates the token if the period is expired.
134
+ def resend_confirmation_instructions
135
+ pending_any_confirmation do
136
+ send_confirmation_instructions
137
+ end
138
+ end
139
+
140
+ # Overwrites active_for_authentication? for confirmation
141
+ # by verifying whether a user is active to sign in or not. If the user
142
+ # is already confirmed, it should never be blocked. Otherwise we need to
143
+ # calculate if the confirm time has not expired for this user.
144
+ def active_for_authentication?
145
+ super && (!confirmation_required? || confirmed? || confirmation_period_valid?)
146
+ end
147
+
148
+ # The message to be shown if the account is inactive.
149
+ def inactive_message
150
+ !confirmed? ? :unconfirmed : super
151
+ end
152
+
153
+ # If you don't want confirmation to be sent on create, neither a code
154
+ # to be generated, call skip_confirmation!
155
+ def skip_confirmation!
156
+ self.confirmed_at = Time.now.utc
157
+ end
158
+
159
+ # Skips sending the confirmation/reconfirmation notification email after_create/after_update. Unlike
160
+ # #skip_confirmation!, record still requires confirmation.
161
+ def skip_confirmation_notification!
162
+ @skip_confirmation_notification = true
163
+ end
164
+
165
+ # If you don't want reconfirmation to be sent, neither a code
166
+ # to be generated, call skip_reconfirmation!
167
+ def skip_reconfirmation!
168
+ @bypass_confirmation_postpone = true
169
+ end
170
+
171
+ protected
172
+
173
+ # To not require reconfirmation after creating with #save called in a
174
+ # callback call skip_create_confirmation!
175
+ def skip_reconfirmation_in_callback!
176
+ @skip_reconfirmation_in_callback = true
177
+ end
178
+
179
+ # A callback method used to deliver confirmation
180
+ # instructions on creation. This can be overridden
181
+ # in models to map to a nice sign up e-mail.
182
+ def send_on_create_confirmation_instructions
183
+ send_confirmation_instructions
184
+ end
185
+
186
+ # Callback to overwrite if confirmation is required or not.
187
+ def confirmation_required?
188
+ !confirmed?
189
+ end
190
+
191
+ # Checks if the confirmation for the user is within the limit time.
192
+ # We do this by calculating if the difference between today and the
193
+ # confirmation sent date does not exceed the confirm in time configured.
194
+ # allow_unconfirmed_access_for is a model configuration, must always be an integer value.
195
+ #
196
+ # Example:
197
+ #
198
+ # # allow_unconfirmed_access_for = 1.day and confirmation_sent_at = today
199
+ # confirmation_period_valid? # returns true
200
+ #
201
+ # # allow_unconfirmed_access_for = 5.days and confirmation_sent_at = 4.days.ago
202
+ # confirmation_period_valid? # returns true
203
+ #
204
+ # # allow_unconfirmed_access_for = 5.days and confirmation_sent_at = 5.days.ago
205
+ # confirmation_period_valid? # returns false
206
+ #
207
+ # # allow_unconfirmed_access_for = 0.days
208
+ # confirmation_period_valid? # will always return false
209
+ #
210
+ # # allow_unconfirmed_access_for = nil
211
+ # confirmation_period_valid? # will always return true
212
+ #
213
+ def confirmation_period_valid?
214
+ return true if self.class.allow_unconfirmed_access_for.nil?
215
+ return false if self.class.allow_unconfirmed_access_for == 0.days
216
+
217
+ confirmation_sent_at && confirmation_sent_at.utc >= self.class.allow_unconfirmed_access_for.ago
218
+ end
219
+
220
+ # Checks if the user confirmation happens before the token becomes invalid
221
+ # Examples:
222
+ #
223
+ # # confirm_within = 3.days and confirmation_sent_at = 2.days.ago
224
+ # confirmation_period_expired? # returns false
225
+ #
226
+ # # confirm_within = 3.days and confirmation_sent_at = 4.days.ago
227
+ # confirmation_period_expired? # returns true
228
+ #
229
+ # # confirm_within = nil
230
+ # confirmation_period_expired? # will always return false
231
+ #
232
+ def confirmation_period_expired?
233
+ self.class.confirm_within && self.confirmation_sent_at && (Time.now.utc > self.confirmation_sent_at.utc + self.class.confirm_within)
234
+ end
235
+
236
+ # Checks whether the record requires any confirmation.
237
+ def pending_any_confirmation
238
+ if (!confirmed? || pending_reconfirmation?)
239
+ yield
240
+ else
241
+ self.errors.add(:email, :already_confirmed)
242
+ false
243
+ end
244
+ end
245
+
246
+ # Generates a new random token for confirmation, and stores
247
+ # the time this token is being generated in confirmation_sent_at
248
+ def generate_confirmation_token
249
+ if self.confirmation_token && !confirmation_period_expired?
250
+ @raw_confirmation_token = self.confirmation_token
251
+ else
252
+ self.confirmation_token = @raw_confirmation_token = Kingsman.friendly_token
253
+ self.confirmation_sent_at = Time.now.utc
254
+ end
255
+ end
256
+
257
+ def generate_confirmation_token!
258
+ generate_confirmation_token && save(validate: false)
259
+ end
260
+
261
+
262
+ def postpone_email_change_until_confirmation_and_regenerate_confirmation_token
263
+ @reconfirmation_required = true
264
+ self.unconfirmed_email = self.email
265
+ self.email = self.kingsman_email_in_database
266
+ self.confirmation_token = nil
267
+ generate_confirmation_token
268
+ end
269
+
270
+ def postpone_email_change?
271
+ postpone = self.class.reconfirmable &&
272
+ kingsman_will_save_change_to_email? &&
273
+ !@bypass_confirmation_postpone &&
274
+ self.email.present? &&
275
+ (!@skip_reconfirmation_in_callback || !self.kingsman_email_in_database.nil?)
276
+ @bypass_confirmation_postpone = false
277
+ postpone
278
+ end
279
+
280
+ def reconfirmation_required?
281
+ self.class.reconfirmable && @reconfirmation_required && (self.email.present? || self.unconfirmed_email.present?)
282
+ end
283
+
284
+ def send_confirmation_notification?
285
+ confirmation_required? && !@skip_confirmation_notification && self.email.present?
286
+ end
287
+
288
+ # With reconfirmable, notify the original email when the user first
289
+ # requests the email change, instead of when the change is confirmed.
290
+ def send_email_changed_notification?
291
+ if self.class.reconfirmable
292
+ self.class.send_email_changed_notification && reconfirmation_required?
293
+ else
294
+ super
295
+ end
296
+ end
297
+
298
+ # A callback initiated after successfully confirming. This can be
299
+ # used to insert your own logic that is only run after the user successfully
300
+ # confirms.
301
+ #
302
+ # Example:
303
+ #
304
+ # def after_confirmation
305
+ # self.update_attribute(:invite_code, nil)
306
+ # end
307
+ #
308
+ def after_confirmation
309
+ end
310
+
311
+ module ClassMethods
312
+ # Attempt to find a user by its email. If a record is found, send new
313
+ # confirmation instructions to it. If not, try searching for a user by unconfirmed_email
314
+ # field. If no user is found, returns a new user with an email not found error.
315
+ # Options must contain the user email
316
+ def send_confirmation_instructions(attributes = {})
317
+ confirmable = find_by_unconfirmed_email_with_errors(attributes) if reconfirmable
318
+ unless confirmable.try(:persisted?)
319
+ confirmable = find_or_initialize_with_errors(confirmation_keys, attributes, :not_found)
320
+ end
321
+ confirmable.resend_confirmation_instructions if confirmable.persisted?
322
+ confirmable
323
+ end
324
+
325
+ # Find a user by its confirmation token and try to confirm it.
326
+ # If no user is found, returns a new user with an error.
327
+ # If the user is already confirmed, create an error for the user
328
+ # Options must have the confirmation_token
329
+ def confirm_by_token(confirmation_token)
330
+ # When the `confirmation_token` parameter is blank, if there are any users with a blank
331
+ # `confirmation_token` in the database, the first one would be confirmed here.
332
+ # The error is being manually added here to ensure no users are confirmed by mistake.
333
+ # This was done in the model for convenience, since validation errors are automatically
334
+ # displayed in the view.
335
+ if confirmation_token.blank?
336
+ confirmable = new
337
+ confirmable.errors.add(:confirmation_token, :blank)
338
+ return confirmable
339
+ end
340
+
341
+ confirmable = find_first_by_auth_conditions(confirmation_token: confirmation_token)
342
+
343
+ unless confirmable
344
+ confirmation_digest = Kingsman.token_generator.digest(self, :confirmation_token, confirmation_token)
345
+ confirmable = find_or_initialize_with_error_by(:confirmation_token, confirmation_digest)
346
+ end
347
+
348
+ # TODO: replace above lines with
349
+ # confirmable = find_or_initialize_with_error_by(:confirmation_token, confirmation_token)
350
+ # after enough time has passed that Kingsman clients do not use digested tokens
351
+
352
+ confirmable.confirm if confirmable.persisted?
353
+ confirmable
354
+ end
355
+
356
+ # Find a record for confirmation by unconfirmed email field
357
+ def find_by_unconfirmed_email_with_errors(attributes = {})
358
+ attributes = attributes.slice(*confirmation_keys).permit!.to_h if attributes.respond_to? :permit
359
+ unconfirmed_required_attributes = confirmation_keys.map { |k| k == :email ? :unconfirmed_email : k }
360
+ unconfirmed_attributes = attributes.symbolize_keys
361
+ unconfirmed_attributes[:unconfirmed_email] = unconfirmed_attributes.delete(:email)
362
+ find_or_initialize_with_errors(unconfirmed_required_attributes, unconfirmed_attributes, :not_found)
363
+ end
364
+
365
+ Kingsman::Models.config(self, :allow_unconfirmed_access_for, :confirmation_keys, :reconfirmable, :confirm_within)
366
+ end
367
+ end
368
+ end
369
+ end
@@ -0,0 +1,206 @@
1
+ # frozen_string_literal: true
2
+
3
+ require 'kingsman/strategies/database_authenticatable'
4
+
5
+ module Kingsman
6
+ module Models
7
+ # Authenticatable Module, responsible for hashing the password and
8
+ # validating the authenticity of a user while signing in.
9
+ #
10
+ # This module defines a `password=` method. This method will hash the argument
11
+ # and store it in the `encrypted_password` column, bypassing any pre-existing
12
+ # `password` column if it exists.
13
+ #
14
+ # == Options
15
+ #
16
+ # DatabaseAuthenticatable adds the following options to +kingsman+:
17
+ #
18
+ # * +pepper+: a random string used to provide a more secure hash. Use
19
+ # `rails secret` to generate new keys.
20
+ #
21
+ # * +stretches+: the cost given to bcrypt.
22
+ #
23
+ # * +send_email_changed_notification+: notify original email when it changes.
24
+ #
25
+ # * +send_password_change_notification+: notify email when password changes.
26
+ #
27
+ # == Examples
28
+ #
29
+ # User.find(1).valid_password?('password123') # returns true/false
30
+ #
31
+ module DatabaseAuthenticatable
32
+ extend ActiveSupport::Concern
33
+
34
+ included do
35
+ after_update :send_email_changed_notification, if: :send_email_changed_notification?
36
+ after_update :send_password_change_notification, if: :send_password_change_notification?
37
+
38
+ attr_reader :password, :current_password
39
+ attr_accessor :password_confirmation
40
+ end
41
+
42
+ def initialize(*args, &block)
43
+ @skip_email_changed_notification = false
44
+ @skip_password_change_notification = false
45
+ super
46
+ end
47
+
48
+ # Skips sending the email changed notification after_update
49
+ def skip_email_changed_notification!
50
+ @skip_email_changed_notification = true
51
+ end
52
+
53
+ # Skips sending the password change notification after_update
54
+ def skip_password_change_notification!
55
+ @skip_password_change_notification = true
56
+ end
57
+
58
+ def self.required_fields(klass)
59
+ [:encrypted_password] + klass.authentication_keys
60
+ end
61
+
62
+ # Generates a hashed password based on the given value.
63
+ # For legacy reasons, we use `encrypted_password` to store
64
+ # the hashed password.
65
+ def password=(new_password)
66
+ @password = new_password
67
+ self.encrypted_password = password_digest(@password) if @password.present?
68
+ end
69
+
70
+ # Verifies whether a password (ie from sign in) is the user password.
71
+ def valid_password?(password)
72
+ Kingsman::Encryptor.compare(encrypted_password, password)
73
+ end
74
+
75
+ # Set password and password confirmation to nil
76
+ def clean_up_passwords
77
+ self.password = self.password_confirmation = nil
78
+ end
79
+
80
+ # Update record attributes when :current_password matches, otherwise
81
+ # returns error on :current_password.
82
+ #
83
+ # This method also rejects the password field if it is blank (allowing
84
+ # users to change relevant information like the e-mail without changing
85
+ # their password). In case the password field is rejected, the confirmation
86
+ # is also rejected as long as it is also blank.
87
+ def update_with_password(params, *options)
88
+ current_password = params.delete(:current_password)
89
+
90
+ # Note: the reject_blank_password is a kingsman only option (not in Devise)
91
+ opts = options.extract_options!
92
+ if params[:password].blank? && opts[:reject_blank_password] != false
93
+ params.delete(:password)
94
+ params.delete(:password_confirmation) if params[:password_confirmation].blank?
95
+ end
96
+
97
+ result = if valid_password?(current_password)
98
+ update(params, *options)
99
+ else
100
+ assign_attributes(params, *options)
101
+ valid?
102
+ errors.add(:current_password, current_password.blank? ? :blank : :invalid)
103
+ false
104
+ end
105
+
106
+ clean_up_passwords
107
+ result
108
+ end
109
+
110
+ # Updates record attributes without asking for the current password.
111
+ # Never allows a change to the current password. If you are using this
112
+ # method, you should probably override this method to protect other
113
+ # attributes you would not like to be updated without a password.
114
+ #
115
+ # Example:
116
+ #
117
+ # def update_without_password(params)
118
+ # params.delete(:email)
119
+ # super(params)
120
+ # end
121
+ #
122
+ def update_without_password(params)
123
+ params.delete(:password)
124
+ params.delete(:password_confirmation)
125
+
126
+ result = update(params, *options)
127
+ clean_up_passwords
128
+ result
129
+ end
130
+
131
+ # Destroy record when :current_password matches, otherwise returns
132
+ # error on :current_password. It also automatically rejects
133
+ # :current_password if it is blank.
134
+ def destroy_with_password(current_password)
135
+ result = if valid_password?(current_password)
136
+ destroy
137
+ else
138
+ valid?
139
+ errors.add(:current_password, current_password.blank? ? :blank : :invalid)
140
+ false
141
+ end
142
+
143
+ result
144
+ end
145
+
146
+ # A callback initiated after successfully authenticating. This can be
147
+ # used to insert your own logic that is only run after the user successfully
148
+ # authenticates.
149
+ #
150
+ # Example:
151
+ #
152
+ # def after_database_authentication
153
+ # self.update_attribute(:invite_code, nil)
154
+ # end
155
+ #
156
+ def after_database_authentication
157
+ end
158
+
159
+ # A reliable way to expose the salt regardless of the implementation.
160
+ def authenticatable_salt
161
+ encrypted_password[0,29] if encrypted_password
162
+ end
163
+
164
+ # Send notification to user when email changes.
165
+ def send_email_changed_notification
166
+ send_kingsman_notification(:email_changed, to: kingsman_email_before_last_save)
167
+ end
168
+
169
+ # Send notification to user when password changes.
170
+ def send_password_change_notification
171
+ send_kingsman_notification(:password_change)
172
+ end
173
+
174
+ protected
175
+
176
+ # Hashes the password using bcrypt. Custom hash functions should override
177
+ # this method to apply their own algorithm.
178
+ #
179
+ # See https://github.com/heartcombo/kingsman-encryptable for examples
180
+ # of other hashing engines.
181
+ def password_digest(password)
182
+ Kingsman::Encryptor.digest(password)
183
+ end
184
+
185
+ def send_email_changed_notification?
186
+ self.class.send_email_changed_notification && kingsman_saved_change_to_email? && !@skip_email_changed_notification
187
+ end
188
+
189
+ def send_password_change_notification?
190
+ self.class.send_password_change_notification && kingsman_saved_change_to_encrypted_password? && !@skip_password_change_notification
191
+ end
192
+
193
+ module ClassMethods
194
+ Kingsman::Models.config(self, :pepper, :stretches, :send_email_changed_notification, :send_password_change_notification)
195
+
196
+ # We assume this method already gets the sanitized values from the
197
+ # DatabaseAuthenticatable strategy. If you are using this method on
198
+ # your own, be sure to sanitize the conditions hash to only include
199
+ # the proper fields.
200
+ def find_for_database_authentication(conditions)
201
+ find_for_authentication(conditions)
202
+ end
203
+ end
204
+ end
205
+ end
206
+ end