loyal_devise 2.1.2 → 2.1.3

data/lib/devise/models/database_authenticatable.rb

@@ -1,4 +1,3 @@
-# -*- encoding : utf-8 -*-
 require 'devise/strategies/database_authenticatable'
 require 'bcrypt'
 
@@ -76,13 +75,13 @@ module Devise
       end
 
       # Updates record attributes without asking for the current password.
-      # Never allows to change the current password. If you are using this
+      # Never allows a change to the current password. If you are using this
       # method, you should probably override this method to protect other
       # attributes you would not like to be updated without a password.
       #
       # Example:
       #
-      #   def update_without_password(params={})
+      #   def update_without_password(params, *options)
       #     params.delete(:email)
       #     super(params)
       #   end
@@ -96,6 +95,21 @@ module Devise
         result
       end
 
+      # Destroy record when :current_password matches, otherwise returns
+      # error on :current_password. It also automatically rejects 
+      # :current_password if it is blank.
+      def destroy_with_password(current_password)
+        result = if valid_password?(current_password)
+          destroy
+        else
+          self.valid?
+          self.errors.add(:current_password, current_password.blank? ? :blank : :invalid)
+          false
+        end
+
+        result
+      end
+
       def after_database_authentication
       end
 

data/lib/devise/models/lockable.rb

@@ -1,4 +1,3 @@
-# -*- encoding : utf-8 -*-
 require "devise/hooks/lockable"
 
 module Devise
@@ -56,7 +55,7 @@ module Devise
 
       # Verifies whether a user is locked or not.
       def access_locked?
-        locked_at && !lock_expired?
+        !!locked_at && !lock_expired?
       end
 
       # Send unlock instructions by email

data/lib/devise/models/omniauthable.rb

@@ -1,4 +1,3 @@
-# -*- encoding : utf-8 -*-
 require 'devise/omniauth'
 
 module Devise
@@ -9,7 +8,7 @@ module Devise
     #
     # Oauthable adds the following options to devise_for:
     #
-    #   * +omniauth_providers+: Which providers are avaialble to this model. It expects an array:
+    #   * +omniauth_providers+: Which providers are available to this model. It expects an array:
     #
     #       devise_for :database_authenticatable, :omniauthable, :omniauth_providers => [:twitter]
     #

data/lib/devise/models/recoverable.rb

@@ -1,8 +1,7 @@
-# -*- encoding : utf-8 -*-
 module Devise
   module Models
 
-    # Recoverable takes care of reseting the user password and send reset instructions.
+    # Recoverable takes care of resetting the user password and send reset instructions.
     #
     # ==Options
     #
@@ -45,10 +44,15 @@ module Devise
 
       # Resets reset password token and send reset password instructions by email
       def send_reset_password_instructions
-        generate_reset_password_token! if should_generate_reset_token?
+        ensure_reset_password_token!
         send_devise_notification(:reset_password_instructions)
       end
-
+      
+      # Generate reset password token unless already exists and save the record.
+      def ensure_reset_password_token!
+        generate_reset_password_token! if should_generate_reset_token?
+      end 
+      
       # Checks if the reset password token sent is within the limit time.
       # We do this by calculating if the difference between today and the
       # sending date does not exceed the confirm in time configured.
@@ -103,9 +107,9 @@ module Devise
 
       module ClassMethods
         # Attempt to find a user by its email. If a record is found, send new
-        # password instructions to it. If not user is found, returns a new user
+        # password instructions to it. If user is not found, returns a new user
         # with an email not found error.
-        # Attributes must contain the user email
+        # Attributes must contain the user's email
         def send_reset_password_instructions(attributes={})
           recoverable = find_or_initialize_with_errors(reset_password_keys, attributes, :not_found)
           recoverable.send_reset_password_instructions if recoverable.persisted?

data/lib/devise/models/registerable.rb

@@ -1,4 +1,3 @@
-# -*- encoding : utf-8 -*-
 module Devise
   module Models
     # Registerable is responsible for everything related to registering a new

data/lib/devise/models/rememberable.rb

@@ -1,4 +1,3 @@
-# -*- encoding : utf-8 -*-
 require 'devise/strategies/rememberable'
 require 'devise/hooks/rememberable'
 require 'devise/hooks/forgetable'
@@ -51,7 +50,7 @@ module Devise
       def remember_me!(extend_period=false)
         self.remember_token = self.class.remember_token if generate_remember_token?
         self.remember_created_at = Time.now.utc if generate_remember_timestamp?(extend_period)
-        save(:validate => false)
+        save(:validate => false) if self.changed?
       end
 
       # If the record is persisted, remove the remember token (but only if

data/lib/devise/models/timeoutable.rb

@@ -1,9 +1,8 @@
-# -*- encoding : utf-8 -*-
 require 'devise/hooks/timeoutable'
 
 module Devise
   module Models
-    # Timeoutable takes care of veryfing whether a user session has already
+    # Timeoutable takes care of verifyng whether a user session has already
     # expired or not. When a session expires after the configured time, the user
     # will be asked for credentials again, it means, he/she will be redirected
     # to the sign in page.

data/lib/devise/models/token_authenticatable.rb

@@ -1,4 +1,3 @@
-# -*- encoding : utf-8 -*-
 require 'devise/strategies/token_authenticatable'
 
 module Devise

data/lib/devise/models/trackable.rb

@@ -1,4 +1,3 @@
-# -*- encoding : utf-8 -*-
 require 'devise/hooks/trackable'
 
 module Devise

data/lib/devise/models/validatable.rb

@@ -1,4 +1,3 @@
-# -*- encoding : utf-8 -*-
 module Devise
   module Models
     # Validatable creates all needed validations for a user email and password.

data/lib/devise/modules.rb

@@ -1,4 +1,3 @@
-# -*- encoding : utf-8 -*-
 require 'active_support/core_ext/object/with_options'
 
 Devise.with_options :model => true do |d|
@@ -27,4 +26,4 @@ Devise.with_options :model => true do |d|
 
   # Stats for last, so we make sure the user is really signed in
   d.add_module :trackable
-end
+end

data/lib/devise/omniauth.rb

@@ -1,4 +1,3 @@
-# -*- encoding : utf-8 -*-
 begin
   require "omniauth"
   require "omniauth/version"

data/lib/devise/omniauth/config.rb

@@ -1,4 +1,3 @@
-# -*- encoding : utf-8 -*-
 module Devise
   module OmniAuth
     class StrategyNotFound < NameError

data/lib/devise/omniauth/url_helpers.rb

@@ -1,4 +1,3 @@
-# -*- encoding : utf-8 -*-
 module Devise
   module OmniAuth
     module UrlHelpers

data/lib/devise/orm/active_record.rb

@@ -1,4 +1,3 @@
-# -*- encoding : utf-8 -*-
 require 'orm_adapter/adapters/active_record'
 
-ActiveRecord::Base.extend Devise::Models
+ActiveRecord::Base.extend Devise::Models

data/lib/devise/orm/mongoid.rb

@@ -1,4 +1,3 @@
-# -*- encoding : utf-8 -*-
 require 'orm_adapter/adapters/mongoid'
 
-Mongoid::Document::ClassMethods.send :include, Devise::Models
+Mongoid::Document::ClassMethods.send :include, Devise::Models

data/lib/devise/{param_filter.rb → parameter_filter.rb}

@@ -1,6 +1,5 @@
-# -*- encoding : utf-8 -*-
 module Devise
-  class ParamFilter
+  class ParameterFilter
     def initialize(case_insensitive_keys, strip_whitespace_keys)
       @case_insensitive_keys = case_insensitive_keys || []
       @strip_whitespace_keys = strip_whitespace_keys || []
@@ -9,16 +8,16 @@ module Devise
     def filter(conditions)
       conditions = stringify_params(conditions.dup)
 
-      @case_insensitive_keys.each do |k|
-        value = conditions[k]
-        next unless value.respond_to?(:downcase)
-        conditions[k] = value.downcase
-      end
+      conditions.merge!(filtered_hash_by_method_for_given_keys(conditions.dup, :downcase, @case_insensitive_keys))
+      conditions.merge!(filtered_hash_by_method_for_given_keys(conditions.dup, :strip, @strip_whitespace_keys))
+
+      conditions
+    end
 
-      @strip_whitespace_keys.each do |k|
+    def filtered_hash_by_method_for_given_keys(conditions, method, condition_keys)
+      condition_keys.each do |k|
         value = conditions[k]
-        next unless value.respond_to?(:strip)
-        conditions[k] = value.strip
+        conditions[k] = value.send(method) if value.respond_to?(method)
       end
 
       conditions
@@ -34,9 +33,8 @@ module Devise
 
     private
 
-    # Determine which values should be transformed to string or passed as-is to the query builder underneath
     def param_requires_string_conversion?(value)
-      [Fixnum, TrueClass, FalseClass, Regexp].none? {|clz| value.is_a? clz }
+      true
     end
   end
 end

data/lib/devise/parameter_sanitizer.rb

@@ -0,0 +1,59 @@
+module Devise
+  class BaseSanitizer
+    attr_reader :params, :resource_name, :resource_class
+
+    def initialize(resource_class, resource_name, params)
+      @resource_class = resource_class
+      @resource_name  = resource_name
+      @params         = params
+      @blocks         = Hash.new
+    end
+
+    def for(kind, &block)
+      if block_given?
+        @blocks[kind] = block
+      else
+        block = @blocks[kind]
+        block ? block.call(default_params) : fallback_for(kind)
+      end
+    end
+
+    private
+
+    def fallback_for(kind)
+      default_params
+    end
+
+    def default_params
+      params.fetch(resource_name, {})
+    end
+  end
+
+  class ParameterSanitizer < BaseSanitizer
+    private
+
+    def fallback_for(kind)
+      if respond_to?(kind, true)
+        send(kind)
+      else
+        raise NotImplementedError, "Devise Parameter Sanitizer doesn't know how to sanitize parameters for #{kind}"
+      end
+    end
+
+    def sign_in
+      default_params.permit(*auth_keys)
+    end
+
+    def sign_up
+      default_params.permit(*(auth_keys + [:password, :password_confirmation]))
+    end
+
+    def account_update
+      default_params.permit(*(auth_keys + [:password, :password_confirmation, :current_password]))
+    end
+
+    def auth_keys
+      resource_class.authentication_keys
+    end
+  end
+end

data/lib/devise/rails.rb

@@ -1,4 +1,3 @@
-# -*- encoding : utf-8 -*-
 require 'devise/rails/routes'
 require 'devise/rails/warden_compat'
 

data/lib/devise/rails/routes.rb

@@ -1,4 +1,3 @@
-# -*- encoding : utf-8 -*-
 require "active_support/core_ext/object/try"
 require "active_support/core_ext/hash/slice"
 
@@ -251,15 +250,11 @@ module ActionDispatch::Routing
     #   end
     #
     #   authenticate :user, lambda {|u| u.role == "admin"} do
-    #     root :to => "admin/dashboard#show"
+    #     root :to => "admin/dashboard#show", :as => :user_root
     #   end
     #
     def authenticate(scope=nil, block=nil)
-      constraint = lambda do |request|
-        request.env["warden"].authenticate!(:scope => scope) && (block.nil? || block.call(request.env["warden"].user(scope)))
-      end
-
-      constraints(constraint) do
+      constraints_for(:authenticate!, scope, block) do
         yield
       end
     end
@@ -269,25 +264,21 @@ module ActionDispatch::Routing
     # a model and allows extra constraints to be done on the instance.
     #
     #   authenticated :admin do
-    #     root :to => 'admin/dashboard#show'
+    #     root :to => 'admin/dashboard#show', :as => :admin_root
     #   end
     #
     #   authenticated do
-    #     root :to => 'dashboard#show'
+    #     root :to => 'dashboard#show', :as => :authenticated_root
     #   end
     #
     #   authenticated :user, lambda {|u| u.role == "admin"} do
-    #     root :to => "admin/dashboard#show"
+    #     root :to => "admin/dashboard#show", :as => :user_root
     #   end
     #
     #   root :to => 'landing#show'
     #
     def authenticated(scope=nil, block=nil)
-      constraint = lambda do |request|
-        request.env["warden"].authenticate?(:scope => scope) && (block.nil? || block.call(request.env["warden"].user(scope)))
-      end
-
-      constraints(constraint) do
+      constraints_for(:authenticate?, scope, block) do
         yield
       end
     end
@@ -330,7 +321,7 @@ module ActionDispatch::Routing
     # good and working example.
     #
     #  devise_scope :user do
-    #    match "/some/route" => "some_devise_controller"
+    #    get "/some/route" => "some_devise_controller"
     #  end
     #  devise_for :users
     #
@@ -402,12 +393,14 @@ module ActionDispatch::Routing
         match "#{path_prefix}/:provider",
           :constraints => { :provider => providers },
           :to => "#{controllers[:omniauth_callbacks]}#passthru",
-          :as => :omniauth_authorize
+          :as => :omniauth_authorize,
+          :via => [:get, :post]
 
         match "#{path_prefix}/:action/callback",
           :constraints => { :action => providers },
           :to => controllers[:omniauth_callbacks],
-          :as => :omniauth_callback
+          :as => :omniauth_callback,
+          :via => [:get, :post]
       ensure
         @scope[:path] = path
       end
@@ -427,6 +420,17 @@ module ActionDispatch::Routing
         @scope.merge!(old)
       end
 
+      def constraints_for(method_to_apply, scope=nil, block=nil)
+        constraint = lambda do |request|
+          request.env['warden'].send(method_to_apply, :scope => scope) &&
+            (block.nil? || block.call(request.env["warden"].user(scope)))
+        end
+
+        constraints(constraint) do
+          yield
+        end
+      end
+
       def set_omniauth_path_prefix!(path_prefix) #:nodoc:
         if ::OmniAuth.config.path_prefix && ::OmniAuth.config.path_prefix != path_prefix
           raise "Wrong OmniAuth configuration. If you are getting this exception, it means that either:\n\n" \

data/lib/devise/rails/warden_compat.rb

@@ -1,4 +1,3 @@
-# -*- encoding : utf-8 -*-
 module Warden::Mixins::Common
   def request
     @request ||= ActionDispatch::Request.new(env)
@@ -13,32 +12,3 @@ module Warden::Mixins::Common
     request.cookie_jar
   end
 end
-
-class Warden::SessionSerializer
-  def serialize(record)
-    klass = record.class
-    array = klass.serialize_into_session(record)
-    array.unshift(klass.name)
-  end
-
-  def deserialize(keys)
-    klass_name, *args = keys
-
-    begin
-      klass = ActiveSupport::Inflector.constantize(klass_name)
-      if klass.respond_to? :serialize_from_session
-        klass.serialize_from_session(*args)
-      else
-        Rails.logger.warn "[Devise] Stored serialized class #{klass_name} seems not to be Devise enabled anymore. Did you do that on purpose?"
-        nil
-      end
-    rescue NameError => e
-      if e.message =~ /uninitialized constant/
-        Rails.logger.debug "[Devise] Trying to deserialize invalid class #{klass_name}"
-        nil
-      else
-        raise
-      end
-    end
-  end
-end

data/lib/devise/strategies/authenticatable.rb

@@ -1,4 +1,3 @@
-# -*- encoding : utf-8 -*-
 require 'devise/strategies/base'
 
 module Devise
@@ -101,7 +100,7 @@ module Devise
 
       # Extract a hash with attributes:values from the http params.
       def http_auth_hash
-        keys = [authentication_keys.first, :password]
+        keys = [http_authentication_key, :password]
         Hash[*keys.zip(decode_credentials).flatten]
       end
 
@@ -135,24 +134,27 @@ module Devise
         parse_authentication_key_values(request_values, request_keys)
       end
 
-      # Holds the authentication keys.
       def authentication_keys
         @authentication_keys ||= mapping.to.authentication_keys
       end
 
-      # Holds request keys.
+      def http_authentication_key
+        @http_authentication_key ||= mapping.to.http_authentication_key || case authentication_keys
+          when Array then authentication_keys.first
+          when Hash then authentication_keys.keys.first
+        end
+      end
+
       def request_keys
         @request_keys ||= mapping.to.request_keys
       end
 
-      # Returns values from the request object.
       def request_values
         keys = request_keys.respond_to?(:keys) ? request_keys.keys : request_keys
         values = keys.map { |k| self.request.send(k) }
         Hash[keys.zip(values)]
       end
 
-      # Parse authentication keys considering if they should be enforced or not.
       def parse_authentication_key_values(hash, keys)
         keys.each do |key, enforce|
           value = hash[key].presence